Subject: [wpkops] X.509 whitelist proposal

From: Tony Rutkowski <[email-masked]>
Date: Thu, 17 Jul 2014 18:49:56 -0400

Hi Steve,

The note below was distributed earlier on the ITU-T SG17
sub-group Q11/17 list by the group's rapporteur.  It might
be useful to gauge industry reaction in IETF and CA/B
Forum venues.

Note that although the document appears on an ITU-T
template, it has not been submitted.   In addition, although
the source is indicated as "Denmark," it is not apparent
that the source is any other than than the rapporteur
himself, who is identified as the contact.  Lastly, although
the note asserts that "IEC TC57 WG15 (smart grid
security) has requested the inclusion of whitelist
support in X.509," there is no apparent liaison to
this effect.

--tony

-------- Original Message --------
Subject: 	[T17Q11] X.509 whitelist support
Date: 	Thu, 17 Jul 2014 14:43:30 +0200
From: 	Erik Andersen <[email-masked]>
To: 	Directory list <[email-masked]>, SG17-Q11 
<[email-masked]>
CC: 	SG17-Q10 <[email-masked]>

IEC TC57 WG15 (smart grid security) has requested the inclusion of 
whitelist support in X.509. A preliminary proposal for such a feature 
may be found as 
http://www.x500standard.com/uploads/extensions/whitelistInX509.pdf

The feature may in some way be combined with the trust broker concept, 
which probably will involve a number of changes.

As it is quite important that we have workable solution, any comment is 
welcome. I hope you will find the time to review the proposal before it 
is submitted to ITU-T.

Kind regards,

Erik

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 18 Jul 2014 11:31:11 +0200

Hi Tony,

I can see you saved me the trouble to submit the proposal to the PKIX list.

I am not operating in a vacuum. I am currently involved in a smart grid
project within Denmark (http://www.chpcom.dk – in Danish unfortunately),
where use of PKI has been included.

There is some pressure by the major electricity company
(http://energinet.dk/EN/Sider/default.aspx)  to make me the Danish Member
representative in ITU-T SG17. It takes a lot of red tape. I am also active
in IEC TC57 WG15. As I mentioned, the proposal has been submitted to that
group for comments.

I will make an effort to get onto the wpkops mailing list.

I am interested in any constructive comment.

Kind regards,

Erik

Fra: pkix [mailto:[email-masked]] På vegne af Tony Rutkowski
Sendt: 18. juli 2014 00:50
Til: [email-masked]
Cc: [email-masked]; [email-masked]
Emne: [pkix] X.509 whitelist proposal

Hi Steve,

--tony

-------- Original Message -------- 

Subject: 

[T17Q11] X.509 whitelist support

Date: 

Thu, 17 Jul 2014 14:43:30 +0200

From: 

Erik Andersen  <mailto:[email-masked]> <[email-masked]>

To: 

Directory list  <mailto:[email-masked]>
<[email-masked]>, SG17-Q11  <mailto:[email-masked]>
<[email-masked]>

CC: 

SG17-Q10  <mailto:[email-masked]> <[email-masked]>

IEC TC57 WG15 (smart grid security) has requested the inclusion of whitelist
support in X.509. A preliminary proposal for such a feature may be found as
http://www.x500standard.com/uploads/extensions/whitelistInX509.pdf 

The feature may in some way be combined with the trust broker concept, which
probably will involve a number of changes.

As it is quite important that we have workable solution, any comment is
welcome. I hope you will find the time to review the proposal before it is
submitted to ITU-T.

Kind regards,

Erik

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 18 Jul 2014 13:02:54 +0100

Hi Tony,

Seems like an odd proposal all right.

Technically, I'd say it could do with a lot more work before
it'd be ready for prime time. For example, if a node only
wants to talk to a few others, why are there so many CAs or
"delegators" involved. Seems a bit silly to me tbh but maybe
I'm not getting the use-case. Its also obviously pretty much
an outline rather than a worked-out proposal. I'd also have
thought this likely to be sorted at another layer, e.g.
within CoAP maybe, where pre-shared keys with DTLS will be
common, and where there would as a result be no PKI at all.

Process wise, from the IETF perspective, I think we no longer
care really. While we used work closely with the ITU-T folks
on X.509, I've not really seen any benefit from that myself
for some years now. And afaik anyone who cares just implements
from RFC 5280 anyway so changes to X.509 are pretty much fine
to ignore.

But I'd be interested in hearing if there are in fact IETF
participants who continue to think its important that we pay
attention to these kinds of changes to X.509. And, if you do,
then please say what if anything you think we ought say about
such changes proposed within ITU-T. (On or off-list is fine.)

Cheers,
S.

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 18 Jul 2014 08:10:44 -0400

Hi Erik,

You have been participating long enough in the ITU-T
to know that it is an intergovernmental body, and one
cannot simply create a contribution using a Member
nation's name - even if you are a citizen - because
you don't like the "red tape."  It is the Danish
Administration - the Ministry of Business and
Growth - that gets to make submissions for
Denmark, not you.

Denmark ten years ago reduced its ITU financial
contribution by more than a half, and has not
submitted a document into the ITU-T since at
least 2001.  It thus seems unlikely this will occur.

You now say that "the proposal has been submitted
to that group [IEC TC57 WG15} for comments," whereas
your previous message said it "has requested the
inclusion of whitelist support in X.509."

I don't mean to be harsh or difficult here, but your
proposal is far reaching with profound effects on
X.509/PKI communities and implementations.  This
material also appears to be your own personal
proposal with no other apparent support.  You
should be proceeding to get reactions and support
from others on your ideas before attributing them
to a Member State or using your position as Q11/17
rapporteur to advance them.

--tony

On 2014-07-18 5:31 AM, Erik Andersen wrote:
> (http://energinet.dk/EN/Sider/default.aspx)  to make me the Danish 
> Member representative in ITU-T SG17. It takes a lot of red tape. I am 
> also active in IEC TC57 WG15. As I mentioned, the proposal has been 
> submitted to that group for comments.
>

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 18 Jul 2014 14:46:42 +0200

Hi Tony,

I have no intention to submit a contribution without the permission from the
Danish ministry. I would be killed.  Before I can submit it, it has to be
approved by two different Danish authorities. The agreement is that I first
distribute it among experts to get any constructive comments that could
improve the proposal before getting it through the approval process within
Denmark.

One use case is as follows:

An electrical substation (e.g. transformation) has many interconnected
entities. One of these entities is the contact to the outside world. If
something happens within the substation, the situation has to be detected,
commands have to be sent to other entities that that have to process the
command and react to the commands. All this must happens within 10 ms. False
commands would be disastrous in this environment, so authentication is
necessary, but there is no time to validate a long certification path, to
consult OCSP, etc. It is an environment very different from a browser
environment and old solutions do not work here.

Kind regards,

Erik 

Fra: Tony Rutkowski [mailto:[email-masked]] 
Sendt: 18. juli 2014 14:11
Til: Erik Andersen; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; SG17-Q11
Emne: Re: [T17Q11] SV: [pkix] X.509 whitelist proposal

Hi Erik,

--tony

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 18 Jul 2014 09:21:45 -0400

Hmm, what are you trying to achieve here. Are you trying to develop a
standard that is likely to be adopted and used by Microsoft, IBM,
Google and the CA industry or are you trying to get ITU imprimatur for
something that is already developed?

If it is the first then I can't see any likelihood that an ITU
publication would help in the slightest. The mainstream IT industry is
adamant that communications standards have to be open standards. And
paying for a standard completely kills it dead. So does use of ASN.1

IETF does already have SCVP which has many of the features you propose
and W3C did XKMS back in the day. These days however the trend is for
JSON.

I have a proposal for a 'broker' type scheme that is a bit more
general than the one you propose. Rather than being a broker for just
PKI information, the broker is potentially a one stop shop for all the
information that a client might need to connect to another network
entity or validate a connection request.

http://prismproof.org/ has links to the papers which are the OmniQuery
and OmniPublish Web Services.

On Fri, Jul 18, 2014 at 8:46 AM, Erik Andersen <[email-masked]> wrote:
> _______________________________________________
> wpkops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wpkops
>

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 18 Jul 2014 16:29:22 +0200

Hi Phillip,

Thanks for your comment. I will certainly look at SCVP.

I expect the proposal will primarily be picked-up by companies working on smart grid support not too biased by old thinking.

The (smart) grid uses the SCADA (Supervisory Control And Data Acquisition) protocols, a very large set of protocol standards. These standards are developed by IEC TC57  and being implemented all over the world. We have several SCADA experts even in a small country like Denmark. WG15 of IEC TC57 is working on Smart Grid security and is working closely with ITU-T Study Group 17 to extend X.509 to cover their needs.

To answer your question. Software support for PKI adapted to Smart Grid will most likely be provided by those developing SCADA. Siemens could be a major player. At least they have a heavy interest in the matter. It could be big business. Even in a small country like Denmark, there will be millions of communicating entities, including smart meters, heat pumps, solar cells, load stations for cars, substations, wind turbines, power stations, etc. 

Smart Grid will be a prime target for terrorist attacks. Whether we can provide the necessary security, time will show.

We also see a need for machine readable certificate policies. As an example, currently X.509 (and 5280) says that an unsupported non-critical extension shall be ignored by the RP. That is not good enough, but that is how browsers work.

Kind regards,

Erik

-----Oprindelig meddelelse-----
Fra: [email-masked] [mailto:[email-masked]] På vegne af Phillip Hallam-Baker
Sendt: 18. juli 2014 15:22
Til: Erik Andersen
Cc: Tony Rutkowski; [email-masked]; Stephen Farrell; [email-masked]; Directory list; [email-masked]; SG17-Q11
Emne: Re: [wpkops] [T17Q11] SV: [pkix] X.509 whitelist proposal

Hmm, what are you trying to achieve here. Are you trying to develop a standard that is likely to be adopted and used by Microsoft, IBM, Google and the CA industry or are you trying to get ITU imprimatur for something that is already developed?

If it is the first then I can't see any likelihood that an ITU publication would help in the slightest. The mainstream IT industry is adamant that communications standards have to be open standards. And paying for a standard completely kills it dead. So does use of ASN.1

IETF does already have SCVP which has many of the features you propose and W3C did XKMS back in the day. These days however the trend is for JSON.

I have a proposal for a 'broker' type scheme that is a bit more general than the one you propose. Rather than being a broker for just PKI information, the broker is potentially a one stop shop for all the information that a client might need to connect to another network entity or validate a connection request.

http://prismproof.org/ has links to the papers which are the OmniQuery and OmniPublish Web Services.

On Fri, Jul 18, 2014 at 8:46 AM, Erik Andersen <[email-masked]> wrote:
> Hi Tony,
>
>
>
> I have no intention to submit a contribution without the permission 
> from the Danish ministry. I would be killed.  Before I can submit it, 
> it has to be approved by two different Danish authorities. The 
> agreement is that I first distribute it among experts to get any 
> constructive comments that could improve the proposal before getting 
> it through the approval process within Denmark.
>
>
>
> entities. One of these entities is the contact to the outside world. 
> If something happens within the substation, the situation has to be 
> detected, commands have to be sent to other entities that that have to 
> process the command and react to the commands. All this must happens 
> within 10 ms. False commands would be disastrous in this environment, 
> so authentication is necessary, but there is no time to validate a 
> long certification path, to consult OCSP, etc. It is an environment 
> very different from a browser environment and old solutions do not work here.
>
>
>
> Kind regards,
>
>
>
> Erik
>
>
>
> You have been participating long enough in the ITU-T to know that it 
> is an intergovernmental body, and one cannot simply create a 
> contribution using a Member nation's name - even if you are a citizen 
> - because you don't like the "red tape."  It is the Danish 
> Administration - the Ministry of Business and Growth - that gets to 
> make submissions for Denmark, not you.
>
> Denmark ten years ago reduced its ITU financial contribution by more 
> than a half, and has not submitted a document into the ITU-T since at 
> You now say that "the proposal has been submitted to that group [IEC 
> TC57 WG15} for comments," whereas your previous message said it "has 
> requested the inclusion of whitelist support in X.509."
>
> I don't mean to be harsh or difficult here, but your proposal is far 
> reaching with profound effects on X.509/PKI communities and 
> implementations.  This material also appears to be your own personal 
> proposal with no other apparent support.  You should be proceeding to 
> get reactions and support from others on your ideas before attributing 
> them to a Member State or using your position as Q11/17 rapporteur to 
> advance them.
>
> --tony
>

---

From: Tony Rutkowski <[email-masked]>
Date: Fri, 18 Jul 2014 13:47:21 -0400

Hi Phillip,

The challenges of applying PKI to SmartGrids
has been worked within NIST's SmartGrid security
group and equivalents in other venues over the
past five years or more.  See the group's twicki at
http://collaborate.nist.gov/twiki-sggrid/bin/view/SmartGrid/CyberSecurityCTG
Volume 1 of the associated NISTR 7628, and a Rev. 1
in draft was produced last year.  See
http://csrc.nist.gov/publications/drafts/nistir-7628-r1/draft_nistir_7628_r1_vol1.pdf

There was a good article providing an overview in
the first issue of IEEE Transactions on SmartGrid.  See
http://www.csit.qub.ac.uk/media/pdf/Filetoupload,286700,en.pdf

The entire last ITU-T SG17 meeting had barely a hundred
attendees.  The PKI group Q11/17 had only three input
contributions (2 from Korea's ETRI, and one from China -
both dealing with non-PKI matters) and only a handful of
people present.  It is the last remaining UN intergovernmental
technical standards body in the sector and rapidly dying, so
it seems a stretch that anything will be pursued there.
Now doing it in the IETF is another matter!

--tony

ps. On the positive side, the ITU-T standards are now free.

---

From: Erwann Abalea <[email-masked]>
Date: Mon, 21 Jul 2014 12:08:24 +0200

Bonjour,

2014-07-18 19:47 GMT+02:00 Tony Rutkowski <[email-masked]>:

> [...]

Not true anymore. X.5xx recommendations are again available for a fee, at
least the 2012-10 editions.

-- 
Erwann.

---

From: "Erik Andersen" <[email-masked]>
Date: Mon, 21 Jul 2014 14:12:27 +0200

Hi,

The X.5xx documents freely available are listed on http://www.x500standard.com/index.php?n=Ig.LatestAvail.

The X.5xx documents not freely available are listed on http://www.x500standard.com/index.php?n=Ig.Latest.

Erik

-----Oprindelig meddelelse-----
Fra: [email-masked] [mailto:[email-masked]] På vegne af Olivier Dubuisson
Sendt: 21. juli 2014 11:54
Til: 'Phillip Hallam-Baker'
Cc: [email-masked]; 'Directory list'; [email-masked]; 'SG17-Q11'
Emne: [x500standard] Re: SV: [wpkops] [T17Q11] SV: [pkix] X.509 whitelist proposal

ITU-T Recommendations are free and ASN.1 has been freely available for many years.

O. Dubuisson

> paying for a standard completely kills it dead. So does use of ASN.1
-----
www.x500standard.com: The central source for information on the X.500 Directory Standard.

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 21 Jul 2014 08:27:18 -0400

Of course,  what Erik didn't tell you is that
the ITU-T still foolishly does not make them
freely available the first year after they are
adopted - in order to extract a few extra Swiss
francs out of the system.

--tony

On 2014-07-21 8:12 AM, Erik Andersen wrote:
> Hi,
>
> The X.5xx documents freely available are listed onhttp://www.x500standard.com/index.php?n=Ig.LatestAvail.
>
> The X.5xx documents not freely available are listed onhttp://www.x500standard.com/index.php?n=Ig.Latest.
>
> Erik

---

From: "Erik Andersen" <[email-masked]>
Date: Wed, 23 Jul 2014 09:52:41 +0200

Hi Olivier,

I do not recall ever to have written that. I certainly do not mean that.

Kind regards,

Erik

-----Oprindelig meddelelse-----
Fra: pkix [mailto:[email-masked]] På vegne af Olivier Dubuisson
Sendt: 21. juli 2014 11:54
Til: 'Phillip Hallam-Baker'
Cc: 'SG17-Q11'; [email-masked]; [email-masked]; 'Directory list'
Emne: Re: [pkix] [wpkops] [T17Q11] SV: X.509 whitelist proposal

ITU-T Recommendations are free and ASN.1 has been freely available for many
years.

O. Dubuisson

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Massimiliano Pala <[email-masked]>
Date: Thu, 24 Jul 2014 10:26:14 -0400

Hi Erik, all,

At first glance (very clear), It seems to me that this proposal is in 
between SCVP (that might be a bit complicated to implement in small 
SCADA devices) (RFC 5055), TAMP (RFC 5934), and CMC 
(id-cmc-trustedAnchors) (RFC 5272 - Section 6.15 / RFC 6402) messages.

I would suggest you look into those those options as well.

Cheers,
Max

---

From: "Erik Andersen" <[email-masked]>
Date: Thu, 24 Jul 2014 16:40:22 +0200

Hi Max,

Thank you very much. I will follow your advice.

Kind regards,

Erik

-----Oprindelig meddelelse-----
Fra: wpkops [mailto:[email-masked]] På vegne af Massimiliano Pala
Sendt: 24. juli 2014 16:26
Til: [email-masked]
Emne: Re: [wpkops] [T17Q11] SV: [pkix] X.509 whitelist proposal

Hi Erik, all,

At first glance (very clear), It seems to me that this proposal is in between SCVP (that might be a bit complicated to implement in small SCADA devices) (RFC 5055), TAMP (RFC 5934), and CMC
(id-cmc-trustedAnchors) (RFC 5272 - Section 6.15 / RFC 6402) messages.

Cheers,
Max

On 7/18/14, 10:29 AM, Erik Andersen wrote:
> Cc: Tony Rutkowski; [email-masked]; Stephen Farrell; 
> [email-masked]; Directory list; [email-masked]; SG17-Q11
>> An electrical substation (e.g. transformation) has many 
>> interconnected entities. One of these entities is the contact to the outside world.
>> detected, commands have to be sent to other entities that that have 
>> to process the command and react to the commands. All this must 
>> happens within 10 ms. False commands would be disastrous in this 
>> environment, so authentication is necessary, but there is no time to 
>> validate a long certification path, to consult OCSP, etc. It is an 
>> environment very different from a browser environment and old solutions do not work here.
>>
>>
>>
>> Kind regards,
>>
>>
>>
>> Erik
>>
>>
>>
>> get reactions and support from others on your ideas before 
>> attributing them to a Member State or using your position as Q11/17

---

From: Olivier Dubuisson <[email-masked]>
Date: Mon, 21 Jul 2014 11:54:21 +0200

ITU-T Recommendations are free and ASN.1 has been freely available for 
many years.

O. Dubuisson

---

From: "Sill, Alan" <[email-masked]>
Date: Thu, 31 Jul 2014 21:17:13 +0000

Erik,

With the desire to wind this discussion back to its actual content and avoid for the present further discussion of procedures, let me say that the use case proposed is a familiar one in the world of extended use of PKI as an authentication piece of access control systems in distributed infrastructure environments.

The solution invariably is to implement a separate authorization layer that can work with the existing certificate infrastructure, which is out or scope as a work item for any of the proposed groups.

My personal belief is that this is not worth pursuing in its present form. I would be happy, off-list or on an individual basis, to pass on some of the solutions that I have seen work in practice in distributed computational, storage and other related control settings, some of which can be achieved within the existing X.509 settings through the use, for example, of time limited or otherwise membership-limited extended attribute certificates.

My suggestion, with great respect and due deference to its proposers, is to drop the referenced proposal until exploration of appropriate authorization technologies has been done and again offer to have that discussion off these lists or on a different one.

Alan Sill, TTU
VP of Standards, Open Grid Forum

On Jul 18, 2014, at 12:49 AM, Tony Rutkowski <[email-masked]<mailto:[email-masked]>> wrote:

Hi Steve,

--tony

-------- Original Message --------
Subject:        [T17Q11] X.509 whitelist support
Date:   Thu, 17 Jul 2014 14:43:30 +0200
From:   Erik Andersen <[email-masked]><mailto:[email-masked]>
To:     Directory list <[email-masked]><mailto:[email-masked]>, SG17-Q11 <[email-masked]><mailto:[email-masked]>
CC:     SG17-Q10 <[email-masked]><mailto:[email-masked]>

IEC TC57 WG15 (smart grid security) has requested the inclusion of whitelist support in X.509. A preliminary proposal for such a feature may be found as http://www.x500standard.com/uploads/extensions/whitelistInX509.pdf

The feature may in some way be combined with the trust broker concept, which probably will involve a number of changes.

As it is quite important that we have workable solution, any comment is welcome. I hope you will find the time to review the proposal before it is submitted to ITU-T.

Kind regards,

Erik

<whitelistInX509.pdf>_______________________________________________
pkix mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/pkix