1. 2/29/2004Profile-04 open issues draft-ietf-ipsec-pki-profile-04.txt (Potentially) Open Issues Gregory M Lebovitz gregory@netscreen.com

2. 2/29/2004Profile-04 open issues Overview NAT-T considerations? Certificate Type? PKI Life Cycle Stuff pass in-band? Critical Bit? 2401bis sync’ing? CDP / AIA ?

3. 2/29/2004Profile-04 open issues NAT-T How or Does NAT-T stuff affect us? Owner to write text and own this part of the document?

4. 2/29/2004Profile-04 open issues Certificate Type? PKIX? –Signing? DNSsec signed stuff? PGP? Kerberos? SPKI Certificates? PKIX Attribute Certificates? PROPOSAL: –PKIX x.509 w/ RSA with SHA-1. DONE.

5. 2/29/2004Profile-04 open issues PKI LifeCycle Stuff In-Band? CRLs? Intermediate Certs? Trust Anchors? Other revocation information?

6. 2/29/2004Profile-04 open issues LifeCycle Stuff - PROPOSAL Philosophy: –Put all life cycle stuff in its own bucket, out of band of IKE, as a rule. It will be handled in charter items [2] and [3] –Minimize fragmentation and bloat to avoid UDP frag (FW’s choke on it) –Neither v1 nor v2 has adequate expression for querying detailed PKI elements, for revocation and intermediate certs. Proposal - MUST NOT REQUEST or SEND: –CRLs –Trust Anchors –Intermediate Certs –other revocation info

7. 2/29/2004Profile-04 open issues Critical Bit Issue: –How do we handle critical extensions, if marked critical? –Drop or don’t drop if you don’t understand it Options

8. 2/29/2004Profile-04 open issues 2401bis Sync’ing? SPD –Matching for cipher suite proposal –Pull from IKE_ID, and lookup for SPD match –Match to appropriate cert contents for validation of presented ID. PAD –Use anything else you want in cert or ID to lookup authorization, and do AAA

9. 2/29/2004Profile-04 open issues CDP / AIA Inclusion? SHOULD? MUST? Not at all? Push to [2] and [3]? PROPOSAL –SHOULD send, MUST be able to process upon receipt –MUST accept certs w/o it

10. 2/29/2004Profile-04 open issues KU & EKU Handling Background –CAs aren’t flexible enough with what they do/don’t allow to be configured for (E)KU. Therefore, we can’t depend on it. PROPOSAL: –Put whatever you want or nothing, it doesn’t matter. We will ignore it all together. –Receiver – Ignore it all together

11. 2/29/2004Profile-04 open issues Others? Come to Microphone

12. 2/29/2004Profile-04 open issues Let’s rev and go to WG last call! gregory@netscreen.com