KMIP Specification v2.0 and KMIP Profiles v2.0 from #KMIP TC approved as Committee Specifications

OASIS is pleased to announce that KMIP Specification v2.0 and KMIP Profiles v2.0 from the OASIS Key Management Interoperability Protocol (KMIP) TC [1] have been approved as OASIS Committee Specifications.

What is KMIP and why is it important?

The Key Management Interoperability Protocol (KMIP) is a single, comprehensive protocol for communication between clients that request any of a wide range of encryption keys and servers that store and manage those keys. By replacing redundant, incompatible key management protocols, KMIP provides better data security while at the same time reducing expenditures on multiple products.

The KMIP Specification v2.0 is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.

KMIP Profiles v2.0 specifies conformance clauses that define the use of objects, attributes, operations, message elements and authentication methods within specific contexts of KMIP server and client interaction.

These Committee Specifications are OASIS deliverables, completed and approved by the TC and fully ready for testing and implementation.

The documents and related files are available here:

Key Management Interoperability Protocol Specification Version 2.0
Editable source (Authoritative):
https://docs.oasis-open.org/kmip/kmip-spec/v2.0/cs01/kmip-spec-v2.0-cs01.docx
HTML:
https://docs.oasis-open.org/kmip/kmip-spec/v2.0/cs01/kmip-spec-v2.0-cs01.html
PDF:
https://docs.oasis-open.org/kmip/kmip-spec/v2.0/cs01/kmip-spec-v2.0-cs01.pdf
For your convenience, OASIS provides a complete package of the prose document and related files in a ZIP distribution file. You can download the ZIP file here:
https://docs.oasis-open.org/kmip/kmip-spec/v2.0/cs01/kmip-spec-v2.0-cs01.zip

Key Management Interoperability Protocol Profiles Version 2.0
Editable source (Authoritative):
https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/cs01/kmip-profiles-v2.0-cs01.docx
HTML:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/cs01/kmip-profiles-v2.0-cs01.html
PDF:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/cs01/kmip-profiles-v2.0-cs01.pdf
Test cases:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/cs01/test-cases/
ZIP file:
https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/cs01/kmip-profiles-v2.0-cs01.zip

Members of the KMIP TC [1] approved these specifications by Special Majority Vote. The specifications had been released for public review as required by the TC Process [2]. The vote to approve as Committee Specifications passed [3], and the documents are now available online in the OASIS Library as referenced above.

Our congratulations to the TC on achieving this milestone and our thanks to the reviewers who provided feedback on the specification drafts to help improve the quality of the work.

========== Additional references:
[1] OASIS Key Management Interoperability Protocol (KMIP) TC
https://www.oasis-open.org/committees/kmip/

[2] Public review:
* 30-day public review, 25 April 2019:
https://lists.oasis-open.org/archives/kmip/201904/msg00021.html
– Comment resolution logs:
KMIP Specification: https://docs.oasis-open.org/kmip/kmip-spec/v2.0/csprd01/kmip-spec-v2.0-csprd01-comment-resolution-log.txt
KMIP Profiles: https://docs.oasis-open.org/kmip/kmip-profiles/v2.0/csprd01/kmip-profiles-v2.0-csprd01-comment-resolution-log.txt

[3] Approval ballot:
https://www.oasis-open.org/committees/ballot.php?id=3407

Open Mobility Foundation grows at OASIS

City-led coalition develops open source software and policies for urban transportation data

Invitation to comment on KMIP Specification v1.4 Errata 01 CSPRD01 from the KMIP TC – ends July 10th

We are pleased to announce that KMIP Specification v1.4 Errata 01 CSPRD01 from the KMIP TC [1] is now available for public review and comment. This document lists errata for the OASIS Standard “Key Management Interoperability Protocol Specification Version 1.4.” This publication also includes a “redlined” version of the complete KMIP Specification v1.4 showing the draft Errata in context.

The Key Management Interoperability Protocol (KMIP) is a single, comprehensive protocol for communication between clients that request any of a wide range of encryption keys and servers that store and manage those keys. By replacing redundant, incompatible key management protocols, KMIP provides better data security while at the same time reducing expenditures on multiple products. The KMIP Specification v1.4 is intended for developers and architects who wish to design systems and applications that interoperate using the Key Management Interoperability Protocol Specification.

The documents and related files are available here:

Key Management Interoperability Protocol Specification Version 1.4 Errata 01
Committee Specification Draft 01 / Public Review Draft 01
30 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01.docx
HTML:
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01.html
PDF:
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01.pdf

Other artifacts (redlined version):
Key Management Interoperability Protocol Specification Version 1.4 Plus Errata 01
OASIS Standard incorporating Public Review Draft 01 of Errata 01
30 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01-redlined.docx
HTML:
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01-redlined.html
PDF:
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01-redlined.pdf

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file at:
https://docs.oasis-open.org/kmip/spec/v1.4/errata01/csprd01/kmip-spec-v1.4-errata01-csprd01.zip

How to Provide Feedback

OASIS and the KMIP TC value your feedback. We solicit feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

This public review starts 26 June 2019 at 00:00 UTC and ends 10 July 2019 at 11:59 UTC.

Comments on the work may be submitted to the TC by following the instructions located at:
https://www.oasis-open.org/committees/comments/form.php?wg_abbrev=kmip

Feedback submitted by TC non-members for this work and for other work of this TC is publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/kmip-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with the public review of these works, we call your attention to the OASIS IPR Policy [2] applicable especially [3] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about this specification and the KMIP TC may be found on the TC’s public home page [1].

========== Additional references:

[1] OASIS Key Management Interoperability Protocol (KMIP) TC
http://www.oasis-open.org/committees/kmip/

[2] http://www.oasis-open.org/policies-guidelines/ipr

[3] http://www.oasis-open.org/committees/kmip/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Terms Mode

Global Coalition of Cities Launches the ‘Open Mobility Foundation’

LOS ANGELES (PRWEB) JUNE 25, 2019 –The Open Mobility Foundation (OMF) – a global coalition led by cities committed to using well-designed, open-source technology to evolve how cities manage transportation in the modern era – launched today with the mission to promote safety, equity and quality of life. The announcement comes as a response to the growing number of vehicles and emerging mobility options on city streets. A new city-governed non-profit, the OMF brings together academic, commercial, advocacy and municipal stakeholders to help cities develop and deploy new digital mobility tools, and provide the governance needed to efficiently manage them.

“Cities are always working to harness the power of technology for the public good. The Open Mobility Foundation will help us manage emerging transportation infrastructures, and make mobility more accessible and affordable for people in all of our communities,” said Los Angeles Mayor Eric Garcetti, who also serves as Advisory Council Chair of Accelerator for America, which showcased the MDS platform early on.

The OMF convenes a new kind of public-private forum to seed innovative ideas and govern an evolving software platform. Serving as a forum for discussions about pedestrian safety, privacy, equity, open-source governance and other related topics, the OMF has engaged a broad range of city and municipal organizations, private companies and non-profit groups, and experts and advocates to ensure comprehensive engagement and expertise on vital issues.

Growing from work pioneered at the Los Angeles Department of Transportation and the City of Santa Monica, the founding municipal members of the coalition are Austin, Texas; Bogotá, Colombia; Chicago; Los Angeles; Louisville, Ky.; Miami; Miami-Dade County, Fla.; Minneapolis; New York City Department of Transportation; New York City Taxi and Limo Commission; Philadelphia; Portland, Ore.; San Francisco; San Jose, Calif.; Santa Monica, Calif.; Seattle; and Washington D.C.

“Mayors across the country have made infrastructure, innovation and inclusion our key focus. The OMF joins all of these priorities and will help cities better manage the public right-of-way for all citizens,” said Steve Benjamin, Mayor of Columbia, S.C., and President of the U.S. Conference of Mayors.

In addition to cities and public agencies, the Open Mobility Foundation is founded in part by The Rockefeller Foundation – a premier science-driven philanthropy focused on promoting the well-being of humanity throughout the world. The Open Mobility Foundation is also founded by micro-mobility operators such as Bird and Spin; technology companies such as Microsoft, Blue Systems and Stae; and is supported by advisors that include the International Association of Public Transport, Transportation for America, MetroLabs and the NewCities Foundation.

“The Open Mobility Foundation is a great example of how governments can leverage the power of data to transform and modernize the use of city infrastructure to ensure a more equitable future for all,” said Dr. Rajiv J. Shah, President of The Rockefeller Foundation.

“Technology can play a strong role to transform the relationship amongst multi-modal transportation, retail, hospitality, real estate, and a smart city with a common digital map and understanding of infrastructure usage,” said Tara Prakriya, Partner Group Program Manager of MCVP and Mobility at Microsoft. “Microsoft is delighted to partner with the Open Mobility Foundation to create an open set of standards to facilitate this digital transformation.”

As municipalities integrate expanded transportation options – and as the number and type of vehicles using the existing public right-of-way rises dramatically in cities across the country – this innovative coalition is focused on four primary areas:

1)    Increasing Safety. Cities need tools to manage and measure new transportation modes in order to ensure the safety of their residents and reach the goals of Vision Zero.

2)    Ensuring Equity. Cities need tools to ensure mobility technologies do not create or exacerbate inequality. New forms of transportation should be accessible and affordable to all residents.

3)    Improving Quality of Life. Cities need tools to ensure transportation options do not impede sidewalks or increase roadway congestion and add to the sustainability and safety of our urban environment.

4)    Protecting Privacy. Cities need tools that enable them to generate and analyze data through the mobility services they provide while also adhering to world-class privacy and data security standards.

The OMF governs a platform called “Mobility Data Specification” (MDS) that the Los Angeles Department of Transportation developed to help manage dockless micro-mobility programs (including shared dockless e-scooters). MDS is comprised of a set of Application Programming Interfaces (APIs) that create standard communications between cities and private companies to improve their operations. The APIs allow cities to collect data that can inform real-time traffic management and public policy decisions to enhance safety, equity and quality of life. More than 50 cities across the United States – and dozens across the globe – already use MDS to manage micro-mobility services.

Making this software open and free offers a safe and efficient environment for stakeholders, including municipalities, companies, experts and the public, to solve problems together. And because private companies scale best when cities can offer a consistent playbook for innovation, the OMF aims to nurture those services that provide the highest benefit to the largest number of people, from sustainability to safety outcomes.

By using collaborative methods and an open-source structure, the OMF enables cities and public agencies to access the digital tools that they need to effectively manage city streets as the worlds of transportation and technology continue to intersect and evolve.

The OMF is partnered with OASIS, a leader in the open-source and software standards industry.

“OASIS is excited to host the OMF community, who will produce open-source standards and methods that improve mobility for communities everywhere. We are proud to support the OMF with our proven platform of open-source software, tools and time-tested process that help organizations grow in an open and reliable way,” said Gershon Janssen, President of OASIS.

Membership to the OMF is open, and interested cities and companies are encouraged to apply. To apply for membership or learn more about joining the Open Mobility Foundation, visit http://www.openmobilityfoundation.org.

Watch the Open Mobility Foundation video featuring Los Angeles Mayor Eric Garcetti and Dr. Rajiv J. Shah, President of The Rockefeller Foundation, here: https://vimeo.com/343586607.

Additional Quotes

“Mobility options are arriving at such a fast pace that often it becomes almost impossible for the public sector to catch up. We need to stay ahead of the game and speak the same language. The Mobility Data Specification is the first step for government to digitize its policies, and the Open Mobility Foundation will be a great resource to foster practical and sustainable mobility management tools,” said Carlos A. Gimenez, Mayor of Miami-Dade County.

“This is a momentous step for cities as they bring innovative solutions into their ever-changing mobility landscapes,” said Robert Spillar, Director of the City of Austin Transportation Department. “This international commitment to open source technology will accelerate cities’ work in transportation planning and implementation toward improving safety, equity and quality of life in a transparent manner.”

“Data gathering in NYC has been transformative, has helped us achieve important victories in fair pay for drivers and street safety, and has been fundamental in developing our new traffic congestion policy,” said Rodney Stiles, Acting Deputy Commissioner of Public Affairs for the NYC Taxi & Limousine Commission.

“We’re excited to join the Open Mobility Foundation and work together with other leading cities to ensure we have well-designed tools to provide us with basic data we need to manage traffic and congestion on our streets,” said Chris Warner, Director of the Portland Bureau of Transportation. “Thanks to the Open Mobility Foundation, cities will gain access to the best information and 21st century technologies. With these tools in hand, we can increase equitable access for historically underserved communities and people with disabilities, increase the safety of our streets, and vigorously pursue our climate goals.”

“Blue Systems has developed a comprehensive MDS-based Smart City Mobility Platform that analyzes mobility providers’ data in real time,” said Christophe Arnaud, CEO of Blue Systems. “MDS enables our Platform to take what has traditionally been a historical, planning-based business and moves it into an operational realm that helps cities manage the public right-of-way effectively and efficiently. We are proud to be a founding member of what will be a robust ecosystem that will take on the technical issues surrounding emerging mobility technology in cities around the world.”

“Data is key to building a robust transportation system that effectively connects people to the jobs and services they need,” said Beth Osborne, Director of Transportation for America. “The Open Mobility Foundation will provide a forum for leading communities and their private sector partners to establish shared mobility systems that are safer, more equitable, cleaner and healthier.”

“In joining the Open Mobility Foundation, we will harness our national community of researchers to address the transportation and mobility priorities facing cities,” said Martin O’Malley, a former Governor of Maryland and former Mayor of Baltimore. “Partnerships between universities and cities in this domain leverage open-source platforms to drive system-wide transportation analytics, enable urban management and planning solutions and strengthen data privacy approaches.” O’Malley chairs the Advisory Council of MetroLab, a national collaborative of more than 40 cities and 50 universities focused on advancing civic innovation.

“The Open Mobility Foundation is meeting a critical need for cities across the country during a time of profound disruption in transportation,” said John Rossant, Founder and Chairman of NewCities, a global nonprofit focused on the future of cities. “As urban communities begin to be impacted by new modes of mobility and technology, we need to ensure that the solutions we create are smart, safe and equitable – and that we’re ultimately building a better urban future for all.”

“The Open Mobility Foundation is the latest example of how cities are collaborating both to solve the world’s toughest challenges in novel and creative ways and scale solutions through new norms and instruments,” said Bruce Katz, Director of the Nowak Metro Finance Lab at Drexel University and a Partner at Accelerator for America.

About OASIS

The Open Mobility Foundation is partnered with and hosted by OASIS-Open, a leader in the open-source and software standards industry. One of the most respected member-driven standards bodies in the world, OASIS offers projects – including open source projects – a path to standardization and de jure approval for reference in international policy and procurement. OASIS has a broad technical agenda encompassing cybersecurity, privacy, cryptography, cloud computing and IoT – any initiative for developing code, APIs, specifications or reference implementations can find a home at OASIS.

For More Information 
media(at)openmobilityfoundation.org

Invitation to comment on 3 #OpenC2 CSPRD03s from the OpenC2 TC – ends June 27

We are pleased to announce that Open Command and Control (OpenC2) Language Specification Version 1.0, Open Command and Control (OpenC2) Profile for Stateless Packet Filtering Version 1.0, and Specification for Transfer of OpenC2 Messages via HTTPS Version 1.0 from the OASIS Open Command and Control (OpenC2) TC [1] is now available for public review and comment. This is the third public review for these titles.

OpenC2 is a suite of specifications to achieve command and control of cyber defense functions. These specifications include the OpenC2 Language Specification, Actuator Profiles, and Transfer Specifications. The OpenC2 Language Specification and Actuator Profile(s) focus on the standard at the producer and consumer of the command and response while the transfer specifications focus on the protocols for their exchange.

– The OpenC2 Language Specification provides the semantics for the
essential elements of the language, the structure for commands and
responses, and the schema that defines the proper syntax for the language elements that represents the command or response.

– The Profile for Stateless Packet Filtering Version is a cyber defense mechanism that denies or allows traffic based on static properties of the traffic, such as address, port, protocol, etc. This profile defines the Actions, Targets, Specifiers and Options that are consistent with version 1.0 of the OpenC2 Language Specification.

– The Specification for Transfer of OpenC2 Messages via HTTPS specifies the use of HTTP over TLS as a transfer mechanism for OpenC2 Messages.

The documents and related files are available here:

– Open Command and Control (OpenC2) Language Specification Version 1.0
Committee Specification Draft 09 / Public Review Draft 03
31 May 2019

Editable source (Authoritative):
http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd03/oc2ls-v1.0-csprd03.md

HTML:
http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd03/oc2ls-v1.0-csprd03.html

PDF:
http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd03/oc2ls-v1.0-csprd03.pdf

– Open Command and Control (OpenC2) Profile for Stateless Packet Filtering Version 1.0
Committee Specification Draft 06 / Public Review Draft 03
31 May 2019

Editable source (Authoritative):
http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd03/oc2slpf-v1.0-csprd03.md

HTML:
http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd03/oc2slpf-v1.0-csprd03.html

PDF:
http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd03/oc2slpf-v1.0-csprd03.pdf

– Specification for Transfer of OpenC2 Messages via HTTPS Version 1.0
Committee Specification Draft 05 / Public Review Draft 03
21 May 2019

Editable source (Authoritative):
http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd03/open-impl-https-v1.0-csprd03.md

HTML:
http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd03/open-impl-https-v1.0-csprd03.html

PDF:
http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd03/open-impl-https-v1.0-csprd03.pdf

For your convenience, OASIS provides a complete package of the prose specification and related files in a ZIP distribution file. You can download the ZIP file at:

– OpenC2 Language Specification: http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd03/oc2ls-v1.0-csprd03.zip

– OpenC2 Profile for Stateless Packet Filtering: http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd03/oc2slpf-v1.0-csprd03.zip

– Specification for Transfer of OpenC2 Messages via HTTPS: http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd03/open-impl-https-v1.0-csprd03.zip

How to Provide Feedback

OASIS and the OpenC2 TC value your feedback. We solicit feedback from potential users, developers and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

This public review starts 13 June 2019 at 00:00 UTC and ends 27 June 2019 at 11:59 UTC.

This specification was previously submitted for public review [2]. This 15-day review is limited in scope to changes made from the previous review. Changes are highlighted in red-lined file included in the package [3].

Comments on the work may be submitted to the TC by following the instructions located at:

http://www.oasis-open.org/committees/comments/form.php?wg_abbrev=openc2

Feedback submitted by TC non-members for this work and for other work of this TC is publicly archived and can be viewed at:

http://lists.oasis-open.org/archives/openc2-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with the public review of these works, we call your attention to the OASIS IPR Policy [4] applicable especially [5] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about this specification and the TC may be found on the TC’s public home page.

========== Additional references:

[1] OASIS Open Command and Control (OpenC2) TC
http://www.oasis-open.org/committees/openc2/

[2] Previous public reviews:

– 30-day public review, 09 November 2018:
https://lists.oasis-open.org/archives/openc2/201811/msg00005.html
– Comment resolution logs:

OpenC2 Language Specification:
https://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd01/oc2ls-v1.0-csprd01-comment-resolution-log.pdf

OpenC2 Profile for Stateless Packet Filtering:
https://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd01/oc2slpf-v1.0-csprd01-comment-resolution-log.pdf

Transfer of OpenC2 Messages via HTTPS:
https://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd01/open-impl-https-v1.0-csprd01-comment-resolution-log.pdf

– 15-day public review, 13 April 2019:
https://lists.oasis-open.org/archives/members/201904/msg00005.html
– Comment resolution logs:

OpenC2 Language Specification:
http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd02/oc2ls-v1.0-csprd02-comment-resolution-log.pdf

OpenC2 Profile for Stateless Packet Filtering:
http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd02/oc2slpf-v1.0-csprd02-comment-resolution-log.pdf

Transfer of OpenC2 Messages via HTTPS:
http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd02/open-impl-https-v1.0-csprd02-comment-resolution-log.pdf

[3] Red-lined versions:

– OpenC2 Language Specification: http://docs.oasis-open.org/openc2/oc2ls/v1.0/csprd03/oc2ls-v1.0-csprd03-DIFF.pdf

– OpenC2 Profile for Stateless Packet Filtering: http://docs.oasis-open.org/openc2/oc2slpf/v1.0/csprd03/oc2slpf-v1.0-csprd03-DIFF.pdf

– Specification for Transfer of OpenC2 Messages via HTTPS: http://docs.oasis-open.org/openc2/open-impl-https/v1.0/csprd03/open-impl-https-v1.0-csprd03-DIFF.pdf

[4] http://www.oasis-open.org/policies-guidelines/ipr

[5] http://www.oasis-open.org/committees/openc2/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#Non-Assertion-Mode
Non-Assertion Mode

Call for Consent for #XACML REST Profile V1.1 and JSON Profile of XACML 3.0 V1.1 as OASIS Standards opens

The OASIS eXtensible Access Control Markup Language (XACML) TC members [1] have approved submitting the following Candidate OASIS Standards to the OASIS Membership in a call for consent for OASIS Standards:

XACML REST Profile Version 1.1
Candidate OASIS Standard 01
28 March 2019

JSON Profile of XACML 3.0 Version 1.1
Candidate OASIS Standard 01
28 March 2019

XACML is an OASIS Standard which describes both a policy language and an access control decision request/response language (both defined in XML). XACML v3.0 is an international standard (ITU-T X.1144), approved by the International Telecommunications Union – Telecommunication Standardization Sector (ITU-T).

The REST Profile specification defines a profile for the use of XACML in a RESTful architecture.

The JSON Profile proposes a standardized interface between a policy enforcement point and a policy decision point using JSON, leveraging the decision request and response structure specified in the core XACML standard.

XACML REST Profile Version 1.1 received 3 Statements of Use from ViewDS Identity Solutions, Axiomatics AB, and Siemens AG [2].

JSON Profile of XACML 3.0 Version 1.1 received 3 Statements of Use from ViewDS Identity Solutions, Axiomatics AB, and Siemens AG [3].

This Committee Specification was approved by the Technical Committee and was submitted for the required 60-day public review [4]. All requirements of the OASIS TC Process having been met [5] [6], the Candidate OASIS Standard is now submitted to the voting representatives of OASIS Organizational Members.

This Call for Consent is taking place under the revised TC Process rules effective 01 July 2017 [2]. This is a call to the primary or alternate representatives of OASIS Organizational Members to consent or object to this approval. You are welcome to register your consent explicitly on the ballot; however, your consent is assumed unless you register an objection [3]. To register an objection, you must:

1. Indicate your objection on this ballot, and

2. Provide a reason for your objection and/or a proposed remedy to the TC.

You may provide the reason in the comment box or by email to the Technical Committee on its comment mailing list or, if you are a member of the TC, to the TC’s mailing list. If you provide your reason by email, please indicate in the subject line that this is in regard to the Call for Consent.

— Details —

The Call for Consent opens at 07 June 2019 00:00 UTC and closes on 20 June 2019 23:59 pm timezone. You can access the ballot at:

Internal link for voting members: https://www.oasis-open.org/apps/org/workgroup/voting/ballot.php?id=3408

Publicly visible link: https://www.oasis-open.org/committees/ballot.php?id=3408

OASIS members should ensure that their organization’s voting representative responds according to the organization’s wishes. If you do not know the name of your organization’s voting representative is, go to the My Account page at

http://www.oasis-open.org/members/user_tools

then click the link for your Company (at the top of the page) and review the list of users for the name designated as “Primary”.

— Additional information —

[1] OASIS eXtensible Access Control Markup Language (XACML) TC
https://www.oasis-open.org/committees/xacml/

TC IPR page
https://www.oasis-open.org/committees/xacml/ipr.php

[2] https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26#OScallForConsent

[3] XACML TC comment mailing list: https://lists.oasis-open.org/archives/xacml-comment/
(You must be subscribed to send to this list. To subscribe, see https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=xacml.)

XACML TC main mailing list: https://lists.oasis-open.org/archives/xacml/

[4] Candidate OASIS Standard Special Majority Vote:
https://www.oasis-open.org/committees/ballot.php?id=3356

[5] Public reviews:

* 30-day public reviews, 20 September 2018:
https://lists.oasis-open.org/archives/xacml/201809/msg00013.html
– Comment resolution logs:
http://docs.oasis-open.org/xacml/xacml-rest/v1.1/csprd01/xacml-rest-v1.1-csprd01-comment-resolution-log.txt
http://docs.oasis-open.org/xacml/xacml-json-http/v1.1/csprd01/xacml-json-http-v1.1-csprd01-comment-resolution-log.txt

* 60-day public reviews, 06 April 2019:
https://lists.oasis-open.org/archives/members/201904/msg00004.html
– Comment resolution logs:
TBD. No comments received.

[6] Statements of Use:

– Statements of Use for XACML REST Profile Version 1.1

ViewDS Identity Solutions:
https://lists.oasis-open.org/archives/xacml/201902/msg00001.html

Axiomatics AB:
https://lists.oasis-open.org/archives/xacml/201902/msg00010.html

Siemens AG:
https://lists.oasis-open.org/archives/xacml/201902/msg00012.html

– Statements of Use for JSON Profile of XACML 3.0 Version 1.1

ViewDS Identity Solutions:
https://lists.oasis-open.org/archives/xacml/201902/msg00000.html

Axiomatics AB:
https://lists.oasis-open.org/archives/xacml/201902/msg00011.html

Siemens AG:
https://lists.oasis-open.org/archives/xacml/201902/msg00012.html

Invitation to comment on four PKCS #11 specifications – ends July 6th

OASIS and the OASIS PKCS 11 TC are pleased to announce that four PKCS #11 specifications are now available for public review and comment:
PKCS #11 Cryptographic Token Interface Base Specification Version 3.0
PKCS #11 Cryptographic Token Interface Profiles Version 3.0
PKCS #11 Cryptographic Token Interface Current Mechanisms Specification Version 3.0
PKCS #11 Cryptographic Token Interface Historical Mechanisms Specification Version 3.0

The PKCS #11 specifications define a platform-independent API to cryptographic tokens, such as hardware security modules and smart cards. The API itself is named “Cryptoki” (from “cryptographic token interface” and pronounced as “crypto-key”).

“Base Specification” defines data types, functions and other basic components of the PKCS #11 Cryptoki interface.
“Profiles” is intended for developers and architects who wish to design systems and applications that conform to the PKCS #11 Cryptographic Token Interface standard.
“Current Mechanisms” defines mechanisms that are anticipated for use with the current version of PKCS #11.
“Historical Mechanisms” defines mechanisms for PKCS #11 that are no longer in general use.

The documents and related files are available here:

*********************
PKCS #11 Cryptographic Token Interface Base Specification Version 3.0
Committee Specification Draft 01 / Public Review Draft 01
29 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/csprd01/pkcs11-base-v3.0-csprd01.docx
HTML:
https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/csprd01/pkcs11-base-v3.0-csprd01.html
PDF:
https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/csprd01/pkcs11-base-v3.0-csprd01.pdf
*********************
PKCS #11 Cryptographic Token Interface Profiles Version 3.0
Committee Specification Draft 01 / Public Review Draft 01
29 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.0/csprd01/pkcs11-profiles-v3.0-csprd01.docx
HTML:
https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.0/csprd01/pkcs11-profiles-v3.0-csprd01.html
PDF:
https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.0/csprd01/pkcs11-profiles-v3.0-csprd01.pdf
*********************
PKCS #11 Cryptographic Token Interface Current Mechanisms Specification Version 3.0
Committee Specification Draft 01 / Public Review Draft 01
29 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/pkcs11/pkcs11-curr/v3.0/csprd01/pkcs11-curr-v3.0-csprd01.docx
HTML:
https://docs.oasis-open.org/pkcs11/pkcs11-curr/v3.0/csprd01/pkcs11-curr-v3.0-csprd01.html
PDF:
https://docs.oasis-open.org/pkcs11/pkcs11-curr/v3.0/csprd01/pkcs11-curr-v3.0-csprd01.pdf
*********************
PKCS #11 Cryptographic Token Interface Historical Mechanisms Specification Version 3.0
Committee Specification Draft 01 / Public Review Draft 01
29 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/pkcs11/pkcs11-hist/v3.0/csprd01/pkcs11-hist-v3.0-csprd01.docx
HTML:
https://docs.oasis-open.org/pkcs11/pkcs11-hist/v3.0/csprd01/pkcs11-hist-v3.0-csprd01.html
PDF:
https://docs.oasis-open.org/pkcs11/pkcs11-hist/v3.0/csprd01/pkcs11-hist-v3.0-csprd01.pdf
*********************

For your convenience, OASIS provides a complete package of the specification document and any related files in ZIP distribution files. You can download the ZIP files at:
“Base Specification”:
https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/csprd01/pkcs11-base-v3.0-csprd01.zip
“Profiles”:
https://docs.oasis-open.org/pkcs11/pkcs11-profiles/v3.0/csprd01/pkcs11-profiles-v3.0-csprd01.zip
“Current Mechanisms”:
https://docs.oasis-open.org/pkcs11/pkcs11-curr/v3.0/csprd01/pkcs11-curr-v3.0-csprd01.zip
“Historical Mechanisms”:
https://docs.oasis-open.org/pkcs11/pkcs11-hist/v3.0/csprd01/pkcs11-hist-v3.0-csprd01.zip

How to Provide Feedback

OASIS and the OASIS PKCS 11 TC value your feedback. We solicit input from developers, users and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The public review starts 7 June 2019 at 00:00 UTC and ends 6 July 2019 at 23:59 UTC.

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be used by following the instructions on the TC’s “Send A Comment” page (https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=pkcs11).

Comments submitted by TC non-members for this work and for other work of this TC are publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/pkcs11-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review, we call your attention to the OASIS IPR Policy [1] applicable especially [2] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about the specification and the PKCS11 TC can be found at the TC’s public home page:
https://www.oasis-open.org/committees/pkcs11/

========== Additional references:
[1] https://www.oasis-open.org/policies-guidelines/ipr

[2] https://www.oasis-open.org/committees/pkcs11/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Mode

Invitation to comment on Static Analysis Results Interchange Format (#SARIF) v2.1.0 – ends July 5th

OASIS and the OASIS Static Analysis Results Interchange Format (SARIF) TC are pleased to announce that Static Analysis Results Interchange Format (SARIF) Version 2.1.0 is now available for public review and comment.

Software developers use a variety of tools to assess the quality of their programs. These tools can report results on qualities such as validity, security, performance, compliance with legal requirements, etc. To form an overall picture of program quality, developers often need to aggregate the results produced by all of these tools, a task made difficult when each tool produces output in a different format.

SARIF defines a standard format for the output of static analysis tools in order to:
· Comprehensively capture the range of data produced by commonly used static analysis tools.
· Reduce the cost and complexity of aggregating the results of various analysis tools into common workflows.
· Represent analysis results for all kinds of programming artifacts, including source code and object code.

The documents and related files are available here:

Static Analysis Results Interchange Format (SARIF) Version 2.1.0
Committee Specification Draft 01 / Public Review Draft 01
27 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.docx
HTML:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html
PDF:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.pdf
JSON schemas:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/schemas/

For your convenience, OASIS provides a complete package of the specification document and any related files in ZIP distribution files. You can download the ZIP file at:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.zip

How to Provide Feedback

OASIS and the SARIF TC value your feedback. We solicit input from developers, users and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The public review starts 5 June 2019 at 00:00 UTC and ends 5 July 2019 at 23:59 UTC.

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be used by following the instructions on the TC’s “Send A Comment” page (https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=sarif).

Comments submitted by TC non-members for this work and for other work of this TC are publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/sarif-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review, we call your attention to the OASIS IPR Policy [1] applicable especially [2] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about the specification and the SARIF TC can be found at the TC’s public home page:
https://www.oasis-open.org/committees/sarif/

========== Additional references:
[1] https://www.oasis-open.org/who/intellectualproperty.php

[2] https://www.oasis-open.org/committees/sarif/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Mode

Invitation to comment on Static Analysis Results Interchange Format (#SARIF) v2.0 – ends June 18th

OASIS and the OASIS Static Analysis Results Interchange Format (SARIF) TC [1] are pleased to announce that Static Analysis Results Interchange Format (SARIF) Version 2.0 is now available for public review and comment. This is the second public review for SARIF v2.0.

Software developers use a variety of tools to assess the quality of their programs. These tools can report results on qualities such as validity, security, performance, compliance with legal requirements, etc. To form an overall picture of program quality, developers often need to aggregate the results produced by all of these tools, a task made difficult when each tool produces output in a different format.

SARIF defines a standard format for the output of static analysis tools in order to:
· Comprehensively capture the range of data produced by commonly used static analysis tools.
· Reduce the cost and complexity of aggregating the results of various analysis tools into common workflows.
· Represent analysis results for all kinds of programming artifacts, including source code and object code.

The documents and related files are available here:

Static Analysis Results Interchange Format (SARIF) Version 2.0
Committee Specification Draft 02 / Public Review Draft 02
27 May 2019

Editable source (Authoritative):
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02.docx

HTML:
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02.html

PDF:
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02.pdf

JSON schemas:
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/schemas/

For your convenience, OASIS provides a complete package of the specification document and any related files in ZIP distribution files. You can download the ZIP file at:

https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02.zip

How to Provide Feedback

OASIS and the SARIF TC value your feedback. We solicit input from developers, users and others, whether OASIS members or not, for the sake of improving the interoperability and quality of its technical work.

The public review starts 04 June 2019 at 00:00 UTC and ends 18 June 2019 at 23:59 UTC.

This specification was previously submitted for public review [2]. This 15-day review is limited in scope to changes made from the previous review. Changes are highlighted in red-lined file included in the package [3].

Comments may be submitted to the TC by any person through the use of the OASIS TC Comment Facility which can be used by following the instructions on the TC’s “Send A Comment” page (https://www.oasis-open.org/committees/comments/index.php?wg_abbrev=sarif).

Comments submitted by TC non-members for this work and for other work of this TC are publicly archived and can be viewed at:
https://lists.oasis-open.org/archives/sarif-comment/

All comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members. In connection with this public review, we call your attention to the OASIS IPR Policy [4] applicable especially [5] to the work of this technical committee. All members of the TC should be familiar with this document, which may create obligations regarding the disclosure and availability of a member’s patent, copyright, trademark and license rights that read on an approved OASIS specification.

OASIS invites any persons who know of any such claims to disclose these if they may be essential to the implementation of the above specification, so that notice of them may be posted to the notice page for this TC’s work.

Additional information about the specification and the SARIF TC can be found at the TC’s public home page:
https://www.oasis-open.org/committees/sarif/

========== Additional references:

[1] OASIS Static Analysis Results Interchange Format (SARIF) TC
https://www.oasis-open.org/committees/sarif/

[2] Previous public review:
– 30-day public review, 22 June 2018:
https://lists.oasis-open.org/archives/sarif/201806/msg00083.html
– Comment resolution log:
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd01/sarif-v2.0-csprd01-comment-resolution-log.txt

[3] Red-lined version (PDF):
https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02-DIFF.pdf

[4] https://www.oasis-open.org/who/intellectualproperty.php

[5] https://www.oasis-open.org/committees/sarif/ipr.php
https://www.oasis-open.org/policies-guidelines/ipr#RF-on-RAND-Mode
RF on RAND Mode

No results with the selected filters