PKI: A High Level View from the Trenches

1
PKI A High Level View from the Trenches

• Ken Klingenstein,
• Project Director, Internet2 Middleware Initiative
• Chief Technologist, University of Colorado at
  Boulder

2
Agenda

• Fundamentals - Components and Contexts
• The missing pieces - in the technology and in the
  community
• Current Activities - feds, chime, anx, overseas,
  pkiforum, etc.
• Higher Ed Activities (CREN, HEPKI-TAG, HEPKI-PAG,
  Net_at_edu, PKIlabs)

3
PKI A few observations

• Think of it as wall jack connectivity, except
  its connectivity for individuals, not for
  machines, and theres no wall or jackBut it is
  that ubiquitous and important
• Does it need to be a single infrastructure? What
  are the costs of multiple solutions? Subnets and
  ITPs...
• Options breed complexity managing complexity is
  essential

4
A few more...

• IP connectivity was a field of dreams. We built
  it and then the applications came. .
  Unfortunately, here the applications have arrived
  before the infrastructure, making its development
  much harder.
• Noone seems to be working on the solutions for
  the agora.

5
Uses for PKI and Certificates

• authentication and pseudo-authentication
• signing docs
• encrypting docs and mail
• non-repudiation
• secure channels across a network
• authorization and attributes
• and more...

6
A framework

• PKI Components - hardware, software, processes,
  policies
• Contexts for usage - community of interests
• Implementation options (in-source, out-source,
  roll-your-own,etc.)
• Note changes over time...

7
PKI Components

• X.509 v3 certs - profiles and uses
• Validation - Certificate Revocation Lists, OCSP,
  path construction
• Cert management - generating certs, using keys,
  archiving and escrow, mobility, etc.
• Directories - to store certs, and public keys and
  maybe private keys
• Trust models and I/A
• Cert-enabled apps

8
PKI Contexts for Usage

• Intracampus
• Within the Higher Ed community of interest
• In the Broader World

9
PKI Implementation Options

• In-source - with public domain or campus unique
• In-source - with commercial product
• Bring-in-source - with commercial services
• Out-source - a spectrum of services and issues
• what you do depends on when you do it...

10
Cert-enabled applications

• Browsers
• Authentication
• S/MIME email
• IPsec and VPN
• Globus
• Secure multicast

11
X.509 certs

• purpose - bind a public key to a subject
• standard fields
• extended fields
• profiles
• client and server cert distinctions

12
Standard fields in certs

• cert serial number
• the subject, as x.500 DN or
• the subjects public key
• the validity field
• the issuer, as id and common name
• signing algorithm
• signature info for the cert, in the issuers
  private key

13
Extension fields

• Examples - auth/subject subcodes, key usage, LDAP
  URL, CRL distribution points, etc
• Key usage is very important - for digsig,
  non-rep, key or data encipherment, etc.
• Certain extensions can be marked critical - if an
  app cant understand it, then dont use the cert
• Requires profiles to document, and great care...

14
Cert Management

• Certificate Management Protocol - for the
  creation and management of certs
• Revocation Options - CRL, OCSP
• Storage - where (device, directory, private
  cache, etc.) and how - format
• escrow and archive - when, how, and what else
  needs to be kept
• Cert Authority Software or outsource options
• Authority and policies

15
Certificate Management Systems

• Homebrews
• OpenSSL and OpenCA
• Baltimore, Entrust, etc.
• W2K, Netscape, etc.

16
Directories

• to store certs
• to store CRL
• to store private keys, for the time being
• to store attributes
• implement with border directories, or acls within
  the enterprise directory, or proprietary
  directories

17
Inter-organizational trust model components

• Certificate Policy- uses of particular certs,
  assurance levels for I/A, audit and archival
  requirements
• Certificate Practices Statement- the nitty gritty
  operational issues
• Hierarchies vs Bridges
• a philosopy and an implementation issue
• the concerns are transitivity and delegation
• hierarchies assert a common trust model
• bridges pairwise agree on trust models and policy
  mappings

18
Certificate Policies Address (CP)

• Legal responsibilities and liabilities
  (indemnification issues)
• Operations of Certificate Management systems
• Best practices for core middleware
• Assurance levels - varies according to I/A
  processes and other operational factors

19
Certificate Practice Statements (CPS)

• Site specific details of operational compliance
  with a Cert Policy
• A single practice statement can support several
  policies (Chime)
• A Policy Management Authority (PMA) determines if
  a CPS is adequate for a given CP.

20
Trust chains

• Path construction
• to determine a path from the issuing CA to a
  trusted CA
• heuristics to handle branching that occurs at
  bridges
• Path validation
• uses the path to determine if trust is
  appropriate
• should address revocation, key usage, basic
  constraints, policy mappings

21
Trust chains

• When and where to validate
• off-line on a server at the discretion of the
  application
• depth of chain
• some revocations better than others - major
  (disaffiliation, key compromise, etc.) and minor
  (name change, attribute change)
• sometimes the CRL cant be found or hasnt been
  updated

22
Mobility Options

• smart cards
• usb dongles
• passwords to download from a store or directory
• proprietary roaming schemes abound - Netscape,
  Verisign, etc
• SACRED within IETF recently formed for standards
• integration of certificates from multiple stores

23
More current activities

• HEPKI
• the Grid

24
Current Activities

• PKIX (http//www.ietf.org/html.charters/pkix-chart
  er.html)
• Federal PKI work (http//csrc.nist.gov/pki/twg/)
• State Govs (http//www.ec3.org/)
• Medical community (Tunitas, CHIME, HIPAA)
• Automobile community (ANX)
• Overseas
• Euro government - qualifying certs
• EuroPKI for Higher Ed (http//www.europki.org/ca/r
  oot/cps/en_index.html)

25
All the stuff we dont know

• Revocation approaches
• Policy languages
• Standard profiles
• Mobility
• Path math
• User interface

26
PKI and Higher Ed

• ah, the public sector life
• Key issues
• Current activities

27
ah, the public sector

• almost universal community of interests
• cross-agency relationships
• complex privacy and security issues
• limited budgets and implementation options
• sometimes ahead of the crowd and the obligation
  to build a marketplace

28
Key issues

• trust relationships among autonomous
  organizations
• interoperability of profiles and policies
• interactions with J.Q. Public
• international governance issues

29
(No Transcript)