December 2006 - caops-wg

Re: [caops-wg] [igtf-general] Re: Certificate Profile document updated (to v0.14)
by Mike Helm 04 Jan '07

04 Jan '07

I haven't had time to read the new draft but a couple comments at 2nd hand ... Kaspar Brand writes: > > recommendation. It used to be necessary to set pathlen=0 in the I said the wrong thing here - pathlen has to be undefined, or whatever "unlimited" is in asn.1. "0" probably has to be forbidden for Grid CAs; it disables old-style Grid proxy certs (we did this ca 2002). > > that pathLenConstraint MUST be absent or set to 0. I did the same for > > end-entity certs, comments welcome on that! > > Setting pathlen to 0 in end-entity certs actually goes explicitly > against both RFC 3280 and the latest 3280bis I-D: > > > CAs MUST NOT include the pathLenConstraint field unless the cA > > boolean is asserted and the key usage extension asserts the > > keyCertSign bit. > > In its current wording, 3.3.1 still gives the option of not including > pathlen at all (which is fine), but if we really want to allow the other > option (setting it to 0 for EE certs), then we should state that this > contradicts a mandatory requirement of RFC 3280 (similar to 3.2.1). Why would we want to set it for EE certs? The IETF PKIX profile for how path length is evaluated is in 4.2.1.10 (about p 36) > Second, two comments about authority and subject key identifiers - > section 2.4.6 currently states: > > > 2.4.6 Authority and Subject Key Identifier: > > A subjectKeyIdentifier extension MAY be included in CA certificates > > to aid in validation path construction. An authorityKeyIdentifier > > MAY be included in all CA certificates, except for selfsigned > > root certificates. > > The statement about the authorityKeyIdentifier is basically fine, but > the "except for selfsigned root certificate" poses a problem for a large > number of existing CA certs - when looking at the IGTF distribution Sure, ours does too. I don't understand this restriction - see the discussion in RFC 3280 4.2.1.1 - it's simply useless in the case of most self-signed CAs. RFC 3280 says "where ... [the CA has a] "self-signed" certificate, the authority key identifier MAY be omitted .... It's useless (I think) because disambiguation is not defined at the point in the chain of certs where you have a self-signed cert. The subject key & authority key ids should be identical in this case. (It might be useful to say, that if a self-signed CA cert presents an authority key id, it must be identical to the subject key id.)

3 3

CFP: The Third International Symposium on Information Assurance and Security (IAS'07)
by Frank Siebenlist 13 Dec '06

13 Dec '06

FYI - Regards, Frank. --------------------- Call for Papers The Third International Symposium on Information Assurance and Security (IAS'07) http://www.ias07.org/ August 29-31, 2007, Manchester, United Kingdom Overview: Information assurance and security has become an important research issue in networked and distributed information sharing environments. Finding effective ways to protect information systems, networks and sensitive data within the critical information infrastructure is challenging even with the most advanced technology and trained professionals. The International Symposium on Information Assurance and Security aims to bring together researchers, practitioners, developers, and policy makers involved in multiple disciplines of information security and assurance to exchange ideas and to learn the latest development in this important field. Topics: Previously unpublished work offering novel research and application contributions in any aspect of information assurance, security and privacy are solicited for submission to the IAS'07 symposium. Topics of interest include, but are not limited to, the following: - Agent and Mobile Code Security - Anonymity and User Privacy - Authentication and Identity Management - Authorization and Access Control - Biometrics Security and Applications - Computer Forensics - Cryptographic Protocols - Data Integrity and Privacy - Database Security - Denial of Service and Intrusion Detection - Distributed System Security - E-Commerce and E-Government Security - Fraud Control - Information Warfare and Cyber-terrorism - Intellectual Property Protection - Internet and Web Services Security - Key Management and Recovery - New Ideas and Paradigms for Security - Operating System Security - Secure Hardware and Smartcards - Secure Software Technologies - Security Education and Training - Security Management and Strategy - Security Models and Architectures - Security Verification, Evaluations and Measurements - Trust Negotiation, Establishment and Management - Ubiquitous Computing Security Paper Submission: Papers should be original and contain contributions of theoretical, experimental or application nature, or be unique experience reports. The page limit is 6 pages in IEEE 8.5" x 11" two-column format with fonts not smaller than 10 points. Each paper should contain up to 5 keywords. Electronic submission in the PDF or Word format is required. Papers will be evaluated for originality, significance, clarity, and soundness. Except for invited papers, all papers will be reviewed by at least three independent reviewers. Conference Proceedings: Accepted papers will be published by IEEE Computer Society Press. Selected papers presented in the conference will be considered for publication in a special issue of an international journal. Best Paper Awards: The IAS'07 Program Committee will select one winner for the Best Paper Award (all regular papers are eligible) and one winner for the Best Student Paper Award (to be eligible, the student must be the sole author of the paper, or the first author and primary contributor. A cover letter to the General Chair/Program Chair must identify the paper as a candidate for this competition at the time of submission). The award winners will each be presented with an award certificate and a direct payment of £200 at the conference, and an invitation to submit an extended version of the award-winning paper for the consideration of publication in an international journal, JIAS. Key Deadlines: Paper Submission Deadline: March 20, 2007 Author Notification: May 20, 2007 Camera Ready Submission Deadline (6 pages): June 20, 2007 Author Registration Deadline: June 20, 2007. Workshop Proposal Submission Deadline: February 10, 2007. Workshop Proposal Notification: February 15, 2007. Panel/Tutorial Proposal Submission Deadline: April 20, 2007. Proposal Notification: May 20, 2007 Instructions for workshop proposals: IAS'07 invites workshop, panel and tutorial proposals. A workshop proposal should include the following items: (1) Title of the workshop. (2) Scope and Topics. (3) The workshop chair (or co-chairs) with a brief biography. (4) Contact information (email address and phone number). (5) Expected number of attendees. Additional notes for the workshops: - The organisers of a workshop can decide their own paper submission and notification deadlines. - Each workshop should have at least ten papers. - A list of accepted papers (Authors, Titles, Email addresses and Review Results) must be sent to the IAS'07 Program Chair (ias07(a)cs.man.ac.uk) by May 20, 2007. - IAS'07 will provide administrative support for workshop room booking, registration, and publication. All papers accepted by the workshops will be published in the IAS'07 proceedings. - All other workshop related matters, such as collect, review and accept papers, should be planned and organised by the workshop organisers, independently of the IAS'07. Workshop organisers should make sure that the papers be reviewed by at least three reviewers. Financial support for workshop chairs: If workshops are constructed successfully (with at least ten papers), their organisers (one organiser per workshop) will get: - Free registration, - Free accommodation (up to 3 nights). Contacts: Further enquiries regarding matters related to IAS'07 can be sent to the Conference Local Organising Chairs: Ms Bryony Quick; or Mr Iain Hart; Email: ias07(a)cs.man.ac.uk Tel: +44 (0)161 275 6130 Fax: +44 (0)161 275 6204 -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

OGF Security Area Update December 2006
by David Groep 04 Dec '06

04 Dec '06

Dear all, Over the past few months, several new activities have started in the OGF Security Area. With this Update, we would like to inform you about these activities and at the same time foster coherency in the security area. We hope you find this update useful and welcome any comments you have on this kind of communication, and of course on any grid security related activities. Note also the OGF 19 early registration deadline of December 8 (Friday). We hope that, with the activities listed below, the OGF 19 program will be interesting and packed with security-related activities. Best regards, the Security ADs Blair Dillaway and David Groep. In this update: - NEW: OGSA-AuthN Charter BoF to be held at OGF19 - NEW: Activity discussion on Levels of Assurance issues - OGSA Basic Security Profile Core and Security Channel - OGSA-AuthZ-WG re-chartered - Firewall Issues RG documents and group directions - CAOPS Document progress and sessions These updates will usually be sent to the <security-area at ogf.org> list, to which you can subscribe via http://mailman.ogf.org/ OGSA-AuthN Charter BoF ---------------------- The OGSA-AuthN group is currently being bootstrapped to look at technologies and mechanisms for authentication in the OGSA context. The groups focus will be on the drafting the roadmap for OGSA authentication technologies, documentation of existing authentication community practices, and look at the issues surrounding AuthN delegation. The group and BoF is being organised and animated by Alan Sill of Texas Tech. Discussions on the exact scope of the group are currently ongoing on the BoF mailing list, and a BoF session will be held during OGF19. These discussions should result in a charter proposal being brought to the community at the BoF. It is explicitly a part of the charter for this group to work in a symmetrical manner with any OGSA-AuthZ work that may be needed for consistency in grid services. For more information Draft charter: http://www.ggf.org/gf/group_info/charter.php?review&group=OGSA-AuthN-WG Mailing list: ogsa-authn-bof(a)ogf.org http://www.ogf.org/mailman/listinfo/ogsa-authn-bof/ Topical BoF on Levels of Assurance (LoAs) ----------------------------------------- Ideas around "Levels of Assurance" have been receiving more and more attention, with the advance of federations and Authentication and Authorization infrastructures. "LoA is defined as the strength of authentication required for a service provider to be assured that a resource access is only granted to users whose identities have been verified. It reflects the degree of confidence in an authentication process used to establish the identity of an entity (an individual or a software component) to whom the credential was issued, and the degree of confidence that the entity using the credential is indeed the entity that the credential was issued to." Ning Zhang of Manchester University has taken the initiative to bring up the discussion on this activity in the OGF context. Examples of questions that this activity could address are: - What are the existing definitions of LoA suited to Grid or VO environment? - How to apply LoA to safeguard Grid services/resources? - Are some onerous registration requirements or special condition stipulations due to perceived inadequacies in the strength of authentication? - Are there any limitations in terms of user accessibility, scalability and interoperability? The activity can include discussion on how operational procedures affect LoA, how the various parameters and factors influence the overall LoA value in grid/VO environments, and come up with recommendations on how these factors can be taken into account. The purpose here is to consult, and to seek comments and feedbacks from, the communities concerned (including service providers, from e-Science, e-Business and e-Gov) on their views on the definition and applications of LoA in achieving fine-grained access control. Everyone interested in such an activity is extremely welcome to attend this activity BoF session. If there is sufficient interest within OGF, the BoF can also discuss how the activity is best embedded in the OGF organisation; it is not necessarily the aim of this BoF to result in a new research or working group. More information: Security Area Wiki: https://forge.gridforum.org/sf/wiki/do/viewPage/projects.sec/wiki/LoAInitia… Document "e-Infrastructure Security: Levels of Assurance" https://forge.gridforum.org/sf/sfmain/do/downloadAttachment/projects.sec/wi… Discussion forum: https://forge.gridforum.org/sf/discussion/do/listTopics/projects.sec/discus… OGSA Basic Security Profile Core and Security Channel documents --------------------------------------------------------------- The updated version of the OGSA Basic Security Profile 1.0 - Core has entered WG final call and is available on GridForge: https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… The OGSA Security Profile 1.0 - Secure Channel document draft, discussing how to establish a secure channel in the OGSA context, has been revised and is now available at https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.ogsa-wg/… OGSA-AuthZ-WG re-chartered ------------------------- The OGSA-AuthZ Working Group has been rechartered and now addresses more advanced features that are required, such as obligations, decisions based on action parameters, policy management, dynamic delegation of authority, attribute schema exchanges etc. The new charter is available from http://www.ggf.org/gf/group_info/charter.php?review&group=OGSA-AuthZ-WG Firewall Issues overview document published ------------------------------------------- This "Firewall Issues Overview" information track document by Ralph Niederberger et al., has been published as GFD-I.083. You can download it here: http://www.ggf.org/gf/docs/?final The middlebox technology overview and evaluation document is coming up next, and new documents are being considered on the mailing list More information: Charter: http://www.ggf.org/gf/group_info/charter.php?review&group=FI-RG Mailing list: fi-rg(a)ogf.org http://www.ogf.org/mailman/listinfo/fi-rg/ CAOPS Documents and sessions ---------------------------- CAOPS will hold two sessions during the upcoming OGF 19 event, of which one is traditionally dedicated to the International Grid Trust Federation (IGTF). Current draft document for example include the Grid Certificate Profile, a comprehensive collection of the community knowledge on what works and does not work in an interoperable PKI geared to currently running grids. More information: Charter: http://www.ggf.org/gf/group_info/charter.php?review&group=CAOPS-WG International Grid Trust Federation http://www.gridpma.org/ Grid Certificate Profile: https://forge.gridforum.org/sf/go/doc13741 (PDF) https://forge.gridforum.org/sf/go/doc13742 (MS Word) -- David Groep ** National Institute for Nuclear and High Energy Physics, PDP/Grid group ** ** Room: H1.56 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0