May 2007 - caops-wg - lists.ogf.org

Soliciting the grid community's views on risk-based authN & authZ schemes
by Mike 'Mike' Jones 10 Jul '07

10 Jul '07

Salutations, On behalf of the UK JISC (http://www.jisc.ac.uk/) the ES-LoA Project (E-infrastructure Security: authentication Levels of Assurance) is soliciting views from the community of services, and identity and resource providers about the use-of/need-for a risk-based authentication and authorisation scheme. Such a scheme, built on top of open standards based middleware such as Shibboleth, would take into account the level of confidence in users' identification through their identity and attribute assertions when deciding whether or not to permit access to a particular resource. The principle objectives of the ES-LoA project are as follows: o to raise the community's awareness with regard to authentication Levels of Assurance (LoA) as one of the factors that can be used to quantify the degree of protection for resources with varying levels of sensitivity in federated environments, o to investigate potential applications of LoA to various types of service, including resources provided for the grid/e-Science community, and library and e-learning resources, o to build community consensus in using the appropriate definition of LoA reflecting the trustworthiness of a resource's authentication mechanism, and o to raise service providers' interests in deploying a technology that can help them to achieve LoA linked fine-grained access control. If you provide, or plan to provide, a service or client infrastructure that issues or consumes credentials for authentication we would be grateful if you would take time to participate in this survey. The results will also form input to the Open Grid Forum's activity in this area through the LoA research group. The survey, entitled "ES-LoA Survey Questionnaire", is available from http://www.es-loa.org/output. Please either fill in the online form or return the completed Word document to es-loa(a)manchester.ac.uk by Friday 8th June 2007. Thank you for your time and valuable information, the ES-LoA project team.

1 1

Fwd: Protocol Action: 'Internet X.509 Public Key Infrastructure Subject Alternative Name for expression of service name' to Proposed Standard
by Alan Sill 30 May '07

30 May '07

FYI. May be of interest for solving problems associated with verification of association of a service certificate with a particular DNS record. Alan Begin forwarded message: > From: The IESG <iesg-secretary(a)ietf.org> > Date: May 30, 2007 12:27:37 PM CDT > To: IETF-Announce <ietf-announce(a)ietf.org> > Cc: Internet Architecture Board <iab(a)iab.org>, RFC Editor <rfc- > editor(a)rfc-editor.org>, pkix mailing list <ietf-pkix(a)imc.org>, pkix > chair <pkix-chairs(a)tools.ietf.org> > Subject: Protocol Action: 'Internet X.509 Public Key > Infrastructure Subject Alternative Name for expression of service > name' to Proposed Standard > > > The IESG has approved the following document: > > - 'Internet X.509 Public Key Infrastructure Subject Alternative > Name for > expression of service name ' > <draft-ietf-pkix-srvsan-05.txt> as a Proposed Standard > > This document is the product of the Public-Key Infrastructure (X.509) > Working Group. > > The IESG contact persons are Tim Polk and Sam Hartman. > > A URL of this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-pkix-srvsan-05.txt > > Technical Summary > > This document specifies how to use the existing X.509 certificate > Subject Alternative Name extension (with the otherName syntax) to > carry a reference to a DNS SRV record. The intent is to link a > certificate to the service named in the DNS record. > > The document notes that the problem being solved here is not the > typical server authentication problem. Instead, an authorization > problem is being solved. The question being answered here is > whether > the server that holds the private key is authorized to provide a > particular service. This mechanism fills a gap that otherwise would > exist if the server is provisioned with typical server certificate > that attests just to the name of the server. A server holding a > certificate with this extension has been certified by the issuer of > the certificate to offer the service expressed in the corresponding > SRV RR record. The cited example in the document is that of a > Kerberos server (e.g., a KDC). > > When DNSSEC is fully deployed, this extension may not be needed, as > signed DNS records (SRV RR and others) should be able to provide the > same form of authentic authorization information. (This extension > does not represent competition with DNSSEC as the only binding > provided is to SRV RR records, a subset of overall DNSSEC > functionality.) > > Working Group Summary > > The PKIX WG expressed consensus to advance the draft to Proposed > Standard. > > Protocol Quality > > This document was reviewed by Russ Housley for the IESG. > Alan Sill, Ph.D TIGRE Senior Scientist, High Performance Computing Center Adjunct Professor of Physics TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

2 1

Trying to find Verisign CA services
by David Chadwick 25 May '07

25 May '07

How about this for a great web site search service :-( If you search the Verisign web site for "CA services" you get returned every document that exists that contains the address of their offices in Mountain View, CA. Nothing about Certification Authorities, however regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

2 1

Trying to find Verisign CA services
by David Chadwick 25 May '07

25 May '07

Whilst trying to find out how Verisign handled the naming issues that you face I tried searching its web site for more details How about this for a great web site search service :-( If you search the Verisign web site for "CA services" you get returned EVERY document that exists that contains the address of their offices in Mountain View, CA. Nothing about Certification Authorities, however regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Call for comments for Auditing document
by Yoshio Tanaka 17 May '07

17 May '07

Dear all, The latest auditing document is available on the Grid Forge web site at: https://forge.gridforum.org/sf/go/doc4858?nav=1 I believe the document is useful for external auditing as well as self auditing. I would like to ask IGTF CAs to review the auditing document (and hopefully do self auditing using the document) and give feedback to us. I would especially interested in whether the specified sections in RFC2527/3647 as evidences are appropriate or not. Please send your comments to this ML, or you can give us in Istanbul and Singapore. Thanks, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

IGTF Session, 18:00 BST, Charter Suite 3
by Darcy Quesnel 09 May '07

09 May '07

IGTF Session Wed, May 9, 17:00 GMT (18:00 BST), Charter Suite 3 Agenda * Updates from the regional PMAs (15 min) o APGrid PMA (Yoshio) o EUGrid PMA (David) o TAGPMA (Darcy) * Problems in compliance with the new Authentication Profile (20 min) * Authentication Profiles (20 min) o MICS (Darcy) o Portal-based CS (Yoshio) * Hardware Tokens (20 mins) o Robots (Jens) * AOB

4 5

CEN Guidelines on signature verification
by David Chadwick 08 May '07

08 May '07

Dear All you may find this document on signature verification useful regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

CAOPS Session is Connected to ESNet Gatekeeper 884483
by Darcy Quesnel 08 May '07

08 May '07

Darcy

1 0

Updated Agenda
by Darcy Quesnel 08 May '07

08 May '07

CAOPS-WG Session Tue, May 8, 16:00 GMT, Charter Suite 5 Agenda * Vote on Grid Certificate Profile Document? o David, 2 min, Darcy 3 min * Plans on Finalizing the OCSP Document! o Milan, 15 min * Development of Audit Guidlines Document o Yoshio, 10 min * Development of the Authentication Service Profile Document o David, 5 min * Development of the Relying Party Defined Namespace Policies Document o David, 15 min * Hardware Tokens: The Netherelands and Robots o David, 5 min o Jens, 15 min https://forge.gridforum.org/sf/wiki/do/viewPage/projects.caops-wg/wiki/Home… Darcy

1 0

Draft Agenda
by Darcy Quesnel 08 May '07

08 May '07

- Vote on Grid Certificate Profile Document? - David, 2 min, Darcy 3 min - Plans on Finalizing the #%&! OCSP Document! - Milan Sova, 15 min - Development of Audit Guidlines Document? - Yoshio, 15 min - Development of the Authentication Service Profile Document - David, 15 min - Development of the Relying Party Defined Namespace Policies Document - David, 15 min Any suggestions are welcome. The agenda is on the wiki associated with the CAOPS site http://forge.gridforum.org/sf/wiki/do/viewPage/projects.caops-wg/wiki/HomeP… Feel free to add material, amend, and generally edit this agenda. Darcy

5 8