- caops-wg - lists.ogf.org

CAOPS Agenda Building
by Darcy Quesnel 01 May '06

01 May '06

The next GGF is fast approaching. We have one full session to discuss CAOPS documents and one session to discuss IGTF issues and possibly some spillover from CAOPS. It's now time to build the agenda. What should would you like to see on the agenda? Any new document ideas (auditing, etc)? Old documents that we have to wrap up (OCSP, etc.)? Darcy

3 3

Issue with OCSP through HTTP caches
by jluna＠ac.upc.edu 26 Apr '06

26 Apr '06

Dear all, A couple of days ago we had an issue with the OCSP Responder and an OpenSSL user, where the OCSP Request was being sent over HTTP but transversing a Squid cache. The problem was a combination of an OpenSSL's "known issue" (use the "host+path" parameters instead of the "url" parameter when performing an OCSP Request) with the Squid ability to cache certain types of HTTP requests (in this case HTTP/1.0). Even though RFC2560 mentions the following: "The reliance of HTTP caching in some deployment scenarios may result in unexpected results if intermediate servers are incorrectly configured or are known to possess cache management faults. Implementors are advised to take the reliability of HTTP cache mechanisms into account when deploying OCSP over HTTP." Maybe we should add to the "OCSP Requirements for Grids" document this note, so potential deployments disable OCSP over HTTP caching in intermediate servers. What do you think about it? More info about the OpenSSL issue mentioned above can be found in the openssl-users mailinglist under the folloing link: http://marc.theaimsgroup.com/?l=openssl-users&m=111091034704961&w=2 Best regards, Jesus & Oscar

4 6

Re: [caops-wg] OCSP Telecon ?
by Olle Mulmo 25 Apr '06

25 Apr '06

Wednesday is the only possibility for me next week, it looks like. That said, it would be stupid not to make any progress whatsoever until the very last minute before the meeting. I will look at the document during the next 24 hours. /Olle On Apr 25, 2006, at 13:40, Oscar Manso wrote: > Hello again, > Unfortunately we would not be able to attend the conference at the > time > suggested by Olle on Thursday... > What about next week? We would be able to attend from Monday to > Wednesday at > the time being proposed... > > > Oscar > >> -----Mensaje original----- >> De: Olle Mulmo [mailto:mulmo@pdc.kth.se] >> Enviado el: lunes, 24 de abril de 2006 22:25 >> Para: Darcy Quesnel >> CC: Olle Mulmo; Oscar Manso; 'Mike Helm'; 'Jesus Luna'; Milan >> Sova; Christos Kanellopoulos; caops-wg(a)ggf.org >> Asunto: Re: [caops-wg] OCSP Telecon ? >> >> >> Thursday at 19:00 CET ? >> >> /Olle >> >> On Apr 24, 2006, at 20:57, Darcy Quesnel wrote: >> >>> Ok, so this last Friday didn't seem to be all that popular, and I >>> wasn't on the ball Thursday morning. Can we get the just >> the authors >>> and very interested parties in on the call - Olle, Jesus, Oscar, >>> Milan, Mike - sometime this week? When would be good? >>> >>> Unfortunately, I won't be able to host the call this week >> as I'm away >>> at a conference, schmoozing. Can one of you host the telecon? >>> >>> >>> Darcy >>> >>> >>> Oscar Manso wrote: >>>> For us, in first instance there is no problem to participate on >>>> Thursday morning (until 12h utc). >>>> We would also be available any other day next week. >>>> By the way, I would like to point out that we did not receive any >>>> comments from the last version of the OCSP document sent >> to the list. >>>> And, given the fact that we won't be able to attend the >> next meeting >>>> in Tokyo, maybe it would be worth talking about it during the >>>> teleconference. >>>> Thank you, >>>> Oscar & Jesús >>>>> -----Mensaje original----- >>>>> De: owner-caops-wg(a)ggf.org >> [mailto:owner-caops-wg@ggf.org] En nombre >>>>> de Alan Sill Enviado el: miércoles, 19 de abril de 2006 18:19 >>>>> Para: Darcy Quesnel >>>>> CC: caops-wg(a)ggf.org; Mike Helm; 'Jesus Luna'; Alan Sill; >> Olle Mulmo >>>>> Asunto: Re: [caops-wg] OCSP Telecon ? >>>>> >>>>> I am not available Fri. of this week through Friday of >> the following >>>>> week -- except possibly by phone some time Thursday morning 4/27. >>>>> >>>>> Alan >>>>> >>>>> On Apr 19, 2006, at 10:48 AM, Darcy Quesnel wrote: >>>>> >>>>>> Would it be productive to have an OCSP telecon sometime >>>>> before the GGF >>>>>> in Tokyo? >>>>>> >>>>>> If so, when would be good for everyone involved? Friday >> at 13:00 >>>>>> Eastern, say? >>>>>> >>>>>> >>>>>> Darcy >>>>>> >>>>>> >>>>> >> ==================================================================== >>>>> : Alan Sill, Texas Tech University Office: Admin 233, >> MS 4-1167 : >>>>> : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax >> 806-742-4358 : >>>>> >> ==================================================================== >>>>> >>>>> >> >> > >

3 2

OCSP Telecon ?
by Darcy Quesnel 25 Apr '06

25 Apr '06

Would it be productive to have an OCSP telecon sometime before the GGF in Tokyo? If so, when would be good for everyone involved? Friday at 13:00 Eastern, say? Darcy

5 6

Microsoft Cert revocation presentation at NIST
by Mike Helm 04 Apr '06

04 Apr '06

Kelvin Yiu of Microsoft gave a very interesting presentation about MS strategy for managing revocation in VISTA, which I think has some relevance for us. Among other things, he really pushed the lightweight OCSP profile (not sure if that is finished in IETF PKIX but it is close). Among other things he mentioned the use of TLS stapling - this is from RFC 3546 section 3.6 http://www.ietf.org/rfc/rfc3546.txt where an OCSP response is bundled into the TLS handshake. I hope the slide deck will be made available, but in lieu of that here are some of the best practices from KY's slides (paraphrased a bit): Use HTTP not LDAP - better thruput, can cache Set Etag & cache-control Keep it simple 1 OCSP & 1 CDP that is accessible User overlapping validity periods Max-age should be less than overlap period Support the litewgt OCSP profile for hi volume envs Pre-generate OCSP response if sec rqmts permit - don't do real time stuff Support stapling - push for it in new protocols

1 0

Re: [caops-wg] OCSP & Proxy Certs
by Mike Helm 22 Feb '06

22 Feb '06

I was talking to Frank Siebenlist of Argonne & Globus, and he is interested in taking on some of the client side issues in the OCSP Requiremets paper & making sure they are properly addressed. This is something he and Von Welch, in another context, have emphasized as being very important for OCSP and similar services. This attention & input should be very useful. What was the discussion at CAOPS at GGF-16? I haven't seen any minutes or feedback. Thanks, ==mwh Michael Helm ESnet/LBL

2 2

GGF16 Meeting Materials
by Darcy Quesnel 21 Feb '06

21 Feb '06

GGF16 meeting materials are now available online. http://forge.gridforum.org/docman2/ViewCategory.php?group_id=56&category_id… Darcy

1 0

OCSP Document with additional comments from CertiVeR and UPC.
by Jesus Luna 14 Feb '06

14 Feb '06

Hi, I'm sending a new incarnation of the OCSP document which includes some comments/additions from CertiVeR and UPC. I'm not sure about my comment regarding VOMS-like systems (page 12) 'cause if it is correct then may bring additional complexity to the Proxy Revocation Mechanism. :( Salut, -- <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> o o o Jesus Luna Garcia | Polytechnic University of Catalonia o o o PhD Student | Department of Computer Architecture o o o phone: +34 93 401 7187 | Campus Nord. www.ac.upc.es U P C fax: +34 93 401 7055 | C/Jordi Girona 1-3, Modul D6-116 E-mail: jluna(a)ac.upc.es | Barcelona 08034 SPAIN <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>

1 0

Presentation slides OCSP document
by Jesus Luna 14 Feb '06

14 Feb '06

Regards, -- <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> o o o Jesus Luna Garcia | Polytechnic University of Catalonia o o o PhD Student | Department of Computer Architecture o o o phone: +34 93 401 7187 | Campus Nord. www.ac.upc.es U P C fax: +34 93 401 7055 | C/Jordi Girona 1-3, Modul D6-116 E-mail: jluna(a)ac.upc.es | Barcelona 08034 SPAIN <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>

1 0

RE: [caops-wg] OCSP & Proxy Certs
by Cowles, Robert D. 13 Feb '06

13 Feb '06

> Conclusions: > We should recommend CA operators include an AIA URL for OCSP, and > stand up a server. > Since not every CA can do this, we should recommend some agency > (IGTF? commercial?) stand up clearinghouse OCSP responders which > can become well-known & trusted resources > A protocol for permitting authenticated updates (registering of > revoked proxy certs) may need to be developed > OCSP client software must ignore "unknown" responses about proxy > certs - no info is no info in this case. > Following up on discussions at the EUgridPMA and post-meeting discussiions, I'm really nervous about the fragility of a network of OCSP responders.... that's just for the CA's and doesn't really address the issue that Mike raises of how we set up a network of responders that will do what we want with proxy certificates. For what it's worth, there seem to be a number of wireless providers in airports, etc. that I'm seeing recently who are supplying OCSP information that Firefox chokes on and so it won't allow me connect to the site. Being a typical user, I don't give damn about the PKI infrastructure, I just wantto chckmy email and I don't want have to spend an even longer time screwing around ... as a result, I now use IE to connect to wireless systems for payment, registration etc. Also, IE doesn't seem to cache the DNS and so as I move from airport to airport, it is more likely to do the redirection to the new registration page in a timely fashion than Firefox. (I suspect that the same issue is involved in the OCSP error code I receive, but I haven't bothered to look it up. BC

6 16