- caops-wg - lists.ogf.org

The Open GRid Ocsp -OGRO- client has been launched!
by Jesus Luna 03 Oct '05

03 Oct '05

Dear all, We really sorry for not being able to attend the next GGF meeting, but on the other hand a couple of weeks ago we hosted here in Barcelona TERENA's TF-EMC2 meeting (presentations can be found in http://www.terena.nl/tech/task-forces/tf-emc2/meetings/sep05/agenda.html) and we had the opportunity to introduce CertiVeR's OCSP validation infrastructure for Grids. Such system is composed of two elements: -In first place an OCSP Service which is currently configured as a Trusted/Authorized Responder for several Grid PKIs. As mentioned in TERENA's meeting, at this moment such service is being tested (Pilot Phase) and offered free of charge for those CAs whishing to use it. The list of CAs being served will grow in the next days, so please let us know your comments or questions about it. More information about the service can be obtained from: http://globus-grid.certiver.com/info/ -In second place as mentioned weeks ago in this list, we have *finally* released the first version of the Open GRid Ocsp -OGRO- client API (Java version). This client implements a "Grid Validation Policy", consisting of a set of XML-rules to provide OCSP validation for Grid, taking into consideration several of the issues discussed in this group. As a proof of concept we have integrated it into the Java CoG 4 libraries (example available in OGRO's web page) and also into GT4's WSRF Java Core (example to be released in the following days also). OGRO is being offered with a GNU GPL license, so please feel free to use it. You can find more information in: http://globus-grid.certiver.com/info/ogro/index.html We hope to release soon more technical details about OGRO-CertiVeR-GT4 (benchmarks, optimized validation policies, etc.), but in the meantime we will appreciate your comments, questions, bugs reports, etc. Best regards! -- ____________________ Jesus Luna Garcia PhD Student. Polytechnic University of Catalonia Barcelona, Spain jluna(a)ac.upc.edu

3 2

OCSP draft : latest status
by Olle Mulmo 01 Oct '05

01 Oct '05

All, Very fruitful discussions and comments so far! Just to let you know, I am doing my best trying to keep up and annotate the existing document with comments, to capture all that has been discussed so far, and in what way certain sections need improvements or additions. I plan to finish this in a couple of days (have another document deadline to take care of first) -- could be useful for our continued discussions. Also, to avoid confusion, I will hold off publishing an updated version until after GGF14. /Olle

2 1

OCSP document status
by Olle Mulmo 24 Aug '05

24 Aug '05

Dear all, Hope you all have had a good vacation for some part of the past couple of months. Document submission deadline for GGF15 is rapidly coming -- much sooner than I had thought, actually, and my workload for the next couple of weeks is not looking promising. Is someone interested in taking on the lead to shepherd the progress on the OCSP document for the next couple of weeks? In particular, what is currently left is a discussion on the use of proxy certificates. Regards, /Olle

2 1

Re: [tagpma-general] "accredit" and branding
by Mike Helm 05 Jul '05

05 Jul '05

Mark Franklin writes: > I'd like to add another twist to this discussion - Levels Of Assurance > (LOAs). These come up a lot in the PKI world. The idea is that relying We actually started here. If you look at the early GGF work on CP/CPS -- GFD 16 -- you will find a lot of discussion about levels of assurance, much of it borrowed from previous exposure to US Federal Bridge and agency CP/CPS's. But this has gone nowhere in the grid community. It doesn't seem to be the way the current grid projects work. Some of this probably is due to the limitations of the underlying crypto library. However I don't think the levels tell the relying party that much that it finds useful, so assurance levels have never been implemented. I am thinking maybe refactoring this idea and "branding" or project referencing might be more useful.

1 0

"develop"
by Mike Helm 01 Jul '05

01 Jul '05

I wanted to talk about TAGPMA charter use of the word "develop"; I don't think I stated my case very well yesterday. I'm using an older draft & I know some changes are in the offing but I don't think they invalidate this comment. There is a gradual escalation in the meaning of "develop" from the beginning of the charter, from this (p2 or 3) It will be the mission of the TAGPMA to develop and maintain published information on the trustworthiness of its member authentication service providers. To this p5, 2.2 The TAGPMA will develop Authentication Service profiles that reflect our community's requirements. With a couple stops in between. (1) As a practical matter, I don't see how TAGPMA can do this kind of development in 2.2. Members or prospective members can develop, and bring these new ideas in, but TAGPMA isn't a supported project. Now, I think it might be a good idea for such efforts to be supported - is that what is intended for this PMA? Will be making a roadmap &c? (2) As a matter of trust management, do you want the developer to be the approver / accreditor too? I think you'd want to have a little more impartiality in the TAGPMA / review side of the relationship (imagine making the town building inspector and real estate developer the same person). I think the earlier language was better - "foster development" &c, and something migth be needed here to say how innovations get let in. Unless #1 above is really what is wanted here.

1 1

XKMS next steps
by Mike Helm 01 Jul '05

01 Jul '05

Thought this might be of interest & time-critical.... ------- Forwarded Message

1 0

Re: Debriefing teleconf for tuesday 5 June?
by Stephen Farrell 01 Jul '05

01 Jul '05

Here's one that I've been thinking about for a long while, but which has never gotten sufficient interest from anyone to warrant doing work: How about XKMS as a way to allow XML applications to more easily integrate with Kerberos? I imagine there won't be enough interest to do this, but do let me know if I'm wrong. Regards, Stephen. Jose Kahan wrote: > Hi folks, > > Would you be available for a teleconference next Tuesday at > the usual time ( Time: 8:30am-9:30am PST/ 11:30am-12:30pm > EST/16:30-17:30 UTC [1]) to talk > abut the publication of the Recommendation and next steps? > > As I said in a previous message, our charter is extended until > end of September 2005 so that we can do the after-publication > maintenance (erratas and so on). At that time, if the WG wants to > do further work in something else, it must be rechartered and > the WG need to be reformed. Of course, if this is the goal, we shouldn't > wait until end of September to start that. Last time we talked about > this, there didn't seem to be any further need for rechartering. > > During this period, I think that it would be interesting to try > to focus on three tasks (just a proposal) that be a product > of the WG: > > - errata > > - W3C Note: WSDL description for XKMS > We already have one proposal[1]. I noticed there was another > one in the original XKMS 1.o submission[2]. > > - documenting actual deployment, real use cases, tutorials... > anything that can incite people to adopt this technology faster > > Do you have other topics you would like to discuss? How about the ideas > that were around for completing the PGP support in xml:dsig? We could > document them and do some kind of early implementation to make this > progress quickly and publis it as a note too. > > If people are not available for meeting next week, could I know who > is interested in participating in the WSDL XKMS Note so that > we can examine our resources and evaluate if we can get it ready > by end of September? > > Does this make sense? It's ok with me if you want to handle it through > email rather than thru a teleconf. > > Thanks! > > -jose > > [1] http://lists.w3.org/Archives/Public/www-xkms/2005Mar/0027 > [2] http://www.w3.org/TR/xkms/#_Toc505753190 > [3] http://www.timeanddate.com/worldclock/ ------- End of Forwarded Message

1 0

RE: CAOPS and TAGPMA schedules at GGF 14
by Genovese, Tony 23 Jun '05

23 Jun '05

Hi Alan - The date is correct (6/30), but it is Thursday not Wednesday. The official agenda for GGF14 is below: http://www.gridforum.org/webevents/publish/webevent.cgi?cmd=listweek&cf= list&cal=cal80&d=27&m=06&y=2005 Thursday Jun 30 11 a.m. - 12:30 p.m. Certificate Authority Ops - WG #3 Calendar: Regent 1 Details: Deal with TAGPMA community issues. CA-OPs 1 Tuesday 2:30 - 4:00 is for CA-ops general meeting. CA-OPs 2 Tuesday 4:30 - 6:00 is for the International Grid Trust Federation. Million thanks to Darcy for setting this up!! Tony... > -----Original Message----- > From: Alan Sill [mailto:Alan.Sill@ttu.edu] > Sent: Thursday, June 23, 2005 1:52 PM > To: Genovese, Tony > Cc: Charlie Catlett; abose(a)umich.edu; Scott Rea; Alan Sill; Frank J. Nagy; > tagpma-general(a)tagpma.org; caops-wg(a)ggf.org; darcy.quesnel(a)canarie.ca; > Dane Skow; Mark Franklin; William A.(Andy) Adamson; tony(a)ncsa.uiuc.edu; > Cowles, Robert D. > Subject: Re: CAOPS and TAGPMA schedules at GGF 14 > > Just double-checking that this is still the schedule. > > Alan > > On Jun 13, 2005, at 1:56 PM, Genovese, Tony wrote: > > > The schedule for GGF 14 is now available on the website: > > > > http://www.gridforum.org/webevents/publish/webevent.cgi? > > cmd=listweek&cf= > > list&cal=cal80&d=27&m=06&y=2005 > > > > Tuesday: > > Jun 28 2:30 p.m. - 4 p.m. CAOPS-WG #1 Calendar: Consulate 1&2 > > Jun 28 4:30 p.m. - 6 p.m. CAOPS-WG #2 Calendar: Consulate 1&2 > > Wednesday: > > Jun 30 11:00 a.m. - 12:30 p.m. CAOPS-WG #3 Calendar: Regent 1 > > > > > > CAOPS-WG 3 is the scheduled meeting time for the TAGPMA. Please review > > the charter before our meeting. Founding members (CC'd) listed in the > > charter, if you can not make it or send a representative please let me > > know. This meeting is to review and approve our charter. Thanks, > > > > http://www.gridpma.org/docs/TAGPMA%20charter%20v1.pdf [.doc] > > > > Tony... > > > > > ====================================================================== > : Alan Sill, Texas Tech University Office: Science 117, MS 41051 : > : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-3730 fax 806-742-1182 : > ======================================================================

1 0

RE: [caops-wg] OCSP section 4
by Cowles, Robert D. 22 Jun '05

22 Jun '05

> >Clients are off the net all the time, for a large number of reasons. > >The relying party decisions are often time critical -- need > to be made > >now, not 2 hrs from now when the router is fixed and the remote OCSP > >responder > >is visible again. > > If a client is off the net, it is not going to be easy to validate a > certificate on-line because only if the certificate is on the > localCRL/OCSPcache the client will be sure of its status. > Hopefully, most certificates being used should be valid. > Therefore, they > won't be present in the localCRL. Sorry to be responding to this a week later but I have to point out that attacks are not random events, they are often coordinated. That means, unless you KNOW an OCPS responder is down because of a hardware problem or something similar, then it could well be "not responding" PRECISELY because you, the relying party, are about to be asked to verify a newly compromised certificate. The point I'm trying to make is that from a securit perspective it is foolish to assume the events "OCSP responder is inaccessible" and "asked to validate a compromised certificate" are independent events ... as soon as we assume that, we create a vulnerability that can be exploited. Bob Cowles

1 0

Agendas for GGF
by Darcy Quesnel 20 Jun '05

20 Jun '05

I've asked for three slots at the next GGF. The first session will deal with regular CAOPS business: - discussion of the latest OCSP draft (thanks Olle!) and maybe: - an auditing check list for CA's by Yoshio? and Olle has suggested: - XKMS, who will explain this to us? - some discussion is needed of site-integrated credential stores (KCA, etc.) and their operational concerns Is there anything else anyone would like to add to this? There are also two other sessions, one for discussion of International Grid Federation issues, and one for discussion The Americas Grid PMA issues. Any ideas for the agenda of these are also welcome. Darcy

2 1