- caops-wg - lists.ogf.org

Meeting Materials for GGF13
by Darcy Quesnel 16 Mar '05

16 Mar '05

All the presentations and the minutes are now available online. http://forge.gridforum.org/docman2/ViewCategory.php?group_id=56&category_id… Darcy

1 0

Re: Grid OCSP proposal
by Jesus Luna Garcia 16 Mar '05

16 Mar '05

Dear all, We hope you're having a very fruitful meeting at Seoul. We are looking forward to knowing a little bit what has been discussed there. Milan, Thanks for all your useful comments. We have read your document and agree with most of your observations (just a small change on page 6, changing "reply" by "replay"). In the case of OCSP Response Extensions we are expecting to publish our results soon, but in the meantime maybe the following remarks may help to clarify the point: -We agree with you in that the idea of including new extensions on the OCSP Response may be something relatively difficult to standardize. But on the other hand, we would like to point out that such mechanism has been defined in the RFC2560 with the aim to convey additional information on assertions made by the responder. What we find is that even though such generic mechanism has already been proposed on the standard, the document lacks of suggestions about which uses can be given to the extensions in order to suggest directions or services that could improve the validation process. This is normal given the fact that the standard is very generic in its design. However, the CAOPS-WG could propose a set of recommended/suggested ocsp extensions to improve the validation process for grid applications. For example, due to the dynamic nature of the mechanism, we find that the addition of extensions presenting information such as the accuracy of the OCSP Response (with values that could range from Very-High: Maximum Delay –md- of 5 minutes, High: md of 1 hour, Medium: md of 1 day, and Low: md of 1 week or more ), or the level of revocation of a certificate (definitely revoked or simply suspended) could help to complete the OCSP Response. In addition, given the connectivity provided by a central OCSP Response System we find that this could be an ideal place to convey information that could be retrieved from the user's domain without the need to communicate with other Authorities such as, for example, the degree of trust in the issuing authority of the certificate (i.e. Gold: highly trusted registry and revocation procedures, Silver: highly trusted registry procedures, Bronze: low confidence registry procedures). We believe that the availability of such dynamic information could be very valuable to complement a PDP AuthZ decision when matching against the correspondent validation policy in order to accept/deny user access for a grid application. - In our modest opinion, the set of extensions or services suggested in the final document, should present which ones could be useful on Grid environments, keeping always a balance between performance and security while providing a flexible security policy model. -Regarding to performance and extensions, initial testing has shown that parsing a couple of OCSP Extensions means an overhead of about 0.018 secs when comparing to an OCSP Response without them embedded. This time is relative due to the hardware being used - in our case, a Pentium III at 450 MHz. Even though the initial results do not seem to decrease considerably the efficiency of the responder, we are hoping to send you more results as soon as possible (Proxy Generation and Validation, etc.). -In the case of Trust Chaining for different CAs, we believe that this feature should not require a high overhead because the OCSP Responder will be signing with the same cryptographic keypair (only the public certificate is changed according to the CA hierarchy being processed). Best regards, Oscar & Jesus Milan Sova wrote: >> Hi Oscar, Jesus. >> First I'd like to say sorry I could not make it to Amsterdam in >> February to meet you - maybe next time? >> Thanks for your input. My comments to your version of the document >> are inline. >> One "global" comment here: I'm not too optimistic about defining >> new OCSP extensions. I'm afraid nobody is going to implement them >> unless they are properly standardized (or really widely used, which >> is, of course, a kind of chicken-and-egg problem). Similarly, >> overloading OCSP with authorization and "trust chaining" >> implementation would IMHO make bring up more complexity to the grid AA >> infrastructure. I'd prefer concentrating on really using the >> possibilities provided by current state of standards and available >> implementations. >> >> Regards > >

3 3

CAOPS-WG Schedule
by Darcy Quesnel 14 Mar '05

14 Mar '05

In one of the printed GGF schedules, it incorrectly states the CAOPS-WG session #1 was today at 13:00-14:30. This is not, in fact, the case. CAOPS-WG #1: Document Review Tuesday, March 15 15:00-16:30, Onyx Room CAOPS-WG #2: IGF Issues Tuesday, March 15 17:00-18:30 Please inform as many people as possible about the correct time. Darcy

1 0

GGF13 schedule (important changes!)
by Olle Mulmo 10 Mar '05

10 Mar '05

All, There were some unfortunate clashes in the schedules for the security area sessions. Therefore, the CAOPS#1 meeting HAS MOVED to Tuesday. There's an additional clash between CAOPS#2 and the ad-hoc delegation BOF, but nothing could be done about that. We will see if summaries of those sessions can be prepared and presented at the Security area meeting, which follows directly after. Various security related sessions that may be of interest: Monday, March 14: 1pm-2:30pm OGSA-AuthZ, Sapphire 3 5pm-6:30pm Firewall Issues Group BOF, Emerald 1&2 Tuesday, March 15 1pm-2:30pm Town Hall meeting, Crystal 3pm-4:30pm CAOPS#1, Onyx 5pm-6:30pm WS Delegation ADHOC BOF, Sapphire 1 5pm-6:30pm CAOPS#2, Crystal 3 7pm-8:30pm Security Area meeting, Sapphire 2 Wednesday, March 16 11am-12:30pm Grid VPN-RG BOF, Crystal 3 Not yet scheduled: Trusted Computing BOF See you in Seoul, /Olle

1 0

OCSP in PKIX
by Mike Helm 10 Mar '05

10 Mar '05

There's no draft available publicly, but the title sounds interesting: 3.2 OCSP Data Interchange Format John Hines (Tumbleweed) (no draft) The presenter will be submitting an individual draft defining a data interchange format for OCSP servers. The presentation will present the problems that inspired this draft and invite WG participation. (10 min.)

1 0

Sessions at GGF13
by Darcy Quesnel 17 Feb '05

17 Feb '05

I've scheduled two sessions at GGF13: one for document review and one for international PMA issues. The documents that are up for review are OCSP Requirements http://forge.gridforum.org/projects/caops-wg/document/OCSP_Requirements_for… and possibly http://forge.gridforum.org/projects/caops-wg/document/Authentication_Profil… Is there anything anyone would like to add to the agenda of this first session? The second session will hopefully be a summary of what the EUGridPMA, the APGridPMA, and the (newly-formed) TAGPMA are up to. We should have some time to talk about the PMA Charter document and how it applies to each. Is there anything anyone would like to add to the agenda of the second session? Darcy

1 0

EuroPKI 3rd Call for Papers
by David Chadwick 16 Feb '05

16 Feb '05

Dear All please find attached the third call for papers for the EuroPKI workshop. I am glad to announce that Carlisle Adams will be giving the keynote speech. So put the dates, 31 June-1 July in your diaries, and submit a paper if you have one. There is still time since there is a one week extension on the call for papers, which now closes on 27th Feb rather than 20th Feb. Regards David -- ***************************************************************** PLEASE NOTE NEW CONTACT DETAILS AS OF 1 JAN 2005 David W. Chadwick, BSc PhD Professor of Computer Science The Computing Laboratory, University of Kent, Canterbury, CT2 7NZ Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0