- caops-wg - lists.ogf.org

Re: [caops-wg] [voms-proc-wg] [Idel-wg] OGF37 Arrangements and sessions
by Yoshio Tanaka 31 Jan '13

31 Jan '13

Hi Mike, Jens, and all, I'm planning to go to OGF37, but I need to leave there on Wednesday (13th). So, if we have CAOPs session(s), I would expect that it will be on Monday or Tuesday. -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) From: Jens Jensen <jens.jensen(a)stfc.ac.uk> Subject: Re: [voms-proc-wg] [Idel-wg] OGF37 Arrangements and sessions Date: Sun, 20 Jan 2013 15:01:19 +0000 Message-ID: <50FC06BF.9030700(a)stfc.ac.uk> > Hi Mike, > > There is more afoot for OGF37; Andrew Grimshaw is planning to organise > a specific workshop on (identity) delegation. He was going to write > some paragraphs and send them around - probably around now. It would > make sense to combine IDEL-WG with this activity (ie to host it as an > extended IDEL-WG) - if you agree. > > 1. I haven't looked into the timing/flights/costs/logistics yet, so I > don't know. > 2. A day would seem reasonable (four sessions)? > 3. Don't know; will leave to the chairs to decide. There is useful > stuff to do, though, we have enough material for at least one session > - a draft IGTF profile for SARoNGS et al (aka "LIVE"), updates from > PMAs, > 3. As regards FEDSEC I suspect there is more than enough useful new > stuff floating around, but it'll depend on who is coming and to some > extent how many documents I have time to put into a useful form before > March... > > Cheers > -j > > On 18/01/2013 17:01, Mike Jones wrote: > > Folks, > > > > It's time to register sessions of OGF37. > > > > There's noise from IDEL participants and we should schedule that this > > group > > meets. And I should be in a position to circulate a strawman on the > > gridsite > > delegation info doc real soon^(TM). > > > > CA-ops mentioned that OGF37 was scheduled close to another similar > > meeting and > > folk might not be able to make it; I believe we should at least meet > > for one > > session to keep things ticking forward, but am happy to apply for more > > than 1 > > session if we thing there are items to discuss. If we will not be > > quorate > > then perhaps we should not have CA-ops > > > > VOMS proc has a straw-man doc that we need to work on so we need to > > schedule > > this session. > > > > Questions then: > > > > 1, Who will make it to OGF37 > > 2, do we need 3 or 4 sessions to cover work (assuming CA-OPS)? > > 3, do we suspend CA-ops this time due to participation? > > also, > > 3, Jens Are you going, and is there a FedSec session? > > > > Rgds, > > Mike > > > > > > _______________________________________________ > > Idel-wg mailing list > > Idel-wg(a)ogf.org > > https://www.ogf.org/mailman/listinfo/idel-wg > > > -- > Scanned by iCritical.

1 0

OGF37 Arrangements and sessions
by Mike Jones 20 Jan '13

20 Jan '13

Folks, It's time to register sessions of OGF37. There's noise from IDEL participants and we should schedule that this group meets. And I should be in a position to circulate a strawman on the gridsite delegation info doc real soon™. CA-ops mentioned that OGF37 was scheduled close to another similar meeting and folk might not be able to make it; I believe we should at least meet for one session to keep things ticking forward, but am happy to apply for more than 1 session if we thing there are items to discuss. If we will not be quorate then perhaps we should not have CA-ops VOMS proc has a straw-man doc that we need to work on so we need to schedule this session. Questions then: 1, Who will make it to OGF37 2, do we need 3 or 4 sessions to cover work (assuming CA-OPS)? 3, do we suspend CA-ops this time due to participation? also, 3, Jens Are you going, and is there a FedSec session? Rgds, Mike

2 1

document drafts on use of OCSP for IGTF CAs (profiling RFC5019 and relying party guidance)
by David Groep 10 Jan '13

10 Jan '13

Dear all, When we discussed the move to actual OCSP deployment for (large numbers of) IGTF CAs last year during OGF, we came up with the idea of writing two documents to facilitate this deployment: * guidelines for IGTF CAs on how to quickly (and correctly) deploy authoritative OCSP responders, which profile to choose, and how to generate it. Basic on RFC5019 'light-weight' OCSP, but then with some documents and tooling to actually know what to do * a guide for relying parties (and software coders) on how to set up their software and site to make use of OCSP services without causing an effective DDoS against the CAs. We had foreseen a discussion in Rome on progressing the OCSP effort, and we now face the sad duty of having to do that without Milan's guidance. At least we should try and make some progress, relying on good examples and hopefully leveraging some of Scott knowledge on 'real world' deployment. It is also a topic which for which the documents can be partly IGTF (where they concern policy and operations), and partly OGF CAOPS-WG (where they concern profiling and standards). I've made a basic and simple start with two Wiki pages: http://wiki.eugridpma.org/Main/OCSPDeploymentGuidelines http://wiki.eugridpma.org/Main/OCSPProfileForIGTFCAs one for each document. I propose we review these during the Monday session next week. Those in CAOPS who want to join at this stage, you're welcome any time -- the meeting will have video connectivity open for these discussions (hoping the video works). It will definitely also be a topic for OGF in Charlottesville. Details of the video conf will be at <https://www.eugridpma.org/meetings/2013-01/#video> Best regards, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Fwd: Re: Milan
by David Groep 04 Jan '13

04 Jan '13

-------- Original Message -------- From: Jan Ruzicka <janru(a)cesnet.cz> Thank you all for the warm responses. According to wish of the family, the last farewell with Milan will be held tomorrow at noon in Prague. We will arrange flowers or wreath on behalf of TERENA and international AAI community. Thank you again Jan On 01/03/2013 10:02 AM, Jan Ruzicka wrote: > Dear all, > > it is very sad to be the bearer of this news: Milan Sova of CESNET has > suddenly passed away. > He was a good friend, great colleague and amusing musician. > > With kind regards and in sorrow, > > Jan > -- ------------------------------------------------------------------- Ing. Jan Ruzicka CESNET z. s. p. o. tel: +420234680499 Zikova 4 e-mail,sip: janru(a)cesnet.cz 160 00 Praha 6 icq:151316768 Czech Republic -------------------------------------------------------------------

1 0

Milan Sova
by David Groep 03 Jan '13

03 Jan '13

Dear all, It is with great grief and sorrow that I forward the news that Milan Sova, our colleague of the CESNET CA has suddenly passed away. He has been one of the great driving forces for the IGTF, EUGridPMA, and the CAOPS-WG, and a pioneer in PKI and identity management - but above all a source of inspiration and joy during all those many places we went and where we together built up that warm and fuzzy feeling of trust. Let us remember Milan for all the great times we had together and his inspiration -- it's still hard to comprehend. We'll miss you! DavidG. > Date: Thu, 03 Jan 2013 10:02:08 +0100 > From: Jan Ruzicka <janru(a)cesnet.cz> > > Dear all, > > it is very sad to be the bearer of this news: Milan Sova of CESNET has > suddenly passed away. > He was a good friend, great colleague and amusing musician. > > With kind regards and in sorrow, > > Jan > --=20 > ------------------------------------------------------------------- > Ing. Jan Ruzicka CESNET z. s. p. o. > tel: +420234680499 Zikova 4 > e-mail,sip: janru(a)cesnet.cz 160 00 Praha 6 > Czech Republic > ------------------------------------------------------------------- -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

10 9

Re: [caops-wg] [tagpma-general] RE: [apgrid-pma:28517] Re: [igtf-general] Milan Sova
by Sill, Alan 03 Jan '13

03 Jan '13

A tremendous loss. He will be missed deeply at many levels, as a friend, thoughtful contributor, careful and patient colleague, and as a warm and insightful human being. Alan On Jan 3, 2013, at 6:28 AM, Yousef Torman <torman(a)asrenorg.net<mailto:torman@asrenorg.net>> wrote: Dear All I also join in sending my condolences. Yousef Torman From: Suhaimi Napis [mailto:suhaimi@putra.upm.edu.my] Sent: Thursday, January 03, 2013 1:25 PM To: members(a)apgridpma.org<mailto:members@apgridpma.org> Cc: David Groep; All IGTF Members (igtf-general); CAOPS-WG; AnkabutTeam; merrouch(a)cnrst.ma<mailto:merrouch@cnrst.ma>; Yousef Torman; talhaoui(a)cnrst.ma<mailto:talhaoui@cnrst.ma> Subject: Re: [apgrid-pma:28517] Re: [igtf-general] Milan Sova My condolences to his family. A great loss indeed. Suhaimi Napis, PhD Dept of Cell and Molecular Biology, Universiti Putra Malaysia T: +603 89471299/1010; D: +603 89467590; +sn(a)upm.my<mailto:sn@upm.my>; @s_napis; (s) snapis2006 >>Sent from my smartphone. Sorry for typos, gramms and truncs. SAVE TREES•THINK B4 U INK On Jan 3, 2013, at 6:11 PM, "Ahmed Dabbagh" <ahmed.dabbagh(a)kustar.ac.ae<mailto:ahmed.dabbagh@kustar.ac.ae>> wrote: Very sad to hear this bad news. Milan was very active member in certification authority, which I always learnt from his great experience Regards, Ahmed Sent from Samsung Mobile David Groep <davidg(a)nikhef.nl<mailto:davidg@nikhef.nl>> wrote: Dr. Ahmed Dabbagh Technology Development Manager <M2.jpg> UAE Advanced Network for Research and Education P.O.Box 127788 , Abu Dhabi, UAE T : +971-(0)2-5018530 F: +971-(0) 2-4472442 M: +971559568863 E: ahmed.dabbagh(a)kustar.ac.ae<mailto:ahmed.dabbagh@kustar.ac.ae> <M3.png> Dear all, It is with great grief and sorrow that I forward the news that Milan Sova, our colleague of the CESNET CA has suddenly passed away. He has been one of the great driving forces for the IGTF, EUGridPMA, and the CAOPS-WG, and a pioneer in PKI and identity management - but above all a source of inspiration and joy during all those many places we went and where we together built up that warm and fuzzy feeling of trust. Let us remember Milan for all the great times we had together and his inspiration -- it's still hard to comprehend. We'll miss you! DavidG. > Date: Thu, 03 Jan 2013 10:02:08 +0100 > From: Jan Ruzicka <janru(a)cesnet.cz<mailto:janru@cesnet.cz>> > > Dear all, > > it is very sad to be the bearer of this news: Milan Sova of CESNET has > suddenly passed away. > He was a good friend, great colleague and amusing musician. > > With kind regards and in sorrow, > > Jan > --=20 > ------------------------------------------------------------------- > Ing. Jan Ruzicka CESNET z. s. p. o. > tel: +420234680499 Zikova 4 > e-mail,sip: janru(a)cesnet.cz<mailto:janru@cesnet.cz> 160 00 Praha 6 > Czech Republic > ------------------------------------------------------------------- -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL ** <ank-union27983.png> --

1 0

Re: [caops-wg] [Ca] [apgrid-pma:28514] [igtf-general] Milan Sova
by Jinny Chien 03 Jan '13

03 Jan '13

I still can't accept this bad news now. He is a good mentor , and I got a lot of experience from him. I am really looking forward to seeing him again in APGridPMA/ISGC this year. :( Milan, we will miss you forever. Jinny >Dear all, > >It is with great grief and sorrow that I forward the news that >Milan Sova, our colleague of the CESNET CA has suddenly passed away. > >He has been one of the great driving forces for the IGTF, EUGridPMA, >and the CAOPS-WG, and a pioneer in PKI and identity management - but above >all a source of inspiration and joy during all those many places we went >and where we together built up that warm and fuzzy feeling of trust. > >Let us remember Milan for all the great times we had together and >his inspiration -- it's still hard to comprehend. We'll miss you! > > DavidG. > >> Date: Thu, 03 Jan 2013 10:02:08 +0100 >> From: Jan Ruzicka <janru(a)cesnet.cz> >> >> Dear all, >> >> it is very sad to be the bearer of this news: Milan Sova of CESNET has >> suddenly passed away. >> He was a good friend, great colleague and amusing musician. >> >> With kind regards and in sorrow, >> >> Jan >> --=20 >> ----------------------------------------------------------- -------- >> Ing. Jan Ruzicka CESNET z. s. p. o. >> tel: +420234680499 Zikova 4 >> e-mail,sip: janru(a)cesnet.cz 160 00 Praha 6 >> Czech Republic >> ----------------------------------------------------------- -------- > >-- >David Groep > >** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** >** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL ** >_______________________________________________ >Ca mailing list >Ca(a)lists.grid.sinica.edu.tw >http://lists.grid.sinica.edu.tw/mailman/listinfo/ca

1 0

Fwd: [pkix] Protocol Action: 'Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile' to Proposed Standard (draft-ietf-pkix-rfc5280-clarifications-11.txt)
by Sill, Alan 01 Nov '12

01 Nov '12

FYI Begin forwarded message: From: The IESG <iesg-secretary(a)ietf.org> Subject: [pkix] Protocol Action: 'Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile' to Proposed Standard (draft-ietf-pkix-rfc5280-clarifications-11.txt) Date: November 1, 2012 5:15:47 PM CDT To: IETF-Announce <ietf-announce(a)ietf.org> Cc: pkix mailing list <pkix(a)ietf.org>, pkix chair <pkix-chairs(a)tools.ietf.org>, RFC Editor <rfc-editor(a)rfc-editor.org> The IESG has approved the following document: - 'Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile' (draft-ietf-pkix-rfc5280-clarifications-11.txt) as Proposed Standard This document is the product of the Public-Key Infrastructure (X.509) Working Group. The IESG contact persons are Sean Turner and Stephen Farrell. A URL of this Internet Draft is: http://datatracker.ietf.org/doc/draft-ietf-pkix-rfc5280-clarifications/ Technical Summary Since the publication of RFC 5280 in May of 2008, several areas have been identified where the document was not clear, thus motivating a “clarifications” update. Experience with CA use of the Certificate Policies extension motivated a change to allow (MAY) use of BMPString. The DANE WG requested that PKIX clarify make an explicit (positive) statement about self-signed certificates that are not marked as CA certificates. PKIX published an informational RFC (5937) and a standards track RFC (5914) related to trust anchor formats and constraints processing by a relying party. This document updates 5280 to point to these documents. Experience with IDNs motivated a minor update to align the details of how such names are processed. The Secruity Considerations section was updated to reflect experience with attacks against CAs. This document addresses all of these issues. Working Group Summary Most of the clarifications in this document were not contentious, except for the self-signed certificate text. Numerous revisions were required to develop text that was acceptable to the WG. The original document editor was replaced as part of this process. He elected to no longer be listed as an author, but he is thanked in the Acknowledgements section. Document Quality This is a very small document and is well written. Most of the clarifications are motivated by experience with existing implementations of CA or RP software. There is no need for a MIB doctor review, there are no Media Types, etc. Personnel Steve Kent is the Document Shepherd, and Sean Turner the Responsible Area Director. _______________________________________________ pkix mailing list pkix(a)ietf.org https://www.ietf.org/mailman/listinfo/pkix

1 0

Minutes from the OGF36 CAOPS session
by David Groep 10 Oct '12

10 Oct '12

Dear all, The minutes of the CAOPS WG and IGTF session are now available thanks to Mike Jones. The collaborative minutes have been captured in a static version at http://redmine.ogf.org/dmsf_files/162 and you can contribute to the collaborative minutes at <http://bit.ly/OGF36CAOPS> GFD.125bis has also been sent to the editor for entering public comment as PREC document. Best regards, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Final version of the Revised Grid Certificate Profile
by David Groep 09 Oct '12

09 Oct '12

Dear all, Following the earlier WG last call, and having consolidated all pending changes, during the WG meeting today we decided to agree that this version should go to the AD and the OGF editor process. We hereby ask the AD (Jens) to make this document enter public comment period, as a PREC, for 6 weeks. <http://redmine.ogf.org/dmsf_files/25> Thanks to everyone who contributed to this revised version! Best regards, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0