- caops-wg - lists.ogf.org

Migration to OGF Redmine for the CAOPS-WG and import of gridforge documents
by David Groep 25 Jun '12

25 Jun '12

Dear all, Some of you may already have heard that Open Grid Forum is changing their document management system from SourceForge (GridForge) to Redmine. This should alleviate systems maintenance and bring down costs, and the new service should be more stable and easier to manage. The new OGF Redmine is at https://redmine.ogf.org/ A downside it that all content needs to be migrated, and a new structure must be built up. During the CAOPS meeting in Delft at OGF35 we decided to move CAOPS now, migrating the current documents from Gridforge to Redmine. I was the lucky victim to try it for you - and the initial migration has just happened: - *all* documents from gridforge have been preserved. The raw dump hereof is available on redmine under "Files": <https://redmine.ogf.org/projects/caops-wg/files> as a multi-part rar archive -- since Redmine has a max upload file size of a mere 5 MByte. No data have been lost - contents have been imported manually into the Redmine DMSF Document store: <https://redmine.ogf.org/dmsf/caops-wg> in a structure based on the GFD type (Informational, Recommendations, Community Practice). - history of all documents has been preserved, although in some cases historic versions are bundled up in a single ZIP file also retired documents are there ("Retired") since we may revive them at a future date. - wiki contents are also migrated - documents of the former LoA-RG have been consolidated into CAOPS - we use no other features of gridforge, apart froma lone tracking item that was no longer relevant (OCSP requirement progress, used during GGF13) You can view all documents by going to redmine now, but for group members: - please sign up to redmine (the account management is not joint, sorry) - click "request to join" so we can sign you up to the group - start contributing to documents and discussions, or maintain the wiki ;-) I hope we learn to work with Redmine as we have learned to deal with Gridforge ... questions and suggestions to me and the list please! Cheers, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Re: [caops-wg] Updated version GFD.125bis "Grid Certificate Profile" intended for PREC
by David Groep 25 Jun '12

25 Jun '12

Dear Reimer (cc: WG), On 2012-06-18 11:41, Reimer Karlsen-Masur, DFN-CERT wrote: > Hi David, > > a couple of remarks: > > 1. Why is SHA-2 for CA certs a SHOULD (section 2) when it is "only" > RECOMMENDED for EE-certs (section 3)? For RFC2119 the "SHOULD" and "RECOMMENDED" are the same ... "there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course." > > 2. Typo in footnote 12 "It no..." Thanks - fixed in v0.5! Also the "forward slash" as noted by John Kewley has been fixed now. Since OGF is migrating all document from GridForge to Redmine (https://redmine.org.org/) also the new version 0.5 is uploaded there: https://redmine.ogf.org/dmsf_files/25?download=66 with the revision history at <https://redmine.ogf.org/dmsf_files/25>. A copy is also still held in GridForge. Cheers, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

PKPWP draft ready(ish) for discussion
by Jens Jensen 17 Jun '12

17 Jun '12

Folks, I finally got the draft document transferred onto the wiki, just about in time for CAOPS tomorrow morning. https://grid.ie/eugridpma/wiki/GuidelineOnPrivateKeyProtection2 ... which took a little more editing of bullet/numbering and stuff but I think I got it right. Moreover, I think I managed to simplify a few things. Things to ponder is the distinction between the different flavours of private keys, ie protected key, activation data, activated key. I've tried to keep it generic-ish, so a key is not necessarily an RSA key, although it does mention "certificate" and CA. Thanks --jens

1 0

CAOPS sessions at OGF35 in Delft
by Mike Jones 16 Jun '12

16 Jun '12

Folks, We have two sessions scheduled for CAOPS on Monday between 0900 and 1230. A tentative agenda has been posted here http://bit.ly/OGF35CAOPS Please let me know if you wish to add to (or take from) this. See you in Delft. Rgds, Mike

3 3

Updated version GFD.125bis "Grid Certificate Profile" intended for PREC
by David Groep 07 Jun '12

07 Jun '12

Dear all, Following the discussions in Oxford and later, I had uploaded a new version of the "revised" Grid Certificate Profile to GridForge: https://forge.ogf.org/sf/go/doc16402 and have now put there a new (v3) edition which addresses a comment raised by Roberto Cecchini: > I'm referring to the paragraphs 2.4.4 (AuthorithyInfoAccess) and 2.4.5 > (which, IMHO, should be 2.4.4.1). From the document I didn't understand > if the AIA extension is a MUST/SHOULD/COULD/COULDN'T and so on... which is addressed by making the "may" into a "MAY" and adding a footnote with a proposed explanatory text in 2.4.4. Please have a look and comment on this change. Let's also try to converge on a final version by OGF35 in Delft (in two weeks) to that it can go on to the Editor. See you @OGF35! DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Updates to GFD.125 and time line to completion
by David Groep 13 Mar '12

13 Mar '12

Dear all, Following the discussion today on the revision of the Grid Certificate Profile (GFD.125), I have uploaded the base of the new document to GridForge onder the CAOPS Working Drafts: https://forge.ogf.org/sf/go/doc16402 this version is still very much like the original GFD.125, except for the following: - the preamble now mentions it is a "recommendation" - all references to RFC3280 have been replaced by 5280 - the ambiguity regarding emailAddress ("obsoleted" vs. "depricated") for its use in subject names for CAs and EECs has been resolved and is now in line with RFC5280 - emailAddress (or Email, or E) now MUST NOT be used in subject or issuer DNs What still needs to be done, and for which your input is much appreciated: - verify consistency with RFC5280 (following the 3280->5280 change) - remove references to java version 1.4, and the by-now-dangerous recommendation to have the keylength smaller than 4096 (section 4.3). We should review the status of small key lengths on eTokens, where the maximum might be 4096 bits. The aim is very much to get the new GFD out quickly as a recommendation (instead of an information document), so the proposed changes have a deliberately limited objective: make sure it is consistent and not wrong. Other experience we may have gathered over the years and which can be folded in quickly (and without much controversy) is also very welcome. The aim is to have a new document approved by the WG and ready for public comment BEFORE the next OGF35 in Delft. So it must be done by the end of May this year. Comments on the list are welcome, and GridForge is always available for uploads and comments as well. Best, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

CAOPs @ OGF34
by Yoshio Tanaka 13 Mar '12

13 Mar '12

Dear all, We will have a CAOPs session at OGF 34, Oxford. Date: Tuesday, 13 March (today). Time: 1:30pm - 3:00pm Venue: Lecture Theatre B Tentative Agenda: CAOPs stuff - GFD.125 update - Follow up of OGF33 (if needed) - Namespaces check - Sending signed email IGTF stuff - PMA update - Classic AP 4.4 - RAT staff (including SHA2 issue) Please let me know if you have the other agenda. There will be a security-related workshops prior to the CAOPs session in the same room, same day. 11:00 - 12:30 Federated Security See you soon! -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

NIST Identity Management White Paper (draft, Aug. 30 2011)
by Alan Sill 19 Sep '11

19 Sep '11

Hi folks, On the topic of federated iIdM-related standards for clouds, you may be interested in reading and/or participating in the discussion going on at the US Federal government level within the NIST 'standards acceleration to jump-start the adoption of cloud computing" (SAJACC) effort: http://tinyurl.com/3ku7ah4 If you are interested in more information or in participating in this group, for which IdM is a small subset of their ongoing work, the URL to access their web page is: http://collaborate.nist.gov/twiki-cloud-computing/bin/view/CloudComputing/S… Thanks, Alan

1 0

Meeting in Lyon?
by Milan Sova 24 Aug '11

24 Aug '11

Hi. Although is is less then a month to the OGF33 in Lyon the agenda for the meeting is not published yet. Is the date for the CAOPS meeting already set? It would really help planning the trip. Regards -- Milan Sova sova(a)cesnet.cz

2 1

GFD.125 to P-REC?
by Alan Sill 05 Aug '11

05 Aug '11

Hi David and the CAOps group, I'd like to suggest that we think collectively about the considerations that have led us to put forward the very useful and by now quite mature CAOPs document GFD.125 as a "COmmunity Practice" document and not as a proposed recommendation. I understand that historically, there was some thought that this profile might not represent a collection of items that ought to be standardized, but I think that experience has shown most of its content to be important, if not essential. With this in mind, I'd like to raise the issue of whether this quite mature document, or another one quite close to it in intent, might be worth putting forward into the stream as a proposed recommendation. To go from a proposed to a full recommendation would take the passage of some time and demonstration of multiple implementations; I am willing to consider the multiple adoptions of GFD.125 by CAs throughout the world as implementations for this purpose. There may be other points of view, but now is the time to discuss them, I think, and so would like to ask for your input. Thanks, Alan

4 3