- caops-wg - lists.ogf.org

Agenda of the COAPS session at OGF 32
by Yoshio Tanaka 15 Jul '11

15 Jul '11

Dear all, We will have a CAOPs session at OGF 32, Salt Lake City. Date: Saturday, 16 July. Time: 3:30pm - 5:00pm Venue: Salon E Tentative Agenda: - Publish GFD 125 as a recommendation - Public Key Protections Guidelines Document (tbc) - Use X.509 in Cloud (tbc) Please let me know if you have the other agenda. There will be two security-related workshops prior to the CAOPs session in the same room (Salon E), same day. 11:00 - 12:30 Federated Identity Managgement 13:30 - 15:00 Federated and Delegated Access To Clouds I look forward to seeing many of you tomorrow. -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

Hacker Cracks Secure Hashing Algorithm Using Amazon Cloud -- Security -- InformationWeek
by Alan Sill 22 Nov '10

22 Nov '10

Thought you would be interested in the following link. Topic: Using EC2's cluster GPU power, security researcher spent only $2.10 to decrypt 14 SHA1 passwords in under an hour; other experts aren't concerned. Link: http://www.informationweek.com/news/security/NAC/showArticle.jhtml?articleI… Alan

2 1

HPC in the Cloud article: Cloud Security: The Federated Identity Factor
by Alan Sill 19 Nov '10

19 Nov '10

Thought you would be interested in the following link. Comments and discussion are welcome. Quote: "Standards like SAML and WS-Federation were purpose-built to provide robust security in the cloud. They keep authentication strong and securely within the enterprise firewall. They eliminate the need to maintain sensitive access control information external to the organization. They enable successful on- and off-boarding of all employees on a common directory server. They make it easier to pass security audits by giving full visibility into user access. They afford the flexibility needed to accommodate special or unusual needs. And they scale without adding significant cost or increased complexity." Link: http://www.hpcinthecloud.com/features/Cloud-Security-The-Identity-Factor--1… Alan

1 0

Fwd: [pkix] New Version Notification for draft-hotz-kx509-01
by Alan Sill 08 Nov '10

08 Nov '10

Can people please read this draft and comment if and as appropriate? Link: http://datatracker.ietf.org/doc/draft-hotz-kx509/ Thanks, Alan Begin forwarded message: > From: "Henry B. Hotz" <hotz(a)jpl.nasa.gov> > Date: November 8, 2010 3:22:35 PM CST > To: "saag(a)ietf.org" <saag(a)ietf.org>, "pkix(a)ietf.org" <pkix(a)ietf.org>, "ietf-krb-wg(a)anl.gov Group" <ietf-krb-wg(a)anl.gov> > Subject: Re: [pkix] New Version Notification for draft-hotz-kx509-01 > > I think I've incorporated all the suggested changes, except the ones that would create a new incompatible protocol. > > I intend to start discussion of a new version to fix the warts, but let's take care of this baseline first. > > On Nov 8, 2010, at 12:01 PM, IETF I-D Submission Tool wrote: > >> >> A new version of I-D, draft-hotz-kx509-01.txt has been successfully submitted by Henry Hotz and posted to the IETF repository. >> >> Filename: draft-hotz-kx509 >> Revision: 01 >> Title: KX509 Kerberized Certificate Issuance Protocol >> Creation_date: 2010-11-08 >> WG ID: Independent Submission >> Number_of_pages: 10 >> >> Abstract: >> This rfc describes a protocol, called kx509, for using Kerberos >> tickets to acquire X.509 certificates. >> >> While not (previously) standardized, this protocol is already in use >> at several large organizations, and certificates issued with this >> protocol are recognized by TAGPMA (The Americas Grid Policy >> Management Authority). >> >> >> >> The IETF Secretariat. > > ------------------------------------------------------ > The opinions expressed in this message are mine, > not those of Caltech, JPL, NASA, or the US Government. > Henry.B.Hotz(a)jpl.nasa.gov, or hbhotz(a)oxy.edu > > > > _______________________________________________ > pkix mailing list > pkix(a)ietf.org > https://www.ietf.org/mailman/listinfo/pkix Alan Sill, Ph.D Senior Scientist, High Performance Computing Center Adjunct Professor of Physics, TTU VP of Standards Open Grid Forum ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

Issues with the Audit Guidelines Document GFD 169
by Reimer Karlsen-Masur, DFN-CERT 28 Oct '10

28 Oct '10

Hi Yoshio, hi EUGridPMA list, hi CAOPS-WG, while working with the Audit Guidelines Document (GFD 169) I came across some surprising issues: The PDF offered from <http://www.ogf.org/documents/GFD.169.pdf> dated from 19.04.2010 differs from the latest .doc version available from <https://forge.gridforum.org/sf/go/doc4858> which is called version 10 dated from 20.01.2010. Both documents self-claim that they are each version 1.0. Aside some minor differences like release dates, table of contents, etc the PDF is missing a numbering of an audit case. The section numbering in the PDF is different from the one in the word doc. But immediately after section heading "3.1.2. CA System" in the PDF the case number (7) for "The CA computer where the signing of the certificates..." is missing. Inserting the number (7) here will introduce an off-by-one error for current numbers (7) to (48) being (8) to (49) after the correction. Case (49) in the current(!) PDF is actually redundant to case (50)i. and needs to be deleted. The requirement quoted in case (49) is no longer included in the IGTF-AP-Classic v4.3 and v4.2 document. Instead it became part of case (50)i. which is to be found in section 6 of the IGTF-AP-Classic document. This latter bug is also found in the .doc(!) version from 19.01.2010 except that the case numbering here is different again. Case (50) is the redundant requirement to be deleted so that cases (51) to (56) are off-by-one which need to be renumbered to (50) to (55) once the redundant case is deleted. Be aware that the Auditing Template document (audit check-list) available from <https://www.eugridpma.org/guidelines/classic> does not match its audit case numbers to any of the above (PDF & .doc) GFD 169 document's case numbers. That indeed got me so confused that I started to look into these issues. How can we go about getting GFD 169 fixed? I did not see any bug reporting mechanism on the OGF site.... Thanks Reimer -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-580 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 Sachsenstr. 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

3 7

New version of the "Relying Party Defined Namespace Constraints" document
by David Groep 27 May '10

27 May '10

Dear all, In preparation for the upcoming meeting, I've edited the RPDNC document to incorporate the comments received from the PC period. In doing so, I realised that there was indeed still some implementation suggestion in the requirements document, which I moved around a bit to an appendix. The document is, as always, at: https://forge.gridforum.org/sf/go/doc4857 and has two new revisions: https://forge.gridforum.org/sf/docman/do/downloadDocument/projects.caops-wg… has the new document vesion, with track-changes enabled (but hidden) and rev. 17 has a ZIP file with the PDF, a change-tracked PDF, and a PDF of the public comments received with brief notes on top stating if and where they were addressed). I realise that this document has been pending for ages, but hopefully we can push it out in Chicago. Comments welcome! Cheers, DavidG. -- David Groep ** Nikhef, Dutch National Institute for Sub-atomic Physics,PDP/Grid group ** ** Room: H1.50 Phone: +31 20 5922179, PObox 41882, NL-1009DB Amsterdam NL **

1 0

Auditing document is available as GFD-I.169
by Yoshio Tanaka 21 Apr '10

21 Apr '10

Dear all, Auditing Guidelines document (Guidelines for auditing Grid CAs) was published as GFD-I. 169 on 2010-04-19. Thank you very much for everyone who helped us to complete this document. The separate spreadsheet for Classic AP will also be available soon. Best Regards, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

1 0

CAOPs session at OGF28
by Yoshio Tanaka 15 Mar '10

15 Mar '10

Dear all, CAOPs/IGTF session will be held this afternoon (Monday 15, 16:00-17:30) in OGF28@Munich. The room is HGB-A014. Here is tentative agenda: ---------------------------------------------------------------------- 1. CAOPs (40min) (1) review document status - auditing guidelines doc. (Yoshio) - Signing off the HLCA document - specifically decide how to proceed with it (Jens) - relying party defined namespace policies (DavidG) - authentication service profile (Christos) (2) Outcome of the CSA discussion (Jens) 2. IGTF (40min) (1) updates from three regional PMAs (David, Eric, Scott) (2) approval status of private key protection doc (3) approval status of Comprehensive Guideline on Robots doc (4) change procedure for IGTF accredited policies (5) procedure for adding a new CA (Jens) 3. AOB ---------------------------------------------------------------------- Please let us know if you have the other agenda which should be put on the list. Best Regards, -- Yoshio Tanaka (yoshio.tanaka(a)aist.go.jp) http://ninf.apgrid.org/ http://www.apgridpma.org/

3 4

Private key protection
by Jens Jensen 16 Oct '09

16 Oct '09

Hi Reimer, It was not robots, that'll be tomorrow. We talked about the EE key protection document, but my talk was really about the Private Key Protection Working Party which discusses protection of "interesting" keys such as things that generate signatures, attribute authorities, etc. Regards --jens

2 2

CAOPS session minutes
by Jim Basney 15 Oct '09

15 Oct '09

OGF27 CAOPS meeting Agenda: - Status of the RPDNC Document [ DavidG, Jens Jensen] - Status of the Auditing Guidelines Document [ Yoshio Tanaka ] - Status of Authentication Service Profile Document [ Christos Kanellopoulos ] - Discussion on private key protection [ Jens Jensen ] - Input to OGF for the collaboration between CAOPs and IGTF - AOB Summary: * Yoshio will update the Auditing Guidelines by end of November to match the latest Classic AP and provide a spreadsheet checklist as a separate document. Alan Sill will help. * DavidG and Jens will respond to the public comments and make minor edits as needed to the RPDNC document by end of November. * Jens and Scott will draft a document on private key protection by the next OGF. * Yoshio Tanaka and Jim Basney will be reviewers for the ARCS SLCS. Minutes: Unfortunately Christos could not join us due to illness. Yoshio gave an update on the Auditing Guidelines document. Public comment period was Mar 2 to Apr 1 2009. Nine comments were submitted, four of them were just "I support." Yoshio hasn't had time to address the remaining five comments. Needs to be updated to latest IGTF Classic AP. Document must be updated when Classic AP is updated? Does OGF process support this? GFDs aren't meant to be updated frequently. GFD.125 has never been revised. We have collected changes for the next version. A revision would be a new document. Goes through public comment again. Make this document an example, and IGTF maintains the updated version. Or maintain it on gridforge? Could the checklist be moved to a separate spreadsheet? TAGPMA has a spreadsheet. Should it also include RFC 2527 paragraph numbers? Already does. It will be published on the OGF website once it's a GFD. Update to support MICS and SLCS profiles? APGridPMA doesn't have MICS or SLCS, so Yoshio doesn't have experience with them. Can someone else add it? Should the audit guidelines be profile-specific? Can they be more general? A lot of work to change at this point. Alan Sill volunteered to help. Provide spreadsheet checklist as a separate document. DavidG gave an update on the RPDNC document. Only one reviewer posted comments during the public comment period. The document doesn't sufficiently address an RPDNC file's life-cycle. Need to re-iterate that the relying party creates these files. David and Jens will work to clarify this. Is there an issue of trust between the CA and the RPDNC creator? Entirely up to relying party to do it. This document should focus on the RPDNC requirements. Some of the more complex examples show the composition of RPDNC policies. Jens will look at clarifying it. Alan recommends looking at openspf.org as an example policy framework. Are proxy certificates in-scope? No. Also editorial comments. Should the security considerations section discuss distribution of RPDNCs? We consider it out of scope, which should be stated in the security considerations section. DavidG and Jens will write responses to the comments and make minor edits to the document. The group is not aware of any progress on the Authentication Service Profile template document and Christos is unfortunately not here (due to illness) to give us an update. Jens led a discussion on private key protection. Goal: document best practices on private key protection. IGTF is drafting an End User Private Key Protection document. Scott Rea has documented a scheme for generating and distributing CA private keys for USHER. Key backup versus escrow. Escrow is storing the key with a 3rd party. Aim to have a draft by next OGF. Scott Rea volunteers to help. A community practice document that lists several options. Dhiva gave an update on the DOEGrids CA move to netHSMs. Will start with one netHSM for low usage CA and monitor. Then later move DOEGrids CA to netHSMs. Deploy second netHSM in remote location. Using nCipher netHSMs. Dartmouth uses Luna SA4. ES.net netHSMs will be in production next week in multiple locations. Brazilian Cryptus HSM. Could be used as a netHSM. FIPS Level 4 - wipes itself frequently for voltage violations. DOEGrids runs netHSM client on Linux. Two options: nToken or nCipher software. Brazilian HSM follows OpenHSM framework. Jens has MyProxy connected to nCipher HSM. NCSA has MyProxy connected to SafeNet HSM. Christos proposed a discussion of input to OGF but he's not here... Not sure what this is about. IGTF should become a formal partner of OGF? Jens will consider. Discussion of agenda for IGTF workshop session this afternoon: * Review of ARCS SLCS * Discussion of CA termination End of CAOPS session. Begin of IGTF workshop session. Neil Witheridge presented the ARCS SLCS. Federations members will self-assert that they meet requirements and must be open to external audit, but it's not clear that audits will be required. Current SLCS not up to SLCS Profile identity vetting requirements. SLCS client screen-scrapes Shibboleth IdP login page for authentication. SLCS server is modified software from SWITCH. IGTF SLCS will look for eduPersonAssurance value of LOA2. CN component consists of 'cn' attribute value and 'auEduPersonSharedToken' attribute value from Shibboleth. Requirement for delegation to grid portals. Are there portals that can't meet the guidelines of <https://grid.ie/eugridpma/wiki/GuidelineOnPrivateKeyProtection>? In that case, Neil proposed a proxy delegation architecture rather than a direct SLCS certificate issuance to the portal. Accreditation timeline depends on Australian Federation timeline. Likely will pursue accreditation next year. IGTF should proceed with the Private Key Protection document so it can be referenced by the Authentication Profiles by the end of the year. Yoshio and Jim Basney will be reviewers for this CA. Yoshio led a discussion of CA termination. APAC project is done. ARCS took over the APAC CA. Desire is to change the CA name. If issuer name changes, users will need to re-register with VOMS. UK and Swiss have done a CA name change like this. Discussion of difference between SLCS EECs issued to portals versus proxy certificates issued to portals. Adjourn for the day.

1 0