May 2007 - loa-bof - lists.ogf.org

LoA survey invitation
by Ning Zhang 25 May '07

25 May '07

Dear LoA Colleagues, The JISC funded ES-LoA project would like to consult with service and identity providers and Grid/e-Science community for their views on using a risk-based authentication and authorisation scheme. Such a scheme, built on top of open standards based middleware such as Shibboleth, would take into account the level of confidence in users' identification through their identity and attribute assertions when deciding whether or not to permit access to a particular resource. May I invite you to take the time to answer the ES-LoA Survey questionnaire, available from http://www.es-loa.org/output, by Friday 8th June 2007 - you can either fill in the questionnaire on-line, or download a copy and email your response to es-loa(a)manchester.ac.uk. Many thanks for your help in advance. BW Ning *************************************** Dr N Zhang Room KB 2.113 School of Computer Science University of Manchester Oxford Road Manchester M13 9PL England, UK Email: nzhang(a)cs.man.ac.uk Tel: (+44) (0)161 275 6117 Fax: (+44) (0)161 275 6204 Web: http://www.manchester.ac.uk/cs/people/zhang

1 0

"secure password" protocol info
by Frank Siebenlist 09 May '07

09 May '07

I promised to share links about these "secure password" protocols, which are already supported in the last openssl version. Pre-Shared Key Ciphersuites for Transport Layer Security (TLS) http://www.ietf.org/rfc/rfc4279.txt The BIG advantage of this kind of protocol is that one doesn't need any x509 certs on client and server to achieve mutual authentication...which makes it an ideal bootstrap authN protocol. Furthermore, there are many advantages over simple, less secure digest authentication schemes, like no possible dictionary attacks on the messages and such. You should also be able to combine it with OTP to provide better security against otp-hijacking if the otp protocol itself is not over a secured channel (note that a secured channel again requires some pre-configured server-cert). In the LoA taxonomy, I believe that this secure password protocol deserves its own mentioning as it takes the x509 server/proxy-certs and CAs out of the trust chain. Enjoy, securely yours, Frank. PS. Some additional info: The IEEE P1363 Home Page Standard Specifications For Public-Key Cryptography http://grouper.ieee.org/groups/1363/ Submissions to IEEE P1363.2 Submissions for Password-authenticated key agreement http://grouper.ieee.org/groups/1363/passwdPK/submissions.html Secure (One-Time-) Password Authentication for the Globus Toolkit http://www.mcs.anl.gov/~franks/GW05/GW05-SecureOne-Time-PasswordAuthenticat… Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

Re: [loa-bof] LoA-RG
by Ning Zhang 06 May '07

06 May '07

Dear All, I have prepared the attached - provisional slides for the Monday's session. Looking forward to seeing you. Ning ----- Original Message ----- From: "Blair Dillaway" <blaird(a)microsoft.com> To: <helm(a)fionn.es.net>; "Ning Zhang" <nzhang(a)cs.man.ac.uk> Cc: "Michael Helm" <helm(a)es.net>; "David Groep" <davidg(a)nikhef.nl>; <Stephen.Pickles(a)manchester.ac.uk> Sent: Thursday, April 12, 2007 5:43 PM Subject: RE: LoA-RG This seems like a quite reasonable plan for an RG. If you already knew the answers, it wouldn't be research. Based on this, a reasonable timeline might be: - Contact external groups and collect important use cases between OGF20 & 21. - Prepare draft document by Nov 2007 - Complete RG internal review and move to public comment by Feb 2008 - Publish INFO document May 2008 It would certainly be acceptable to move these dates out some if you feel more time is needed to collect and validate use case inputs. Mike, the important thing for now is to put milestone dates in the charter you're comfortable with as the document editor. If can let us know what milestones you think are reasonable, then we can start this through the approval process. Thanks, Blair > -----Original Message----- > From: Mike Helm [mailto:helm@fionn.es.net] > Sent: Wednesday, April 11, 2007 4:21 PM > To: Ning Zhang > Cc: Michael Helm; David Groep; Blair Dillaway; > Stephen.Pickles(a)manchester.ac.uk > Subject: Re: LoA-RG > > > So far, I have not raised a lot of interest in actually doing > this analysis. I've discussed it at a couple of Open Science Grid > functions (this is the organization most likely to provide the > right kind of people to describe these use cases), a software > security group (which David G is also acquainted with), and > a couple of Grid CA PMAs, one just before the BoF, and one after. > > I'm thinking this is worth one or two more tries, preferably > with European stakeholders dominant (get a different set > of security expectations and ideas, thinking about this). > > The best I could do for a draft would probably be fall 2007, > expecting that sometime in the next 2-3 months we could find > a couple of participants. > > Thanks, ==mwh

1 0