July 2014 - Nsi-wg - lists.ogf.org

OGF NSI networking architecture and need for certificates with restricted user base
by Sill, Alan 07 Aug '14

07 Aug '14

Dear folks in the OGF CAOPS, VOMS-PROC and NSI working groups. I'd like to initiate some discussion among the participants in these working groups for the use case referred to in the talk at the link below. Some review of the conditions for this use case would be helpful. Note this is also a use case that comes up in Internet-of-Things discussions, and has caused some discussion on the PKIX group list (though that group is now dormant of course) and other related lists lately. To me this is a familiar situation with well-known parameters, but possibly some additional considerations, and might possibly lead to some useful communication among the members in these groups about solutions that could be applied using existing technologies that would avoid the possible downsides associated with the proposed use of self-signed certificates. (For example, extended attribute certificates as used in VOMS, though the same or perhaps through a different implementation, might be a good solution here; other solutions might be contemplated that would be more attractive than self-signed certificates for this situation.) Your comments, discussion and input are recruited (by me -- I'm not speaking for the NIS-WG members per se!), and I hope that all parties will regard this as useful discussion for information exchange only. Thanks, Alan Begin forwarded message: From: Guy Roberts <Guy.Roberts(a)dante.net<mailto:Guy.Roberts@dante.net>> Subject: RE: [Nsi-wg] Wednesday's NSI conf call Date: July 30, 2014 at 1:30:19 PM GMT+2 To: Alan Sill <kilohoku150(a)gmail.com<mailto:kilohoku150@gmail.com>> Hi Alan, Please find the slides on NSI security here: https://redmine.ogf.org/dmsf/nsi-wg?folder_id=6592 The proposal is that NSAs will run their own private Certificate Authorities (self-signing) rather than using public Certificate Authorities. Participating NSAs will then exchange information about each other’s Certificates in an ad hoc way. This solution does not scale well as private Certificates have to be manually shared, but it reduces the size of the certificate pool. Guy From: Alan Sill [mailto:kilohoku150@gmail.com] Sent: 30 July 2014 10:56 To: Guy Roberts Cc: Alan Sill Subject: Re: [Nsi-wg] Wednesday's NSI conf call Guy, On Jul 30, 2014, at 11:02 AM, Guy Roberts <Guy.Roberts(a)dante.net<mailto:Guy.Roberts@dante.net>> wrote: - comments/feedback from last week’s presentation from John on ‘Secure Communications with Self Signed Certificates’ Are copies of these slides available? I would like to understand the context. (In general, use of self-signed certificates is risky at best, so I would like to understand the use case here.) Alan

5 7

minutes from today's NSI conf call...
by Guy Roberts 30 Jul '14

30 Jul '14

... are available here: https://redmine.ogf.org/dmsf_files/13314 Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 30 Jul '14

30 Jul '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 EDT, 15:00 BST, 16:00 CEST, 23:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - comments/feedback from last week's presentation from John on 'Secure Communications with Self Signed Certificates' - update on NSI documents, and closing off: - NSA Description - NSI AAI - NSI Topo - NSI DDS - topics for NSI at NORDUnet conference _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 29 Jul '14

29 Jul '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 EDT, 15:00 BST, 16:00 CEST, 23:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda:? - comments/feedback from last weeks SSL presentation from John - update on NSI documents, and closing off: - NSA Description - NSI AAI - NSI Topo - NSI DDS - topics for NSI at NORDUnet conference

1 0

NSI meetings in September
by Guy Roberts 16 Jul '14

16 Jul '14

Hello All, This is a note to remind everyone that the NSI face-to-face meeting in September will be held in Uppsala on 22 September, the day before the NORDUnet conference. Please register for the NORDUnet conference if you would like to attend the NSI meeting. NSI will not be holding any meetings at OGF42 in London. Regards, Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

Minutes from today's NSI conf call
by Guy Roberts 16 Jul '14

16 Jul '14

Hello All, Minutes from today's NSI call are available here: https://redmine.ogf.org/dmsf_files/13297 As there are a lot of Action Points from today's call, I have reproduced there here: AP1: Guy to investigate whether funding can be found to support NSI-CONTEST after the end of GN3plus (March 2015). AP2: Michal B. to investigate making the NSI-CONTEST code publicly available at the end of GN3plus project life so that community support is possible. AP3: Michal to discuss with the NSI-CONTEST team whether they can add support for multi-AG hierarchy testing in the CTS. AP4: Once the service goes online, Michal to announce NSI-CONTEST mailing list for support, bugs, change requests etc. AP5: John/Hans to prepare additional text to be added to the extensions to the schema for AA AP6: John to contact Hans to see if can send in most recent copy of AA doc. AP7: Freek to review John's document on the switching service AP8: Chin to review the tree/chain description in both the NSI framework v2 and the draft-gwdrp-macauley-document-distribution-service to check that the framework doc has sufficient detail. AP9: Guy to send mail to list to remind people that there will be no NSI meeting at OGF 42. Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 15 Jul '14

15 Jul '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 EDT, 15:00 BST, 16:00 CEST, 23:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - Michal B. to discuss the progress of the NSI-CONTEST work - NSI standards document preparation updates - NSI Framework V2 doc public comment - converted to an informational document and resubmitted - Other items _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

minutes from today's NSI conf call...
by Guy Roberts 09 Jul '14

09 Jul '14

... are available here: https://redmine.ogf.org/dmsf_files/13279 _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

NSI framework document v2 to go to OGF editors
by Guy Roberts 09 Jul '14

09 Jul '14

Hello All, On today's NSI call I would like agreement from the working-group to submit the NSI framework spec to the OGF editors for review before going to public comment. You can view this document here: https://redmine.ogf.org/dmsf_files/13168 Guy _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0

Wednesday's NSI conf call
by Guy Roberts 08 Jul '14

08 Jul '14

The following is dial-in information for Wednesday's NSI call, time: 7:00 PDT 10:00 EDT, 15:00 BST, 16:00 CEST, 23:00 JST 1. Dial Toll-Free Number: 866-740-1260 (U.S. & Canada) 2. International participants dial: Toll Number: 303-248-0285 Or International Toll-Free Number: http://www.readytalk.com/intl 3. Enter 7-digit access code 8937606, followed by "#" Agenda: - NSI standards document preparation updates - update on topology discussions with NML - NSI Framework V2 doc public comment - GLIF in Prague? _____________________________________________________________________ Guy Roberts PhD Senior Transport Network Architect DANTE Cambridge, UK +44 1223 371316 DANTE is the project co-ordinator and operator of GÉANT, the high-speed pan-European research and education network that is transforming the way researchers collaborate. Learn more at: www.geant.net<http://www.geant.net/> Like us on: www.facebook.com/GEANTnetwork<http://www.facebook.com/GEANTnetwork> Follow us at: www.twitter.com/GEANTnews<http://www.twitter.com/GEANTnews> DANTE is the trading name of Delivery of Advanced Network Technology to Europe Limited registered in England & Wales. Registration Number 2806796. Registered Office - 9400 Garsington Road, Oxford Business Park, Oxford OX4 2HN. _____________________________________________________________________

1 0