December 2007 - ogsa-wg - lists.ogf.org

Draft minutes 10-December-2008
by Andrew Grimshaw 10 Dec '07

10 Dec '07

1 0

Glossary ready for publication
by Treadwell, Jem 10 Dec '07

10 Dec '07

All, The "final call" comment period is now closed, and I believe the Glossary v1.6 is ready for publication. This week I received the following comments: * Comments from Mike Behrens that didn't result in any changes. * Andreas pointed out some issues with the references, which I resolved. * Donal provided some comments, several of which I addressed through changes to the document or by opening/amending trackers for the OGSA Architecture doc, as you will have seen in my earlier message. Assuming everyone was OK with the responses I gave I don't think any of these changes require discussion, so I plan to upload the final version to GridForge by Tuesday, and then submit it to the OGF Editor for publication. Hiro, FYI that I'll join the second part of Monday's call (can't make the first part). I'll let you know once the document has been submitted. Thanks as always for all the valuable input and support! - Jem Jem Treadwell Software Engineer HP ESS Software 856.638.6021 office | 856.638.6190 fax | jem.treadwell(a)hp.com<mailto:jem.treadwell@hp.com> 6000 Irwin Road | Mount Laurel | NJ 08054 http://www.hp.com/go/vse [cid:image001.jpg@01C83ABA.4D1FB1F0]<http://www.hp.com/go/software>

1 0

[Invitation] roadmap 1.1 @ 2007-12-10 17:00 - 18:00 ()
by Hiro Kishimoto 10 Dec '07

10 Dec '07

ogsa-wg(a)ogf.org, you are invited to Title: roadmap 1.1 Time: 2007-12-10 17:00 - 18:00 (Central Time) Calendar: Description: When: 6-7pm EDT, 5-6pm CDT, 3-4pm PDT, 8-9am JST, 11-12pm UK Dial-in numbers US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) Germany: +49 (0)69 50070802 (Frankfurt) Switzerland: +41 (0)1 8009574 (Zurich) More numbers: http://forge.ogf.org/short/ogsa-wg/dialin PIN: 4371991 Screen share service: URL: http://ogsa.glance.net/?key=1203 Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment - https://forge.gridforum.org/sf/go/wiki1848 Roll call Agenda bashing 2) Minutes approval and AI review Minutes approval Aug. 6 telcon: https://forge.gridforum.org/sf/go/doc14704 Aug. 13 F2F: https://forge.gridforum.org/sf/go/doc14718 Aug. 27 call: https://forge.ogf.org/sf/go/doc14741 Oct. 1 call: https://forge.ogf.org/sf/go/doc14785 Action Item review http://forge.ogf.org/short/ogsa-wg/ailist 3) OGSA roadmap 1.1 public comment review Public comments tracker - http://forge.ogf.org/short/ggf-editor/ogsarm11 4) AoB You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=MGhpOTB2bDRpa3VpaTVnbX… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

[Invitation] Profile interop (Dave Snelling) @ 2007-12-10 16:00 - 17:00 ()
by Hiro Kishimoto 10 Dec '07

10 Dec '07

ogsa-wg(a)ogf.org, you are invited to Title: Profile interop (Dave Snelling) Time: 2007-12-10 16:00 - 17:00 (Central Time) Calendar: Description: When: 5-6pm EDT, 4-5pm CDT, 2-3pm PDT, 7-8am JST, 10-11pm UK The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) Germany: +49 (0)69 50070802 (Frankfurt) Switzerland: +41 (0)1 8009574 (Zurich) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment - https://forge.gridforum.org/sf/go/wiki1848 Roll call Minutes approval and AI review (see the bottom of this agenda) Agenda bashing 2) OGSA WSRF profile inteop (David Snelling) Interop page - https://forge.gridforum.org/sf/go/wiki1744 3) AoB Minutes approval Sept. 27 call: https://forge.gridforum.org/sf/go/doc14784 Action Item review http://forge.ogf.org/short/ogsa-wg/ailist You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=bmRyNXNoMXFpOXY2NjY5dG… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

Re: [ogsa-wg] OGSA EAP Security profiles: Final call for comments
by Duane Merrill 07 Dec '07

07 Dec '07

Thanks for the comments, Sven! > C0302 Is there anyway to strengthen this from SHOULD towards MUST? I > guess that the SHOULD covers situations without a PKI infrastructure > and other ways of trusting the source of EPRs, but allowing for this > edge case does reduce the security/trustworthiness that is provided by > strict conformance to the profile. A very valid comment. As you've identified, the trade-off is "loss of applicability to certain situations" versus "less rigorous trustworthiness given strict conformance". The general consensus on this issue during our review telecon this morning was that that we would wait and see how others weigh in on this issue during public comment. Sven, would you mind re-raising the question of mandatory-signing during the upcoming public comment? > Secure Communication: > > I have concerns about supplying the certificate in the document. You > rightly make disclaimers warning that the source and transmission path > needs to be trusted, but in actual use I wonder if this chain of trust > will be maintained with proper diligence by the creators of the > consuming software? I can see that it is convenient and, when properly > implemented, will be very useful, but it does have the potential of > causing security problems in poor implementations. While the inclusion of generic key material (e.g., a secret key) in an EPR document may be vulnerable to untrusted source and transmission paths, we profile the inclusion of X.509 certs (where the public key that has been signed into a digital certificate), which provide their own trust-assurance via the certificate's Certificate Authority. That public key can then be used at the message or transport level to both provide message protection and to authenticate the other party, and is as trustworthy as the certificate's CA. Trustworthiness of arbitrary key material can be assured via digital signature of the EPR > In various places throughout the document you say that a server > certificate is provided for "hostname verification" (e.g. line 454). I > think that this is restrictive as the certificate authenticates the > server and not just the name of the remote host that gives you access > to the server. I think that these statements could be rephrased. > Yes, we're going to rephrase the discussion to "identity verification". -Duane

2 1

OGSA Glossary v1.6: Final Call
by Treadwell, Jem 07 Dec '07

07 Dec '07

Hi, I've now uploaded draft 12 of the OGSA Glossary v1.6-this draft incorporates all public comments, including changes agreed on the December 3rd telecon, and should be the final draft before publication. You'll find the document at http://tinyurl.com/3yqn5r. If you have comments please let me have them by CoB this Friday, December 7th. If any comments are minor (e.g. typos, formatting, minor wordsmithing) I'll incorporate them and submit the document for publication next Monday, December 10th. If I receive more serious comments I'll ask Hiro to schedule time for discussion on an upcoming telecon, at which we'll agree either to address them before publication or to create trackers and defer them for the next version. Thanks! - Jem Jem Treadwell Software Engineer HP ESS Software 856.638.6021 office | 856.638.6190 fax | jem.treadwell(a)hp.com<mailto:jem.treadwell@hp.com> 6000 Irwin Road | Mount Laurel | NJ 08054 http://www.hp.com/go/vse [cid:image001.jpg@01C836B9.7DDDB2B0]<http://www.hp.com/go/software>

3 3

RSS Specification now in Public Comment
by Donal K. Fellows 06 Dec '07

06 Dec '07

The Resource Selection Service Specification is now (after much discussion) in public comment. Please make comments! Document: http://www.ogf.org/Public_Comment_Docs/Documents/2007-12/draft-ggf-ogsa-rss… Comment Forum: https://forge.gridforum.org/sf/discussion/do/listTopics/projects.ggf-editor… Donal.

1 0

Minutes from Security Call
by David Snelling 06 Dec '07

06 Dec '07

Attendance Mark Dave Andreas Donnal Duane Andrew Minutes Review Approved for November 19th Approved for November 26th Action Items: artf6072 still pending artf6006 closed as obsolete Review Comments: Secure Addressing Minor edits from Blair will be addressed as suggested. artf6093 Resolved Comment from Sven on SHOULD vs. MUST question on securing EPRs. Postpone action until PC. ACTION: Duane to mail Sven telling him the action and that he can raise it again in PC. Review Comments: Secure Communication Lines 152, 99, and 307 are just edits - will be done. Cypher suites: Agree with the comment and will clarify the text and change the names of the policy documents to include the SSL. AES_128 Issue: Preference for only one case in the document. ACTION Duane to ask Blair if 256 is really a problem. Password AuthN Issues: Agree with the comment and make it a MUST use secure channel in Usn/Pwd case = Change to a MUST. Allow both SSL and digested Pwds together = do nothing to the document. Sven's Comment: Certificate in the document Issue: The issue seems to be a corner case and it is up to the client to check the chain. The technology in this space is relatively mature and the area of the spec is not so central that legislating against poor implementation is necessary. No action on the document. Host name verification issue: Change the wording to "server identity verification". Typo will be fixed. Docs to be sent to the editor as this was the last call. Only the ASE_128 choice will be decided based on conversation with Blair. No further review needed. Need another call or F2F time for OGSA BSP 2.0. AOB: None -- Take care: Dr. David Snelling < David . Snelling . UK . Fujitsu . com > Fujitsu Laboratories of Europe Limited Hayes Park Central Hayes End Road Hayes, Middlesex UB4 8FE Reg. No. 4153469 +44-208-606-4649 (Office) +44-7768-807526 (Mobile)

1 0

Fwd: OGSA EAP Security profiles: Final call for comments
by David Snelling 06 Dec '07

06 Dec '07

Forwarded: Begin forwarded message: > From: Sven van den Berghe <Sven.vandenBerghe(a)uk.fujitsu.com> > Date: 29 November 2007 15:39:39 GMT > To: dgm4d(a)virginia.edu > Cc: Michel Drescher <Michel.Drescher(a)UK.Fujitsu.com>, David > Snelling <David.Snelling(a)UK.Fujitsu.com> > Subject: Re: [ogsa-wg] OGSA EAP Security profiles: Final call for > comments > > Duane, > > Dave Snelling suggested that I look over these documents. I have > the following comments which I hope you don't mind me making. > > Secure Addressing: > > C0302 Is there anyway to strengthen this from SHOULD towards MUST? > I guess that the SHOULD covers situations without a PKI > infrastructure and other ways of trusting the source of EPRs, but > allowing for this edge case does reduce the security/ > trustworthiness that is provided by strict conformance to the profile. > > Secure Communication: > > I have concerns about supplying the certificate in the document. > You rightly make disclaimers warning that the source and > transmission path needs to be trusted, but in actual use I wonder > if this chain of trust will be maintained with proper diligence by > the creators of the consuming software? I can see that it is > convenient and, when properly implemented, will be very useful, but > it does have the potential of causing security problems in poor > implementations. > > In various places throughout the document you say that a server > certificate is provided for "hostname verification" (e.g. line > 454). I think that this is restrictive as the certificate > authenticates the server and not just the name of the remote host > that gives you access to the server. I think that these statements > could be rephrased. > > TYPO: Section B.2 the numbering of the code fragment is not right > (continues from previous fragment)? > > > Regards, > > Sven > > Sven.vandenBerghe(a)uk.fujitsu.com > Fujitsu Laboratories of Europe > +44 208 606 4651 > > > > On 27 Nov 2007, at 15:27, David Snelling wrote: > >> Guys, >> >> Now is a good time for you two to have a look at these. For non- >> delegation based security these should cover most authentication >> level activity and provide the mechanism for carrying >> authorization content. >> >> Begin forwarded message: >> >>> From: "Duane Merrill III" <dgm4d(a)virginia.edu> >>> Date: 27 November 2007 14:17:48 GMT >>> To: <ogsa-wg(a)ggf.org> >>> Subject: [ogsa-wg] OGSA EAP Security profiles: Final call for >>> comments >>> >>> Hi, >>> >>> The OGSA WG's "express authentication profiles" (Secure >>> Addressing 1.0 and Secure Communication 1.0) are now available >>> for any final comments before submission to the OGF Editor. >>> You’ll find a copy of the documents (drafts 005) at https:// >>> forge.ogf.org/sf/go/projects.ogsa-wg/ >>> docman.root.working_drafts.security_profiles_use_case. If you >>> have comments please let me have them by the end of Sunday, >>> December 2nd. >>> >>> Thanks! >>> >>> - Duane >>> >>> -- >>> ogsa-wg mailing list >>> ogsa-wg(a)ogf.org >>> http://www.ogf.org/mailman/listinfo/ogsa-wg >> >> -- >> >> Take care: >> >> Dr. David Snelling < David . Snelling . UK . Fujitsu . com > >> Fujitsu Laboratories of Europe Limited >> Hayes Park Central >> Hayes End Road >> Hayes, Middlesex UB4 8FE >> Reg. No. 4153469 >> >> +44-208-606-4649 (Office) >> +44-7768-807526 (Mobile) >> >> >> > -- Take care: Dr. David Snelling < David . Snelling . UK . Fujitsu . com > Fujitsu Laboratories of Europe Limited Hayes Park Central Hayes End Road Hayes, Middlesex UB4 8FE Reg. No. 4153469 +44-208-606-4649 (Office) +44-7768-807526 (Mobile)

1 0

ogsa bsp 2.0 draft 003
by Andreas Savva 06 Dec '07

06 Dec '07

I've uploaded a revised (change-tracked) version of bsp 2.0 for today's call. https://forge.gridforum.org/sf/go/doc14940?nav=1 Also attaching a 'clean' pdf copy. -- Andreas Savva Fujitsu Laboratories Ltd

1 0