- ogsa-wg - lists.ogf.org

[Invitation] Profile interop (Dave Snelling) @ 2007-12-10 16:00 - 17:00 ()
by Hiro Kishimoto 10 Dec '07

10 Dec '07

ogsa-wg(a)ogf.org, you are invited to Title: Profile interop (Dave Snelling) Time: 2007-12-10 16:00 - 17:00 (Central Time) Calendar: Description: When: 5-6pm EDT, 4-5pm CDT, 2-3pm PDT, 7-8am JST, 10-11pm UK The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) Germany: +49 (0)69 50070802 (Frankfurt) Switzerland: +41 (0)1 8009574 (Zurich) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/ Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment - https://forge.gridforum.org/sf/go/wiki1848 Roll call Minutes approval and AI review (see the bottom of this agenda) Agenda bashing 2) OGSA WSRF profile inteop (David Snelling) Interop page - https://forge.gridforum.org/sf/go/wiki1744 3) AoB Minutes approval Sept. 27 call: https://forge.gridforum.org/sf/go/doc14784 Action Item review http://forge.ogf.org/short/ogsa-wg/ailist You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=bmRyNXNoMXFpOXY2NjY5dG… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

Re: [ogsa-wg] OGSA EAP Security profiles: Final call for comments
by Duane Merrill 07 Dec '07

07 Dec '07

Thanks for the comments, Sven! > C0302 Is there anyway to strengthen this from SHOULD towards MUST? I > guess that the SHOULD covers situations without a PKI infrastructure > and other ways of trusting the source of EPRs, but allowing for this > edge case does reduce the security/trustworthiness that is provided by > strict conformance to the profile. A very valid comment. As you've identified, the trade-off is "loss of applicability to certain situations" versus "less rigorous trustworthiness given strict conformance". The general consensus on this issue during our review telecon this morning was that that we would wait and see how others weigh in on this issue during public comment. Sven, would you mind re-raising the question of mandatory-signing during the upcoming public comment? > Secure Communication: > > I have concerns about supplying the certificate in the document. You > rightly make disclaimers warning that the source and transmission path > needs to be trusted, but in actual use I wonder if this chain of trust > will be maintained with proper diligence by the creators of the > consuming software? I can see that it is convenient and, when properly > implemented, will be very useful, but it does have the potential of > causing security problems in poor implementations. While the inclusion of generic key material (e.g., a secret key) in an EPR document may be vulnerable to untrusted source and transmission paths, we profile the inclusion of X.509 certs (where the public key that has been signed into a digital certificate), which provide their own trust-assurance via the certificate's Certificate Authority. That public key can then be used at the message or transport level to both provide message protection and to authenticate the other party, and is as trustworthy as the certificate's CA. Trustworthiness of arbitrary key material can be assured via digital signature of the EPR > In various places throughout the document you say that a server > certificate is provided for "hostname verification" (e.g. line 454). I > think that this is restrictive as the certificate authenticates the > server and not just the name of the remote host that gives you access > to the server. I think that these statements could be rephrased. > Yes, we're going to rephrase the discussion to "identity verification". -Duane

2 1

OGSA Glossary v1.6: Final Call
by Treadwell, Jem 07 Dec '07

07 Dec '07

Hi, I've now uploaded draft 12 of the OGSA Glossary v1.6-this draft incorporates all public comments, including changes agreed on the December 3rd telecon, and should be the final draft before publication. You'll find the document at http://tinyurl.com/3yqn5r. If you have comments please let me have them by CoB this Friday, December 7th. If any comments are minor (e.g. typos, formatting, minor wordsmithing) I'll incorporate them and submit the document for publication next Monday, December 10th. If I receive more serious comments I'll ask Hiro to schedule time for discussion on an upcoming telecon, at which we'll agree either to address them before publication or to create trackers and defer them for the next version. Thanks! - Jem Jem Treadwell Software Engineer HP ESS Software 856.638.6021 office | 856.638.6190 fax | jem.treadwell(a)hp.com<mailto:jem.treadwell@hp.com> 6000 Irwin Road | Mount Laurel | NJ 08054 http://www.hp.com/go/vse [cid:image001.jpg@01C836B9.7DDDB2B0]<http://www.hp.com/go/software>

3 3

RSS Specification now in Public Comment
by Donal K. Fellows 06 Dec '07

06 Dec '07

The Resource Selection Service Specification is now (after much discussion) in public comment. Please make comments! Document: http://www.ogf.org/Public_Comment_Docs/Documents/2007-12/draft-ggf-ogsa-rss… Comment Forum: https://forge.gridforum.org/sf/discussion/do/listTopics/projects.ggf-editor… Donal.

1 0

Minutes from Security Call
by David Snelling 06 Dec '07

06 Dec '07

Attendance Mark Dave Andreas Donnal Duane Andrew Minutes Review Approved for November 19th Approved for November 26th Action Items: artf6072 still pending artf6006 closed as obsolete Review Comments: Secure Addressing Minor edits from Blair will be addressed as suggested. artf6093 Resolved Comment from Sven on SHOULD vs. MUST question on securing EPRs. Postpone action until PC. ACTION: Duane to mail Sven telling him the action and that he can raise it again in PC. Review Comments: Secure Communication Lines 152, 99, and 307 are just edits - will be done. Cypher suites: Agree with the comment and will clarify the text and change the names of the policy documents to include the SSL. AES_128 Issue: Preference for only one case in the document. ACTION Duane to ask Blair if 256 is really a problem. Password AuthN Issues: Agree with the comment and make it a MUST use secure channel in Usn/Pwd case = Change to a MUST. Allow both SSL and digested Pwds together = do nothing to the document. Sven's Comment: Certificate in the document Issue: The issue seems to be a corner case and it is up to the client to check the chain. The technology in this space is relatively mature and the area of the spec is not so central that legislating against poor implementation is necessary. No action on the document. Host name verification issue: Change the wording to "server identity verification". Typo will be fixed. Docs to be sent to the editor as this was the last call. Only the ASE_128 choice will be decided based on conversation with Blair. No further review needed. Need another call or F2F time for OGSA BSP 2.0. AOB: None -- Take care: Dr. David Snelling < David . Snelling . UK . Fujitsu . com > Fujitsu Laboratories of Europe Limited Hayes Park Central Hayes End Road Hayes, Middlesex UB4 8FE Reg. No. 4153469 +44-208-606-4649 (Office) +44-7768-807526 (Mobile)

1 0

Fwd: OGSA EAP Security profiles: Final call for comments
by David Snelling 06 Dec '07

06 Dec '07

Forwarded: Begin forwarded message: > From: Sven van den Berghe <Sven.vandenBerghe(a)uk.fujitsu.com> > Date: 29 November 2007 15:39:39 GMT > To: dgm4d(a)virginia.edu > Cc: Michel Drescher <Michel.Drescher(a)UK.Fujitsu.com>, David > Snelling <David.Snelling(a)UK.Fujitsu.com> > Subject: Re: [ogsa-wg] OGSA EAP Security profiles: Final call for > comments > > Duane, > > Dave Snelling suggested that I look over these documents. I have > the following comments which I hope you don't mind me making. > > Secure Addressing: > > C0302 Is there anyway to strengthen this from SHOULD towards MUST? > I guess that the SHOULD covers situations without a PKI > infrastructure and other ways of trusting the source of EPRs, but > allowing for this edge case does reduce the security/ > trustworthiness that is provided by strict conformance to the profile. > > Secure Communication: > > I have concerns about supplying the certificate in the document. > You rightly make disclaimers warning that the source and > transmission path needs to be trusted, but in actual use I wonder > if this chain of trust will be maintained with proper diligence by > the creators of the consuming software? I can see that it is > convenient and, when properly implemented, will be very useful, but > it does have the potential of causing security problems in poor > implementations. > > In various places throughout the document you say that a server > certificate is provided for "hostname verification" (e.g. line > 454). I think that this is restrictive as the certificate > authenticates the server and not just the name of the remote host > that gives you access to the server. I think that these statements > could be rephrased. > > TYPO: Section B.2 the numbering of the code fragment is not right > (continues from previous fragment)? > > > Regards, > > Sven > > Sven.vandenBerghe(a)uk.fujitsu.com > Fujitsu Laboratories of Europe > +44 208 606 4651 > > > > On 27 Nov 2007, at 15:27, David Snelling wrote: > >> Guys, >> >> Now is a good time for you two to have a look at these. For non- >> delegation based security these should cover most authentication >> level activity and provide the mechanism for carrying >> authorization content. >> >> Begin forwarded message: >> >>> From: "Duane Merrill III" <dgm4d(a)virginia.edu> >>> Date: 27 November 2007 14:17:48 GMT >>> To: <ogsa-wg(a)ggf.org> >>> Subject: [ogsa-wg] OGSA EAP Security profiles: Final call for >>> comments >>> >>> Hi, >>> >>> The OGSA WG's "express authentication profiles" (Secure >>> Addressing 1.0 and Secure Communication 1.0) are now available >>> for any final comments before submission to the OGF Editor. >>> You’ll find a copy of the documents (drafts 005) at https:// >>> forge.ogf.org/sf/go/projects.ogsa-wg/ >>> docman.root.working_drafts.security_profiles_use_case. If you >>> have comments please let me have them by the end of Sunday, >>> December 2nd. >>> >>> Thanks! >>> >>> - Duane >>> >>> -- >>> ogsa-wg mailing list >>> ogsa-wg(a)ogf.org >>> http://www.ogf.org/mailman/listinfo/ogsa-wg >> >> -- >> >> Take care: >> >> Dr. David Snelling < David . Snelling . UK . Fujitsu . com > >> Fujitsu Laboratories of Europe Limited >> Hayes Park Central >> Hayes End Road >> Hayes, Middlesex UB4 8FE >> Reg. No. 4153469 >> >> +44-208-606-4649 (Office) >> +44-7768-807526 (Mobile) >> >> >> > -- Take care: Dr. David Snelling < David . Snelling . UK . Fujitsu . com > Fujitsu Laboratories of Europe Limited Hayes Park Central Hayes End Road Hayes, Middlesex UB4 8FE Reg. No. 4153469 +44-208-606-4649 (Office) +44-7768-807526 (Mobile)

1 0

ogsa bsp 2.0 draft 003
by Andreas Savva 06 Dec '07

06 Dec '07

I've uploaded a revised (change-tracked) version of bsp 2.0 for today's call. https://forge.gridforum.org/sf/go/doc14940?nav=1 Also attaching a 'clean' pdf copy. -- Andreas Savva Fujitsu Laboratories Ltd

1 0

***SPAM*** OGSA BSP 2.0
by Blair Dillaway 04 Dec '07

04 Dec '07

Hiro, David: I read thru the lastest BSP 2.0 draft and had a couple of comments. Pg 3 - Table 1. It is not clear to me why you are including the OGSA BSP 1.0 namespaces in this doc since it obsoletes that specification. If this was meant to indicate the BSP 1.0 namespace will be re-used for the BSP 2.0 specs it seems to me that would just lead to needless confusion. Pg 4, Line 95 - You are defining a new conformance claim for this spec, so why do you also claim it exposes the BSP 1.0 conformance claim? Of course, you still need to fill in the full references to the two specs this document will apply to which I presume will define the namespaces you will need to reference. Regards, Blair Dillaway

2 1

[Invitation] Basic Security Profile @ 2007-12-06 08:00 - 09:00 ()
by OGSA WG 04 Dec '07

04 Dec '07

ogsa-wg(a)ogf.org, you are invited to Title: Basic Security Profile Time: 2007-12-06 08:00 - 09:00 (Central Time) Calendar: Description: When: 9-10pm EST, 8-9am CST, 6-7pm PST, 11-12pm JST, 2-3pm UK The dial-in number for Monday; US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) Germany: +49 (0)69 50070802 (Frankfurt) Switzerland: +41 (0)1 8009574 (Zurich) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/?key=1206 Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment - https://forge.gridforum.org/sf/go/wiki1848 Roll call Agenda bashing 2) Minutes approval and AI review (see the bottom of this agenda) Minutes approval Nov. 19: Waiting for minutes (Mark Morgan) Nov. 26: https://forge.gridforum.org/sf/go/doc14942?nav=1 Action Item review - http://forge.ogf.org/short/ogsa-wg/ailist 2) OGSA Express AuthN profiles (Duane) - Review comments received during final call of the two profiles Secure Addressing - https://forge.ogf.org/sf/go/doc14938 (doc) - http://forge.ogf.org/short/ogsa-wg/spsa (tracker) Secure Communication - https://forge.ogf.org/sf/go/doc14937 (doc) - http://forge.ogf.org/short/ogsa-wg/spsc (tracker) - Review updated version of the OGSA Basic Profile (to be uploaded before the call) https://forge.ogf.org/sf/go/doc14940 and comments posted to the list You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=ZWYxbGJscGVzZWgwYXFodT… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0

[Updated Invitation] Primer @ 2007-12-06 07:00 - 08:00 ()
by OGSA WG 04 Dec '07

04 Dec '07

Details for the following event have changed: Title: Primer Time: 2007-12-06 07:00 - 08:00 (Central Time) Calendar: Description: When: 8-9am ET, 7-8am CT, 5-6am PT, 10-11pm JST, 1-2pm UK Dial-in numbers for Thursday: US: +1 718 3541071 (New York) or +1 408 9616509 (San Jose) UK: +44 (0)207 3655269 (London) Japan: +81 (0)3 3570 8225 (Tokyo) PIN: 4371991 See more information: - https://forge.gridforum.org/sf/go/wiki1477 Screen share service: URL: http://ogsa.glance.net/?key=1206 Usage: https://forge.gridforum.org/sf/go/wiki1584 Note: ** OGF IPR POLICY APPLIES ** http://www.ogf.org/About/abt_policies.php 1) Early discussion Social study notification - https://forge.gridforum.org/sf/go/wiki1717 Note taker assignment - https://forge.gridforum.org/sf/go/wiki1848 Roll call Agenda bashing 2) Minutes approval and AI review (see the bottom of this agenda) Oct. 1 call: https://forge.gridforum.org/sf/go/doc14803 Oct. 19 F2F: https://forge.gridforum.org/sf/go/doc14882 Action Item review http://forge.ogf.org/short/ogsa-wg/ailist 3) OGSA primer review (Andrew Grimshaw) Review latest draft - https://forge.gridforum.org/sf/go/doc14408 Item tracker - http://forge.ogf.org/short/ogsa-wg/primer You can view this event at http://www.google.com/calendar/event?action=VIEW&eid=bzYzbm90OGtxbDZobnRoMm… You are receiving this courtesy email at the account ogsa-wg(a)ogf.org because you are an attendee of this event. To stop receiving future notifications for this event, decline this event. Alternatively you can sign up for a Google Calendar account at http://www.google.com/calendar/ and control your notification settings for your entire calendar.

1 0