- security-area - lists.ogf.org

TC-RG set up
by Andrew Martin 01 Jun '05

01 Jun '05

Dear all, The TC-RG (Trusted Computing Research Group) is now up and running; welcome to those who have signed up to the list. Others are welcome to join (by sending a message to majordomo(a)ggf.org, saying `s*bscribe tc-rg' ---replace the * with a u. Majordomo bounces this message when I spell it out in full). We are planning two meetings at GGF14: Wenbo is arranging a seminar in the community track programme, with several speakers talking about experiences so far with TC. We will also have a TC-RG research group session, with an opportunity to discuss those topics, and hear about progress towards our goals. One of those goals is a use case document. I'd be pleased to hear from anyone who wants to contribute a (possible, potential, actual, etc.) use case for trusted computing in Grid middleware or applications. I'll begin to collate these with the ideas presented at the BOF. Please send your ideas to the TC-RG list. Best regards Andrew Martin and Wenbo Mao.

1 0

ping
by Olle Mulmo 30 May '05

30 May '05

1 0

FI-RG charter
by Leon Gommans 13 May '05

13 May '05

Just to inform you: below charter is now with our AD's as final charter proposal for the firewall issues research group after comments of GGF13 have been considered. Our AD's are taking this charter to the GFSG ----- Firewall Issues Research Group (FI-RG). Chairs: Leon Gommans, Inder Monga Area Directors: Olle Mulmo, Dane Skow Mailing list: (requested as) fi-rg(a)ggf.org Description of Work: Grids increasingly require application driven transport privileges from the network. As such, the network is asked to enforce policy decisions on behalf of various entities participating in an application. For this purpose, the network employs functions such as firewalls, network address translators, application level gateways, VPN style gateways etc. The research group will first document the type of issues that Grid applications experience when the need arises to control data transport policy enforcement devices. Some examples are highlighted in GFD.37. Once the types of issues have been identified, the group will relate these issues to specific categories of enforcement devices. The first group of devices falls into the category the IETF refers to as "middle-boxes". The group will deliver a document that will analyze and categorize scenario's using existing IETF protocols, architectures and frameworks. The analyses will also try to identify functionalities for which the current state of technology appears not to provide solutions for the Grid. The work to be considered includes the work of the following IETF groups: * midcom - "middlebox" communication: http://www.ietf.org/html.charters/midcom-charter.html * aft - Authenticated Firewall Traversal: http://www.ietf.org/html.charters/aft-charter.html * nsis – Next Steps in Signaling: http://www.ietf.org/html.charters/nsis-charter.html Subsequent area's of research will include the description and evaluation of below category of devices: * Application Level Gateways. * Host based firewall functions. * VPN style gateways. Existing documents from the grid community will be used as starting point. Relevant output of this Research Group will be brought to the attention of the IETF via the GGF liaison to the IETF. Goals and Milestones: Submit informational documents that describe: 1) An inventory of the type of issues when Grid jobs have to deal with middle-box functions, application level gateways, VPN style gateways, etc. Describe and classify the issues in document #1 2) An evaluation of existing IETF middle-box (signaling-) protocols and functions. Recognize possible limitations and produce a list of requirements towards the IETF in document #2 3) An evaluation of approaches and solutions such as application level gateways, host based firewalls, VPN style gateways etc. Capture results in document #3 GGF13: Charter discussion and group volunteers (done). GGF14: Collection of existing documents with Group discussions GGF15: First draft of document #1 and Group discussions. GGF16: WG-last call and submission of document #1. Draft of document #2 and group discussions GGF17: WG last-call and final submission of document #2. GGF18: Draft document #3 and group discussions. GGF19: 2nd draft of document #3 with group discussions. GGF20: WG last-call and final submission of document #3.

1 0

Authority recognition document published as GFD.48
by Olle Mulmo 12 May '05

12 May '05

Finally, after a few bumps at the end of road, the Authority recognition document has been published and is now GGF informational document #48. Let me congratulate the authors for a job well done. With that, ARRRG has now completed. /Olle

1 0

Trusted Computing: Proposed Research Group
by Andrew Martin 03 May '05

03 May '05

Following the distribution of a draft charter a couple of weeks ago, we held a BOF at GGF13 last week on this proposed new research group. Notes of the meeting, with copies of the presentations, and a draft charter are at the group's temporary web site: http://www.softeng.ox.ac.uk/Andrew.Martin/TC/index.html There appeared to be a fair amount of support, and general interest in at least some of the items in the draft charter. We remain uncertain about whether to include the production of a roadmap document as part of the initial charter or not. Discussion of the charter and the research group's formation is now welcome. Please use this mailing list: if the traffic becomes too high, no doubt a separate list can be created. Best regards Andrew Martin Wenbo Mao

2 2

Last chance to comment on the Authority Recognition GGF document
by Olle Mulmo 14 Apr '05

14 Apr '05

All, I want to thank many of you for spending some of your invaluable time to make GGF a successful community effort. At this point in time, your help is solicited and kindly requested again. The GGF editor has kindly allowed a week-long extension of the second public comment period of the Authority Recognition document. Please post a comment here in next couple of days: http://forge.gridforum.org/forum/forum.php?forum_id=463 The document can be found here (look at "Attached files"): http://forge.gridforum.org/tracker/?aid=1155 Thank you and regards, /Olle

1 0

Fw: [ogsa-wg] Updated telecon schedule table
by Takuya Mori 30 Mar '05

30 Mar '05

Hi, The attached is the dial-in information for the upcoming OGSA conference call. Thanks, Takuya Mori

1 0

[Resend from Takuya] RE: Update on OGSA Basic Profile Security work
by Von Welch 25 Mar '05

25 Mar '05

[Takuya, please sub-scribe to security-area(a)ggf.org if you plan on posting. Thanks, Von ] ------- start of forwarded message ------- To: security-area(a)ggf.org Cc: ogsa-wg(a)gridforum.org Subject: Re: [ogsa-wg] RE: Update on OGSA Basic Profile Security work From: Takuya Mori <mori(a)mcs.anl.gov> Dear All, There is an update on the telecon schedule. I applogize my duplicate, if you guys have already been noticed it. It is proposed to have the Basic Profile sessions 1-3pm ET on Wednesdays. The security related issues is also scheduled in the same time slot on Mar 30th now. If it does not work for you, please let me know it. Thank you, Takuya Mori From: "Hiro Kishimoto" <hiro.kishimoto(a)jp.fujitsu.com> Subject: [ogsa-wg] RE: Update on OGSA Basic Profile Security work Date: Wed, 23 Mar 2005 17:05:37 +0900 > Thanks Dane for your obliging email, > > Certainly OGSA-WG welcomes and requires security experts. > Proposed telecon date is March 30th. If it does not work for > you, April 6th is another option. Please let me know your > preference. > > You can sub-scribe our mailing list; > https://forge.gridforum.org/projects/sourceforge/document/majordomo_help/en… > jordomo_help.doc > http://www-unix.gridforum.org/mail_archive/ogsa-wg/threads.html > > Our Wednesday call is 5-7pm CST. The dial in number is 1-888-452-0308 > or 1-484-644-0505 and the pass code is 71815. > > You can download the latest basic profile draft from; > https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa-basic-… > le/en/3 > > Now we have four open security related issues on this profile; > #1320: Transport and/or Message Level security > MUST or SHOULD?? > #1321: Discovery of key-info for encryption in message level security > Service Group Profile/ EPR embedding > #1322: Use of Proxy Certificates > Standard but not widely adopted outside of grid communit > Time boxed certificates (short lived certs) > #1323: Communication of assertions > Profiles for common assertions in headers or Proxy Certificate > #1324: Separate Security Basic Profile > Should we have a separate profile document for security > > Basic profile tracker is at; > https://forge.gridforum.org/tracker/index.php?group_id=42&atid=780 > > Thanks, > ---- > Hiro Kishimoto > > > > -----Original Message----- > > From: Dane Skow [mailto:dane@fnal.gov] > > Sent: Thursday, March 17, 2005 6:03 PM > > To: security-area(a)ggf.org > > Cc: Ian Foster; Hiro Kishimoto > > Subject: Update on OGSA Basic Profile Security work > > > > As Frank mentioned in the Security Area Meeting, the OGSA Basic Profile > > is now > > being worked intensely toward conclusion. The Working Group has set a > > goal of > > mid April for resolving all the open issues with the current draft. The > > majority of > > the new issues opened this meeting have to do with security. Takuya has > > asked for > > a week to allow the interested parties in the Security Area to read the > > current draft > > and comment on the current open issues (or raise others). This means > > that interested > > parties will need to engage within the next few days to have maximal > > effectiveness. > > I encourage those interested in OGSA to engage on the Basic Profile now. > > > > The response to the question about which use cases from the OGSA use > > case > > document must be supported by the Basic Profile was "all of them". > > However, since > > we will not have a normative spec for WS-Delegation by June, nor do I > > know > > any other credential delegation standard, I suspect there > > was likely a misunderstanding. Takuya will follow up on that question. > > > > I believe Hiro and Ian (chairs of OGSA-WG) > > will second me in saying that input on this document from > > security experts is welcomed and requested. The most effective form > > would be for > > people to join the mailing list and attend the relevant phonecons. The > > next most > > effective is to download and read the current drafts and provide > > comments to the list. > > > > Frank and Takuya have volunteered to try to alert the area about > > relevant phonecons > > and open issues. However, they will not be able to relay > > comments/discussion with this > > short timeline. Interested parties will have to join them directly to > > keep up with the discussion. > > > > Cheers, > > Dane > > ------- end of forwarded message -------

1 0

[Bounce from Hiro] RE: Update on OGSA Basic Profile Security work
by Von Welch 23 Mar '05

23 Mar '05

------- start of forwarded message ------- From: "Hiro Kishimoto" <hiro.kishimoto(a)jp.fujitsu.com> To: "'Dane Skow'" <dane(a)fnal.gov>, <security-area(a)ggf.org> Cc: "'Ian Foster'" <foster(a)mcs.anl.gov>, "'ogsa-wg'" <ogsa-wg(a)gridforum.org> Subject: RE: Update on OGSA Basic Profile Security work Date: Wed, 23 Mar 2005 16:43:47 +0900 Message-ID: <00e301c52f7c$0c60ae40$63e61fac@ORD> Thanks Dane for your obliging email, Certainly OGSA-WG welcomes and requires security experts. Proposed telecon date is March 30th. If it does not work for=20 you, April 6th is another option. Please let me know your=20 preference. You can subscribe our mailing list; https://forge.gridforum.org/projects/sourceforge/document/majordomo_help/= en/1/ma jordomo_help.doc http://www-unix.gridforum.org/mail_archive/ogsa-wg/threads.html Our Wednesday call is 5-7pm CST. The dial in number is 1-888-452-0308 or 1-484-644-0505 and the pass code is 71815. You can download the latest basic profile draft from; https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa-basi= c-profi le/en/3 Now we have four open security related issues on this profile; #1320: Transport and/or Message Level security MUST or SHOULD?? #1321: Discovery of key-info for encryption in message level security Service Group Profile/ EPR embedding #1322: Use of Proxy Certificates Standard but not widely adopted outside of grid communit Time boxed certificates (short lived certs) #1323: Communication of assertions Profiles for common assertions in headers or Proxy Certificate #1324: Separate Security Basic Profile Should we have a separate profile document for security Basic profile tracker is at; https://forge.gridforum.org/tracker/index.php?group_id=3D42&atid=3D780 Thanks, ---- Hiro Kishimoto > -----Original Message----- > From: Dane Skow [mailto:dane@fnal.gov] > Sent: Thursday, March 17, 2005 6:03 PM > To: security-area(a)ggf.org > Cc: Ian Foster; Hiro Kishimoto > Subject: Update on OGSA Basic Profile Security work >=20 > As Frank mentioned in the Security Area Meeting, the OGSA Basic = Profile > is now > being worked intensely toward conclusion. The Working Group has set a > goal of > mid April for resolving all the open issues with the current draft. = The > majority of > the new issues opened this meeting have to do with security. Takuya = has > asked for > a week to allow the interested parties in the Security Area to read = the > current draft > and comment on the current open issues (or raise others). This means > that interested > parties will need to engage within the next few days to have maximal > effectiveness. > I encourage those interested in OGSA to engage on the Basic Profile = now. >=20 > The response to the question about which use cases from the OGSA use > case > document must be supported by the Basic Profile was "all of them". > However, since > we will not have a normative spec for WS-Delegation by June, nor do I > know > any other credential delegation standard, I suspect there > was likely a misunderstanding. Takuya will follow up on that question. >=20 > I believe Hiro and Ian (chairs of OGSA-WG) > will second me in saying that input on this document from > security experts is welcomed and requested. The most effective form > would be for > people to join the mailing list and attend the relevant phonecons. The > next most > effective is to download and read the current drafts and provide > comments to the list. >=20 > Frank and Takuya have volunteered to try to alert the area about > relevant phonecons > and open issues. However, they will not be able to relay > comments/discussion with this > short timeline. Interested parties will have to join them directly to > keep up with the discussion. >=20 > Cheers, > Dane >=20 ------- end of forwarded message -------

1 0

Update on OGSA Basic Profile Security work
by Dane Skow 17 Mar '05

17 Mar '05

As Frank mentioned in the Security Area Meeting, the OGSA Basic Profile is now being worked intensely toward conclusion. The Working Group has set a goal of mid April for resolving all the open issues with the current draft. The majority of the new issues opened this meeting have to do with security. Takuya has asked for a week to allow the interested parties in the Security Area to read the current draft and comment on the current open issues (or raise others). This means that interested parties will need to engage within the next few days to have maximal effectiveness. I encourage those interested in OGSA to engage on the Basic Profile now. The response to the question about which use cases from the OGSA use case document must be supported by the Basic Profile was "all of them". However, since we will not have a normative spec for WS-Delegation by June, nor do I know any other credential delegation standard, I suspect there was likely a misunderstanding. Takuya will follow up on that question. I believe Hiro and Ian (chairs of OGSA-WG) will second me in saying that input on this document from security experts is welcomed and requested. The most effective form would be for people to join the mailing list and attend the relevant phonecons. The next most effective is to download and read the current drafts and provide comments to the list. Frank and Takuya have volunteered to try to alert the area about relevant phonecons and open issues. However, they will not be able to relay comments/discussion with this short timeline. Interested parties will have to join them directly to keep up with the discussion. Cheers, Dane

1 0