Jens’ N th soapbox Can’t be a PMA without a Soapbox Jens Jensen, RAL EU GridPMA, Switch, Zürich, May 2009

PART I WHAT IS A CA?

What is an IGTF CA? Is it the institution running the issuing authority Is it the trust anchor, a certificate Is it a cert and a (sub-)namespace Is it a collection of certs and namespace Is it a person (le roi, c’est moi)

What is a CA? All of the above (ish) Plus the following…

What is a CA – Services 1.Support infrastructure (eg helpdesk) 2.Contact s (e.g.,.info) 3.Front end – certificate request/download –Renewal and RA interface (if different) 4.Back end – signing service 5.CRL –And OCSP, if available

What is a CA – Services Notification service –Subscriber Issuance, renewal, rekey Revocation –RA Same, mostly –Unusual events

What is a CA – Services Repository –Satisfying repository obligations Publications according to local (usu country) law –Personal data

What is a CA – IGTF RPDNC… (see later) CA manager’s GPG key –TACAR registration paperwork Attendance record –PMA most recent presentation record –PMA most recent audit record

What is a CA – IGTF PMA reviewer records –Initial, re-review: mails, spreadsheets Minreq and AP implementation

What is a CA – Infrastructure 1.Networks – (internet/web needed for at least CRL) 2.DNS, internal 3.DNS, external 4.Machines, hardware 5.Physical protection

What is a CA – internals 1.(Front) database –Logging and archiving (if different) (WORM?) 2.CA operator interface 3.Signing infrastructure –HSM, if used 4.RA database –Paper and/or online

What is a CA – people/roles 1.CA Manager –Policy, admin 2.RA manager manager –RA managers, RA operators (variations) 3.Support 4.(Self)auditor

What is a CA – “Manual” Trust Photocopies (or equiv) of ids Appointment letters PINs, if used Private keys throughout PKI Passphrases

What is a CA – Internals High availability services –Redundancy, monitoring High integrity services –Backup, integrity checks High confidentiality services –Encryption, physical protection, release procedures DISASTER RECOVERY

What is a CA – W&F Audit results –Internal audits –Self audits –External audits

What is a CA – W&F Level of Assurance – LoA Level of Effort – LoF Level of Expertise – LoE –Level of Contribution? – LoC Making change – inertia – LoI –Dinghy vs supertanker Level of Reputation(?) – LoR

What is a CA – W&F Age –Catching up with changing requirements –General rule of decay and obsolescence Components, documents Procedures Age: Rule of that curvy thing

What is CA – exceptional Coping with special cases and errors –Usually on a case by case basis –See humans vs comps later in pres.

PARTS II & III POLICY AND SOFTWARE

Guiding Principles Redde Caesari quae sunt Caesaris –Policy To orthogonise or not –Software Jens’ Law of Humans vs Computers Jens’ Law of Complexity

PART II POLICY

Implementation Implement! in CP/CPS Template Implement! in “1”SCP Implement! in software – see next Part

Examples (non-exhaustive) Either describe separate dimensions –E.g. private key protection –E.g. identity vetting W&F Describe with OIDs OIDs are not ordered I.e,..1 >.2 >.3

Ponder Instead of “how is it implemented” –“What is the goal” How LoA is achieved How APs relate to each other in this respect –Policy mapping

Or not Orthogonal Usually a good thing Clean Separates things that are separate Modular Non-orthogonal Easier to interpret Single mapping to other levels (maybe) Maybe it makes sense to do both

Example Private key in file –Password protected –User generated Certificate personal –F2F id vetting –IGTF-rekey … “I am a Classic…” Maybe it makes sense to do both

PART III SOFTWARE

Law of Humans vs Computers Computers are good at computer things –Make computers do them! Humans are good at human things –Give human things back to humans

Operating Manuals Documenting existing practice Documenting special cases –Discourage too much creativity –Guidelines – good

Law of Complexity “Make simple things simple, complex things possible” “Make things as simple as possible, but not simpler” Complexity has to go somewhere

The Software Triangle Pain Simple convenience Does the right (complex) thing

Example – web CA FF can no longer import certs from file? Backwards DNs, IE on Vista Conversion from PKCS#12 to PEM Import/export for non-personal certs Trust web sites flag not set on cert imp?

Renewal Import into browser –.pem of course is OK Retaining use of private key

Signing Policies Implementation of RPDNC Good(ish) certs outside RPDNC

More software STFC will release Java clients software –Open Source licence –As soon as I get round to doing it Other Java clients STFC-licensed –Free (beer) for non-commercial

Concluding Remarks Soapbox