David Kelsey CLRC/RAL, UK d.p.kelsey@rl.ac.uk WP6 CA Mgrs meeting 5 Mar 2002 David Kelsey CLRC/RAL, UK d.p.kelsey@rl.ac.uk 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

Meetings WP6 Certificate Authorities Group Defining procedures for Authentication/Trust Dec 2000, March, June, August, Dec 2001 and 5 March 2002 Agenda 5 Mar 02 Roundtable update Features/Acceptance Matrix GGF CP/CPS Authentication with other Grid projects (USA, CrossGrid) WP6 procedures Next meeting – June 2002 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

EDG CA’s roundtable Already in TB1 CERN, Czech Rep, France, Ireland, Italy, Netherlands, Nordic, Portugal, Russia, Spain, UK Several working on OpenCA as the implementation Should/will share expertise here Discussion about re-issue of expired certs (users and CA) Long jobs which live beyond life of cert? CA publishing issued certs in LDAP (For VO Authorisation) Some do, some don’t, some don’t want to Other Grid projects USA (LBL/ESnet DOE Science Grid) Karlsruhe (Germany, CrossGrid) 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

Features/Acceptance Matrix Defined Minimum requirements for EDG CA (Jun01) N * N matrix to show status of “acceptance” Matrix still rather sparse right now! But Features matrix is in better shape Every CA checks that it “trusts” all others Brian Coghlan working on developing and automating the process Investigate using Grid info services Once we have N*N matrix may collapse to single row Using a modified set of min requirements “CA Managers” measure of “trust” 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

Inter-Grid authentication USA DOE CA now in operation We reviewed their procedures in Dec 2000 Passed EDG criteria Add to Acceptance matrix Approved as a “trusted” CA First test USA – UK reported recently Karlsruhe (CrossGrid and Germany) CA in early operation with draft CP/CPS WP6 CA group will check this soon 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

Scaling Issues Now: 11 CA’s + 2 new Potentially 7 more CrossGrid countries to come! But no overlap – one per country Can a semi-automated Acceptance matrix cope? OK for now so we should continue this way In the longer term, this will become more difficult! Must remember that authorisation should check user identity carefully we don’t want 2 heavy weight systems Investigate requirements for future Authentication Re-look at Root or Bridge CA Or GGF will solve the problem? 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

GGF CP/CPS Security Area GridCP working group Discussed in GGF4 Toronto Aiming to help solve “Trust” problem Discussing CP/CPS, Audit, PMA, … Aim to finalise the CP models in GGF5 Edinburgh Our acceptance matrix methods may be useful 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs

WP6 CA procedures “Catch all” CA for DataGrid -> CNRS (agreed) For those without a CA (CEA, ESA, CSSI etc) But requested revised CP to state how RA works User training/documentation (many repeated cert requests!) Cal Loomis requests/suggestions Stability Subscription service for CRL’s Notification of updates Registry of trusted CA’s (GRID service) Subscription service for CA info We will investigate OCSP, OGSA – notification 5-Mar-02 D.P.Kelsey, WP6 CA Mgrs