People’s Choice… When not just any CA will do Bruce A Rich OASIS KMIP F2F, Feb 2016

Why multiple CAs? Partitioning of intranet space into Dev, Test, Production areas Loose and flexible More tightly controlled Rigid controls, may even be further partitioned May somewhat mirror the internal org chart, reflecting partition of responsibilities and control

Can “Certify” a PKCS10 blob via KMIP, but… If a server has multiple CA personalities, how can the client discover/suggest/hint? And PKCS10 is not user-friendly, is there a way to request/tweak certificate capabilities through KMIP?

Client choice The Certify API allows Attributes to be passed on the call KMIP already has X509 Certificate Issuer attribute Since that is supposed to be unique(ish), use that as a mechanism to refer to the desired issuer Or could define a more client-friendly (X509 Certificate Issuer Name- >String) attribute

Discovering the choices No (protocol-defined) way to know what CAs the server might be able to contact/use on the client’s behalf Could add a Query extension for this, would return zero-n X509 Certificate Issuer (or X509 Certificate Issuer Name) attributes Having the server volunteer the information keeps the client from having to compose this stuff all by themselves…

PKCS#10 avoidance? Could define a couple of new attributes to specify whether the cert would be for a CA or not, the certificate usage type Already have a variant of AlternativeName that is X500 Distinguished Name Larger scope than just usage of X500 Certificate Issuer

Recommendation Augment Query with one more optional thing to ask the server Minimalist profile to show usage

Backup slides

Common certificate extensions “Key Usage” Allowable usages for the public key in the certificate CERT_SIGN CRL_SIGN DATA_ENCIPHERMENT DIGITAL_SIGNATURE GOVT_APPROVED KEY_AGREEMENT KEY_ENCIPHERMENT NON_REPUDIATION These are covered via the Cryptographic Usage Mask on the public key (except GOVT_APPROVED, see KMIP Spec 3.19) Omission is interpreted as all of the above OID = { 2, 5, 29, 0F }

Common certificate extensions… “Basic constraints” Tells whether the cert is for a CA or not (TRUE or FALSE) OID = { 2, 5, 29, 19 } Impacts all interpretation of extended key usages

Alternative Name Can provide most of the information needed by Certify DNS Name IP Address X500 Distinguished Name Only need “Basic Constraints”, “CA=true” attribute “Extended Key Usage” bitset attribute