XML Key Management Services - Tutorial 9 December 01 Blair Dillaway Software Architect Microsoft Corp.

Outline Historical Perspective XKMS Overview Trust Models Using XKMS Whats Next

Historical Perspective PKI complexity has limited its use –Enrollment – multiple approaches –No std discovery approach – CAs, Certs, Keys –Cert standardization & interpretation –Trust management Chain-building logic OID interpretation Cross certification & cert hierarchies –Client handling of complex ASN.1 and PKCS data structures –Effective Revocation/Validation Affects every client Interoperability issues

XKMS Overview Define XML compatible key mgmt Make PKI-based security easier to use –Address multi-vendor, cross-plat issues –Support multiple Trust/PKI infrastructures –Allow clients to offload complex, and difficult, trust assessment –Integrate key validity checks –Keep the interfaces simple –Keep interactions simple

XKMS Approach Internet Client App XKMS Service Web Service App PKI Std. Protocols: HTTP SOAP Std. Discovery: UDDI WSDL

Trust Models (1 of 2) XKMS is trust model agnostic –PKIX, PGP, Key-based, Proprietary –Services define supported model Similar to CA publishing a CPS Contract between the Service and Applications XKMS doesnt tell one how to do this or what the business relationship should be

Trust (2 of 2) But, theres still a bootstrapping problem –Apps need to pick the right trust infrastructure –Need trust in an XKMS service(s) XKMS doesnt define how to handle this Will likely mirror what already happens –Keys for high-volume, low-value, Services widely distributed –Keys for Enterprise Services distributed via internal trust –Keys for vertical market, high-value, apps using high assurance mechanism

Using XKMS (1 of 2) Getting started –Pick the right service, get its usage profile info, etc. –Tailor the XKMS client for the service Cache the service identifying info Set the service URL Understand supported KeyInfo elements Structural requirements on data (i.e., KeyID or KeyName formatting)

Using XKMS (2 of 2) Operations –Register your public key –Locate other public keys (optional) Ex: find key so you can send encrypted data to others –Check validity/trustworthiness of public keys Authentication, Signed documents, … Possibly before sending encrypted data –Manage your keys Revoke Update associated attributes Recover/roam your private key

Next Steps Refinement of XKMS 1.1 –Interface refinement –Xml Signature context issues –Bulk operations –Message level authentication, integrity, confidentiality –Update for conformance with latest XML stds Move forward as a W3C recommendation

XKMS Message Samples

Registration Request Valid abc123 mykey 8nSoscDtBoSA5jiqrMn3yg0TRvRdfFFzrutP7zHAT X4lD8cgPns= AQAB 85XRXbVMov0efQi1NvS41Q1YsZg= T12:00: : T12:00: :00 Signature Exchange mX8qoz9e+Ko01d4GcfLiyBeFg5Q= KKRHMd5eL7wwBG1Xs7A= mX8qoz9e+1d4GcfLiyBeFg5Q= 9uT2hVmuZ4sBLk414= JMffIc07Z23iJelIXHE= KeyName X509Cert

Register Result Success Valid abc123 mykey CN=MyName, O=Microsoft CN=TheCA Thn3s9ozskDXj1ibjrhxz092LG4ivz+3ARpNT+mARKY= T12:00: : T12:00: :00 Signature Exchange

Locate Request mykey KeyName X509Cert

Locate Response Success mykey My Management Data My-SPKI-Cert mpk9qt0uwUb8KyMNiHEK6Y1efkBVBC3FE= AQAB CN=MyName, O=Microsoft CN=TheCA UbCDPEkqMtlSNBxmfQt8i6tZWpqFntJilP50iRKwBLw=

Validate Request Valid abc123 Signature Encryption KeyName X509Cert

Validate Response Success Valid abc123 mykey My Management Data CN=MyName, O=Microsoft CN=TheCA UbCDPEkqMtlSNBxmfQt8i6tZWpqFntJilP50iRKwBLw= T12:00: : T12:00: :00 Signature Exchange