Update on PKI Activities in the Spanish Academic Network PKI-COORD November 26, Amsterdam

PKI-COORD Outline IRIS-PCA  New members and evolution  Policy update  Integration into EuroPKI PKCS#11 libraries  UmPKCS11 timestamp server  Development just started PAPI  Current status  PAPI v1.1  The pilot PAPI mesh The case for BCAs in Europe

PKI-COORD IRIS-PCA Four new candidate organizations  Expected to be fully integrated before the end of the year  Problems for already established PKIs Contacts with other Spanish initiatives in PKIs  Governmental: CERES  Private: ACE (has become VeriSign) Still looking for the PKI killer application

PKI-COORD IRIS-PCA: Policy update New version of the policy document  OID: iris-pca/docs/politica.html An English translation is available iris-pca/docs/politica-pca-ingles.rtf Submitted to EuroPKI for acceptance

PKI-COORD PKCS#11 Library Developed by the University of Murcia for their internal PKI project  Available for Unix/Linux and Windows  Thoroughly tested in an operational environment More than 15,000 users Acces control, clock-in, facility reservation,... Available under GPL  Source and RPM formats  Full documentation under development

PKI-COORD PAPI Current version available is  Point of Access based on Apache mod_perl  Configurable using Apache directives inside httpd.conf Authentication hooks for  Internal database  POP-3  LDAP Includes a set of enhanced documentation  FAQ FAQ  Guide for Beginners Guide for Beginners

PKI-COORD PAPI Version is under test Problem: PoAs using the same policy must load different tokens to the user’s browser  Lack of scalability for large services Solution: PoAs with the same policy are grouped into a GPoA  Tokens are assigned hierarchically Better managenent of tokens  Registered by the PoA once all contents are received by the user’s browser Simplified installation and operation

PKI-COORD PAPI V1.1 implementation of GPoAs Browser Authentication Server Keys Hcook- Lcook GPoA GPoAPoA Hcook- Lcook PoA 302+ Hcook data

PKI-COORD The PAPI pilot mesh Using PAPI ASs and PoAs  Remote access to restricted services  Inter-institutional trust relationships A fairly complete cocktail  Three universities (one virtual)  Two commercial information providers  One library consortium  A public content provider More organizations to join in the near future  So we can erase the “pilot” PAPI is under test in other academic networks  We now about three of you

PKI-COORD Bridge CAs Integrate existing PKIs which may implement different architectures, security policies, and cryptographic suites  Address the shortcomings of the two basic PKI integration methods: mesh and hierarchical Are not root CAs  Connect trust domains through cross certificate pairs creating a “bridge of trust” Do not issue certificates directly to users Are not used as a trust point by the users of the PKIs involved  User keep their natural trust point Based on the PKIX standards

PKI-COORD Bridge CA Architecture Bridge Principal CA Bridge of trust

PKI-COORD The Federal Bridge CA Principal CAs cross-certificate with the FBCA membrane  The FBCA is built using several cross-certified commercial CAs  The membrane offers a common boundary for them Certification Policy mapping  extension Directory Services  All certificates issued by any node of the FBCA  All certificates issued to any node of the FBCA  All cross certificates pairs containing certificates held or issued by the FBCA  A CARL from each node of the FBCA covering certificates issued by that node Libraries for certificate path discovery and validation

PKI-COORD The experience at RedIRIS Problems in a bottom-up approach Theoretically, hierarchical PKIs are scalable...  Found problems when testing the integration of the RedIRIS PKI directly under another root CA < openssl  The first certificate whose subject name matched the issuer of the current certificate was assumed to be the issuer certificate >= openssl  All certificates whose subject name matches the issuer name of the current certiticate are subject to further tests  One of these tests (applied to the Authority Key Identifier) fails when a new CA is introduced at the top of the hierarchy Solution: cross-certification  Why not at a BCA?

PKI-COORD Bridge CAs Pros and cons More flexible and extensible than either mesh or hierarchical structures Support a bottom-up approach  Integration of already existing PKIs  Maintain policy independence Require certificate path discovery and validation software  There is a (public) library available Put stress on directory services  Other approaches possible Not much tested (scalability, performance,...)  More experiments are required