Certificate Requests to HIP Jani Pellikka 80 th IETF Mar 27 th – Apr 1 st 2011 Prague, Czech Republic.

Slides:

Advertisements

Similar presentations

Chapter 14 – Authentication Applications

Advertisements

CSCE 815 Network Security Lecture 10 KerberosX.509 February 13, 2003.

Authentication Applications. will consider authentication functions will consider authentication functions developed to support application-level authentication.

PIS: Unit III Digital Signature & Authentication Sanjay Rawat PIS Unit 3 Digital Sign Auth Sanjay Rawat1 Based on the slides of Lawrie.

Cryptography and Network Security Chapter 14

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Web security: SSL and TLS

CS5204 – Operating Systems 1 Authentication. CS 5204 – Operating Systems2 Authentication Digital signature validation proves:  message was not altered.

Csci5233 Computer Security1 Bishop: Chapter 10 (Cont.) Key Management: Certificates.

Resource Certificate Profile Geoff Huston, George Michaelson, Rob Loomans APNIC IETF 67.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

 A public-key infrastructure ( PKI ) is a set of hardware, software, people, policies, and procedures needed to create, manage, distribute, use, store,

Public Key Management and X.509 Certificates

Chapter 14 From Cryptography and Network Security Fourth Edition written by William Stallings, and Lecture slides by Lawrie Brown, the Australian Defence.

Chapter 4 Authentication Applications. Objectives: authentication functions developed to support application-level authentication & digital signatures.

Chapter 5 Network Security Protocols in Practice Part I

IP Security IPSec 2 * Essential Network Security Book Slides. IT352 | Network Security |Najwa AlGhamdi 1.

Authentication Cristian Solano. Cryptography is the science of using mathematics to encrypt and decrypt data. Public Key Cryptography –Problems with key.

HIT Standards Committee: Digital Certificate Trust – Policy Question for HIT Policy Committee March 29, 2011.

Apr 2, 2002Mårten Trolin1 Previous lecture On the assignment Certificates and key management –Obtaining a certificate –Verifying a certificate –Certificate.

An Authorization System for Grid Applications Thesis Presentation 5 th Dec 2006 Author: Wang Xiao Supervisor: Professor Heikki Hämmäinen Instructor: MSc.

CSCI283 Fall 2005 GWU All slides from Bishop’s slide set Public Key Infrastructure (PKI)

APNIC Trial of Certification of IP Addresses and ASes RIPE 52 Plenary George Michaelson Geoff Huston.

Resource Certificate Profile SIDR WG Meeting IETF 66, July 2006 draft-ietf-sidr-res-certs-01 Geoff Huston Rob Loomans George Michaelson.

Public Key Distribution and X.509 Wade Trappe. Distribution of Public Keys There are several techniques proposed for the distribution of public keys:

Chapter 8 Web Security.

14 May 2002© TrueTrust Ltd1 Privilege Management in X.509(2000) David W Chadwick BSc PhD.

Zach Miller Condor Project Computer Sciences Department University of Wisconsin-Madison Securing Your Condor Pool With SSL.

CSCI 6962: Server-side Design and Programming

Secure Electronic Transaction (SET)

Secure Socket Layer (SSL)

Information Security Fundamentals Major Information Security Problems and Solutions Department of Computer Science Southern Illinois University Edwardsville.

National Institute of Advanced Industrial Science and Technology Self-audit report of AIST GRID CA Yoshio Tanaka Information.

Unit 1: Protection and Security for Grid Computing Part 2

Certificate-Based Operations. Module Objectives By the end of this module participants will be able to: Define how cryptography is used to secure information.

Web Security : Secure Socket Layer Secure Electronic Transaction.

CERTIFICATES. What is a Digital Certificate? Electronic counterpart to a drive licenses or a passport. Enable individuals and organizations to secure.

Symmetric Encryption Mom’sSecretApplePieRecipe Mom’sSecretApplePieRecipe The same key is used to encrypt and decrypt the data. DES is one example. Pie.

1 SeGW Certificate profile (Revised) 3GPP2 TSG-S WG4 /TSG-X WG5 (PDS) S X xx Source: QUALCOMM Incorporated Contact(s): Anand.

IST E-infrastructure shared between Europe and Latin America ULAGrid Certification Authority Vanessa Hamar Universidad de Los.

X.509 Topics PGP S/MIME Kerberos. Directory Authentication Framework X.509 is part of the ISO X.500 directory standard. used by S/MIME, SSL, IPSec, and.

Cryptography and Network Security Chapter 14 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

PKI Future Directions 29 November 2001 Russ Housley RSA Laboratories CS – Class of 1981.

Pkiuniversity.com. Alice Bob Honest Abe’s CA Simple PKI hierarchy.

Cryptography and Network Security Chapter 14

1 APNIC Trial of Certification of IP Addresses and ASes RIPE October 2005 Geoff Huston.

NECTEC-GOC CA The 3 rd APGrid PMA face-to-face meeting. June, Suriya U-ruekolan National Electronics and Computer Technology Center, Thailand.

Authentication Header ● RFC 2402 ● Services – Connectionless integrity – Data origin authentication – Replay protection – As much header authentication.

1 SSL/TLS. 2 Web security Security requirements Secrecy to prevent eavesdroppers to learn sensitive information Entity authentication Message authentication.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

1 Certification Issue : how do we confidently know the public key of a given user? Authentication : a process for confirming or refuting a claim of identity.

CCSDS Security Working Group Fall 2015 Meeting Certificate Management 9 November – 13 November 2015 Darmstadt Germany Charles Sheehe NASA/Glenn.

Doc.: Submission February 5, 2013 René Struik (Struik Security Consultancy)Slide 1 FILS Handling of Large Objects Date: Authors:

QuoVadis accreditation with EuGridPMA Alessandro Usai

GRID-FR French CA Alice de Bignicourt.

NECTEC-GOC CA A Brief Status Report 13 th APGrid PMA Face-to-Face meeting March 24 th, 2014 Large-Scale Simulation Research Laboratory Information Communications.

Page 1 of 17 M. Ufuk Caglayan, CmpE 476 Spring 2000, SSL and SET Notes, March 29, 2000 CmpE 476 Spring 2000 Notes on SSL and SET Dr. M. Ufuk Caglayan Department.

ASN.1: Cryptographic files

Cryptography and Network Security

Secure Sockets Layer and the SSLiverse

کاربرد گواهی الکترونیکی در سیستمهای کاربردی (امضای دیجیتال)

زير ساخت كليد عمومي و گواهي هويت

Public-Key Certificates

APNIC Trial of Certification of IP Addresses and ASes

Cryptography and Network Security

Resource Certificate Profile

Digital Certificates and X.509

Resource Certificate Profile SIDR WG Meeting IETF 66, July 2006

Presentation transcript:

Certificate Requests to HIP Jani Pellikka 80 th IETF Mar 27 th – Apr 1 st 2011 Prague, Czech Republic

Certificate Requests (1/4) Currently there is no way to request certificates through HIP control packets – Two use cases for certificate requests: 1)request the certificate of the peer host 2)request for issuance (i.e. signing) of a certificate Certificate request mechanism to HIP – Provides a means to request a preferred certificate through HIP BEX and possibly UPDATE packets – Request included in a HIP packet to 1) obtain the certificate of the peer host, and 2) to request for issuance of a certificate for the host itself

Certificate Requests (2/4) Two new HIP parameter types: – CERT_REQ and CERT_SIGN_REQ The two parameters are of the TLV form and holds (in addition to length and value) the following fields: – Cert Group, CA Count, CA ID, CA Type – Indication of a Certificate Authority (CA)

Certificate Requests (3/4) Type Unique indentifier for the parameter Length The size of the parameter in octets excluding Type, Length, and Padding Cert Group Group ID grouping multiple related CERT and CERT_X_REQ parameters CA Count Total number of preferred CAs in the certificate request CA ID Sequence number of a preferred CA CA Type Defines the format of the indication of a CA (either HIT or SHA-1 hash) Certification Authority The indication of an accetable CA in a format defined by the ”CA Type” field Padding To make the TLV a multiple of 8 bytes

Certificate Requests (4/4) CERT_REQ and CERT_SIGN_REQ parameters are basically lists of acceptable CAs CERT parameter is the placeholder for the actual certificate request mapped by a shared value in the ”Cert Group” field (i.e. the CERT and request field share the same namespace) CERT parameter can contain (for example): – Self-signed certificate (in case of sign request) – Certificate template with desired values and fields (in case of request for the certificate of the peer)

Appendix A: Self-Signed Certificate Certificate: Data: Version: 3 (0x2) Serial Number: 0 (0x0) Signature Algorithm: sha1WithRSAEncryption Issuer: CN=Example Host Validity Not Before: Mar 21 10:47: GMT Not After : Apr 20 10:47: GMT Subject: CN=Example Host Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:eb:8e:59:16:90:06:44:e1:22:a3:d1:1f:71:36: 1d:67:31:70:c7:28:7c:aa:db:6a:72:57:a7:c4:8a: 97:b1:ad:e4:54:47:a1:09:89:47:a6:45:cd:64:92: 5d:6c:9b:18:ae:e4:95:71:c6:f6:e8:0b:32:cc:42: aa:64:97:4e:ec:6e:29:b8:af:99:bc:98:95:58:37: 15:05:00:27:36:7c:3c:c4:d6:72:e5:19:5c:30:15: 24:54:49:e6:68:63:3f:3a:2b:2a:e6:73:75:65:f6: 1d:ce:82:0e:c1:5d:a2:cf:8b:29:df:af:12:b1:97: 1d:df:64:06:9f:6d:21:2d:93 Exponent: (0x10001) X509v3 extensions: X509v3 Issuer Alternative Name: IP Address: 2001:1015:5c0e:5a74:293f:be13:cbfa:f6bd X509v3 Subject Alternative Name: IP Address: 2001:1015:5c0e:5a74:293f:be13:cbfa:f6bd Signature Algorithm: sha1WithRSAEncryption 70:9f:78:a2:63:90:d3:1c:e8:c0:b2:03:b0:fa:52:b1:13:a7: 0c:dd:f7:f4:42:86:06:68:0b:aa:1c:08:a3:bd:70:ad:47:f0: 9f:a4:31:1b:53:e6:05:5c:cb:41:40:9e:f8:39:cc:6a:ce:c2: 75:8a:e9:c0:8c:e3:03:b0:98:ed:6e:ac:0e:cb:82:96:fd:e4: 13:18:b2:ad:bf:f0:aa:2f:6d:ac:71:09:24:ca:bd:da:c9:e1: 63:fd:66:ad:e4:42:38:d5:68:3d:13:d4:ed:1c:49:e2:38:37: 36:60:cc:63:43:ae:1d:b7:e2:31:d4:22:af:2e:5b:3f:ed:6a: 72:ff

Appendix B: Joint Use Case Initiator authenticates itself towards Responder, which requires certificate-based authentication Intitiator does not happen to have requested certificate; it requests Responder to obtain one for it Responder gets the certificate for Initiator, verifies required information on it, and forwards it to Initiator in R2