Public Key Activities in the Spanish Academic Network PKI-COORD (PKI Coordination for Europe) December 6, Amsterdam

PKI Coordination for Europe - 2 December 6, 2000, Amsterdam Outline zIRIS-PCA yObjectives and Characteristics yHierarchy yPolicy yProcedures yLinks zPKCS#11 Library zPAPI yArchitecture yStatus yGoals

PKI Coordination for Europe - 3 December 6, 2000, Amsterdam IRIS-PCA: Objectives zExplore PK technologies zEstablish a hierarchical certification structure in the Spanish Research and Academic Network (RedIRIS constituency) zEstablish a common certification framework zShare applications and experiencies between the members of the community zPromote the use of open-source software

PKI Coordination for Europe - 4 December 6, 2000, Amsterdam IRIS-PCA: The Begginings zPKI activities were started at the end of 1997  GTI-PCA Working Group y7th WG meeting in November 2000 zIRIS-PCA is in production yStarted November 2000 yTwo organizations certified yNine organizations working on their own PKI (candidates to be incorporated)

PKI Coordination for Europe - 5 December 6, 2000, Amsterdam IRIS-PCA: Characteristics zScope: Root CAs of organizations under our constituency (Research and Acedmic institutions) zX509 v3 certificate format zRedIRIS operates the root CA ySoftware: openssl yOn dedicated, securified, off-line Linux box yCertificates available through HTTP (plus LDAP in the next future) zEach organization is free to establish its own CA and RA structure, CP and CPS yAt least as restrictive as the IRIS-PCA CP

PKI Coordination for Europe - 6 December 6, 2000, Amsterdam IRIS-PCA: Hierarchy IRIS-PCA Org-RootCA Org-SubCA Server certificate User certificate Other certificates Server certificate User certificate Other certificates

PKI Coordination for Europe - 7 December 6, 2000, Amsterdam IRIS-PCA: Policy zhttp:// (only Spanish version available) zAt the moment, no CP/CPS full compliance to standards (RFC 2527) zChapters on: yIRIS-PCA identity yScope yCertification tree yUse of the RAs ySecurity and privacy requirements yPoliciy and procedures for certificates yPolicy and procedures for revocations yValidity of the certificates yNaming conventions yCRL and certificate management yObligations and responsibilities

PKI Coordination for Europe - 8 December 6, 2000, Amsterdam IRIS-PCA: Procedures zThe candidate organization sends yBy yCertificate request (PKCS#10 or self-signed certificate formats) yBy certified postal mail yCertification policy yRequest document and legal agreement yFormal appointment to the technical contact replies yBy (to the organization technical contact) yCA certificate (PEM format), also published by HTTP yBy certified postal mail ySecret code for revocation

PKI Coordination for Europe - 9 December 6, 2000, Amsterdam IRIS-PCA: Links zIRIS-PCA Pilot pca/index.en.html zGTI-PCA Working Group zMailing list

PKI Coordination for Europe - 10 December 6, 2000, Amsterdam PKCS#11 Library zDeveloped by the University of Murcia for their internal PKI project yOpen to different formats and sizes of smart-cards yAvailable for Unix/Linux and Windows yThoroughly tested in an operational environment yAbout 10,000 users yAcces control, clock-in, facility reservation,... zThe aim of RedIRIS is to distribute the library under GPL yNegotiation is ongoing yConfiguration procedures and documentation necessary

PKI Coordination for Europe - 11 December 6, 2000, Amsterdam PAPI zWas initiated to solve the problems derived from access control based on IP-address filters zIts main objective is the provision of controlled access to information services with yA simple and transparent user interface yMaximum flexibility for yClients (universities and other centers inside the RedIRIS network) yInformation providers yUser ubiquity yUser privacy with respect to content providers zStarted with the collaboration of content providers and client organizations zLiaisons with other academic networks

PKI Coordination for Europe - 12 December 6, 2000, Amsterdam PAPI: Architecture

PKI Coordination for Europe - 13 December 6, 2000, Amsterdam PAPI: Status zFunctioning prototype yBased on Apache mod_perl and virtual servers yRunning from October yhttp:// zFirst real environment testbed available on mid-December yAccess to digital library services at a major university in Southern Spain yAbout 300 initial users y70,000 potential users ySuccessful initial tests

PKI Coordination for Europe - 14 December 6, 2000, Amsterdam PAPI: Short- and mid-term goals zOptimization of system modules based on performance measurements and user feedback yManagement facilities yImplementation of a set of basic authentication hooks (user- and group-based) zInstallation procedures and documentation set: dissemination yPAPI-on-a-box zHarmonization (standardization?) with similar projects yEssential to effectively involve content providers