1. Jens’ N th soapbox Can’t be a PMA without a Soapbox Jens Jensen, RAL EU GridPMA, Switch, Zürich, 11-13 May 2009

2. PART I WHAT IS A CA?

3. What is an IGTF CA? Is it the institution running the issuing authority Is it the trust anchor, a certificate Is it a cert and a (sub-)namespace Is it a collection of certs and namespace Is it a person (le roi, c’est moi)

4. What is a CA? All of the above (ish) Plus the following…

5. What is a CA – Services 1.Support infrastructure (eg helpdesk) 2.Contact emails (e.g.,.info) 3.Front end – certificate request/download –Renewal and RA interface (if different) 4.Back end – signing service 5.CRL –And OCSP, if available

6. What is a CA – Services Notification service –Subscriber Issuance, renewal, rekey Revocation –RA Same, mostly –Unusual events

7. What is a CA – Services Repository –Satisfying repository obligations Publications according to local (usu country) law –Personal data

8. What is a CA – IGTF RPDNC… (see later) CA manager’s GPG key –TACAR registration paperwork Attendance record –PMA most recent presentation record –PMA most recent audit record

9. What is a CA – IGTF PMA reviewer records –Initial, re-review: mails, spreadsheets Minreq and AP implementation

10. What is a CA – Infrastructure 1.Networks – (internet/web needed for at least CRL) 2.DNS, internal 3.DNS, external 4.Machines, hardware 5.Physical protection

11. What is a CA – internals 1.(Front) database –Logging and archiving (if different) (WORM?) 2.CA operator interface 3.Signing infrastructure –HSM, if used 4.RA database –Paper and/or online

12. What is a CA – people/roles 1.CA Manager –Policy, admin 2.RA manager manager –RA managers, RA operators (variations) 3.Support 4.(Self)auditor

13. What is a CA – “Manual” Trust Photocopies (or equiv) of ids Appointment letters PINs, if used Private keys throughout PKI Passphrases

14. What is a CA – Internals High availability services –Redundancy, monitoring High integrity services –Backup, integrity checks High confidentiality services –Encryption, physical protection, release procedures DISASTER RECOVERY

15. What is a CA – W&F Audit results –Internal audits –Self audits –External audits

16. What is a CA – W&F Level of Assurance – LoA Level of Effort – LoF Level of Expertise – LoE –Level of Contribution? – LoC Making change – inertia – LoI –Dinghy vs supertanker Level of Reputation(?) – LoR

17. What is a CA – W&F Age –Catching up with changing requirements –General rule of decay and obsolescence Components, documents Procedures Age: Rule of that curvy thing

18. What is CA – exceptional Coping with special cases and errors –Usually on a case by case basis –See humans vs comps later in pres.

19. PARTS II & III POLICY AND SOFTWARE

20. Guiding Principles Redde Caesari quae sunt Caesaris –Policy To orthogonise or not –Software Jens’ Law of Humans vs Computers Jens’ Law of Complexity

21. PART II POLICY

22. Implementation Implement! in CP/CPS Template Implement! in “1”SCP Implement! in software – see next Part

23. Examples (non-exhaustive) Either describe separate dimensions –E.g. private key protection –E.g. identity vetting W&F Describe with OIDs OIDs are not ordered I.e,..1 >.2 >.3

24. Ponder Instead of “how is it implemented” –“What is the goal” How LoA is achieved How APs relate to each other in this respect –Policy mapping

25. Or not Orthogonal Usually a good thing Clean Separates things that are separate Modular Non-orthogonal Easier to interpret Single mapping to other levels (maybe) Maybe it makes sense to do both

26. Example Private key in file –Password protected –User generated Certificate personal –F2F id vetting –IGTF-rekey … “I am a Classic…” Maybe it makes sense to do both

27. PART III SOFTWARE

28. Law of Humans vs Computers Computers are good at computer things –Make computers do them! Humans are good at human things –Give human things back to humans

29. Operating Manuals Documenting existing practice Documenting special cases –Discourage too much creativity –Guidelines – good

30. Law of Complexity “Make simple things simple, complex things possible” “Make things as simple as possible, but not simpler” Complexity has to go somewhere

31. The Software Triangle Pain Simple convenience Does the right (complex) thing

32. Example – web CA FF can no longer import certs from file? Backwards DNs, IE on Vista Conversion from PKCS#12 to PEM Import/export for non-personal certs Trust web sites flag not set on cert imp?

33. Renewal Import into browser –.pem of course is OK Retaining use of private key

34. Signing Policies Implementation of RPDNC Good(ish) certs outside RPDNC

35. More software STFC will release Java clients software –Open Source licence –As soon as I get round to doing it Other Java clients STFC-licensed –Free (beer) for non-commercial

36. Concluding Remarks Soapbox