1. NIST Path Validation Protection Profiles
November 10, 2003
Tim Polk

2. Ancient History
In 2001, NIST/NSA/Cygnacom/DigitalNet established a test suite for basic path processing
“Conformance Testing of Relying Party Client Certificate Path Processing Logic”
Technical success
Marketing failure

3. Current Efforts
NIST/NSA/DigitalNet (and others?) collaborated on a comprehensive test suite for path processing
Covers all fields and extensions used in Section 6 of RFC 3280
Goal 1 – support progression of 3280
Goal 2 – to encourage support for path validation in COTS products

4. PKITS Test Suite Another Technical Success
224 objective tests (many with subtests) in 16 functional areas
self-issued certificates
Delta CRLs
Policy mapping
Name constraints
Etc., etc.

5. Where’s the Carrot? Or, How can I: Hypothesis:
Encourage vendors to use the tests?
Educate consumers to ask for tested products?
Hypothesis:
Third party testing/certification provides
Vendors a certificate they can use in marketing
Consumers with something to ask for…
Result should be better products

6. NIST Strategy
Leverage the PKITS test suite, the Common Criteria testing labs (e.g., NIAP) to obtain independent test results with a family of protection profiles
Conformance testing only
2 key functional groupings
optional functional groups for CRL processing

7. Functional Groupings Enterprise PKI Bridge-Enabled Delta CRLs
Indirect CRLs
DSA

8. Enterprise PKI
Base certificate fields and the following certificate extensions:
Key usage
Basic constraints
Certificate policies (not anyPolicy)
requireExplicitPolicy in policy constraints
CRLS segmented by name
CRLs segmented by certificate type (e.g., CA certificates)

9. Bridge-Enabled Policy mapping Name constraints Distribution Points
Any Policy

10. Schedule Protection Profiles have been submitted for validation
Hopefully, the profiles will be validated and ready for use by early December

11. For More Information http://csrc.nist.gov/pki/testing/x509paths.html
(tests)
(protection profiles)