1. 1 11 th Fed/Ed PKI Meeting Some quick updates from recent HEPKI-TAG and SURA work Jim Jokl jaj@Virginia.EDU

2. 2 US Higher Education Root (USHER) and Policy  Background A hierarchical CA for Higher Education  Issue authority certificates to campus CAs  Replace and offer more than the old CREN hierarchy Initial discussions on LOA for USHER  Strong procedures for USHER operations  Strong process to identify campuses Discussions on requirements for schools  Something heavy, PKI-Lite, etc?  Implications for when USHER cross-certifies with HEBCA  Early focus decisions Strong procedures for USHER itself; use the InCommon I&A process for schools Architect for an USHER-heavy and an USHER-Lite Focus deployment on USHER-Lite

3. 3 USHER & Policy: Enter LionShare  LionShare needs a trust fabric that works logically like PKI-Lite Verify PKI-Lite OID in cert  Question: can/should USHER require at least PKI-Lite from campuses? Schools doing this anyway Strong pushback on TAG call  How does USHER certify campuses  Campus liability concerns  Why is a requirement needed? USHER Campus CA LionShare SASL CA Short-life user certificates

4. 4 Grid Computing & PKI Bridges  Started in the NMI Testbed Grid project Tradition in the grid community appeared to be to run a CA for each Grid or install root certificates for each site We wanted an approach that scaled more easily, leveraged central campus authentication, and enabled researchers to get out of the identity management business  Logical solution Attempt to leverage HEBCA with Globus  Project Do the technical work needed to pilot this idea in parallel with the development of HEBCA

5. 5 Schematic of Original SURA NMI Testbed Grid PKI Integration Goal Campus E Grid A’s PKI Testbed Bridge CA Testbed CA Campus B Grid Campus C Grid Campus D Grid Campus A Grid Campus F Grid B’s PKI C’s PKI Cross-cert pairs User Certs

6. 6 Inter-campus NMI Testbed Globus Project Activity  Built simple Testbed Bridge CA Off-line system Used Linux and OpenSSL to build bridge Stored securely when not is use  Cross-certifications UVA UAB TACC USC LSU Univ of Arkansas in progress  www.pki.virginia.edu/nmi- bridge www.pki.virginia.edu/nmi- bridge

7. 7 Globus & PKI Bridges  Some issues Globus uses OpenSSL which is not bridge-aware  Preload cross-certificates  Signing policy files Certificate profiles used by some campus CAs caused problems  Continuing forward with the SURA Grid Cross-certification of sites Developing  Directory-based infrastructure to automate management of gridmap-file  Web-based tool for sites to easily add/remove their users  Tools to automatically deploy the cross-certificates and signing policy files

8. 8 HEPKI-TAG Update  New revision of PKI-Lite Clarifications to Policy/Practices document Profiles updated  Support for EAP-TLS wireless authentication recommending use of Microsoft OID  Specified Authority Key Identifier to be compatible with bridges  More specified with more notes for implementers  Supporting some other USHER topics  Signing tools project  Internet2 and Educause HEPKI-TAG site links Internet2Educause