1. HEBCA Overview CSG, uWash, 2002 Michael R Gettes Georgetown University Gettes@Georgetown.EDU

2. 2 Policy Technical PKI is 1/3 Technical and 2/3 Policy?

3. Transforming Education Through Information Technologies http://www.educause.edu/ Common Solutions Group, January, 2002 (Sanibel Island) 3 Multiple CAs in FBCA Membrane Survivable PKI Cross Certificates allow for “one/two-way policy” Directories are critical in BCA world.

4. Transforming Education Through Information Technologies http://www.educause.edu/ Common Solutions Group, January, 2002 (Sanibel Island) 4 A Snapshot of the U.S. Federal PKI Federal Bridge CA NFC PKI Higher Education Bridge CA NASA PKI DOD PKI Illinois PKI University PKI CANADA PKI

5. 5

6. 6 The PKI Puzzle By David Wasley, UCOP PKI Hierarchy Medical

7. 7 HEBCA linkage HEBCAFBCA NIH E-Auth Shib CREN Weems’ Wacky World Medical Healthkey MitreTek Inter- Directories Euro PKI GRID SEVIS Apache Signed Email FDRM State Bridges VidMid

8. NIH ca trust anchor “DAVE” (Discovery and Validation Engine) sender (UA) receiver (NIH) NIH directory FBCA dir cross cert cross cert DAVECAME-Lock software ca directory HEBCA dir cross cert UA ca UA dir issued get Cert,CRL via directory chaining

9. 9ControlNumber “Registry of Directories” Structure Legend: a subordinate referral a superior referral dc=edu c=us c=japan dc=intl (Top) dc=uab dc=ucop (else sup) dc=edu o=US Govt o=HHS ou=A, o=NASA (else sup) c=us ou=FBCA ou=agency7 (else sup) o=US Govt, c=us ou=FBCA ou=agency7 ou=FBCA, o=US Govt, c=us Content DirectoriesReferral Directories “Else superior referral” clause exists to allow any LDAP client (or content directory) to have option of pointing to a referral directory and be able to construct a desired path There is no “else” clause in content directories to prevent loops

10. 10 HEBCA BID F Board of Instantation and Development F 10-12 of CIO, Techies, Lawyers (usual suspects) F 1 Year to make HEBCA production –Governance –Stand up Policy/Operational Authorities –Service (structure, fees, management) –Cross-certify with FBCA –Funding and Technical development issues Application interfaces, discovery, blah blah blah

11. 11 HEBCA Issues F Certificates in Directories F Gietz: Break out cert data in dir objects (searchable certs) F Chadwick: Certificate Parsing Server F Likely a major impact on Bridge CA model F OpenSSL/OpenCA to be “bridge aware” F Registry of Directories (Next-Gen)

12. 12 HEBCA Issues F Deployment F Web Server plugin (apache) F Email validator (server based on receipt) F Bill Weems and crew; many apps F Application Integration F CAM/DAVE extensions (server validation) F XKMS, SCVP, Novomodo, blah blah F Understanding Java 1.4 and WinXP F Develop appropriate APIs F Browser awareness!!!!