1. X.509 Proxy Certificates for Dynamic Delegation Ian Foster, Jarek Gawor, Carl Kesselman, Sam Meder, Olle Mulmo, Laura Perlman, Frank Siebenlist, Steven Tuecke, Von Welch (Presenter: vwelch@ncsa.uiuc.edu)

2. PKI '04 April 12Proxy Certificates2 Outline Problem Statement, Motivations, Approach Proxy Certificate Solution –What are they? –What can they do? Status: Standardization, Implementation, Deployment

3. PKI '04 April 12Proxy Certificates3 Use Case Job Data Store Job Broker Doman A Domain B Domain C Domain D

4. PKI '04 April 12Proxy Certificates4 Motivation Dynamic Delegation –Run-time decision on who and what –Support late binding of jobs to resources Dynamic Entities –Entities (e.g. Jobs) created at same time Single Sign On –Avoid repeated manual authentication Easy (user-driven) cross-domain use

5. PKI '04 April 12Proxy Certificates5 Approach Start with PKI –Aids cross-domain trust issues since trust relationships can be set up by individual Build off of existing standards –Needs to be easily understood by security folks at many sites Ease of implementation –Use with existing PKI libraries as much as possible –Start with identity-based authz systems

6. PKI '04 April 12Proxy Certificates6 Our solution: Proxy Certificates Allow users to delegate on the fly by granting other entities the right to use their name Prototypes in ’98 Standardized in IETF/PKIX 2004 Fully implemented, deployed and widely used

7. PKI '04 April 12Proxy Certificates7 Same format as X.509 Public Key Identify Certificate, but signed by user (or another proxy certificate) Name scoped to issuer’s name Support restricted delegation from issuer to bearer Includes critical extension to identify as Proxy and express delegation

8. PKI '04 April 12Proxy Certificates8 Certificate attribute X.509 Public key certificate X.509 Proxy Certificates Issuer/ Signer A certification authorityA public key certificate or another Proxy Certificate NameAny as allowed by issuer’s policy Unique, scoped to namespace defined by issuer’s name Delegation from Issuer NoneAllows for arbitrary delegation policies Key pairsUses unique key pair

9. PKI '04 April 12Proxy Certificates9 ProxyCertInfo Extension Critical X.509 Extension Identifies a certificate as a Proxy Cert Allows issuer to express delegation intentions

10. PKI '04 April 12Proxy Certificates10 ProxyCertInfo Delegation Policy Does not specify any method of expression –No language will be right for everyone all the time Instead OID to identify language and language-specific field –Any language can be used as long as understood by relying party Two methods defined: All and none

11. PKI '04 April 12Proxy Certificates11 Single Sign On User creates key pair locally Signs new public key with identity private key Gives short life span –E.g. 8 hours Probably all rights Allows for weak (filesystem) protection of private key and easy use

12. PKI '04 April 12Proxy Certificates12 Delegation

13. PKI '04 April 12Proxy Certificates13 Performance and Security Issues Proxy generate requires key pair generation Those accepting delegation must take care to prevent DoS –Validate delegation request before generating key pair

14. PKI '04 April 12Proxy Certificates14 Authorization Methods All rights/impersonation –Works great if you don’t mind ignoring least privilege Delegation with restrictions –Issue: How does authentication mechanisms know restrictions will be enforced? Identity from Proxy Certificate plus addition assertions to grant rights

15. PKI '04 April 12Proxy Certificates15 Standardization Status Proxy certificates have passed PKIX and IETF last calls Awaiting editorial process to become RFC Latest version is draft-ietf-pkix-proxy-10: –http://www.ietf.org/internet-drafts/draft-ietf-pkix-proxy-10.txt –Defines specifics of Proxy certificate creation and path validation

16. PKI '04 April 12Proxy Certificates16 Implementation Fully implemented in Globus Toolkit’s Grid Security Infrastructure (GSI) –www.globus.org/security/ Build on OpenSSL –Changes are additions to handle Proxy Cert path validation as error handlers to normal path validation Similar Java implementation GSSAPI-based library –Also integrated with SSH, FTP, CVS

17. PKI '04 April 12Proxy Certificates17 Deployment Many CAs issuing certificates for use with Proxy certificates for production Grids around the world –Master CA list at http://www.gridpma.org/ –Two dozen plus CAs, including DOE, NSF, NASA Old Globus CA with 5k+ certs

18. PKI '04 April 12Proxy Certificates18 Future Work One-time passwords/Two-factor authentication –Lot of recent attacks using keyboard sniffing –Service that hands out proxies authenticating with OTP Poor man’s hardware tokens Reasonable Restrictions –Where from? Intended use? –IP addresses too fragile (NAT, mobility, multi-homed) –Allow for late binding to resources Revocation –Even with short lifetime, interest in revocation

19. PKI '04 April 12Proxy Certificates19 Summary Proxy Certificates are extension to X.509 identify certificates to allow for real-time delegation and naming Implemented with minimal changes to existing PKI libraries In production use in Grids world-wide Implementation available as part of Globus Toolkit (www.globus.org)

20. PKI '04 April 12Proxy Certificates20 Acknowledgements DOE – SciDAC “Security for Group Collaboration” Many colleagues in Global Grid Forum and IETF for ideas and discussions Questions?