1. KMIP v.Next PGP Support 1 Michael Allen Sr. Technical Director, Symantec

2. Agenda KMIP v.Next PGP Support 2 Trust Establishment 1 Current KMIP Situation 2 Proposed Enhancements 2

3. Trust Establishment - Email 3 KMIP v.Next PGP Support

4. Trust Establishment – External Directory 4 KMIP v.Next PGP Support

5. Where Are We Now 5 KMIP v.Next PGP Support

6. Note About Notation 6 KMIP v.Next PGP Support

7. How Do We Fit This Into That? 7 KMIP v.Next PGP Support

8. What’s Missing from KMIP? 8 2 Each PGP key have multiple user IDs (usually email addresses, can be images as well) Searches for other PGP keys usually use these user IDs KMIP has certificate identifier but doesn’t have the right bits in that attribute User IDs can be signed just as keys can be signed Multiple User IDs 1 A PGP key consists of a unifying key and multiple purpose-specific sub keys Keys are tied together via signatures between each other KMIP doesn’t have a link notion between sets of public / private key pairs Top Key / Sub Key Structures 3 Anyone’s PGP key can sign another key These signatures may play a role in arbitrary trust calculations Arbitrary Signature Sets 4 PGP-specific feature where the key ID of another PGP key rides along with one’s own PGP key Anything encrypted with one’s PGP key also gets encrypted to the ADK Searches for ADK occur via its key ID Additional Decryption Key KMIP v.Next PGP Support

9. PGP Certificate Type Re-Examined 9 KMIP v.Next PGP Support

10. Top Key and Sub Key Link Objects 10 KMIP v.Next PGP Support

11. Top Key and Sub Key Link Objects 11 KMIP v.Next PGP Support

12. New Link Types 12 KMIP v.Next PGP Support Table 9.1.3.2.20: Link Type Enumeration

13. New PGP Key ID Attribute 13 KMIP v.Next PGP Support Section 3.XX

14. New PGP User ID Attribute 14 KMIP v.Next PGP Support Section 3.XX

15. New PGP ADK Attribute 15 KMIP v.Next PGP Support Section 3.XX

16. New PGP Signature Attribute 16 KMIP v.Next PGP Support Section 3.XX

17. Thank you! 17 Michael Allen mike_allen@symantec.com 650-527-0716