1. EGEE is a project funded by the European Union CA overview and requirements Ognjen Prnjat, Nikos Vogiatzis GRNET EGEE-SEE regional kick-off, April 7-8 th, 2004

2. Athens, 7-8 th April - 2 Objectives of this session Establish understanding of the CA operation Agree on strategy in EGEE-SEE

3. Athens, 7-8 th April - 3 Outline Basic PKI/CA overview EGEE security

4. Athens, 7-8 th April - 4 Grid security requirements Secure communication (authenticated and perhaps confidential) between Grid elements. Security support across organizational boundaries, thus prohibiting a centrally-managed security system. “Single sign-on" for users of the Grid, including delegation of credentials for computations that involve multiple resources and/or sites.

5. Athens, 7-8 th April - 5 Globus security Globus / Globus Security Infrastructure use PKI and certificates PKI (CAs and Certificates) SSL/ TLS Proxies and Delegation PKI for credentials Proxies and delegation (GSI extensions) for secure single sign-on PKI: Public Key Infrastructure, SSL: Secure Socket Layer TLS: Transport Level Security SSL for authentication and message protection

6. Athens, 7-8 th April - 6 Certificates A X.509 certificate binds a public key to a name It includes a name and a public key signed by a trusted party (I\issuer) By checking the signature, one can determine that a public key belongs to a given user Name Issuer Public Key Signature Koumantaros Kostas 56, Mesogion Av. Athens, GR BD 04-03-1977 Male 175cm, 65Kg Brown Eyes Hellenic State Seal

7. Athens, 7-8 th April - 7 Certification Authorities (CAs) A small set of trusted entities known as Certificate Authorities (CAs) are established to sign certificates CA is an entity that exists only to sign user certificates The CA signs it’s own certificate which is distributed in a trusted manner The public key from the CA certificate can then be used to verify other certificates CA certificate itself must be trusted!! Name: CA Issuer: CA CA’s Public Key CA’s Signature

8. Athens, 7-8 th April - 8 CA verification Different approaches: Root certification Cross certification Bridge/hub cross-certification EGEE approach: PMA “club” of CA managers

9. Athens, 7-8 th April - 9 GRID CAs - PMA The European Grid Authentication Policy Management Authority for e-Science Authentication for distributed resource access through the Grid Security Infrastructure (GSI) Goal: establish a common authentication infrastructure trusted by all EU DataGrid parties Later joined by more partners (LCG project, others around the world) GridPMA.org initiative was started in 2002 http://www.eugridpma.org/

10. Athens, 7-8 th April - 10 EGEE security PMA checks if candidate CA conforms to a set of Minimum Requirements before it can join the club Cyprus, HellasGrid and Israel CA part of PMA Up to other EGEE-SEE CAs join the PMA club and run CA services for local Grid users Details on the site: http://www.eugridpma.org/ Catch-all CA (for SEE-GRID): HellasGrid

11. Athens, 7-8 th April - 11 Action points Identify existing CAs and future CA plans