1. PKI Update

2. Topics Background: Why/Why Not, The Four Planes of PKI, Activities in Other Communities Technical activities update S/MIME Pilot prospects – light CP/CPS KX.509 and Grid issues Policy activities: draft HE cert policy, FERPA European activity HE Bridge CA, NIH pilot CREN CA

3. Topics Why PKI? The Four Stages of PKI Other sectors Federal Activities - fBCA, NIH Pilot, ACES, other Healthcare- HIPAA Corporate Deployments European activities The Industry Higher Ed TAG, PAG

4. Why PKI? Single infrastructure to provide all security services Established technology standards, though little operational experience Elegant technical underpinnings Serves dozens of purposes - authentication, authorization, object encryption, digital signatures, communications channel encryption Low cost in mass numbers

5. Why Not PKI? High legal barriers Lack of mobility support Challenging user interfaces, especially with regard to privacy and scaling Persistent technical incompatibilities Overall complexity

6. D. Wasley’s PKI Puzzle

7. The Four Planes of PKI on the road to general purpose interrealm PKI the planes represent different levels of simplification from the dream of a full interrealm, intercommunity multipurpose PKI simplifications in policies, technologies, applications, scope each plane provides experience and value

8. The Four Planes are Full interrealm PKI - (Boeing 777) - multipurpose, spanning broad and multiple communities, bridges to unite hierarchies, unfathomed directory issues Simple interrealm PKI - (Regional jets) - multipurpose within a community, operating under standard policies and structured hierarchical directory services PKI-light - (Corporate jets) - containing all the key components of a PKI, but many in simplified form; may be for a limited set of applications; can be extended within selected communities PKI-ultralight (Ultralights) - easiest to construct and useful conveyance; ignores parts of PKI and not for use external to the institution; learn how to fly, but not a plane...

9. Examples of Areas of Simplification Spectrum of Assurance Levels Signature Algorithms Permitted Range of Applications Enabled Revocation Requirements and Approaches Subject Naming Requirements Treatment of Mobility...

10. PKI-Light example CP: Wasley, etal. Draft HE CP stubbed to basic/rudimentary CRL: ? Applications: (Signed email) Mobility: Password enabled Signing: md5RSA Thumbprint: sha1 Naming: dc Directory Services needed: Inetorgperson

11. PKI-Ultralight CP: none CRL: limit lifetime Applications: VPN, Internal web authentication Mobility: not specified Signing: not specified Thumbprint: sha1 Naming: not specified Directory Services needed: none

12. Federal Activities fBCA NIH Pilot ACES fPKI TWG Others – federal S/MIME work Internet2/NIH/NIST research conference...

13. Healthcare HIPAA - Privacy specs issued HIPAA - Security specs not yet done Two year compliance phase-ins Little progress in community trust agreements Non-PKI HIPPA Compliance Options

14. Corporate deployments Success stories within many individual corporations for VPN, authentication No current community ABA guidelines Others...

15. European Efforts Generally a bit more successful; can leverage culture, national licensing structures, passports, etc. Higher ed efforts somewhat tied to national efforts; no trans- Euro work of note. http://www.terena.nl/projects/pki/pki-coord011126minutes- draft.html Have major Grid needs coming in 2005 As always, the directories are hard and ad hoc

16. The Industry What's the problem with PKI then? It all boils down to one thing: Complexity. Wanted: PKI Experts By Scot Petersen July 18, 2001

17. The Industry Baltimore in peril PKIforum slows down OASIS-SAML work (XML to leaven PKI) gains buzz RSA buys Securant

18. KX.509 Software that uses a Kerberos ticket to create a temporary certificate (less than 8 hrs; no revocation; etc.) Used for authentication to certificate-based local web services (preload campus roots) in Kerberos realms Out of Michigan; to be polished and released via NMI grant Two parts: server (KCA) that issues certs; client code to manage incoming cert into stores,OS and applications… New service (KCT) to issue Kerberos tickets from certs.

19. The Industry Browsers that don’t take community roots Communications tools that want certs we don’t want to give them Path math that sometimes don’t compute Technology that doesn’t interoperate...

20. Higher Education HEBCA HEPKI-TAG HEPKI-PAG PKI-labs Campus successes – Texas Med, Dartmouth, MIT…