EMI is partially funded by the European Commission under Grant Agreement RI Common Authentication Library Daniel Kouril, for the CaNL PT EGI CF 2012, Munich

EMI INFSO-RI Common security layer (PKI) used but no common support in applications – Duplication of code - expensive maintenance – No common profile for SSL and X.509 – Difficult to add new features – Security audit of code quite hard Motivation

EMI INFSO-RI Simple API to support authentication and message protection Functionality to deal with Grid specifics Available for a wide range of languages Easy to understood and use – Hide complexity inside the library Credentials delegation not addressed Main Goals

EMI INFSO-RI API designed and underwent detailed expert reviews Implementation started in the middle of 2011 – EMI PT established for the work APIs implemened by three subgroups Implementations delivered as part of EMI-2 EMI PTs are expected to integrate CaNL in Y3 Current Status

EMI INFSO-RI API for connection-based applications – Simple to use – Mutualy authentication connection – Exchange of protected messages Minimal external dependencies – Numbers, size Dependency on SSL implementation kept minimal Available CaNL Features

EMI INFSO-RI Grid „extensions“ inherent to the library – Support for proxy certificates (RFC, legacy) – Support for CA‘s signing policies Management of X.509, including proxies – Generation of X.509 requests – Proxy signing Some bindings support PKCS11 – Smart cards and/or soft-tokens Available CaNL Features

EMI INFSO-RI Samples of codes provided (or can be) – Connection establishment, delegation, proxy mgmt API descriptions available Developers will need to replace their code with calls to canl Any feedback welcome Integration with applications

EMI INFSO-RI Largely based on existing code Two levels of API First level contains basic calls to establish authenticated connection and communicate – Simple but generic – Generic API with no SSL and/or X.509 dependency – Internaly plugin-based – Other security mechanims easy to support C

EMI INFSO-RI The second level provides extensions for SSL and/or X.509 – Setting SSL specifics for connections CA‘s locations, cert/priv key, SSL versions, … Certificate and proxy management – Preparing CSR requests, signing proxies, … C

EMI INFSO-RI Based on code from ARC framework – A lot of code cleaning performed Interface for handling X.509 credentials – Private key, certificate, proxy – Certificate request – CA and policies – Predefined environment setups Abstract X.509 authenticated connection – Both client and server side Expandable to different transport layers – implemented for network sockets C++

EMI INFSO-RI Designed to integrate seamlessly with the standard Java network stack. Provides implementation of multiple trust stores: – OpenSSL-like trust store with support for Globus EACL and IGTF Namespaces – Custom directory store which can be flexibly configured to use certificates and CRLs defined with wildcard expressions – Traditional Java Keystore amended with separate CRLs It is possible to automatically use remote CRLs and certificates (with local caching) Java

EMI INFSO-RI Trust stores are refreshed at configurable intervals User credentials can be provided in multiple formats: – Java keystore – Pair of PEM files – PEM keystore – DER PKCS8 Offers support for RFC 2818 Adds a lot of helper utilities, e.g. allowing to perform DN comparison in a portable and safe way or to format a DN for printing. Java

EMI INFSO-RI Thank you