Jens' obligatory soap box Can't be a PMA without a SoapBox A random collection of Soapy things Nicosia, Jan 2009

Reviews Review reviews –Doesn’t quite work –Operational Consistency –How to ensure and improve consistency –Automation is better –(Too much automation is dangerous)

Housekeeping Web sites: locating repository obligations Consistent interfaces for automated clients? –Or at least URLs? (.info) Cf. Jim’s talk –Review certificates –Review CP/CPS –Locate support contact

Reviews Maintaining reviews –Policy (policies get updated) –Operational Use Template Policy framework –Annotations –Needs an interface –Gets confusing?

“Reuse” of DN What are all those DNs in the logs –Persons? –Jobs? –MyProxy proxies? Proxied proxies? –Agent with central key or proxy –Shared private keys?

“Reuse” of credential 1.Activation of private key –Key token, Unencrypted (host), Encrypted 2.Activation of MyProxy account 3.Intentional use of proxy 4.Proxy use of proxy 5.Unintentional use of proxy or privkey 6.Intentional misuse of proxy or privkey –Host key, user key

Security Strengthen security by weakening it –Areas of investigation –How to improve security Campaign for enforcablier security –Make it easier for RPs and opsecs

Example Using MyProxy to manage credentials –Single point of, er, something Single sign-on –Re-use of password –But single password is better (in some ways)

Using Robots Streaker security Credential automated –Can act on behalf of users, e.g., portal –Can act independently Are these different?

Using Robots Robots have names –Using robots for code signing doesn’t make sense If acting on behalf of many users, meaningless? People use host certificates –Hosts can do everything people can do

Securitification Communicating systems behaviour –… to admins Communicating user behaviour –… to VOs? What has a certificate done since it was (requested) revoked –And subsequently successfully revoked

Recommendations Work with RPs to improve operational security? –Seems like no-brainer –But does mean revealing additional data –And to whom, under which circs? Which areas increase impact –cf. RAT  OSCG et al

Auth Profiles Profile bashing –Do they diverge or converge, or neither –Dimensions: ~six dimensional Mixing and matching –Automatic RAs? –Where does the loa W&F live

Beyond Authentication? To encrypt or not encrypt –Pro: already have PKI –Con: Certs expire; maintain CRL forever; no consistent way of locating keys (no keyservers)‏ Conclusion: NOT RECOMMENDED

Beyond Authentication VOMS –Other services where certificate is relevant Object signing –Who can have it –What does it mean Object signing: –No way to define rights –Except for robots! (or probots!!)‏

Back to Authentication Service certificates –Do we still need them? –What does it mean? –Who can have them? –What services can we “issue” Document practices/recommendations

Issues for OGF Back to Template CP/CPS Beating the computer? –How to remember your password? What is a strong passphrase/word –How to specify –How to check

Issues for OGF Documenting deviations from PKIX And those other aspects of 3647 –E.g., acceptance, suspension, modification –RA Management Key validation –All known key validation parameters Personnel policies

Issues for OGF Pinning down those practices? –Like the re-keying question –Template will help here, possibly –But will alone not be sufficient –Disaster recovery Wildcard DNS –(Not the Globus DNS wildcard!)‏

Software Sufficient base for common software –Allow local flavours –Certificate management framework Standards, standards, standards –But which ones?

Dinner Discussion Topics CRL cache –Severance of undersea cable –External CRL caches –How to redirect clients Chasing miscreants by CRL –Or helping RPs and OCSPs etc –Use cases for “expired” CRLs

Conclusion The case for more automation –Humans do too many machine things The case for less automation –Machines do human things  for once try to do it properly

Conclusion This is no time for complacency Many things still not on top of other things The case for Template Policy to the rescue™

Conclusion More work…? Many things could be improved with better text, descriptions Make little working groups working on work needed to make work work