EU NREN PKI Jan MeijerAARnet PKI / Access Federations Strategy Workshop 10 February 2010 Sydney

me : SURFnet – CERT, security, PKI, systems engineering, e-voting 2007-now: UNINETT – service development, storage, PKI

beautiful morning NRENs 6 months server certs starting personal

PKI purpose Guarantee: Authenticity Confidentiality Integrity Non repudiation

ehr, no, we want others not to read our mail to know the sender is the sender that, for documents, thanks no reading of my credit card number no reading of my health information no reading of my passwords log on to my internal web site

if it doesn’t work it doesn’t work

the issue ?

direct trust

hierarchical trust

web of trust

Feb 1993, RFC 1422 Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management obsoletes RFC 1114 Mail Privacy: Key Management (1989)

Feb 1993, RFC 1422 The infrastructure specified in this document establishes a single root for all certification within the Internet, the Internet Policy Registration Authority (IPRA). The IPRA establishes global policies, described in this document, which apply to all certification effected under this hierarchy. Beneath IPRA root are Policy Certification Authorities (PCAs), each of which establishes and publishes (in the form of an informational RFC) its policies for registration of users or organizations. Each PCA is certified by the IPRA.

USA crypto exports <1996:International Traffic in Arms Regulation 1996: Export Administration Regulations (EAR) of the Department Commerce 31 Dec 1998:56 bit without license 12 January 2000:Freedom to export source: Bert-Jaap Koops’ Crypto Law Survey

Pretty Good Privacy Jun 5, 1991: PGP 1.0 Jan 18, 1996:Ståle Schumacher from Norway publishes PGP 2.63i…with help: Aug 1996:RFC1991, PGP Message Exchange Formats (FYI) Nov 1998:RFC2440, OpenPGP Message Format (STD)

1994: Netscape Navigator : Internet Explorer 2.0

(1994) 1996:.nl electronic purse chipknip chipper

13 December 1999: DIRECTIVE 1999/93/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

1995: Student Chip Card

qualified digital signatures!

1998: SURFnet PKI PGP PKI PGP keyserver pgp.surfnet.nl x.509 PKI

use PGP – signing and encryption – document signing and encryption x.509 – signing and encryption – document signing and encryption – authentication – smartcard deployments

requirements scalable identity vetting at university affordable server and client certificates

SURFnet x.509 PKI 1998: setup 1999: production

more levels

europe

down in the trenches

soon

~2000 Netherlands qualified Digital Signature accreditation framework ready SURFnet PKI: test audit

~2001 “SURFdiensten” GlobalSign discount deal for.nl higher ed

: PKI evolves Focus on policy Focus on CA operations Plans to interlink European PKIs Separate eScience Grid PKI TACAR Experience but not large scale deployment

SURFnet PKI numbers New CAsPersonalServer course 

popular? SSL server certificates Personal certificates Code Signing certificates

biggest problem?

get root in browsers 2000: $ x : IE: WebTrust

puzzling pieces in browser root,$$ flat rate unpunished success why do I want to run my own CA?

TERENA

idea join forces contract commercial CA flat-rate for the TERENA community unlimited NREN becomes RA re-use existing contractual relations make it stupid to not secure your server with SSL

use existing relations

SCS timeline Jan 2005:idea written up (TF-CSIRT!) Feb 2005:presented at TF-EMC2 “the list” 20 kEUR Summer 2005:reality + procedure check September 2005:CfP January 2006:GlobalSign contract

16 March 2006: SCS is born

SCS numbers 12/2007 NRENs# issued# organisations ACONet97926 ARNES*23n/a BELNET67357 CARNet166n/a CESNET45220 CRU/RENATER GARR**10020 JANET (UK) RedIRIS SUNET***48717 SURFnet SWITCH1200n/a UNI-C ****1366n/a UNINETT NRENs certificates

SCS numbers per 1 Aug 2008 # participating NRENs18 (14) # certificates issued (12551) # participating orgs2.225 # proxies3.800

2007: mission accomplished! no ssl = lame and behavioural change...

SCS: lessons learned vested interests, existing services, strong opinions, policy devil.... browser popup was the problem certain level of control good do what matters good enough = good enough!

2007 contract renewal with GlobalSign start preliminary work with new CfP

new CfP, lessons learned 1.root coverage: browsers *and* other platforms 2.validity on contract end 3.ensuring future root coverage 4.end user interfaces 5.interface response times 6.describe certificate request processing 7.profiles 8.subjectAltName 9.multiple valid certificates 10.internationalisation 11.support 12.auditing 13.training 14.certificate lifetime

more lessons...optional reqs 1.alternative lifetimes 2.end user interface for renewal 3.per NREN branding 4.additional profiles 5.eScience Grid certificate support 6.API 7.wildcard certificates 8.OCSP 9.extensive reporting

interesting CfP

TERENA Certificate Service

crucial lesson GlobalSign SCS certificates revoked 3 months after contract expiry

CfP failure Plan B?

New TCS! 5 TERENA CAs – Server – Code signing – Personal – eScience Server – eScience Personal own CPS own front-ends Comodo backend + roots

TCS numbers Jan RENATER2758 SURFnet2499 UNI-C1643 JANET(UK)1289 SUNET1088 CESNET1069 ACOnet733 UNINETT599 BELNET383 PSNC140 GRNET116 FCCN61 CARNet56 HUNGARNET35 GARR22 LITNET21 RedIRIS21 HEAnet11 ARNES7 CSC6 AMRES2 UoM0 # issued12573 # NRENs22

TCS is

TCS organisation TERENA – contractual party, financial clearing house, contact conduit to Comodo TCS PMA, club of 5 – CPS responsibility TCS Representatives – 1 per NREN, formal decisions TCS RAs – day to day operations

TCS Members CountryNRENServerCodePersonal AustriaACOnetXXX BelgiumBELNETXXX CroatiaCARnetX Czech RepublicCESNETXX DenmarkUNI-CX FinlandCSCXX FranceRENATERXX GreeceGRNETXX HungaryHUNGARNETX IrelandHEAnetXX LithuaniaLITNETXX MaltaUoMX NetherlandsSURFnetXXX NorwayUNINETTXXX PolandPSNCXXX PortugalFCCNX SerbiaAMRESXX SloveniaARNESX SpainRedIRISXXX SwedenSUNETXXX UKJANETX 22714

how? SCS Guido Aben, Jan Meijer, Teun Nijssen (SURFnet), Kaspar Brandt (SWITCH), Licia Florio, Karel Vietsch (TERENA), Milan Sova (CESNET), and more... TCS Kent Engstrøm (SUNET), Licia Florio, Jan Meijer, Kevin Meynell, Teun Nijssen, Milan Sova, Karel Vietsch, Henrik Austad, and more... TCS Tender Committee Kurt Bøge (UNI-C), Daniel Garcia (RedIRIS), Licia Florio, Dominique Launay (RENATER), Jan Meijer, Damien Shaw (JANET), Milan Sova, Karel Vietsch

PKI landscape Europe 2010 TCS DFN-PKI SWITCH-PKI Grid PKI Geant3 PKI activity

obituaries chipknip: dead chipper: dead studenten chipkaart:dead SURFnet PGP PKI:dead SURFnet x.509 PKI:dead

alive and kicking TERENA Certificate Service PGP: FIRST, 209 teams, 47 countries Grid PKI Personal certificates?

purpose