1. Federating and PKI: Case Studies Paul Hill, MIT
Understanding what's needed to collaborate across boundaries, this session will provide concrete examples of campus technical implementations.

2. MIT context 99 % of MIT users have at least one MIT x.509 certificate
MIT deployment since 1996
Soft certificate
“junk” certificate used only for authentication
Obtained using MIT ID number, Kerberos principal name, and Kerberos password submitted over SSL/TLS
4/6/2019 2

3. Our CA(s) MIT CA, self signed cert Equifax All user certificates
Nearly all MIT application servers
Equifax
Used by a small number of application servers that need to be under a commercial CA
4/6/2019 3

4. Internal uses Web authentication Access to MIT-only web pages
Fine grained access control
Ability to download MIT licensed software
Sloan’s web portal
Course registration
Housing lotteries
Financial system
4/6/2019 4

5. Using the MIT certificates outside of MIT for online purchasing
DELL
Apple
GovConnection
Office Depot
VWR Scientific
AirGas
Grainger
Minuteman Press of Cambridge
4/6/2019 5

6. Using Certificates for online sales
ChargeMIT – MIT’s e-commerce solutions
suite of ecommerce services provided by the Controller's Accounting Office (CAO) and Information Services & Technology (IS&T)
enable secure online, back-office, and point-of-sale credit card transactions for MIT departments, labs, centers, and recognized groups
Hosted service or DLC’s server
4/6/2019 6

7. MIT Certificates are not used for
Code signing
SMIME
long term encryption
VPN authentication (yet)
4/6/2019 7

8. Support issues for end users
Getting the MIT root CA into the certificate store
Getting the users to obtain a certificate
Certificate renewals
Certificates expire July 31st each year
Large publicity campaign once a year
4/6/2019 8

9. Support issues for application servers
Getting the proper certificates installed on the application server
Certificate renewal
Teaching developers how to use the technology
4/6/2019 9

10. Obstacles to using PKI for easy federations
Perceived lack of other interesting sites deploying user certificates
Lack of developers that understand the use of user certificates
Armchair lawyers
Non-repudiation
“signatures”
equivalency
Multi-tier applications
4/6/2019 10

11. The lack of barriers
So far few external partners have refused to accept MIT certificates once we have asked
Variety of commercial vendors
US government agencies
4/6/2019 11

12. Future directions Better education of developers PKINIT PKCROSS
Improved documentation
Sample source code
Hosted servers running arbitrary code
PKINIT
Multi-tiered applications
PKCROSS
Using PKI to establish Kerberos cross realm authentication
4/6/2019 12