1. 1 Bridge/Gateway CA Project Status Gzim OCAKOGLU European Commission – DG ENTR / IDABC Reykjavik – 27 May 2005

2. 2 Outline Introduction to IDABC Programme Bridge/Gateway CA Project History Bridge/Gateway CA Pilot –Part 1 Pilot Implementation –Part 2 Recommendations for an operational BGCA Conclusions

3. 3 From IDA to IDABC 1995: first IDA Programme (Interchange of Data between Administration) 1999: IDA II 2005 – 2009 : IDABC Programme (Interoperable delivery of pan-European eGovernment services to Administration, Business and Citizens)

4. 4 “The objective of the IDABC programme is to identify, support and promote the development and establishment of pan-European eGovernment services and the underlying interoperable telematic networks supporting the Member States and the Community in the implementation … of Community policies and activities, achieving substantial benefits for public administrations, businesses and citizens.” Objective of IDABC

5. 5 Why a Bridge/Gateway CA ? IDA PKI deployed as a stop-gap solution in IDA II Programme –Members of sectoral networks should rely on national PKIs (Currently not available for most civil servants) eEurope Action Plan –support for electronic signatures in public administration Member States’ policy –ability to use the electronic certificates issued by their national CAs in pan-European business IDA II programme policy –encourage interoperability, use of standards, use of e- signature, etc. –Conclusions from previous projects

6. 6 Objective of the Bridge/Gateway CA Pilot to establish an intermediate trust infrastructure to allow a MS or the Commission to have trust and confidence in electronic certificates issued at the national level to civil servants participating in IDA networks.

7. 7 BGCA Project History 1999 : First PKI CUG’s established under the IDA Programme : issue of interoperability (recognition) of national digital certificates was raised by MS July 2002 : Bridge CA Feasibility Study issued as a result of TAC request July 2003 : “WP1” : Analysis of Bridge CA Requirements completed and reviewed July 2004 : Selection of ETSI TSL standard as technical solution for BGCA Pilot November 2004 : “WP1.2” deliverables available December 2004 : BGCA Pilot Launch

8. 8 Summary of Bridge CA Feasibility Study http://europa.eu.int/idabc/en/document/3235#feasibility Need of strong political support (e.g. explicit commitment from the European Commission) Need of governing body with high level participation of MS in the body Architecture : Modified Bridge CA or BGCA (distribution of signed trust lists) Need of some form of harmonisation of certification policies Need of agreed minimum standards and operating procedures for CA’s Operation of the Bridge : suitable European agency or external contractor? Need for a pilot

9. 9 Summary of WP1.2 deliverables Reference documents : http://europa.eu.int/idabc/en/document/3235/5585 http://europa.eu.int/idabc/en/document/3235/5585 Trust list usage recommendations –Usage of Trust lists : solely for distribution purposes (not for storage of trust) –3 trust models will be explored (add, remove or accept CA’s from trusted lists) –Standard : use of ETSI TS 102 231 with modified profile –Applications to be used : SSL mutual authentication and S/MIME Network Architecture Test Programme

10. 10 BGCA Pilot Part 1 : Implementation of Pilot –Set-up of BGCA Infrastructure –Set-up of Test Infrastructure –Running of Pilot Tests –Report on test results –Final report on technical requirements for MS administrations Part 2 : Recommendations for operational Bridge/Gateway CA –Practices Statement for operational BGCA –Participation documents (including procedures) for operational BGCA –Recommendations for extension of Pilot to Industry

11. 11 Part 1: BGCA Pilot phase : status 9 participating countries –Belgium –Italy –Germany –Finland –Czech Republic –Estonia –Slovakia –Slovenia –Iceland

12. 12 MS MS MS MS European Bridge/ Gateway CA CA Participating Member States end- user Bridge Practices Statements (CPS + signature policy) in issuing TSL to Participating Member States CAs PKI Disclosure Statement including “Trust Validation Info” in each Certificate Policies for each Participating CA signed message Validation of signed message ? Trust Equivalence Matrix between Certificates types accross Participating CAs Signature Validation Guidelines in assessing trust in end-user signature v MOU agreement Part 2 : Recommendations for operational Bridge/Gateway CA

13. 13 European IDA Bridge/Gateway CA Certificate Practice Statement Participating Member State Administration MOU ETSI TS 101 456 ETSI TS 102 042 IETF RFC 2527 IETF RFC 3647 Scheme Policy Recommendations for future extensions of the European IDA Bridge/Gateway CA Recommendations on Signature Creation and Verification for end- users EBGCA-DEL-018 - Trust Matrix ETSI TS 101 456 IETF RFC 3647 Participating Member CA PKI Disclosure Statements, Certificate Policies and Certificate Practice Statements Participating Member State Administration Participation Form Schematically

14. 14 EBGCA stakeholders EBGCA Authority Level –BGCA Governing Board or Body : with representatives of all concerned parties E.g. European Commission or agency MS representatives, responsible for the national PKI’s –BGCA Policy Authority : implementation of the BGCA Policy scheme (including CP’s mapping) –BGCA Evaluators : independent agents that will determine trust level of requesting CA’s –BGAC Operational Authority : coordination of operation of the BGCA (CA and RA services, TSL services, tesbed services) European MS Administration level –MS administration –MS evaluator (e.g. existing national supervision of accreditation body) –MS CA service provider European MS Administration end-user level

15. 15 European IDA Gateway/Bridge Authority Level European Bridge/Gateway Policy Authority European Bridge/Gateway Operational Authority European Member States Administration Level European Member State Administration Relying Party European Bridge/Gateway Technical assessors European IDA Gateway/Bridge Governing Board European Member State Administration Certificate Holder European Member State Administration end users level European Member State Administratio ns European Administration Member State CA European Bridge/Gate way Evaluator MOU Scheme Policy PKI PDS – CP – CPS European Bridge/Gateway CA Service Provider European Bridge/Gateway test bed service provider European Bridge/Gatewa y TSL Service Provider European Member State CA Evaluator

16. 16 Content of the Practise Statements Based on RFC 3647 –Main drivers : further facilitate the comparison between different CPs and CPSs (to ease the comparison of the trust levels provided by the CA’s of the different MS Administrations  important that CPS of the BGCA itself is very clear). Content : –Publication and repository responsibilities –Identification and authentication (naming ID validation, …) –Certificate life-cycle operational requirements Submission and enrolment Certificate application processing Certificate/TSL issuance Certificate/TSL acceptance Certificate usage/renewal/re-key/modification/revocation/suspension Certificate status services –Facility, management and operational controls –Technical Security vcontrols –Certificate profile, CRL, OCSP –Compliance Audit –Business and Legal matters (Fees, financial responsibility, IPR, warranties, liability, …)

17. 17 Content of Trust Matrix Objective : guideline to determine the equivalence between CP’s Scope: –Definition of seven categories of CP’s –PDS requirements and layout CA contact information Certificate type, usage Obligation of users/relying parties –PDS statements profiling towards TSL level

18. 18 Remaining Issues Technical issues : –Central validation services in the model? –Central Time-stamping solution ? Legal Issues : –liability of the BGCA? –Applicable law for the MoU Policy issues : –Form of the Governing Body : European Institution? –Language of documentation –Validity and signature of the MoU’s

19. 19 Conclusions Bridge/Gateway CA Pilot results expected in 3Q2005 –Results of technical implementation and tests –Recommendations for an operational European Bridge/Gateway CA Pending or future actions for an operational European Bridge/Gateway CA –Interpretation of Pilot Results –Agreement on BGCA Governing Body, MoU format and concept of PDS and Trust Matrix –Definition of ownership of BGCA and deployment

20. 20 THANK YOU ! Web:http://www.europa.eu.int/idabchttp://www.europa.eu.int/idabc E-mail:idabc@cec.eu.intidabc@cec.eu.int Address:IDABC Secretariat DG Enterprise/I.5 - SC15 2/50 European Commission B-1049 Brussels, Belgium More Information :