1. Virginia Tech Overview of PKI@Virginia Tech Secure Enterprise Technology Initiatives e-Provisioning Group Frank Galligan frankg@vt.edufrankg@vt.edu Fed/Ed XV PKI Coordination Meeting June 14, 2007

2. Virginia Tech Background Secure Enterprise Technology InitiativesSecure Enterprise Technology Initiatives eProvisioning GroupeProvisioning Group –Technical Support for University PKI Initiatives Sponsorship For PKI InitiativesSponsorship For PKI Initiatives –Vice President for Information Technology –Funding from Executive Vice President Virginia TechVirginia Tech Blacksburg, Virginia - Southwestern VABlacksburg, Virginia - Southwestern VA Research University - Ranking 56 th in USResearch University - Ranking 56 th in US 28,000 Full Time Students - Largest in VA28,000 Full Time Students - Largest in VA 7,000 Faculty and Staff - PKI Target Group7,000 Faculty and Staff - PKI Target Group Corporate Research Center - Location of CCCorporate Research Center - Location of CC

3. VTCA Architecture Virginia Tech User CA Server CA Virginia Tech Root CA SSL Web Server Certificates Middleware Certificates Middleware CA Personal Certificates 4/10/2003 7/23/20049/20/2006 417 Issued105 Issued 444 Issued Subordinate CAs Offline CA Online CA Other CAs As Needed Aladdin eToken

4. Virginia Tech PKI Project Structure Six Projects: A Coordination Challenge Infrastructure Integration Token Administration System Policy Device Selection Documentation and Communication

5. Virginia Tech VTCA Design Methodology Architecture: Hierarchical Model High Assurance Level: FIPS 140-2 Level 3 HSM Standards: PKCS, CryptoAPI, PCSC, X509 v3 Commercial or OpenSource: OpenCA 0.9.x Deployment Model: Phased, Smart Devices Scope: Initially for Internal Use Administration: RA,CA,HSM,SYS,APP CP and CPS Documents: PMA, RFC 2527

6. Virginia Tech VT Personal Digital Certificates Token Administration System - TAS Two Phase Certificate Enrollment Process - Phase I Registration Authority Admin Station Applicant Hokie ID scanned to retrieve LDAP record Applicant provides two photo IDs for validation Applicant creates a password for their eToken - Phase II Certification Authority Admin Station Applicant authenticates using their eToken password TAS generates RSA keys onboard eToken and creates CSR TAS sends CSR to User CA, returned cert stored on eToken Applicant digitally signs VT Usage Agreement TAS automatically sends email with instructions to applicant eToken Password Resets, Certificate Revocation

7. Virginia Tech PKI Integration Virginia Tech Personal Certificate Profile –Encryption Disabled VT PKI Applications –Digitally Signed Leave Reports/Work Flow –VPN Authentication –S/MIME e-Mail, MS Office Word and Excel, Adobe Acrobat –Client SSL Authentication, CAS (Central Authentication Server) Other Digital Signature Applications –Grant Proposals –Travel Vouchers –Various Departmental Forms –Phone Bills

8. Virginia Tech References Virginia Tech Home Page www.vt.edu Virginia Tech PKI www.pki.vt.edu Virginia Tech PDCs www.pki.vt.edu/PDC Virginia Tech Certificate Policy www.pki.vt.edu/rootca/cp Virginia Tech eAladdin eToken News www.aladdin.com/news/2006/etoken/Virginia_Tech.asp Personal Digital Certificates at Virginia Tech – Internet2 Presentation www.internet2.edu/presentations/fall06/20061204-PKIwksp- Dunker.htm www.internet2.edu/presentations/fall06/20061204-PKIwksp- Dunker.htm

9. Virginia Tech Overview of PKI@Virginia Tech Secure Enterprise Technology Initiatives e-Provisioning Group Frank Galligan frankg@vt.edufrankg@vt.edu Fed/Ed XV PKI Coordination Meeting June 14, 2007