Notes from the 1st PKI Coordination Meeting

December 6, 2000, TERENA Offices, Amsterdam

Yuri Demchenko
John Dyer
 

Agenda
1. Opening
2. Round table introduction
3. Agenda bashing
4. European NRENs projects overview
4.1. SURFnet PKI/CA - Ton Verschuren
4.2. DFN - Ingmar Camphausen
4.3. RedIRIS - Diego Lopez
4.4. JISC - Alan Robiette
5. European activity/projects Overview
5.1. PKI/CA services - EuroPKI - Antonio
6. Internet2 PKI Initiative - Brian Gilmore
7. Technical issues in PKI deployment - David Chadwick
8. Discussion of the PKI-COORD Coordination and Technical Agenda
9. Follow-on activity
10. Next meeting
11. Action List
Appendix. List of attendees


1. Opening

Brian Gilmore, the meeting chairman welcomed participants and expressed his hope that the meeting would be able to identify ways in which PKI in the European Academic Community could be coordinated.
 

2. Introductions

21 delegates attended the meeting from 11 countries. A list of those attending is appended to these minutes.
 

3. Agenda bashing

It was agreed that the major discussion of the issues that arise should take place in agenda items 8 and 9 and that the meeting should try and identify clear objectives for future deliverables, timelines and associated contributors.
 

4. European NRENs projects overview

4.1. SURFnet PKI/CA - Ton Verschuren

SURFnet's X.509 PKI service, has been running as a Root CA since January 1, 2000, however this is not an end-user oriented service but certifies institutional CAs. During 2000 the SURFnet CA (which is audited by TTP.NL) issued certificates for a few universities and the SURFnet Offices. The Xcert licenses that SURFnet issues are certificates which are valid for 12 months for 2500 USD (which includes a crypto device) and brings with it the authority for each CA to issue up to 100 certificates themselves. SURFnet has a policy that organisations can issue up to 100 certificates on SURFnet's hosting platform; but for larger numbers of certificates the organisations will have to move to a platform of their own. Ton went on to mention that SURFnet is attempting to stimulate uptake of certificates and CA services amongst the SURFnet community by providing information via their website and through the distribution of a SURFkit CDROM. This contains a version of the Netscape client pre-configured with PCA and CA certificates. SURFnet also have a cookbook of related information, which is currently being translated from Dutch to English.

Ton suggests that SURFnet future development may include the extension of services for client authentication with SSL based applications, implementing PKI smart card, and integration with LDAP but its unlikely that they will adopt the use of Qualified Certificates. SURFnet doesn't expect use of QCs in the near future. The main difficulty is establishing a legal entity that must check personal identity. Currently there is no urgent/strong need amongst the SURFnet community in the legal binding of certificates. Ton's presentation is available from http://www.terena.nl/projects/pki/docs/ton.verschuren.SURFnetPKI.ppt. More information on the SURFnet PKI work can be found at http://pki.surfnet.nl/ (mainly Dutch) and https://creche.wind.surfnet.nl/office-ca/ (English). Although the current version of the CPS is in Dutch the next will be in English. SURFnet have been evaluating tender for the provision of PKI technology-oriented trial targeted for possible implementation in Higher Education.
 

4.2. DFN PCA - Ingmar Camphausen

The DFN PCA was established in 1996 to serve the German Research community. It is being moved to be part of the DFN CERT which itself has recently been established as a separate non-profit company. The DFN PCA initially had services for PEM (X.509v2) and X.509v3 (basically SSL certificates) but abandoned PEM, due to lack of usage. The DFN PCA infrastructure consists of more than 30 PGP CAs and 20 SSL CAs under a Root CA which itself has two subordinate CAs: one for user PGP keys and one for server certificates. DFN PCA provides free service for universities who don't want to run their own CA. However not many certificates were issued last year.

DFN believes that the availability of good documentation is essential for the expansion of a pervasive PKI infrastructure and to provide some support, DFN PCA has developed a handbook showing how to install and run a subordinate CA on Apache servers. Development is being carried out in context of the forthcoming German Digital signature legislation and the decision of the German Government on the deployment of a secure communication infrastructure between Federal Ministries which is being created in the frame of SPHINX project run by BSI, the German Federal
Office for Security in Information technology. DFN PCA runs special project on Integration of DFN PKI and SPHINX. DFN PCA cooperates with the DFN directory project to utilise LDAP for publishing Certificates. Ingmar mentioned that DFN has PGP cross-certification with SURFnet and the UK Academic community. Whilst their CP is in German it is intended to have an English translation available soon.
 

4.3. IRIS-PCA - Diego Lopez

The RedIRIS PCA (IRIS-PCA) was officially established in November 2000 and already has a heavy load with around 6000-7000 users. Their current implementation is X.500 based but unfortunately encounters naming problems when accessing certificates from either the DNS based DC-tree or from the X.521 naming tree. This problem appears particularly in the case of e-mail where individual names are used, a problem similarly found in the United States. The problem is further complicated by the inclusion of national character-sets, but that particular issue is being addressed by the Internationalized DNS Working Group at IETF and by Network Solutions.

The current policy document (which is not fully RFC 2527 compliant) is in Spanish and can be found at: http://www.rediris.es/cert/iris-pca/docs/politica.html. RedIRIS has the intention of making available a new version which will be fully RFC2527-compliant, including an English translation however, Spanish version will always be the authoritative reference.

Diego described PAPI, is a public-key based project to provide ubiquitous and transparent access to information resources much like Internet2's Shibboleth. PAPI is at the stage of functional prototype and currently used for authorization of access to Library resources for students (http://www.rediris.es/app/papi/). Diego invited meeting attendees to test the system if they wished by contacting him for information on how to do this.

An affiliate to RedIRIS (the University of Murcia) has also developed some PKCS#11 Library modules, which RedIRIS plan to put into public domain under GPL, but this intention is slightly delayed whilst formal permission is obtained from the institutions that funded the project together with the University.

The PKI use in Spanish Academic Network presentation is available from the URL: http://www.terena.nl/projects/pki/docs/diego.lopez.pki-coord-iris.ppt
 

4.4. PKI Development in the UK Academic community - Alan Robiette

Alan described the status of PKI deployment in the United Kingdom. The UK Academic community doesn't currently have a Public Key Infrastructure, but will be discussing an action plan sometime during 2001. UK Universities currently have a nationwide Access management system known as Athens that relies on a central name space and will not scale well. More information on Athens can be found at http://www.athens.ac.uk/).

The UK academic funding body (the JISC) is funding two PKI pilot projects, one focused on mobility and the other looking at secure access to patients information. Alan said that the overall goal of PKI implementation in the UK Academic Community is to enable all Educational institutions to exchange and handle electronic documents and may involve work from European Qualified Certificate Initiative.

On a practical note, Alan said that national PKI deployment might run into problems in small institutions where insufficient technical support effort exists. There is also a lack of clarity on UK Government PKI policy and the existence of multiple certificate infrastructures may develop for separate but similar purposes.
 

5. European activity/projects Overview

5.1. PKI/CA services - EuroPKI - Antonio Lioy

Antonio Lioy made a presentation about the current status of EuroPKI project. Slides can found on the TERENA web site at: (http://www.terena.nl/projects/pki/docs/antonio.lioy.EuroPKI.ppt). The EuroPKI Top Level Certification Authority (http://www.europki.org/ca/root/en_index.html) was established as result of the European Commission funded ICE-TEL/ICE-CAR projects (http://ice-car.darmstadt.gmd.de/). Although the ICE-CAR project finishes on December 31, 2000, EuroPKI will continue the work partially funded by Torino University and some Italian banks that are interested in continuing the service.

The EuroPKI structure is hierarchical and provides a Root CA, currently with one level of trust, but no cross-certification is available. Antonio said that the EuroPKI team doesn't expect the appearance of more than about 20 CAs in Europe during the next couple of years.

EuroPKI would like to see the one global Certificate Policy complying with RFC 2527 and multiple (local) Certification Practice Statements (CPS). The Certificate Policy should be:

Other elements of the Certification Policy requirements that need to be addressed are the incorporation of: personal identification of the subject (e.g., personal ID or separate IP-address), secure management of CA and the periodic publication of CRL. Antonio said that since there are differences in legislation and practice between the various European countries (particularly regarding personal identification), it seems logical to have more than one level of trust if we want to establish European PKI service. The particular issue of the UK legislation where personal ID cards are not required means that the EuroPKI CP had to be written in such a way as to avoid terms such "national ID" or "photo ID". The EuroPKI Certification Policy, Version 1.1 (Draft 4) can be found on the web http://www.europki.org/ca/root/cps/en_index.html. Attendees are invited to review the draft and send in comments.

Future development of the EuroPKI system will be the implementation of time stamping which could be used as the basis on which time-sensitive interactions, such as financial or examination submissions could be validated. Initiatives such as Common Data Security Architecture (CDSA) - http://developer.intel.com/ial/security/ and Trusted Computing Platform Alliance (TPCA) - http://www.trustedpc.org/) are of relevance in this respect.

Antonio also explained a method of securing a CA using duplicate hardware with periodic backups of CRLs.

It was agreed by the meeting that EuroPKI could provide a good basis on which to develop common ground and best practice for European NRENs.
 

6. Internet2 PKI Initiative

Brian Gilmore and Alan Robiette who had both attended the Oct 2000 Internet2 meeting provided a short verbal report on Internet2 PKI related activity. They reported that the PKI activity in Internet2 is coordinated by Higher Education PKI (HEPKI) Activity Groups with functional responsibility divided as follows:

The work of these groups is a cooperative effort between Internet2, CREN and EDUCAUSE/Net@EDU. It was stated that Internet2 has established two PKI Labs that will focus on: interoperability, manageability, trust, delegation models, scaling and human factors. More information can be found at the following web site (http://middleware.internet2.edu/pkilabs/). The PKI labs are supported by Internet2, AT&T Labs, and are provided with guidance from a national advisory board of leaders in PKI development and deployment.

Internet2 is involved in the development of the "eduPerson Object Class" for deployment of US wide Directory for Higher Education (DoDHE) based on LDAP. More information on this issue can be found at http://www.educause.edu/eduperson/. It was noted that Ton Verschuren of SURFnet has established contact with Ken Klingenstein from Internet2 regarding the eduPerson development.
 

7. PKI Deployment Technical Issues - David Chadwick

David Chadwick discussed some of the technical issues of certificate management and exchange that have the potential to cause interoperability problems. He reported that CRL compatibility was a big issue and he had discovered that in one case a browser from one vendor had not been able to view a CRL from the same vendor.

David went on to explain that even in using LDAP as a storage mechanism there are problems, as the lack of "matching rules" means that it is not possible to retrieve a particular CRL or certificate. Solutions are being developed in the IETF and may be found in the following documents :

Another issue that David discussed is the need to develop a mechanism for handling digital authentication within the PKI framework. He said that in particular there is a need to agree on a standard protocol during the initial authentication and certification of the user. There are currently 2 competing alternatives, CMP and CMS. David went on to point out that there is no common agreement on where best to store private keys and certificates. David concluded his presentation by offering access to some PKI test objects for those who wanted to under take some experiments. Contact him direct for details.
 
 

8. An Agenda for Future PKI Technical Development and Coordination in TERENA

The meeting focused on the following issues:

All present were invited to report on relevant projects in their respective countries.

Janne Kanner of FUNET reported that they have been piloting PKI. Additionally, the Finnish government has been running a PKI for citizens for about a year. It is the intention that the academic PKI will be as compatible as possible with the governmental one to enable access to all the PKI-enabled services in Finland The Finnish legislative position is that all institutions must honor personal certificates. Janne demonstrated a smart card that operates with a four-digit PIN card allowing three incorrect entries before becoming automatically blocked and requiring police intervention to remove the block. He went on to report that there was no root CA in Finland but three large commercial CA's are in business. The approximate cost of a smartcard with a certificate for the governmental PKI is about 25 Euros and it is thought these might be available for purchase to organisations outside the country boundaries. Finally he reported that there is an initiative to investigate storing certificates on mobile phone SIM cards.

As most certification policy documents are huge (running into hundreds of pages) building cross-certifications and webs of trust and harmonization is not a trivial matter. David Chadwick mentioned that he is working on an Expert System that will allow computation of trust levels based on the analysis of the CPs.

It was noted that PKI has not found wide use in Internet applications yet and still needs to find a niche in which PKI is the essential solution. It was generally agreed by meeting attendees that the community is not yet ready to establish a European wide PKI entity itself, but should keep up strong collaborative links with EuroPKI.

The meeting agreed to establish small groups of NRENs representatives to draft a position statement and regarding EuroPKI with TERENA acting as a neutral coordinator.
 

9. Follow-on activities

A further meeting on PKI will be held at the appropriate time.
 

10. Next meeting

The meeting agreed that the day had been useful and a further meeting should be held when the need for PKI development becomes more mature. TERENA will monitor the situation and inform the meeting attendees via a pki-coord email list.

11. Action list

Action 0-1-1. TERENA to establish a small group of NRENs representatives to draft a Statement about EuroPKI.

Action 0-1-2. TERENA to establish a web area covering European PKI Coordination.

Action 0-1-3. TERENA to publish a Summary of the Questionnaire about PKI/CA related services/projects for Research and Education Community in Europe on the web.

Action 0-1-4. TERENA to initiate further discussion about cooperation and coordination in PKI deployment in European Academic and Research community.

Action 0-1-5. TERENA to organize a further PKI meeting at the appropriate time and announce via the PKI-COORD mailing list.
 
 

Appendix to Notes from the 1st PKI Coordination Meeting

List of attendees
1st PKI Coordination Meeting

6 December 2000
 
1. Milan Sova Czech Republic, CESNET
2. Janne Kanner Finland, FUNET
3. Ingmar Camphausen Germany, DFN
4. Peter Gietz Germany, DFN
5. Giles Massen Luxembourg, RESTENA
6. Ton Verschuren Netherlands, SURFnet
7. Janus Liebregts Netherlands, SURFnet
8. Alf Hansen Norway, UNINETT
9. Diego R. Lopez Spain, RedIRIS-CSIC
10. Francisco Monserrat Spain, RedIRIS-CSIC
11. Torbjorn Wiberg Sweden, SUNET
12. Alan Robiette United Kingdom, UKERNA
13. Konstantin Chuguev DANTE
14. Antonio Lioy EuroPKI
15. Panagiotis Saragiotis Greece, GR-NET
16. Thomas Lenggenhager Switzerland, SWITCH
17. Brian Gilmore TERENA Executive Committee
18. David Chadwick TERENA Technical Committee
19. Karel Vietsch TERENA
20. John Dyer TERENA
21. Yuri Demchenko TERENA