6Th Annual PKI R&D Workshop Applications-Driven
Total Page：16
File Type：pdf, Size：1020Kb
NISTIR 7427 ISBN 1-886843-60-0 6th Annual PKI R&D Workshop “Applications-Driven PKI” Proceedings William T. Polk Kent Seamons NISTIR 7427 ISBN 1-886843-60-0 th 6 Annual PKI R&D Workshop “Applications-Driven PKI” Proceedings William T. Polk Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Kent Seamons Brigham Young University September 2007 U.S. DEPARTMENT OF COMMERCE Carlos M. Gutierrez, Secretary NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY James M. Turner, Acting Director Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. 6th Annual PKI R&D Workshop - Proceedings Foreward NIST hosted the sixth annual Public Key Infrastructure (PKI) Research & Development Workshop on April 17-19, 2007. The two and a half day event brought together computer security experts from academia, industry, and government to share progress, and explore challenges, in PKI and related technologies. In addition to the nine refereed papers, this proceedings captures the essence of the workshop activities including the keynote addresses, invited talks, panels, a birds-of-a-feather session and the popular informal rump session. Continuing a trend from previous years, the workshop addressed an increasingly broad range of topics beyond PKI. The theory and practice of identity management took center stage for much of the workshop. In keeping with this year’s theme, “Applications Driven PKI”, practical applications were the focus of many presentations as well. And as always, several presentations describing innovations in infrastructure design prompted spirited discussions. The identity management theme was evident throughout the workshop, beginning with the opening keynote presentation. Carl Ellison presented on behalf of Microsoft’s Identity and Access Architect, Kim Cameron. Cameron’s seven Laws of Identity provided an excellent foundation for several subsequent presentations. Carl’s presentation was immediately followed by a panel on identity management systems, with a lively exploration of their commonalities and differences. The second keynote, by Ken Klingenstein, explored an “attribute ecosystem” where the academic community’s Shibboleth project might play a central role. A later panel discussion explored the lessons learned in identity systems that leverage both the Security Association Markup Language (SAML) and PKI. Applications, both deployed and in development, were also a common theme. Projects from the European Union and Argonne National Laboratories were the subject of refereed paper presentations. A panel from the mortgage industry describing PKI-based mortgage applications generated extensive discussions with its intersection of signature technologies and the legal implications. A Federal Government panel presented applications from the Treasury Department, Food and Drug Administration, and the Drug Enforcement Administration. Two presentations explored the intersection between applications and identity management. Yet another Federal Government panel explored the deployment of a PKI-based identity management credential, the Personal Identity Verification (PIV) Card, and the opportunities and challenges this project presents for application developers. The rump session featured a complementary presentation on PKI in Radio Frequency Identification (RFID) passports. PKI is applied to these identity credentials in entirely different ways, yet share the overall goal of identifying a credential holder. iii 6th Annual PKI R&D Workshop - Proceedings New approaches to infrastructure design were also presented in the workshop. Three presentations addressed PKI for Grids, including two presentations from the United Kingdom. Other presentations included “one time private keys,” a “temporal key release infrastructure,” and a system for delegating client authenticated web access through proxy certificates. These schemes strive to establish PKI-based analogs to common practices in other arenas, such as sealed bids at auctions or password-sharing for privilege delegation. In all, the workshop included the presentation of two invited keynote presentations, nine referred papers, five panel discussions, a rump session, and a birds-of-a-feather session. Once again, the workshop was an international event with 125 attendees representing a cross-section of the global PKI community, with presenters from the USA, United Kingdom, Israel, Singapore, Brazil, and Canada. Due to the success of this event, a seventh workshop is planned for March 4-6, 2008. Given the broad interest in identity management techniques regardless of the underlying technology, next year’s workshop will be renamed to reflect the de facto shift in focus. William T. Polk National Institute of Standards and Technology Gaithersburg, MD USA iv 6th Annual PKI R&D Workshop - Proceedings 2007 PKI R&D Workshop Applications-Driven PKI Gaithersburg, Maryland USA April 17-19, 2007 http://middleware.internet2.edu/pki07/ (Pre-proceedings were distributed at the workshop) WORKSHOP SUMMARY 1 Provided by Ben Chinowsky, Internet2 REFEREED PAPERS The OASIS Digital Signing Service and its Application to E-Invoicing in Europe 13 Nick Pope Thales e-Security, UK Juan Carlos Cruellas Universitat Politècnica de Catalunya, Spain The Directory-Enabled PKI Appliance: Digital Signatures Made Simple, Approach and Real World Experience 24 Uri Resnitzky Algorithmic Research (ARX) A New Paradigm in PKI Architecture: OTPK Technology for Online Digital Signature 37 Tan Teik Guan Data Security Systems Solutions Ptd Zvi Efroni Ltd Universal Certificate Authentication to Key Applications at Argonne National Laboratory 47 Doug Engert Argonne National Laboratory Rich Raffenetti David Salbego John Volmer Temporal Key Release Infrastructure 62 Ricardo Felipe Custódio Universidade Federal de Santa Júlio da Silva Dias Catarina-UFSC Fernando Carlos Pereira Adriana Elissa Notoya Limited Delegation for Client-Side SSL 76 Nicholas Santos Dartmouth College Sean W. Smith A Scalable PKI for a National Grid Service 91 Jens Jensen Rutherford Appleton Laboratory David Spence Matthew Viljoen v 6th Annual PKI R&D Workshop - Proceedings A Certificate-Free Grid Security Infrastructure Supporting Password-Based User Authentication 103 Jason Crampton Royal Holloway, University of London Hoon Wei Lim Kenneth G. Paterson Geraint Price Enabling the Provisioning and Management of a Federated Grid Trust Fabric 119 Stephen Langella Ohio State University Scott Oster Ohio State University Shannon Hastings Ohio State University Frank Siebenlist Argonne National Laboratory Tashin Kruc Ohio State University Joel Saltz Ohio State University LIST OF ACRONYMS 133 vi 6th Annual PKI R&D Workshop - Proceedings Organizers General Chair: Ken Klingenstein, University of Colorado Program Chair: Kent Seamons, Brigham Young University Steering Committee Chair: Neal McBurnett, Internet2 Local Arrangements Chair: Tim Polk / Sara Caswell, NIST Scribe: Ben Chinowsky, Internet2 Program Committee Kent Seamons, Brigham Young Univ. (chair) Eric Norman, University of Wisconsin Peter Alterman, National Institutes of Health Tim Polk, NIST Bill Burr, NIST Scott Rea, Dartmouth College David Chadwick, University of Kent John Sabo, Computer Associates Joe Cohen, Forum Systems Ravi Sandhu, GMU and TriCipher Carl Ellison, Microsoft Krishna Sankar, Cisco Systems Stephen Farrell, Trinity College Dublin Stefan Santesson, Microsoft Richard Guida, Johnson & Johnson Frank Siebenlist, Argonne Nat’l Laboratory Peter Gutmann, University of Auckland Sean Smith, Dartmouth College Russ Housley, Vigil Security, LLC Von Welch, NCSA Neal McBurnett, Internet2 Stephen Whitlock, Boeing Clifford Neuman, USC-ISI Michael Wiener, Cryptographic Clarity Archival Sites PKI 2006: http://middleware.internet2.edu/pki06 PKI 2005: http://middleware.internet2.edu/pki05 PKI 2004: http://middleware.internet2.edu/pki04 PKI 2003: http://middleware.internet2.edu/pki03 PKI 2002: http://www.cs.dartmouth.edu/~pki02 vii 6th Annual PKI R&D Workshop - Proceedings This page has been left intentionally blank. viii 6th Annual PKI R&D Workshop - Proceedings 6th Annual PKI R&D Workshop Summary http://middleware.internet2.edu/pki07/proceedings/workshop_summary.html Ben Chinowsky, Internet2 Note: this summary is organized topically rather than chronologically. See http://middleware.internet2.edu/pki07/proceedings/ for the workshop program, with links to papers and presentations. The workshop looked at three aspects of its main theme of "applications-driven PKI": I. Identity systems and federations II. Current or imminent applications III. Advanced approaches to infrastructure There were also some additional talks not directly related to the workshop theme. I. Identity systems and federations There is a surge of interest in an "identity layer for the Internet", and a change in how identity is conceived in many quarters. The old joke goes that on the Internet no one knows you're a dog; identity is about giving you control over who -- if anyone -- gets to know that you're a dog, and if so, what kind of dog you are. This notion of identity as attributes, instead of identity as identifier, is gaining momentum for both privacy