PKI Future Directions 29 November 2001 Russ Housley

PKI Future Directions 29 November 2001 Russ Housley RSA Laboratories CS – Class of 1981

Outline • Background • Privilege Management • Certification Status • Management Protocols • Legal and Policy • Applications 2

Digital Signing • A one-way hash function is used to create a hash of the data to be signed • A digital signature is cryptographic transformation of the hash value and the signer’s private key Original Message Hash Value Signature Value Originator Private Key 3

X. 509 Certificate Format VERSION 12345 SERIAL NUMBER SIGNATURE ALGORITHM C=US, S=VA, O=RSA Labs CN=Russell Housley ACBDEFGH v 1 or v 2 or v 3 RSA with SHA-1 ISSUER VALIDITY 1/1/01 - 1/1/02 SUBJECT PUBLIC KEY INFO RSA, 48. . . 321 ISSUER UNIQUE ID SUBJECT UNIQUE ID RSTUVWXY EXTENSIONS SIGNATURE 4

X. 509 CRL Format v 1 or v 2 VERSION SIGNATURE ALGORITHM C=US, S=VA, O=RSA Labs ISSUER LAST UPDATE 12/2/01 RSA with SHA-1 11/25/01 NEXT UPDATE REVOKED CERTIFICATES CRL EXTENSIONS SIGNATURE SEQUENCE OF SERIAL NUMBER 9/27/01 12345 REVOCATION DATE CRL ENTRY EXTENSIONS 5

Privilege Management • Extensions allow arbitrary information to be bound to the subject identity • Should only include an attribute in the identity certificate if it meets two criteria – The CA is authoritative for the attribute – The expected lifetime of the attribute will not increase the likelihood of revocation • When these criteria cannot be met, then an attribute certificate should be used instead 6

Attribute Certificate VERSION C=US, S=VA, O=RSA Labs HOLDER C=US, S=VA, O=RSA Labs, OU=IT ISSUER SIGNATURE ALGORITHM 123456789 v 1 or v 2 RSA with SHA-1 SERIAL NUMBER VALIDITY 11/29/01 - 11/30/01 ATTRIBUTES ISSUER UNIQUE ID EXTENSIONS SIGNATURE SEQUENCE OF ATTRIBUTE TYPE Administrator { 2 5 4 72 } (role) SET OF ATTRIBUTE VALUES 7

Linking Identity Certificates and Attribute Certificates • The attribute certificate holder field is a pointer to an identity certificate • Two techniques: – Matching subject – Links to any identity certificate for that subject – Matching issuer / serial number pair – Links to a particular certificate 8

Certificate Status • Certificate Revocation Lists (CRLs) – Delta CRLs – Sliding Window Delta CRLs – Indirect CRLs • Online Certificate Status Protocol (OCSP) – RFC 2560 – Client must build certification path – Irrevocable trust in OCSP responder • Delegated Path Validation – Simple Certificate Validation Protocol (SCVP) • draft-ietf-pkix-scvp-06, July 2001 – Server builds path and validates it for the client – Irrevocable trust in SCVP responder 9

Sliding Window Delta CRLs In this example, one can fetch the smaller Delta CRL if the cache is current within 36 hours. 10

Indirect CRLs Hierarchical PKI In this example, one can validate the Indirect CRL once, caching information about all of the CAs in the hierarchy. Each certificate issued to a CA contains a CRL Distribution Points extension that points to the Indirect CRL. 11

OCSP Response VERSION C=US, O=RSA, CN=OCSP 1 id-MD 5, A 5 CF 3378 E 4 BB 0012, ED 3556 A 790 CC 34 FF, 2560 RESPONDER ID PRODUCED AT Good THIS UPDATE NEXT UPDATE http: //pki. rsa. com/20011129. crl 20011129094500 Z CERTIFICATE ID CERTIFICATE STATUS 20011129080000 Z v 1 20011130080000 Z SINGLE EXTENSIONS RESPONSE EXTENSIONS Nonce = 48 SIGNATURE 12

SCVP Architecture OCSP Responder Certificate Client Yes / No SCVP Responder X. 500 Directory LDAP Directory Other … 13

Management Protocols • Too many choices … – – – PKCS #10 [RFC 2314] Certificate Request Message Format [RFC 2511] Certificate Management Protocol (CMP) [RFC 2510] Certificate Management using CMS (CMC) [RFC 2797] Simple Certificate Enrollment Protocol (SCEP) [Cisco] • Need simple, straightforward enrollment – Enable your grandparents to get a certificate and send digitally signed electronic mail … • Yet, allow face-to-face registration for high-value electronic commerce – Qualified Certificates [RFC 3039] 14

Legal and Policy • Electronic Signatures in Global and National Commerce Act (E-Sign) • Health Insurance Portability and Accountability Act (HIPAA) • Government Paperwork Elimination Act (GPEA) • European Directive 1999/93/EC – Qualified certificates required • American Bar Association is updating RFC 2527 – Certificate Policy and Certification Practices Framework 15

Applications • Signed documents – ETSI Electronic Signature Format [RFC 3126] – Electronic signature policies [RFC 3125] – XML Digital Signatures [RFC 3075] • Time stamping servers – Time-Stamp Protocol (TSP) [RFC 3161] • Wireless Applications Protocol (WAP) 16

For More Information Russ Housley rhousley@rsasecurity. com +1 703 435 1775 www. rsasecurity. com/rsalabs 17