Challenge PKI 2002 IETF PKI

Size: px

Start display at page:

Download "Challenge PKI 2002 IETF PKI"

みそらしんまつ
5 years ago
Views:

1 Challenge PKI 2002 IETF PKI

10 PKIX-WG RFC 337: DPD(Delegated Path Discovery)/DPV(Delegated Path Verification) EE 56 th IETF PKIX-WGSCVP Proxy Certificate / Qualified Certificate? PKI TAP OASIS/W3C/EESSI/JNSA Copyright (c) 2003 NPO Page 10

13 56 th IETF PKIX-WG : 76 Chairs: Stephen Kent(BBN), Tim Polk(NIST) 19 Internet-Drafts(I-Ds) Last Call SCVP, Proxy Cert Expire Draft Area Director Repository Locator Service Copyright (c) 2003 NPO Page 13

15 Agenda DPD/DPV standard selection process SCVP Discussion Proxy Certificates Signature Algorithms & Key Usage Trusted Archive Protocol Qualified Certificates Profile LDAP/X.500 alignment Subject Identification Method EESSI JNSA ChallengePKI 2002 LDAP PKI Issues Liaison Copyright (c) 2003 NPO Page 15

22 Trusted Archive Protocol Carl Wallace (Cygnacom) ( ) Data Validation: Evidence verification Path Processing: Evidence Collection TSP message CMS DVCS? WG Draft MLTAP DVCS Peter Sylvester PKIXEXT PKIXAPPS WG Copyright (c) 2003 NPO Page 22

38 Multi Domain PKI Test Suite -- Result of JNSA Challenge PKI Ryu Inada As representative of NPO Japan Network Security Association Sponsored by IT Promotion Agency, Japan

39 JNSA Challenge PKI 2002 As we reported on 11-Nov-2002/56 th IETF, we, JNSA, make a Multi Domain PKI Test Suite. We finished work at 28-Feb-2003, and prepare to open it public and translation to English. Estimated date of open to public: End of June 2003 Estimated date of translation to English : End of June Mar th IETF PKIX-WG 2

40 20-Mar th IETF PKIX-WG 3

41 PKI interoperability test suite 20-Mar th IETF PKIX-WG 4

42 Challenge PKI Test Cases 20-Mar th IETF PKIX-WG 5

43 Sample implementations In Java Worked on JDK 1.4 Based on Path Discovery/Path Validation API which provided from reference implementation. And additional Path Discovery/Path Validation logic which concerned multi domain PKI environment. In C++ Worked on Microsoft Crypto API. Using Windows original Revocation Service Provider and additional Path Discovery/Path Validation logic which concerned multi domain PKI environment. 20-Mar th IETF PKIX-WG 6

44 Requirement of GPKI and implementations Requirement Impl. of GPKI *1 CRL IDP ( issuing distribution point ) 20-Mar th IETF PKIX-WG 7

45 Sample implementation for 20-Mar th IETF PKIX-WG 8

46 Sample implementation for JAVA GPKICertPathBuilderSpi GPKICertPathChecker GPKICertPathValidatorSpi java.security.cert.* We extend original JDK s path builder/path checker interface. 20-Mar th IETF PKIX-WG 9

47 To achieve more Applicable Test Suite... Provide Framework more applicable & reusable Easy to extract minimal test case There are too many test cases about 256 cases. For easily modified to you purpose: PKIX, GPKI, and other frameworks Ready for Multi-domain PKI Re-usable for others No depend on environment Run on your local environment maybe linux or cygwin? We need two Reference!! Define multi-domain PKI PKI Define DB DB Schema to to re-use 20-Mar th IETF PKIX-WG 10

48 Related Links NPO JNSA IPA Security Center JNSA Challenge PKI Implementation Problems on PKI ( JNSA Challenge PKI 2001 ) nge2001.html The report of Challenge PKI in IETF Atlanta 20-Mar th IETF PKIX-WG 11

49 Demonstration 20-Mar th IETF PKIX-WG 12

untitled

untitled better RFID 1 /?? PKI PKI ) (GPKI) GtoB GPKI 3300- LGPKI GtoC -> Identrus B2B GPKI Identrus PKI 2 Internet-VPN PKI? HTTPS ( ) HTTPS 3 PKI??????? PDA/ /? RFIDPKI?? 4 Challenge