PKI Future Directions
29 November 2001
Russ Housley
RSA Laboratories
CS – Class of 1981
Outline
• Background
• Privilege Management
• Certification Status
• Management Protocols
• Legal and Policy
• Applications
2
Digital Signing
• A one-way hash function is used to create a hash
of the data to be signed
• A digital signature is cryptographic
transformation of the hash value and the signer’s
private key
Original
Message
Hash
Hash
Value
Sign
Signature
Value
Originator
Private Key
3
X.509 Certificate Format
VERSION
12345
SERIAL NUMBER
SIGNATURE ALGORITHM
C=US, S=VA, O=RSA Labs
C=US, S=VA, O=RSA Labs
CN=Russell Housley
RSA with SHA-1
ISSUER
VALIDITY
1/1/01 - 1/1/02
SUBJECT
SUBJECT PUBLIC
KEY INFO
ACBDEFGH
v1 or v2 or v3
RSA, 48...321
ISSUER UNIQUE ID
SUBJECT UNIQUE ID
RSTUVWXY
EXTENSIONS
SIGNATURE
4
X.509 CRL Format
v1 or v2
VERSION
SIGNATURE ALGORITHM
C=US, S=VA, O=RSA Labs
ISSUER
LAST UPDATE
12/2/01
RSA with SHA-1
11/25/01
NEXT UPDATE
REVOKED
CERTIFICATES
CRL EXTENSIONS
SIGNATURE
SEQUENCE OF
SERIAL NUMBER
9/27/01
12345
REVOCATION DATE
CRL ENTRY EXTENSIONS
5
Privilege Management
• Extensions allow arbitrary information to be
bound to the subject identity
• Should only include an attribute in the identity
certificate if it meets two criteria
– The CA is authoritative for the attribute
– The expected lifetime of the attribute will not increase
the likelihood of revocation
• When these criteria cannot be met, then an
attribute certificate should be used instead
6
Attribute Certificate
VERSION
C=US, S=VA, O=RSA Labs
HOLDER
C=US, S=VA,O=RSA Labs, OU=IT
ISSUER
SIGNATURE ALGORITHM
123456789
v1 or v2
RSA with SHA-1
SERIAL NUMBER
VALIDITY
11/29/01 - 11/30/01
ATTRIBUTES
ISSUER UNIQUE ID
EXTENSIONS
SIGNATURE
SEQUENCE OF
ATTRIBUTE TYPE
Administrator
{ 2 5 4 72 } (role)
SET OF
ATTRIBUTE VALUES
7
Linking Identity Certificates
and Attribute Certificates
• The attribute certificate holder field is a pointer to
an identity certificate
• Two techniques:
– Matching subject –
Links to any identity certificate for that subject
– Matching issuer / serial number pair –
Links to a particular certificate
8
Certificate Status
• Certificate Revocation Lists (CRLs)
– Delta CRLs
– Sliding Window Delta CRLs
– Indirect CRLs
• Online Certificate Status Protocol (OCSP)
– RFC 2560
– Client must build certification path
– Irrevocable trust in OCSP responder
• Delegated Path Validation
– Simple Certificate Validation Protocol (SCVP)
• draft-ietf-pkix-scvp-06, July 2001
– Server builds path and validates it for the client
– Irrevocable trust in SCVP responder
9
Sliding Window Delta CRLs
Full CRL
Number
22
23
24
25
26
27
28
29
30
31
32
33
Delta CRL
Since
13
14
15
16
17
18
19
20
21
22
23
24
8AM
4AM
4PM
Noon
Monday
Midnight
8PM
4AM
8AM
4PM
Noon
Midnight
8PM
Tuesday
In this example, one can fetch the smaller Delta
CRL if the cache is current within 36 hours.
10
Indirect CRLs
Hierarchical PKI
In this example, one
can validate the Indirect
CRL once, caching
information about all of
the CAs in the
hierarchy.
Each certificate issued
to a CA contains a CRL
Distribution Points
extension that points to
the Indirect CRL.
11
OCSP Response
VERSION
C=US, O=RSA, CN=OCSP1
id-MD5, A5CF3378E4BB0012,
ED3556A790CC34FF, 2560
RESPONDER ID
PRODUCED AT
Good
THIS UPDATE
NEXT UPDATE
http://pki.rsa.com/20011129.crl
20011129094500Z
CERTIFICATE ID
CERTIFICATE STATUS
20011129080000Z
v1
20011130080000Z
SINGLE EXTENSIONS
RESPONSE EXTENSIONS
Nonce = 48
SIGNATURE
12
SCVP Architecture
OCSP
Responder
Certificate
Client
Yes / No
SCVP
Responder
X.500
Directory
LDAP
Directory
Other …
13
Management Protocols
• Too many choices …
–
–
–
–
–
PKCS #10 [RFC 2314]
Certificate Request Message Format [RFC 2511]
Certificate Management Protocol (CMP) [RFC 2510]
Certificate Management using CMS (CMC) [RFC 2797]
Simple Certificate Enrollment Protocol (SCEP) [Cisco]
• Need simple, straightforward enrollment
– Enable your grandparents to get a certificate and send
digitally signed electronic mail …
• Yet, allow face-to-face registration for high-value
electronic commerce
– Qualified Certificates [RFC 3039]
14
Legal and Policy
• Electronic Signatures in Global and National
Commerce Act (E-Sign)
• Health Insurance Portability and Accountability
Act (HIPAA)
• Government Paperwork Elimination Act (GPEA)
• European Directive 1999/93/EC
– Qualified certificates required
• American Bar Association is updating RFC 2527
– Certificate Policy and Certification Practices Framework
15
Applications
• Signed documents
– ETSI Electronic Signature Format [RFC 3126]
– Electronic signature policies [RFC 3125]
– XML Digital Signatures [RFC 3075]
• Time stamping servers
– Time-Stamp Protocol (TSP) [RFC 3161]
• Wireless Applications Protocol (WAP)
native cell
phone security
services
handset
clear http
or https
gateway
Web
Server
16
For More Information
Russ Housley
rhousley@rsasecurity.com
+1 703 435 1775
www.rsasecurity.com/rsalabs
17