FusionGrid CA

Certificate Policy

And

Certification Practice Statement

Version 1.0a

December 6, 2004

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

1 Introduction [4](#introduction)

1.1 Overview [4](#overview)

1.1.1 General Definitions [4](#general-definitions)

1.2 Community and Applicability [5](#community-and-applicability)

1.2.1 Certification Authorities [5](#certification-authorities)

1.2.2 Registration Authorities [5](#registration-authorities)

1.2.3 FusionGrid Credential Service [6](#fusiongrid-credential-service)

1.2.4 End Entities [6](#end-entities)

1.2.5 Applicability [6](#applicability)

1.3 Contact Details [6](#contact-details)

2 General Provisions [6](#general-provisions)

2.1 Obligations [6](#obligations)

2.1.1 CA and RA Obligations [6](#ca-and-ra-obligations)

2.1.2 Subscriber Obligations [7](#subscriber-obligations)

2.1.3 FusionGrid Credential Service Obligations
[7](#fusiongrid-credential-service-obligations)

2.1.4 Relying Party Obligations [8](#relying-party-obligations)

2.1.5 Repository Obligations [8](#repository-obligations)

2.2 Liability [8](#liability)

2.3 Financial Responsibility [8](#financial-responsibility)

2.4 Interpretation and Enforcement [8](#interpretation-and-enforcement)

2.4.1 Governing Law [8](#governing-law)

2.5 Fees [8](#fees)

2.6 Publication and Repositories [8](#publication-and-repositories)

2.6.1 Publication of CA information [8](#publication-of-ca-information)

2.6.2 Frequency of Publication [9](#frequency-of-publication)

2.6.3 Access Controls [9](#access-controls)

2.6.4 Repositories [9](#repositories)

2.7 Compliance audit [9](#compliance-audit)

2.8 Confidentiality [9](#confidentiality)

2.9 Intellectual Property Rights [9](#intellectual-property-rights)

3 Identification and Authentication
[9](#identification-and-authentication)

3.1 Initial Registration [9](#initial-registration)

3.1.1 Types of names [10](#types-of-names)

3.1.2 Name Meanings [10](#name-meanings)

3.1.3 Uniqueness of names [10](#uniqueness-of-names)

3.1.4 Method to Prove Possession of Private Key
[10](#method-to-prove-possession-of-private-key)

3.1.5 Authentication of Organization Identity
[10](#authentication-of-organization-identity)

3.1.6 Authentication of Individual Identity
[10](#authentication-of-individual-identity)

3.2 Routine Rekey [10](#routine-rekey)

3.3 Rekey After Revocation [10](#rekey-after-revocation)

3.4 Revocation Request [10](#revocation-request)

4 Operational Requirements [10](#operational-requirements)

4.1 Certificate Application [10](#certificate-application)

4.2 Certificate Issuance [11](#certificate-issuance)

4.3 Certificate Acceptance [11](#certificate-acceptance)

4.4 Certificate Suspension and Revocation
[11](#certificate-suspension-and-revocation)

4.4.1 Circumstances for Revocation [11](#circumstances-for-revocation)

4.4.2 Who Can Request Revocation [11](#who-can-request-revocation)

4.4.3 Procedure for Revocation Request
[11](#procedure-for-revocation-request)

4.4.4 Circumstances for Suspension [11](#circumstances-for-suspension)

4.4.5 CRL Issuance Frequency [11](#crl-issuance-frequency)

4.4.6 Online Revocation/status checking availability
[12](#online-revocationstatus-checking-availability)

4.4.7 Online Revocation checking requirements
[12](#online-revocation-checking-requirements)

4.4.8 Other forms of revocation advertisement available
[12](#other-forms-of-revocation-advertisement-available)

4.5 Security Audit Procedures [12](#security-audit-procedures)

4.6 Records Archival [12](#records-archival)

4.6.1 Types of Event Recorded [12](#types-of-event-recorded)

4.6.2 Retention Period for Archives [12](#retention-period-for-archives)

4.7 Key Changeover [12](#key-changeover)

4.8 Compromise and Disaster Recovery
[12](#compromise-and-disaster-recovery)

4.9 CA Termination [12](#ca-termination)

5 Physical, Procedural and Personnel Security Controls
[12](#physical-procedural-and-personnel-security-controls)

5.1 Physical Security Controls [13](#physical-security-controls)

5.2 Procedural Controls [13](#procedural-controls)

5.3 Personnel Security Controls [13](#personnel-security-controls)

6 Technical Security Controls [13](#technical-security-controls)

6.1 Key Pair Generation and Installation
[13](#key-pair-generation-and-installation)

6.1.1 Key Pair Generation [13](#key-pair-generation)

6.1.2 Private Key Delivery to Entity
[13](#private-key-delivery-to-entity)

6.1.3 Public Key Delivery to Certificate Issuer
[13](#public-key-delivery-to-certificate-issuer)

6.1.4 CA Public Key Delivery to Users
[13](#ca-public-key-delivery-to-users)

6.1.5 Key Sizes [13](#key-sizes)

6.1.6 Public Key Parameters Generation
[13](#public-key-parameters-generation)

6.1.7 Parameter Quality Checking [13](#parameter-quality-checking)

6.1.8 Hardware/Software Key Generation
[14](#hardwaresoftware-key-generation)

6.1.9 Key Usage Purposes [14](#key-usage-purposes)

6.2 Private Key Protection [14](#private-key-protection)

6.2.1 Private Key (n out of m) Multi person control
[14](#private-key-n-out-of-m-multi-person-control)

6.2.2 Private Key Escrow [14](#private-key-escrow)

6.2.3 Private Key Archival and Backup
[14](#private-key-archival-and-backup)

6.3 Other Aspects of Key Pair Management
[14](#other-aspects-of-key-pair-management)

6.4 Activation Data [14](#activation-data)

6.5 Computer Security Controls [14](#computer-security-controls)

6.5.1 Specific Computer Security Technical Requirements
[14](#specific-computer-security-technical-requirements)

6.5.2 Computer Security Rating [14](#computer-security-rating)

6.6 Life-Cycle Security Controls [14](#life-cycle-security-controls)

6.7 Network Security Controls [15](#network-security-controls)

6.8 Cryptographic Module Engineering Controls
[15](#cryptographic-module-engineering-controls)

7 Certificate and CRL Profiles [15](#certificate-and-crl-profiles)

7.1 Certificate Profile [15](#certificate-profile)

7.1.1 Version number [15](#version-number)

7.1.2 Certificate Extensions [15](#certificate-extensions)

7.1.3 Algorithm Object identifiers [15](#algorithm-object-identifiers)

7.1.4 Name Forms [15](#name-forms)

7.1.5 Name Constraints [16](#name-constraints)

7.1.6 Certificate Policy Object Identifier
[16](#certificate-policy-object-identifier)

7.1.7 Usage of Policy Constraints Extensions
[16](#usage-of-policy-constraints-extensions)

7.1.8 Policy qualifier syntax and semantics
[16](#policy-qualifier-syntax-and-semantics)

7.2 CRL Profile [16](#crl-profile)

7.2.1 Version [16](#version)

7.2.2 CRL and CRL Entry Extensions [16](#crl-and-crl-entry-extensions)

8 Specification Administration [16](#specification-administration)

8.1 Specification Change Procedures
[16](#specification-change-procedures)

8.2 Publication and Notification Procedures
[16](#publication-and-notification-procedures)

8.3 CPS Approval Procedures [16](#cps-approval-procedures)

Bibliography [16](#bibliography)

Appendix A: Guidelines for RAs and PMA Members
[17](#appendix-a-guidelines-for-ras-and-pma-members)

A.1 Membership of the National Fusion Collaboratory VO
[17](#a.1-membership-of-the-national-fusion-collaboratory-vo)

A.2 Guidelines for PMA members [17](#a.2-guidelines-for-pma-members)

A.2 Guidelines for RAs [17](#a.2-guidelines-for-ras)

A.3 Authentication procedures [18](#a.3-authentication-procedures)

A.3.1 Authentication of individual identity
[18](#a.3.1-authentication-of-individual-identity)

A.3.2 Steps in authentication for certification
[18](#a.3.2-steps-in-authentication-for-certification)

A.4 Lifetime of certificates [18](#a.4-lifetime-of-certificates)

# Introduction

## Overview

The National Fusion Collaboratory (NFC) is a creation of a SciDAC
proposal to "advance the science of high temperature plasma physics for
magnetic fusion". This VO will exist for at least the 5-year funding
period of that proposal, and if successful may become a more lasting
entity. The need for the FusionGrid CA itself will last as long as the
Collaboratory does, and will at least cover the period where any X.509
certificates issued by this CA are still valid.

The NFC Virtual Organization community is defined as all persons
authorized to use any of the National Fusion Collaboratory's on-line
resources. General information about the NFC can be found at
[http://www.fusiongrid.org](http://www.fusiongrid.org/). Specific
information about the FusionGrid CA can be found at
http://dsd.lbl.gov/FusionGrid/FGCA.html.

The structure of this document follows that used by the DOEGrids
Certificate Policy and Certification Practice Statement \[DOEGrids\]
which is based on RFC 2527 \[RFC2527\]. Not all sections of RFC 2527 are
used. Sections that are not included have a default value of "No
stipulation".

This document describes the set of rules and procedures established by
the FusionGrid policy management authority (PMA) for the operations of
the FusioniGrid PKI service. ESnet operates the FusionGrid public key
infrastructure under the authority of the FusionGrid PMA. ESnet and the
data center housing the PKI servers are located at Lawrence Berkeley
National Laboratory, Berkeley, California.

This document will include both the certificate policy and the
certification practice statement for the FusionGrid PKI. The general
architecture is a certificate authority with multiple registration
authorities. Each registration authority may vet any user identities.

It is the intent of this CA to issue person certificates for use in the
FusionGrid to scientists, engineers, graduate students, and others
working on or collaborating with Department of Energy Scientific
Research programs relating to magnetic plasma fusion research. Thus
these certificates should be compatible with the Globus middleware that
is used on these Grids. Service certificates for FusionGrid services and
hosts will continue to be issued by the DOEGrids CA.

The FusionGrid PKI is based on Iplanet CMS running on a Solaris
platform. This configuration directly influences the architecture
supported.

### General Definitions

**Certification Authority (CA)**\
The entity / system that issues X.509 identity certificates (places a
subject name and public key in a document and then digitally signs that
document using the private key of the CA

**Certificate Policy (CP)**\
A named set of rules that indicates the applicability of a certificate
to a particular community and/or class of application with common
security requirements. For example, a particular certificate policy
might indicate applicability of a type of certificate to the
authentication of electronic data interchange transactions for the
trading of goods within a given price range.

**Certification Practice Statement (CPS)**\
A statement of the practices, which a certification authority employs in
issuing certificates.

**Credential Service**\
A service that requests and stores long-term x.509 public key
certificates and the associated private keys for members of a real or
virtual organization. The Credential Service will delegate proxy
certificates to properly authenticated users.

**Distinguished Name (DN)**\
A multi-component name originally defined by the X.500 Directory
specification \[X.500\]. The DNs used in the FsuionGrid certificates
will be consistent with components defined in X.509 Certificate Profile
\[RFC3280\].

**Person Certificate**\
A certificate used for authentication to establish a Grid Person
Identity. It will represent an individual person.

**Policy Management Authority (PMA)**\
The committee that approves policy governing the FusionGrid CA. For the
FusionGrid CA this is a committee composed of the National Fusion
Collaboratory PIs.

**Registration Authority (RA)**\
A person that is responsible for identification and authentication of
certificate subjects. He/she has the authority to use the CA agent
interface in order to cause the CA to issue certificates.

**Relying Party**\
A recipient of a certificate who acts in reliance on that certificate
and/or digital signatures verified using that certificate.

**Service Certificate**\
A certificate for a particular service running on a host. It will
represent a single service on a single host.

**Virtual Organization (VO)**\
An organization that has been created to represent a particular research
or development effort independent of the physical sites that the
scientist or engineers work at. (i.e. the National Fusion
Collaboratory).

## Community and Applicability

### Certification Authorities

ESnet will manage and operate the FusionGrid PKI. It will be a
subordinate CA to the Esnet Off-line Root CA .The On-line CA and the
registration interface servers are located at the ESnet data center. The
host on which the CA runs has a DNS alias of ca.fusiongrid.org.

### Registration Authorities

The FusionGrid PKI consists of a number of individual RAs representing
sites that are members of the FusionGrid. ESnet maintains a browser
accessible registration interface for use by the FusionGrid RAs. This
interface can be used to:

-   Approve or reject the certificate request

-   Initiate certificate revocations

-   Search for certificates

The RAs can be contacted at <FusionGridRA@george.lbl.gov>. This is the
list to which the CA should send notification of certificate requests.

### FusionGrid Credential Service

The National Fusion Collaboratory runs a community Credential Manager
which is implemented by the MyProxy \[MYPROXY\] software and stores
long-term person credentials for members of the collaboratory. This
Manager will delegate proxy certificates on demand to authorized
parties, eliminating the need for the end entities to manage their own
private keys. The FusionGrid Credential Service (FGCS) provides the
interface through which the Fusion Collaboratory end entities request
their certificates. The policy and operation of this service is critical
to the reliability and security of FusionGrid certificates and is
covered in detail in a separate document \[GRIDCRED\]. Relevant to this
document is the fact that the identity of a person requesting a
certificate is vetted by a FusionGrid RA as described in this document.

### End Entities

FusionGrid PKI issues person certificates to scientists, engineers,
graduate students, and others working on or collaborating with
Department of Energy scientific research programs relating to magnetic
plasma fusion research.

### Applicability

***Person certificates*** can be used to authenticate a person to
relying sites that have agreed to accept certificates from the
FusionGrid CA. This authentication may require the signing of Globus
proxy certificates \[RFC3820\]. It is expected that these sites will be
supported by DOE Fusion Research funding or will be collaborating with
such sites. These certificates are not suitable for legally binding
digital signatures on documents.

## Contact Details

FusionGrid PKI is operated by **ESnet** and managed by the PI of the
National Fusion Collaboratory. The members of the FusionGrid can be
found at http://www.fusiongrid.org

Contact person for questions related to this document is:

Mary R. Thompson

One Cyclotron Road, MS50B-2239

Berkeley, CA 94706\
phone: +1 510 486 7408\
fax: +1 510 486 6363\
e-mail: mrthompson@lbl.gov

# General Provisions

## Obligations

### CA and RA Obligations

**FusionGrid CA** will:

-   Accept certification requests from entitled entities;

-   Notify the RA of certification request and accept authentication
    results from the RA.

-   Issue certificates based on the requests from authenticated
    entities;

-   Notify the subscriber of the issuing of the certificate;

-   [Publish the issued certificates;]{.mark}

-   Accept revocation requests according to the procedures outlined in
    this document;

-   Authenticate entities requesting the revocation of a certificate,
    possibly by delegating this task to a FusionGrid RA;

-   [Issue a Certificate Revocation List (CRL);]{.mark}

-   [Publish the CRL issued.]{.mark}

-   [Keep audit logs of the certificate issuance process]{.mark}

**A FusionGrid RA** will:

-   Accept authentication requests from the FusionGrid CA;

-   Authenticate entity making the certification request according to
    procedures outlined in this document;

-   Notify the FusionGrid CA when authentication is completed for a
    certification or revocation request;

-   Accept revocation requests according to the procedures outlined in
    this document;

-   Notify the FusionGrid CA of all revocation requests;

-   Authenticate entity making revocation request according to
    procedures outlined in this document.

-   Additional guidelines are described in Appendix A.

### Subscriber Obligations

Subscribers must:

-   Read and adhere to the procedures published in this document;

-   Generate a key pair using a trustworthy method, including using the
    FusionGrid Credential Service to generate and store the key.

-   Take reasonable precautions to prevent any loss, disclosure or
    unauthorized use of the private key associated with the certificate,
    including:

```{=html}
<!-- -->
```
-   Selecting a pass phrase/password of a minimum 8 characters

-   Always using the pass phrase to encrypt the stored private key.

-   Never sharing the private key or Grid Credential password with other
    users.

```{=html}
<!-- -->
```
-   Provide correct personal information and authorize the publication
    of the certificate

-   Notify immediately FusionGrid PKI in case of a private key lost or
    compromised.

-   Use the certificates for the permitted uses only.

### FusionGrid Credential Service Obligations

The FusionGrid Credential Service must:

-   Run on a secured machine

-   Generate a key pair using a trustworthy method

-   Take reasonable precautions to prevent any loss, disclosure or
    unauthorized use of the private key associated with the certificate,
    including:

```{=html}
<!-- -->
```
-   Requiring a pass phrase/password of a minimum 8 characters

-   Always using the pass phrase to encrypt the stored private key.

-   Only delegate a proxy to a party that knows the passphrase.

```{=html}
<!-- -->
```
-   Co-ordinate revocation procedures with the FusionGrid PKI,

```{=html}
<!-- -->
```
-   Immediately notify the FusionGrid PKI in case of a private key lost
    or compromised and stop issuing proxies for the certificate

-   Notify the FusionGrid PKI of any revocation request it receives

-   Remove stored credentials that have been revoked by the FusionGrid.

### Relying Party Obligations

Relying parties must:

-   Read the procedures published in this document;

-   Use the certificates for the permitted uses only.

-   Do not assume any authorization attributes based solely on an
    entity\'s possession of a FusionGrid certificate.

Relying parties may:

-   Verify that the certificate is not on the CRL before validating a
    certificate;

### Repository Obligations

FusionGrid PKI will provide access to FusionGrid CA information, as
outlined in section 2.6.1, on its web site. The location of the
information is specified in section 2.6.4.

## Liability

FusionGrid PKI and its agents issue person certificates according to the
practices described in this document to validate identity. No liability,
implicit or explicit, is accepted.

The certification service is run with a reasonable level of security,
but it is provided on a *best effort only* basis. It doesn't warrant its
procedures and it will take no responsibility for problems arising from
its operation, or for the use made of the certificates it provides.

FusionGrid PKI denies any financial or any other kind of
responsibilities for damages or impairments resulting from its
operation.

## Financial Responsibility

No Financial responsibility is accepted.

## Interpretation and Enforcement

### Governing Law

This policy is subordinate to all applicable U.S. government laws, as
well as Department of Energy (DOE) orders.

## Fees

No fees are charged for FusionGrid Certificates. All costs for operation
are covered directly or indirectly by DOE.

## Publication and Repositories

### Publication of CA information

FusionGrid PKI will operate a secure online repository that contains:

-   FusionGrid CA's certificate;

-   Certificates issued by the PKI;

-   A Certificate Revocation List;

-   A copy of this policy

-   Other information deemed relevant to the FusionGrid PKI.

### Frequency of Publication

-   Certificates will be published to the FusionGrid PKI repository as
    soon as issued.

-   CRLs will be published as soon as issued or refreshed once every
    month if there are no changes.

-   All FusionGrid PKI documents will be published to the project
    website as they are updated.

### Access Controls

The online repository is available on a substantially 24/7 basis,
subject to reasonable scheduled maintenance.

FusionGrid PKI doesn't impose any access control on its Policy, its
Certificate and issued certificates and CRLs. In the future, FusionGrid
PKI may impose access controls on issued certificates, their status
information and CRLs at its discretion, subject to agreement between the
CA, relying parties and subscribers.

### Repositories

Repository of certificates and CRLs can be found at
http://dsd.lbl.gov/FusionGrid/FGCA.html

## Compliance audit

The FusionGrid PKI will not be audited by an outside party. The CA
operation may be reviewed by any corss certifying organization or
potential relying organization if approved by the PMA.

## Confidentiality

FusionGrid PKI collects subscribers' full name and e-mail address. Some
of this information is used to construct unique, meaningful subject
names in the issued certificates.

Information included in issued certificates and CRLs is **not**
considered confidential.

FusionGrid PKI doesn't collect any kind of confidential information.

FusionGrid PKI doesn't have access to or generate the private keys of a
digital signature key pair, such as those used in FusionGrid identity
certificates. These key pairs are generated and managed by the client or
the FusionGrid Credential Service and are the sole responsibility of
subscriber or FGCS,

## Intellectual Property Rights

This document was derived from \[DOEGridCP\].

# Identification and Authentication

## Initial Registration

### Types of names

Names will be Distinguished Names (DN) consistent with the name
requirements specified in RFC3280. See section 7.1.4 for more details.

### Name Meanings

For individuals, the value of the Common Name (CN) component of the DN
has no semantic significance. It should have a reasonable association
with the authenticated name of the subscriber.

### Uniqueness of names

The Distinguished Name must be unique for each subject name certified by
the FusionGrid PKI. Each CN component will include the full name of the
subscriber. Each CN will have appended 5 or 6 random alphanumeric
characters (i.e. "John K. Doe 1W2D3"). Certificates must apply to unique
individuals or resources. Private keys associated with Person
certificates may not be shared between people.

### Method to Prove Possession of Private Key

[The FusionGrid CA does not verify that the requestor possesses the
private key for the certificate, since if he does not, he will be unable
to use the certificate.]{.mark}

### Authentication of Organization Identity

[Real organizational identity is not supported. The subscriber must be a
member of the NFC virtual organization to qualify for a person
certificate. The RA will be responsible for determining NFC membership
by the procedure documented in appendix A.]{.mark}

### Authentication of Individual Identity

Each FusioinGrid RA will be responsible for determining the identity
used in the subject field of the Certificate. The procedure for
determining identity is documented in appendix A.

## Routine Rekey

People certificates can be reissued **before their expiration** by an
online procedure, which checks the validity of the subject's
certificate. No other checks are performed.

Re-keying of expired certificates or server certificates follows the
same rules as an initial registration.

[V2.3 has no stipulation here]{.mark}

## Rekey After Revocation

Rekey after revocation follows the same rules as an initial
registration.

## Revocation Request

See section 4.4.2 for details on who can request a certificate
revocation.

# Operational Requirements

## Certificate Application

Procedures are different if the subscriber is submitting a request
directly or if the FusionGrid Certificate Manager is submitting the
request for the subscriber. In the first case the subscriber must
generate its own key pair. In the second case, the Certificate Manager
will generate a unique key pair for the subscriber and store it
encrypted with a user specified passpharse in a secure server. A proxy
based on that key will only be provided to a requester that knows the
passphase. A Key pair must have a minimum key length of 1024bits.

-   **Person**.\
    Certificate requests are submitted by an online procedure, using a
    http interface. The request is sent to the FusionGrid RAs for
    validation.

## Certificate Issuance

FusionGrid PKI issues the certificate if, and only if, an RA has
validated the authentication of the subject. A message is sent to the
requestor's e-mail address with the instructions on how to download it
from the FusionGrid PKI web server.

## Certificate Acceptance

No Stipulation.

## Certificate Suspension and Revocation

### Circumstances for Revocation

A certificate will be revoked when the information it contains is
suspected to be incorrect or compromised. This includes situations
where:

-   The subscriber's private key is lost or suspected to be compromised;

-   The information in the subscriber's certificate is suspected to be
    inaccurate;

-   The subscriber no longer needs the certificate to access Relaying
    Parties' resources;

-   The subscriber violated his/her obligations.

### Who Can Request Revocation

A request to revote an End Entity Certificate can be done by the
following entities if they can present reasonable evidence that the
private key has been compromise or that the subscriber's data is in
error, or at the request of the subscriber for any reason:

-   The Holder or owner of the Certificate.

-   The RA that validated the original Certificate request

-   The FusionGrid PKI managers.

-   Any other official entity that is a member of the FusionGrid.

### Procedure for Revocation Request

The entity requesting the revocation must authenticate itself to the
FusionGrid PKI or the VO's RA staff, which must use the same procedures
used for the authentication of identity of a person.

### Circumstances for Suspension

The FusionGrid PKI does not support Certificate Suspension.

### CRL Issuance Frequency

CRLs are issued after every certificate revocation or refreshed once
every month if there are no changes.

### Online Revocation/status checking availability

[An online Status checking facility is not currently provided]{.mark}.

### Online Revocation checking requirements

No stipulation.

### Other forms of revocation advertisement available

No stipulation.

## Security Audit Procedures

Security Auditing of the FusionGrid PKI is not supported.

## Records Archival

### Types of Event Recorded

The following events are recorded and archived

-   Certification requests;

-   Issued certificates;

-   Issued CRLs;

### Retention Period for Archives

Minimum retention period is three years.

## Key Changeover

No stipulation.

## Compromise and Disaster Recovery

If the CA's private key is --- or suspected to be - compromised, the CA
will:

1.  Inform subscribers and subordinate RAs;

2.  Terminate the certificates and CRL distribution services for
    certificates and CRLs issued using the compromised key.

## CA Termination

Before FusionGrid PKI terminates its services, it will:

1.  Inform subscribers and subordinate RAs;

2.  Make widely available information of its termination;

3.  Stop issuing certificates and CRLs.

4.  Destroy its private key's and all copies.

# Physical, Procedural and Personnel Security Controls

## Physical Security Controls

The FusionGrid PKI is located at Lawrence Berkeley National Laboratory
in the ESnet Data Center. The ESnet Data center maintains a limited
access procedure keyed to the LBNL badge system. The servers are
maintained in access controlled secure racks. All access to the servers
is limited to FusionGrid PKI managers and system support staff of ESnet.
All servers are Sun Solaris systems. Security on these systems is
maintained and configured to highest level provided for by Sun. All
security patches will be applied as soon as they are released by Sun and
verified by the ESnet support staff.

The FusionGrid PKI servers are located behind a Cisco Pix Firewall. The
entire server farm will be monitored by the Bro intrusion detection
system.

## Procedural Controls

No Stipulations.

## Personnel Security Controls

All access to the servers and applications that comprise the FusionGrid
PKI is limited to FusionGrid PKI managers and the ESnet system support
staff.

# Technical Security Controls

## Key Pair Generation and Installation

### Key Pair Generation

Each End Entity must generate its own key pair or have the FusionGrid
Credential Service generate a key on its behalf. FusionGrid PKI does not
generate private keys.

### Private Key Delivery to Entity

The FusionGrid PKI never has access to the End Entity private key.

### Public Key Delivery to Certificate Issuer

Entities' public keys are delivered to the issuing CA in a secure and
trustworthy manner (e.g. SSL/TLS).

### CA Public Key Delivery to Users

CA certificate is delivered by an online transaction from a secure web
server or by other out of band secure process.

### Key Sizes

Keys of length less then 1024 bits will not be signed.

### Public Key Parameters Generation

No stipulation.

### Parameter Quality Checking

No stipulation.

### Hardware/Software Key Generation

No stipulation.

### Key Usage Purposes

FusionGrid certificates are only warranted for authentication and
signing proxy certificates \[RFC3820\].

The ESnet root CA private key will only be used to sign subordinate CAs.
The FusionGrid online CA signing key is the only key that will be used
for signing CRLS and certificates for persons.

The certificate key usage field must be used in accordance with
\[RFC3280\]

## Private Key Protection

### Private Key (n out of m) Multi person control

Not supported.

### Private Key Escrow

Not supported.

### Private Key Archival and Backup

There is no support for Private Key Archival and Backup for End Entity
Certificates.

FusionGrid CA private key is kept, encrypted, in multiple copies and in
different locations, on CD-ROMs. For emergencies, the pass phrase is in
a sealed envelope kept in a safe.

## Other Aspects of Key Pair Management

FusionGrid CA certificate has a validity of **six** years.

## Activation Data

FusionGrid CA private key is protected by a pass phrase.

## Computer Security Controls

### Specific Computer Security Technical Requirements

CA servers include the following:

-   Operating systems are maintained at a high level of security by
    applying all recommended and applicable security patches;

-   Monitoring is done to detect unauthorized software changes;

-   Services are reduced to the bare minimum;

### Computer Security Rating

No stipulations.

## Life-Cycle Security Controls

No stipulations.

## Network Security Controls

The Root Certificate Authority will be off line and will only sign
subordinate CAs. FusionGrid will maintain an Online CA for issuing
Certificates authorized by the FusionGrid RAs.

The FusionGrid PKI servers are located behind a Cisco Pix Firewall. The
entire server farm will be monitored by the Bro intrusion detection
system. \[Bro\]

## Cryptographic Module Engineering Controls

No stipulations.

# Certificate and CRL Profiles

## Certificate Profile

### Version number

X.509 v3.

### Certificate Extensions

**Basic Constraints** (Critical)\
not a CA.

**Key Usage** (Critical)\
Digital Signature, Non Repudiation, Key Encipherment

**Authority Key Identifier**

### Algorithm Object identifiers

No stipulations.

### Name Forms

The X.509 character set is case insensitive. But in some situations
software being used to interpret these fields does interpret the name
forms as case sensitive. To insure proper operation, relying parties
must make sure the case used in Globus map files match the case of
issued certificates. Until uniform interpretation of case is deployed it
is strongly recommended that we follow the case conventions that are
used in the examples below.

**Issuer**: DC=org; DC=fusiongrid; OU=Certificate Authorities;
CN=FusionGrid CA;

**Issuer SubjectAltName**: email:FusionGridCA@george.lbl.gov

**End Entity:**

The subject name of the End Entity will be a valid Distinguished Name
(DN). These DNs will consist of the following Relative DN (RDN):

-   DC=org; DC=FusionGrid; OU=People

The Common Name (CN) components of the DN is defined as:

-   Full name as determined by the RA and an additional 5 random
    alphanumeric characters added for uniqueness. (i.e. "John K. Doe
    1W2D3")

-   DC=org; DC=FusionGrid; OU=People; CN= John K. Doe 1W2D3

### Name Constraints

Not supported

### Certificate Policy Object Identifier

[None]{.mark}

### Usage of Policy Constraints Extensions

No stipulated.

### Policy qualifier syntax and semantics

The qualifier is a pointer to this document, in the form of an URL.

## CRL Profile

### Version

X.509 v1.

Version 1 is required for compatibility with Netscape Communicator.

### CRL and CRL Entry Extensions

No stipulation.

# Specification Administration

## Specification Change Procedures

Users will not be warned in advance of changes to FusionGrid CA's policy
and CPS.

## Publication and Notification Procedures

The policy is available at http://dsd.lbl.gov/FusionGrid/FGCA.html

## CPS Approval Procedures

The FusionGrid PKI PMA is responsible for the CP and CPS. All changes
must be approved by the PMA.

# Bibliography {#bibliography .unnumbered}

\[Bro\] V. Paxson, Bro: A System for Detecting Network Intruders in Real
Time, Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999. (This
paper is a revision of paper that previously appeared in Proc. 7th
USENIX Security Symposium , January 1998.)
<http://www.icir.org/vern/papers.html>

\[DOEGridCP\] <http://www.doegrids.org/Docs/CP_CPS.pdf>

\[GRIDCRED\] TBD

\[MYPROXY\] http://grid.ncsa.uiuc.edu/myproxy/

\[RFC2527\] - S. Chokani and W. Ford, Internet X.509 Infrastructure
Certificate Policy and Certification Practices Framework, RFC 2527,
March 1999

\[RFC3280\] - R. Housley, W. Ford, W. Polk and D. Solo, Internet X.509
Public Key Infrastructure Certificate and CRL Profile, RFC 3280, April
2002

RFC3820\] -- Tuecke, S., et al., Internet X.509 Public Key
Infrastructure (PKI) Proxy Certificate Profile. June 2004, IETF RFC 3820

\[X500\] The Directory \-\-- overview of concepts, models and services,
1993. CCITT X.500 Series Recommendations.

# Appendix A: Guidelines for RAs and PMA Members {#appendix-a-guidelines-for-ras-and-pma-members .unnumbered}

## A.1 Membership of the National Fusion Collaboratory VO {#a.1-membership-of-the-national-fusion-collaboratory-vo .unnumbered}

The NFC community is defined as all persons authorized to use any of the
National Fusion Collaboratory's on-line resources. Any member of the PMA
may authorize a new member of the community. Any member of the NFC is
entitled to have a person certificate issued by the FusionGrid CA.

## A.2 Guidelines for PMA members {#a.2-guidelines-for-pma-members .unnumbered}

1.  The PMA approves the CP/CPS for the FusionGrid CA.

2.  The PMA appoints or removes individuals as Registration Authorities

3.  The members of the PMA have the final authority to grant membership
    in the NFC and thus to approve a request for a FusionGrid person
    certificate.

## A.2 Guidelines for RAs {#a.2-guidelines-for-ras .unnumbered}

1.  Registration Authorities (RA) will perform all of the functions
    needed to apply certificate issuance policy to potential CA
    subscribers. The RA uses the registration interface of the CA to
    generate and forward a certificate request to the CA.

2.  An RA needs to be technically qualified and have the organizational
    authority to make the decision on whether the organization will
    issue a certificate to an applying individual. This agent has
    approximately the same role and level of responsibility as the
    agents in an organization that process computer account request
    forms and make the decision as to whether to issue and account or
    not.

3.  RAs, by policy may not use the FusionGrid CA registration interface
    to do the following:

    a.  Sign CA certificates.

    b.  Sign a name space not approved by this policy.

    c.  Clone or create new RAs without the PMA's approval.

## A.3 Authentication procedures {#a.3-authentication-procedures .unnumbered}

### A.3.1 Authentication of individual identity {#a.3.1-authentication-of-individual-identity .unnumbered}

Any member of the PMA (a sponsor) or RA may authenticate a person
requesting a certificate. Person requesting certification must
demonstrate reasonable evidence of membership in the NFC VO.

### A.3.2 Steps in authentication for certification {#a.3.2-steps-in-authentication-for-certification .unnumbered}

1.  A person requests a certificate from the FusionGrid CA, either
    directly or through the FusionGrid Certificate Manager interface;
    the request includes the name of a PMA member (sponsor) that can
    authenticate the request.

2.  RA receives notification of the request and takes assignment if
    appropriate.

3.  If the RA cannot personally vouch for the requester, notifies the
    sponsor indicated in request that a request is pending including the
    name, institution and email of the requester

4.  Sponsor or RA contacts requester and authenticates request (secure
    means).

5.  Sponsor confirms or refutes the request to the RA. (secure means)

6.  RA approves or rejects the request using the registration interface.

7.  Person requesting certificate receives notification from CA or
    Certificate Manager.

## A.4 Lifetime of certificates {#a.4-lifetime-of-certificates .unnumbered}

Identity certificates approved by the FusionGrid CA have a lifetime of
no more than 24 months from date of approval.