# Presentation: 720806

## SPOCK Demonstration

**of Entrust PKI**

**SPOCK**

**NSA**

**ARMY**

**IRS**

**AIR FORCE**

**NAVY**

**Notes:**
Good Afternoon,

I am MAJ Michael Davis, the Deputy Program Manager for the NSA’s Security Proof-of-Concept Keystone Program.  On behalf of Terry Losonsky, the Program Manager, We thank you for the opportunity to brief you on the SPOCK Program and our demonstration of the Entrust PKI.

For ten days in June, elements from the Army, Air Force, Navy, NSA and IRS conducted tests with the Entrust/PKI version 3.0c over a Public Key Infrastructure they built in only three weeks.

To better understand the circumstances of our demonstration, I will need to explain the SPOCK Program.  I will follow this Agenda. . .

## AGENDA

**  ****What’s the SPOCK Program**
**  ****Past Accomplishments**
**  ****Who’s in SPOCK**
**  ****What does the SPOCK team do**
**  ****Demonstration Process**
**  ****SPOCK PKI Architecture**
**  ****PKI Claims and Results**
**  ****Lessons Learned**
**  ****Return on Investment **
**  ****Summary**

**Notes:**

I will first provide Who’s, What’s and When’s of the SPOCK Program.

I will then explain the demonstration process and tie it into the Entrust schedule.

I will illustrate the architecture, that we used and explain why we choose it.

I will review the ten claims made by Entrust and the results

I will present overall lessons learned from the Entrust demonstration.

I will explain why organizations volunteer people, equipment, and time to participate in SPOCK demonstrations.

I will then provide an opportunity to ask questions.

I will begin by answering your first question:  “What’s SPOCK?”

## What’s SPOCK ?

**    “****A ****Consortium**** of ****Product Developers**
**and ****Government System Integrators**** **
**interested in exploring ****INFOSEC *****commercial***
** **
**solutions ****and ****Enabling Technologies****”**

**Notes:**

SPOCK stands for Security Proof-of-Concept Keystone.  

The current SPOCK program started in December of 1995 to gain insight into the world of commercial INFOSEC products.

SPOCK considers the Warfighter ISSEs as its customer.

I should also explain what SPOCK is NOT:
   SPOCK does not evaluate products, we demonstrate.
We have established strong links with the NIAP program and introduce vendors and integrators alike to Common Criteria.

  SPOCK does not compare products, each demonstration sets a “bar” that others must pass to be considered.
<Pause>
Since December 1995, we have accomplished . . . 

## PAST

**ACCOMPLISHMENTS**
**1995-1998**

** **** ****32 Consortium Meetings - Over 1500 Attendees**
**  ****96 Emerging Topic Areas Briefed**
**  ****8 Diverse Solutions Demonstrated**
**  ****Established Zones of Cooperation**
**  ****Over 40 Government System Integration Communities**
**  ****Over 100 Solution Developers**
**  ****Input for the President’s Quality Award**
**  ****Nominated for SECDEF’s Team Excellence Award**

**Notes:**
SPOCK meets monthly on the first Tuesday.
Normally three briefings are presented at each meeting.  Briefs include both commercial vendors presenting product information and system integrators presenting requirements or lessons learned.

1.  DSNT NetFortress - Point to Point Network layer encryptor for VPNs
2.  NSC BorderGuard - VPN solution with access control
3.Wheelgroup NetRanger - “real time” Intrusion Detection
4.  Dragonfly - MLS Guard with FORTEZZA
5.  DirecPC - High Speed delivery of data files via commercial satelite
6.  CISCO 7500 - Router with security services
7. Entrust PKI - PKI and email, web and desktop security products
8. StorageTek Atlas ATM firewall and encryptor (ONGOING)

The Zones of Cooperation provides for information exchange, the primary SPOCK Product.

Who has been responsible for these accomplishments? . . .

## Who’s in SPOCK

**  ****Army - BCBL-G, LIWA, DISC4**
**  ****Navy - SPAWAR, NAVSEA, NIA**
**                ****FIWC, NIWA, NRL**
**  ****Air Force - AFIWC, 609 IWS, AFOSI**
**                      ****CPSG**
**  ****Joint - J6, DISA**
**  ****Non DoD - NASA, DoJ**
**  ****NSA - V, Y, X, C**

**Notes:**

SPOCK is a volunteer organization.  

These organizations have provided personnel and equipment and participated in previous SPOCK demonstrations.

What are the requirements that SPOCK places on its members . . .

## What’s the 

**SPOCK Team do ?**

**  ****Attend monthly briefings on Warfighter**
**    ****Architectures and Solutions**
**  ****Demonstrate Security Claims in**
**    ****Warfighter Architectures**
**  ****Write SPOCK Demonstration Reports**
**  ****Develop Draft Security Targets and**
**    ****Protection Profiles**

**Notes:**

We meet on the first Tuesday of every month at COACT in Columbia.

If interest dictates. .  Demonstrate.

Introduce both vendors and system integrators to Common Criteria
  HeatSeeker Pro Security Target
  Partial Security Targets for demonstrations
  Intrusion Detection Protection Profile

If information exchange is our primary product, then SPOCK demonstrations are the cornerstone for our process. . .

## DEMONSTRATION

**PROCESS**

**1.  Solution/Developer Identified.**
**2.  Developer briefs the Solution during meeting.**
**3.  Developer presents Security Claims, **
**     ****Architecture, and Equipment Requirements.**
**4.  SPOCK prepares Scripts to demonstrate Claims.**
**5.  SPOCK demonstrates Security Claims**
**     ****in Government Architectures.**
**6.  SPOCK writes the Demonstration Report,**
**     ****signed by Chief, NSA V2.**

**Notes:**
1.  Warfighter identifies product that may provide the desired technology.  

2.  SPOCK invites the vendor to brief at one of our meetings.  In the case of Entrust, they briefed last winter.  Entrust provides all the pieces for a PKI.

3.  Entrust made 10 claims for their PKI, 1 claim for their API and additional claims for their “Entrust-Ready”  Applications.  They proposed an architecture and scripts to verify each claim.

4.  SPOCK distributed the claims scripts and architecture to its members.  We received responses and formed a demonstration team.  We modified the claims, scripts and architecture so they became the “governments”, however, still vendor approved.

5.  Our demonstrations normally last three days.  We recognized that Entrust would take at least five days.  This was extended to eight days.

6.  Currently writing report.  Slower than usual because we are doing the Atlas demonstration.  Report is unclassified and available.

## ENTRUST CA

- Entrust/Authority

- Entrust/Admin

- CERTIFICATE
- AUTHORITY

- Directory

- Users

- Other
- CAs

**ENTRUST CA**
**ARCHITECTURE**

**Notes:**

I included this slide as a comparison to other CA products.

The Entrust Administrators focus is on clients, i.e. add, revoke, etc.

The Entrust Authority or Manager controls overall policies for the domain.

The Entrust components for the demonstration . . .

## SPOCK PKI

- CA

- User

- User

- Directory

- Entrust/Manager
- & Entrust/Admin

- iCL i500, X.500 Directory

- Entrust/Clients

**SPOCK PKI**
**COMPONENTS**

**Notes:**

These are the PKI components for a domain.  We also used Entrust email, web and desktop security add-ins.

The directory stores the certificates.  Prior to the demonstration the significance of the directory was not understood by the warfighters.

## SPOCK PKI

- c=US

- o=US Gov

- ou=Navy

- ou=Air Force

- ou=Army

- cn=user1
- cn=user2
- cn=user3
- cn=user4

- cn=user1
- cn=user2
- cn=user3
- cn=user4

- cn=user1
- cn=user2
- cn=user3
- cn=user4

- cn=user1
- cn=user2
- cn=user3
- cn=user4
- cn=webserver

_**KEY**_
- c=country
- o=organization
- ou=organizational unit
- cn=common name

**  ****Each Site Contains iCL’s i500, X.500**
**    ****Directory**
**  ****Each Site Contains 3,000 User Entries**
**  ****Each Site “chained” to all of the others**
**   ****to browse and retrieve certificates**

- o=IITRI

- cn=user1
- cn=user2
- cn=user3
- cn=user4

**SPOCK PKI**
**Directory Schema**

**Notes:**

The ou=ITRLab was not officially part of the SPOCK demonstration, However, most included it in their search bases.

X.500 required to “chain” the directories together to create the “Capital D” Directory.

Chaining is required to support cross certification, which was the focus of our demonstration.

## SPOCK PKI

- CA4

- User

- User

- Directory

- CA3

- User

- User

- Directory

- CA2

- User

- User

- Directory

- CA5

- User

- Directory

- CA1

- User

- User

- Directory

**NSA**
**         **DECIN Lab - Linthicum, MD** **

**IRS**
**      **IITRI - Lanham, MD

**Army - DISC4**
**       **J.G. Van Dyke - Alexandria, VA

**Air Force**
- CPSG - San Antonio, TX**   **

**Navy - NIWA**
- COACT - Columbia, MD**     **

- User

**Cross-certified**

- Certificate Authority (Entrust/Manger)

- CA

- X.500 Directory (Entrust/Directory)

- LDAP Connectivity

**SPOCK PKI**
**ARCHITECTURE**

**Notes:**

NSA - DECIN lab is traditional participant in SPOCK demonstrations.
Army - J.G. Van Dyke & Associates was hired by DISC4 to look at different PKI products.  They choose to use the SPOCK demonstration to look at Entrust.
Air Force - Cryptographic Systems Group (CPSG) New player refered to us by AFWIC which participated in the past.
Navy - Originally NAVSEA, Crystal City.  NIWA agreed to “own” the site if equipment was set up at COACT.
IRS - IITRI also a traditional participant in SPOCK demonstrations.

We choose a network architecture instead of a hierarchical model because, the participants believed that it more closely reflected their relationships.

We originally wanted a hybrid architecture, mixing both models.  However, changed to a pure network model to ensure completion of the demonstration.

The typical test site looked like this . . .

## DECIN Lab

**ARCHITECTURE**

**Notes:**
Most complicated SPOCK demo:  Many software programs. Firewall configuration issues.

Entrust PKI components:
 Manager and Admin (Administrator could be on its own machine)
 X.500 Directory
 Clients

Most sites ran multiple programs on a server.  Conflict between Exchange and Entrust on same server.  May not reflect actual architecture, but it was what was available.
MS Exchange Mail server
  Navy used the IITRI mail server for “remote” mail.
Netscape Enterprise web server
  Navy did not attempt to setup a Netscape server.  Went to DECIN.

This architecture was used to verify the Entrust Claims. . .

## ENTRUST PKI

**CLAIMS**

- 1.1  Key Management
-         Transparency
- 1.2  Secure Key Recovery
- 1.3  Auto Key Update
- 1.4  Client Key Initialization
- 1.5  Certificate Revocation

- 1.6  Support Cross-certification
- 1.7  Entrust Scalability
- 1.8  Hardware Tokens Option
- 1.9  Support Multiple
-         Algorithms
- 1.10  Support Multiple
-           Applications

**Notes:**
I will define each claim in detail.
The Entrust API claim was not demonstrated.  Only IITRI completed the additional scripts for the ICE and Express.  None of the sites completed the additional scripts for E-RNS
Scripts were developed to provide a Yes or No for each claim.  Navy made a number of modifications to the scripts for each claim - interested in “ease of use” and ability to perform tasks remotely.

Our TEST Methodology:  Use Entrust “Entrust-Ready” Applications to demonstrate PKI claims.

Most observations were on the “application” not on the PKI.

The first of ten claims was . . . 

##     Users should be able to use security product without understanding cryptography or key management

**Key Management**
**Transparency**

-   E-Mail - Signed and Encrypted E/Express
-   Desktop File Encryption E/ICE

- 1.  Claim verified.  The management of keys is
-       transparent to users.
- 2.  Searching the Directory, is NOT transparent.

**Notes:**

The User selects a profile and then enters their password.  The ability to select profiles allows multiple certificates per individual and multiple individuals per machine.

Once a certificate is associated with an email or file recipient, the process was easy.

To make this process easier, Certificates can be stored in three places:
1.  The Directory
2.  The MS Exchange Global Address Book
3.  The Personal Address Book

We experienced a number of problems with the iCL product.  It was not user friendly.  Also, there is a real shortage of people with X.500 expertise.  (Entrust and Van Dyke)

The second claim was . . .

## Secure Backup &

**Key Recovery**

- 1.  Claim verified.  Recovered files and email.
- 2.  Entrust Key Recovery solution is best suited for
-      Authorized user that has forgotten their password.

- Entrust provides the ability to recover keys in cases
- where a valid user has forgotten their password or
- an employee has left the company

- There are three general cases for “key recovery”.
- Send Authentication Code, Reference Number
- “out of band” to authorized individual.

**Notes:**

Entrust uses a two key pair model.  One pair is for encryption and the other pair is for verification.

Entrust claims to secure the encryption keys on the Entrust Manager.  We did not attempt to verify this claim.  SPOCK does not evaluate cryptographic implementations.

Three Cases:
1.  Valid User forgets their password.
2.  Organization or Law enforcement wants to recover information from a User that is no longer valid.
3.  Law enforcement surveillance.

Case 2 - New certificate is generated.

Case 3 - Not attempted, awkward at best.

The third claim was . . .

## Automatic

**Key Update**

- Certificates are updated without user involvement.

- Set Encryption and Verification period to 2 months
- Set Signing Private to 10 percent.

- 1. Claim verified.  User informed by message box.
- 2. If renewal period is missed, key recovery is required.

**Notes:**

Encryption and Verification period is 2-60 months.
Signing Private is 1-100 percent of verification.

You must make these settings before you create the certificate.

The forth claim was . . . 

## Client Key

**Initialization**

- Clients are initialized using a secure “pipe”.
- Clients can be set up remotely over a network.

- Run installation program over the network.
- Requires:  Authentication Code, Reference Number
- and access to install program and entrust.ini file.

- SEP was not verified.
- Claim verified.  Remote install in 20 minutes.

**Notes:**

SEP was not verified because the SPOCK program does not evaluate cryptographic implementations.

The remote install looked familiar to those who do McAfee updates.

20 minutes to install over LAN.

20 more minutes to install Express add-on, associate certificates and send message.

Authentication Code and Reference number passed “out of band”

## Certificate

**Revocation**

- Entrust provides the ability to revoke certificates.

- Revoke user.  Attempt to send and receive email.
- Attempt to access web server.  Attempt to use ICE.

- 1. Claim verified after modifications.
- 2. Express does not verify certificate prior to sending.

**Notes:**
We were most disappointed with this claim.  Time was a factor.
I said there were three places to store certificates.  Well there are really five, when you add disk and ram caches of certificates.

The Directory showed the certificate as revoked (Navy crash)  However, the user was still able to user their certificate because it was cached. 

We had to modify the entrust.ini file on each client. We had to delete *.crl and *.arl files form each client. We had to reboot the clients.

The old certificate is still kept in the personal address book.  You can still send to a user with a revoked certificate.

Remote users still continued to have access to their machines until they connected. [Logical]

Any user can modify their entrust.ini file.  BL - Don’t use Entrust’s CRL for Access Control

## Support

**Cross-Certification**

- Certificate Authorities are able to cross-certify.

- Establish Search base by “chaining” directories
- Use Entrust Managers to Cross Certify
- Send encrypted mail/files to another domain.

- 1.  Claim verified.
- 2.  Problems searching the Directory

**Notes:**
The sixth claim was the most significant for the demonstration.

Used Express, ICE and the Entrust Client to verify cross-certification

Due to lack of resources, we did not verify with Netscape.

CPSG demonstrated interoperability with Netscape certificates.

No or open security policy - significant issue with network architecture
Claim verified.  I would like to see hybrid architecture and move a CA from one to another, ala deployment.

By using “superior references” you can scale the PKI between CAs.  Entrust’s seventh claim was the ability to scale within a trust domain.

## Scalability

- Quickly add 3,000 users within each domain.

- “Bulk Load” using a disk loaded with
- 3,000 names and serial numbers.  Real users
- were loaded individually.

- Claim verified.

**Notes:**
The SPOCK team choose 3,000 users.  The ability to scale is dependant on your Directory  hardware.  Bank of Nova Scotia has ~50,000 users.

Loading 3,000 users took 5 minutes to load the disk and 25 minutes for Entrust to enable them.  This does not include the time for each client to initialize (see claim 4) 

We did not have 3,000 users to really stress the directory.  However, DECIN noticed delays because they were using a 133 MHz Pentium.

## Hardware Tokens

**Biometrics**

- Support Tokens for storing profiles and Biometrics
- for authentication of users.

- Use DateKey smart card to store user’s profile.
- Use Biometrics device instead of a password
- to authenticate users

- Hardware Token claim verified. Biometrics device
- vendor could not provide correct drivers.

**Notes:**

In addition to creating new users on a smart card, we copied some profiles.
Profile copied to Smart Card.  Original on Hard Disk, no longer valid.

Encryption is still performed in software.  

Entrust/PKI version 4.0 claims to support hardware CA.

The ninth claim was . . .

## Multiple

**Algorithms**

- Entrust supports multiple algorithms for hashing
- encryption and digital signature.

- Use Entrust Manager to select hashing and digital
- signature algorithms.
- Use Entrust Client and Applications to select
- different encryption algorithms.
- Send email and files to other users.

- 1.  Claim verified within the abilities of the
- SPOCK Team.

**Notes:**

The SPOCK team agreed to accept the Entrust header as valid and to verify that the files contained cipher text.

The Entrust Manager sets the Hashing and signature algorithms.

The user can set their default encryption algorithm using Entrust Client.

User can change encryption algorithm for each  encryption.

The algorithm used to encrypt the file or email is completely transparent to the  recipient.

## Single Password

**Many Applications**

- Entrust uses the single password for a user’s
- certificate to logon to secure applications.

- Start Client, enter password. Start ICE, enter same
- password.  Start Express, enter same password.  Start
- Entrust-Ready Netscape, enter same password.

- Claim verified.  Automatic logoff time is set for
- each application.

**Notes:**

Note quite what we expected when we heard “single security logon”.

Entrust/PKI version 4.0 allows “true” single logon to security applications.

I have associated results with each claim, however ther were some “overall” lessons learned . . .

## LESSONS

**LEARNED**

-   The significance of the X.500 Directory.
-    “Open” Security Policy.
-   Key Recovery.
-   Significant Firewall configuration issues.

**Notes:**
1.

2.

3.

4.

All Team member considered it a successful demonstration.  Most wanted to continue testing.  I would hope that this demonstration could be picked up as a pilot, perhaps by DISA.

I know the SPOCK Program is successful because 

it is a volunteer organization!!!

What do you get from participating.

## RETURN ON

**INVESTMENT**

**  ****SYSTEM INTEGRATOR**
** ****Quick look at emerging technology**
** ****Solution strengths and weaknesses are demonstrated**
**  ****in *****THEIR***** warfighter configurations**
**  ****GOVERNMENT**
** ****Learn about and influence emerging solutions**
** ****Insight into future architectures (requirements)**
**  ****INDUSTRY**
** ****Better understands Warfighter’s needs**
** ****Rapid exposure of solution in Warfighter Architecture**

**Notes:**

These returns apply to all , not just those that participated in the Entrust demonstration.

I have presented information on our Entrust demonstration and the SPOCK Program.

To summarize. . .

## SUMMARY

**  ****SPOCK focuses on commercial INFOSEC **
**    ****solutions and emerging technologies**
**  ****SPOCK demonstrates security in legacy and**
**    ****contemporary architectures**
**  ****SPOCK “teams” to demonstrate security in**
**    ****operational architectures**
**  ****SPOCK supports development of Protection**
**    ****Profiles and Security Targets**

**Notes:**

A partial security target based on claims, input from the demonstration and Entrust documentation will be part of the SPOCK report.  Expect it to be available in September.

## QUESTIONS &

**QUESTIONS &**
**COMMENTS**

**Notes:**

I am open to questions about our Entrust Demonstration or the SPOCK Program.

## SPOCK

**CONTACTS**

**  ****SPOCK Chairman**
**	****Louis Giles, Chief V2**
**	****(410) 859-6281**
**  ****SPOCK Program Manager**
**	****Terry Losonsky****	****	****	****terryus@aol.com**
**	****(410) 859-6318****	****	****	****FAX: (410) 859-6897**
**  ****SPOCK Deputy Program Manager**
**	****MAJ Michael Davis****	****	****	****mdavis@gibraltar.ncsc.mil**
**	****(410) 859-6318****	****	****	****FAX: (410) 859-6897**
**	****http://spock.v.nsa:12080/**
**  ****SPOCK Contract Support**
**	****Larry McGinness****	****	****	****spock@coact.com**
**	****(301) 498-0150****	****	****	****FAX: (301) 498-0855**
**	****www.coact.com/spock.html**

## SECURE

- Encrypt/Decrypt
- Sign/Verify Signature

- E-mail

- Entrust

- Client

- OS

- Mail
- Server

- Entrust
-    CA

- Directory

- E-mail

- Entrust

- Client

- OS

- Mail
- Server

- CA

- Directory

- E-mail

- Entrust

- Client

- OS

- Mail
- Server

- CA

- Directory

- Internet

- Remote
- Sites

**SECURE**
**E-MAIL**

## SECURE

- Encrypt/Decrypt
- Sign/Verify Signature

- Browser

- Entrust

- Client

- OS

- Web
- Server

- Entrust
-    CA

- Directory

- Browser

- Entrust

- Client

- OS

- Web
- Server

- CA

- Directory

- Browser

- Entrust

- Client

- OS

- Web
- Server

- CA

- Directory

- Internet

- Remote
- Sites

**SECURE**
**WEB BROWZER**