# Presentation: 148711

## Future of Credential Management on the Grid

**Mary Thompson**
**DSD Department Meeting**
**Oct 16, 2005**

## PKI “package”

**Elements:**
**Diffe-Hellman public/private key cryptography**
**X.509 public key certificates**
**TLS (Transport Layer Security) protocol**
**Public/private key crypto vastly simplified key distribution for encrypted communications**
**Password/private key is known only to holder, no trusted third party is involved**
**Good for non-repudiation of digital signatures**

## X.509 Public Key Certificates

**Public certificates binding a name to a public key, signed by a trusted authority (CA)**
**Private (encrypted) keys prove identity**
**Used for authentication by relying parties who have previously established trust with the CA.**
**X.509 standards:**
**IETF RFC 2459 1999 - X.509 certificate**
**IETF RFC 3280 Apr 2002 - X.509 certificate (revised) **
**IETF RFC 3820 June 2004 - Proxy certificate profile**

## Advantages over traditional authentication methods

**No on-line 24/7 secure server needed to authenticate users.**
**Trust is established between relying parties and CA by out-of-band methods. RP has copy of CA’s public key**
**TLS use of certificates to provide authenticated, encrypted channel between users and servers.**

## Problems - Credential Management

**Security of private keys stored by naïve users on local workstation is questionable.**
**Difficult for relying party to know when a private key may have be comprised.**
**Portability of private key**
**Use of private key varies by application**
**Understanding of private/public key crypto by users.**
**What key to sign with.**
**What key to encrypt with.**

## Problems - Certificate Revocation

**CRLs**
**Relying parties need to get updates regularly**
**TLS does not check revocation out-of-the box**
**Many applications do not check for revocation**
**OCSP - Online Certificate Status Protocol**
**Requires secure on-line 24/7 server**
**Pretty new, not all CA’s provide the service**

## Solutions  

**Online credential repositories**
**Short-term certificates**
**Proxy certificates**
**EndEntity certificates generated on demand**

## Proxy Certificates

**Invented as part of GSI**
**Short-term, non encrypted private keys**
**User only types passphrase once**
**Don’t need to worry about revocation**
**Safe enough to store read-only to user**
**Created by delegation protocol which works between parties or by just one party.**
**The delegatee **
**generates a new key pair **
**Presents a certificate signing request (CSR) consisting of the new public key and a DN, and signed by the private key**
**The delegator**
**Verifies the certificate request**
**Creates a new X.509 cert, flagged as a proxy cert and signs it with the EE private key (i.e. acts as a CA)**

## Proxy Certs (cont)

**If a relying party agrees, the proxy can represent the orginal end entity**
**Proxy certs may contain a rights restriction extension**
**Standardized by IETF RFC 3820, June 2004**
**Path validation of proxy certs supported in OpenSSL 0.9.8 July 2005**

## MyProxy

**Intended to store proxy certificates (1-2 week life times)**
**Traveling Grid user could delegate a proxy to the MyProxy server before leaving home (and access to his long-term credential)**
**Could then delegate short-term (12-hrs) certs from MyProxy to other host from which he wanted to start a Globus job.**
**Also used by Grid Portals to get a certificate on behalf of a user and to renew certificates used by long running jobs**

## Kerberos CA (KCA)

**Developed at Fermi Lab to grant X.509 certificates to authorized Kerberos users.**
**Use site user registry to provide Grid usable credentials**
**Been in use for a few years.**

## Unmet needs

**Fusion Grid**
**Get credential management out of users hands**
**Decided to wrap classic MyProxy in Web scripts to allow requesting and management of long term credentials via a grid-integrated Web interface.**
**NERSC**
**Get automatic certificate generation for all their users**
**Get a handle on OTP usage**
**Pushed for MyProxy to support an on-line CA, similar in concept to KCA but not Kerberos based.**

## Extensions to MyProxy

**Storing of long term credentials**
**Originally only stored by admin interface (run as same user on same host)**
**Recently it has added a  message interface to store and retrieve long-term credentials**
**Alternative authentication schemes**
**Originally - used the  passphrase to decrypt the stored key, or established off-line trust with Portals using PKI.**
**Now has added PAM authentication, including Kerberos, OTP, system passwords,  etc. (done independently by Jim Basney and Monte)**

## Extensions to MyProxy (cont)

**Includes an on-line CA**
**Issues a limited term credential for authenticated users. (just released Monte’s work)**
**Provide mapping from user id to DN**
**Gridmap files**
**LDAP interface (pending - Monte again)**

## One Solution - FusionGridCredential repository for long-term credentials

**User goes through Web interface to register with FusionGrid.**
**Credential manager gets credential in standard way**
**Call ESNet run CA to get a certificate**
**Certificate request vetted by RA**
**CM stores credential in secure MyProxy server encrypted with user chosen passphrase **
**Users uses credential by retrieving a proxy with MyProxy-logon command. (authenticates against stored long-term credential)**
**Authorized Portals can also retrieve proxies, with or without knowing user passphrase**
**The MyProxy server + a little more user information comprises the VO’s user registry**

## Second Solution - NERSCMyProxy Online CA

**User is already entered in NERSC user base.**
**User does a MyProxy-logon to get a proxy credential.**
**MyProxy authenticates user against a PAM auth module of NERSC’s choice, e.g. OTP system.**
**MyProxy CA module maps user id to DN, via gridmap file or LDAP directory and creates limited term credential which is stored in MyProxy repository.**
**MyProxy issues proxy to user.**
**Work in progress - Steve Chan**

## Advantages of Repositories

**Eliminates need for users to securely store and manage certificates.**
**Provides a portable way for users to access certificates.**
**Long term certificates can be revoked (sort of) by removing from repository.**
**Short term certificates can ignore revocation.**
**Keys are more secure, or at least compromises are more likely to be noticed and dealt with. (all certificates revoked and/or reissued)**
**Facilitates Portal use of certificates for authentication and Grid service use.**

## Acceptance by Grid

**PMA federations  ****(CA Policy Management Authorities)**
**TAGPMA (The Americas Grid PMA)**
**EUGridPMA (European Grid)**
**APGridPMA (Asia Pacific Grid)**
**Three have now joined in International Grid Trust Federation (ITFG)**
**“****to allow scientific researchers to identify themselves to any grid resource in the world using just a single online identity.”**
**They support two certificate policies**
**Classic PKI - private key must never leave holder’s possession**
**Short-lived Credential Generation Service profile - written to accommodate KCA, will cover MyProxy CA as well.**

## My Conclusions

**Absence of on-line authentication server not very important in Grid environment.**
**Desire to use Grid certificates for non-reputable digital signatures not evident.**
**Scientists intolerant of difficult to remember certificate procedures.**
**Relying parties happier with private key security on key servers than on user’s workstations.**
**Credential managers are the wave of the future for Grids and other VO’s.**