Jim Basney's PKI Page

I use this page to keep notes and pointers about work in the area of Public Key Infrastructures (PKI) related to my projects. For a more comprehensive listing of PKI-related information, see The PKI page.

CAs | Online CAs | PKI Bridges | Standards | Online Credential Repositories | Secure Data Storage Systems | Smart Cards | Hardware Security Modules | Password-based PKI | GSSAPI | GAA-API | SAML | XKMS | Web SSO | Web Services | Grid Systems | Grid Authentication | Grid Authorization | XACML | SPKI | Conferences | Usability | SSL | Privacy | OCSP

Certification Authorities

• OpenCA
• EJBCA: J2EE CA
• Red Hat Certificate System (formerly Netscape Certificate Management System)
• Dogtag Certificate System (open source version of Red Had Certificate System)
• Globus Simple CA
• xca
• php-ca
• Protecting a Private Key in a CA Context article
• Thawte Web of Trust

Online Certification Authorities

• KX.509/KCA: Kerberized CA, issues short-lived certificates, web browser plug-ins via PKCS#11
• Simple Certificate Enrollment Protocol (SCEP): defined by Cisco and VeriSign, request certificates from a CA, PKCS#7 messages sent via HTTP to the CA, request may be authenticated out-of-band by CA operator or using a shared secred (password) previously distributed
• AT&T Online CA: short-lived certificates
• Cornell On-line Certification Authority
• MOCA: Mobile Certificate Authority for Wireless Ad Hoc Networks
• Intrusion Tolerant Password-Enabled PKI
• Omega Key Management Service: public key registration and private key escrow
• CACL NPACI CA
• Globus Certificate Service
• CAcert (wiki, assurance program, CA key protection)

PKI Bridges

• Federal Bridge CA
• SURA NMI Testbed Grid PKI Bridge CA
• Windows XP PKI Bridge Path Validation Experiment

Standards / Policies / Recommendations

• Standards:
  • RFC 3647: Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework (supersedes RFC 2527)
  • EUGridPMA Guidelines
  • TAGPMA Profiles
  • Higher Education PKI Technical Activities Group (HEPKI-TAG)
  • E-Authentication
• Repositories:
  • TERENA Academic CA Repository
• Examples:
  • DOEGrids CA

Online Credential Repositories

• SACRED: RFC 3767, Java implementation
• MyProxy
• SHEMP: Secure Hardware Enhanced MyProxy
• SLAC Virtual Smart Card
• Secure Computing Corporation Virtual Smart Card
• RSA Keon Web PassPort
• Entrust TruePass
• nCipher KeySafe
• StrongKey symmetric key management service

Secure Data Storage Systems

• CODEX
• The e-Vault

Smart Cards

• Smart Card Alliance
• JavaCard and Java Card Forum
• Open Card Framework (OCF)
• USA Federal Smart Card Site
• NIST Smart Card Standards and Research
• NIST Personal Identity Verification (PIV) Program
• Privacy and Security Threat Analysis of the Federal Employee Personal Identity Verification (PIV) Program by Paul A. Karger (IBM) in SOUPS 2006.
• Security analysis of smartcard to card reader communications for biometric cardholder authentication
• alt.technology.smartcards FAQ
• Smartcard Info Page
• report on contactless smart card security
• OpenSC
  • OpenSC: PIV
• APIs:
  • PKCS#11
    • Java PKCS#11 Reference Guide
  • Microsoft CryptoAPI
• Vendors:
  • Axalto / Schlumberger
  • Safenet
  • ActivCard
  • Gemplus
  • HID
  • Precise Biometrics
  • iButton
• Press:
  • DoD Roll-out of 2-5 million smartcards
  • NASA uses Phillips' MIFARE DESFire Contactless Smart Cards
  • Transportation Worker Identification Credential (TWIC)

Hardware Security Modules

• IBM 4758/4764
• nCipher nShield
• SafeNet Luna
• IBM embedded Trusted Platform Module (TPM) (Linux info)

Password-based PKI

• IEEE P1363.2: Password-Based Public-Key Cryptography
• Publications on Strong Password Authentication

GSSAPI

• GSSAPI-enabled OpenSSH:
  • Simon Wilkinson's patch
  • NCSA's GSI-enabled OpenSSH
• Mechglue
  • heimdal-discuss thread Nov 2001
  • NCSA distribution

Generic Authorization and Access-control API (GAA-API)

• USC home page

Security Assertion Markus Language (SAML)

• Cover Page
• OASIS page

XML Key Management Specification (XKMS)

• W3 XKMS page
• XML Key Information Services Specification (X-KISS)
• XML Key Registration Service Specification (X-KRSS)

Web Single Sign-On

• Shibboleth: inter-institutional sharing of web resources subject to access controls, uses SAML
• Pubcookie
• Web Initial Sign-on (Wisconsin site)
• Yale's Central Authentication Service (CAS)
• Microsoft Passport
• Liberty Alliance project
• Athens

Web Services

• OASIS Web Services Security (WSS) TC
• WS-Trust
  • OASIS Web Services Secure Exchange (WS-SX) TC
  • Implementations: PingSTS CredEx

Grid Computing Systems

• Globus
• UNICORE

Grid Authentication

• proxy certificates: RFC 3820
• gSOAP

Grid Authorization Systems

• gridmapdir: dynamic allocation of local unix usernames to grid users
• DynamicSessions: dynamic grid account creation
• Virtual Organization Membership Service (VOMS): manages groups, roles, ACLs
• LCAS: Local Centre Authorization Service: plug-in for VOMS
• LCMAPS: Local Credential Mapping Service
• GACL: Grid ACL library
• Slashgrid
• Java Authentication and Authorization Service (JAAS)
• Globus Toolkit Authorization Callouts

XACML

• OASIS

SPKI / SDSI

• SPKI/SDSI Certificate Documentation [Carl Ellison]
• RFC 2696: SPKI Certificate Theory
• e-speak: uses SPKI attribute certificates for delegation and trust establishment

Conferences

• PKI05

PKI Usability

• "Plug-and-Play PKI: A PKI your Mother can Use" by Peter Gutmann
• Easycert mailing list
• OASIS PKI Technical Committee
  • PKI Action Plan, February 22, 2004, Version 1.0.
  • August 2003 survey
  • Analysis of June 2003 Survey on Obstacles to PKI Deployment and Usage by OASIS PKI Technical Committee, August 2003, Version 1.0.
  • OASIS PKI Forum
  • CSRTool

SSL

• SSL Programming Guide
• SSL Documentation: includes info on loading certificates into browsers

Privacy

• "Who Goes There? Authentication Through the Lens of Privacy"

OCSP

• RFC 2560
• OCSP Requirements for Grids
• CertiVeR IGTF OCSP Responder
• OpenValidation.Org
• OGRO - The Open GRid Ocsp Java client API
• TORSEC OCSP implementation (binary only download)