pki
Email PKI | Feide RnD
@import "/modules/cck/content.css";
@import "/modules/node/node.css";
@import "/modules/system/defaults.css";
@import "/modules/system/system.css";
@import "/modules/user/user.css";
@import "/modules/cck/fieldgroup.css";
@import "/modules/comment/comment.css";
@import "/themes/feide/style.css";
@import "/files/color/feide-fcb1a577/style.css";
@import "/themes/feide/print.css";
@import "/themes/feide/fix-ie.css";
Navigation
Software
Federated software
Attributes
eduroam
Federations
Mailing lists
Documents
Slides
Federated login
Feide RnD
My account
Contact
feide.no
Home
Email PKI
23 July, 2007 - 23:00 — andreas@uninett.no
Abstract
Describes an idea of how to integrate Feide or other federated systems with email PKI. How can you use Feide to solve the key distribution problem of web of trust (PGP).
Download documentDownload document in PDF formatEmail PKI and federated identity managementAndreas Г…kre SolbergTue Jul 24 09:32:36 2007Table of ContentsIntroductionThe Trusted Introducer ServiceAbout the ideaIntroductionEvery day people send sensitive information in unencrypted e-mail,
and they make important decisions based on information received in
unsigned e-mail, frequently sent unencrypted through open wireless
networks, SMTP proxies, the SMTP server
of a home DSL company, or through a hotel network.
Unencrypted e-mails are stored on a company IMAP server
and at laptop hard drives. Sensitive information may be e.g. personal
secrets, business secrets, passwords, and personal health data. There are mainly two technologies available for e-mail encryption
and digital signatures: PGP
(Pretty Good Privacy) and S/MIME. In this
document we will look at PGP. Common to all
PKI systems is that they require an initial trust
relationship between participating entities. Before person A can send an
encrypted e-mail to person B, A must possess B’s public key, and must have
validated B’s ownership of the key through an external channel. Initial
trust may be established by personal contact, where person A and B meet to
exchange key fingerprints (hashed values) of their
public keys. This method scales poorly to establish trust between a group
of people: A group of ten people communicating through a mailing-list will
require 9! (362 880) key signature exchanges to establish a mesh of trust.
To ease this process PGP offers the functionality of
trusted introducers: If A trusts B as an introducer,
and B trusts C, then a trust relationship is dynamically created between A
and C.The Trusted Introducer ServiceTrusted introducers are not necessarily persons; they can be any
entity with a key pair. As we will see, this allows us to exploit
established AAIs (Authentication and Authorization
Infrastructures), in the world of e-mail cryptography.Many European countries are now deploying AA infrastructures for
educational users and services. AAIs are trust networks, with local
authorities responsible for authenticating local users. These authorities
are often called Asserting Parties or Identity Providers. Initially, AAIs
were deployed on a per-country basis and limited to the educational
community. Currently, efforts are made to inter-connect the national AAIs
to a European confederation, in a GÉANT2 project called eduGAIN. We also
see examples of national federations considering connections to commercial
services and Identity Providers. With a European-wide federation, the same
trusted introducer can be used for all users in the
participating countries. AAI commonly support Web Single Sign-On. Hence a web-based
Introducer service is preferred, to act as a trusted
introducer for e-mail cryptography.A PGP public key contains a user ID string, which should include the
full name of the user and the users e-mail address. The
Introducer must validate the name and e-mail address in the
user ID field to establish the trust between a person and a PGP public
key. So, the Introducer will obtain the name
and e-mail address of the user from the Identity Provider. After ensuring
the relationship between the user and the public key, the
Introducer uses its own private key to sign the user’s
public key, and then publishes the signature to a keyserver. All users
that have added the Introducer as a
trusted introducer, and are configured to retrieve
keys and signatures from the given keyserver, will automatically establish
trust with all users of the service. FigureВ 1.В Architecture of the Introducer ServiceBelow follows a typical scenario where a user make use of
the Introducer service. In the scenario the
user is assumed to already have a PGP key pair.The user downloads the Introducer’s
public key and configures the key as a trusted
introducer in the PGP key store.The Introducer initiates a web Single
Sign-On procedure with the user’s Identity Provider. The user enters
her credentials. If authentication is successful, the Identity
Provider delivers to the Introducer an
authentication assertion and the required attributes: full name and
e-mail address.The Introducer asks the user to paste
an ASCII encoded version of her public key in an input field, or
alternatively upload the public key binary version.The Introducer compares the user ID
string with the full name and e-mail address obtained from the
Identity Provider. If they match, the service may proceed.This step is optional but recommended: As an extra verification,
the Introducer sends a verification URL in
an encrypted e-mail to the user. This ensures that the user is
actually holding the private key corresponding to the particular
public key and has access to the particular e-mail account. After the
user clicks the verification URL in the encrypted e-mail,
the Introducer proceeds to the next
step.The Introducer signs the public key
with its own private key. Next, it uploads the signature to a publicly
accessible keyserver. The Introducer may
provide keyserver functionality itself, or use an arbitrary keyserver
accessible to all relevant users. The
Introducer may even upload the signature to multiple
keyservers.To establish a full mesh of trust between users in a group, each
user goes through the above steps once. When a user receives an e-mail
from a previously unknown sender, PGP can be configured to ask the
keyserver for a key matching the e-mail address of the sender. It will
then also retrieve the Introducer’s signature,
and hence it will dynamically establish the trust relationship to the
sender of the e-mail.The service outlined above is described in the context of e-mail
cryptography, but the method is generic and can be used for most
situations where users and PGP are included. Even though the method is
specific to PGP, the concept can be re-used in other PKI solutions. In
example a certificate authority may use the AAI to authenticate users
before issuing S/MIME certificates.About the ideaThis document was submitted to TNC 2007 approval December 2006.
The document was later published on the Feide RnD blog July 2007. Feide has not
yet implemented any proof of concept service. If you have thoughs,
comments or plans for implementation, please contact the
author.
Email
PKI
SAML 2.0
Login to post comments
2007-2008 © UNINETT
разделы
тонировка стекол
эмжс
аденома предстательный железа
lida
очки ночной видение
эдас-134 аденома предст.ж-зы
пп-пленка
эмжс
ppg краска
промальп
схема зал вахтангова
5440.15 (крышка)
купить nokia 9300i
покраска рчв
snr
слимент лифт
поглощение радиоволна
конвейер
охота зверь
inerta краска
пвс
время кострома
герб область
управление иваново
комплексный сайт
купить букмекерский линия
билет russia music awards
рассылка база данный
купить автотехнику
peg perego venezia
схема зал вахтангова
флеш презентация
купить элеваторный узел
доставка суша
съемный зубной протез
фейрверк вечеринка
покраска аэротенк
отбеливание белье
рак пищевод
корпаративные праздник
mobilux
фотопечать
диспетчеризация
тонировка стекол
архитектурный визуализация
витрина подогреваемый
купить айсбест
анимация 3d график
персонализация карта
этнический психология
концентрирование кислорода
договор суррогатный мать
колодец канализационный пластиковый
рак простата
красный площадь собор
зубной протез
сервис холодильник
архыз
тренировка память
тренировка память
эрозия шейка матка
sharp ar-m205
обрезание
поливомоечная машина
ивановец
вскрытие авто
винный холодильник
iridium motorola
дмитрий шумок
проект электропроводка
избавиться спам
краска двухкомпонентный
масло форма
доставка ноутбук
акриловый вставка вкладыш
меховой холодильник
pki