properly.
6.4. Protecting Against Denial of Service with Key Generation
As discussed in Section 2.3, one of the motivations for Proxy
Certificates is to allow for dynamic delegation between parties. This
delegation potentially requires, by the party receiving the
delegation, the generation of a new key pair which is a potentially
computationally expensive operation. Care should be taken by such
parties to prevent another entity from performing a denial of service
attack by causing them to consume large amount of resource doing key
generation.
A general guideline would always to perform authentication of the
delegating party to prevent such attacks from being performed
anonymously. Another guideline would be to maintain some state to
detect and prevent such attacks.
6.5. Use of Proxy Certificates with a Central Repository
As discussed in Section 2.7, one potential use of Proxy Certificates
is to ease certificate management for end users by storing the EEC
private keys and certificates in a centrally managed repository.
When a user needs a PKI credential, the user can login to the
repository using name/password, one time password, etc. and the
repository would then delegate a PC to the user with proxy rights,
but continue to protect the EEC private key in the repository.
Care must be taken with this approach since compromise of the
repository will potentially give the attacker access to the long-term
private keys stored in the repository. It is strongly suggested that
some form of hardware module be used to store the long-term private
keys, which will serve to help prevent their direct threat though it
may still allow a successful attacker to use the keys while the
repository is compromised to sign arbitrary objects (including Proxy
Certificates).
7. IANA Considerations
IANA has established a registry for policy languages. Registration
under IETF space is by IETF standards action as described in [i8].
Private policy languages should be under organizational OIDs; policy
language authors are encouraged to list such languages in the IANA
registry, along with a pointer to a specification.
OID Description
--- -----------
1.3.6.1.5.5.7.21.1 id-ppl-inheritALL
1.3.6.1.5.5.7.21.2 id-ppl-independent
8. References
8.1. Normative References
[n1] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[n2] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509
Public Key Infrastructure Certificate and Certificate
Revocation List (CRL) Profile", RFC 3280, April 2002.
8.2. Informative References
[i1] Butler, R., Engert, D., Foster, I., Kesselman, C., and S.
Tuecke, "A National-Scale Authentication Infrastructure",
IEEE Computer, vol. 33, pp. 60-66, 2000.
[i2] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0", RFC
2246, January 1999.
[i3] Farrell, S. and R. Housley, "An Internet Attribute
Certificate Profile for Authorization", RFC 3281, April 2002.
[i4] Foster, I., Kesselman, C., Tsudik, G., and S. Tuecke, "A
Security Architecture for Computational Grids", presented at
Proceedings of the 5th ACM Conference on Computer and
Communications Security, 1998.
[i5] Foster, I., Kesselman, C., and S. Tuecke, "The Anatomy of the
Grid: Enabling Scalable Virtual Organizations", International
Journal of Supercomputer Applications, 2001.
[i6] Kohl, J. and C. Neuman, "The Kerberos Network Authentication
Service (V5)", RFC 1510, September 1993.
[i7] Neuman, B. Clifford, "Proxy-Based Authorization and
Accounting for Distributed Systems", In Proceedings of the
13th International Conference on Distributed Computing
Systems, pages 283-291, May 1993.
[i8] Narten, T. and H. Alvestrand. "Guidelines for Writing an IANA
Considerations Section in RFC", RFC 2434, October 1998.
9. Acknowledgments
We are pleased to acknowledge significant contributions to this
document by David Chadwick, Ian Foster, Jarek Gawor, Carl Kesselman,
Sam Meder, Jim Schaad, and Frank Siebenlist.
We are grateful to numerous colleagues for discussions on the topics
covered in this paper, in particular (in alphabetical order, with
apologies to anybody we’ve missed): Carlisle Adams, Joe Bester, Randy
Butler, Keith Jackson, Steve Hanna, Russ Housley, Stephen Kent, Bill
Johnston, Marty Humphrey, Sam Lang, Ellen McDermott, Clifford Neuman,
Gene Tsudik.
We are also grateful to members of the Global Grid Forum (GGF) Grid
Security Infrastructure working group (GSI-WG), and the Internet
Engineering Task Force (IETF) Public-Key Infrastructure (X.509)
working group (PKIX) for feedback on this document.
This work was supported in part by the Mathematical, Information, and
Computational Sciences Division subprogram of the Office of Advanced
Scientific Computing Research, U.S. Department of Energy, under
Contract W-31-109-Eng-38 and DE-AC03-76SF0098; by the Defense
Advanced Research Projects Agency under contract N66001-96-C-8523; by
the National Science Foundation; and by the NASA Information Power
Grid project.
Appendix A. 1988 ASN.1 Module
PKIXproxy88 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
proxy-cert-extns(25) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
-- IMPORTS NONE --
-- PKIX specific OIDs
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
-- private certificate extensions
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- Locally defined OIDs
-- The proxy certificate extension
id-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pe 14 }
-- Proxy certificate policy languages
id-ppl OBJECT IDENTIFIER ::= { id-pkix 21 }
-- Proxy certificate policies languages defined in
id-ppl-anyLanguage OBJECT IDENTIFIER ::= { id-ppl 0 }
id-ppl-inheritAll OBJECT IDENTIFIER ::= { id-ppl 1 }
id-ppl-independent OBJECT IDENTIFIER ::= { id-ppl 2 }
-- The ProxyCertInfo Extension
ProxyCertInfoExtension ::= SEQUENCE {
pCPathLenConstraint ProxyCertPathLengthConstraint
OPTIONAL,
proxyPolicy ProxyPolicy }
ProxyCertPathLengthConstraint ::= INTEGER
ProxyPolicy ::= SEQUENCE {
policyLanguage OBJECT IDENTIFIER,
policy OCTET STRING OPTIONAL }
END
Authors’ Addresses
Steven Tuecke
Distributed Systems Laboratory
Mathematics and Computer Science Division
Argonne National Laboratory
Argonne, IL 60439
Phone: 630-252-8711
EMail: tuecke@mcs.anl.gov
Von Welch
National Center for Supercomputing Applications
University of Illinois
EMail: vwelch@ncsa.uiuc.edu
Doug Engert
Argonne National Laboratory
EMail: deengert@anl.gov
Laura Pearlman
University of Southern California, Information Sciences Institute
EMail: laura@isi.edu
Mary Thompson
Lawrence Berkeley National Laboratory
EMail: mrthompson@lbl.gov
Full Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.