RE: Something Stronger than a Passphrase? (UNCLASSIFIED)
Classification: UNCLASSIFIED
Caveats: NONE
Thanks Daniel,
I think this is a very good paper. It seems to focus on the MyProxy
server as a CA. But (trying to exercise my newly forming understanding),
I see that it need not be if I have already put a proxy credential on
the MyProxy server. The OTP could be used to get subordinate proxy
credentials for my own use. So relying parties need not know, a priori,
of the existence of this MyProxy server.
But relying parties would seem to have to understand the difference
between CA certs, end entity certs and proxy certs, and understand
whether to check the revocation status of each.
Does anyone know whether any commercial relying party products
understand, will not reject and will not require the revocation status
of proxy certificates even if they require status of the longer term
certificates in the chain?
PKI folks tend to think only CAs should be able to sign certs. Does
anyone know whether there is any problem with NIST/FIPS-compliance if
proxy certs are accepted by a relying party product or system? (I hope
not. I think we need this.)
Thanks, again
> -----Original Message-----
> From: owner-myproxy-users@ncsa.uiuc.edu
> [mailto:owner-myproxy-users@ncsa.uiuc.edu] On Behalf Of Daniel Clark
> Sent: Tuesday, April 10, 2007 4:31 PM
> To: myproxy-users@ncsa.uiuc.edu
> Subject: Re: Something Stronger than a Passphrase? (UNCLASSIFIED)
>
> On 4/10/07, Jim Basney <jbasney@ncsa.uiuc.edu> wrote:
> > Friedrichs, Paul D CTR DISA PEO-IAN
> <Paul.Friedrichs.ctr@disa.mil> wrote:
> > > I am *very* interested in deploying MyProxy on a large scale,
> >
> > Great!
> >
> > > but I am
> > > concerned about the possibility of a
> phishing/pharming-like attack
> > > to capture the passphrase passed from the prospective
> proxy to what
> > > it thinks is the MyProxy server during the get process.
>
> If you haven't run across it yet, this paper is a good read
> that covers some of these issues, specifically the use of
> One-Time Passwords (OTP) with MyProxy:
>
> Simplifying Public Key Credential Management Through Online
> Certificate Authorities and PAM
> http://middleware.internet2.edu/pki06/proceedings/chan-pam.pdf
>
> --
> Daniel Clark # http://dclark.us # http://opensysadmin.com
>
Classification: UNCLASSIFIED
Caveats: NONE