implementing certpath validation lessons learned
play

Implementing CertPath Validation: Lessons Learned Steve Hanna Sun - PowerPoint PPT Presentation

Jan 10, 2024 •45 likes •155 views

Implementing CertPath Validation: Lessons Learned Steve Hanna Sun Microsystems, Inc. steve.hanna@sun.com Cert Path Validation & Building Widely needed S/MIME, TLS, IPsec, ... Very complex sonof2459 includes 18

  1. Implementing CertPath Validation: Lessons Learned Steve Hanna Sun Microsystems, Inc. steve.hanna@sun.com

  2. Cert Path Validation & Building � Widely needed � S/MIME, TLS, IPsec, ... � Very complex � son−of−2459 includes 18 certificate extensions � Validation requires 24 steps per certificate � Not including revocation and building! � Complexity causes bugs, security holes, and cost � But every feature’s required in some environment � What can we do?

  3. Possible Solutions � Simplify the standards? � Delegate Validation/Building to a Trusted Server � DPD/DPV, XKMS � Grit your teeth and write the code � Use a Library that supports Validation/Building � Getronics CML � Use a Platform that supports Validation/Building � CertPath API in J2SE TM 1.4

  4. CertPath API � Standard API for CertPath building and validation � Standardized through Java Community Process TM � Expert group: Bluestone, DSTC, Entrust, IBM, Sun, Verisign � Currently Proposed Final Draft (JSR 55) � Incorporated into Merlin (J2SE 1.4) � Will be included in future J2SE implementations � Beta 3 available from http://java.sun.com, FCS soon � Free, available for most OS’s

  5. CertPath API Features � Read/write encoded CertPaths (e.g. PKCS#7) � Validate CertPaths � Build validated CertPaths � Retrieve certs & CRLs from a directory � Abstract API supports X.509 or non−X.509 certs. PKIX−specific API also included. � Extensible. Can load multiple implementations, custom validation checks, and such at run time.

  6. Features of Sun’s Implementation � Read/write encoded CertPaths � PkiPath or PKCS#7 formats � Validate CertPaths � Compliant with draft−ietf−pkix−new−part1−08.txt � No support for CRL DP, SIA, or AIA extensions, DeltaCRL and IDP CRL extensions (all optional). � Build validated CertPaths (more info later) � Retrieve certs & CRLs from a directory � from LDAP directory or collection

  7. CertPath Building � Little analysis to date � Should you start with EE or TAs (trust anchors)? � Starting with EE (forward) better in hierarchy � Starting with TAs (reverse) better in other topologies � Name constraints crucial in non−hierarchies � Loops should be prohibited � Self−signed certs should be ignored � See NDSS ’01 paper for details

  8. Hierarchical Topology sun.com hr.sun.com cto.sun.com steve@cto.sun.com

  9. Non−Hierarchical Topology iso.int isoc.org ietf.org jcp.org example.com sun.com hr.sun.com cto.sun.com steve@cto.sun.com

  10. Lessons Learned � Implementation and interoperability testing provide surprising insights. � PKIX validation and building works! � You don’t have to implement it yourself. Use a library (like Getronics CML) or platform (like Java TM ) that implements it.

  11. URLs and Q&A � J2SE 1.4 http://java.sun.com/j2se/1.4 � NDSS ’01 paper http://www.isoc.org/isoc/conferences/ndss/01/2001 /papers/elley.pdf � Getronics CML http://www.getronicsgov.com/hot/cml_home.htm

Recommend

Lessons learned implementing the C2Sim standard in a practical exercise E.M. Bearss 1 , K.G.

Lessons learned implementing the C2Sim standard in a practical exercise E.M. Bearss 1 , K.G.

Lessons learned implementing the C2Sim standard in a practical exercise Lessons learned implementing the C2Sim standard in a practical exercise E.M. Bearss 1 , K.G. LeSueur 2 , M.J. OConnor 3 and R.F. Zinser 4 1 Software Engineer, Trideum,

176 views • 3 slides
Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

Protg 2006, July 26th, Stanford I R I S A C 1 R E C Saint-Cyr Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From Ontology Ontology Design Design Ontology Ontology Design Design Jean Andr B

371 views • 12 slides
Best practices and lessons learned in preparing and implementing an effective public communication

Best practices and lessons learned in preparing and implementing an effective public communication

Zentralanstalt fr Meteorologie und Geodynamik Best practices and lessons learned in preparing and implementing an effective public communication strategy during a nuclear emergency Dr. Gerhard Wotawa, M.A. (Intern. Rel.) ZAMG/Division Data,

232 views • 10 slides
TLS 1.3 Lessons Learned from Implementing and Deploying the Latest Protocol Nick Sullivan

TLS 1.3 Lessons Learned from Implementing and Deploying the Latest Protocol Nick Sullivan

TLS 1.3 Lessons Learned from Implementing and Deploying the Latest Protocol Nick Sullivan @grittygrease November 11, 2016 PLAY SP 0:00:00 - MENU - PAST PRESENT FUTURE Transport Layer Security Point-to-point secure

721 views • 61 slides
Lessons Learned from Implementing a Web-Based Tool for Brief Alcohol Interventions in a Large

Lessons Learned from Implementing a Web-Based Tool for Brief Alcohol Interventions in a Large

Lessons Learned from Implementing a Web-Based Tool for Brief Alcohol Interventions in a Large Integrated Health Care System Ken Weingardt, Ph.D., Michael A. Cucciare, PhD Paula Wilbourne, PhD, John S. Baer, PhD Veterans Health Administration

418 views • 27 slides
Meeting Orientation Slide If you are having any technical problems with the webinar please

Meeting Orientation Slide If you are having any technical problems with the webinar please

Implementing Project Lazarus in North Carolina: Lessons Learned From the Project Lazarus Model A Two Part Webinar on Lessons Learned from Implementing Project Lazarus in North Carolina A Clinical and Community Based Intervention to Prevent

426 views • 15 slides
Lessons Learned from Implementing Privacy- Preserving Protocols for Smart Meters Benessa Defend

Lessons Learned from Implementing Privacy- Preserving Protocols for Smart Meters Benessa Defend

Lessons Learned from Implementing Privacy- Preserving Protocols for Smart Meters Benessa Defend Real World Crypto, London January 9, 2015 - Confidential - 1 In Collaboration with Klaus Kursawe George Danezis Markulf

570 views • 23 slides
Native or External? Lessons learned implementing cryptography for VisualWorks Martin Kobetic

Native or External? Lessons learned implementing cryptography for VisualWorks Martin Kobetic

Native or External? Lessons learned implementing cryptography for VisualWorks Martin Kobetic Cincom Smalltalk Engineering ESUG 2011 Let's implement SSL! DES, MD5, SHA, RSA, DSA, RC4, X.509, ASN.1, DER, ... * SSL 3.0, RSA, DES, RC4, basic

369 views • 17 slides
Lessons learned implementing ChatOps (DevOps + messaging) Corey Hulen / Co-founder and CTO,

Lessons learned implementing ChatOps (DevOps + messaging) Corey Hulen / Co-founder and CTO,

Lessons learned implementing ChatOps (DevOps + messaging) Corey Hulen / Co-founder and CTO, Mattermost, Inc. March 2020 What is ChatOps? ChatOps is a collaborative, conversation- centric way of working that brings people, discussions, bots,

390 views • 27 slides
Construction Manager Perspective: Lessons Learned Implementing the EPA Superfund Job Training

Construction Manager Perspective: Lessons Learned Implementing the EPA Superfund Job Training

Construction Manager Perspective: Lessons Learned Implementing the EPA Superfund Job Training Initiative (SJTI) Tommy Jordan, P.G. Project Manager AGENDA SJTI Program Overview Implementation

659 views • 27 slides
Implementing a Simple SMF Service: Lessons Learned OSDevCon09, October 30th, 2009 Constantin

Implementing a Simple SMF Service: Lessons Learned OSDevCon09, October 30th, 2009 Constantin

Implementing a Simple SMF Service: Lessons Learned OSDevCon09, October 30th, 2009 Constantin Gonzalez Principal Field Technologist Sun Microsystems Germany Goals Make ZFS pool hygiene a 1-click experience Implement a simple SMF

582 views • 39 slides
Lessons Learned from Implementing Response Propensity Models in the 2013 Census Test Gina

Lessons Learned from Implementing Response Propensity Models in the 2013 Census Test Gina

Lessons Learned from Implementing Response Propensity Models in the 2013 Census Test Gina Walejko, PhD U.S. Census Bureau, Center for Survey Measurement The views expressed on statistical, methodological, technical, or operational issues are

226 views • 18 slides
National Council for Behavioral Health Prep for Success: Lessons Learned in Implementing Models

National Council for Behavioral Health Prep for Success: Lessons Learned in Implementing Models

National Council for Behavioral Health Prep for Success: Lessons Learned in Implementing Models for Early Intervention in Psychosis In partnership with the National Alliance on Mental Illness Thursday, June 5, 2014 2:00 3:30pm EST

569 views • 55 slides
Implementing Bike Share Lessons Learned, Challenges, and Successes Bren Hall, Room 1424

Implementing Bike Share Lessons Learned, Challenges, and Successes Bren Hall, Room 1424

Implementing Bike Share Lessons Learned, Challenges, and Successes Bren Hall, Room 1424 Tuesday, July 9th, 10:05am 11:20am Mo Lovegreen, Director, Campus Sustainability, UC Santa Barbara Partnerships and Process Partnering Agencies on the

718 views • 34 slides
Lessons Learned in Developing and Implementing a Quality Rating System in New York State

Lessons Learned in Developing and Implementing a Quality Rating System in New York State

Lessons Learned in Developing and Implementing a Quality Rating System in New York State Medicaid Managed Care Lindsay Cogan, PhD, MS Director, Division of Quality Measurement Office of Quality and Patient Safety New York State Department of

176 views • 16 slides
Developing and implementing provincial Alzheimer Strategies Lessons learned from the Quebec

Developing and implementing provincial Alzheimer Strategies Lessons learned from the Quebec

Developing and implementing provincial Alzheimer Strategies Lessons learned from the Quebec Alzheimer Plan Howard Bergman, MD, FCFP, FRCPC Chair, Department of Family Medicine Professor of Family Medicine, Medicine and Oncology The Dr. Joseph

710 views • 31 slides
High Speed Turbulence Working Group Lessons Learned from CFD Validation Study of Protuberance

High Speed Turbulence Working Group Lessons Learned from CFD Validation Study of Protuberance

https://ntrs.nasa.gov/search.jsp?R=20110011318 2018-05-22T01:56:49+00:00Z High Speed Turbulence Working Group Lessons Learned from CFD Validation Study of Protuberance Heating May 3, 2011 Brandon Oliver brandon.oliver-1@nasa.gov EG3: Applied

247 views • 10 slides
Programs and Practices In this document, we summarize the lessons learned from the field as

Programs and Practices In this document, we summarize the lessons learned from the field as

LESSONS FROM THE FIELD: Implementing Behavioral Health Equity Programs and Practices In this document, we summarize the lessons learned from the field as communities and organizations seek to implement programs such as the National Standards

327 views • 6 slides
Lessons learned implementing patient decision support in routine care Dominick L. Frosch, PhD

Lessons learned implementing patient decision support in routine care Dominick L. Frosch, PhD

Lessons learned implementing patient decision support in routine care Dominick L. Frosch, PhD How do we engage patients in making choices about their care? Partners in Medical Decision Making Prescription Strength Information for Better

491 views • 9 slides
Online sales: lessons learned 29 May 2020 www.globaldistributorscollective.org The GDC is

Online sales: lessons learned 29 May 2020 www.globaldistributorscollective.org The GDC is

Online sales: lessons learned 29 May 2020 www.globaldistributorscollective.org The GDC is hosted by Practical Action, alongside implementing partners Hystra and BoP Innovation Center. Agenda 1. Objectives and scene-setting 2. Different online

463 views • 17 slides
DM training program in Belgium: Lessons Learned after 3 editions Marie-Claire Lambrechts,

DM training program in Belgium: Lessons Learned after 3 editions Marie-Claire Lambrechts,

Implementing an international DM training program in Belgium: Lessons Learned after 3 editions Marie-Claire Lambrechts, Franois Perl, Saskia Decuman, Laurence Paquier, Lode Godderis European Conference for Socio Professional Rehabilitation

511 views • 21 slides
Institutionalizing Lessons Learned October 25, 2006 Loren Plisco Region II Background

Institutionalizing Lessons Learned October 25, 2006 Loren Plisco Region II Background

Institutionalizing Lessons Learned October 25, 2006 Loren Plisco Region II Background SEP 2002 Davis-Besse Lessons Learned Task Force AUG 2004 - Effectiveness Review Lessons Learned Task Force JAN 2005 - EDO Charters

269 views • 22 slides
OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned Jobsite Safety and Health Inspections/Audits better known as; PAPER WORK You hate it, Your safety director requires it, OSHA loves it, Does it

926 views • 35 slides
3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the Spanish Registry: Lessons Learned from the Registries o Is It possible (and worthy) to do a national registry? Lessons learned from the o

1.16k views • 43 slides

More recommend