Key Management Death Match? Marc Massar, CISSP, NSA-IAM DEEPSEC - PowerPoint PPT Presentation

Key Management Death Match? Marc Massar, CISSP, NSA-IAM DEEPSEC IDSC2009 Competing KM Standards Technical Deep Dive

Introduction 2  The Problem – Why So Many Key Management Products?  More Problems – Interoperability  The Contenders  Details of the Standards/Protocols 11/19/2009

3

Click icon to add picture Click icon to add picture So Many Keys, So Little Time 4 11/19/2009

The Problem – The Many Uses of Crypto 5 Enterprise Cryptographic Environments Collaboration & File Server Portals Content Mgmt Disk Production Systems Arrays Backup Database LAN VPN WAN System Replica Backup Disk Enterprise eCommerce Applications Applications CRM Business Backup Staging Analytics Tape Dev/Test Email Obfuscation Key Key Key Key Key Managemen Managemen Managemen Managemen Managemen t System t System t System t System t System Key Key Key Managemen Managemen Managemen t System t System t System 11/19/2009

And More – Interoperability 6 Enterprise Cryptographic Environments Collaboration & File Server Portals Content Mgmt Disk Production Systems Arrays Backup Database LAN VPN WAN System Replica Backup Disk Enterprise eCommerce Applications Applications CRM Business Backup Staging Analytics Tape Dev/Test Email Obfuscation Disparate, Often Proprietary Protocols Key Key Key Key Key Managemen Managemen Managemen Managemen Managemen t System t System t System t System t System Key Key Key Managemen Managemen Managemen t System t System t System 11/19/2009

And More – The Many Uses of Crypto 7 - Certificate - Symmetric - Asymmetric - Other Client Server Network Storage Web System Network Encrypted Encrypted Client Data Encryption Encryption (SSL Database Database Protection (EFS) Management Accelerators) Management Management Secure Middleware and Router Router Encrypted T Encrypted T ape ape Communications App. Server Encryption Encryption Key Key (Outlook) Management Management Management Management Management Strong Auth for Remote Mainframe Mainframe Firewalls Firewalls NAS NAS Access (VPN) Disk Encryption Disk Encryption SSH SSH Switches Switches SANS SANs (BitLocker) (BitLocker) Management Management Wireless Wireless Encryption Encryption PGP PGP Wireless Wireless Offline Storage Offline Storage Management Management … … … … 11/19/2009

Encryption is Business Critical 8  You don’t encrypt worthless information – you only encrypt the most important information  Encryption Impacts Your Business Processes!  It Matters Who Encrypts…And Matters More Who Decrypts!  Value Transfer from Data to Keys 11/19/2009

Click icon to add picture Click icon to add picture The Contenders 9 11/19/2009

The Contenders – KMIP 10  Key Management Interoperability Protocol Round 1 – KMIP  …will develop specification(s) for the interoperability of KM services with KM clients…will address anticipated customer requirements for KMIP is an open key lifecycle management (generation, refresh, distribution, tracking standard of use, life-cycle policies including states, archive, and destruction), backed by key sharing, and long-term availability of crypto objects of all types… OASIS with members  In Scope – Just about everything including IBM, EMC/RSA,  Out of Scope – Implementation and Thales, LSI, framework details NIST, SafeNet, and quite a few more. KMIP came out of the IEEE 1619.3 effort 11/19/2009

The Contenders – IEEE 1619.3 11  1619.3 – A Sub-Committee of 1619 Round 2 - IEEE 1619.3 Working Group Formed as a  …standard defines methods for the storage, management, and sub- distribution of cryptographic keys used for the protection of stored committee of data. This standard augments existing KM methodologies to IEEE 1619 address issues specific to cryptographic protection of stored data. SISWG This includes stored data protected by compliant implementations (Security in of other standards in the IEEE 1619 family . Storage  In Scope – Protection of stored data Working Group ). Members (interfaces, methods, and algorithms) include Cisco,  Out of Scope – Transport Encryption, non- EMC/RSA, LSI, Vormetric, and storage use cases others. 11/19/2009

The Contenders - EKMI 12 Round 3 –  Enterprise Key Management Infrastructure EKMI  …TC will create use-case(s) that describe how and where the protocols it intends to create, will be used Another OASIS  …TC will define symmetric key management protocols… committee.  …ensure cross-implementation interoperability, the TC will create a This one test suite…will allow different implementations of this protocol to be formed before certified… KMIP and includes  …TC will provide guidance on how a symmetric key-management members from infrastructure may be secured using asymmetric keys… Red Hat, CA,  …in conjunction with other standards organizations that focus on Wells Fargo, disciplines outside the purview of OASIS, the TC will provide input on PayPal, and how such enterprise KM infrastructures may be managed… PrimeKey.  …conduct other activities that educate users…  In Scope – All symmetric secrets secured using the defined KM Infrastructure  Out of Scope – Asymmetric KM, some implementation details 11/19/2009

The Contenders – IETF KeyProv 13 Round 4 – IETF  Provisioning of Symmetric Keys KeyProv Provisioning of  …to define protocols and data formats necessary Symmetric Keys. This committee has been for provisioning of symmetric cryptographic keys inactive and active again recently and has and associated attributes...consider use cases participation from NIST, ActivIdentity, related to use of Shared Symmetric Key T okens. and others. Released Other use cases may be considered for the DSKPP – Dynamic Symmetric Key purpose of avoiding unnecessary restrictions in Provisioning Protocol and PSKC – Portable the design and ensure…future extensibility. Symmetric Key Container  In Scope – Provisioning of Symmetric keys (think existing devices)  Out of Scope – Asymmetric keys, specific implementations 11/19/2009

Click icon to add picture Click icon to add picture Sizing Up the Competition 14 11/19/2009

KMIP Overview 15  Community Draft Level – version 1.0  Binary Protocol  TTLV – T ag T ype Length Value  Standard defines – Objects, Attributes, and Operations  Objects – Base Objects like Key Block, Key Value, Key Wrapping Data  Objects – Managed Objects like Certificates, Keys, Key parts, template data  Attributes – Identifier, State, Usage Limits, Algorithm, Length, Issuer, Application data  Operations – Create, Register, Re-Key, Derive, Get, Modify Attributes, Activate, Revoke, Destroy  List not all inclusive 11/19/2009

IEEE 1619.3 Overview 16  Draft 7 August 2009 – Probably a draft 8 soon  Defines a KM architecture model, KM Conceptual model, Lifecycle model, KM Sequence models, Object models, and Operation models  These models are all specific to “data at rest”  Does NOT define a message between actors  Proposed adoption of KMIP binary protocol for communication between actors  Defines Key naming extensively – global uniqueness  Also calls for XML message not yet defined…likely to adopt something that one of the other committees proposes (EKMI, IETF, or XML from KMIP) 11/19/2009

EKMI Overview 17  SKSML – Symmetric Key Services Markup Language 1.0 PR02 Draft 8  Mobile – SKSML available as well  Committee defines not only the semantics of symmetric key exchange (XML – SKSML) but also the components required to make that exchange secure  SKMS, SKS, SKCL, uses PKI as the trust mechanism for key exchange  Very well defined set of Requests/Responses to cover multiple use cases 11/19/2009

IETF KeyProv Overview 18  Leverages RFC4758 – CT-KIP (Cryptographic T oken Key Initialization Protocol)  DSKPP – 1.0 draft 9  PSKC – 1.0 draft 4  Symmetric Key Format doc – 1.0 draft 6  Does not define an architecture per se, but does outline the use cases around provisioning keys to Internet accessible cryptographic systems  Covers typical Client – Server interactions  Defines “entities” that are actors in the use cases  DSKPP allows for 2-pass and 4-pass messages between client and server 11/19/2009

Click icon to add picture Click icon to add picture The Messages 19 11/19/2009

Message Layout – KMIP 20 Get Unique identifier Unique … operation 04 4 0000000A 06 24 1f165d65-cbbd-4bd6-9867-80e0b390acf9 Identifier tag type length value tag type length value Tag Type Length Value Attribute Structure <varies> Tag Type Length Value Attribute String <varies> “Application Specific ID” Name Attribute Integer 4 2 Index Attribute Structure <varies> Tag Type Length Value Value App. String <varies> “ssl” Name App. String <varies> “www.example.com” ID 11/19/2009