security-devroom

Download

security-devroom@lists.fosdem.org

December 2011

1 discussions

[security-devroom] [Talk/Demo Submission] Dogtag Certificate System (open source PKI)
by Kashyap Chamarthy 04 Feb '12

04 Feb '12

Heya, Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits) http://www.opensc-project.org/opensc/wiki/FOSDEM2012 Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery. The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS) Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.) Affiliation/Bio: ---------------- I'm Kashyap Chamarthy, a test engineer at Red Hat. I help test open source Identity and Security(PKI) technologies[2][3]. I also test and deploy a lot of upstream Linux(KVM based) virtualization as part of my lab infrastructure. Looking ahead to learn some finer details about open-source crypto at FOSDEM and meet some cool folks. [1] http://kashyapc.fedorapeople.org/dogtag-pki/ [2] http://pki.fedoraproject.org [3] http://freeipa.org

4 5