January 2012 - security-devroom

[security-devroom] [Talk/Demo Submission] Dogtag Certificate System (open source PKI)
by Kashyap Chamarthy 04 Feb '12

04 Feb '12

Heya, Here is my talk/demo submission for "Hardware Security and Cryptography" room at Fosdem. I also added it to the below wiki (I'd prefer to do a demo if time permits) http://www.opensc-project.org/opensc/wiki/FOSDEM2012 Abstract for 'Dogtag Certificate System': -------------------------------------------------- This talk gives a brief overview of Dogtag Certificate System, an open-source and open-standards based scalable PKI(public-key infrastructure) solution. It lets you manage digital certificate life cycle -- common operations like certificate issuance, revocation, retrieval, renewal, manage Certificate Revocation Lists, certificate status checking using OCSP, key archival/recovery. The talk also provides a deployment overview of different configurable subsystems like CA(Certificate Authority) -- this is the core part of certificate system which handles basic certificate management operations. Other subsystems include DRM(data recovery manager) -- which is used for 'key' archival and recovery; OCSP(online certificate status protocol) -- for checking whether a certificate is valid. RA(Registration Authority) -- for locally generating and submitting certificate requests(and validate them) effectively reducing load on CA. There are couple of other subsystems for token management (TKS/TPS) Demonstration: ------------------- If possible, I'd also prefer to show a quick demo of configuring different subsystems like CA, KRA(Key Recovery Archival), OCSP, RA(Registration Authority) using virtual machines on my laptop with the current upstream dogtag pki . This would hopefully be useful for sys. admins trying to deploy an enterprise class PKI. (I'd be using some test scripts[2], but, I may use slightly updated scripts at that time of demo.) Affiliation/Bio: ---------------- I'm Kashyap Chamarthy, a test engineer at Red Hat. I help test open source Identity and Security(PKI) technologies[2][3]. I also test and deploy a lot of upstream Linux(KVM based) virtualization as part of my lab infrastructure. Looking ahead to learn some finer details about open-source crypto at FOSDEM and meet some cool folks. [1] http://kashyapc.fedorapeople.org/dogtag-pki/ [2] http://pki.fedoraproject.org [3] http://freeipa.org

4 5

Re: [security-devroom] [FOSDEM] Smartcard workshop at FOSDEM 2012
by Jean-Michel Pouré - GOOZE 01 Feb '12

01 Feb '12

Le mardi 31 janvier 2012 à 11:50 +0100, Wouter Simons a écrit : > on a personal note :) > is there any oportunity to register for this work-shop or is it first > come first served ? You are right. Last year, we donated 100 smartcards at FOSDEM. People rushed in the room and some left immediately. As a result 50% of the audience had no smartcard. To avoid this situation, there are 3 different situations: 1) You may register online for a free ePass2003: http://www.gooze.eu/feitian-epass-2003-free-software-developer-kit Indicate "FOSDEM 2012" during checkout. Give your real name and address as a normal checkout. You only need to pick-up your token at FOSDEM, on first day (Saturday) or second day (Sunday) in the dev romm. I will be sitting in front of the room with OpenSC hackers. 50 ePass2003 will be reserved this way. First in, first served. 2) You may receive a free ePass2003 during the smartcard workshop. 50 additional ePass2003 will be available for the smartcard workshop audience. You will have to register writing your name on a paper. We wan to avoid people picking-up the ePass2003 and leaving immediately. So that the audience can hack around the ePass2003 during the workshop. 3) Free software kits If you are taking part in a free software project and would like to implement security features around hardware tokens, GOOZE ***always*** donates the epass2003. Just register on this page and we will ship to your address: http://www.gooze.eu/feitian-epass-2003-free-software-developer-kit Make a full description of your token. We always verify information, even looking at source code before shipping a free token. This usually takes 24/48 hours before your order is validated or rejected. The reason why we donate the ePass2003 to free software communities is that until recently tokens were very expensive and exotic hardware. Donating a token is a first step before people discover this ***proven*** technology. Hope this helps. Kind regards, -- Jean-Michel Pouré - Gooze - http://www.gooze.eu

5 11

[security-devroom] Smartcard workshop at FOSDEM 2012
by Jean-Michel Pouré - GOOZE 31 Jan '12

31 Jan '12

Dear all, Just a few information about the smartcard workshop: http://fosdem.org/2012/schedule/event/smartcard_workshop The workshop is intended for people interested in discovering smartcards, security tokens and hardware cryptography. It will be based on the OpenSC framework: http://www.openSC-project.org Schedule: Sunday, 13:00 to 15:00 * Discover the hardware The workshop will start with a donation of 50 ePass2003 free developer kits. The kit includes an ePass2003 and a CD with all documentation: http://www.gooze.eu/feitian-epass-2003-free-software-developer-kit Donation of tokens is always kind of "rush" and should take around 15 minutes. Then the schedule should be: * OpenSC quickstarter guide: http://www.gooze.eu/printpdf/book/export/html/36 should take around 45 minutes We will cover installation and basic OpenSC commands. * Using SSH with smartcards: http://www.gooze.eu/printpdf/book/export/html/193 should take around 15 minutes * Using smartcards with Firefox: http://www.gooze.eu/printpdf/book/export/html/145 is a tutorial around CAcert should take around 15 minutes * Using smartcards with TrueCrypt: http://www.gooze.eu/printpdf/book/export/html/203 should take around 15 minutes * Questions and answers The slides should be based on a tutorial given at Debian day in Paris and will be available under a Free license: http://www.gooze.eu/sites/default/files/slides/debian-miniconf-paris-2010-v… Kind regards, -- Jean-Michel Pouré - Gooze - http://www.gooze.eu

1 0

[security-devroom] Fosdem schedule ready - last minute change
by Kai Engert 30 Jan '12

30 Jan '12

Hi everyone, (a) Greetings from Martin, whom I've just spoken to, and who asked me to send this email. (b) Martin has worked with Fosdem organizers and the schedule for the Security and Hardware Crypto room is ready. Saturday: http://fosdem.org/2012/schedule/track/hardware_cryptography_devroom Sunday: http://fosdem.org/2012/schedule/track/security_devroom (c) Soon after the initial schedule was announced, I noticed a conflict between the "CACert / Trust" talk and the talk I'll be giving in the Mozilla room, also about the consequences of the DigiNotar incident, from a Mozilla and NSS code perspective. After talking with Martin and the Fosdem organizers on IRC, we have agreed to avoid the conflict between the talks and make a last minute switch of the schedule. The schedule shown on the Fosdem.org website has already been updated, and no longer has the conflict. So, only for those of you who had looked at the schedule earlier than this email, we had switched the 15:00 and 16:00 talks. The updated Saturday schedule is: 15:00 yaSSL 16:00 CAcert I hope this change was in everybody's interest. Thanks and Regards Kai

3 2

[security-devroom] Fosdem 2012, donation of 50 ePass2003 to security devroom
by Jean-Michel Pouré - GOOZE 19 Jan '12

19 Jan '12

Dear all, Just a quick note that GOOZE will be attending FOSDEM security devroom (day one) and we will donate 50 ePass2003 tokens to the assistance. http://www.gooze.eu/epass-2003 People interested will only need to register an online form during the security devroom and I will hand them free tokens. Hoping this can make the devroom a success. Kind regards, -- Jean-Michel Pouré - Gooze - http://www.gooze.eu

1 0

[security-devroom] FOSDEM 2012 Submission
by Anders Rundgren 05 Jan '12

05 Jan '12

Hi Guys, If you have a devroom and there is time left, I would like to elaborate on "Open Security Hardware". My BIO: Anders is a seasoned developer and entrepreneur who has worked exclusively with Internet-based systems since 1995. Anders is currently a consultant at PrimeKey solutions with enrollment to EJBCA as a core working field. Open Security Hardware is an effort creating a unified crypto container that works equally well in traditional connected tokens (e.g. smart cards) as in embedded systems like mobile phones. The most important part of the plot is the integration of an end-to-end-security token provisioning scheme that is based on an enhanced Internet browser. The 30min talk will elaborate of the technical details behind the paper: http://webpki.org/papers/keygen2/sks-keygen2-exec-level-presentation.pdf Anders

1 0