Subject: PKI Disaster Recovery and Key Rollover

From: "Denis Pinkas" <[email-masked]>
Date: Mon, 9 Jul 2007 15:45:18 +0200

To the WG,

I edited together with Joel Kazin an individual Internet-Draft that has been placed on the IETF web server.
The target category is INFORMATIONAL.

The document is now available at:
https://datatracker.ietf.org/drafts/draft-pinkas-pkix-pki-dr-kr

The abstract is the following:

   This document presents a framework to assist the writers of policy 
   or practice statements and the designers of a Public Key 
   Infrastructure to prepare disaster recovery plans in case of a
   private key-compromise or a private key-loss.  This may happen to 
   end-entity keys, Certification Authorities, Revocation Authorities, 
   Attribute Authorities, or Time-Stamping Authorities.  Since 
   certificates have finite validity, CA key-rollover should be 
   planned in advance. 

   In addition, denial of service attacks on Repositories holding 
   CRLs has also to be considered.
   This framework provides a comprehensive list of potential key-
   compromise or key-loss conditions that, in the opinion of the 
   authors, should be addressed so that it is possible to quickly 
   recover from exceptional situations.

I ask the WG to consider whether this document should be progressed 
as an individual contribution or as a PKIX WG document.

I will not be present at the next meeting, but I plan to prepare a few slides to present the draft.

To this respect, I ask whether it would be possible to get a time slot (5 minutes) 
at the next meeting. 

Denis

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 11 Jul 2007 18:46:45 +1200

"Denis Pinkas" <[email-masked]> writes:

>This document presents a framework to assist the writers of policy or
>practice statements and the designers of a Public Key Infrastructure to
>prepare disaster recovery plans in case of a private key-compromise or a
>private key-loss. This may happen to end-entity keys, Certification
>Authorities, Revocation Authorities, Attribute Authorities, or Time-Stamping
>Authorities.  Since certificates have finite validity, CA key-rollover should
>be planned in advance.

Should it also cover the far more serious problem of the CA going out of
business?  I've talked to users of a number of CAs that have failed and the
effect has been pretty chaotic on relying parties and users: one day the CA
just isn't there any more, and everything stops working.  This seems to be by
far the most serious real-world-impact CA issue that I've encountered, but
it's not even considered in any PKI documentation that I know of.

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 11 Jul 2007 01:54:03 -0700

Peter,

The Policy Framework (Informational RFC 3647) has a section on CA and RA
Termination.  I have seen a number of Certificate Policies drafted that
describe requirements as to what a CA must do prior to termination of
service.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Peter Gutmann
Sent: Wednesday, July 11, 2007 2:47 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: PKI Disaster Recovery and Key Rollover

Should it also cover the far more serious problem of the CA going out of
business?  I've talked to users of a number of CAs that have failed and
the
effect has been pretty chaotic on relying parties and users: one day the
CA
just isn't there any more, and everything stops working.  This seems to
be by
far the most serious real-world-impact CA issue that I've encountered,
but
it's not even considered in any PKI documentation that I know of.

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 11 Jul 2007 21:37:15 +1200

"Santosh Chokhani" <[email-masked]> writes:

>Termination.

Do you mean section 4.5.8:

   This subcomponent describes requirements relating to procedures for
   termination and termination notification of a CA or RA, including the
   identity of the custodian of CA and RA archival records.

This seems to provide about as much utility as Cygnus' corporate drugs policy
:-).

>I have seen a number of Certificate Policies drafted that describe
>requirements as to what a CA must do prior to termination of service.

Given the number of CAs whose users I've talked to for which the termination
of service consisted of "404 Not Found", I think this is something that needs
to be addressed in more detail.  In particular since this draft is supposed to
cover "PKI Disaster Recovery" and having your CA suddenly vanish is the single
biggest possible disaster than can hit a PKI, I think a fair amount of the
document should be devoted to this.  Where do the CA keys go?  Who issues
CRLs?  (A real-world example there, one national PKI that evaporated suddenly
was left with the problem that while the hardware was still in place, there
were no staff left who knew how to issue a CRL).  Who takes over the defunct
CA's role? Who gets the CA's keys?  (Again, real-world example, they end up on
eBay for sale to the highest bidder).  You could easily write a small book on
all of this, it really is the single most drastic PKI disaster recovery issue
that we have, and probably the most frequently-occurring (CA- rather than EE-
related) one.

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 11 Jul 2007 03:47:18 -0700

Peter,

Like rest of the Policy Framework, 3647 does not specify any policies
for this or other points.  3647 is a framework and not a policy or a
sample policy.

What I have seen in some of the certificate policies seem to adequately
address this.

-----Original Message-----
From: pgut001 [mailto:[email-masked]] 
Sent: Wednesday, July 11, 2007 5:37 AM
To: Santosh Chokhani; [email-masked]; [email-masked];
[email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: PKI Disaster Recovery and Key Rollover

This seems to provide about as much utility as Cygnus' corporate drugs
policy
:-).

>requirements as to what a CA must do prior to termination of service.

Given the number of CAs whose users I've talked to for which the
termination
of service consisted of "404 Not Found", I think this is something that
needs
to be addressed in more detail.  In particular since this draft is
supposed to
cover "PKI Disaster Recovery" and having your CA suddenly vanish is the
single
biggest possible disaster than can hit a PKI, I think a fair amount of
the
document should be devoted to this.  Where do the CA keys go?  Who
issues
CRLs?  (A real-world example there, one national PKI that evaporated
suddenly
was left with the problem that while the hardware was still in place,
there
were no staff left who knew how to issue a CRL).  Who takes over the
defunct
CA's role? Who gets the CA's keys?  (Again, real-world example, they end
up on
eBay for sale to the highest bidder).  You could easily write a small
book on
all of this, it really is the single most drastic PKI disaster recovery
issue
that we have, and probably the most frequently-occurring (CA- rather
than EE-
related) one.

Peter.

---

From: Andy Nourse <[email-masked]>
Date: Wed, 18 Jul 2007 18:06:03 -0700

>    certificates have finite validity, CA key-rollover should be

Key rollover is included in the SCEP draft:
http://www.ietf.org/internet-drafts/draft-nourse-scep-15.txt
For CA certificates, we have the ability to retrieve the "next" certificate,
which is the certificate that will replace the current CA certificate when
it expires.  The SCEP response is signed by the current CA cert, as it is
intended that the "next" certificate be retrieved while the current one is
still valid.

Normally, CA key rollover would happen when the CA key expires, but it could
be done early in the event of key compromise or loss.

Andy Nourse
Cisco Systems