Subject: Re: PKI Disaster Recovery and Key Rollover

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 11 Jul 2007 09:05:44 +0200

Peter,

The point you mention, seems to me in between technical matters and juridical matters.

It is addressed in different ETSI documents that may be downloaded free of charge from: 
http://www.etsi.org/services_products/freestandard/home.htm

In particular ETSI TS 101 456 and ETSI TS 102 042.

Here is an extract from ETSI TS 101 456:

7.4.9	CA termination

The CA shall ensure that potential disruptions to subscribers and relying parties are minimized 
as a result of the cessation of the CA's services, and ensure continued maintenance of records 
required to provide evidence of certification for the purposes of legal proceedings (see the 
Directive [1], annex II (i)). In particular:

a)	Before the CA terminates its services the following procedures shall be executed as a minimum:

-	the CA shall inform all subscribers, relying parties and other CAs with which it has agreements 
    or other form of established relations.

NOTE:	The CA is not required to have a prior relationship with the relying party.

-	the CA shall terminate all authorization of subcontractors to act on behalf of the CA
    in the performance of any functions related to the process of issuing certificates;
-	the CA shall perform necessary undertakings to transfer obligations for maintaining 
    registration information (see clause 7.3.1) and event log archives (see clause 7.4.11) 
    for their respective period of time as indicated to the subscriber and relying party (see clause 7.3.4);
-	the CA shall destroy, or withdraw from use, its private keys, as defined in clause 7.2.6.

b)	The CA shall have an arrangement to cover the costs to fulfil these minimum requirements 
      in case the CA becomes bankrupt or for other reasons is unable to cover the costs by itself.

c)	The CA shall state in its practices the provisions made for termination of service. 
    This shall include:
-	the notification of affected entities;
-	the transfer of its obligations to other parties;
-	the handling of the revocation status for unexpired certificates that have been issued.

Do you think that some parts of this text should be incorporated in the current draft ?

Denis

===============================================================

>"Denis Pinkas" <[email-masked]> writes:
>
>>This document presents a framework to assist the writers of policy or
>>practice statements and the designers of a Public Key Infrastructure to
>>prepare disaster recovery plans in case of a private key-compromise or a
>>private key-loss. This may happen to end-entity keys, Certification
>>Authorities, Revocation Authorities, Attribute Authorities, or Time-Stamping
>>Authorities.  Since certificates have finite validity, CA key-rollover should
>>be planned in advance.
>
>Should it also cover the far more serious problem of the CA going out of
>business?  I've talked to users of a number of CAs that have failed and the
>effect has been pretty chaotic on relying parties and users: one day the CA
>just isn't there any more, and everything stops working.  This seems to be by
>far the most serious real-world-impact CA issue that I've encountered, but
>it's not even considered in any PKI documentation that I know of.
>
>Peter.
>
>

Regards,

Denis Pinkas

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 11 Jul 2007 23:06:51 +1200

>Here is an extract from ETSI TS 101 456:

Hmm, OK, what I was looking for was more of a list of issues from the
user/EE/relying-party point of view, things that they have to consider when
dealing with a CA.  To take one oft-quoted case:

  - the CA shall destroy, or withdraw from use, its private keys, as defined
    in clause 7.2.6.

that's never going to happen in the real world because the only asset left to
a CA when it goes out of business is its private key, and the liquidators are
never going to allow the deliberate destruction of corporate assets in this
manner.  More importantly, even if the CA had some policy related to this
while it was still operating, once it's in receivership the policy becomes
void. It's a bit like Tony Bartoletti's suggestion for adding a crimeFree bit
to keyUsage, you can write whatever policy you like for it but when it comes
to the crunch it's not going to work the way the policy says.

So what I was looking for, if the document is looking at PKI-related disaster
recovery, is advice to users on what to do when their CA vanishes, all support
and services stop overnight (with no continuity or responsibility), and the
liquidators sell the private key on eBay.

Peter.

---

From: "Ignacio Alamillo" <[email-masked]>
Date: Wed, 11 Jul 2007 15:20:13 +0200

Hi,

Not want to disturb anyone with legal stuff, but in many cases the applicable law establishes some minimum actions to undertake in case a CA stops operations. I.e. article 21 of the Spanish Law 59/2003, on electronic signatures, says something like "a CA wanting to cease operations shall inform within two months its subscribers and will be allowed to transfer, with their express consent, the management of valid certificates to another CA or revoke them". 

Up to this, no one has any effective protection against a CA going off business which doesn't inform of anything, therefore the third paragraph of this art. 21 says that the CA will transfer the Science and Technology Ministry (today the Industry, Commerce and Tourism Ministry) the revocation information. 

With this information, the Ministry will maintain a public service informing of the revocation status of the certificates. 

Not bad at all, but even in this case a CA could not transfer this information to the Ministry.

Therefore, the best "continuity" strategy to be able to validate signatures is, in my opinion, to implement a signature completion and maintenance process, getting all the relevant evidential material (such as CRLs or OCSP responses) and store it.

ETSI CAdES and XAdES specs provide full guidance on this, just as CEN CWA 14171 does.

Best,

Ignacio

-----Mensaje original-----
De: [email-masked] en nombre de Peter Gutmann
Enviado el: mié 11/07/2007 13:06
Para: [email-masked]; [email-masked]
CC: [email-masked]; [email-masked]
Asunto: Re: PKI Disaster Recovery and Key Rollover

Peter.

---

From: Tony Bartoletti <[email-masked]>
Date: Thu, 12 Jul 2007 11:32:34 -0700

>to the crunch it's not going to work the way the policy says.

Stepping back a bit to look at this, it seems clear that REAL disaster 
recovery can only come by ensuring that (so qualified) CA's abide by some 
kind of "escrowed recovery/continuity arrangement" as a matter of 
course.  Some entity, ala FDIC-for-PKI (not to imply that it be a 
government entity) needs the power to either revoke CA root, or provide for 
continuity of operations (magic, yeah...)

As Peter points out, the "keys" are the last bit of leverage the CA 
retains, and the CA (in general) will have no compunction to abide by any 
policy at a time when the downside outweighs the benefit.

If the concern is really for the relying parties and overall PKI stability, 
it makes no sense to demand that the CA take ANY particular action 
"post-disaster" ("the building may collapse at any moment - for your 
safety, please walk, do not RUN to the exits").  Rather, CA's that 
(voluntarily) enter into a verifiable "continuity contract" should be able 
to tout this fact as a qualification, and let the market decide if this 
becomes a "selling point" for their services.

Thoughts?   ____tony____

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900