An enterprise (such as an institute of higher education) wishing to deploy a PKI must choose between several options, all expensive and awkward. It might outsource certification to a third-party company; it might purchase CA software and appliances from a third-party company; it might try to build and maintain its own CA. In the latter two options, the enterprise faces the additional challenge of showing sufficiently safe practices to have its CA certified or cross-certified, for broader inter-operability.
This paper presents our research and development effort to address this problem. We use OpenCA to provide the basic functionality; we package it on a Linux installation on a bootable CD; we use the 1.1b TCG trusted platform module (standard on many desktop and laptop machines) to hold the private key; we also use the TPM to add assurance that the key can only be used when the system is correctly configured as the CA. This tool enables an enterprise to operate a CA possessing a degree of physical security and the ability to attest proper configuration to a remote certifier simply by booting a CD in a commodity machine. The code (and CD image) are all open-source, and will be available for free.
KeywordsTrusted Platform Module Cryptographic Operation Trust Computing Group Registration Authority Trust Computing Platform
Unable to display preview. Download preview PDF.
- 1.Covell, C., Bell, M.: OpenCA Guides for 0.9.2+, http://www.openca.org/openca/docs/online/
- 2.Douglass, J.: The Papyrus Project, Version 4 (2005), http://www.cren.net/crenca/crencapages/papyrus.html
- 3.Higher Education Bridge Certification Authority, http://www.educause.edu/hebca/
- 4.Hohnstadt, C.: XCA (2003), http://xca.sourceforge.net/
- 5.Chandra, P., Viega, J., Messier, M.: Network Security with OpenSSL. O’Reilly & Associates, Sebastopol (2002)Google Scholar
- 6.Knoppix linux, http://www.knoppix.net/
- 7.Marchesini, J., Smith, S.W., Wild, O., Barsamian, A., Stabiner, J.: Open-Source Applications of TCPA Hardware. In: 20th Annual Computer Security Applications Conference. IEEE Computer Society Press, Los Alamitos (2004)Google Scholar
- 8.OpenCA PKI Development Project, http://www.openca.org/openca/
- 9.OpenSSL: the Open Source toolkit for SSL/TLS, http://www.openssl.org/
- 10.Personal communicationGoogle Scholar
- 11.pyCA–X.509 CA (2003), http://www.pyca.de/
- 12.Ribbeck, B.R.: The PKI Working Group End User Deployment Matrix (2004), https://webspace.uth.tmc.edu/bribbeck/public/PKIWMATRIX.html
- 13.Trusted Computing Platform Alliance. Main Specification, Version 1.1b (February 2002), http://www.trustedcomputinggroup.org
- 14.Yi, S., Kravets, R.: MOCA:Mobile Certificate Authority for Wireless Ad Hoc Networks. In: 2nd Annual PKI Research Workshop (2002)Google Scholar