Brief status report of AIST GRID CA APGridPMA Meeting @ Singapore September 16

1. Brief status report ofAIST GRID CAAPGridPMA Meeting @ SingaporeSeptember 16 Yoshio Tanaka (yoshio.tanaka@aist.go.jp) Information Technology Research Institute AIST, Japan

2. Issued certificates • User certificates: 154 (136) • Valid: 32 (31) • Invalid (revoked or expired): 122 (105) • Host certificates: 2204 (1706) • Valid: 397 (509) • Invalid (revoked or expired): 1647 (1197) • LDAP certificates: 264 (262) • Valid: 33 (33) • Invalid (revoked or expired): 231 (229)

3. At first • Grid Technology Research Center completed its term in last March (Jan. 2002 to Mar. 2008). • Since April, we belong to Information Technology Research Institute. • Replaced “Grid Technology Research Center” to “Information Technology Research Institute” in CP/CPS.

4. Results of self-auditing: Score B • Certificate revocation can be requested by users, the registration authorities, and the CA. Others can request revocation if they can sufficiently prove compromise or exposure of the associated private key. • The CP/CPS does not describe that “others can request revocation.” 4.4.2 Who can request revocation Subscribers, the AIST GRID RA and the AIST GRID CA can request revocation.Others can request revocation if they can sufficiently prove compromise or exposure of the associated private key.

5. Results of self-auditing: Score B • The CA must react as soon as possible, but within one working day, to any revocation request received. • The CP/CPS does not describe “but within one working day.” 4.4.4 Revocation request grace period AIST GRID CA willprocesses revocation as soon as it receives the request, but at least within one working day. The revocation information will be published to the AIST GRID PKI repository.

6. Results of self-auditing: Score B • An end entity must request revocation of its certificate as soon as possible, but within one working day after detection of… • The CP/CPS does not describe “but within one working day.” 2.1.3 End entity, host administrator obligation … - Instruct the CA to revoke the certificate promptly, but at least within one working day, upon any actual or suspected loss, disclosure, or other compromise of the subscriber’s private key.

7. Results of self-auditing: Score B • Certificates (and private keys) managed in a software token should only be re-keyed, not renewed. • Certificates may be renewed or re-keyed for more than 5 years without a form of identity and eligibility verification, and this procedure must be described in the CP/CPS. • The CP/CPS does not clearly distinguish re-key and renew. 3.2 Routine Rekey Enrollment request is necessary if the certificate is expired. AIST GRID CA does not allow to re-issue a new end-entity certificate using the same key pair with an issued certificate. End-entity certificates may be rekeyed for less than 5 years without a form of identity and eligibility verification. If an end-entity certificate has been rekeyed for 5 years, the initial identity vetting procedures defined in CPS[3.1 Initial registration] are required.

8. Results of self-auditing: Score C • When the CA’s cryptographic data needs to be changed, such a transition shall be managed; from the time of distribution of the new cryptographic data, only the new key will be used for certificate signing purposes. • The overlap of the old and new key must be at least the longest time an end-entity certificate can be valid. The older but still valid certificate must be available to verify old signatures – and the secret key to sign CRLs – until all the certificates signed using the associated private key have also expired. • The CP/CPS does not describe the transition procedure 3.2 Routine Rekey When the root CA Certificate will be expired, AIST GRID CA will issue a new root CA Certificate at least one year before the expiration. From the time of distribution of the new CA Certificate, only the new key will be used for certificate signing purposes. The older but still valid certificate must be available to verify old signatures – and the secret key to sign CRLs – until all the certificates signed using the associated private key have also expired.

9. Results of self-auditing: Score C • Revocation requests must be properly authenticated. • Authentication of revocation requests descried in the CP/CPS is applicable only for the following case: • A user, who has a valid certificate and corresponding private key, requests revocation of her/his/host certificate. 3.4 Revocation request If a revocation request of a certificate is made by the owner of the certificate and the owner has a corresponding private key, the revocation request is authenticated by possession of the private key. Otherwise, revocation request is authenticated by the RA either by face-to-face meeting, phone call or exchanging emails.

10. Last one • AIST GRID CA Certificate was valid for 5 years • AIST GRID CA will change the validity period of the root CA certificate to 20 years. • Assigned a new OID 4.7 CA certificate validity CA will stop to sign new user certificates by its private key before it is shorten than user certificates. CA certificate validity is 20years. 1.3.6.1.4.1.18936.1.11.1.3 Certification Practices Statements 1.3.6.1.4.1.18936.1.11.3 CA Certificate Policy