----- Original Message -----
From: Kroll, Greg
Sent: Friday, June 18, 2010 2:54 PM
To: 'Support for Support Discussion List'
Subject: Soft Personal Digital Certificates

Information Technology has begun a project to issue personal digital certificates similar to those that are issued on eTokens, but the new certificates will be stored in software, on computers and mobile devices, rather than on hardware tokens. These soft PDCs should be useful for authentication, digital signatures, and encryption. If you have an application or function that you think might take advantage of a soft PDC, or would like to participate in an analysis of needs, we would like to include you in one or more focus group meetings. Please respond to Greg Kroll (usdgk@vt.edu) by July 1, 2010, if you would like to attend an initial meeting (time and place to be determined based on response to this e-mail.)

VTVTVTVTVTVTVTVTVTVTVTVTVTVT
--Greg Kroll, PMP
Assoc Dir for IT Project Management & Planning
Virginia Tech
1700 Pratt Drive (0214)
Blacksburg, VA. 24061
office: 540.231.9654
fax: 540.231.7413

Draft Agenda for Introductory meeting to discuss Soft Personal Digital Certificates

Wednesday, July 7, 2010, 2:00 p.m., RB14-115.

Agenda

1. Welcome & meeting format
   • A very brief overview of the agenda and explanation that this first meeting is for us to gather information on possible uses and answer questions about personal digital certificates. We are planning smaller focus group meetings to discuss use cases.
2. Overview of Soft Personal Digital Certificates
   • Frank will give a brief overview
3. Questions/Answers and Discussion
   1. Do those attending understand the technology?
   2. Do you have an application waiting for this technology?
   3. What do you want to use these certificates for? or What are these certificates useful for?
   4. Is in-person identity proofing a problem?
   5. What are your feelings on your users being able to handle management of certificate keys? Escrow?
   6. Would you benefit from external/extended trust, i.e., root key signing solution (their is an RFP in progress)?
   7. Where can this certificate replace a signature? See Standard for Personal Digital Identity Levels of Assurance
   8. Who is not familiar with the Thawte free E-mail Certificates?
   9. What are the barriers or problems with using these certificates for specific applications like e-mail encryption?
   10. Any concerns with key escrow and recovery?

Meeting Notes

1. Went around the room with introductions, what department you are with, and if desired why you are here today.
2. Frank Galligan gave a brief introduction to the project, the technology, and progress to date. Probable completion date of Spring/Summer 2011.
3. Eligibility for a soft cert is everyone that is eligible for an eToken plus all students.
   • The Graduate School asked specifically about non-VT-affiliated graduate student committee members. The answer is if they are eligible for an eToken (which committee members are) then they can get a soft cert.
4. A 5-year validity period is good for students. Someone commented that it seems strange that the validity of a soft cert would be longer than for an eToken that has a higher LOA.
5. It is envisioned that enrollment would have 3 stages:
   1. user logs into a customized, public, web interface to request a soft PDC.
   2. user then goes to a convenient registration authority (RA) station for face-to-face identity proofing.
   3. user is notified by e-mail where to download their certificate and are provided instructions.
6. In order to use encryption the public keys would need to be publicly available, probably by publishing them to the AD or ED.
7. We are looking for "early adopters" to help us work out the processes. Those interested should contact Greg Kroll.
   • Discussed at 7/8/2010 project team meeting.
     Dave Martin expressed interest as an early adopter.
8. Users only have one active key pair but could have multiple certificates.
   • Discussed at 7/8/2010 project team meeting.
     An active key pair means the user does not have a revoked cert, only "valid" or "expired" certs.
     A user can have multiple active certs associated with their one active key pair.
     A user can download their key pair anytime by providing the appropriate password.
     The PKCS12 file could be stored anywhere (PKCS12 defines a file format commonly used to store X.509 private keys with accompanying public key certificate).
     As for passwords:
     We intend to use the same rules (strength) as for eTokens.
     We do not want to advertise the fact that users can change their password, assuming they know how. Because of the fact that user can change their password means a lower LOA.
9. Remember, public key encrypts, private key decrypts. For digital signatures, you sign with your private key.
10. Internal Audit has mandated that if encryption is enabled there must be a key escrow.
11. By having a key escrow we lose non-repudiation because someone could always say that our key store was compromised and the encrypted document or signature did not come from them.
12. Someone asked if webmail (the newest one) is PKI enabled. Dave Martin is going to look into it but was pretty certain that it supported encryption.
13. One suggested use for a soft PDC is for signing IMS forms.
14. Another possible use is for Hokie SPA and access to information/changes to W2 forms, direct deposit, etc.
15. Possible use for student financial aid, especially scholarships.
16. Remote issuance:
    1. A suggested alternative for face-to-face identity proofing is to look into using notaries to verify someone's credentials.
    2. IDDL should be able to use these for verifying distance learners taking tests.
17. A question was asked about when someone changes their name. The answer is to revoke the old certificate and get a new one.
    • Discussed at 7/8/2010 project team meeting.
      Do not revoke the old cert because that would give the user a new key pair. Instead request a new cert which would use the old key pair and give the user a new cert. However, the user would still have to go through face-to-face identity proofing.
18. Another possible use is for human subjects used in research. A soft cert could be used by the human subjects to release their records.
19. Someone asked about putting the soft PDC on an eToken for portability. The answer is yes it can be imported to the eToken, however, if that eToken has to be revoked or returned then the soft PDC is wiped from the eToken.
20. Is in-person identity proofing a problem?
    1. Definitely a pain but understandably required. Perhaps sometime in the future we could offer soft PDC's with different LOA.
    • Discussed at 7/8/2010 project team meeting.
      For example, for someone that does not have access to a VT approver they might use a non-VT approver.
21. What are your feelings on your users being able to handle management of certificate keys? Escrow?
    1. Would be difficult for most users to manage more than one key pair.
    2. Users need education on the importance of private key security.
    • Discussed at 7/8/2010 project team meeting.
      The escrow should be considered a service of last resort. Departments should have a process in place to protect and retrieve data.
22. Would you benefit from external/extended trust, i.e., root key signing solution (there is an RFP in progress)?
    1. Preferred but not a show stopper.
    2. The Research Division would benefit by being able to move encrypted data around.
    • Discussed at 7/8/2010 project team meeting.
      Most likely only for VT employees.
23. What are the barriers or problems with using these certificates for specific applications like e-mail encryption?
    1. Only a problem if using multiple key pairs.
    • Discussed at 7/8/2010 project team meeting.
      Multiple key pairs meaning one from VT and another from somewhere/someone else. In this case the user would be get a pop-up and allowed to select.
    1. Clark Gaylord mentioned he uses PGP for e-mail.
    2. Marc DeBonis mentioned he uses Windows Rights Management Services (RMS).
24. Any concerns with key escrow and recovery?
    1. Who can officially do this?
    2. Dave Martin mentioned that there is a procedure already in place to retrieve ex-employee's e-mail.
    3. Cert owner should be able to retrieve the keys any time they want, e.g., because of a forgotten password.
    • Discussed at 7/8/2010 project team meeting.
      Needs publicity and explanations. Put in the project communication plan.
      Some research needs to go into the technical aspects of un-revoking a cert (if even possible). This is related to the fact that someone can call 4Help and revoke a cert for someone else, this is how it works for eTokens. Define a use case for this scenario.
      Our procedures should allow as much as possible even if it involves a process "out of band", meaning, for instance, the user coming in person and a manual process.