Proxy Certificate Profile

1
Proxy Certificate Profile

• draft-ietf-pkix-proxy-03
• Draft has worked on in Global Grid Forum
• Details of draft are open to influence by PKIX
• And have been influenced in private conversations
• PKIX would be preferred venue
• But most conversations now seem to be focusing on
  fundamental approach instead of details so we are
  asking for this to move to last call.

2
Motivation

• Grid Computing users dynamically creating
  entities (e.g. computational jobs)
• Need to name entities
• Need to grant entities rights
• Dynamic nature of creation makes tradition CA
  process too heavy weight

3
Summary of Approach

• End entity creates Proxy Cert for created entity
• Looks like X509 identity cert
• Has identity based off of EEC identity
• Has critical extension identifying as proxy
• Can contain intention of EE to delegate
  all/none/some of its rights to PC holder
• Define oid and policy blob
• Oids defined for All and No rights delegated
• Works with current protocols (SSL)