Proposal for an Internet2 PKI Lab at Florida State University

Yvo Desmedt
Department of Computer Science
PO Box 4530, Florida State University
Tallahassee, FL 32306-4530
desmedt@cs.fsu.edu

1. Introduction

Seeing the importance of e-commerce, it is no surprise that several organizations are setting up Public Key Infrastructures. For example:

the Massachusetts Institute of Technology (MIT) and the Corporation for Research and Educational Networking (CREN) propose to set up a hierarchical authentication structure for secure resource-sharing among higher education institutions [3].
as a reaction to the jamming of such WWW addresses as yahoo.com, cnn.com, a meeting was set up at the White House. A list of key initiatives was set up [4]. One of those is the:
Funding 7 Public Key Infrastructure Models pilot programs in FY2001 at different federal agencies. ($7 million)

Although X500/509 is one of the first Public Key Infrastructures proposed, others have been suggested. Seeing the future importance of a Public Key Infrastructure (PKI), it is natural to wonder which Public Key Infrastructure is the best.

This proposal first describes the general background and general qualifications of the group at Florida State University that will address the issues on PKI (see Section 2). Then the work on PKI done by some members of the group is surveyed (see Section 3). The research goals and other funding aspects are discussed in Section 4.

2. General background and general qualifications of the group

Florida State University is strongly committed to:

Information Security.

Starting Fall 1999, the Department of Computer Science at Florida State University had two faculty members whose main area of research is Information Security. Those are:

Yvo Desmedt, Professor,
Alec Yasinsac, Assistant Professor.

Moreover, the main area of research interest of the Department of Computer Science at Florida State University is in Information Security, as is clear from the advertisement for new positions.

Florida State University has been recognized recently by:

NSTISSC: (the National Security Telecommunications and Information Systems Security Command). NSTISSC certified that the security courses at Florida State University satisfy the curriculum guidelines of NSTISSC for a Certificate in Information Systems Security Professionals.
NSA: (the National Security Agency). On May 24, 2000, Florida State University was designated as one of the 14 NSA Centers of Academic Excellence in Information Assurance Education.

Recently the group that will work on PKI at Florida State University has been awarded by the College of Arts and Sciences $125,000 for equipment to set up an information security lab. Additionally the space where this lab will be installed will be renovated. The lab will consists of several computers and an isolated network to simulate internet denial of service attacks, the impact of virus, find new security holes, etc. The impact of new security technology will also be simulated and tested.

Internet2.

Florida State University is a member of Internet2 and is strongly committed to it at different levels:

Administrative level.

The CIO of Florida State University, Larry Conrad, has been involved in Internet2, for example, as:

a member of the panel: on ``Quality of Service Administrative Issues'' at the Internet2 member meeting in Washington, DC, Oct. 1997.
member of the fall 1999 Program Committee.

Technical level.

Both Yvo Desmedt and Alec Yasinsac are members of the Internet2 Security Working Group.

3. Involvement on PKI

The following research and work has been done by the members of the Florida State University team on PKI, in particular by:

Yvo Desmedt.

Already in his PhD (1984) [5] he said that it is more secure to receive multiple certificates for the same public key. He wrote:

Using public key schemes, one can ask at several locations the public key of his correspondent and only use it when all the pretended keys are equal.

In 1996 he combined this idea with the work on network reliability. He co-authored a proposal to use the concept of multiple connectivity to increase the guarantee that the public key is the correct one [2] (this idea was also suggested independently by [6]). Although this proposal seems similar to the one followed in PGP [8] and by Rivest-Lampson [7], the difference is that PGP and Rivest-Lampson approach does not insist on having a certain connectivity and is therefore unable to protect against a computer hacker that can break into several certifying authorities.

Yvo Desmedt will moderate a panel (submitted and accepted) on ``Which PKI (Public Key Infrastructure) is the right one?'' at the 7th ACM Conference on Computer and Communication Security, November 1-4 2000, Athens, Greece. The motivation for such a panel discussion is that before one builds such an expensive infrastructure, experts should debate what method to use and whether a PKI is needed. While a hierarchical PKI may become the next target of computer hackers, a multiple-connected one seems much more expensive to build.

Recent research (not yet published) co-authored by Yvo Desmedt argues that multiple-connected PKIs may not be as expensive to build as one would expect and proposes new methods to further increase security [1].

Alec Yasinsac

has given an overview on PKI focusing in particular on the need for PKI.

4. Additional funding and research goals

The goal is to study practical as well as remaining theoretical problems related to PKI. The AT&T investment in equipment, a PKI testbed, etc., will help to achieve these goals. Furthermore, it is the intention to apply to the National Science Foundation for a special project grant on PKI to address the problem in its generality.

Bibliography

1: M. Burmester and Y. Desmedt.
Hierarchical public-key certification: The next target for hackers?
In preparation.
2: M. Burmester, Y. Desmedt, and G. Kabatianskii.
Trust and security: A new look at the Byzantine generals problem.
In R. N. Wright and P. G. Neumann, editors, Network Threats, DIMACS, Series in Discrete Mathematics and Theoretical Computer Science, December 2-4, 1996, vol. 38. AMS, 1998.
3: Cren's certificate authority service.
4: Cyber security budget initiatives. February 15, 2000.
5: Y. Desmedt.
Analysis of the Security and New Algorithms for Modern Industrial Cryptography.
PhD thesis, K.U. Leuven, Leuven, Belgium, October 1984.
6: M. K. Reiter and S. G. Stubblebine.
Path independence for authentication in large scale systems.
In Proceedings of the 4th ACM Conference on Computer and Communications Security, pp. 57-66, April 1997.
Zurich.
7: R. L. Rivest and B. Lampson.
SDSI-a simple distributed security infrastructure.
8: P. R. Zimmermann.
The Official PGP User's Guide.
MIT Press, Cambridge, Massachussets, 1995.