Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 6 Next »

Phase 1 Implementation Plan

A plan to implement the Phase 1 Recommendations of the Metadata Distribution WG is emerging:

Relevant facts:

  1. The InCommon metadata signing certificate expires on May 2, 2014.
  2. The InCommon metadata signing certificate is signed by a legacy CA whose certificate expires on March 29, 2014.
  3. The XML signature on InCommon metadata uses a deprecated SHA-1 digest algorithm.
    • NIST deprecated the use of SHA-1 in conjunction with digital signatures on January 1, 2011.
    • NIST disallows the use of SHA-1 in conjunction with digital signatures beginning January 1, 2014.
    • See: NIST SP 800-57 Part 1, Revision 3 (July 2012), Tables 3 and 4

Actions:

  1. Replace the current signing certificate with a long-lived, self-signed certificate based on the current key pair. Set the new certificate to expire on December 18, 2037.
  2. Deploy a new metadata aggregate that uses the new self-signed certificate and a SHA2-based signing algorithm.
  3. Recommend that all organizations migrate to the new metadata aggregate asap. In particular, any deployment that (incorrectly) relies on the legacy CA must migrate to the new metadata aggregate by March 29, 2014.
  4. Replace the current metadata aggregate with a redirect. [date TBD]

  5. Create a discussion list for administrators that have questions or experience problems regarding this transition.
  • No labels