You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 18 Next »

Phase 1 Implementation Plan

This document is a DRAFT plan to implement the Phase 1 Recommendations of the Metadata Distribution WG.

Executive Summary

  1. A new metadata aggregate will be deployed, at a new HTTP location.
  2. The digital signature on the new metadata aggregate will be upgraded.
    1. The signing certificate is new (but the signing key is not).
    2. The digital signature on the new metadata aggregate employs a SHA-2 digest algorithm.

  3. All deployments are encouraged to migrate to the new metadata aggregate ASAP but no later than [date TBD].

    1. Some non-standard deployments may be required to take action by March 29, 2014.

Current Policy

It is strongly recommended that InCommon SPs and IdPs refresh and verify metadata at least daily. The security implications of metadata refresh are discussed on the Metadata Consumption wiki page:

Regular metadata refresh protects users against spoofing and phishing, and is a necessary precaution in the event of key compromise. Failure to refresh metadata exposes you, your users, and other Federation participants to unnecessary risk.

If you verify the digital signature on InCommon metadata (as recommended), the following implementation plan may affect your metadata refresh process. Even if you don't verify the signature (which is not recommended), note that the HTTP location of InCommon metadata is changing.

Drivers

  1. The InCommon metadata signing certificate expires on May 2, 2014.
  2. The InCommon metadata signing certificate is signed by a legacy CA whose certificate expires on March 29, 2014.
  3. The XML signature on InCommon metadata uses a deprecated (and soon-to-be disallowed) SHA-1 digest algorithm.
    • NIST deprecated the use of SHA-1 in conjunction with digital signatures on January 1, 2011.
    • NIST disallows the use of SHA-1 in conjunction with digital signatures after January 1, 2014.
    • See: NIST SP 800-57 Part 1, Revision 3 (July 2012), Tables 3 and 4
  4. Multiple, heterogeneous services run on vhost wayf.incommonfederation.org, namely, Metadata Services and the Discovery Service. To provide better quality of service, these services need to be segregated on their own vhosts (md.incommon.org and ds.incommon.org, resp.). Note: The InCommon Federated Error Handling Service is already running on ds.incommon.org.

Actions

  1. Replace the current signing certificate with a long-lived, self-signed certificate based on the current key pair. Set the new certificate to expire on December 18, 2037.
  2. Deploy a new metadata aggregate that uses the new self-signed certificate and a SHA2-based signing algorithm (specifically, SHA-256).

  3. Recommend that all deployments migrate to the new metadata aggregate ASAP but no later than [date TBD]. In particular, any deployment that (incorrectly) relies on the legacy CA must either stop doing so or migrate to the new metadata aggregate by March 29, 2014.

  4. Replace the current metadata aggregate with a redirect to the new metadata aggregate on [date TBD].

  5. Create a discussion list for administrators that have questions or problems regarding this transition.
  • No labels