VERICERT Project (Jan 2004- Dec 2004)

Version Française

Four partners

• department LOR and RST at INT
• department RSM at ENST de Bretagne
• department INFRES at ENST
• department IR at ENIC

Abstract

This project is the following of project CI 2003 CADDISC (Combination of LDAP and DNSsec directories for distributing keys) which aims to reach a two-level PKI (Public Key Infrastructure), a global one based on DNSsec, and a local one (companies, schools) using LDAP.

VeriCert aims to improve LDAP security for the keys publishing service, by introducing for some entries of the LDAP basis one more access control according to the search depth.

VeriCert is interested in the three possible uses of the CADDISC certificate verification:

• the authentication done in IEEE 802.11 networks. The results of (CI 2002) Authentis platform will be reused, but instead of basing user's authentication on the certificate presented by the user, CADDISC will ensure the reliability of certificates.
• the authentication in an operator's context. The users will authenticate to the access network through the PANA protocol.
• The authentication in a context of VPN secured by IPsec

Project deliverables will be available in French only

• Document de mise à jour des fichiers d'installation de OpenLDAP et OpenCA, Sébastien Abaga, ENST-Bretagne, 2004.
• SP1 : Etude et développement de la sécurité dans LDAP (Study and development for LDAP security)
  • Réorientations du SP1 (New directions for SP1)
  • Rapport INT, LDAP et la publication de certificats (LDAP and certificate publication), Isabelle Elhadji Toumane, Ziad Yousfi, février 2004
  • Rapport de recherche du GET, "Usage et gestion actuels des certificats numériques", Chakib Bekara, Maryline Laurent-Maknavicius, rapport 04014 LOR, 2004.
  • Rapport de recherche du GET, "Méthodes de révocation des certificats numériques", Chakib Bekara, Maryline Laurent-Maknavicius, rapport 04015 LOR, 2004.
• SP2 : Couplage des travaux de CADDISC et Authentis (Combining CADDISC and Authentis projects)
• Travaux sur la Politique de certification en cours (Ongoing works on the certification policy)
• Mise en oeuvre de l'authentification dans LDAP (implementing authentication in LDAP)
  • Mise en oeuvre de TLS/SSL pour OpenLDAP (Implementing TLS/SSL in OpenLDAP), M. Gardie
  • Mise en oeuvre de SASL et de Kerberos pour OpenLDAP (Implementing SASL and Kerberos in OpenLDAP), M. Gardie

• Intégration de CADDISC dans les VPN-IPsec (CADDISC integration into IPsec-VPN)
• Sources
  • guide d'installation
  • CONFIG-racoon
  • INSTALL-OpenSSL-and-Co
  • INSTALL-racoon
  • curl-7.11.1.tgz
  • curl-diffs
  • openssl-diffs
  • openssl-ipsec.tgz
  • openssl-overwrite-base-0.9.7d.tgz
  • openssl-scvp.tgz
  • racoon.conf
  • racoon.tgz
  • test-scvp.tgz

Publications regarding LDAP, DNSsec, and IP security

• V. Le Poupon, V. Royer, "Authentification forte auprès d'un serveur LDAP par la méthode SASL Kerbéros" (fichier pdf), juin 2004.
• C. Benhamed, M. Oudrhiri, "SASL & LDAP" (fichier Word Winzippé), juin 2003.
• F. Dupont, " DNSsec for IPsec: The RNRT "IDsA" Project ", IPsec 2002, Paris, Dec. 2002.
• G. Guette, O. Courtay, "A Key RollOver Algorithm for DNSsec", ICICT 200 3, nov-déc 2003.
• G. Guette, O. Courtay, B. Cousin, "Complémentarité de DNSsec et d'IPsec", JRES03, nov 2003.
• A. Hecker, H. Labiod, A. Serhrouchni, " Authentis: Through Incremental Authentication Models to Secure Interconnected Wi-Fi WLANs ", Second IEEE Workshop on Applications and Services in Wireless Networks ASWN 2002, Paris, July 2002.
• M. Laurent, "Les annuaires LDAP et DNSSEC au service d'une PKI globale", 3ème Conférence sur la Sécurité et Architectures Réseaux, SAR 2004, La Londe, Côte d'Azur, France, juin 2004.
• M. Laurent, J. Bournelle, " Inter-domain security for Mobile IPv6 ", vol 58, No 7-8 des Annales des Télécommunications, 2003.
• M. Laurent, " La sécurité d'Internet ", Technique de l'Ingénieur, 2001.
• M. Laurent, "Le protocole IPsec", Techniques de l'Ingénieur, 2003.
• N. Rasamoely, "Gestion des certificats par LDAP", septembre 2002.
• Infrastructure DNSsec et Applications, www.telecom.gouv.fr/rnrt/projets/res_02_22.htm.
• D.A. Wheeler, "Easier Email Security is on the Way?", November 2004 (original version April 2002)

IETF works

• S. Boeyen, T. Howes, P. Richard, " Internet X.509 Public Key Infrastructure: Operational Protocols - LDAPv2 ", RFC 2559, April 1999.
• D. Eastlake, " Domain Name System Security Extensions ", RFC 2535, March 1999.
• D. Forsberg, Y. Ohba, B. Patil, H. Tschofenig, A. Yegin, " Protocol for Carrying Authentication for Network Access (PANA) ", draft-ietf-pana-pana-01, June 2003.
• R. Housley, W. Ford, W. Polk, D. Solo, " Internet X.509 Public Key Infrastructure Certificate and CRL Profile ", RFC 2459, Jan. 1999.
• Malpani, R. Housley, T. Freeman, "Simple Certificate Validation Protocol (SCVP)", draft-ietf-pkix-scvp-12, June 2003.
• M. Wahl, T. Howes, S. Kille, " Lightweight Directory Access Protocol (v3) ", RFC 2251, Dec. 1997.