HAM-PKI - Versionsgeschichte

DO1GL: link to policy added

DO1GL — Sun, 28 Dec 2014 13:11:44 GMT

link to policy added

← Nächstältere Version		Version vom 13:11, 28. Dez. 2014
Zeile 41:		Zeile 41:
	=== TODO ===		=== TODO ===

-	* ~~solid~~ certification ~~policy~~	+	* robust certification and revocation policy: [[HAM-PKI/Policy]]
-	* solid revocation policy	+
	* CA implementation		* CA implementation
	* validation volunteers		* validation volunteers

OE1LFB um 17:39, 22. Nov. 2014

OE1LFB — Sat, 22 Nov 2014 17:39:22 GMT

← Nächstältere Version		Version vom 17:39, 22. Nov. 2014
Zeile 26:		Zeile 26:
	=== Requirements ===		=== Requirements ===

-	* Operator ~~Idenfitication~~ Process	+	* Operator Identification Process
	** Match "real identity" (person's name) with "amateur identity" (callsign) and "online identity" (email address / browser / app / certificate request)		** Match "real identity" (person's name) with "amateur identity" (callsign) and "online identity" (email address / browser / app / certificate request)
		+	*** don't request passport scans. DON'T.
	** Automation as far as possible		** Automation as far as possible
	* Certificate Issuing Process		* Certificate Issuing Process
Zeile 59:		Zeile 60:

	* Online Form (Full Name[r], Call[r], EMail[r])		* Online Form (Full Name[r], Call[r], EMail[r])
-	* User receives EMail with link to upload website to upload Callsign assignment, CSR and a document which proves identity.	+	* User receives EMail with link to the upload website to upload Callsign assignment, CSR and a document which proves identity (again: no passports)
	** official proof of residence OR		** official proof of residence OR
	** phone, electricity or gas bill with personal name and address (but without more details) not older than 1 month and need to be originally send via snail mail		** phone, electricity or gas bill with personal name and address (but without more details) not older than 1 month and need to be originally send via snail mail
	* User receives status via EMail, that his request is beeing processed		* User receives status via EMail, that his request is beeing processed
	* Admin validates the data.		* Admin validates the data.
-	* User is informed about acceptance, request for more information or denial of request. On acceptance the cert is ~~send~~ out via email	+	* User is informed about acceptance, request for more information or denial of request. On acceptance the cert is sent out via email

	Why do we want a proof of residence or a phone or gas bill and not a scanned ID?		Why do we want a proof of residence or a phone or gas bill and not a scanned ID?

OE1LFB um 17:34, 22. Nov. 2014

OE1LFB — Sat, 22 Nov 2014 17:34:30 GMT

← Nächstältere Version		Version vom 17:34, 22. Nov. 2014
Zeile 16:		Zeile 16:
	Some services (LotW, a pair of APRS-IS implementations) started to use certificates to identify amateur radio operators. These certificates are issued by a Certificate Authority (CA) which will check the operator's identity and callsign before issuing the certificate. Faking such a certificate is cryptographically impossible.		Some services (LotW, a pair of APRS-IS implementations) started to use certificates to identify amateur radio operators. These certificates are issued by a Certificate Authority (CA) which will check the operator's identity and callsign before issuing the certificate. Faking such a certificate is cryptographically impossible.

-	Currently there is only one CA, used by the ARRL to issue Logbook-of-the-World certificates. In addition to the fact that this is a single point of failure, many hams may have problems with sending personal documents around the globe. This lead to the idea, that another CA could be created and that the formal rules for this CA need to be defined and documented. This would make the whole process of issuing and revoking certificates transparent to the amateur who is requesting a certificate, and to server operators who need to decide which CAs they want to trust.	+	Currently there is only one CA, used by the ARRL to issue Logbook-of-the-World (LoTW) certificates. In addition to the fact that this is a single point of failure, many hams may have problems with sending personal documents using the postal service around the globe. This lead to the idea, that another CA could be created and that the formal rules for this CA need to be defined and documented. This would make the whole process of issuing and revoking certificates transparent to the amateur who is requesting a certificate, and also to server operators who need to decide which CAs they want to trust.

	=== Our Goal: Creation of a "Chaoswelle" Root CA ===		=== Our Goal: Creation of a "Chaoswelle" Root CA ===

OE1LFB um 17:30, 22. Nov. 2014

OE1LFB — Sat, 22 Nov 2014 17:30:47 GMT

← Nächstältere Version		Version vom 17:30, 22. Nov. 2014
Zeile 1:		Zeile 1:
	= HAM PKI: Igniting Amateur Radio over Internet Applications =		= HAM PKI: Igniting Amateur Radio over Internet Applications =

-	This is work-in-progress. Join our discussion on #ham-pki on the IRCnet.	+	This is work-in-progress. Join our discussion in <code>#ham-pki</code> on the IRCnet.

	== ChaosWelle Amateur Radio Certificate Authority ==		== ChaosWelle Amateur Radio Certificate Authority ==

DL7TNY um 12:28, 23. Okt. 2014

DL7TNY — Thu, 23 Oct 2014 12:28:18 GMT

← Nächstältere Version		Version vom 12:28, 23. Okt. 2014
Zeile 92:		Zeile 92:

	* Person and Callsign are registered to different locations		* Person and Callsign are registered to different locations
		+
		+
		+	What is done with the documents after the certificate is approved or declined:
		+
		+	* a protocol of the check is saved with the callsign from the person who has checked the documents and perhaps a comment
		+	* all files uploaded by the user will be deleted right after the process has finished.
		+	* If an admin requires more information about a request and no more information are send, the request will automatically be denied after 30days and the data will be deleted. Only a protocol will be saved.

DL7TNY um 12:18, 23. Okt. 2014

DL7TNY — Thu, 23 Oct 2014 12:18:05 GMT

← Nächstältere Version		Version vom 12:18, 23. Okt. 2014
Zeile 58:		Zeile 58:
	Possible manual process:		Possible manual process:

-	# User ~~fills in a form~~ with:	+	* Online Form (Full Name[r], Call[r], EMail[r])
-	** ~~Full Name (required)~~	+	* User receives EMail with link to upload website to upload Callsign assignment, CSR and a document which proves identity.
-	** ~~Callsign~~ (~~required~~)	+	** official proof of residence OR
-	** ~~E-Mail address~~ (to ~~send back~~ the ~~certificate~~)	+	** phone, electricity or gas bill with personal name and address (but without more details) not older than 1 month and need to be originally send via snail mail
-	** ~~Scan/Photo of~~ Callsign ~~assigment (~~to ~~verify that name~~ and ~~callsign belong~~ to the ~~requester~~)	+	* User receives status via EMail, that his request is beeing processed
-	** ~~Certificate Request file~~	+	* Admin validates the data.
-	~~# Admin performs tedious manual check of callsign document, approves or demands more documents~~	+	* User is informed about acceptance, request for more information or denial of request. On acceptance the cert is send out via email
-	~~# Certificate/notification~~ is ~~sent~~ to ~~user via email~~	+
		+	Why do we want a proof of residence or a phone or gas bill and not a scanned ID?
		+	* In some countries (like Germany) you are not allowed to scan or copy your ID card.
		+	* If it is allowed, many people save the scan on their local computer often without working access control in place
		+	* A bill not older than a month which came via postal service is normaly not stored on the computer but has all informations we need
		+
		+
		+	When is a request for a personal cert accepted (all AND connected):
		+
		+	* EMail Adress is working
		+	* Callsign is valid
		+	* Callsign is assigned to requesting person
		+	* Person and Callsign are both registered to the same address
		+	* Adress is valid
		+
		+
		+	When is a request for a personal cert denied (all OR connected):
		+
		+	* EMail Adress is NOT working
		+	* Callsign is NOT valid
		+	* Callsign is NOT assigned to requesting person
		+	* Adress is NOT valid
		+
		+
		+	When is more information required to decide about the request:
		+
		+	* Person and Callsign are registered to different locations
		+

	Problem: manual labor is manual.		Problem: manual labor is manual.
		+

	Possible automation: make smartphone app/app plugin that:		Possible automation: make smartphone app/app plugin that:

DO1GL um 09:37, 23. Okt. 2014

DO1GL — Thu, 23 Oct 2014 09:37:11 GMT

← Nächstältere Version		Version vom 09:37, 23. Okt. 2014
Zeile 5:		Zeile 5:
	== ChaosWelle Amateur Radio Certificate Authority ==		== ChaosWelle Amateur Radio Certificate Authority ==

-	=== Problem ===	+	=== Problem: Authenticating Radio Amateurs Online ===

	Access to some systems or services (for example APRS or the hamnet) over the Internet should only be provided to authorized and licensed amateur radio operators.		Access to some systems or services (for example APRS or the hamnet) over the Internet should only be provided to authorized and licensed amateur radio operators.
Zeile 12:		Zeile 12:


-	=== Solution ===	+	=== Solution: Certificate PKI ===

-	Some services started to use certificates to identify amateur radio operators. These certificates are issued by a CA which will check the operator's identity and callsign before issuing the certificate. Faking such a certificate is cryptographically impossible.	+	Some services (LotW, a pair of APRS-IS implementations) started to use certificates to identify amateur radio operators. These certificates are issued by a Certificate Authority (CA) which will check the operator's identity and callsign before issuing the certificate. Faking such a certificate is cryptographically impossible.

-	Currently there is only one CA, ~~use~~ by the ARRL to issue Logbook-of-the-World certificates. ~~Despite~~ the fact that this is a single point of failure, many hams may have problems with sending personal documents around the globe. This lead to the idea, that another CA could be created and that the formal rules for this CA need to be defined and documented. This would make the whole process of issuing and revoking certificates transparent to the amateur who is requesting a certificate, and to server operators who need to decide which CAs they want to trust.	+	Currently there is only one CA, used by the ARRL to issue Logbook-of-the-World certificates. In addition to the fact that this is a single point of failure, many hams may have problems with sending personal documents around the globe. This lead to the idea, that another CA could be created and that the formal rules for this CA need to be defined and documented. This would make the whole process of issuing and revoking certificates transparent to the amateur who is requesting a certificate, and to server operators who need to decide which CAs they want to trust.
		+
		+	=== Our Goal: Creation of a "Chaoswelle" Root CA ===

	One of the first ideas was to put this CA service into the local amateur radio operators group (for example ARRL in the US, DARC in Germany) but not every amateur radio operator is a member of such a group. Also, integrating such a service in a local group has to tackle many political and bureaucratic hurdles, making it impossible in the short term.		One of the first ideas was to put this CA service into the local amateur radio operators group (for example ARRL in the US, DARC in Germany) but not every amateur radio operator is a member of such a group. Also, integrating such a service in a local group has to tackle many political and bureaucratic hurdles, making it impossible in the short term.

-	~~Another - better idea -~~ is to ~~let volunteers provide this~~ CA within an organization which is known for its privacy and IT knowledge ~~and where every amateur~~ radio ~~operator~~ can request ~~a certificate. The CCC shall be~~ this ~~organization in our case~~.	+	Our goal is therefore to build a volunteer-driven CA within the [https://www.ccc.de/ CCC], an organization which is known for its privacy and IT knowledge. With this CA, any radio amateur can request certificates free of charge, and the documentation and implementation of this CA will be usable as a blue-print for other groups (local clubs, government agencies for amateur radio) to follow.

	=== Requirements ===		=== Requirements ===
Zeile 39:		Zeile 41:

	* solid certification policy		* solid certification policy
		+	* solid revocation policy
	* CA implementation		* CA implementation
	* validation volunteers		* validation volunteers
Zeile 77:		Zeile 80:
	== Applications of Certificate Login ==		== Applications of Certificate Login ==

-	* [https://aprsdroid.org/ssl/ APRS-IS] login	+	* [https://aprsdroid.org/ssl/ APRS-IS] login (implemented, working)
-	* HAMNET user and VPN login	+	* HAMNET user and VPN login (VPN implemented, radio user login TODO)
-	* aprs.fi interactive services	+	* aprs.fi interactive services (TODO)
	* any online service for radio amateurs		* any online service for radio amateurs
		+	** possibly oauth server to reduce the hurdles for 3rd party services

	== Long Term Tasks ==		== Long Term Tasks ==
		+
		+	=== Self-Obsolescence ===
		+
		+	Bring forward Root CA implementations in radio clubs, regulatory offices etc, so that every amateur is equipped with a certificate as soon as she gets her callsign.

	=== Root CA Bundle ===		=== Root CA Bundle ===
Zeile 102:		Zeile 110:
	=== More Online Services ===		=== More Online Services ===

-	~~Document existing~~ amateur radio online services~~, contact the operators.~~	+	Contact the designers/operators of the following services to integrate certificate auth:
		+	* D-Star
		+	* Packet Radio
		+	* net44
		+	* Allstarlink
		+	* DX-Clusters
		+	* ''Add further amateur radio online services''

DO1GL um 17:16, 22. Okt. 2014

DO1GL — Wed, 22 Oct 2014 17:16:48 GMT

← Nächstältere Version		Version vom 17:16, 22. Okt. 2014
Zeile 74:		Zeile 74:
	# Downloads and integrates certificate once issued		# Downloads and integrates certificate once issued

		+
		+	== Applications of Certificate Login ==
		+
		+	* [https://aprsdroid.org/ssl/ APRS-IS] login
		+	* HAMNET user and VPN login
		+	* aprs.fi interactive services
		+	* any online service for radio amateurs

	== Long Term Tasks ==		== Long Term Tasks ==

DO1GL: certification process

DO1GL — Wed, 22 Oct 2014 15:51:09 GMT

certification process

← Nächstältere Version		Version vom 15:51, 22. Okt. 2014
Zeile 26:		Zeile 26:
	* Operator Idenfitication Process		* Operator Idenfitication Process
	** Match "real identity" (person's name) with "amateur identity" (callsign) and "online identity" (email address / browser / app / certificate request)		** Match "real identity" (person's name) with "amateur identity" (callsign) and "online identity" (email address / browser / app / certificate request)
-	** Automation as far as possible ~~(i.e. PostCard with ID code to official address)~~	+	** Automation as far as possible
	* Certificate Issuing Process		* Certificate Issuing Process
	* Revocation Process		* Revocation Process
Zeile 41:		Zeile 41:
	* CA implementation		* CA implementation
	* validation volunteers		* validation volunteers
		+
		+	=== Certification Process ===
		+
		+	Possible automatic process:
		+
		+	# User fills in callsign + certificate request
		+	# Automatic system sends registration-code postcard to address registered in country's official database
		+	# User enters registration-code, can download certificate
		+
		+	Problem: somebody needs to pay for postage & logistics.
		+
		+
		+	Possible manual process:
		+
		+	# User fills in a form with:
		+	** Full Name (required)
		+	** Callsign (required)
		+	** E-Mail address (to send back the certificate)
		+	** Scan/Photo of Callsign assigment (to verify that name and callsign belong to the requester)
		+	** Certificate Request file
		+	# Admin performs tedious manual check of callsign document, approves or demands more documents
		+	# Certificate/notification is sent to user via email
		+
		+	Problem: manual labor is manual.
		+
		+	Possible automation: make smartphone app/app plugin that:
		+
		+	# Lets user enter his personal data
		+	# Makes a photo of required documents
		+	# Creates a key pair and CSR
		+	# Uploads to CA
		+	# Downloads and integrates certificate once issued

DO1GL um 14:20, 22. Okt. 2014

DO1GL — Wed, 22 Oct 2014 14:20:36 GMT

← Nächstältere Version		Version vom 14:20, 22. Okt. 2014
Zeile 1:		Zeile 1:
-	= HAM PKI =	+	= HAM PKI: Igniting Amateur Radio over Internet Applications =
		+
		+	This is work-in-progress. Join our discussion on #ham-pki on the IRCnet.
		+
		+	== ChaosWelle Amateur Radio Certificate Authority ==

	=== Problem ===		=== Problem ===
Zeile 20:		Zeile 24:
	=== Requirements ===		=== Requirements ===

-	* Issue Process
	* Operator Idenfitication Process		* Operator Idenfitication Process
		+	** Match "real identity" (person's name) with "amateur identity" (callsign) and "online identity" (email address / browser / app / certificate request)
		+	** Automation as far as possible (i.e. PostCard with ID code to official address)
		+	* Certificate Issuing Process
	* Revocation Process		* Revocation Process
-	** ~~Revokation from~~ CA	+	** Create Revocation Policy
-	** ~~Revokation from~~ Owner	+	** Provide Public Audit Log of revocations
-	** ~~Revokation from~~ Service Provider due to abuse	+	** Revocation by CA
		+	** Revocation by Callsign Owner
		+	** Revocation by Service Provider due to abuse