RFC proxy and SHA-2 signature support in WLCG middleware

Introduction

IGTF would like CAs to move from SHA-1 to SHA-2 signatures ASAP, to anticipate concerns about the long-term safety of the former.

• See https://twiki.grid.iu.edu/bin/view/Security/HashAlgorithms

For WLCG this implies using RFC proxies instead of the Globus legacy proxies in use today.

• See Jan GDB presentation for detailed explanation

Updates on the state of affairs are regularly presented in GDB meetings:

• Sep 2012
• Jul 2012
• Apr 2012
• Feb 2012
• Jan 2012

Phases and milestones

1. Deployment of SW supporting RFC proxies

• Proxy usage:
  • Legacy
  • RFC only in special tests
  • SHA-2 only in special tests
• SW supports:
  • Legacy
  • RFC maybe
  • SHA-2 maybe
• Milestone:
  • All deployed SW supports RFC proxies
• Additional goal:
  • All deployed SW supports SHA-2, except dCache and BeStMan

2. Switch to RFC proxies

• There should be no issues with that by this time

3. Upgrade dCache and BeStMan

• Proxy usage:
  • RFC
  • SHA-2 only in special tests
• SW supports:
  • RFC
  • SHA-2 maybe
• Milestone:
  • All deployed SW supports SHA-2

4. Introduce SHA-2 CAs

• Plan B ?
  • Best avoided!

Status of EMI/UMD middleware for WLCG

Product	Version	RFC proxies	SHA-2 support	Availability	Notes
APEL-Publisher
ARC-CE
ARC-Infosys
Argus
BDII-site
BDII-top
CREAM
dCache
DGAS-sensors
DPM
EMI-UI
EMI-WN
FTS
gLExec
gLite-CLUSTER
LB
LFC
MyProxy
StoRM
VOBOX
VOMS
WMS

Status of OSG middleware for WLCG

Status of CERN middleware for WLCG

Status of central EGI services for WLCG

Status of central OSG services for WLCG

Status of LHC experiment software

-- MaartenLitmaath - 26-Jun-2012