| |
Comment: |
Gentlemen,
I've read your submission of the "GRIP PKI and CA Policy"
and have a few questions and comments. If I understand
the goals of the paper correctly, I believe there is a
publishable Experimental document here after a few
edits. Would you be so kind as to forward these comments
to Reinhard Letz as his email was missing from the draft.
With the exception of the section entitled "Interfacing UNICORE PKI
and Globus PKI", the document has a thorough description of how you
operated your project's PKI. This, particularly if compared with
documents from the CAOps working group (eg. GFD 16 & 17), would be a
welcomed experiences document for the Experimental thread. I believe
this is the intent rather than a general recommendation on how to run
a PKI (for UNICORE).
Since the only PKI changes required for the GRIP interface section was
the introduction of proxy certificates and a couple additional service
certificates, I wonder if this section doesn't belong better in the
"GRIP Interoperability" paper. However, this paper may strive to
record the GRIP PKI as differentiated from the UNICORE PKI and thus
need it. In which case, I'd say these interoperability driven features
are an integral part of the GRIP PKI. Subsection 3 (Comparison of
UNICORE and Globus Security) seems to contain much discussion
appropriate to a "Security Considerations" section. Appendix B belongs
in the paper and I'd recommend moving some text to the Security
Considerations section.
Either way, I'd ask you to review the paper in light of my comments on
the Interoperability document to be careful about distinguishing
between the Globus collaboration, the Globus toolkit, and the GRIP
project participants running services based on the Globus toolkit. As
an example, I refer you to the third paragraph of section 5 (The GRIP
PKI) on page 7: "For use of Globus, the user is also issued a Globus
certificate by the Globus CA." I believe you mean that in order to use
resources running services based on the Globus toolkit, the user is
issued a X.509 certificate from the "Globus CA" you operate as part of
the GRIP project. One could easily get the impression you were
interacting with services offered by the Globus collaboration
(particularly since they offer a "bootstrapping" Globus CA for folks
to get test certificates) when in fact, you are completely independent
as far as I can tell.
I'll return the document to you for your edits
and response.
|
