Mobile ID client from Nerd integrated with EJBCA PKI from PrimeKey

Mobile ID is a open source new Android app for signatures and encryption developed by Nerd in Greece. It is still a beta version, but I though it might be interesting to know. It has been integrated with EJBCA so you can get a certificate easily. Development and further integration will also continue beyond this point. Also see press release.

Enterprise EJBCA features vs Community

EJBCA version 6 with EJBCA Enterprise and EJBCA Community is released by now. Instead of this blog post, that are getting aged, you should head over to the newer pages.

This is a continuation of the blog post EJBCA will always be Open Source.

Here we will describe the feature difference between EJBCA 5 (Enterprise) and EJBCA 4 (Community). For a high level overview you should first read EJBCA will always be Open Source.
For a list of all the features in EJBCA, visit EJBCA.org.

The freshest, most up to date, description of EJBCA Enterprise features will be available at PrimeKey.

EJBCA Enterprise Edition vs Community

EJBCA 5 has features required for high trust environments:

• Common Criteria EAL4+ and CWA 14167 certified.
• Certified access control and authorization module, for assurance and high trust role separation.
• Integrity protected security audit log, with digital signature or HMAC protection.
• Improved security audit log messages, complete information that is auditable.
• Full database integrity protection of all tables, to detect database manipulation.
• Authentication of local CLI users enabling role separation also for local CLI.
• Penetration tested with improved security.

Users requiring certified operations, Common Criteria, CWA, ETSI or WebTrust will benefit greatly from EJBCA 5.
In addition to that there are other minor changes that are unique to EJBCA 5. These changes are the result of the majority of development resources now focusing on future versions of EJBCA, and will eventually water down to Community EJBCA.

• Smaller release ZIP file.
• Minor CLI improvements with new methods and parameters.
• New database CLI for database export, import and verification.
• Support for Permanent Identifiers (RFC 4043) and authorityInformationAccess in CRLs.
• Support for SIP and Kerberos extended key usages.
• Improved memory efficiency in certain use cases.
• Optimized database usage.
• Other minor improvements and bugfixes.

Normal users will be satisfied with the feature set, and the record breaking performance, of EJBCA 4.

Feature comparison table

The freshest, most up to date, description of EJBCA Enterprise features will be available at PrimeKey.

This is a snapshot at the time this blog post was written.

Feature	Enterprise	Community
License	Open Source LGPL v2.1 or later	Open Source LGPL v2.1 or later
PKI features	Full, including all protocols	Full, including all protocols
Recommended for	EJBCA Enterprise is recommended for Corporations, Governments and other organizations looking for an enterprise scale, production-ready, certified, open source PKI solution without any upfront license fees.	EJBCA Community is recommended for developers and technical PKI users in non-mission critical environments. As this version is unsupported it is intended to be used by those prepared to spend time and resource solving issues independently.
Suitable for	EJBCA is suitable for small to huge scale PKI deployments ranging from 1000 to over 100 million issued certificates.	EJBCA is suitable for small to huge scale PKI deployments ranging from 1000 to over 100 million issued certificates.
Security Certifications	EJBCA Enterprise has been certified under Common Criteria EAL 4+ (CIMC Protection Profile) and CWA 14167-1 (at customer locations).	None
Commercial support	PrimeKey provides commercial support with Service Level Agreements (SLA) for issue tracking, problem resolution, patches and fixes.	None provided, community support through forums and mailing lists.
Integrity protected security audit	EJBCA Enterprise features a Common Criteria certified security audit mechanism using HMAC or digital signatures for integrity protection.	No
Database integrity protection	EJBCA Enterprise features a Common Criteria certified database protection protecting the database from malicious DBAs.	No
Penetration tested	EJBCA Enterprise has been penetration tested as part of Common Criteria evaluation, and by independent security testers.	No
Role separation	Full role separation including local command line interface.	Role separation for remote access users.
Security flaw remediation process	PrimeKey have a Common Criteria evaluated tracking process for security, and other, bug reports.	EJBCA Community follows an open development and issue tracking process, without guaranteed response times.
License Price / Subscription	No software license fee – Provided as part of an annual subscription for commercial level support.	No software license fee – free to download, free to use.
Additional features	Emergency hot fixes, security alerts, best practice advice, private issue tracking portal, additional guides and tools.	Most feature complete and most flexible PKI, with highest performance, compared to most open source and commercial PKIs.
Training	Customers and Partners get training on latest certified PKI from PrimeKey (additional cost depending on your contract).	Contact PrimeKey.

Cert-cvc 1.3.0 released

We have released version 1.3.0 of the ePassport EAC library cert-cvc. This version is a minor release that only adds support for BouncyCastle v 1.47.
Cert-cvc now work with BC 1.46 and BC 1.47.

Visit EJBCA.org for downloads.

Regards,
PrimeKey EJBCA Team

EJBCA will always be Open Source

Since EJBCA 5 there is now one version of EJBCA that is free to download and one that is not.

This blog will try to clarify why and what this means.

Why we are doing this

EJBCA 5.0 is Common Criteria and CWA (14167) certified software. Software certification costs many hundred of thousands of euros, a substantial investment by PrimeKey Solutions to fulfil customer needs for certified software.

PrimeKey is a commercial company employing most of the EJBCA developers and makes a living out of selling support, services and training for EJBCA and SignServer.

PrimeKey can not afford to give away certification for free to large organizations with much larger funds than PrimeKey itself. Without employed EJBCA developers EJBCA can not continue to be among the top PKI software in the world.

To fulfil the needs of these customers, and also the community, two version of EJBCA are needed:

• Certified versions of EJBCA, not available for free download.
• Non-certified versions of EJBCA, available for free download.

EJBCA Enterprise Edition

Many organizations require that PKI software is certified according to Common Criteria and/or CWA.

Certified software can require additional features, such as secure audit logging and database integrity protection.

Software certification is a business requirement and has generally little to do with the code itself. EJBCA 5 is aimed to the Enterprises that have these higher trust requirements.

Enterprise EJBCA is:

• available to all support customers.
  
• features all newest features required for higher trust and maximum performance
  
• security certified according to Common Criteria and CWA
  
• supported with SLA
  
• Open Source LGPL v2.1 or later
  

The current Enterprise EJBCA version is EJBCA 5.0.

EJBCA Community Edition

EJBCA is an open source project. It is one of the most widely used PKIs in the world with deployments on all habited continents.

Organizations that do not require certified software or SLA support can use the Community EJBCA.

PrimeKey will still maintain the Community version of EJBCA. We will continue to provide new features and bug fixes to ensure that both versions of EJBCA will remain the leading PKI software.

PrimeKey always contributes back the features from the certified version to the Community, and PrimeKey's customers pay for development of many features that goes directly into the open source project.

Community EJBCA is:

• available for anyone to download and use
  
• still maintained with new features and bug fixes
  
• supported by the community
  
• Open Source LGPL v2.1 or later
  
• advanced features will be introduced first in Enterprise EJBCA but may eventually end up in later versions of Community EJBCA
  

The current Community EJBCA version is EJBCA 4.0.

Open Source at Security Document World 2012

I will hold a presentation called "Leveraging Open Source technologies for secure electronic documents" at Security Document World 2012.

Summary of the presentation:

Todays security documents requires the deployments of extensive security software infrastructures, primarily PKI based. Current, and future, security documents such as passports, ids, driver licenses and tachographs all require one or several public key infrastructures to produce and use.
This presentation will show open source solutions available to support these documents, including CSCS, Document Signer, CVCA, DV and Inspection Systems. We will explain how security document producers can use these solutions in the best and most efficient way, and what pitfalls to avoid. In order to reap the full benefits of open source and open standards there are a few more things to consider apart from simply viewing it as cost free software.
Finally we will display real world use cases where open source software is part of the production of millions of security documents.

I will mention several open source project:
- EJBCA
- SignServer
- JMRTD
- ISODL
- BouncyCastle
- etc

Looking forward seeing you at the conference :-)

EJBCA 5.0.4 released

We have released EJBCA 5.0.4 to our customers. This is a release that is delivered for, hopefully, final evaluation for Common Criteria EAL 4+. We keep our fingers crossed.

A few new minor features was also added during the development phase. These are customer requested OCSP features and a few usability improvement found during customer installations.

This is a maintenance release with a few bug fixes and new features. In all, 20 issues have been resolved.

Noteworthy changes:

• OCSP: Possibility to only publish revoked certificates to Validation Authority.
• OCSP: Possibility to treat "non existing is good" based on URI on the Validation Authority.
• Do not allow creation of CAs using weak keys.
• Add Kerberos extended key usages.
• Add possibility to specify certificate profile to CA init CLI command.
• Fix a few more tests on windows platform.
• Fixed minor security issues in admin web.
• Fixed a few cosmetic issues improving usability.

EJBCA 5.0.x, being a certified version, is not available for free download on the internet, as previous version has always been. Contact PrimeKey if you want access to EJBCA 5.0.

Ubuntu GNU/Linux 12.04 (precise) on Sony Vaio SE15 (VPCSE1v9E)

Ubuntu GNU/Linux 12.04 (precise) on Sony Vaio SE15 (VPCSE1v9E), SandyBridge version.

Update 2013: This machine has very poor build quality. If you use it daily it will start falling apart after a year or so of use. Don't buy.

The findings here are not my own. All credits goes to the authors in the Ubuntu forums on vaio S compatibility.

Update Ubuntu 13.10:
Using Ubuntu 13.10  by now, and everything works basically flawless. Still starting to look for a new machine though, as the quality of this one is not so good. Casting eyes on the new Dell XP13 DE, with Linux pre-installed...

Update Ubuntu 12.10:
Using Ubuntu 12.10 I have changed my approach a little bit.

• Use hacked BIOS with advanced menus. This enables me to permanently disable the Radeon in BIOS. Otherwise it will be re-activated after suspend/resume so power consumption will be high after resume.
• Use the powersavings script below.
• Use Kernel 3.7 from Ubuntu Mainline. This have some new power saving improvement.

With the above I can really get 4+ hours out of the battery, stable through suspend/resume cycles.

Update Ubuntu 12.04: In Ubuntu 12.04 no kernel parameters are needed. ASPM does not seem to work anyhow and the i915 parameters are enabled by default in the kernel.
I have also found a weak point of the laptop. The air intake fr cooling is located under the machine, exactly where your leg is if you have the laptop in your lap. When blocking the air intake with your leg the machine overheats and throttles the CPU to a crawl.

The Vaio SE15 is a very nice machine. It is easy to replace an existing HDD with an
SSD, it is very light and has good screen and keyboard.
Installing Ubuntu 12.04, precise pangolin from USB works like a charm, no issues.
Update: Due to inadequate cooling I would not buy this machine again. Extremely nice chassis, but overheats and throttles the CPU very easily.

I used the alternate installer in order to get full disk encryption. The alternate installer completed without any glitches, and boots me directly into Ubuntu.
A minor gotcha is that most times, but not always, I get a blank screen instead of the boot password screen (to unlock full disk encryption). It is not hung though, so just enter your password in the blank screen and it boots.

Using 12.04 everything works out of the box, trackpad (including two finger scrolling), wireless, screen, suspend and resume. I used wired network during install, but connected to wifi ince installed.

Using the Vaio the only thing that needs attention is the switchable graphics, and powersaving features. Powersaving is the area where GNU/Linux, by default, is not as good as the Mac, and requires some technical tweaking.

I use only the Stamina (Integrated Intel graphics) mode of the Vaio, and want Speed (Discrete ATI graphics) to be disabled at all times.
By default the ATI card is powered on even in Stamina mode (the physical switch does not physically power of the ATI graphics), so when booting Ubuntu the first time fans will be always on until you manage to power of the ATI card.

With the settings distilled from Ubuntu forums on vaio S compatibility everything works nice and I get the following results.

Battery drain between 9500 and 12500 mW when idling and doing light work (like writing this). This should give a standard battery life between 4-5 hours using the built in 52170mWh battery.
In reality I am a developer, and with some things open and doing some real work, power consumption is between 15 and 30W, giving battery times of say 2-3 hours.

I also added an instruction how to enable TRIM support if you are using an SSD, and also how to re-enable hibernate in Ubuntu 12.04 (precise).


On to the forum summary of settings.


* 1. Make sure Intel powersaving features are enabled
-----------------------------------------------
sudo vi /etc/default/grub

Add some items to the kernel boot parameters, use the following line

GRUB_CMDLINE_LINUX_DEFAULT="quite splash i915.i915_enable_fbc=1 i915.i915_enable_rc6=1 pcie_aspm=force"

update-grub

pcie_aspm=force does not work btw, if anyone can solve this that would be benefitial. Getting:
"ACPI _OSC control for PCIe not granted, disabling ASPM"
-----------------------------------------------

* 2. Disable (power off) Radeon discrete graphics at all times, and power of bluetooth on boot.
We use vgaswitcheroo for this. It is included by default in Ubuntu 12.04, no need to install anything
We also make sure bluetooth is disabled on boot hrer.

- Power of at boot
sudo vi /etc/rc.local

add the following before 'exit 0'

echo OFF > /sys/kernel/debug/vgaswitcheroo/switch
rfkill block bluetooth

- Install so it runs at resume from suspend
(not sure this is needed, but it does not hurt and does not take ant time)

sudo vi /etc/pm/sleep.d/10_disable_radeon

add the following to the file

#!/bin/sh
# Action script ensures that discrete graphics card is disabled after
# resuming from standby/hibernate
#
#
case "${1}" in
resume|thaw)
echo OFF > /sys/kernel/debug/vgaswitcheroo/switch
;;
esac

sudo chmod +x /etc/pm/sleep.d/10_disable_radeon
-----------------------------------------------


* 3. Add script to enable/disable powersavings in battery vs powered mode
-----------------------------------------------
sudo apt-get install ethtool
sudo vi /etc/pm/power.d/powersavings

add the following to the file

------ Start add from below -----

#!/bin/sh

# Shell script to reduce energy consumption when running battery. Place
# it in /etc/pm/power.d/ and give execution rights.

# This is a modified version of an original script of by Skumpic,
# available here: http://blog.liberailvoip.it/2010/04/27/
# ubuntu-lucid-lynx-acer-aspire-one-impostazioni-ottimizzate-
# autonomia-prestazioni/

# Disable Wake On Lan
ethtool -s eth0 wol d

if on_ac_power; then
# ----- Start AC powered settings #

# Disable laptop mode
echo 0 > /proc/sys/vm/laptop_mode

# Set SATA channel: max performance
for foo in /sys/class/scsi_host/host*/link_power_management_policy;
do echo max_performance > $foo;
done

# Set Max Power for wifi interface
# change value according to your hardware!
iwconfig wlan0 txpower 14   

# Disable wifi power saving
iwconfig wlan0 power off

# CPU Governor: Performance
for foo in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor;
do echo performance > $foo;
done

# Disabile USB autosuspend
for foo in /sys/bus/usb/devices/*/power/control;
do echo on > $foo;
done

# Disable PCI autosuspend
for foo in /sys/bus/pci/devices/*/power/control;
do echo on > $foo;
done

# Disabile audio_card power saving
echo 0 > /sys/module/snd_hda_intel/parameters/power_save_controller
echo 0 > /sys/module/snd_hda_intel/parameters/power_save

# Set maximum display backlight
echo 15 > /sys/class/backlight/acpi_video0/brightness

# ----- End AC powered settings #

else

# ----- Start battery powered settings #

# Enable Laptop-Mode disk writing
echo 5 > /proc/sys/vm/laptop_mode

# Set SATA channel to power saving
for foo in /sys/class/scsi_host/host*/link_power_management_policy;
do echo min_power > $foo;
done

# Activate wifi power saving
iwconfig wlan0 power timeout 500ms

# Reduce wifi txpower
iwconfig wlan0 txpower 5

# Select Ondemand CPU Governor
for foo in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor;
do echo ondemand > $foo;
done

# Activate USB autosuspend
echo auto > /sys/bus/usb/devices/1-1.1/power/control # Fingerprint sensor
echo auto > /sys/bus/usb/devices/1-1.3/power/control # Webcam

# Activate PCI autosuspend
for foo in /sys/bus/pci/devices/*/power/control;
do echo auto > $foo;
done

# Activate audio card power saving
# (sounds shorter than 5 seconds will not be played)
echo 5 > /sys/module/snd_hda_intel/parameters/power_save
echo 1 > /sys/module/snd_hda_intel/parameters/power_save_controller

# Set medium display backlight
echo 5 > /sys/class/backlight/acpi_video0/brightness


# ----- End battery powered settings #

fi

----- Stop add above -----

Make executable

sudo chmod +x /etc/pm/power.d/powersavings
-----------------------------------------------

* 4. Enable TRIM on SSD
-----------------------------------------------
(only if using an SSD)

sudo cp /etc/fstab /etc/fstab_bak-notrim
sudo vi /etc/fstab

look for the root partition entry, something like:
/dev/mapper/host-root / ext4 errors=remount-ro

add discard to the parameters, like
/dev/mapper/host-root / ext4 discard,errors=remount-ro

You can also add the noatime parameter to save some disc writes.

Reboot to enable
-----------------------------------------------

* 5. Re-enable hibernate in Ubuntu 12.04 (Precise)
-----------------------------------------------
In Ubuntu 12.04, Precise, Hibernate is not available by default. It is rather easy to enable though.
When enabled, both hibernate and suspend works well on the Vaio.

sudo vi /etc/polkit-1/localauthority/50-local.d/com.ubuntu.desktop.pkla

Add the following (probably creating the file)

[Re-enable hibernate by default]
Identity=unix-user:*
Action=org.freedesktop.upower.hibernate
ResultActive=yes

Credits for this tip goes to
Askubuntu


Reboot to enable
-----------------------------------------------



You can use acpi_call instead of vgaswitcheroo to disable the radeon video card.
acpi_call causes resume to take a long time, so therefore I recommend vgaswitcheroo,
which is also included by default in Ubuntu (12.04).

This is only kept for reference, don't use if you followed the guide above.

* Use acpi_call to turn of ATI card at all times.
-----------------------------------------------
(also disable bluetooth on boot)

- build and test
sudo apt-get install git
git clone https://github.com/mkottman/acpi_call.git
cd acpi_call
make
sudo insmod acpi_call.ko
lspci -vnnn | grep VGA
sudo chmod +x test_off.sh
./test_off.sh
(Trying \_SB.PCI0.PEG0.PEGP._OFF: works!)

- Install
sudo cp acpi_call.ko /lib/modules/`uname -r`/kernel/
sudo depmod
sudo modprobe acpi_call
sudo vi /etc/modules
- add the following after 'lp'
acpi_call

- Make sure it starts
sudo vi /usr/local/bin/radeon_off_sony_sa.sh

add the following to the file

#!/bin/sh
echo "\_SB.PCI0.PEG0.PEGP._OFF" > /proc/acpi/call

sudo chmod +x /usr/local/bin/radeon_off_sony_sa.sh

- Test
sudo /usr/local/bin/radeon_off_sony_sa.sh
sudo cat /proc/acpi/call

- Install so it runs at boot
sudo vi /etc/rc.local

add the following before 'exit 0'

/usr/local/bin/radeon_off_sony_sa.sh
rfkill block bluetooth

- Install so it runs at resume from suspend
(this can make resume be a little slow, with black screen for a few seconds when resuming)

sudo vi /etc/pm/sleep.d/10_disable_radeon

add the following to the file

#!/bin/sh
# Action script ensures that discrete graphics card is disabled after
# resuming from standby/hibernate
#
#
PATH=/usr/local/bin:/bin
case "${1}" in
resume|thaw)
radeon_off_sony_sa.sh
;;
esac

sudo chmod +x /etc/pm/sleep.d/10_disable_radeon
-----------------------------------------------