This glossary is helpful for the following documents:

A bandwidth-on-demand system dedicated to reserve resources in heterogeneous, multi-domain environments, allowing immediate and advance circuit reservations. The autoBAHN system provides the production bandwidth-on-demand service for the GÉANT community.

An encoding standard to store (binary) data in ASCII (American Standard Code for Information Interchange) format, i.e. using only a printable sub-set of those 7-Bit characters that ASCII comprises.

see Certification Authority

eduPKI PMA forms the CA Evaluation and Accreditation Team which will evaluate an applying CA in regards to its conformance with a chosen eduPKI Trust Profile. The CA Evaluation and Accreditation Team is responsible for accreditation of conforming CAs as well as suspension and withdrawal of such accreditation.

see X.509 digital Certificate

The main governing document for a CA defining its standards and conditions for issuing X.509 digital Certificates.

An electronically signed list of revoked X.509 digital Certificates issued by a CA.

A Certification Authority issues X.509 digital Certificates and publishes revocation and status information about the issued Certificates.

Based on the CP the Certification Practice Statement of a CA contains detailed information, specifications, CA procedures and security measures for the issuance of X.509 digital Certificates by the CA.

see Common Network Information Service

Provides a unified repository of all relevant network information about a single administrative domain. Apart from the internal functionality required for populating, validating and updating the repository, cNIS is equipped with modules for analysing the network topology data and presenting the data in a client-specified format (graphical, tabular or XML for external applications).

A Certification Authority acting in compliance with an implied or explicitly named eduPKI Trust Profile.

see Certificate Policy

see Certification Practice Statement

see Certificate Revocation List

see Distinguished Encoding Rules

A standard derived from the Basic Encoding Rules (BER) standard to encode Certificates and CRLs when stored in binary form, e.g. in files.

Federation of organisations mutually providing their users access to the Internet connectivity.

RADIUS/TLS server operated by a network visited by a user registered within a different network.

RADIUS/TLS server operated by the network managing an account for a user visiting a different network.

see eduPKI Policy Management Authority

The eduPKI PMA board consists of a chair and a co-chair as well as further members coordinating and performing the work of the eduPKI PMA.

The main governing document defining rules for the eduPKI PMA.

The authority that is managing and coordinating PKI, policy and trust matters between the GÉANT community as Relying Parties and CAs as identity assurers.

eduPKI is using TACAR to provide a trusted download location for the Trust Anchors of CAs.

Definition of minimum requirements of a GÉANT Service in regards to the quality of identity assertions and vetting procedures as well as the supporting assertion infrastructure.

Standards issued by NIST for processing information on U.S. federal computer systems in U.S. government environments.

Processing Standards (USA)

The fast and reliable pan-European communications infrastructure serving Europe’s research and education community.

A service offered by GÉANT participants to the GÉANT community.

The GÉANT Service Area is a common pan-European service infrastructure that enables a range of advanced network services and applications to be offered at a national level by NRENs.

These are network related services with the objective of being available seamlessly in the different management domains across the GÉANT Service Area. Example of such services are autoBAHN, cNIS, I-SHARe and perfSONAR.

An identity assurer, e.g. a CA, issues an identity assertion, e.g. a certificate, once the assurer has vetted the identity of the entity described in the certificate’s distinguished name for assertions issued to persons or the assurer vetted the identity of the certificate requester for other kinds of certificates, e.g. server certificates.

An identity assurer, e.g. a CA, issues identity assertions once the identity assurer has vetted the identity that is or owns the subject described by the identity assertion.

see Internet Engineering Task Force

A collaborative tool to support operations in the management of end-to-end (E2E) network link services in a multi-domain environment. I-SHARe enables the seamless delivery of multi-domain E2E network link services as well as the provision of a consistent operational support system across multiple domains by simplifying collaboration between those participating domains and such making it easier to establish and manage E2E network links.

A community of network designers, operators, vendors and researchers fostering the evolution of the Internet architecture and caring for a smooth operation of the Internet.

see Information Sharing across Heterogeneous Administrative Regions.

The USA’s national standards and technology body.

National Research and Education Networks are providing Internet connectivity as well as additional services to its scientific research and education constituency on a national level.

see National Institute of Standards and Technology (USA)

see National Research and Education Network

A uniquely assigned identifier for a document or object.

see Online Certificate Status Protocol

see Object Identifier

A protocol defined by the IETF in “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP”, RFC 2560, for issuing online queries and receiving responses about the revocation status of an X.509 digital Certificate.

see Privacy Enhanced Mail

The multi-domain monitoring service for the GÉANT Service Area enabling NRENs, Network Operations Centres (NOCs) and Performance Enhancement and Response Teams (PERTs) to collaborate in providing seamless network performance for their network users.

see Performance Service Oriented Network monitoring Architecture

see Public Key Cryptography Standard

see Public Key Infrastructure

see Public Key Infrastructure for X.509 digital Certificates

see Policy Management Authority

A set of governing documents, e.g. CP and CPS, defining quality and operations of a CA.

A Policy Management Authority manages and coordinates PKI, policy and trust matters between Relying Parties which rely on issued identity assurances and CAs as the identity assurers.

A standard and format to store Certificates and CRLs in Base64 encoded form, e.g. files.

A set of standards for public key cryptography, e.g. PKCS#10 describing Certificate Signing Requests (CSRs), PKCS#11 describing an application programming interface (API) for accessing a cryptographic key token and PKCS#12 describing how to store private key material and associated certificates in pass-phrase protected files.

Infrastructure for public key cryptography.

PKI especially built around X.509 digital Certificates; name of a working group at the IETF that writes RFCs in regards to implementing PKI with X.509 digital Certificates.

over TLS; a protocol defined by IETF in “TLS encryption for RADIUS”, draft-ietf-radext-radsec-09, S. Winter, M. McCauley, S. Venaas, K. Wierenga

A Relying Party relies on issued identity assertions, e.g. on X.509 digital Certificates to authenticate the respective holder of the Certificate.

A series of technical and organisational documents and recommendations about the Internet published by the IETF.

see Request for Comments

Asymmetric cryptographic algorithm developed by R. L. Rivest, A. Shamir and L. Adleman used for digital signing and encryption.

Secure Hash Algorithm defined by NIST used to produce cryptographically strong hash sums.

see TERENA Academic CA Repository

Each eduPKI Trust Profile has its specific trust category in TACAR and accredited CAs under an eduPKI Trust Profile are tagged with the TACAR Trust Category.

Trans-European Research and Education Networking Association

A TERENA provided web-site to download various CA certificates.

see Transport Layer Security

see eduPKI Trust Profile

A protocol defined by the IETF in “The Transport Layer Security (TLS) Protocol”, RFC 5246.

An (often self-signed) X.509 digital Certificate bound to a CA.

A trust fabric is a mesh of PKIs, Policies, CAs and X.509 digital certificates of CAs and end-entities that makes up the environment in which Relying Parties are basing and making their trust decisions for authentications.

The eduPKI PMA forms the Trust Team that is assisting GÉANT Services with defining their identity assertion and trust requirements in order to write a Trust Profile document. The Trust Team registers GÉANT Services under Trust Profiles.

A set of recommendations issued by the International Telecommunication Union’s (ITU’s) Telecommunications Standardisation Sector (ITU-T) on PKI with digital certificates (and CRLs).

X.509 digital Certificates are X.509 compliant digitally signed identity assertions issued by an identity assurer, i.e. a CA, expressing the binding of the Certificate holder represented by the Certificate’s subject name to the embedded public key.