Imported from previous forum
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
Sorry for the delay in posting these. They are available in the archive as well.
Minutes for the FIX Encryption Working Group Meeting
New York, July 24, 2000
Attending in Person:
David Aspin, Javelin Technologies
Scott Atwell, American Century
Craig Iskowitz, Mondial Limited
Brien Oberstein, TransactTools, Inc.
Ryan Pierce, Chair, Townsend Analytics Ltd. / Archipelago LLC
Steven Ulbricht, JP Morgan
Attending via Telephone:
Bill Cary, Innovision Corp
Christopher D. Eveleigh, Financial Fusion, Inc.
Chris Lambert, EMX Company Limited
Denis McConalogue, Goldman Sachs International
John Velissarios, PricewaterhouseCoopers
The meeting focused on the PowerPoint presentation, encryption072400.ppt on
the www.fixprotocol.org web site, under Working Groups / Encryption. Some
of the main discussion points were as follows:
-
Scott Atwell stated that he would like to see progress in a few months,
with SSL / TLS pilots happening this year. -
While our initial efforts will not be to achieve non-repudiation, Steven
Ulbricht suggested that we research what industry-wide definitions for
non-repudiation, if any, exist. If the security we can specify is far from
achieving non-repudiation, it may not be worth pursuing this avenue further.
However, if we are close to the mark, it would be wise to create something
which meets the standards. The SEC and/or SIA would be good references. -
Several firms are already using SSL. It is required in EMX’s
architecture, hence vendor FIX engines like Javelin supporting EMX already
include SSL. Likewise, Denis McConalogue mentioned that Goldman has SSL
included in their FIX engine, and would be willing to test with external
parties. -
The SSL vs. TLS question and related ciphersuite question. No clear
answer came from the group; we decided to research the matter further, as the
answer depends on support for SSLv3 and TLS 1.0, as well as the ciphersuites
they support, in many popular vendor crypto packages. We decided to offline
it to the discussion groups. -
We discussed issues related to CA and mapping certificates into CompIDs
or customers.
EMX is the CA in their implementation, and they require that CA’s issue
certificates with the CN (Common Name) attribute including the FIX CompID in
a certain format.
This works for them because the CA in their model enforces the business
rule of verifying that the proper CompID is included in the proper format
for the CN field. It is advantageous because a firm could have multiple
certificates issued for one CompID for multiple FIX engines, and could
renew expired certificates, without notifying one’s trading partners.
It may not work in a more general scope because CompIDs are not centrally
coordinated globally, and firms may wish to use other CA’s that would not
adhere to the CN format.
Another approach involves using the certificate fingerprint, or the
certificate issuer and serial number. While this allows use of other CA’s
(such as public CA’s like Verisign), it does not give clients the
capability of switching certificates without contacting their trading
partners.
Further, the number of CAs in the system can be an issue. One or a small
group of CA’s may work well for a routing network. Firms may wish to
maintain their own CA’s. This could require issuing certificates to
one’s trading partners, or both parties could have their own CA and each
sign their own certificates. Having many CA’s makes the job of checking
Certificate Revocation Lists (CRLs) to verify signatures more difficult.
The EMX security document is posted to the FIX web site, which describes
their implementation of SSLv3 and digital signatures of FIX messages.
EMX has identified future enhancements to their signature method which
is not included in this document.
We also solicited for volunteers to lead efforts within the group. So far
we have:
-
Drafting App Note for SSLv3 / TLS: Craig Iskowitz, Chris Lambert,
Denis McConalogue, Ryan Pierce, John Velissarios -
Investigation of Non-Repudiation with SIA: Steven Ulbricht, JP Morgan.
JP Morgan will sponsor an inquiry within the SIA. -
Developing a Java SSLv3 / TLS open source proxy: Brien Oberstein,
David Aspin