HAM PKI

Problem

Access to some systems or services (for example APRS or the hamnet) over the Internet should only be provided to authorized and licensed amateur radio operators.

APRS currently uses a passcode, which is just some kind of checksum of the callsign. There are many freely available tools, which you can use to generate your own APRS passcode for every string you can imagine. Based on that information an APRS passcode is not a secure way of authenticating an amateur radio operator.

Solution

Some services started to use certificates to identify amateur radio operators. These certificates are issued by a CA which will check the operator's identity and callsign before issuing the certificate. Faking such a certificate is cryptographically impossible.

Currently there is only one CA, use by the ARRL to issue Logbook-of-the-World certificates. Despite the fact that this is a single point of failure, many hams may have problems with sending personal documents around the globe. This lead to the idea, that another CA could be created and that the formal rules for this CA need to be defined and documented. This would make the whole process of issuing and revoking certificates transparent to the amateur who is requesting a certificate, and to server operators who need to decide which CAs they want to trust.

One of the first ideas was to put this CA service into the local amateur radio operators group (for example ARRL in the US, DARC in Germany) but not every amateur radio operator is a member of such a group. Also, integrating such a service in a local group has to tackle many political and bureaucratic hurdles, making it impossible in the short term.

Another - better idea - is to let volunteers provide this CA within an organization which is known for its privacy and IT knowledge and where every amateur radio operator can request a certificate. The CCC shall be this organization in our case.

Requirements

• Issue Process
• Operator Idenfitication Process
• Revocation Process
  • Revokation from CA
  • Revokation from Owner
  • Revokation from Service Provider due to abuse

TODO

• solid certification policy
• CA implementation
• validation volunteers

Long Term Tasks

Root CA Bundle

Management of a list of Root CAs is non trivial, as can be seen from the different browser developers, OS vendors etc, especially in the context of the CACert inclusion.

To make life for service administrators easier, we should maintain and provide a Root CA bundle" - a package containing a set of Root CAs that we deem as trusted, according to a documented set of rules.

Alternatively, this could be achieved by creating Sub-CA certificates for the existing ham radio CAs, making one effective Root CA that only delegates signing of individual amateurs.

EchoLink

EchoLink is using a manual verification process of users prior to allowing them on the EchoLink Internet backbone. We need to get in touch with the responsible people at EchoLink, so we can achieve two synergy effects:

• Implement Certificate-based authentication on the EchoLink backbone
• Provide the EchoLink verification team with a CA so they can issue certificates for other applications as well

More Online Services

Document existing amateur radio online services, contact the operators.