![](media/image1.jpeg){width="1.75in" height="1.2666666666666666in"}

United States Department of Agriculture Government Program

######### 

#########  Frequently Asked Questions

eAuthentication

Updated: 6/17/03

#########  

**Q1: Why should agencies integrate with WebCAAF in the short term
rather than waiting for the GSA Gateway?**

A1: There are several advantages to integrating with WebCAAF instead of
waiting for the GSA gateway.

1.  WebCAAF is expected to be available in time for applications to meet
    the 10/03 GPEA deadline. The timeframe and long term costs for the
    GSA Gateway are uncertain and may not be known for a few months.

2.  Agency applications will be able to integrate with WebCAAF in the
    short term to provide authentication at the assurance level WebCAAF
    provides. WebCAAF will integrate with the GSA Gateway once the
    gateway is ready. This will allow applications to seamlessly accept
    the higher assurance level credentials provided by the gateway with
    no configuration changes when the GSA Gateway is available.

3.  Additional advantages of using WebCAAF include:

    a.  WebCAAF will provide a standard security methodology and
        platform across USDA agencies

    b.  WebCAAF will provide basic access control, while the GSA Gateway
        will only provide authentication. Agency applications would have
        to build their own basic authorization engine, even if it is
        just for standard HTML pages.

    c.  If all applications use WebCAAF, single sign-on across USDA
        applications will be a possibility. By having some applications
        go directly to the GSA gateway, single sign-on will not be
        possible.

    d.  An Agency Guidebook will be published for WebCAAF to provide
        integration guidance for Agencies. There is no timeframe for GSA
        to issue a similar document.

    e.  Individual agency applications will not have to integrate
        separately with the GSA Gateway if they are integrated with
        WebCAAF; WebCAAF will be the one integration point between USDA
        Applications and GSA.

**Q2: When will the long term agency costs for using WebCAAF be
available?**

A2: Final costs for integrating with and using WebCAAF will be available
at the completion of the 16-week pre-implementation project, currently
scheduled for the end of July 2003. The current fixed cost for
SiteMinder licenses is \$1.41 per user. There will be other fixed costs
for additional software, hardware, architecture enhancements and
support.

**Q3: Why can\'t users get certificates from any Certificate Authority
rather than integrating with WebCAAF or the GSA Gateway?**

A3: USDA users will be required to authenticate with a credential that
meets the assurance level defined for the transaction. In order to
achieve cross federal government interoperability, each credential
provider must be certified by GSA as an ECP (Electronic Credential
Provider) with an associated assurance level that the credential
provides. Agencies may not directly accept certificates from commercial
providers for the following reasons:

1.  The assurance level provided by the Certificate Authority may not be
    certified by GSA. All credential providers must follow stringent
    requirements to meet each assurance level, and the certificate
    authority must go though an extensive GSA audit to be certified for
    each assurance level.

2.  Most external certificate authorities will not qualify as ECPs for
    individual users. For example, VeriSign only offers a Class 1
    certificate to citizens and this credential would not meet the ECP
    requirements for any assurance level, as the identify proofing is
    only based on a valid email address.

3.  Non-standard credentials will not be accepted at the GSA Gateway. If
    the certificate authority is not an ECP, other federal agencies will
    not accept the certificate. This would require the user to obtain
    another certificate to transact with other federal agencies that are
    integrated with the GSA Gateway.

4.  Agency applications would have to build the separate components to
    authenticate certificates. When an application requests a
    certificate, the application must be able to process the certificate
    with the Certificate Authority. The processing includes checking the
    expiration date, real-time CRL (Certificate Revocation List)
    checking and being able to map the distinguished name in the
    certificate to a backend directory. For applications integrated with
    WebCAAF or the GSA Gateway, this processing will be performed for
    them.

**Q4: Will agencies be required to define their entire registration
process?**

A4: The requirements will vary by level of assurance and will be
specific to each type of supported authentication technology (e.g.,
password, PIN, or other credential). Agencies will be required to define
processes that follow these detailed requirements to register users. An
agency guidebook (to be ready by the end of July) will contain
registration process requirements that map to the Authentication
Assurance Levels for WebCAAF. Additionally, a standard process and
associated application will be available for agencies to leverage.

**Q5: Does WebCAAF issue certificates?**

A5: No, WebCAAF issues *credentials*, not certificates. WebCAAF
credentials are a username and password.

**Q6: Can WebCAAF provide more than one level of authentication?**

A6: There are two main parts of WebCAAF -- the authentication engine and
the credential store. Although technically the WebCAAF authentication
engine can accept different levels of credentials, such as
Username/Passwords or PKI certificates, the strategy right now is to
only accept current WebCAAF credentials (usernames and passwords).

WebCAAF will integrate with the GSA Gateway once the gateway is ready.
All authentications will be performed at the GSA Gateway instead of
WebCAAF. This enables applications already integrated with WebCAAF to
seamlessly accept the higher assurance level credentials provided by the
gateway with no configuration changes.

The WebCAAF credential store will continue to be used to store usernames
and passwords for USDA credentials. The GSA Gateway will use the WebCAAF
credential store to authenticate USDA users. WebCAAF will only be able
to provide usernames and passwords as credentials. Having WebCAAF issue
PKI certificates is not planned and customers will need to go to a GSA
Gateway ECP to get them.

**Q7: What is the timeframe for PKI?**

A7: The timeframe is unknown. The current strategy is to utilize the GSA
Gateway to provide the authentication of any credential other that the
current WebCAAF credential, for example PKI. This is contingent upon the
GSA gateway being available and having PKI providers that are certified
as Electronic Credential Providers (ECPs).

In addition, if a USDA customer does not already have a certificate from
a certified ECP, USDA will direct users to purchase certificates
directly from a third party ECP. When USDA directs it's users to
purchase certificates from a third party ECP, USDA will have no control
over to credential issuing and management process, including not being
able to revoke user certificates.

**Q8: How is authorization handled in WebCAAF versus how it is handled
by the GSA Gateway?**

A8: Agencies are responsible for their own authorization within their
applications. However, WebCAAF provides some basic authorization. This
includes allowing initial access to the application (i.e. is the user
"authorized" to get to this application) and can protect static HTML
content down to the URL level. In contrast, the GSA Gateway provides no
authorization. Every Agency application will be responsible for
developing authorization if it is connecting to the GSA Gateway.

**Q9: What is the difference between an electronic signature and a
digital signature?**

A9: An *electronic signature* (e-signature) is a generic term that
refers to all methods by which someone can "sign" an electronic record
and signal a person's consent, approval, or acknowledgement. An
electronic signature, while represented digitally, can take many forms,
such as a name typed at the end of an email message, a digitized image
of a handwritten signature or even a secret code or PIN that identifies
the sender to the recipient.

A *digital signature* is a more advanced electronic signature that
provides authentication or proof of origin of signed data, support for
non-repudiation, and data integrity. Data appended to, or a
cryptographic transformation of, a data unit that allows a recipient of
the data unit to prove the source and integrity of the data unit and
protect against forgery e.g. by the recipient.[^1]

**Q10: Are only agricultural producers allowed in the WebCAAF user
store?**

A10: No. The WebCAAF user store can contain any user doing business with
USDA. Additionally, agencies may use WebCAAF to authenticate employees,
although this feature will not be available in the initial
implementation.

**Q11: What happens if WebCAAF meets an agency's assurance level
requirements and the agency decides not to move forward and integrate
with WebCAAF?**

A11: If an agency is able to use WebCAAF to meet GPEA and they make a
business decision not to use it, USDA will not be able to support or
stand behind this decision as justification for not meeting GPEA.

**Q12:** **Who is evaluating WebCAAF to give the WebCAAF credentials a
level of assurance?**

A12: While WebCAAF is currently undergoing the System Certification and
Accreditation process, this process does not determine the level of
assurance associated with a WebCAAF credential. Eventually, GSA will
certify Enterprise Credential Providers (ECP) at a certain assurance
level (1-4) for use with the Gateway. As this process has yet to be
defined, the eAuthentication team will make a preliminarily judgment on
WebCAAF in order to move the eAuthentication initiative forward. This
preliminary level will be based on NIST technology guidance, the OMB
assurance level requirements, and input from GSA.

**Q13: What is the difference between single sign-on and a user having a
single credential?**

A13: Single Credential means that the user has one username and password
(or other credential) to remember, but must login to each web site or
application in order to gain access. Single sign-on refers to the
ability of a user to log in once and be able to access all applications
without having to log in again.

The goal of the GSA gateway is to provide both a single credential and
single sign-on. Although GSA will be able to provide a single
credential, they have not identified a solution to achieve single
sign-on. However, USDA can provide single sign-on for all applications
that are integrated with WebCAAF. Applications that integrate with
WebCAAF will not only utilize a single credential, but can also achieve
single sign-on across USDA.

# Appendix A -- Glossary 

**Biometrics** - Biometrics is a method of analyzing human body
characteristics such as fingerprints, eye retinas and irises, voice
patterns, facial patterns, and/or hand measurements for the purpose of
authentication.

**Digital Signatures** - A *digital signature* is a more advanced
electronic signature that provides authentication or proof of origin of
signed data, support for non-repudiation, and data integrity. Data
appended to, or a cryptographic transformation of, a data unit that
allows a recipient of the data unit to prove the source and integrity of
the data unit and protect against forgery e.g. by the recipient.

**eAuthentication - eAuthentication** verifies the identity of a user
using any electronic service, including those users accessing electronic
documents or records and those users represented by "electronic
signatures" that are created, communicated, and stored in electronic
form.

**Electronic Signatures** - An *electronic signature* (e-signature) is a
generic term that refers to all methods by which someone can "sign" an
electronic record and signals a person's consent, approval, or
acknowledgement. An electronic signature, while represented digitally,
can take many forms, such as a name typed at the end of an email
message, a digitized image of a handwritten signature, or even a secret
code or PIN that identifies the sender to the recipient.

**Personal Identification Number (PIN)** - A PIN is a unique code number
assigned to an authorized user. A PIN is often used in combination with
a smart card or a UID that the user possesses in order to authenticate a
user.

**Single-Sign-On** - The single-sign-on method of authentication permits
a user to enter one name or unique identifier and password in order to
access multiple applications.

**Smart Card** - A smart card is a plastic card about the size of a
credit card, with an embedded microchip that can be loaded with data
that can be used to authenticate a user.

**Triple DES -** Short for Data Encryption Standard, a popular
[symmetric-key
encryption](http://www.webopedia.com/TERM/D/symmetric_key_cryptography.htm)
method developed in 1975 and standardized by
[ANSI](http://www.webopedia.com/TERM/D/ANSI.htm) in 1981 as ANSI X.3.92.
DES uses a 56-bit [key](http://www.webopedia.com/TERM/D/key.htm) and is
illegal to export out of the U.S. or Canada if you don\'t meet the BXA
requirements. This means that the input data is, in effect, encrypted
three times.

**User Authentication** - User authentication is the ability to validate
that a user is actually the person with whom a system is communicating
or conducting a transaction.

**User Identification (UID)** - The UID is a unique identifier by which
a person is known and addressed on a device, network or system.

**Password** - A password is a unique string of characters that a user
types in as an identification code. The system compares the password
against a stored list of UIDs in order to authenticate a user.

[^1]: NIST Consolidate Glossary