# Presentation: 040726

## Federal Bridge Certification Authority

- Presentation to the CSBS
- Russ Davis
- September 24, 2001

## Consequences of Recent Events

- As the FBI requests additional information regarding money laundering of suspected terrorists, how will information be securely exchanged?
- How will the source of the request and the provider of the information be positively identified?
- How can we accomplish this with our current and evolving environments?

**Notes:**
According to the Associated Press, on September 19th, a "special Alert" was issued requesting that banks provide the FBI with any information "suspicious" regarding a list of terrorists.  A question here would be how will this information be distributed?  In cases where the center of focus has not been identified, how will this be securely conveyed?

One very attractive approach is through the use of encrypted email, such as that just described by Deborah Sweaney.  Still, how can the sender and receiver be positively identified?

This is where the Bridge CA will be very important.

## Background

- FBCA is non-hierarchical, peer-to-peer “hub”
- Supports interagency PKI technical interoperability
- Policy interoperability framework established by FPKI Policy Authority
- Goal: accommodate Federal agency use of any PKI COTS product

**Richard A. Guida:**
- 1.  Federal PKI developing from the bottom up - agencies are autonomous/independent, we must honor that.
- 2.  FBCA approach has the virtue of supporting disparate PKI domains - disparate in products, policies, you name it.
- 3.  FBCA solves CA interproduct interoperability issue - ability to cross-cert - in an elegant way: within the membrane, and off-line.  Cross-certs are published in FBCA directory which is 24X7 on Internet.  FBCA itself is “cold silicon” 99% of time - only active to issue new cross-certs and to publish ARLs once a week.

**Notes:**
Richard A. Guida:
1.  Federal PKI developing from the bottom up - agencies are autonomous/independent, we must honor that.
2.  FBCA approach has the virtue of supporting disparate PKI domains - disparate in products, policies, you name it.
3.  FBCA solves CA interproduct interoperability issue - ability to cross-cert - in an elegant way: within the membrane, and off-line.  Cross-certs are published in FBCA directory which is 24X7 on Internet.  FBCA itself is “cold silicon” 99% of time - only active to issue new cross-certs and to publish ARLs once a week.

## The Bridge CA

- The Federal Bridge CA is designed to cross certify agency PKIs.
- It is not a trust anchor (root authority) and only deals with the agency CA certificates.
- The agency is responsible for issuing end entity certificates (such as user certificates).
- The agency is responsible for individual identify proofing.
- The Bridge support 4 increasing levels of assurance.

**Notes:**
Cross certification is the process where two certification authorities create a “cross certificate.” That is, both parties trust each other.  This is a the basis for establishing a trust path.  As non-agency certificates are received, the path validation searches for cross certificates with the requisite agency.  The Bridge will allow agencies a directory location, that can be used to obtain the certificates (and revocation lists) necessary for validating the path.  

The bridge supports 4 increasing levels of assurance.  The assurance level used in issuing a certificate is identified by the object identified used within the certificate.

Additionally, agencies must meet minimum requirements before they are allowed to cross certify with the bridge.  Included are the methods used by the other agency in identifying the individual during certificate issuance.

## Determining Certificate Trust

- CA

- CA

- CA

- CA

- CA

- CA

- CA

- CA

- Bridge CA

**Notes:**
In a current PKI, each agency requires a cross certification.  Generally, this also cost one license for each instance.  For example, if there were 50 agencies that wanted to allow trust path validation, then each agency would need 49 cross certificate pairs (no cross certification to oneself is required).  Thus, in this example, 2450 cross certifications would be required. 

In contrast, using the Bridge requires only 50 cross certificate pairs.  Breaking this down by agency, whereas only one cross certificate pair is required for the bridge, 49 would be required otherwise.

And in each case, how would you know they did a reasonable job at their end?

## Canada

- Cybertrust CA

- Entrust CA

*Federal Bridge CA*

- SFL
- Client

- Entrust
- Client

*Entrust*

- Entrust
- Client

- SFL
- Client

- DoD Bridge CA

*Entrust*

*Spyrus*

*Motorola*

- Entrust
- Client

*Entrust*

- NSA

- Entrust
- Client

*Entrust*

- Entrust
- Client

*Entrust*

- PCA

*Entrust*

- PCA

- CA

- PCA

- CA

- CA

- CA

- PCA

- CA

- CA

- PCA

- CA

- CA

- PCA

- NASA

- PCA

- GTRI

- PCA

- NIST 1

- Entrust
- Client

- NIST 2

- SFL
- Client

- PCA

*CYBERTRUST*

- GSA/FTS

- CYGNACOM

**Notes:**
The chart depicts the Institute for Electrical and Electronic Engineers (IEEE) issued the Electronic Messaging Association (EMA) challenge accepted by the Federal PKI Steering Committee.  A variety of vendor products were tested to verify that path validations could be accomplished.  As seen from the chart, these included deep path validations.  This configuration was successfully demonstrated.

Note the Bridge CA also included an interface with Canada.  It is envisioned that the Bridge will cross certify with other countries.

## What’s an Assurance Level(Those assigned to the FDIC)

**Notes:**
The Bridge CA uses 4 levels of assurance.  Likewise, the FDIC has registered 4 levels of assurance to map directly with those of the Bridge CA.  Each level is specified by the certificate policy used.  The FDIC has one certificate policy that addresses each of the assurance levels.  Certificates issued under the certificate policy will include the appropriate certificate policy (and thereby the assurance level) used.

For and FDIC-Low issued certificate, the Bridge CA would only allow us to cross certify at the same level.  The Bridge cross certificate pair includes the assurance level used.  Thus, respective parties can be assured that the certificates comply with a certain level of assurance.

## State Bridge CA Status

- Federal PKI State Interoperability Working Group.
- Illinois (every taxpayer)
- Washington
- New Jersey
- Pennsylvania (negotiations ongoing)
- Maryland (interest)
- Virginia (interest)

## Other Items

- NIST High Level Cryptographic API
- Allows applications to be easily ported.
- Cooperative effort (NIST, GAO, FDIC, Treasury FMS, DoD FAS, DOE, & Army Corps of Engineers).
- Heavy lifting done below the API (not by the application).
- New Statutory Requirements to use Electronic Signatures.

## Contact Information

- Russ Davis
- Federal Deposit Insurance Corporation
- 3501 N. Fairfax Drive
- Room VS-7159
- Arlington, VA 22226
- Telephone: 	(703) 516-5107
- Email:		RDavis@FDIC.Gov