# Presentation: 261081

## Uncle Sam, Meet The PKI!

- Richard Guida
- 	Chair, Federal PKI Steering Committee
- 	*richard.guida@cio.treas.gov*
- Michèle Rubenstein
- 	Department of the Treasury,
- 	Chair, EMA Board of Directors
- 	*michele.rubenstein @cio.treas.gov*

## Federal PKI Interoperability

- Overview
- Organizational Framework
- Bridge Certification Authority Concept
- Design Requirements
- Meaning of Interoperability
- Current Status
- Challenges
- Path Ahead

## Organizational Framework

- Well over two dozen agency PKIs
- No single Federal hierarchical root
- Full spectrum of COTS products
- Widely divergent agency requirements
- Strong desire to interoperate (communicate accepting certificates from other sources)

## Bridge Certification Authority

- Non-hierarchical “hub”
- Designed under Federal PKI Steering Committee auspices
- CP/CPS under development - will support four levels of assurance (rudimentary, basic, medium, high)
- Operated by, and will exist at, the National Technical Information Service

## Bridge Certification Authority (2)

- Will operate under auspices of Federal Policy Management Authority (FPKI Steering Committee)
- Agencies can apply to have their CA’s cross-certify - FPMA decides level of assurance

## Bridge Certification Authority (3)

- Once cross-certified, Bridge allows construction of trusted path between CA domains
- Initial focus is interagency interoperability, but also plan to do so with external parties

## Design Requirements

- High assurance for Bridge itself
- Must honor four levels of assurance for cross-certified CAs
- Must be hosted at Federal agency (NTIS)
- Must meet MISPC and FIPS 140-1
- Must allow trusted path creation

## Meaning of Interoperability

- Policy
- Technical
- Algorithms
- Protocols
- Encryption key recovery schema consistency

## Current Status (as of Oct 98)

- Funding committed (pending budget passage)
- In design stage
- Once notional design developed, will be vetted through FPKI Steering Committee Technical Working Group (vendors)
- Developing EMA Challenge participation

## WEMA Challenge ‘99

- Demonstrate standards-based, secure, global EC environment featuring interoperable PKI
- Goals
- Demonstrate scalable, standards-based PKI  using COTS products that is transparent to users
- Identify key issues, raise awareness, and determine solutions for a multi-domain PKI
- Demonstrate the capabilities of COTS products and their ability to interoperate

**Notes:**
To model and demonstrate a scalable, manageable, global, standards-based PKI that is fully functional and is transparent to users and applications using commercial off-the-shelf products

## WEMA Challenge ‘99

- Foundation applications are web-based EC and secure messaging
- Some of the participants:
- BT
- NTIS
- Entrust
- Xcert
- European Commission
- Documentation and information
- www.ema.org/challenge99

- Baltimore
- Boeing
- GTE Cybertrust
- GSA
- Treasury

## Challenges

- Dealing with OCSP vs. CRL domains for revocation checking
- Ensuring Bridge supports all COTS products agencies may select
- Ensuring Bridge’s full potential is used
- Making client software use the Bridge
- Mapping applicant CA’s assurance levels to those of Bridge

## Path Ahead

- Complete design and vet through Technical Working Group
- Get Bridge pilot operating (early 1999)
- Participate in EMA Challenge 99
- Attract appropriate applications
- Since fully funded through Sept 2000,  expect no charge to cross-certify until afterwards (but depends on actual usage)