# Presentation: 900045

## Federal Approach to Electronic Credentials

- Information Assurance in an E-World

- Judith SpencerChair of the Federal PKI Steering Committeejudith.spencer@gsa.govhttp://www.cio.gov/fpkisc

## Privacy Act of 1974

- 4 Basic Objectives
- To restrict disclosures of personally identifiable records
- To grant individuals more rights to access records agencies maintain on them
- To grant individuals the right to seek amendments to agency records maintained on themselves
- To establish a code of "fair information practices" which requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records

## Identity Credentials

- Driver’s License
- Employee Identification Card
- Passport
- Birth Certificate
- Physical Presence
- Signature

- Trust

## Legislative Mandate

- Government Paperwork Elimination Act, October 1998
- Commitment to on-line government
- Public electronic access by October 2003
- Electronic Signatures in Global and National Commerce Act, June 2000
*“**A signature may not be denied legal effect simply because it is electronic”*

## E-Transaction Landscape

- Internal
- Effectiveness and Efficiency

- Government to Government

- Government to Business

- Government to Citizen

## E-Gov Initiatives

- Government to Business
- Federal Asset Sales	GSA
- Online Rulemaking	DOT
- Simplified and Unified	Treas Tax and Wage Reporting
- Consolidated Health	HHS Informatics
- Business Compliance	SBA One-Stop
- Int’l Trade Process	DOC Streamlining

- Government to Citizen
- USA Service		GSA
- EZ Tax Filing		Treas
- Online Access (Loans)	DoEd
- Recreation One-Stop	DOI
- Eligibility Assist Online	Labor

- Internal Effectiveness and Efficiency
- E-Training		OPM
- Recruitment One-stop	OPM
- Enterprise HR Integration  OPM including e-Travel
- Integrated Acquisition	GSA
- E-Records Management	NARA

- Government to Government
- e-Vital (business case)	SSA
- e-Grants		HHS
- Disaster Assistance and	FEMA Crisis Response
- Geo-spatial Information 	DOI One-Stop
- Wireless Networks	DOJ
- Enterprise Legal Case	DOJ Management

## A Few Facts

- Internet is perceived as inherently anonymous
- In order to protect privacy, government must know with whom it is dealing
- Knowledge must be within reasonable risk limits
- Electronic credentials provide the means to link identity in the electronic medium

## What is Security on the Internet?

- User Authentication
- Knowing who your correspondent is
- Transaction Integrity
- Ensuring the message sent is the message received
- Non-Repudiation
- Correspondent cannot deny conducting transaction
- Confidentiality
- Only authorized persons can read the message

## Asymmetric Key Encryption

- Used as Identity Credential
- Used to Sign Messages
- Used to Decrypt

- Distributed Openly
- Used to Authenticate Identity
- Used to Verify Signatures
- Used to Encrypt

- Asymmetric Key Encryption

**Notes:**
Digital Signature is the Answer
Mathematically linked pair of very large numbers
First number is used to sign the message (private key)
Need second number to verify signature (public key)
Private key is protected by owner
Public key can be distributed openly

But to ensure identity, you need a Trusted Third Party (certificate authority)
Vouches for identity of signer by linking certificate to public key.
It is the Trusted Third Party function that is the basis of the ACES contract.

Compare to writing a check:
Private key is the hand/brain function of creating the signature on the check.
Certificate is the driver’s license 
Public key is the facsimile signature on the driver’s license.
In this case the certificate authority is the State Driver’s License Bureau

## Identity Credentials

- Driver’s License
- Employee Identification Card
- Passport
- Birth Certificate
- Physical Presence
- Signature
- Electronic Credentials (PKI Certificates)

- Trust

## The Way Forward

**Simplify and Unify**
- Promote Quicksilver e-Authentication Initiative
- Assist other initiatives in defining their identity authentication needs
- Develop applications for cross-governmental use
-  Coordinate consolidated buy of authentication products and services
- Promote interoperability with other entities through FBCA

## Federal Bridge Certification Authority

**Cross Certified**
**CAs**

**Directory System Agent**

**Cross certificates**
**CRL**

**FIP 140-1 L3 Crypto**

**FIP 140-1 L3 Crypto**

**Cross certificates**
**CRL**

**Cross certificates**
**ARL**

- Trust Domain 1

- Trust Domain 2

**S/MIME EMAIL**

- Federal Bridge Certification Authority

## Federal PKI Policy Authority

- Voluntary interagency group - NOT  “agency”
- Governing body for FBCA interoperability
- Oversees operation of FBCA, authorizes issuance of FBCA certificates
- Answers to Federal CIO Council
- Six Charter Members:
- GSA, Justice, DoC, NSA, OMB, Treasury

## Policy Mapping

- Organization is mapped to one of 4 levels spelled out in Bridge Certificate Policy
- Rudimentary
- Basic
- Medium
- High
- Only applies to Organization relationship with Bridge for purposes of interoperability

## Required Documentation

## A Vision for the Future

- Citizen

- Business

- State Government

- International

**Web**

**Trust**

## Closing Words

- Our Vision - Enable e-government through:
- A cross-governmental, ubiquitous, interoperable Public Key Infrastructure.
- The development and use of applications which employ that PKI in support of Agency business processes.
- Government-wide initiatives include:
- Federal PKI Steering Committee
- Federal PKI Policy Authority
- Federal Bridge Certification Authority
- Access Certificates for Electronic Services