# Presentation: 346380

## Public Key Technology

**Richard Guida**
***Chair, Federal PKI Steering Committee***

**Richard.Guida@cio.treas.gov; 202-622-1552**
**http://gits-sec.treas.gov**

## Authentication and Confidentiality: Technical Approaches

**Shared secrets (“Symmetric Crypto”)**
**Personal ID Numbers**
**Passwords**
**Biometrics (including digitized signatures)**
**Public key technology (“Asymmetric Crypto”)**
**Key pair - no shared secrets**

## Shared-Secret Approach

**Shared secret for authentication or confidentiality**
**Different for each pair of users**
**No nonrepudiation**
**Need to pre-arrange and securely transport**
**If one party fails to protect, both compromised**

## Public Key Technology Approach

**Two keys, mathematically linked**
**One is kept private, other is made public**
**Private not deducible from public**
**For digital signature: One key signs, the other validates**
**For confidentiality: One key encrypts, the other decrypts**

**An electronic credential which:**
**Binds an individual’s public key to his or her identity**
**Is digitally signed by a trusted third party (called Certification Authority)**
**Provides a trusted way to obtain an individual’s public key**
**Digital Signature on the certificate precludes undetected alteration of contents**

*Public Key (Digital) Certificate*

## Public Key Infrastructure

**Registration Authorities to identity proof users**
**Certification Authorities to issue certificates and CRLs**
**Repositories (publicly available data bases) to hold certificates and CRLs**
**Some mechanism to recover data when encryption keys are lost/compromised**
**Certificate Policy and related paper**

## Federal PKI Approach

**Establish Federal PKI Policy Authority (for policy interoperability)**
**Develop/deploy Bridge CA using COTS (for technical interoperability)**
**Prototype 2/8/00, production end of 2000**
**Deal with directory issues in parallel**
**Border directory concept; “White Pages”**
**Use ACES for public transactions**

## Access Certs for Electronic Services

**“****No-cost” certificates for the public**
**For business with Federal agencies only (but agencies may allow other uses on case basis)**
**On-line registration, vetting with legacy data; information protected under Privacy Act**
**Regular mail one-time PIN to get certificate**
**Agencies billed per-use and/or per-certificate**

## Access Certs for Electronic Services

**RFP 1/99; bids received 4/99; first award 9/99 (DST), second award 10/99 (ORC), third award 10/99 (AT&T)**
**Contract has provisions for ACES-enabling applications**
**Potential use with state/local government**
**Certificates available now**

## Electronic Signatures under GPEA

**Government Paperwork Elimination Act (October 1998)**
**Technology neutral - agencies select based on specifics of applications (e.g., risk)**
**Gives electronic signature full legal effect**
**Focus: transactions with Federal agencies**
**Draft OMB Guidance 3/99; final 5/00**

## Organization

## PKI Use and Implementation Issues

**Misunderstanding what it can and can’t do**
**Requiring legacy fixes to implement**
**Waiting for standards to stabilize**
**High cost - a yellow herring**
**Interoperability woes - a red herring**
**Legal trepidation - the brightest red herring**