# Presentation: 128880

## December 18, 2003

**December 18, 2003**

## Welcome/Opening Remarks		-	Jeanette Thornton

Introduction				-	Judith Spencer

Federal Smart Card IAB			-	Bill Holcombe 
Federal PKI Policy Authority		-	Michelle Moldenhauer
Smart Card Policy Working Group		-	Bill Holcombe 
Identity Assurance Working Group		-	Mark White
PKI Certificate Policy Working Group 	-	Tim Polk 
Physical Access Interagency Interop		-	Mike Sulak 
SC Data Modeling Working Group		-	Jim Zok 
SC Topology Working Group		-	Jack Finberg 
Aggregated Buy				-	Bill Holcombe
Shared Service Providers WG		-	Fred Catoe 

Closing Comments			-	Judith Spencer

**Introduction****	****	****	****	****-****	****Judith Spencer**
**Federal Smart Card IAB****	****	****	****-****	****Bill Holcombe **
**Federal PKI Policy Authority****	****	****-****	****Michelle Moldenhauer**
**Smart Card Policy Working Group****	****	****-****	****Bill Holcombe **
**Identity Assurance Working Group****	****	****-****	****Mark White**
**PKI Certificate Policy Working Group ****	****-****	****Tim Polk **
**Physical Access Interagency Interop****	****	****-****	****Mike Sulak **
**SC Data Modeling Working Group****	****	****-****	****Jim Zok **
**SC Topology Working Group****	****	****-****	****Jack Finberg **
**Aggregated Buy****	****	****	****	****-****	****Bill Holcombe**
**Shared Service Providers WG****	****	****-****	****Fred Catoe **
**Closing Comments****	****	****	****-****	****Judith Spencer**

**Agenda**

## Federal Smart Card

**Interagency Advisory Board**

**Bill Holcombe**
**GSA**

## Interagency Advisory Board

- History
- Accomplishments
- Membership
- Current Projects

## History

- Working group out of SCPMG(1997) – 1st group met in 1998, Established formally early in 2001, chaired by GSA/FTS
- Founding Members: GSA, DOD, State
-       also Treasury, FDA, DOJ, FAA, VA, USPS, NSA
- Original Goals
- Oversee GSA smart access ID contract
- Coordinate development of GSC-IS

## Accomplishments

- Brought together broad-based interagency group to solve smart card problems
- Provided leadership for development of GSA smart card contract
- Led development of smart card standard – Government Smart Card Interoperability Specification

## Membership

- Meets monthly, open to all interested parties, govt & industry
- Currently over 100 members
- Examples of agencies participating: DOD, FAA, GSA, State, DOI, DOJ, IRS, DHS, DOT, VA, NIST, US COURTS, FMS, USDA, NASA, FDIC, USSS, FDA, TSA, WMATA, MARAD,

## IAB Identified Projects

- Policy Working Group – Bill Holcombe
- Data Modeling Group – Jim Zok
- PAIIWG (Physical Access Interagency Interoperability) – Mike Sulak
- Topology Group – Jack Finberg
- Aggregated Buy – Bob Donelson
- Architecture Group – Jim Dray
- Education Group – Bill Holcombe & Bob Donelson

## Questions?

- Bob Donelson, Chair
- bdonelso@wo.blm.gov
- 202 452-5190

## Federal PKI Policy Authority

**Michelle Moldenhauer**
**U.S. Treasury**

## PKI PA/FBCA Completed Goals

- LDAP directory for non-X.500 customers -  October 2003
- Technical interoperability testing January 2002 – December 2003
- Department of Defense (X-certified)
- U.S. Department of Agriculture/National Finance Center (X-certified)
- National Aeronautics and Space Administration (X-certified)
- Department of Treasury (X-certified)
- Department of Energy (X-cert to be issued)
- U.S. Department of State (X-cert to be issued)
- State of Illinois (X-cert to be issued)
- Government of Canada (X-cert to be issued)
- ACES/Digital Signature Trust (X-cert to be issued)

**PKI PA/FBCA Completed Goals**

## PKIPA/FBCA Current Goals

- Architecture Stability - March 2004
- Full Authority to Operate FBCA - June 2004
- FBCA-aware Applications & Industry Requirements - February 2004
- Technical Cross-Certification Certificates Issued -  Jan - Dec 2004
- Department of Labor (application completed)
- ACES/Operational Research Consultants, Inc. (not started)
- ACES/AT&T (not started)
- US Patent & Trademark Office (scheduling)
- Higher Education Bridge CA (in testing)
- Aerospace Bridge (discussion)
- Integration with E-Authentication (in progress)
- Operation via Commercial Managed Service -  January 2006

## FPKI Architecture

**FPKI Architecture**

**FBCA ****Certificate Policy**

_**Bridge Certification Authority**_

**2-way****cross-****certification**

**Agencies**(Legacy agency CA policy)

**States**

**Foreign Entities**

**Citizen &Commerce****Class Certificate Policy**

**Wells Fargo**

**AOL**

**PEPCO**

**Private****Sector**

_**C4 Certification Authority**_

_**E-Governance Certification Authorities**_

- (Mutual authentication  of SAML/SSL Certificates only)

**Assurance****Level 2**

**Assurance****Level 1**

_**  **__**Legend:**_
**  ****SSP = Qualified Shared Service Providers**
**   ****may issue a cross-certificate to the trust**
**   ****anchor.**

**2-way ****cross-certification**

_**Common Policy Certification Authority**_

**E-Auth. Common Policy**(Common Policy Rootincluded in browser list of CAs)

**SSP1**

**SSP2**

- _Agency__CAs__(new ones)_

- _Agency__CAs__(new ones)_

**SSP3**

**New****Agencies**

**1-way cross-certification**

**Other****Bridges**

**ACES**

**E-Governance****Certificate Policy**

- Version 1.0 / 9 Dec 2003

## Smart Card Policy Working Group

**Bill Holcombe**
**GSA**

## Credentialing / Smart Card Policy – What It Means 

- H:Slides/Smart Card Policy Slides 3Dec03

## Credentialing /Smart Card Policy Issuance at Highest Level – What Does it Do?

- Calls for establishment of interoperable smart card platform for credentialing employees and trusted agents of Gov
- Enables physical access & logical access & other applications
- Provides appropriate technical platform  for coherent governmentwide credentialing and identification program

**Notes:**
Issue Federal Identity Card
Plan for identity and credentialing investments
Allow non-repudiation of transactions
Eliminate inconsistent approaches to physical and computer security
Enable cross-agency physical access
Migration path to incorporating logical access
Provide infrastructure as physical and logical networks come up for replacement
Platform of choice will be a smart card
Compliant with GSC-IS
Adopt standards that enable interoperability across Federal enterprise
Prefer virtual machine platform using ISO 7816 and Global Platform specifications
Use authentication methods beyond passwords
Ensure privacy
Plan recognizing total cost of access infrastructure
Converge disparate identity media to common smart card based credential
Provide flexibility to meet agency needs until legacy systems are upgraded
Identity data on card must be in standard machine-readable format and use active asymmetric key based authentication
Card and chip must be tamper and counterfeit resistant
Cards should support multiple authentication methods, e.g., password, digital certificate, biometric
Cards must support automated processing and auditability
Cards should be capable of carrying digital certificate meeting requirements of Federal Bridge model and FIPS 140-2
Certificates should be able to sign and encrypt sensitive e-mail
Card should support secure post-issuance updating of data
Card life should be 5 years
Use common data models specified in GSC-IS, with mandatory card capability container
Meet requirements of NIST Security Guidance Policy
Must support biometrics

## The Common Credential –The Federal Identity Card

- Standards-based machine-readable chip card
- Principal Capabilities
- Carry PKI-based certificates
- Carry multiple biometrics
- Post-issuance loading of applications/data
- Highly tamper & counterfeit resistant
- Works with legacy systems
- Technical interoperability across government
- Works in contact or contactless mode

## Implementation

- At agency / bureau level
- Funded through regular budget process
- Assistance available through
- Interagency Advisory Board
- GSA contracts with prime vendors
- Project Managers Group
- _www.smart.gov_ web site

## Policy Requirements - 1

- Issue Federal Identity Card
- Plan for identity and credentialing investments
- Allow non-repudiation of transactions
- Eliminate inconsistent approaches to physical and computer security
- Enable cross-agency physical access
- Migration path to incorporating logical access

## Provide infrastructure as physical and logical networks come up for replacement
Platform of choice will be smart card -based
Compliant with GSC-IS
Adopt standards that enable interoperability across Federal enterprise
Prefer virtual machine platform using ISO 7816 and Global Platform specifications
Use authentication methods beyond passwords

- Platform of choice will be smart card -based
- Compliant with GSC-IS
- Adopt standards that enable interoperability across Federal enterprise
- Prefer virtual machine platform using ISO 7816 and Global Platform specifications
- Use authentication methods beyond passwords

**Policy Requirements - 2**

## Ensure privacy
Plan recognizing total cost of access infrastructure
Converge disparate identity media to common smart card based credential
Provide flexibility to meet agency needs until legacy systems are upgraded
Identity data on card must be in standard machine-readable format and use active asymmetric key based authentication
Card and chip must be tamper and counterfeit resistant

- Plan recognizing total cost of access infrastructure
- Converge disparate identity media to common smart card based credential
- Provide flexibility to meet agency needs until legacy systems are upgraded
- Identity data on card must be in standard machine-readable format and use active asymmetric key based authentication
- Card and chip must be tamper and counterfeit resistant

**Policy Requirements - 3**

## Support multiple authentication methods, e.g., password, digital certificate, biometric
Support automated processing and auditability
Capable of carrying digital certificate meeting requirements of Federal Bridge model and FIPS 140-2
Certificates should be able to sign and encrypt sensitive e-mail
Support secure post-issuance updating of data
Card life should be 5 years

- Support automated processing and auditability
- Capable of carrying digital certificate meeting requirements of Federal Bridge model and FIPS 140-2
- Certificates should be able to sign and encrypt sensitive e-mail
- Support secure post-issuance updating of data
- Card life should be 5 years

**Policy Requirements - 4 **

## Use common data models specified in GSC-IS, with mandatory card capability container
Meet requirements of NIST Security Guidance Policy
Must support biometrics

- Meet requirements of NIST Security Guidance Policy
- Must support biometrics

**Policy Requirements - 5**

## Issues?

## FICC -IAB Policy Committee Agency Lead Members

- Bill Holcombe		GSA
- Jim Zok			Transportation
- Bob Donelson		  	Interior
- Mike Butler		  	Defense
- Teresa Schwarzhoff	  	NIST
- Thomas Casey	  	DHS

## Identity Assurance Working Group

**Mark White**
**OPM**

## Identity Assurance Questions

- What is the core information required to establish reliable identity & how will it be formatted and used?
- What is the optimum process to issuing a Government credential?

## PKI Certificate Policy Working Group

**Tim Polk**
**NIST**

## Participants

- Co-chaired by GSA and NIST
- John Cornell (GSA), Tim Polk (NIST)
- Agencies that have FPKI PA membership are the “voting” members
- FBCA Operational Authority also participates
- Booz Allen Hamilton provides support

## Scope of Activities

- Maintain FPKI PA certificate policies
- Perform Policy Mapping
- Review Compliance Audits

## Maintain FPKI PA certificate policies

- Federal Bridge CA Policies
- Four policies for different levels of assurance
- Common Policy Suite
- Three policies for HW users, SW users, devices
- Citizen & Commerce Class CP (aka C4)
- PKI-lite for cross-certification with schools, businesses, etc.

## Perform Policy Mapping

- Map CPs to the FBCA and C4 policies
- Review external agency/organization CP against a CPWG-developed matrix of requirements
- Matrix is specific to the level of assurance that was chosen as a target for mapping

## Review Compliance Audits

- For all PKIs
- CP and CPS are consistent
- PKI is operating in accordance with its CPS
- Auditor is qualified *and* independent
- For the Common Policy
- Developing a framework to guide CP-CPS consistency evaluation

## Contacts

- 	Lentz_Mark@bah.com
- 	John.Cornell@gsa.gov
- 	Tim.Polk@nist.gov

## Physical Access Interagency Interoperability Working GroupPAIIWG

**Mike Sulak**
**Department of State**

## PAIIWG

- Merged Physical Access Interoperability Working Group (PAIWG) with Interagency Interoperability Task Force (IITF).
- Chairmanship passed from Donelson to Sulak at 8-26-03 PAIWG/IAB.
- Name changed to PAIIWG at 9-11-03 meeting.
- PAIIWG opened to industry partners.

**Notes:**
At the 8-26-03 PAIWG/IAB meeting it was agreed upon that the functionalities of the Physical Access Interoperability Working Group and the Interagency Interoperability Task force could be combined to form one entity.

Donelson announced that this would be last PAIWG meeting he chaired, nominations made and vote taken, I got it.

## PAIIWG

- Two outstanding issues:
- SEIWG card coding, 25/40 bytes
- Card Authentication
- Sub-group formed
- Webex held 10-01-03 with sub-group members to discuss available options.
- Sub-group consensus, stay with 25 byte packed BCD.
- IAB, on 10-24-03, approves 25 byte coding.

**Notes:**
Sub-group = Tim Baldridge (NASA), Jack Cassidy (TSA), Tony Salloum (DOD), Kevin Kozlowski (Xtec), Jeremy Grant (Maximus), and Tony Cieri (consultant – BLM)

Webex held on 10-01-03.

## PAIIWG

- Webex held 11-17-03 with sub-group members to discuss available card authentication options.
- Two tier approach presented, no consensus.
- Webex held 11-18-03 with PAIIWG membership to discuss additional card authentication option.
- There tier approach presented, consensus formed.

## PAIIWG

- “INSIDE ID” conference, 12-08-03, PAIIWG industry day.
- Three tier card authentication approach presented to industry partners.
- Consensus positive.
- IAB to vote at next meeting.

## PAIIWG

- Continue to address both contact and contactless interoperability issues.
- Update the Smart Card Implementation Guidance document.
- Support the FICC and IAB in their development of smart card interagency interoperability policy.

## PAIIWG

- Questions?

## Smart Card Data Modeling

**Working Group**

**Jim Zok**
**MARAD**

## Identity Intersections

## GSC Data Model IssuesJim Dray, NISTDec 4, 2003

## Credential Domains

**Credential Domains**

- Qualifications Credentials (Medical License, etc.)

- Data Model (Demographic info, etc.)

## GSC Pluggable Data Models

**GSC Pluggable Data Models**

- GSC Core (BSI, VCEI, CCC)

- Data Model 'Port'

- Data Model 1 (ex. GSC-ISv2.1)

- Data Model 2 (ex. DoD CAC)

- Data Model 3 (ex. RIS transit)

## CHUID DATA MODEL

## Smart Card Topology Working Group

**Jack Finberg**
**GSA**

## Smart Card Aggregated Buy

**Bill Holcombe**
**GSA**

## Smart Card Aggregated Buy

- Bob Donelson coordinating
- Several agencies have agreed to participate – March buy
- Received full GSC-IS marketplace cards for testing
- Important new partner – NY\NJ Transit Auth – will help bring down cost of cards

## PKI Shared Service Providers

**Fred Catoe**
**Department of Veteran Affairs**

## SSP Timeline

-  December 2003
- Define Requirements
- Identify Evaluation Criteria
-  January 2004
- Publish Open Solicitation
-  February 2004
- Evaluate Provider Responses
-  March 2004
- Initial Selection of Providers

## Policies and Requirements

-  Required Policies:
- Federal Common Policy
- Certificate & CRL Profile
- Smart Card Policy
- Identity Assurance Policy
-  Requirements Defined:
- Directory Services
- Registration Authority Agreement
- Repository & Archive Services
- Security Requirements

## Evaluation Criteria

-   Policies and requirements will serve as  evaluation criteria
-   Screening elements
-  Compliance audit
-  Operational Capabilities Demonstration
-  Agency specific contracting requirements

## Open Solicitation

-  Notice of intent
-  Preliminary draft completed
-  Solicitation
-  Currently being drafted
-  Registration Authority Agreement
-  Agreement required between each Federal agency and their Shared Service provider
-  Template criteria defined
-  Standard template due by end of January

## Provider Evaluation

-  Operational Capabilities Demonstration participants
-  PKI Certificate Policy Working Group
-  Shared Service  Provider Subcommittee
-  Mandatory Evaluation Criteria
-  Compliance audit
-  Operational Capabilities Demonstration
- Existing NIST reference process for FBCA
- Additional criteria derived from SSP Subcommittee inputs
-  Performance Evaluation Period
-  Starts February 2004, continuously open

## Closing Remarks

**Judith Spencer**
**Chair, FICC**

## 3 Major Subcomponents

- Smart Card Interoperability
- Federal Smart Card Policy
- Government Smart Card Interoperability Specification v. 2.1
- Minimum requirements for topology, data sets, implementation
- Aggregated Buy
- PKI Interoperability
- Common Federal PKI Policy
- Federal Bridge Certification Authority
- Shared Services Migration
- Identity Assurance Interoperability
- Guidance on minimum standards for identity assurance in credential issuance

## For More Information:

- Visit our Website
- www.cio.gov/ficc
- Currently available			Coming Soon
- 	Draft Framework			Draft Roadmap
- 	Charter			    	Policy Documents
- 	Information on meetings		    and more