The Defense Department has licensed public-key infrastructure software from Netscape Communications Corp. for several electronic commerce pilots. The agreement for Certificate Management System 4.1 is the final option of a 1997 departmentwide license that lets up to 2 million users at DOD and Defense contractors' sites use Netscape client and server products for Web access, messaging and collaboration. Netscape's Certificate Management System issues and manages X.509 digital certificates and does encryption key recovery. It supports Federal Information Processing Standards and the Digital Signature Standard, providing midlevel security via a software token.
High security requires a hardware token such as a smart card or Fortezza card.
DOD plans to use PKI for nonclassified purposes such as ensuring the authenticity of signatures on contracts, travel vouchers and other financial documents, and to authenticate users of information systems. The e-commerce pilots also will involve PKI use for the Global Command and Control System and Global Combat Support System, DISA officials said. Version 4.1 succeeds the Netscape Certificate Server, Menkart said. It can distribute certificate authority, maintaining a centralized point of issuance but distributing the sites for registration and verification of the potential 2 million users. PKI allows key recovery, so that encrypted material can be decrypted if the key is lost or a court order requires disclosure.