When a handshake isn’t good enough

PKI lets users know who they’re dealing with; an approaching deadline gives agencies incentive to try it

If you’ve been involved with technology for more than, say, the last 15 minutes, you’ve probably been told that this or that technology is the next big thing. Its actual arrival, however, is usually delayed far behind any predicted date.

But managers and users in government are facing a likely next big thing whether they like it or not: public-key infrastructure. It even has a date attached, because Oct. 21, 2003, is the deadline for agencies to implement the Government Paperwork Elimination Act.

As a memorandum from the Office of Management and Budget put it, agencies are “to provide for the (1) option of electronic maintenance, submission or disclosure of information, when practicable as a substitute for paper; and (2) use and accept electronic signatures when practicable. GPEA specifically states that electronic records and their related electronic signatures are not to be denied legal effect, validity or enforceability merely because they are in electronic form.”

Waivers of the October deadline might be possible, but agencies will need to include a timeline for implementation. You can comply sooner or you can comply later, but comply you must.

Simply put, PKI is the system under which digital certificates and keys—the basic units of verification for a digital document—are created, managed, stored and distributed, as Suranjan Choudhury points out in his recent book, Public Key Infrastructure Implementation and Design.

By combining a public key known to users on both sides of a transaction with a private key generated for a specific task—and known only to a single user—files can be digitally signed, authenticated, encrypted and decrypted.

Saving paper is one likely benefit of PKI, but a more tangible benefit for agencies is the elimination—as nearly as possible—of data input errors. When a user submits a form electronically, the data can be incorporated into an agency’s systems far more easily and accurately than if it is keyed in or scanned.

Having PKI tools for authentication—as the Securities and Exchange Commission’s Electronic Data Gathering, Analysis and Retrieval system has had for some time—adds a level of protection and security.

Another potential benefit, particularly for workers in secure environments, is to incorporate PKI security tools into smart cards, as the Defense Department’s Common Access Card program is doing. On July 26, Army Spc. Trenton R. Dugan, a 3rd U.S. Infantry soldier from “The Old Guard” stationed at Fort Myer, Va., became the one millionth person in DOD to be certified with PKI identification.

By October next year, DOD officials say, all internal e-mail will be digitally signed, and the Common Access Card will supply the private key necessary for PKI encryption. Already, more than 800,000 Common Access Cards have been issued to military and civilian personnel at DOD.

So if the time for PKI has come, to send and receive e-mail, to file a grant application or an expense report, where can users turn for products with PKI capabilities?

Ideally, certificates should work across computing platforms, generated by users of different systems. Three companies are participating in the General Services Administration’s Access Certificates for Electronic Services program, a governmentwide standard for PKI certificates. The companies are Digital Signature Trust Co. of Salt Lake City, Operational Research Consultants Inc. of Chesapeake, Va., and AT&T Government Services, which is working with VeriSign Inc. of Mountain View, Calif.

Assure security

According to Keren Cummins, vice president of government services for Digital Signature Trust, the process ACES vendors use to create digital signatures—which can be read by agencies using all three vendors’ services—is designed to assure security.

“Your credential is based on public-key cryptography, a public-private key pair,” Cummins said. “When we issue you a certificate as part of the ID process, you are sent part of the public key, which is browser-generated. You then send back a document that associates name and public key, signing it using your private key. The signature is a mathematical combination of private key and a hash of the document. Your signature is different every time you sign something—assuming you’re signing different documents.”

Cummins said that even though the vendors each have partners to handle certificate generation, ACES will not become a Babel of digital confusion.

“All three use different certification engines,” she said. “We use RSA, AT&T uses VeriSign and Operational Research uses Netscape. All the agencies know how to validate the certificates, so it’s basically interoperable.”

She acknowledged that these are still “early days” for PKI implementation. Cummins said the aftermath of Sept. 11 might have slowed down PKI implementation somewhat, but it could also ultimately serve as a catalyst.

One thing that could have a very big impact is that the proposed Homeland Security Department “will be a hodgepodge of different agencies trying to coalesce in a coherent way,” she said. Agencies will have to “make decisions on how they communicate with each other and a very large constituency.

“The individual agencies as they proceed can make their plans in a traditional personal identification number and password manner, or they can begin to move toward an interoperable approach like PKI,” she added.

Payton Smith, manager of public-sector market analysis services at Input of Chantilly, Va., said some agencies could move quickly to implement PKI because of their own needs. The Treasury Department, for instance, has invested in PKI to support online tax filing services, he said. Although PKI hasn’t so far been traveling at the speed of light, things could change. Deadlines have a way of moving things along faster.