The NIH PKI Pilots

1. The NIH PKI Pilots Peter Alterman, Ph.D. … again

2. NIH publishes RFAs and other announcements of research topics and training opportunities Researchers submit applications for funding under a number of mechanisms Applications are reviewed by independent study sections 3 – 4X/year Approved applications are ranked Grants are funded by score and mission relevance Annual reports submitted Noncompeting renewals make up bulk of ~40k grants issued annually (about $13B!) A Simplified Description of the NIH Extramural Research Business Process

3. Currently, NIH Extramural Business Process is ALL PAPER

4. Phase I: PKI-enable an Adobe I-form Version of a PHS-398, Application for Research Grant • Allergy Institute created an electronic version of the application form • NIH and Digital Signature Trust working to allow attachment of two TrustID digital signatures to the completed I-form • Institutions will acquire TrustID digsigs courtesy of NIH, download I-form, complete dummy application, sign (PI and AOR) and return to NIH as email attachment • NIH will transfer attachment to local hard disk, then validate signatures using E-lock Assured Office client • Some platform and process constraints understood in pilot • Outcomes: • demonstration of successful creation, signing and validating of I-form 398 • Identification of areas requiring further development

5. What it Looks Like NIH test user University 1 end-users University 3 End users NIH CA And Directory trustpath trustpaths Actually DST CA for Pilot University 2 end-users

6. Phase II: Replace NIH-supplied Digital Certificate with Institution’s Digital Certificate (in multiple flavors) • UAB, UW-M and UCOP • TrustID cert (no-brainer, already done in Phase I) • VeriSign cert • Netscape IPlanet cert • NIH cross-certifies with the Fed Bridge at the test level of assurance • Educause sets up the HE Bridge • Fed Bridge and HE Bridge cross-certify at the test level of assurance • Institutions cross-certify with the HE Bridge at the test level • NIH validates certs using modified E-Lock product • Validation path runs through Fed Bridge toHE Bridge to Institutions’ CRLs

7. Remember This? Slightly Modified… NIH CA, Directory, End user HE Bridge CA And Directory Fed Bridge CA And Directory Validationpath Validationpaths Actually DST CA for Pilot CA,Directory, CRL, end users CA, Directory, CRL, end users

8. The Federal Bridge Certification Authority – Description and Current Status Peter Alterman, Ph.D. Senior Advisor to the Chair, Federal PKI Steering Committee and Acting Director, Federal Bridge Certification Authority

9. The FBCA Architecture CA, Directory, End users Bridge CA And Directory Bridge CA And Directory Trustpaths Trustpaths CA,Directory, End users Trustpaths CA, Directory, End users

10. FBCA Overview • Designed for the purpose of creating trust paths between among PKI domains • Issues cross-certificates to Member CAs only • Employs a distributed, NOT a hierarchical, model • Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane • Develops cross certificates within the membrane to bridge the gap among dissimilar products

11. FBCA Goals • Leverage emerging Federal Agency PKIs to create a unified Federal PKI • Limit workload on Agency CA staff • Support Agency use of: • Any FIPS-approved cryptographic algorithm • A broad range of commercial CA products • Propagate policy information to certificate users in different Agencies

12. FBCA Operation • Issues Cross-Certificates to Participating CAs only • FPKI Steering Committee oversees FBCA development and operations • Documentation • Enhancements • Client-side software • Operates in accordance with Policy Authority and FPKISC direction

13. FBCA Management Hierarchy • Steering Committee oversees FBCA development and operations • Direct Operational Authority • Bridge Documentation • Enhancements • Policy Authority determines participants and levels of cross-certification • Administers Certificate Policy • Approves requests to cross-certify • Enforces compliance by member organizations • GSA named Operational Authority • Operates in accordance with Policy Authority and Steering Committee direction

14. Current Status - August 10, 2001 • Policy Authority approved final documentation on June 18, 2001 • Certificate Policy • Certification Practices Statement • Independent Compliance Analysis • FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001 • Prototyping/Compatibility lab continues operational off-site • Hot backup site nearing completion • C & A Audit under way by KPMG • Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois

15. What Will It Take to Use the FBCA? • Policy mapping of certificate policies • Sharing annual audits • Careful management of cross-certificates to limit transitive trust (exclusion trees) • Directory interoperability and synchronization • Client software for certificate path discovery and processing

16. Next Steps • Continue to bring federal agencies into interoperability • Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft • Pursue interoperability with State PKIs • Pursue interoperability with Nation of Canada • Pursue interoperability with non-government sector bridges

17. References • Federal PKI Steering Committee Website: http://www.cio.gov/fpkisc • FBCA Page: http://www.cio.gov/fpkisc/fbca/index.htm • NIST PKI Website: http://csrc.nist.gov/pki