Time/Date Stamp Time/Date Stamp Authorization Secure Non- repudiation Secure Non- repudiation Key Recovery Key Recovery Message Confidentiality Message Confidentiality (S/MIME) Session Confidence Session Confidence (SSL) Access Control Access Control (SSO/CSO) Non- repudiation Non- repudiation (SET) Integrity (Signature) 1. Certificate Granting Agent 2. Trusted Third Party 3. Security Servers and Agents 4. Certified Delivery System 5. Digital Notary Server 6. Digital Signature Generation 7. Digital Signature Verification 8. Confidentiality Key Exchange 9. Key Pair Generation PKI Certificate Management PKI Certificate Management Policy Approval Certificate Revocation Certificate Revocation Certification Archiving Certification Archiving Repository Naming and Recognition Data Archives

SupplierCustomer Collaborative Commerce Intellectual Property Search, Discovery, Offering Reputation EFTValue Logistics/SCMTheft Trusted Transactions Integrity CRM — Intimate Knowledge Privacy Marketing Selling Shipping Service and Support Design Receivables Shopping Purchasing Using, Maintaining Development Payables Receiving E-Business Information Security Vulnerabilities

Prioritizing PKI Applications ApplicationPriority Secure VPN Secure Web AccessHigh Secure Overall Risk Reduction High New Business Opportunity High Digital Signature Server IDs Desk/LapTop Encryption Medium Consolidated Sign-On SET Low

SSL - A No Brainer  Cyber-browser visits a secure site. Web Server Server Server’s public key  The Web server submits its site/server public key certificate to the browser. The channel is encrypted, the Web server identified.  The Primary PKI App today

Signing and Sealing the Envelope X.400 PEM PGP MOSS S/MIME V.3 OpenPGP Signature DMS/MSP BeingDeployed Not Being Deployed

Web Access: Portals Through the Firewall Public Web site Customer extranet Supplier extranet Employee intranet Channels extranet

EDI Transactions Require Digital Signatures and Encryption Transaction Type Invoice Application Advise Price Sales Catalog Contract Award Summary Trading Partner Profile Request for Quote Response to Request for Quote Purchase Order, Delivery Order Purchase Simple Contracts Purchase Order Change Text Message Order Status Report Functional Acknowledgment Digital Signature Required Yes No Yes No Encryption Capability Needed No Yes No

PKI Integration With Acrobat

California Independent Systems Operator PKI Architecture Master Directory Server (LDAP/X.500) Network Policy Creation Authority CA Signing Certificates Medium Assurance Medium CA High Assurance High CA Basic Assurance Basic CA Register Users Revoke Certs Registration Authority Workstation Policy Approval Authority Client Applications PKI Mail Server

ACES Architecture Subscriber App 1 CAM Browser CA 1 Cert CA 2 Cert CA N Cert App 1 PrivateKey App 1 Cert (FIPS 140-1) SubscrbrPrivateKey Subscrbr Cert (HW Token Opt’l) Agency List of Invalid Cert IDs Audit Log CA 1 Cert CA 2 Cert CA N Cert CAM: -Parse Cert -Verify SubscrbrCert Issuer as an ACES CA -Verify SubscrbrCert Issuer’s signature -Verify SubscrbrCert’s operational period -Check cached Invalid Cert IDs -Get route to Issuer -Send signed Status Request & Cert data to Issuer -Receive signed Status Response -Verify Status Response signature -Pass status & cert data to App -Log audit data App API CAM ACES CA N (FIPS 140-1) CA N PrivateKey ACES CA 2 (FIPS 140-1) CA 2 PrivateKey ACES CA 1 (FIPS 140-1) CA 1 PrivateKey RSA DSA ECDSA Crypto API CA API cert status + cert fields RSA, DSA DSA, ECDSA RSA CA 1 SubscrbrCerts CA 1 Cert CA 2 Cert CA N Cert RSA CA 2 SubscrbrCerts CA 1 Cert CA 2 Cert CA N Cert RSA CA N SubscrbrCerts CA 1 Cert CA 2 Cert CA N Cert

“Brand B” CA Private Key Token Digital ID “Four Corner Transaction” ManufacturerTrading Partner Place Order Receive Order Digital Order BBE E41675DE 6F4593D8 71D2BDA7 20 D519E511 6B7824C5 0B70E1E7 40C1BC36 30 C2AD5ACD 80CB D066A E707418C 40 C08BACF5 1A ED2BF17 2E55DBF2 50 F657EE32 27A84F70 51A2FB63 Digitally Signed Private Key Token Digital ID Provides verification of identities & signatures and assurance (“TRUST”) Facilitate interbank certificate checking Utilize tools to allow interoperability across CA’s and supplies software developers toolkit with standard functionality to member banks Private Key Token Digital ID BANK A BANK B “Brand A” CA Private Key Token Digital ID Source: Entegrity Solutions

European Private Banking (Anon) Private, personal, retail banking & brokerage services Operation in fiscal haven with strict bank secrecy laws Worldwide Customer Base Smartcards with certificate client credentials SSL, User ID, password model was not appropriate Transparent certificate management Initial smartcard/certificate issuance

Bolero directory services registration authority sends public key certification of public key registry certification authority identification exchange of EDI messages exporter carrier bank private key sent by registration authority

Transuranic Reporting and Inventory Processing System (TRIPS)

PKI Case Studies

PKI Integration Scorecard Comments Web BrowsersASSL --> TLS and Wireless AS/MIME;PGP -->OpenPGP VPNsB+IPSec, IPV6 E-FormsB+Signing, Encrypting PackagedDDriven by Webification, ASPs Applications Legacy/CustomFBridging RACF, DCE/Kerberos Applications

Wireless Application Protocol Compare/Contrast to Web