1. Federal Bridge Certification Authority n Background n Overview n EMA Challenge Test structure n Participants n Results n Conclusions and lessons learned

2. Background n FBCA is non-hierarchical, peer-to-peer “hub” n Supports interagency PKI technical interoperability n Policy interoperability framework established by FPKI Policy Authority n Goal: accommodate Federal agency use of any PKI COTS product

3. Overview n Prototype FBCA operational 2/8/00 –DOD funded and technically supported –GSA auspices; hosted by Mitretek Systems –Entrust and Cybertrust CAs –PeerLogic i500 directory –Supports EMA Challenge and testing n Production FBCA operational late 2000 –Additional CA products within membrane –Mesh arrangement within membrane

4. Test Structure n Six disparate PKI domains cross-certified with FBCA (DOD largest) –Five different CA products –Five different X.500 directory products n Interoperability demonstrated via exchange of signed S/MIME messages n X.500 directory framework - chaining between directories, client access via LDAP

5. Cybertrust CA Entrust CA SFL Client Entrust Client Entrust Client SFL Client DoD Bridge CA Entrust Client Entrust Client Entrust Client PCA CA PCA CA PCA CA PCA CA PCA Entrust Client SFL Client PCA

6. Client Details n Eudora engineered with: –Entrust toolkit (“out of the box”) –CygnaCom libraries –JGVanDyke libraries n Outlook engineered with Entrust toolkit n Spyrus LYNKS cryptocards for CygnaCom/JGVanDyke enabled client n Private key on hard disk for Entrust enabled client

7. Participants n Government of Canada n NSA/DOD n NIST n NASA n GSA n Georgia Tech Research Institute n CA products: Entrust; Cybertrust; CygnaCom; Spyrus; Motorola n Directories: PeerLogic; ICL; Nexor; CDS; Chromatix n Integrators: Mitretek; JGVanDyke; GNS; Booz Allen; CygnaCom; A&N Associates

8. Results Results

9. Conclusions and Lessons Learned n FBCA concept works n Client ability to develop and process trust path straightforward to implement n Directory interoperability is critical to PKI interoperability n Directory entries must line up with CAs n Need for native code in clients n Lots of details, lots of devils