1. The Federal Bridge Certification Authority – Description and Current Status Peter Alterman, Ph.D. Senior Advisor to the Chair, Federal PKI Steering Committee and Acting Director, Federal Bridge Certification Authority

2. The FBCA Architecture Bridge CA And Directory Bridge CA And Directory CA, Directory, End users CA, Directory, End users CA,Directory, End users Trust paths

3. FBCA Overview Designed for the purpose of creating trust paths between among PKI domains Designed for the purpose of creating trust paths between among PKI domains Issues cross-certificates to Member CAs only Issues cross-certificates to Member CAs only Employs a distributed, NOT a hierarchical, model Employs a distributed, NOT a hierarchical, model Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane Commercial products participate within the membrane of the Bridge OR interoperate with products within the membrane Develops cross certificates within the membrane to bridge the gap among dissimilar products Develops cross certificates within the membrane to bridge the gap among dissimilar products

4. FBCA Goals Leverage emerging Federal Agency PKIs to create a unified Federal PKI Leverage emerging Federal Agency PKIs to create a unified Federal PKI Limit workload on Agency CA staff Limit workload on Agency CA staff Support Agency use of: Support Agency use of: Any FIPS-approved cryptographic algorithm Any FIPS-approved cryptographic algorithm A broad range of commercial CA products A broad range of commercial CA products Propagate policy information to certificate users in different Agencies Propagate policy information to certificate users in different Agencies

5. FBCA Operation Issues Cross-Certificates to Participating CAs only Issues Cross-Certificates to Participating CAs only FPKI Steering Committee oversees FBCA development and operations FPKI Steering Committee oversees FBCA development and operations Documentation Documentation Enhancements Enhancements Client-side software Client-side software Operates in accordance with Policy Authority and FPKISC direction Operates in accordance with Policy Authority and FPKISC direction

6. FBCA Management Hierarchy Steering Committee oversees FBCA development and operations Steering Committee oversees FBCA development and operations Direct Operational Authority Direct Operational Authority Bridge Documentation Bridge Documentation Enhancements Enhancements Policy Authority determines participants and levels of cross- certification Policy Authority determines participants and levels of cross- certification Administers Certificate Policy Administers Certificate Policy Approves requests to cross-certify Approves requests to cross-certify Enforces compliance by member organizations Enforces compliance by member organizations GSA named Operational Authority GSA named Operational Authority Operates in accordance with Policy Authority and Steering Committee direction Operates in accordance with Policy Authority and Steering Committee direction

7. Current Status - August 10, 2001 Policy Authority approved final documentation on June 18, 2001 Policy Authority approved final documentation on June 18, 2001 Certificate Policy Certificate Policy Certification Practices Statement Certification Practices Statement Independent Compliance Analysis Independent Compliance Analysis FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001 FBCA “open and ready for business” at the GSA/FTS WillowWoods facility operated by Mitretek Systems on June 7, 2001 Prototyping/Compatibility lab continues operational off-site Prototyping/Compatibility lab continues operational off-site Hot backup site nearing completion Hot backup site nearing completion C & A Audit under way by KPMG C & A Audit under way by KPMG Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois Three federal agencies and one state government preparing documentation for application for interoperability with Bridge: NASA, NFC, FDIC, Illinois

8. What Will It Take to Use the FBCA? Policy mapping of certificate policies Policy mapping of certificate policies Sharing annual audits Sharing annual audits Careful management of cross-certificates to limit transitive trust (exclusion trees) Careful management of cross-certificates to limit transitive trust (exclusion trees) Directory interoperability and synchronization Directory interoperability and synchronization Client software for certificate path discovery and processing Client software for certificate path discovery and processing

9. Next Steps Continue to bring federal agencies into interoperability Continue to bring federal agencies into interoperability Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft Bring additional products into Bridge membrane and/or verify interoperability with products in membrane: working with RSA, Cylink, Spyrus and talking with VeriSign and Microsoft Pursue interoperability with State PKIs Pursue interoperability with State PKIs Pursue interoperability with Nation of Canada Pursue interoperability with Nation of Canada Pursue interoperability with non-government sector bridges Pursue interoperability with non-government sector bridges

10. References Federal PKI Steering Committee Website: http://www.cio.gov/fpkisc Federal PKI Steering Committee Website: http://www.cio.gov/fpkisc http://www.cio.gov/fpkisc FBCA Page: http://www.cio.gov/fpkisc/fbca/index.htm FBCA Page: http://www.cio.gov/fpkisc/fbca/index.htm http://www.cio.gov/fpkisc/fbca/index.htm NIST PKI Website: http://csrc.nist.gov/pki NIST PKI Website: http://csrc.nist.gov/pkihttp://csrc.nist.gov/pki