1. The Federal PKI Or, How to Herd Worms Peter Alterman Senior Advisor, Federal PKI Steering Committee

2. Alterman I2 3/9/01 Drivers for a Federal PKI Statutes – GPEA & E-SIGN.. so far Executive Orders Private industry

3. Alterman I2 3/9/01 Fundamental Design Issues Single Federal PKI envisioned early Then reality set in… Hence the Federal Bridge Certification Authority. Requires creation of the Federal Bridge Policy Authority to manage Bridge and Creation of the Federal Bridge Operational Authority to run the Bridge.

4. Alterman I2 3/9/01 Operating Assumptions of the Federal Bridge Certification Authority No matter how desirable it may be, or how cost-effective, there cannot be a single Federal PKI that will pervade all Executive Agencies. In order to finesse the above reality, divine inspiration birthed the concept of the Federal Bridge Certification Authority (FBCA). The model for the FBCA is that of a non- hierarchical hub linking and cross- certifying participating PKIs and bridges.

5. Alterman I2 3/9/01 Elements of the Federal Bridge Cross-Certification and Policy Mapping Certificate arbitration (connectivity) CRL and Directory Services

6. Alterman I2 3/9/01 How the Federal Bridge Works Others FBCA HEPKI BCA NIH CA UA-B CA user DOE CA user IL State CA

7. Alterman I2 3/9/01 Things You Should Notice Institutional C.A.s don’t cross-certify with the Federal Bridge CA. Federal Bridge CA cross-certifies with Federal and State entities and with other Bridges only. This is a new model: policy and technical issues drive the new model. New model relies on proliferation of other bridges.

8. Alterman I2 3/9/01 Issues for the Federal Bridge Where the production Bridge resides Getting multiple CA products to interoperate within the Bridge Directory operations Performance expectations and design upgrades $$ Client application software New products in the PKI space (read Microsoft) New technology models (challenges to “traditional” PKI

9. Alterman I2 3/9/01 Implications for Higher Ed Higher education bridge becomes a critical requirement for doing business with the Feds and maybe the States

10. Alterman I2 3/9/01 Questions for Higher Ed and the Feds Do state institutions cross-certify with the HE bridge or State bridge/FBCA? Can Institutions use the FBCA-HEPKICA path for non-Federal transactions?