PKI certificate sales slow, program executive says

By Bill Murray

GCN Staff

The high cost of certificates is causing the Defense Department to hold back on public-key infrastructure deployments, according to the armed forces' PKI program director.

'There's been a slow start, primarily because the cost of certificates is more than people are looking for,' said R. Michael Green, director of DOD's public-key infrastructure program management office. 'We're trying to pull together some type of consolidated buys,' which would give the armed services lower per-certificate pricing, he said.

Green, whose National Security Agency-managed program began last September, spoke recently at the DOD PKI Roundtable, sponsored by the Armed Forces Communications and Electronics Association.

The General Services Administration's Access Certificates for Electronic Services (ACES) contract is 'a lot cheaper' than DOD's certificate procurement, Green said. But DOD organizations cannot buy from ACES because it offers Class 2 rather than more-secure Class 3 certificates, he said.

PKI uses public- and private-key pairs to encrypt and decrypt data, and to verify the data of remote users through digital certificates issued and managed by a trusted authority. High-security messages require a hardware token, which can be a smart card or Fortezza card, while medium-grade messages, such as signed contracts and sensitive but unclassified correspondence, use a software token. When loaded onto PCs, software tokens can generate passwords for users.

Companies that meet DOD requirements to supply PKI certificates for the DOD Defense Travel Service, Electronic Document Access, Navy One Touch Supply and Paperless Contracting Wide Area Workflow projects are Digital Signature Trust Co. of Salt Lake City; Operational Research Consultants Inc. of Chesapeake, Va.; VeriSign Inc. of Mountain View, Calif.; and General Dynamics Corp., which resells PKI products from CyberTrust Corp. of Needham Heights, Mass. DOD officials have not told Green to buy the cheapest certificates, but he said his goal is to tell Arthur L. Money, assistant secretary of Defense for command, control, communications and intelligence, that DOD got the best price on certificates that meet its PKI policies.

The DOD public-key infrastructure program management officer is 'not responsible for enabling all the apps,' according to Richard Schaeffer, director of infrastracture and information assurance for the assistant secretary of Defense for C3I.

Midlevel security

DOD has distributed 70,000 Class 3 PKI medium-security software certificates, said Linton Wells II, principal deputy assistant secretary of Defense for C3I. Speaking at the AFCEA TechNet conference, Wells said DOD is now distributing Class 4 hardware tokens with the Defense Message System.

DOD officials have distributed Class 3 PKI certificates for medium-value data in low- to medium-risk environments. They want all 3 million DOD personnel by 2003 to use Class 4 certificates, which work for medium- and high-value unclassified data on secure or unsecured networks. Class 4 certificates work with hardware tokens, while Class 3 certificates work with software tokens [GCN, Jan. 24, Page 1].

DOD officials are learning that they need a relatively stable list of names to ensure the reliability of the system, which calls for flat database directories, said Navy Lt. Cmdr. Paul Friedrichs, PKI chief engineer at the Defense Information Systems Agency.

It is better to have few centralized certificate authorities because 'expenses can get quite high due to nonrepudiation,' he said.

Green said nonrepudiation, or confirming that a message was sent and received by the intended parties, requires additional services'such as time-stamping and encryption key recovery'that can raise costs.

DOD wants new registration protocols for PKI because they limit operations and maintenance costs, and the risks associated with using one vendor, Friedrichs said. He tried to allay the concerns of TechNet audience members who asked if DISA's DOD-wide enterprise license for PKI products from Netscape Communications Corp. meant that other vendors will get shut out and that DOD PKI certificates won't work with those used in the commercial world.

'We want more than one [certificate authority] product in the system. It will double or triple engineering costs, but it's worth it' to have the option of using a variety of vendors, Friedrichs said. DISA officials have spent $1 million to $2 million creating legacy software for the PKI program, he said.

'We are not interested in a sole-source, proprietary, nonstandard product,' Schaeffer said. 'We would be happy if products were interoperable and [we] competed vendors with each other as much as possible.'

The reason there are only five certificate authorities is a 'cost issue' and has nothing to do with policy, Friedrichs said. 'I'm not worried about how monolithic it appears. I'm very confident that we can slip in another' certificate authority when needed.