INTERVIEW: R. Michael Green, Defense PKI chief

GREEN: We plan to initiate the acquisition for the Defense Department's target Class 4 architecture early in the first quarter of fiscal 2001. The implementation strategy for the DOD Public-Key Infrastructure is practical and based on an evolution toward higher levels of assurance.The Class 3 PKI, employing some of the best currently available commercial PKI standards and technology, will transition over time to the next generation of PKI represented by the Class 4 architecture. The objective baseline certificate level for DOD sensitive-but-unclassified messaging will be at the Class 4 level of assurance. That is not to say that there won't be some unique DOD requirements that will continue to best be met by the Class 3 PKI. I'm thinking of possibly the tactical user.GREEN: Simply put, the difference between a hardware-based solution and a software-based solution comes down to a question of assurance. Hardware can be more readily verified than software, can be made more resistant to tampering and can afford greater protection to the PKI users' private keys.GREEN: There have been some misconceptions floating around about DOD's use of the Netscape components. First, DOD is not issuing Netscape certificates. The DOD certificates are completely standards-compliant and can move between a variety of applications from a variety of vendors.There is nothing unique about the certificates that would prohibit other vendors from creating compatible certificates. In fact, we have already approved four interim external certificate authorities'Digital Signature Trust Co. of Salt Lake City, General Dynamics Corp., Operational Research Consultants Inc. of Alexandria, Va., and VeriSign Inc. of Mountain View, Calif.'that have produced DOD-compliant certificates. DOD trading partners and vendors use these certificates today.DOD's objective is to field a PKI that is based on standards and employs appropriate commercial components. Unfortunately, in some cases there is no widely accepted industry standard. A prime example is the registration interface between the end entity and the certificate authority. No matter which certificate authority products are chosen, some number of vendor-specific or de facto standards must be selected.During the inception of the DOD PKI, the Netscape Certificate Authority was a component that DOD already had in place and that we had tested. An existing licensing agreement that DOD had with Netscape gave us the ability to provide Netscape clients at no additional cost to DOD.The Netscape products address a number of DOD requirements, namely the crypto-module meets the Federal Information Processing Standard 140-1. They provided a recovery mechanism for the confidentiality key. And, the Netscape client provided a native capability for subscriber-to-certificate-authority registration.Although it is currently fielded, we are in no way tied to or committed to it in the future. It is fully our intent to use other vendors and products in future DOD PKI implementations. Keep in mind that until July, the DOD PKI was still in the pilot phase.GREEN: I'd say that the DOD PKI faces challenges in the areas of ensuring interoperability between vendor components and establishing DOD's directory infrastructure.With respect to interoperability, we have established an effort with DISA to test PKI components at the Joint Interoperability Test Command at Fort Huachuca, Ariz. Initially our focus at JITC will be on testing cards and readers to support the fielding of smart cards as PKI tokens. Using smart cards as an example, our vision for interoperability would be for DOD users to be able to use their access card with PKI credentials installed across any number of off-the-shelf smart-card readers. Today a lack of standardization does not make this a given.The DOD directories will perform a critical role in certificate validation and distribution of public-key certificates. Our identification of the PKI-specific directory requirements and their integration in the larger DOD directory structure is a significant challenge.GREEN: Our experience with DMS has given us some very valuable lessons. Primary among them is that there is a great risk venturing out too far in front of the pack with a new technology.When DMS development began in the early 1990s, the commercial PKI industry was not yet in its infancy, so DOD, by necessity, developed its own. When the marketplace realized the huge commercial potential of electronic commerce and PKI, and developed a commercial PKI and chose different algorithms, protocols, standards and architecture in their PKIs than did DOD, we could not keep up with the pace of innovation. Commercial industry is good at determining the business case, and they picked up quickly on the schism between what DOD was doing and what was going on in the marketplace.The DOD PKI Program Management Office has a commitment to minimize the use of custom products as we migrate away from the current Class 4 PKI. For example, we have deployed the current Class 3 DOD PKI using mostly commercial, off-the-shelf technology. As I mentioned earlier, we have established a test center at JITC to test commercial PKI applications and products to see if they are interoperable with the DOD PKI, what we call public-key enabled or PKE.We've also learned some valuable lessons about our technological architecture choices. Decentralizing the certificate authority function proved to be too expensive to support. While it does offer the user community some degree of flexibility, the difficulty in maintaining several hundred'or thousands in the original architecture'certificate authorities at an adequate security level is too resource-intensive.Similarly, the use of a relatively expensive end-user token became unsupportable. We've learned that it is not practical to go for the armor-plated Rolls-Royce solution for every application. Our new philosophy is to gain widespread use of PKE applications by first fielding technology that is easy to use while providing tangible security benefits.