From: Mark Aldrich <maldrich@grctechs.va.grci.com>
Date: Wed, 20 Mar 1996 01:52:27 +0800
To: "Alan B. Clegg" <abc@gateway.com>
Subject: Re: While browsing the IRS ("Electronic Certification")
In-Reply-To: <Pine.BSI.3.91.960318084035.337A-100000@black-ice.gateway.com>
Message-ID: <Pine.SCO.3.91.960318093421.6327B-100000@grctechs.va.grci.com>
MIME-Version: 1.0
Content-Type: text/plain


On Mon, 18 Mar 1996, Alan B. Clegg wrote:

They've been working on this for awhile.  The problem is that the 
certification setup does not scale well.  They've been looking at having 
the USPS maintain the certificates, but I have heard that it's been 
tossed back and forth between them and GSA and neither of them wants to 
do it.

IRT the actual crypto being used in the solution, they are using the 
Digitial Signature Standard (FIPS PUB 186) with message digests being 
created via the Secure Hash Algorithm (FIP PUB 180).  Unless you're using 
the FIPS stuff, you'd be hard pressed to get GAO or OMB to approve it.

> --SNIP--
> The Financial Management Service is implementing an Electronic
> Certification System to permit fast, secure, and accurate transmission and
> certification of payment data. The system has been approved by the General
> Accounting Office for satisfying the signature certification requirements
> of 31 U.S.C. 3325 and 3528. 
> --SNIP--
> 
> Would anyone like to comment on what is being used to provide 
> signatures?  
> 

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich@grci.com            | 
|        STOP THE CDA NOW!                |MAldrich@dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------