Federal Public Key Infrastructure Policy Authority (FPKIPA) Minutes of the 14 December 2004 Meeting GSA; 1800 F Street; Room 5141B; Washington, DC

Transcription

1 Federal Public Key Infrastructure Policy Authority () Minutes of the ember Meeting ; 1800 F Street; Room 5141B; Washington, DC A. AGENDA 1) Welcome & ing Remarks / Introductions 2) Vote on Minutes from 14 September, 12 October, 9 November 3) Status of Votes Since Last Meeting 4) Discussion Topic #1: Approval of HHS as Voting Member 5) Discussion Topic #2: Chair Nominations and Election 6) Discussion Topic #3: Bridge-to-Bridge Cross-Certification Status 7) Federal Identity Credentialing Committee (FICC) Report 8) FPKI Certificate Policy Working Group (CPWG) Report 9) Federal PKI Architecture Operational Authority (FPKIA OA) Report 10) Other Topics 11) Meeting Adjourned / Next Meeting Plans B. ATTENDANCE LIST VOTING MEMBERS Organization Name Telephone Dept of Commerce (NIST) Polk, Tim tim.polk@nist.gov Dept of Defense Hanko, Dave djhanko@missi.ncsc.mil Dept of Energy Breland, Mary Ann maryann.breland@hq.doe.gov Dept of Justice ABSENT Dept of State Cao, Tin caott@state.gov Dept of the Treasury ABSENT Spencer, Judy judith.spencer@gsa.gov NASA DeYoung, Tice tdeyoung@hq.nasa.gov OMB ABSENT USDA/NFC Sharp, Kathy kathy.sharp@usda.gov OBSERVERS Organization Name Telephone ACES Duncan, Steve stephen.duncan@gsa.gov Dept of Defense Mitchell, Debbie dmmitc3@missi.ncsc.mil Dept of State (Mantech) Froehlich, Charles R. froehlichcr@state.gov Dept of the Interior Davis, Russ russell_davis@blm.gov Dept of the Treasury (evalid8) Faut, Nathan nathan.faut@evalid8corp.com E-Auth Lab (Enspier) Russell, Arthur arussell@enspier.com FICC Petrick, Brant brant.petrick@gsa.gov FICC Support (Bearing Point) Stipisic, Dario dario.stipisic@bearingpoint.com FPKIA OA Director () Jenkins, Cheryl cheryl.jenkins@gsa.gov Secretary () Lentz, Mark lentz_mark@bah.com Secretary () Clemons, Darryl clemons_darryl@bah.com HHS Alterman, Peter altermap@mail.nih.gov HHS Calebrese, Ken ken.calabrese@hhs.gov

2 C. MEETING ACTIVITY Agenda Items 1 & 2 Introductions / Vote on Approval of Meeting Minutes Mr. Tim Polk, Department of Commerce (NIST) and Vice Chair, called the to order at 9:55 a.m. with attendee introductions. Regarding the 14 September, 12 October, and 9 November minutes, they were distributed to the via in sufficient time to call for a vote, but the consensus of the attendees was to conduct the vote via . ACTION (105): will forward the 14 September, 12 October, and 9 November minutes to the voting members and request an vote to be due by 17 December. Agenda Item 3 Status of Votes Since Last Meeting There weren t any votes conducted since the last on 9 November. Agenda Item 4 Discussion Topic #1: Approval of HHS as Voting Member Mr. Ken Calabrese, Department of Health and Human Services (HHS), informed the attendees that the application to be a member is still awaiting signature at HHS and was not able to be completed prior to this. Since receipt of the application is necessary prior to electing an organization, that gets there PKI services from a Shared Service Provider (SSP) and operates their own Registration Authority (RA), as a voting member of the, the decided to conduct the vote to approve HHS as a voting member via vote, once the application is received from HHS. ACTION (106): will request an vote to approve HHS as a voting member after HHS sends the application to be a member is received by the. Agenda Item 5 Discussion Topic #2: Chair Nominations and Election Since the Chair nomination process has been open, there have been three nominations received: Ms. Carol Bales, Department of Energy, Dr. Tice DeYoung, NASA, and Mr. Dave Hanko, DoD PKI PMO. Chair is an elected position and its term is two years. The term of the current Chair, Michelle Moldenhauer, Department of the Treasury, expires in December. The attendees wanted to allow more time for the members to make other nominations. Mr. Polk asked for a hand vote for agreement from the voting members to postpone the Chair election until the 11 January 2005 and to allow the current Chair, Ms. Michelle Moldenhauer, to continue in the role until 11 January The voting members 2

3 in attendance unanimously agreed to postpone the vote for the Chair until the 11 January 2005 and for the current Chair to serve until 11 January ACTION (107): will notify the listserve that they have until 7 January 2005 to nominate people for the position of Chair and that the election will be held at the 11 January Agenda Item 6 Discussion Topic #3: Bridge-to-Bridge Cross-Certification Status Dr. Peter Alterman, HHS, stated that there are three bridge PKIs that are currently interested in crosscertifying with the FBCA --- the Higher Education Bridge Certification Authority (HEBCA), the Aerospace Bridge (Certipath), and the Pharmaceutical Bridge (SAFE Bridge). At a recent CPWG, the special requirements for cross-certification for Bridge PKIs versus individual PKIs were discussed, and the most important additional information that the FBCA will probably require of applicant Bridge PKIs are the charter of the Bridge CA (to understand the governance of the Bridge CA and its cross certification members) and the closest thing they have to the FBCA Criteria & Methodology (C&M) document (to understand what the Bridge PKI requires of its cross-certification members). The FBCA C&M document was updated in October to address Bridge PKIs cross-certifying with the FBCA, but those changes have not been approved by the. A vote was taken to approve the latest C& M document, but not enough YES votes were received to approve the document. All of the voting members who voted to Abstain wanted to have more time to read the document updates before voting. Here is the voting record for this item: Approval vote for October version of Criteria & Methodology Document Voting members Vote (Motion NASA; 2 nd Commerce) Yes No Abstain Dept of Commerce Dept of Defense Dept of Energy Dept of Justice (proxy by Vice Chair) Dept of State Dept of the Treasury (proxy by Vice Chair) NASA OMB (proxy by Vice Chair) USDA/NFC ACTION (108): will forward the October version of the Criteria & Methodology Document to the listserve and ask Defense, Energy, and State to vote on its approval via before the 11 January

4 Agenda Item 7 Federal Identity Credentialing Committee (FICC) Report Ms. Judith Spencer, FICC, reported the following items: NIST has agreed to allow the Smart Card Interagency Advisory Board (SC IAB) to revise Special Publication , the technical specification for Smart Cards. Mr. Tim Baldridge, NASA, is the lead contributor to this effort. The revision should be done by 20 January A subset of the FICC is working on the FIPS 201 Implementation Handbook, taking over the original focus of the FICC Handbook. ERM Guidance for archive of digitally signed records is in process. The next steps are as follows: 1) OMB & DoJ clearance & comments 2) Ready for distribution to FICC/ comments due by 22 December 3) FICC reviews and resolves the comments 4) ERM Guidance is released as an FPKI document and NARA Guidance. Agenda Item 8 FPKI Certificate Policy Working Group (CPWG) Report Since the 9 November, CPWG s were held on 22 November, 7 December, and 13 December. At the 7 December, the CPWG discussed the responses from the US Patent & Trademark Office (PTO) to the discrepancies from their General and Medium Mapping Matrices. All the PTO responses to the CPWG discrepancies were acceptable to the CPWG so it recommends that the vote to approve the PTO policy mapping at the Medium assurance level. Here is the voting record: Approval vote for the PTO Policy Mapping at the Medium Assurance Level Voting members Vote (Motion Commerce; 2 nd Treasury proxy) Yes No Abstain Dept of Commerce Dept of Defense Dept of Energy Dept of Justice (proxy by Vice Chair) Dept of State Dept of the Treasury (proxy by Vice Chair) NASA OMB (proxy by Vice Chair) USDA/NFC The FBCA CP Change Proposal, -03, titled U.S. Citizenship for Trusted Roles, has issues that have not been resolved sufficiently to allow for a vote at this. There was a suggestion for some of the members to meet with Mr. Gil Nolte, DoD PKI PMO Director, and other DoD PKI PMO personnel during the first week of January 2005 to discuss DoD concerns with this change proposal. If the DoD concerns with this change proposal can be resolved during this during 4

5 the first week in January 2005, this change proposal may be voted on at the 11 January The FBCA CP Change Proposal, -04, titled Changes to address E-Authentication issue, was explained by Mr. Tim Polk, Department of Commerce (NIST). The E-Authentication Program had identified the need for Basic Assurance Level certificates to meet the E-Authentication Level 3 authentication requirements. This will require changes in two areas of the FBCA CP. The CPWG discussed this change proposal at their 7 December and recommended it for approval at this. Here is the vote record for this change proposal: Approval vote for FBCA CP Change Proposal -04 Voting members Vote (Motion Commerce; 2 nd ) Yes No Abstain Dept of Commerce Dept of Defense Dept of Energy Dept of Justice (proxy by Vice Chair) Dept of State Dept of the Treasury (proxy by Vice Chair) NASA OMB (proxy by Vice Chair) USDA/NFC ACES/ORC had submitted their compliance audit letter on 13 December, the day before this. This didn t allow sufficient time for the CPWG to review it and decide if it was ready to be approved by the. ACTION (109): will distribute the ACES/ORC Compliance Audit Letter to the CPWG for review by ember and the CPWG will decide by 17 December if it should be recommended to the for vote before 24 December. The Department of Labor (DoL) should be submitting a revised Compliance Audit Letter later in December. The CPWG will review this revised audit letter and then follow ACTION (087) for carrying out the process for approval. Mr. Polk just reminded the attendees that FIPS 201 comments that any of the members want to contribute, as part of a response should be sent to the listserve by 21 December. Agenda Item 9 Federal PKI Operational Authority (FPKI OA) Report Status of FPKI Architecture Certification & Accreditation (C&A) Ms. Cheryl Jenkins, FPKI OA Director, reviewed the status of the FPKIA Certification & Accreditation, stating the following highlights: 5

6 The FPKI OA met with KPMG about the schedule and current findings from the recent FPKIA OA audit and FBCA CP review (RFC 2527 vs RFC 3647 versions). The final report of the audit findings should be completed by the end of December. Status of FBCA/Applicant Cross-Certification Technical Testing: The Department of Homeland Security (DHS) is currently in the lab for testing. Technical interoperability testing for the U.S. Patent & Trademark Office (PTO) has recently been completed and the report that recommends approval should be ready for distribution later in December. One of the things that was learned by the FPKI OA during the PTO testing is that due to their use of DC Naming, a new directory structure will need to be established at the FPKI OA to interact with PTO and other PKIs in the future with a similar certificate naming structure. ACTION (110): will forward the PTO Technical Testing Report to the for review and vote, once it is received from the FPKI OA. Status of CA Testing: There was no CA testing since the 9 November to report during this. Other Topics Agenda Item 10 There weren t any other topics discussed during this. Meeting Adjourned / Next Meeting Plans The adjourned at 11:50 a.m. Agenda Item 11 The next FPKI PA Meeting is scheduled for 11 January 2005 from 09:30-12:30 at the facility located at 1800 F Street, Room 7001, Washington DC. 6

7 D. CURRENT ACTION ITEMS No. Action Statement POC Start Date 048 Solicit participants with a real application to do Judy 10 June business with Canada. Spencer, 057 Write a short paper that says from here forward the FBCA OA will limit FBCA acceptance testing to systems that demonstrate enhanced assurance through NIAP testing. 062 Define the NIAP certification requirement for future bridge membrane applications. 066 Develop text for the Charter regarding the sunset clause for voting members of the who are not cross certified members of the FBCA. 085 Test/evaluate the PKCS-12 usage issue and make a recommendation to the at a in the near future. 087 Once the CPWG approves the Department of Labor (DoL) compliance audit letter, request the voting members to submit their approval votes for cross certification of DoL. 090 Develop a C&A list related to NIST Standards and Tim Polk, NIST Tim Polk, NIST Tim Polk, NIST Tim Polk, NIST Cheryl Jenkins, 8 July Updated 9 Sept 9 Sept 18 Nov 13 July 13 July 12 Oct Target Date 13 Jan 9 Dec 9 Dec 13 Jan 12 October 10 August Jan 2005 Status 095 Develop, obtain approval, and distribute a letter to cross-certification members, requesting them to send a letter to the to document their compliance audit history and schedule of annual audit of their cross-certified CA, in compliance with FISMA requirements. 096 Research and draft charter updates to address Bridge-to-Bridge Cross-Certification. Dr. Tice DeYoung, NASA 12 Oct 12 Oct Jan Research and draft FBCA Criteria & Methodology document updates to address Bridge-to-Bridge Cross-Certification. Dr. Peter Alterman, HHS 12 Oct Jan

8 No. Action Statement POC Start Date 104 Review the PTO directory testing issues and once NIST 9 Nov resolved, between PTO and the FPKIA OA, will ask for approval. 105 Forward the 14 September, 12 October, and 9 November minutes to the voting members and request an vote to be due by 17 December. 106 Request an vote to approve HHS as a voting member after HHS sends the application to be a member is received by the. 107 Notify the listserve that they have until 7 January 2005 to nominate people for the position of Chair and that the election will be held at the 11 January Forward the October version of the Criteria & Methodology Document to the listserve and ask Defense, Energy, and State to vote on its approval via before the 11 January Distribute the ACES/ORC Compliance Audit Letter to the CPWG for review by ember and the CPWG will decide by 17 December if it should be recommended to the for vote before 24 December. 110 Forward the PTO Technical Testing Report to the for review and vote, once it is received from the FPKI OA. Target Date 11 Jan Dec 17 Dec 11 Jan 2005 Status 6 Jan Dec 16 Dec 8