IRS, SSA to let public try digital signatures
- By Kevin Powers
- Nov 13, 1995
The government will use electronic tax filing and on-line Social Security benefits
reviews as the first public tests of a public-key infrastructure for the Digital Signature
Standard.
Starting in February, the Internal Revenue Service and Social Security Administration
will let about 1,000 citizens in San Jose, Calif., and Dayton, Ohio, file income taxes and
check the status of SSA benefits using home PCs, federal kiosks and the Internet.
Eventually the pilot will be expanded to let the Education Department process student
aid and grant applications electronically.
Officials in the General Services Administration's Security Infrastructure Program
Management Office (SI-PMO) are coordinating the interagency PKI pilot.
Some internal government PKI prototypes are under development already, including
efforts led by the National Institute of Standards and Technology and the Defense
Department. But SI-PMO officials said this is the first pilot that meets the National
Performance Review's mandate for establishing public digital signature programs based on
the government's Digital Signature Algorithm (DSA).
"We've been asked to put a mechanism in place for secure functionality in the
National Information Infrastructure," said Richard Kemp, SI-PMO's acting director.
"We're putting together a system where you can identify yourself and go into the
government and collect data on the Internet."
"We're deploying crypto-enabled transactions to exchange protected information
between agencies and citizens," said Phil Mellinger, SI-PMO's chief engineer.
"The purpose is to revolutionize citizen-agency transactions."
SI-PMO officials unveiled plans for what they called the Paperless Federal Transactions
for Citizens pilot during a public meeting this month at GSA's headquarters in Washington.
Digital signatures are considered an essential ingredient in the government's plans for
electronic commerce and other on-line government services. DSS is based on public-key
cryptography techniques, and it uses the DSA developed by NIST to produce user-unique
signatures.
Under the pilot plan, citizens will use smart tokens to generate their public and
private key parts. Users then will present the Postal Service with their signed public
keys and other personal identification.
As the project's certificate authority, the Postal Service will confirm user identities
at the start of a transmission and will issue message certificates along with public keys.
The Postal Service also will maintain a revocation list so agencies know which
certificates are valid and when they expire.
Citizens then will use home PCs or government kiosks to access the WINGS--Web
Interactive Network of Government Services--network being developed by the Postal Service
as part of the governmentwide kiosk initiative. Users will select applications, enter
data, sign their messages and send them to the government via the Internet.
Mellinger said the process hinges on the smart tokens working with World Wide Web
technology.
GSA will award a contract for commercial smart tokens. One set of smart tokens will be
used for Web browsers, and a second set of higher-throughput tokens will be used for Web
servers.
"Agency applications will be migrated to Web servers and linked to the
Internet," Mellinger said. "The Web server will do a lot of crypto processing.
There will be a dedicated crypto box hanging off the Web server to do digital
signatures."
Industry representatives at the meeting pressed Mellinger and Kemp to explain why they
did not include popular commercial digital signature products, such as those from RSA Data
Inc. of Redwood City, Calif., in the pilot.
Kemp said the SI-PMO's long-term goals include supporting alternative industry digital
signatures, but the government has to start rolling out initiatives that provide adequate
security for agencies now.
"There is no certificate authority that will authenticate identities," Kemp
said. "It's not all there yet in the private sector. We have federal standards for
federal entities."
"The PMO is not mandating one particular solution. The objective is to get an
architecture that is based on standards and can attract consensus in government,"
Mellinger said. "We're lighting the way to seeing the NII. We need to get hands-on
experience."