News
Digital Certificates Could Become Standard in IDs
Federal mandates for issuing interoperable electronic IDs to employees and
contractors soon could spur the adoption of digital certificates and the use
of public-key infrastructure (PKI) throughout the country, one industry observer
predicts.
Some states have begun issuing IDs compatible with federal Personal Identity
Verification (PIV) cards to emergency personnel, and one state has cross-certified
with the federal PKI bridge for authenticating digital certificates. Peter Bello,
senior vice president of federal sales for Entrust Inc. of Addison, Texas, predicted
that states soon will begin including digital certificates in IDs issued to
citizens that would be interoperable with state and federal systems and also
could be used to access commercial services.
"Having citizens access government applications is the next big thing,"
Bello said, and the states are the logical entities to enable the process. The
federal government has decided it will not be in the business of issuing digital
certificates to the populace, and "the states have always been the issues
of identity credentials."
Bello and Entrust were at this week's RSA Security conference, updating
other industry observers and government users on developments in the field of
electronic authentication.
Bello predicted that the certificates could begin appearing in driver's
licenses in the next 12 to 24 months as states begin retooling their licenses
to comply with the federal Real ID mandate. "Maybe I'm being too
optimistic, but I think it's just a matter of time," he said.
He has reason to be optimistic: Entrust already is one of the leading providers
of digital certificates to government, and expanded use of the certificates
for access to online resources could open up a large new market for issuing
and managing them.
A digital certificate is an electronic ID, a bit of code that can be stored
on a smart card or other token, or kept on a computer. It contains a digital
signature from the issuing authority that can be used to verify the certificate's
authenticity. It also can include a private cryptographic key that can be used
to encrypt and digitally sign documents and other information.
Government uses the certificates in the Defense Department's Common Access
Card (CAC) and its civilian counterpart, the PIV card. The job of issuing, verifying
and managing the certificates often is done by a third-party certificate authority.
Several agencies, including the Treasury Department and the General Printing
Office (GPO), provide certificate authority services to other federal agencies
as shared service providers. Entrust is a commercial shared service provider,
which has the advantage of also being able to sell into the non-federal market.
Agencies such as Treasury and GPO cannot provide services to non-federal customers,
so when states, contractors, research institutions and other outsiders need
federally approved credentials to interact with feds, they go to Entrust.
DOD has issued millions of CAC cards and, as the PIV card program begins picking
up, tens of thousands of certificates have been issued to civilian workers and
contractors. But the non-federal market offers a huge opportunity for certificate
authorities.
"We're seeing a lot of uptake from state and local governments
on the First Responder Access Card [FRAC]" an ID that contains digital
certificates compatible with federal cards, Bello added.
Illinois, a leader in the use of digital certificates at the state and local
levels, is issuing the FRAC, and a number of other states, including Tennessee,
New York and Alaska are thinking about it.
Illinois also is the first state to be cross-certified with the federal PKI
bridge, an information sharing system that enables one entity to allow the use
of certificates issued by another entity to access its resources. The use of
identity bridges establishes trust relationships so that one organization can
accept digital certificates for strong authentication without having to issue
and manage all of the certificates itself.
Trust bridges so far are in the early stages of development. The aerospace
and pharmaceutical industries have established their own bridges, which have
been cross-certified with the federal bridge. Bello said the next logical step
is for more states to establish their own identity bridges which could cross
certify with the federal bridge. Local government and private organizations
could certify with the state bridges, creating a web of trust that could let
citizens use digital certificates to access state, local and federal applications
as well as do private transactions, such as banking.
"It will take the states some time to get there, but the sooner they
do it the better," he said.
About the Author
William Jackson is the senior writer for Government Computer News (GCN.com).