Fed Official Urges Companies Not To Delay PKI

By David Drucker

The head of the federal government's public-key infrastructure initiative said the benefits of PKI far outweigh difficulties in implementation, and that now is the time for government agencies as well as enterprises to begin plans for deployment.

In his keynote address today at the Electronic Messaging Association's Fall '99 Solutions Summit, Richard Guida, chairman of the federal PKI steering committee, called PKI the best method for meeting the government's high security needs. He outlined the government's plan to deploy PKI in several agencies including the Department of Defense, and to use the technology to let the public securely interact with government over e-mail and the Internet.

"Federal agencies have to embrace public key technologies," Guida said. "What are the challenges we face across all applications? It's not rocket science: We have to worry about authenticating users, and it has to be a viable level of assurance. You may also need varying levels of authentication, and you need the ability for nonrepudiation. Public key does that. There's no technology yet that will guarantee nonrepudiation, but public-key infrastructure comes closest to it."

Guida said the biggest hurdle in PKI deployment is the synchronization of directories, which he said usually accounts for more than half the budget of PKI projects. He advised companies to rethink the common belief that they must solve directory compatibility problems before undertaking PKI planning.

"I take the opposite view," he said. "Solutions to directory problems will be pushed by use of PKI, rather than the other way around. If I waited for directory harmony before I started working on PKI, my kids would be the ones working on it. We'd be missing opportunities that are there now. I think standards are good enough to make a PKI system work in an enterprise today."

One IT manager at a Fortune 500 company agreed, saying that directory issues have been a major obstacle to planning the PKI his company needs for better security throughout its worldwide operations. "We're going to have to start looking at it the other way," said the manager, who requested anonymity.

In describing PKI projects in the Department of Defense, FAA, FDIC and NASA, Guida said PKI will in most cases be used along with smart cards to allow a higher level of internal security. He said PKI also will let agencies work more effectively with subcontractors and open up abilities to do business with more outside companies. He also discussed plans to issue free digital certificates to the public to let them access data from government sources, such as personal social security information.

Guida did not give budget details, but said in general that money spent now on PKI will be worth the initial costs. "It's an expense that won't be recouped in the next year or two, but will be returned in the longer term."

He said other agencies, including the Justice Department, also are considering PKI projects, and that PKI will help agencies work together. "There's large potential for interagency use," he said.

Guida said many companies are holding back on PKI projects because they're worried about venturing into untested legal waters. But he said those concerns are mostly unfounded, and not a reason to hold back from implementation.

"Legal trepidation about PKI is, in my mind, the biggest red herring of them all," he said. "Technology and commerce marches on regardless of legal uncertainties. There's no reason to delay use of this technology."