NFCs Public Key Infrastructure

1
NFCs Public Key Infrastructure

• Kathy Sharp
• USDA, National Finance Center

2
NFC Public Key Infrastructure

• Medium Certification Authority (CA)
• High Availability
• Crypto Module
• Basic Certification Authority
• High Availability
• Crypto Module

3
X.500 Directory

• X.500 Directory
• High Availability
• Repository in the NFC DMZ
• Repository Shadows can be placed at Sites

4
Peripheral Systems

• Medium and Basic CA
• Auto Registration Authority (AutoRA)
• AutoRA Admin
• AutoRA Auth
• Roaming (Zero Footprint) Certificates
• Profile Server

5
Peripheral Systems

• Medium CA
• Web Connector

6
NFC PKI Backup Site

• Located at NITC in Kansas City
• Configured for High Availability
• If the NFC PKI goes Off Line the Backup Site
  activated
• Updates of Backup Site via Firewall VPNs
• Most of the System Admin performed Remotely
• Full PKI Functions
• 24/7 Service

7
NFCs Public Key Infrastructure

• Housed at NFC
• All Registration Functions performed by NFC
  Employees
• Local Registration Authorities - Agencys NFC
  Security Officers or employees appointed by the
  Agency

8
Levels of Assurance

• High Level
• Appear in Person with 2 Forms of Picture ID
  before a high level NFC recognized LRA or Notary
• Medium Level
• Appear in Person with 2 Forms of Picture ID
  before an NFC recognized LRA or trusted agent
• Basic Level
• Appear in Person with 1 Form of Picture ID before
  an agency manager

9
NFC Certificate Application Types

• Virtual Private Network
• Desktop Encryption
• Application Encryption/Digital Signature
• Encrypted E-Mail
• Web Based Encrypted E-Mail
• Web Server
• Roaming Web Client Certificates(Zero Footprint)
• Web Client Certificates

10
Certificate Licenses

• License Per Application Level
• Example A Roaming Certificate is good for all
  Web Applications that are certificate embedded
  (One Certificate One License Multi
  Applications)
• Multi Licenses with the same certificate for
  numerous applications
• Example User needs Encrypted E-Mail and Roaming
  Certificate (One Certificate Two Licenses
  Multi Applications)

11
Federal Government Participation

• Cross-Certification through Federal Bridge CA
• Member of FPKI Steering Committee
• Member of the Legal Working Group of the FPKISC
• Member of the Business Working Group of FPKISC
• Observing Member of the FBCA Policy Authority

12
More Information on NFC PKI

• Visit NFC Web Page at
• www.nfc.usda.gov
• Click on Certification Authority Initiative
• Contact Customer Service at
• customer.support_at_usda.gov
• 504-255-5230