Digital certificates could become standard in IDs

SAN FRANCISCO'Federal mandates for issuing interoperable electronic IDs to employees and contractors soon could spur the adoption of digital certificates and the use of public-key infrastructure (PKI) throughout the country, one industry observer predicts.

Some states have begun issuing IDs compatible with federal Personal Identity Verification (PIV) cards to emergency personnel, and one state has cross certified with the federal PKI bridge for authenticating digital certificates. Peter Bello, senior vice president of federal sales for Entrust Inc. of Addison, Texas, predicted that states soon will begin including digital certificates in IDs issued to citizens that would be interoperable with state and federal systems and also could be used to access commercial services.

'Having citizens access government applications is the next big thing,' Bello said, and the states are the logical entities to enable the process. The federal government has decided it will not be in the business of issuing digital certificates to the populace, and 'the states have always been the issues of identity credentials.'

Bello and Entrust were at this week's RSA Security conference, updating other industry observers and government users on developments in the field of electronic authentication.

Bello predicted that the certificates could begin appearing in driver's licenses in the next 12 to 24 months as states begin retooling their licenses to comply with the federal Real ID mandate. 'Maybe I'm being too optimistic, but I think it's just a matter of time,' he said.

He has reason to be optimistic: Entrust already is one of the leading providers of digital certificates to government, and expanded use of the certificates for access to online resources could open up a large new market for issuing and managing them.

A digital certificate is an electronic ID, a bit of code that can be stored on a smart card or other token, or kept on a computer. It contains a digital signature from the issuing authority that can be used to verify the certificate's authenticity. It also can include a private cryptographic key that can be used to encrypt and digitally sign documents and other information.

Government uses the certificates in the Defense Department's Common Access Card (CAC) and its civilian counterpart, the PIV card. The job of issuing, verifying and managing the certificates often is done by a third-party certificate authority.

Several agencies, including the Treasury Department and the General Printing Office (GPO), provide certificate authority services to other federal agencies as shared service providers. Entrust is a commercial shared service provider, which has the advantage of also being able to sell into the non-federal market. Agencies such as Treasury and GPO cannot provider services to non-federal customers, so when states, contractors, research institutions and other outsiders need federally approved credentials to interact with feds, they go to Entrust.

DOD has issued millions of CAC cards and, as the PIV card program begins picking up, tens of thousands of certificates have been issued to civilian workers and contractors. But the non-federal market offers a huge opportunity for certificate authorities.

'We're seeing a lot of uptake from state and local governments on the First Responder Access Card [FRAC]' an ID that contains digital certificates compatible with federal cards, Bello added.

Illinois, a leader in the use of digital certificates at the state and local levels, is issuing the FRAC, and a number of other states, including Tennessee, New York and Alaska are thinking about it.

Illinois also is the first state to be cross certified with the federal PKI bridge, an information sharing system that enables one entity to allow the use of certificates issued by another entity to access its resources. The use of identity bridges establishes trust relationships so that one organization can accept digital certificates for strong authentication without having to issue and manage all of the certificates itself.

Trust bridges so far are in the early stages of development. The aerospace and pharmaceutical industries have established their own bridges, which have been cross certified with the federal bridge. Bello said the next logical step is for more states to establish their own identity bridges which could cross certify with the federal bridge. Local government and private organizations could certify with the state bridges, creating a web of trust that could let citizens use digital certificates to access state, local and federal applications as well as do private transactions, such as banking.

'It will take the states some time to get there, but the sooner they do it the better,' he said.