USPS digital signature annoucement

[Stanton McCandlish <mech@eff.org>]

[This is just an informational forward, and does not represent official EFF
positions or statements in any way.]

Forwarded message:
Date: Thu, 4 Aug 1994 10:46:48 -0400
From: cmerri01@reach.com (Charles Merrill -- McCarter ^ English - Newark )
Subject: USPS Elec Comm Serv

Quebec City, Canada, August 3, 1994--The U.S. Postal Service has
dramatically increased its commitment to the security of
communications on the NII, with the announcement of Postal
Electronic Commerce Services ("Postal ECS"), which will offer a
nationwide public key certification service for the authentication
of digital signatures used in paperless electronic commerce.  

Richard Rothwell, Senior Director of Technology Integration for the
USPS, officially released the news today in Quebec City, in a paper
delivered to an international working group of the Information
Security Committee of the American Bar Association's Section of
Science and Technology, which has been developing guidelines for
public key certification authorities.

"Our initial implementation is based on the Digital Signature
Standard (DSS) Algorithm set; but our plan is to support other
cryptographic options such as RSA in the near future," Rothwell
said.

Public key digital signatures serve to authenticate the originator
of a digital communication, validate the integrity of the message,
fix the time and date of the message, and prevent the sender from
subsequently repudiating the communication - all features which are
critical to increasing trust in electronic commerce.

The full text of the USPS announcement on Postal ECS follows, which
may be duplicated and disseminated widely, so long as the entire
text is included.    


   Address to Information Security Committee, EDI/IT Division
American Bar Association Section of Science and Technology
               Quebec City, Canada, August 3, 1994


GOOD AFTERNOON

MY NAME IS RICHARD ROTHWELL.  I AM SENIOR DIRECTOR OF TECHNOLOGY
INTEGRATION FOR THE UNITED STATES POSTAL SERVICE.

I DOUBT THERE ARE MANY GROUPS MORE AWARE OF THE SWEEPING CHANGES
TAKING PLACE IN COMMUNICATIONS THAN THIS ONE, OR HOW THOSE
CHANGES AFFECT THE WAY THAT ALL OF US WILL DO BUSINESS IN THE
FUTURE.  TODAY I WANT TO SHARE WITH YOU MY THOUGHTS ON THE ROLE
OF THE POSTAL SERVICE IN THIS NEW AGE, AND PARTICULARLY, THE ROLE
THAT WE ARE BEING ASKED TO ASSUME IN HELPING TO FACILITATE THE
EMERGING WORLD OF ELECTRONIC COMMERCE.

THE POSTAL SERVICE WAS ESTABLISHED, AT THE BIRTH OF THE UNITED
STATES, WITH THE MISSION OF BINDING TOGETHER A DIVERSE AND FAR-
FLUNG NATION THROUGH THE CORRESPONDENCE OF THE PEOPLE.  IT WAS,
AND IS, A BROAD-BASED MISSION.  OVER A CENTURY AGO, THEN ACTING
ATTORNEY GENERAL WILLIAM HOWARD TAFT WROTE THAT "THE MAKERS OF
THE CONSTITUTION ... HAD IN MIND THE COMPREHENSIVE VIEW WHICH
REGARDED POST OFFICES ... AS INSTRUMENTS FOR THE TRANSMISSION OF
INTELLIGENCE,"  A MISSION THEY EXPRESSED "IN VERY COMPREHENSIVE
TERMS..."   TODAY WE ARE BEING ASKED BY OUR CUSTOMERS TO CONSIDER
NEW WAYS OF CARRYING OUT THIS MISSION.  TODAY WE LIVE IN A
COMPLEX, COST CONSCIOUS, INTERDEPENDENT SOCIETY WHICH IS
DEVELOPING NEW ELECTRONIC COMMUNICATION SYSTEMS AND RE-INVENTING
COMMERCIAL PRACTICES.  FOR MANY APPLICATIONS, THE NEW
EFFICIENCIES OF ELECTRONIC DATA COMMUNICATION, THE BENEFITS THAT
IT HAS PROVIDED TO ITS EARLY ADOPTERS, AND THE COMPETITIVE
PRESSURES THAT THIS EVOLUTION HAS CREATED ARE DRIVING
CORPORATIONS, GOVERNMENTS, AND INDIVIDUALS TO EXPLORE NEW WAYS OF
CONDUCTING BUSINESS, AND SERVING THEIR CUSTOMERS AND
CONSTITUENTS.

YET, AS MANY EXPERTS HAVE NOTED, INCLUDING MANY OF YOU IN THIS
ROOM, DIGITAL FILES AS A RULE ARE NEITHER AS SECURE NOR AS
RELIABLE AS THEIR PAPER COUNTERPARTS.  DIGITAL FILES ARE DESIGNED
TO BE EASILY MANIPULATED BY USERS ON DIFFERENT COMPUTERS.  THIS
IS, OF COURSE, AN ESSENTIAL ELEMENT OF THE EFFICIENCY THAT
ELECTRONIC COMMERCE CONVEYS.  BUT WITHOUT SOME METHOD OF SEALING
A DIGITAL FILE TO ESTABLISH ITS CONTENTS, AUTHOR, AND TIME OF
TRANSMITTAL, THE BENEFITS OF ELECTRONIC COMMERCE WILL INEVITABLY
BE LIMITED TO HIGHLY STRUCTURED TRANSACTIONS BETWEEN PARTIES THAT
KNOW AND TRUST ON ANOTHER.  SUCH LIMITS WILL SEVERELY CONSTRAIN
OR WIPE OUT THE BENEFITS OF ELECTRONIC DATA INTERCHANGE.   A
RECENT ARTICLE IN GOVERNMENT COMPUTER NEWS NOTED THAT THE USE OF
TRADING PARTNER AGREEMENTS TO STRUCTURE EDI AGREEMENTS COULD
REQUIRE THE SERVICES OF HUNDREDS OF LAWYERS TO NEGOTIATE, WRITE,
AND ARGUE ABOUT THE AGREEMENTS JUST FOR GOVERNMENT PROCUREMENT.
THIS IS EVIDENCE OF THE GREAT DEGREE OF TRANSACTIONAL FRICTION
THAT MUST INEVITABLY ACCOMPANY SUCH AN APPROACH. 

IF ELECTRONIC COMMERCE IS NOT GOING TO BE LIMITED TO HIGHLY
STRUCTURED TRANSACTIONS BETWEEN WELL KNOWN AND TRUSTED PARTIES,
OTHER SOLUTIONS MUST BE DEVELOPED TO CREATE AN EFFECTIVE LEGAL
FRAMEWORK AND ELECTRONIC INFRASTRUCTURE.  ELECTRONIC
COMMUNICATION MEDIA CANNOT BECOME A RELIABLE BASIS FOR WIDESPREAD
BUSINESS USE WITHOUT A TRUSTED METHOD OF SEALING DIGITAL
CONTENTS, VERIFYING THE PARTIES INVOLVED, AND ESTABLISHING AN
OFFICIAL DATE AND TIME FOR THE TRANSACTION.  

GOVERNMENT HAS SIMILAR NEEDS.  TRUST AND SECURITY ARE ESSENTIAL
TO THE SUCCESS OF THE NATIONAL INFORMATION INFRASTRUCTURE, THE
REFORM OF GOVERNMENT PERFORMANCE, AND A NUMBER OF OTHER CRITICAL
FUNCTIONS, SUCH AS THE IMPLEMENTATION OF HEALTH CARE REFORM.
PERSONAL, EDUCATIONAL, LITERARY, AND BUSINESS CORRESPONDENCE
TRAVELING ON THE INFORMATION SUPERHIGHWAY MUST BE ELECTRONICALLY
GUARDED SO THAT ALL CITIZENS ARE REASONABLY ASSURED OF THE
INTEGRITY OF THEIR RECORDS.  THE TIMELY DELIVERY OF IMPORTANT
ELECTRONIC INFORMATION, AND THE IDENTITY AND AUTHORITY OF THE
PEOPLE WITH WHOM THEY COMMUNICATE ARE EQUALLY IMPORTANT.  WITHOUT
TRUST AND SECURITY, ALL OF THE SUPERCOMPUTERS AND ALL OF THE
HIGH-SPEED NETWORKS IN THE WORLD CANNOT MAKE THE N.I.I. SUCCEED
ON THE BROAD FUNCTIONAL BASIS FOR WHICH IT WAS CONCEIVED.  

AS ONE OF THE NATION'S LARGEST ORGANIZATIONS, THE UNITED STATES
POSTAL SERVICE SHARES MANY OF THE CONCERNS OF BOTH BUSINESS AND
GOVERNMENT.  THE POSTAL SERVICE MUST MANAGE TRANSACTIONS WITH
THOUSANDS OF ORGANIZATIONS ON A DAILY BASIS IN THE PROCESS OF
ANNUALLY DOING $49 BILLION OF BUSINESS MOVING 171 BILLION PIECES
OF MAIL.  BUT OUR CONCERNS ARE NO DIFFERENT FROM THOSE OF ANY
LARGE ENTERPRISE IN THE WORLD TODAY TRYING TO MAKE ITS OPERATIONS
MORE EFFICIENT.

THERE ARE NOT LIKELY TO BE MANY IN THIS ROOM WHO DO NOT BELIEVE
IN THE NEED FOR A MECHANISM FOR ESTABLISHING THE RELIABILITY OF
AN ELECTRONIC TRANSMISSION, AND BINDING AN INDIVIDUAL TO IT. I
THEREFORE DO NOT BELIEVE THAT IT WILL BE NECESSARY TO CONDUCT A
DETAILED EXPLORATION OF THE ADVANTAGES OF BUILDING A PUBLIC KEY
INFRASTRUCTURE AS A SOLUTION TO THE TECHNICAL PROBLEMS OF
PROVIDING SECURITY FOR ELECTRONIC DOCUMENTS.  WHAT I WILL TALK TO
YOU ABOUT IS THE ROLE THE POSTAL SERVICE CAN PLAY IN PROVIDING
THESE TECHNICAL SOLUTIONS WHERE THEY ARE NEEDED.    

THERE ARE SEVERAL REASONS WHY THE POSTAL SERVICE IS DEVELOPING
PLATFORMS FOR PROVIDING SOLUTIONS TO THESE PROBLEMS.  FIRST, OUR
GENERAL DUTY TO "BIND THE NATION TOGETHER THROUGH THE PERSONAL,
EDUCATIONAL, LITERARY, AND BUSINESS CORRESPONDENCE OF THE PEOPLE"
HAS TAKEN ON NEW MEANING NOW THAT A HYBRID INFORMATION HIGHWAY,
PART PAPER AND PART ELECTRONIC, HAS BECOME A REALITY AND WILL
CONTINUE TO BE FOR AT LEAST THE NEXT DECADE.  SECOND, NOT
SURPRISINGLY, OUR CUSTOMERS ARE ASKING US TO PLAY AN EXPANDED
ROLE IN FACILITATING PAPER AND ELECTRONIC COMMERCE BECAUSE WE
HAVE UNIQUE LEGAL AND INSTITUTIONAL RESOURCES TO ACCOMPLISH THE
TASK.  AND THIRD, WE HAVE TO DEVELOP ELECTRONIC SERVICES TO MEET
OUR CUSTOMERS' NEEDS FOR FASTER, MORE EFFICIENT HANDLING OF THEIR
PRODUCTS. 

A CORE FUNCTION OF THE POSTAL SERVICE WILL REMAIN THE
TRANSMISSION OF HARD COPY MESSAGES TO AND FROM RESIDENCES AND
BUSINESSES IN AMERICA.  AS I'VE NOTED, THAT FUNCTION FLOWS OUT OF
OUR CORE MISSION TO BIND THE NATION TOGETHER.  THE POSTAL SERVICE
HAS OTHER MISSIONS AS WELL.  WE ARE TASKED TO PROVIDE SERVICE ON
A UNIVERSAL BASIS TO PATRONS IN ALL AREAS AND TO ALL COMMUNITIES.
WE ARE REQUIRED TO USE EVERY EFFORT TO PROVIDE EFFICIENT AND
EXPEDITIOUS DELIVERY OF CORRESPONDENCE.  WE ARE CHARGED WITH
PROTECTING THE PRIVACY OF POSTAL CUSTOMERS AND MAY NOT MAKE
AVAILABLE TO THE PUBLIC BY ANY MEANS OR FOR ANY PURPOSE ANY
MAILING OR OTHER LIST OF NAMES OR ADDRESSES, PAST OR PRESENT, OF
POSTAL PATRONS OR OTHER PERSONS.  AND WE ARE CHARGED WITH
MAINTAINING THE SECURITY AND INTEGRITY OF THE MAILS, AND
INVESTIGATING POSTAL OFFENSES AND CIVIL MATTERS RELATING TO THE
POSTAL SERVICE.   

AS A CONSEQUENCE OF THESE MISSIONS, THE POSTAL SERVICE HAS AT
LEAST THREE ASSETS WHICH MAKE US A LIKELY CANDIDATE TO PLAY A
ROLE IN THIS EMERGING FIELD.  FIRST, THE POSTAL SERVICE ALREADY
HAS MUCH OF THE LEGAL AND INSTITUTIONAL INFRASTRUCTURE NECESSARY
TO ASSIST IN THE DEVELOPMENT OF WIDESPREAD ELECTRONIC COMMERCE.
SECOND, OUR SIZE AND WIDELY DISTRIBUTED RESOURCES GIVE US THE
PRACTICAL TOOLS TO PROVIDE A MUCH-NEEDED SERVICE ON A UNIVERSAL
BASIS.  THIRD, WE ARE UNIQUELY SITUATED TO PROTECT CORE VALUES
SUCH AS SECURITY AND INDIVIDUAL PRIVACY AS WELL AS UNIVERSAL
ACCESS TO THE TOOLS OF ELECTRONIC COMMERCE.

LET ME DISCUSS THESE ONE AT A TIME. 

FIRST, THE POSTAL SERVICE HAS THE LEGAL STRUCTURE TO PERFORM THE
DUTIES OF MANAGING A CERTIFICATE AUTHORITY.  THE POST OFFICE WAS
ORIGINALLY ESTABLISHED BY THE CONTINENTAL CONGRESS AS THE UNITED
STATE'S FIRST INFORMATION HIGHWAY.  FOR OVER TWO HUNDRED YEARS, A
SOPHISTICATED REGIME OF STATUTES, REGULATIONS, AND POLICIES HAS
DEVELOPED TO PROVIDE THE INFRASTRUCTURE WHICH ENABLES SECURE,
EFFICIENT, AND INEXPENSIVE TRANSMISSION OF PAPER COMMUNICATIONS.
FOR 200 YEARS, THE UNITED STATES POSTAL SERVICE HAS CERTIFIED
MAIL, SEALED IT WITH THE POWER AND AUTHORITY OF LAW, PROVIDED
RESPONSIBLE AND TIMELY MAIL DELIVERY, AND INSURED PATRONS AGAINST
LOSS OR THEFT.  A RELIABLE AND TRUSTED MAIL SYSTEM REMARKABLY
FREE OF CORRUPTION OR ABUSE HAS ACCOMPANIED THE DEVELOPMENT OF A
SYSTEM OF COMMERCE IN THE UNITED STATES WHICH IS SECOND TO NONE
IN THE WORLD.

FOR HARDCOPY COMMUNICATIONS, THE LEGAL FRAMEWORK IS ALREADY IN
PLACE TO HANDLE ISSUES SUCH AS LIABILITY, INDEMNITY,
CONFIDENTIALITY, FRAUDULENT USE, THEFT, DEFINITE DATING, ETC.  A
SIMILAR FRAMEWORK WILL BE REQUIRED TO SUPPORT ELECTRONIC
COMMERCE.  CUSTOMERS HAVE SUGGESTED THAT THE POSTAL SERVICE MAY
BE IN A UNIQUE POSITION TO PROVIDE PART OF THAT STRUCTURE.  FOR
EXAMPLE, SOME CUSTOMERS HAVE SUGGESTED THAT THEY ARE CONCERNED
WITH THEIR OWN CAPACITY TO HANDLE LIABILITY ISSUES, AND THAT THE
POSTAL SERVICE PROVIDES A READY-MADE SOLUTION TO THIS PROBLEM.
OTHERS HAVE EXPRESSED CONCERN ABOUT THE CONFIDENTIALITY PROBLEMS
INHERENT IN DEALING WITH OTHER COMPANIES, WHILE STILL OTHERS HAVE
ASKED FOR A REGIME FOR CONTROLLING FRAUD WHICH IS AS STRONG AND
CONVENIENT AS THAT IN PLACE FOR MAIL FRAUD.  THUS, THE STRONG
LEGAL FRAMEWORK ESTABLISHED FOR HANDLING PAPER COMMUNICATIONS CAN
PROVIDE SIMILAR BENEFITS FOR ELECTRONIC COMMERCE.  

SECOND, OUR CUSTOMERS ARE ASKING FOR OUR ASSISTANCE IN THIS AREA
BECAUSE WE HAVE UNIQUE PRACTICAL ASSETS, INCLUDING:

         THE 40,000 RETAIL FACILITIES DISTRIBUTED NATIONWIDE
         UNIVERSAL PRESENCE AND THE CAPACITY TO ACHIEVE
          SIGNIFICANT SCALE
         THE RESOURCES OF AN EXISTING NATIONAL INFORMATION
          INFRASTRUCTURE
         A VERY STRONG VERIFICATION PROCESS CURRENTLY USED FOR
          PASSPORTS, THAT INVOLVES PROOF OF ID AND OTHER
          INFORMATION TO A FEDERAL EMPLOYEE.
         THE EXPERIENCE, POLICIES, AND ABILITY TO ARCHIVE
          RECORDS WITHOUT RISK THAT THEY WOULD BE USED FOR
          COLLATERAL COMMERCIAL PURPOSES.

THE POSTAL SERVICE IS ALSO A REMARKABLY LONG-LIVED ORGANIZATION,
AND THOSE OF YOU WHO HAVE STRUGGLED WITH ARCHIVING POLICIES WILL
RECOGNIZE THAT TO BE AN IMPORTANT ADVANTAGE.  AS BOB JUENEMAN HAS
SAID ON THE INTERNET, "CERTIFICATES 'R US" MAY BE GONE TOMORROW.
IF YOU HAVE TO PROVE THAT A CERTIFICATE WAS REGISTERED ON A
CERTAIN DATE, AND YOU ARE SEEKING AN APPROPRIATE ARCHIVING
FACILITY, YOU CAN HAVE CONFIDENCE THE POSTAL SERVICE WILL STILL
BE AROUND TO SUPPORT YOUR REQUEST.

A THIRD STRENGTH THE POSTAL SERVICE BRINGS TO ENABLING ELECTRONIC
COMMERCE, AND ANOTHER REASON THAT OUR CUSTOMERS HAVE ASKED FOR
HELP, IS OUR CAPACITY TO CREATE CERTIFICATE MANAGEMENT SYSTEMS
THAT CAN REACH VIRTUALLY EVERY COMMUNITY IN AMERICA, BECAUSE WE
ALREADY HAVE A SUBSTANTIAL PRESENCE IN THOSE COMMUNITIES.  WE CAN
THEREFORE PROVIDE A SOLUTION TO THE QUESTION OF HOW TO PUT THE
TOOLS OF ELECTRONIC COMMERCE, SUCH AS CERTIFICATES, INTO THE
HANDS OF EVERYONE.  THERE ARE MANY OBSTACLES TO PREVENT CITIZENS
FROM TAKING ADVANTAGE OF THE BENEFITS OF ELECTRONIC COMMERCE.
CURRENTLY THERE ARE TECHNOLOGICAL, GEOGRAPHIC, ECONOMIC, AND
KNOWLEDGE BARRIERS WHICH PREVENT PEOPLE FROM PARTICIPATING IN THE
BENEFITS OF ELECTRONIC COMMERCE.  TO PROVIDE UNIVERSAL SERVICE TO
ELECTRONIC COMMERCE WE MUST PROVIDE ACCESS WHICH IS UNIVERSALLY
USABLE AND UBIQUITOUS AND SCALABLE.  BY PROVIDING A SOLUTION TO
SOME OF THESE ACCESS PROBLEMS, THE POSTAL SERVICE MAY HAVE AN
IMPORTANT ROLE TO PLAY IN ENSURING THAT FUTURE COMMUNICATIONS IN
AMERICA PROVIDE A CONTINUING FRAMEWORK FOR SUSTAINING A
DEMOCRATIC, PARTICIPATORY SOCIETY. 

THUS, MANY OF THE INSTITUTIONAL FEATURES NEEDED BY AN ENTITY
WISHING TO TAKE PART IN CERTIFICATE ISSUANCE AND MANAGEMENT
ALREADY EXIST IN THE UNITED STATES POSTAL SERVICE.  THE POSTAL
SERVICE WAS ESTABLISHED TO PROVIDE VERY SIMILAR SERVICES FOR THE
SUPPORT OF CORRESPONDENCE WHEN THE PHYSICAL FRONTIER WAS CHAOTIC
AND HARD TO REACH.  IT IS READY TO PROVIDE SIMILAR SERVICES ON
THE ELECTRONIC FRONTIER.

AS THE POSTMASTER GENERAL HAS INFORMED CONGRESS, WE ARE ACTIVELY
SUPPORTING THE DEVELOPMENT OF THE N.I.I. TO FACILITATE THE
DEVELOPMENT OF OUR OWN BUSINESS AND TO HELP US CARRY OUT OUR
MISSION.  ON MARCH 24, THE POSTMASTER GENERAL TESTIFIED BEFORE
THE SENATE AFFAIRS COMMITTEE THAT "WORKING WITH OTHER FEDERAL
AGENCIES, WE MAY BE ABLE TO DEVELOP AN ELECTRONIC COMMERCE
SYSTEM."  HE ALSO NOTED THAT, THROUGH THE DEVELOPMENT OF A KIOSK
PROGRAM THAT MIGHT CARRY OUT POSTAL TRANSACTIONS AND PERHAPS ALSO
DISSEMINATE INFORMATION FROM OTHER AGENCIES, OUR POSTAL LOBBIES
COULD BECOME "ON-RAMPS" TO THE ELECTRONIC SUPER HIGHWAY. 
THE POSTMASTER GENERAL HIGHLIGHTED TWO IMPORTANT AREAS IN WHICH
THE POSTAL SERVICE MAY BE HELPFUL: SERVING THE REQUIREMENTS OF
OTHER GOVERNMENT AGENCIES, AND PROVIDING UNIVERSAL SERVICE TO
THOSE CITIZENS WHO ARE IN DANGER OF BEING LEFT OUT OF THE
INFORMATION REVOLUTION.  TO THESE HE MIGHT HAVE ADDED A THIRD,
EQUALLY IMPORTANT AREA:  PROTECTING THE PRIVACY OF AMERICAN
CITIZENS.  THIS CONCERN IS DEEPLY EMBEDDED IN POSTAL TRADITION
AND STATUTE.  WHEN WE SPEAK OF THE SECURITY OF ELECTRONIC
COMMERCE WE SHOULD NOT MISS THE WAY IN WHICH COMMERCIAL SECURITY
AND INDIVIDUAL PRIVACY ARE INTERCONNECTED CONCEPTS. 

WHILE IT IS TOO EARLY TO KNOW WHAT PRECISELY LIES AHEAD, LET ME
SHARE WITH YOU A GENERAL DESCRIPTION OF THE SYSTEMS WE ARE
DEVELOPING, BOTH FOR OUR OWN USE AND FOR THAT OF OUR CUSTOMERS.

THE POSTAL SERVICE IS USING PUBLIC KEY ENCRYPTION TECHNOLOGY, AND
RELATED TECHNOLOGIES, TO DEVELOP A PUBLIC KEY CERTIFICATION
AUTHORITY AND A SET OF ASSOCIATED TRUSTED THIRD PARTY SERVICES
WHICH WE CALL POSTAL ELECTRONIC COMMERCE SERVICES (POSTAL ECS).
WHEN INITIALLY DEPLOYED, POSTAL ECS WILL PROVIDE A BASIS FOR
ELECTRONIC ASSURANCES WITHIN AND AMONG GOVERNMENT AGENCIES, AND
BETWEEN GOVERNMENT AGENCIES AND THEIR CONSTITUENTS.  IN
PARTICULAR, THE POSTAL SERVICE HAS DEVELOPED THE ABILITY TO:
    
         ISSUE PUBLIC KEY CERTIFICATES AND STORE THEM IN A
          PUBLIC DIRECTORY;
         PROVIDE FOR THE "SEALING" OF SELECTED DOCUMENTS OR
          OTHER ELECTRONIC OBJECTS AND ASSOCIATING THEM WITH A
          DIGITAL SIGNATURE AND A TRUSTED TIME AND DATE STAMP;
         PROVIDE SERVICES FOR PUBLIC KEY CERTIFICATE PUBLICATION
          AND REVOCATION; AND,
         PROVIDE THE ABILITY TO ENCRYPT CONFIDENTIAL INFORMATION
          MOVING BETWEEN THE USER ENVIRONMENT AND THE POSTAL ECS
          MANAGEMENT SYSTEM.
         FINALLY, PROVIDE NEAR REAL-TIME ACCESS TO CERTIFICATES
          AND THEIR STATUS.
    
THE CERTIFICATION AUTHORITY WILL ISSUE AND MANAGE X.509 PUBLIC
KEY CERTIFICATES CONTAINING A PERSON'S X.500 DISTINGUISHED NAME,
PUBLIC KEY, AND OTHER IDENTIFYING INFORMATION.  USERS CAN THEN
RETRIEVE A CERTIFICATE FROM THE POSTAL SERVICE, AND USE ITS
PUBLIC KEY TO AUTHENTICATE A DIGITAL SIGNATURE GENERATED BY THE
COMPLEMENTARY PRIVATE KEY. 

THE CORRESPONDENCE SERVICE PROVIDED BY THE SYSTEM IS THE POSTAL
ECS SEAL WHICH PROVIDES USERS WITH A VALIDATION OF THE ORIGINATOR
BASED ON HIS OR HER DIGITAL SIGNATURE.  WE ALSO PROVIDE A POSTAL
SERVICE DIGITAL SIGNATURE ON THE DIGEST OF AN ELECTRONIC OBJECT
THAT ASSURES THAT IT CANNOT BE CHANGED WITHOUT DETECTION.  WE
ALSO PROVIDE THE POSTAL SERVICE DIGITAL SIGNATURE ON A DATE AND
TIME STAMP THAT WE SUPPLY TO ENABLE PROOF OF EXISTENCE AT A POINT
IN TIME AND WE PROVIDE ARCHIVING FOR THOSE DATE AND TIME STAMPS.
FINALLY, WE PROVIDE NEAR REAL-TIME ACCESS TO CERTIFICATES AND
THEIR STATUS.  THIS ALLOWS A USER TO GET UP-TO-DATE INFORMATION
ON THE VALIDITY OF CERTIFICATES, AND REMOVES THE NEED FOR USERS
TO MAINTAIN THEIR OWN CERTIFICATE REVOCATION LISTS.

THE POSTAL SERVICE HAS IMPLEMENTED THE CERTIFICATE AUTHORITY
SERVICES, THE CORRESPONDENCE SERVICES AND THE SUPPORTING
DIRECTORY ON A HOST COMPUTER SYSTEM IN ONE OF OUR MAJOR
PRODUCTION DATA CENTERS.  WE HAVE ALSO DEVELOPED THREE POSTAL
SERVICE-LICENSED USER AGENTS AS REFERENCE MODELS TO BE INSTALLED
ON END USER WORKSTATIONS THAT WILL PROVIDE ACCESS TO POSTAL ECS
SERVICES.  THEY RUN ON MICROSOFT WINDOWS-BASED PC~S AND ACCESS
POSTAL ECS SERVICES VIA E-MAIL (EITHER INTERNET OR X.400).  WE
ARE ALSO WORKING ON AN INTERACTIVE DIAL-UP COMMUNICATION
ALTERNATIVE AND EXPECT THIS TO BE AVAILABLE SHORTLY.

THESE USER AGENTS CONTAIN STANDARD PROGRAMMING INTERFACES THAT
LINK USER APPLICATIONS, CRYPTOGRAPHIC ROUTINES, AND ECS SERVICES
TOGETHER.  OUR INITIAL IMPLEMENTATION IS BASED ON THE DIGITAL
SIGNATURE STANDARD (DSS) ALGORITHM SET; BUT OUR PLAN IS TO
SUPPORT OTHER CRYPTOGRAPHIC OPTIONS SUCH AS RSA IN THE NEAR
FUTURE.

WE ARE NOW MOVING FROM DEVELOPMENTAL WORK TO ACTUAL PROOF OF
CONCEPT PILOT TESTING OF THESE SERVICES BOTH INTERNALLY IN THE
USPS AND WITH OUR GOVERNMENT AGENCY PARTNERS.  OUR PLANS WILL
EVOLVE AS WE GAIN EXPERIENCE FROM THESE INITIAL PILOT TESTS AND
CONTINUE TO TALK WITH CUSTOMERS, AND EXPERTS IN ENCRYPTION,
SOFTWARE DEVELOPMENT, AND COMPUTER SCIENCE.  WE HAVE SHARED OUR
PLANS WITH CONGRESS, THE ADMINISTRATION, AND THE MEDIA.  AND WE
HAVE ASKED OURSELVES THREE KEY QUESTIONS:
         IS THIS INITIATIVE CRITICAL TO OUR MISSION AND OUR
          RESPONSIBILITY TO THE PUBLIC?
         DO OUR CUSTOMERS HAVE A NEED FOR OUR PARTICIPATION?
          AND,
         WOULD THE COSTS OF PROVIDING THESE SERVICES BE BALANCED
          BY POTENTIAL REVENUES?

CERTAINLY THE RESPONSES THAT WE HAVE RECEIVED TO DATE MORE THAN
JUSTIFIES OUR VIEW THAT THIS IS AN AREA IN WHICH WE SHOULD
CONTINUE TO BE AN ACTIVE PARTICIPANT.

BEFORE CONCLUDING, LET ME DIRECTLY ADDRESS A CONTROVERSIAL
PHILOSOPHICAL DISCUSSION ABOUT CERTIFICATE MANAGEMENT SO YOU CAN
UNDERSTAND WHAT WE SEE AS THE FUTURE WORLD OF ELECTRONIC
COMMERCE.  THERE HAS BEEN A GREAT DEAL OF DEBATE ABOUT THE
RELATIVE ADVANTAGES OF HIERARCHIAL VERSUS PEER-TO-PEER OR ONE-
LEVEL MODELS FOR MANAGEMENT OF DIGITAL SIGNATURE.  TO SOME
EXTENT, I BELIEVE THIS DEBATE MISSES THE POINT.  THE SYSTEM FOR
MANAGING X.500 CERTIFICATES THAT WILL EVENTUALLY BE ADOPTED WILL
BE ADOPTED ONLY BECAUSE IT MEETS THE BUSINESS NEEDS OF THE USERS.
BECAUSE THE COMPLEX COMMUNICATION NEEDS OF THE FUTURE WILL
REQUIRE FLEXIBILITY TO MEET INDIVIDUAL DESIRES, SOME MIX OF
HIERARCHIAL AND PEER-TO-PEER OR FLAT MANAGEMENT SCHEMES WILL BE
ADOPTED.

WHAT THE RECIPIENT OF AN ELECTRONIC DOCUMENT SIGNED WITH A
DIGITAL SIGNATURE NEEDS TO KNOW IS HOW MUCH WEIGHT TO GIVE THAT
SIGNATURE -- OR, IN OTHER WORDS, WHAT ACTIONS TO TAKE BASED ON AN
EVALUATION OF THE SENDER.  THIS IS EXACTLY THE SAME THING THAT IS
DECIDED EVERY DAY BY PEOPLE -- SHOULD WE SELL SECURITIES TO A
VOICE OVER THE PHONE?  SHOULD WE PLACE AN ORDER WITH A NEW
SALESMAN?  GIVEN THE INFINITE VARIETY OF POSSIBLE TRANSACTIONS
AND ENCOUNTERS, THERE IS NO POINT IN TRYING TO IMPOSE ON
ELECTRONIC TRANSACTIONS A SINGLE PARADIGM FOR AUTHENTICATION.
DIFFERENT LEVELS OF ASSURANCE, AND DIFFERENT ARCHITECTURES, WILL
BE NECESSARY FOR DIFFERENT USES.  WHAT IS IMPORTANT IS THAT THE
PARTIES TO THE TRANSACTION ARE AWARE OF THE LEVEL OF ASSURANCE
PROVIDED. 

THE POSTAL SERVICE CAN BE OF ASSISTANCE IN FILLING SOME SPECIFIC
NEEDS IN THE CERTIFICATE ARENA, BUT IT HAS NO INTENTION OF
CONTROLLING OR DOMINATING THAT ARENA.  FOR THE NEAR FUTURE THE
UNIVERSE OF ELECTRONIC COMMERCE WILL CONTINUE TO HAVE MANY
DIFFERENT GALAXIES.  MANY VARYING CONCEPTS AND SERVICES WILL BE
ABLE TO MAKE VALUABLE CONTRIBUTIONS.  MANY OTHER ENTITIES WILL
PROVIDE SERVICES IN THIS AREA: AS VICE PRESIDENT GORE HAS NOTED
IN NUMEROUS SPEECHES, THERE IS A ROLE FOR BOTH PRIVATE AND PUBLIC
ENTITIES.  WE PLAN TO PROVIDE SERVICES BASED UPON IDENTIFIED
NEEDS, WHICH CUSTOMERS WILL DECIDE WHETHER OR NOT THEY WILL USE.

IN KEEPING WITH THE PHILOSOPHY I HAVE ARTICULATED, LET ME SAY
THAT THE POSTAL SERVICE, IN ANY DEVELOPMENT OF THESE PRODUCTS,
INTENDS TO SUPPORT MULTIPLE CRYPTOGRAPHIC PRODUCTS IN THE MARKET
PLACE.  IN ADDITION, WE WILL NOT COMPETE WITH NETWORK SERVICE
PROVIDERS, NOR WILL WE BECOME A NETWORK OR CARRIER.

IN DEVELOPING THESE SERVICES, WE ARE KEENLY INTERESTED IN THE
WORK OF THIS GROUP.  WHILE THE TECHNOLOGY AND SCALE ISSUES SEEM
TO US TO BE MANAGEABLE, WE RECOGNIZE THAT THERE ARE STILL MANY
LEGAL QUESTIONS CONCERNING THE WAY IN WHICH THE DESIGN OF A
PUBLIC KEY INFRASTRUCTURE MANAGEMENT SERVICE MIGHT BEST WORK.
THE LIABILITY ISSUES ARE NOT YET COMPLETELY CLEAR, AND THE DUTIES
OF EACH ENTITY IN SUCH AN INFRASTRUCTURE NEED TO BE ARTICULATED.
AS CUSTOMERS SEEK OUR SERVICES, WE WILL HAVE TO FACE QUESTIONS OF
SCALABILITY, INVESTMENT, AND THE REGULATORY ISSUES ASSOCIATED
WITH THE INTRODUCTION OF A NEW SERVICE.  CAN THE SERVICE BE
MANAGED?  WHAT INVESTMENT WILL BE REQUIRED?  HOW WILL REGULATORS
HAVE US PRESENT THE SERVICE TO THE PUBLIC AND AT WHAT PRICE?

WE GREATLY APPRECIATE THE EXCHANGE OF VIEWS THAT THIS FORUM MAKES
POSSIBLE.  WE ALL HAVE MUCH TO LEARN IN THIS AREA, AND I BELIEVE
WE SHOULD WELCOME THE FACT THAT WE LIVE IN SUCH INTERESTING
TIMES. 

[end]



-- 
<A HREF="http://www.eff.org/~mech/mech.html">       Stanton McCandlish
</A><HR><A HREF="mailto:mech@eff.org">              mech@eff.org
</A><P><A HREF="http://www.eff.org/">               Electronic Frontier Fndtn.
</A><P><A HREF="http://www.eff.org/~mech/a.html">   Online Activist       </A>