INFORMATION TECHNOLOGY SECURITY

Government of Canada

Public Key Infrastructure

The Government of Canada PKI will allow the federal government to:

-	provide more efficient delivery of services to Canadians;

-	provide electronic commerce and confidentiality services to public servants; and

-	better protect privacy of information used in Government business.

Background

Cryptography is the discipline that treats the principles, means, and methods for making plain information unintelligible and reconverting the unintelligible information back into an intelligible form. Cryptography has been around for hundreds of years but awareness of it has taken off with the wide use of the computer and open networks (e.g., INTERNET). Faster and more complex computers and communications systems have pushed the use and development of new cryptographic systems, which rely on the use of Public Key Cryptography.

What is Public Key Cryptography?

Conventional cryptography consists of a single mathematical key used for both encryption and decryption of data. If you want to send a secure message to an addressee, you encrypt the message using a key known only to the sender and the recipient and then you pass both the key and encrypted message to the recipient so that the message can only be decrypted by the intended recipient.

Public Key Cryptography uses two keys. One key is kept private and the other key is made public. If the Public Key is used to encrypt a message, the Private Key can decrypt the message. In other words, if you want to send an addressee a message, you encrypt the message with the addressee's Public Key and pass the message to the addressee. The addressee can then use the Private Key to decrypt it.

What is a Digital Signature?

With the invention of Public Key Cryptography, another process known as a digital signature is possible. A digital signature is much like a hand signature in that it provides proof that you are the originator of the message (Authentication). If you want to sign the message which you sent to an addressee, you pass the message through a mathematical function (known as a hash function) which provides a summary (hash code) of the message. This summary is unique for every message and is much like a fingerprint. You then encrypt this hash code with your Private Key and attach the code to the end of your message. This attached code is known as a digital signature. The addressee can then verify that the message was sent by you by decrypting the digital signature, using your public key, to get the hash code. The addressee then passes the received message through the same hash function. If the two hash codes are the same, then the message was sent from you (Non-repudiation) and was not altered (Integrity). All this sounds complicated but, in practice, selecting an icon on your computer screen is all that it takes to make it happen.

What is a Public Key Infrastructure?

A Public Key Infrastructure is a Cryptographic key and Certificate delivery system which makes possible secure financial electronic transactions and exchanges of sensitive information between relative strangers. A PKI will provide Privacy, Access control, Integrity, Authentication, and Non-repudiation support to information technology applications and electronic commerce transactions. A PKI will:

-	manage the generation and distribution of Public/Private Key pairs; and

-	publish the Public Keys with the user's identification as "certificates" in open bulletin boards (i.e., X.500 Directory Services).

A PKI provides a high degree of confidence that:

-	Private Keys are kept secure;

-	specific Public Keys are truly linked to specific Private Keys; and

-	the party holding a Public/Private Key pair is who the party purports to be.

How does it work?

A PKI is made up of several central systems known as Certification Authorities (CA). These CAs are logically set up in a tree-like hierarchial structure. Each user's Public Key and identifications are placed in a message (certificate). The user's CA will digitally sign each certificate and make the user's Public Key certificate available through publicly accessible bulletin boards (i.e., X.500 Directories) along with all other users' certificates. Therefore any user will be able to get any other user's Public Key from a bulletin board and verify that it is authentic by using the CA's Public Key to verify the CA's signature on the certificate. The CA at the top of the hierarchy will sign the certificates containing the Public Keys of CAs directly subordinate to it and these CAs will sign the certificates of any other CAs below themselves and so on. This process allows Public Keys that are signed by other CAs in the infrastructure to be verified, since a chain of trust has been set up between CAs in the infrastructure.

Where does the Government of Canada PKI fit in?

Provision of secure information and communication systems based on cryptography depends on the underlying key management system. The Government of Canada PKI will provide a uniform key management and key certification process for confidentiality and digital signatures across the government. The Policy Management Authority (PMA) is an interdepartmental committee chaired by the Treasury Board Secretariat. It will approve the policies and practices which CAs employ in issuing certificates. The Government of Canada PKI is the infrastructure that integrates other technologies (i.e., Electronic Authorization and Authentication, smart cards, etc . . . ) into a seamless solution for secure departmental information management and electronic commerce, whether internal or external to government. It is planned to be operational in late 1998.

Why do we need the Government of Canada Public Key Infrastructure?

Without security, the value of the information highway is significantly reduced. Security is a fundamental requirement for applications such as:

basic electronic commerce (e.g., purchase orders, credit card information, etc...);

private E-mail;

work flow automation using electronic forms with signatures; and

legally binding electronic contracts.

Security issues must be addressed before the information highway can begin to be used to its full potential. The Government of Canada PKI will provide solutions to the following issues:

-	Privacy - keep information confidential;

-	Access control - only allow selected recipients access to the information;

-	Integrity - assurance that the information has not been altered;

-	Authentication - proof of the originator of the information; and

-	Non-repudiation - proof that information was sent by the originator.

Who are involved in the Government of Canada PKI?

A number of departments and agencies are progressing the development of the Government of Canada's PKI and the introduction of its base technology. They include Treasury Board Secretariat, Communications Security Establishment, Royal Canadian Mounted Police, Department of Foreign Affairs and International Trade, Department of National Defence, Citizenship and Immigration Canada, Revenue Canada and Government Telecommunications and Informatics Services. The system is being delivered by Nortel Secure Networks.

How can you benefit?

Clients across government can benefit from working with CSE in the introduction of computerized services and the sharing of common computerized services across government:

departments with immediate requirements can join the strategic partnership which is funding	the Government of Canada PKI project;

departments with less immediate requirements can ensure that new systems with potential application across government can in the future be served by the Government of Canada PKI; and

departments which do not want to operate their own CA can arrange for such services to be	provided by the GTIS certification authority service (Secure Applications and Key
Management).

Require more information?

Clients who require more information on how the Government of Canada PKI can satisfy the unique needs of their department, can contact one of the following numbers:

CSE PKI Project Office: (613) 991-7542

CSE ITS Client Services: (613) 991-7678

GTIS Secure Applications and Key Management Service: (819) 956-4444