30 April 1998

    Date: Thu, 30 Apr 1998 09:59:55 -0400
    To: "Carl M. Ellison" <cme@acm.org>
    From: "Arnold G. Reinhold" <reinhold@world.std.com>
    Subject: Re: Director of Central Intelligence on Trust
    Cc: cryptography@c2.net

    At 11:38 PM +0100 4/29/98, Carl M. Ellison wrote:
    >
    >At 13:05 -0400 4/29/98, Arnold G. Reinhold wrote:
    >>Tenet says the need now is for trust systems rather than security systems:
    >
    >He's right, in a way -- but his plans are wrong, if he thinks gov't
    >experience with key management is applicable.  After all, with the gov't,
    >all authority is delegated down a hierarchy and keys are usually generated
    >in a central place (the NSA?) and handed out to users.
    >
    >He needs to start following the SPKI WG and adding his $0.02

    I agree, that is why I posted those excerpts. Sorry the formatting got
    messed up.

    If you are interested in NSA's approach to key management (and a lot of
    other stuff) check out http://ste.xservices.com/briefings/ste_briefings.html

    This site has an extensive set of slides from a conference held in February
    on STE (Secure Terminal Equipment), the NSA's replacement for the STU-III
    secure telephone in wired environments. Some tidbits I found interesting:

    About 370,000 STU-IIIs have been shipped

    About 290,000 Fortezza cards have been delivered

    STE shipments have just begun with the Navy as the first customer (300 sets).

    STE, which requires an ISDN line or military equivalent,  can set up a
    secure call in 1.9 seconds. STU-III takes 17 seconds. Audio is high quality
    and users can set up three-way conference calls.

    STE requires a third version of Fortezza,  Fortezza plus (KOV-14), for
    classified use. On STEs, the previous Fortezza Plus (KOV-8) is rated for
    Sensitive But Unclassified use only. Original strength Fortezza cards
    cannot be used with STE.

    STE boxes are "releasable" (unlike STU-III sets).  All crypto algorithms
    are in the Fortezza KOV-14 card. These include the traditional Fortezza
    algorithms like Skipjack and SHA, plus "high grade algorithms:" BATON,
    FIREFLY, SDNS signature, STU-III.

    STE desk sets start at around $3200, KOV-14 cards are $255.

    Key management is baroque. Apparently STE incorporates the same key
    management approach as STU-III, with the Crypto Ignition Key (CIK)
    initially loaded on the KOV-14 at a central Electronic Key Management
    System facility, and shipped as classified material via courier to the user
    location.  The user then transfers the CIK into the STE. The KOV-14 then
    becomes unclassified, but still needed to make calls. Electronic key
    distribution is planned, but two years out. If you want to travel, you can
    off load the CIK onto a separate "travel" Fortezza card.

    NSA's root CA is located in a place called Finksburg.

    Arnold Reinhold

    Date: Thu, 30 Apr 1998 12:23:02 -0400 (EDT)
    From: [Removed]
    To: "Arnold G. Reinhold" <reinhold@world.std.com>
    cc: "Carl M. Ellison" <cme@acm.org>, cryptography@c2.net
    Subject: Re: Director of Central Intelligence on Trust

    Some more references to STU-III, EKMS, Finksburg and NSA keys:

    http://www.dtic.mil/dodsi/sab3e.html

    http://www.jya.com/don-ekms.htm

    http://infosec.navy.mil/TEXT/EKMS/

    http://www.fas.org/irp/facility/finksburg.htm

    [Removed]