While browsing the IRS ("Electronic Certification")

While poking around at www.ustreas.gov, I found the following:

		http://www.ustreas.gov/treasury/bureaus/sba/electro.html

The first paragraph reads:

--SNIP--
The Financial Management Service is implementing an Electronic
Certification System to permit fast, secure, and accurate transmission and
certification of payment data. The system has been approved by the General
Accounting Office for satisfying the signature certification requirements
of 31 U.S.C. 3325 and 3528. 
--SNIP--

Would anyone like to comment on what is being used to provide 
signatures?  

Reading on down a bit, we get to this:

--SNIP--

It uses a microcomputer to generate voucher schedules,
electronically certify the vouchers, and transmit them via a dial-up
telephone line to a mainframe host computer at the servicing Regional
Financial Center. 

The electronic certification process provides positive identification of
the certifying officer who authorizes the voucher for payment and ensures
the authenticity of the transmitted data. 

It also detects any deliberate or inadvertent manipulation, modification,
and loss of data between the time the voucher is certified in the Federal
Program Agency microcomputer and the time it is verified at the servicing
Regional Financial Center host computer.
--SNIP--

Comments?

-abc
                                      \             Alan B. Clegg
         Just because I can            \            Internet Staff
        does not mean I will.           \          gateway.com, inc.
                                         \     <http://www.gateway.com/>

On Mon, 18 Mar 1996, Alan B. Clegg wrote:

They've been working on this for awhile.  The problem is that the 
certification setup does not scale well.  They've been looking at having 
the USPS maintain the certificates, but I have heard that it's been 
tossed back and forth between them and GSA and neither of them wants to 
do it.

IRT the actual crypto being used in the solution, they are using the 
Digitial Signature Standard (FIPS PUB 186) with message digests being 
created via the Secure Hash Algorithm (FIP PUB 180).  Unless you're using 
the FIPS stuff, you'd be hard pressed to get GAO or OMB to approve it.

> --SNIP--
> The Financial Management Service is implementing an Electronic
> Certification System to permit fast, secure, and accurate transmission and
> certification of payment data. The system has been approved by the General
> Accounting Office for satisfying the signature certification requirements
> of 31 U.S.C. 3325 and 3528. 
> --SNIP--
> 
> Would anyone like to comment on what is being used to provide 
> signatures?  
> 

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich@grci.com            | 
|        STOP THE CDA NOW!                |MAldrich@dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------