Subject: NSA/IAD Suite B Key-generation & On-line Protocols

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 12 Apr 2009 21:19:52 +0200

>From what I believe must be an unclassified e-mail I quote:

 "NSA/IAD is establishing a commercial Suite B infrastructure that will
   include generation, distribution, revocation, and life cycle maintenance
   of Suite B V3 X.509 certificates with a target IOC of 1st quarter FY10.
   We are defining the certificate policy and interface requirements as
   well as supporting protocols.  KMI CI-2 Spiral 2 will deploy Suite B
   mission certificates and Over-the-Network Key in December 2011 and will
   incorporate ECDH for KEK generation for product wrapping to align with
   HAIPE IS 4.0 (r)"

It would be interesting if someone could translate this into something even
a civilian could understand :-)

I have FWIW, upgraded KeyGen2 to support ECDSA keys according
to the latest XML DSIG 1.1 draft.  Example (look for "ECKeyValue"):
http://webpki.org/papers/keygen2/ec-keygen.xml

XML DSIG 11:
http://www.w3.org/TR/xmldsig-core1

AndersR

---

From: Michael StJohns <[email-masked]>
Date: Sun, 12 Apr 2009 20:32:21 -0400

>   of Suite B V3 X.509 certificates with a target IOC of 1st quarter FY10.

The National Security Agency is establishing a commercial Public Key Infrastructure which issues certificates compliant with the NSA Suite B cryptographic suite and provides the normal functions of certificate generation, distribution and revocation.  The service should be up and running around October 2009.

>   well as supporting protocols. 

We're defining our own way of doing things, so anyone who wants to work with us will have to spend lots of money.

> KMI CI-2 Spiral 2 will deploy Suite B

Phase two - occurring about December 2011 - will provide certificates and key material for the HAIPE series of IP packet encryptors and will do something mostly no one else will care about.