Electronic key management system
The electronic key management system ( EKMS ) is one of the National Security Agency of the United States owned and key management , accounting and distribution in the communications security responsible (COMSEC) program. In particular, it generates electronic key material for all NSA encryption systems, the keys of which are loaded using standardized fill devices , and manages the distribution of the key material produced by the NSA. In addition, the registration of user accounts , privilege management and orders are carried out by the EKMS in order to manage the management and distribution of physical communication security material for the respective services. The uniform EKMS components and standards are intended to promote interoperability between the military services and civil authorities.
Reasons for development
The Registered Publications System (RPS) was replaced by the COMSEC Material Control System (CMCS) in the 1970s. However, the CMCS suffered from security and logistics problems as well as from the labor-intensive operation that had reached its capacity limits. Concern was raised about staff access to paper keys, which posed a direct and serious risk. This concern was justified with the exposure of the Walker spy ring. Destroying the majority of all paper keys will greatly reduce this human risk, but the EKMS’s long-term goal of minimizing human access to key material will not be realized until the benign-fill process is fully implemented. The benign-fill procedure allows the encrypted exchange of electronic key material directly to the COMSEC device without human access to keys in plain text.
The need for joint interoperability led to the Defense Reorganization Act of 1986, under which the Joint Chiefs of Staff (JCS ) mandated the NSA, the Defense Information Systems Agency (DISA) and the Joint Tactical Command, Control and Communications Agency (JTC3A) to Develop a Key Management Goal Architecture. Subsequent difficulties in coordinating COMSEC distribution and support during joint military operations such as Desert Storm , Urgent Fury and Operation Just Cause have highlighted the need for an inter-service interoperable system.
Central Facility
The EKMS begins with the Central Facility (CF) operated by the NSA , which provides a wide range of resources to the services and other government agencies. CF, also known as Tier 0, is the basis of the EKMS. Traditional paper-based keys, as well as keys for Secure Telephone Unit - Third Generation , Secure Terminal Equipment ( STE ), Secure Protocol for Communication Interoperability ( FNBDT ), Iridium , Secure Data Network System (SDNS) and other electronic keys are used by one managed underground building in Finksburg, Maryland . This facility is capable of:
- Orders for physical and electronic key processing
- electronic generation and distribution of keys
- Key material for FIREFLY (an NSA algorithm based on asymmetric cryptography )
- Implementation of seed conversion and exchange of key material ("Rekey")
- Operation of recovery and management of FIREFLY material in the event of a compromise
- Support for over-the-air rekeying (OTAR)
The CF communicates with the other elements of the EKMS over a variety of media, communication devices and networks, either through direct distance dialing with STU-III (data mode) or through dedicated access to connectors with KG-84 . During the transition to fully electronic keys, 3.5-inch floppy disks and 9-track magnetic tapes are also supported. A common user interface, the TCP / IP -based messaging service, is the primary means of communication with the CF. The messaging service allows elements of the EKMS to store messages within the EKMS that contain electronic keys for later retrieval by another element of the EKMS.
Tier 1
Under CMCS, each service maintained a Central Office of Record (COR), which carried out basic key and COMSEC administrative functions such as ordering keys, distributing keys and inventory control, etc. Under EKMS, each service operates its own key management system with EKMS Tier 1 software. This software supports physical and electronic key distribution, traditional electronic key generation, management of distribution and ordering of materials, and other functions related to accounting and COR. It is usually based on software from the US Navy's Key Distribution System (NKDS), developed by the Naval Research Laboratory and further developed by SAIC in San Diego.
Tier 2
EKMS Tier 2 , the Local Management Device (LMD), consists of commercial PCs running the SCO- UNIX operating system and an NSA KOK-22A Key Processor (KP) . The KP is a component that is trusted . It performs cryptographic functions, encryption and decryption for the user account and electronic signature processes. The KP is capable of securely generating traditional keys in the field. Locally generated keys can be used in crypto network communication, transmission security applications (TRANSEC), direct connections and almost anywhere that paper-based keys have been used. Electronic keys can be downloaded directly to Fill devices such as KYK-13 , KYX-15 , or the more modern AN / CYZ-10 data transfer device (DTD) in order to be transferred ( fill ) to the final cryptographic unit .
Tier 3
The lowest level of the EKMS architecture includes devices such as the AN / CYZ-10 data transfer device, the SKL (Simple Key Loader) AN / PYQ-10 and all other processes that are used to fill end cryptographic units (ECUs). The entities of Tier 3 only create hard copies of material, and copies of STU-III / STE material only with the help of Key Management Entities (KMEs) (i.e. Local Elements (LEs)). Unlike Tier 2 LMD / KP accounts, entities using Tier 3 will never receive electronic key material from COR or Tier 0.
Individual evidence
- ^ The Communications Security Material System . Retrieved August 17, 2013.
- ↑ The John A. Walker spy ring - 25 years ago this week - HamptonRoads.com - PilotOnline.com . Retrieved August 17, 2013.
- ↑ KYK-13 - Crypto Museum . Retrieved November 29, 2013.
- ↑ Key transfer devices - Crypto Museum . Retrieved November 29, 2013.