Following is a draft of the cover letter for discussion at the June 1998 TAC 
meeting...


D R A F T   (5/26/98)

Secretary of Commerce
Etc.

Dear Mr. Secretary:

I am pleased to forward to you the enclosed recommended draft of the "Technical 
Advisory Committee to Develop a Federal Information Processing Standard for the 
Federal Key Management Infrastructure" for a federal Key Recovery Standard.  
This recommendation fulfills the requirements established in the Charter 
establishing this Technical Advisory Committee, and we are cognizant of the 
steps you are obligated to take under various statutes and policies to seek 
public comment in making your determination about whether this draft should, in 
fact, become a Federal Information Processing Standard.  

In carrying out our work, we are cognizant that the market technologies for 
encryption key recovery are in the early stages of  evolution. Therefore, our 
recommendations specify functional, security, interoperability, and assurance 
requirements for key recovery functions within a TAC-defined key recovery model, 
but do not endorse any specific key recovery technology.

Since we began meeting in December, 1996, we have necessarily remained focused 
on producing a recommendation within our allocated timeframe.  Therefore, our 
recommendation addresses key recovery components (e.g., end-user products and 
key recovery agents), but does not address the assembly of components into a 
working key recovery system, or other aspects of procuring, implementing, or 
operating a key recovery system.   

As our worked progress, we took due note of a number of important parallel steps 
would assist in implementing any FIPS that you determine appropriate for federal 
government use in this area.   Thus, the TAC strongly recommends that a number 
of supporting activities be undertaken by the government in order for this 
standard to be useful and useable.  First, detailed implementation guidance 
should be developed to address, among other issues,  how agencies should 
configure products containing conforming functions into operational full key 
recovery systems.  Issues regarding the integration of key recovery systems into 
applications and procurement of key recovery services also need to be addressed.  
Operational, personnel, and managerial issues are of great importance as well.  
The TAC believes that the preparation of such guidance will require substantial 
effort, at least comparable to that of our work over the past nineteen months.  

Additionally, for security concerns, we do not support vendor self-declarations 
of conformance to this standard and urge you to pursue a conformance testing 
program along the lines of NIST's excellent (NVLAP) program for the security of 
cryptographic modules under FIPS 140-1.  This, too, is a considerable 
undertaking, but one we feel is necessary to provide agencies (and other users) 
with sufficient assurance of the quality and security of the key recovery 
products they procure.   We urge these activities be undertaken with input from 
industry and the federal community.

As you know, Committee members were appointed for their individual expertise.  
This recommendation does not have the explicit or implicit endorsement of the 
companies nor organizations with which our members are affiliated.  We request 
that as our Committee's recommendation is distributed for comment, you include 
this accompanying letter.

On behalf of the Committee, we hope you find our recommendations useful.  It has 
been our pleasure to assist the Department in developing this recommended draft 
for an encryption key recovery standard.  

Sincerely,


Dr. Stephen T. Kent,
Chairman