ONR PKI Certificate Announcement

On November 30, 2006 the Office of Naval Research (ONR) sent an email to all registered users of its AwardWeb, AdminWeb and PayWeb systems concerning a new security requirement mandated for using these systems. The new requirement is for those accessing ONR web servers to use commercial electronic certificates based on the Public Key Infrastructure (PKI). PKI enables the use of encryption and digital signature services for applications enabled to accept this standard. The certificate is usually installed in conjunction with a web browser. Please see the sections below for information.

FAQ’s

Q: How does this impact my institution?

A: Anyone at your institution using the ONR AwardWeb, AdminWeb, or PayWeb systems must have a PKI certificate from either Operational Research Consultants (ORC) or Verisign.

Q: What is the deadline?

A: Access to the three ONR systems will require a valid certificate beginning January 4, 2007.

Q: What is the cost:

A: Between $99 and $115 per year for each user with a need to access one of these systems. Volume discounts may apply.

Q: What are the steps in obtaining and installing the certificate?

A: You must first contact one of the approved certificate sources.

Standard requirements are that you provide face-to-face identification to a Notary Public or a Registration Authority. After obtaining the certificate it must be installed for each individual. You may want to involve your IT staff in this process since some network tools are available to manage, archive and recover lost keys as well as allow the certificate to be used by the same individual on more than one computer.

Q: How is the certificate used by the ONR systems?

A: Once the PKI certificate is associate with an individual and installed on a computer, the user must select the appropriate certificate, provide the password and complete a registration process with the site. After the certificate is verified and the registration process is completed, you will be notified that access has been granted.

Q: How long might the entire process take?

A: The steps require face-to-face identity verification, applying for a certificate, payment for the certificate, installation of the certificate, registration and granting of access with the ONR system, thus several days or more may be required to complete all of the requirements.

Original Email Sent by ONR

On September 26, 2006, the Naval Network Warfare Command (NETWARCOM) directed that all Naval Web Servers hosting applications accessed by external users must implement Public Key Infrastructure (PKI) electronic authentication of users.

This was to be accomplished by October 4, 2006; however, we were able to obtain a 90 day delay in implementation until January 4, 2007.

What this means is that the users of these systems will need to purchase a PKI certificate from an approved source in order to obtain access.

These certificates cost between $99 and $115 per year for each user.

The approved sources of these certificates are as follows:

* ORC at http://eca.orc.com

* VeriSign, Inc. at http://www.verisign.com/gov/ieca

Beginning on January 4, 2007, all of the ONR web sites will be PKI enabled. We sincerely apologize for the short notice, but hope that you will understand that increased security is becoming a significant issue, and we are attempting to preserve/protect our ability to interchange information with you electronically.

If you have questions or require technical assistance in implementing PKI, the following telephone numbers should prove helpful.

PKI Technical Questions - Navy PKI Help Desk 1-800-304-4636

DAWN LEYMEISTER/CIV/NETWARCOM N33/LOC:NORFOLK VA /TEL:757-417-7929

Please do not delay in taking action to get your PKI certificates. The process entails face-to-face identification in front of either a Registration Authority or a Notary Public prior to the request being processed. It can potentially take several days from certificate request to certificate issuance, so please act early.