Fortezza is an information security system [1] that uses the Fortezza Crypto Card, a PC Card-based security token. [2] It was developed for the U.S. government's Clipper chip project and has been used by the U.S. Government in various applications.
Information security, sometimes shortened to InfoSec, is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. The information or data may take any form, e.g. electronic or physical. Information security's primary focus is the balanced protection of the confidentiality, integrity and availability of data while maintaining a focus on efficient policy implementation, all without hampering organization productivity. This is largely achieved through a multi-step risk management process that identifies assets, threat sources, vulnerabilities, potential impacts, and possible controls, followed by assessment of the effectiveness of the risk management plan.
In computing, PC Card is a configuration for computer parallel communication peripheral interface, designed for laptop computers. Originally introduced as PCMCIA, the PC Card standard as well as its successors like CardBus were defined and developed by the Personal Computer Memory Card International Association (PCMCIA).
A security token is a physical device used to gain access to an electronically restricted resource. The token is used in addition to or in place of a password. It acts like an electronic key to access something. Examples include a wireless keycard opening a locked door, or in the case of a customer trying to access their bank account online, the use of a bank-provided token can prove that the customer is who they claim to be.
Each individual who is authorized to see protected information is issued a Fortezza card that stores private keys and other data needed to gain access. It contains an NSA approved security microprocessor called Capstone (MYK-80) that implements the Skipjack encryption algorithm.
Capstone is the name of a United States government long-term project to develop cryptography standards for public and government use. Capstone was authorized by the Computer Security Act of 1987 and was driven by the NIST and the NSA; the project began in 1993. The initiative involved four standard algorithms: a data encryption algorithm called Skipjack, along with the Clipper chip that included the Skipjack algorithm, a digital signature algorithm, DSA, a hash function, SHA-1, and a key exchange protocol. Capstone's first implementation was in the Fortezza PCMCIA card. All Capstone components were designed to provide 80-bit security.
In cryptography, Skipjack is a block cipher—an algorithm for encryption—developed by the U.S. National Security Agency (NSA). Initially classified, it was originally intended for use in the controversial Clipper chip. Subsequently, the algorithm was declassified.
In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot. Encryption does not itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as plaintext, is encrypted using an encryption algorithm – a cipher – generating ciphertext that can be read only if decrypted. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. It is in principle possible to decrypt the message without possessing the key, but, for a well-designed encryption scheme, considerable computational resources and skills are required. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients but not to unauthorized users.
The original Fortezza card (KOV-8) is a Type 2 product which means it cannot be used for classified information. The most widely used Type 1 encryption card is the KOV-12 Fortezza card which is used extensively for the Defense Message System (DMS). The KOV-12 is cleared up to TOP SECRET/SCI. A later version, called KOV-14 or Fortezza Plus, uses a Krypton microprocessor that implements stronger, Type 1 encryption and may be used for information classified up to TOP SECRET/SCI. It, in turn, is being replaced by the newer KSV-21 PC card with more modern algorithms and additional capabilities. The cards are interchangeable within the many types of equipment that support Fortezza and can be rekeyed and reprogrammed by the owners, making them easy to issue and reuse. This simplifies the process of rekeying equipment for crypto changes: instead of requiring an expensive fill device, a technician is able to put a new Fortezza card in the device's PCMCIA slot.
Classified information is material that a government body deems to be sensitive information that must be protected. Access is restricted by law or regulation to particular groups of people with the necessary security clearance and need to know, and intentional mishandling of the material can incur criminal penalties. A formal security clearance is required to view or handle classified documents or to access classified data. The clearance process requires a satisfactory background investigation. Documents and other information must be properly marked "by the author" with one of several (hierarchical) levels of sensitivity—e.g. restricted, confidential, secret and top secret. The choice of level is based on an impact assessment; governments have their own criteria, which include how to determine the classification of an information asset, and rules on how to protect information classified at each level. This often includes security clearances for personnel handling the information. Although "classified information" refers to the formal categorization and marking of material by level of sensitivity, it has also developed a sense synonymous with "censored" in US English. A distinction is often made between formal security classification and privacy markings such as "commercial in confidence". Classifications can be used with additional keywords that give more detailed instructions on how data should be used or protected.
The Defense Message System or Defense Messaging System (DMS) is a deployment of secure electronic mail and directory services in the United States Department of Defense. DMS was intended to replace the AUTODIN network, and is based on implementations of the OSI X.400 mail, X.500 directory and X.509 public key certificates, with several extensions to meet the specific needs of military messaging.
The KOV-14 Fortezza Plus is a US National Security Agency-approved PC card which provides encryption functions and key storage to the Secure Terminal Equipment and other devices. It is a tamper-resistant module based on the Mykotronx Krypton chip, including all of the cryptographic functionality of the original Fortezza card plus the Type 1 algorithms/protocols BATON and Firefly, the SDNS signature algorithm, and the STU-III protocol. It was developed by Mykotronx as part of the NSA's MISSI program. As of 2008, the KOV-14 is beginning to be phased out and replaced by the backwards compatible KSV-21 PC card.
The Fortezza Plus card and its successors are used with NSA's Secure Terminal Equipment voice and data encryption systems that are replacing the STU-III. It is manufactured by the Mykotronx Corporation and by Spyrus. Each card costs about $240 and they are commonly used with card readers sold by Litronic Corporation.
Secure Terminal Equipment (STE) is the U.S. Government's current, encrypted telephone communications system for wired or "landline" communications. STE is designed to use ISDN telephone lines which offer higher speeds of up to 128 kbit/s and are all digital. The greater bandwidth allows higher quality voice and can also be utilized for data and fax transmission through a built-in RS-232 port. STE is intended to replace the older STU-III office system and the KY-68 tactical system. STE sets are backwards compatible with STU-III phones, but not with KY-68 sets.
STU-III is a family of secure telephones introduced in 1987 by the NSA for use by the United States government, its contractors, and its allies. STU-III desk units look much like typical office telephones, plug into a standard telephone wall jack and can make calls to any ordinary phone user. When a call is placed to another STU-III unit that is properly set up, one caller can ask the other to initiate secure transmission. They then press a button on their telephones and, after a 15-second delay, their call is encrypted to prevent eavesdropping. There are portable and militarized versions and most STU-IIIs contained an internal modem and RS-232 port for data and fax transmission. Vendors were AT&T, RCA and Motorola.
The Fortezza card has been used in government, military, and banking applications to protect sensitive data. [3]
