USPS releases draft for PC postage project
- By Colleen O'Hara
- Jul 27, 1997
The U.S. Postal Service released a draft security plan last week for its ambitious project to deliver postage directly to personal computers a move that could replace many of the postage meters that businesses use everyday.
The draft key-management plan which will support USPS' first effort in 77 years to introduce a new form of postage will provide security for the so-called Information Based Indicia Program (IBIP). The goal of the program is to provide a more secure way to deliver postage via PCs rather than via mechanical postage meters. Mechanical meters in total deliver $20 billion a year in postage revenue to USPS.
With key management a PC user registers a public key with a certificate authority an organization that verifies that the public key belongs to an individual with the matching private key. Using the private key a user encrypts the information to send to another individual who then uses the sender's public key to decrypt the information.
"Having key management is an integral function to doing something like this " said Roy Gordon program manager for process and product development in the Metering Technology Management Group at USPS. "There will be a debate as to how to do key management but we have to have key management to enable what we want to enable."
Debate surrounding development of the federal key-management infrastructure has centered around who should hold and have access to the private key. In the case of the USPS key-management plan which is designed specifically for IBIP the private key is generated on the security device connected to the PC so the private key is never revealed.
"There is no controversy with the Postal Service plan because the controversy begins when two types of keys are held by a third party " said Santosh Chokhani chief executive officer of CygnaCom Solutions Inc. "The Postal Service plan seems [to be] in reasonably good shape."
USPS unveiled IBIP last year. It consists of a suite of products including a new postmark with a 2-D bar code incorporating a digital signature a postal security device (PSD) which performs functions similar to postage meter registers PC software that would print the new postmark and now the key-management plan.
With IBIP users will buy a PSD postage-payment system from a vendor and load it onto a PC. The user will then dial into the vendor's site to initialize the system which includes collecting information about the user such as name and address. Once the user is approved software will be downloaded to the PSD and the device will be ready to use.
The private key will already be installed in the device and the user will have to contact USPS which will act as the certificate authority to receive the matching public key. The user will have to contact the vendor to order download and pay for postage. All communication among the PSD vendor site and USPS will be digitally signed.
"If I sign something I need to verify it " said Dan Lord marketing specialist at USPS. "The only way I can verify it is if I have a key-management plan. Key management is the method used to create distribute and protect cryptographic keys."
USPS expects many small and home-based businesses to use IBIP. Eileen Jaffe director of member services at the Home Office Association of America (HOAA) said printing postage from a PC in combination with new software that helps users sort mail and correct ZIP codes will save small businesses and home offices time and money. In a recent HOAA survey 98 percent of respondents said they would be likely to use software that would let them print postage directly from their computers.
"I don't think we're looking at a replacement of postage meters but it's more convenient for some people " Gordon said. "This target market is interested in using PC postage products for certain services such as mailing invoices." Products that support the program are expected to be in beta testing by the end of the year but Gordon could not predict when the final versions of products would hit the streets. USPS is accepting comments on the draft key-management plan until October.