[Federal Register Volume 62, Number 166 (Wednesday, August 27, 1997)]
[Notices]
[Pages 45471-45473]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 97-22695]
=======================================================================
-----------------------------------------------------------------------
POSTAL SERVICE
Specifications for Information Based Indicia Program (IBIP)
Postal Security Devices and Indicia (Postmarks)
AGENCY: Postal Service.
ACTION: Notice of USPS response to public comments and availability of
Specifications.
-----------------------------------------------------------------------
SUMMARY: The Postal Service received hundreds of comments in response
to our Federal Register notices on the draft specifications for
Information Based Indicia Program Postal Security Device (PSD) and
Indicium. The Postal Service has reviewed all those comments and
developed a response. Some of the comments were within the scope of the
draft proposed specifications and some of the comments were not. Those
within the scope of the draft proposed specifications have responses
included herein. Those outside the scope of the draft proposed
specifications will be included in subsequent responses. Some of the
topics not dealt with herein include key management, host system
specifications, cash management, certificate authority, product life-
cycle management, mail classes, customer usage requirements, market
research, procurement policy, product submission requirements, product/
service provider infrastructure, and program development activities.
ADDRESSES: Copies of the draft PSD and Indicium specifications dated
July 23, 1997, may be obtained from Ed Zelickman, United States Postal
Service, 475 L'Enfant Plaza SW Room 1P801, Washington, DC 20260-6807.
Comments should be submitted to the same address. These documents
supersede all previously issued Indicium and PSD Specifications. Copies
of all written comments may be inspected between 9 a.m. and 4 p.m.,
Monday through Friday, at the above address.
DATES: All written comments must be received on or before October 27,
1997.
FOR FURTHER INFORMATION CONTACT: Ed Zelickman at (202) 268-3940.
SUPPLEMENTARY INFORMATION: The Postal Service received hundreds of
comments on the proposed draft Information Based Indicia Program
(IBIP) Indicia and Postal Security Device specifications (62 FR
37631, July 14, 1997). Those outside the scope of the draft
proposed specifications will be dealt with in subsequent
specifications and documents and will not be addressed herein.
Indicium Specification
Many comments were received regarding Indicium data contents.
Generally, these comments fall into six categories:
1. Reserve Field Usage
The specific use of the reserved field has not been defined.
Product Service Providers are welcome to suggest how the customer or
service provider could best use this field. This field was installed in
the indicia data set as a customer defined field.
2. The PSD Certificate in the Indicium
The USPS has included in the initial draft the PSD certificate in
the indicia. The removal of the certificate in subsequent releases of
these specifications is dependent upon the key management
infrastructure.
3. Size and Format of the Indicium Fields
The USPS feels that all fields (except the reserve field) in the
indicia contribute to either the security/verification of the indicia
or the audit control of IBIP products. We will continue to explore
replacement methods in an effort to reduce indicia size.
4. Rate Category Definition
The Rate category is defined in the draft DMM and CFR policies and
is not defined in these documents.
5. Ascending Register as a Data Element
The ascending register along with the device ID provides absolute
uniqueness to each indicium. The inclusion of the ascending register
also provides one audit control data element.
6. Special Purpose Field
The special purpose field is included as an audit control field.
This data element within the barcode should match the human readable
value on the mailpiece. If these two do not match, this could be a
fraud indicator.
Many comments were received regarding the use of digital signatures
and associated technology. Specifically, a question arose on use of
varying hash
[[Page 45472]]
functions within a given digital signature algorithm. Additionally, use
of alternate algorithms was suggested.
Recent discoveries concerning the use of one of the hash functions
(MD5) specified in the PSD specification have prompted the USPS to
modify the requirements to read that the hash function required is now
SHA-1. The specification also indicates that the USPS will consider
other equally secure digital signature algorithms. These changes will
be included in the next release of the specifications.
A few comments were received regarding the selection of the error
correction level.
The recommended minimum error correction level was selected based
on the data capacity of the Indicium. Product service providers are at
liberty to use a higher error correction level. If additional data is
added to the Indicium, the error correction level must be chosen to
comply with the PDF417 standard.
A few comments were received regarding envelope issues.
There is no requirement for indicia to be printed directly on the
envelopes. Indicia could be printed on labels and those labels
subsequently applied to envelopes, or indicia-window envelopes could be
used.
Numerous comments were received regarding the size and position of
the Indicium on the mailpiece.
The PDF 417 barcode symbology offers great flexibility in tailoring
its dimensions to the particular application. The 2-inch maximum
barcode width was chosen so as not to infringe on the FIM or the OCR
region. The X dimension feature size was the minimum considered
acceptable for processing using USPS equipment. Larger feature sizes
can be used at the discretion of the product service provider to
achieve the specified read rates. However, other issues such as
printing technologies, paper physics, and required read rates should
also be considered by the product service provider to arrive at an
appropriate rate. All issues regarding positioning, format, and content
of the envelope should be referred to the DMM, which is being updated
to include provisions for IBIP. The Indicium must be visible from the
front of the mailpiece. The Postal Service will continue to explore
methods to minimize real estate requirements on envelopes while
continuing to satisfy security, audit and control, administration, and
customer value-added functions. Our position will be reflected in the
next version of the specifications.
Numerous comments were received regarding reflectance issues.
All issues regarding ink, reflectance and fluorescence should be
referred to the DMM, which is being updated to include provisions for
IBIP. The product service provider must evaluate the Indicium to ensure
USPS readability and quality specifications are met. The product
service provider is required to correct any deficiencies that are
discovered from this evaluation.
A few comments were received regarding the minimum and maximum
postage value issue.
These values will be set by USPS policy.
Numerous comments were received regarding the aesthetics of the
sample Indicium.
Use of IBIP indicia is not mandatory; the Information Based Indicia
represents a fourth form of postage. Design of mailpieces with regard
to evidence of postage is left to the discretion of the product service
provider so long as it is a USPS-recognized form of postage. As a
result, the IBIP indicia design is left to the discretion of the
product service provider so long as it is in compliance with the
Indicium Specification and the Domestic Mail Manual (DMM).
Numerous comments were received regarding print contrast ratio
issues.
IBIP does not limit requirements for paper selection and printing
options. We encourage mailers to take sample mailpieces to their
product service provider for evaluation. Mailpiece design analysis will
determine pass or fail on a case-by-case basis.
A few comments were received regarding a Postal Service pre-
disposition on print technology. No specific technology has been
assumed for printing of the new indicia.
Numerous comments were received regarding readability rate.
Mail submitted must comply with USPS read rate regulations. The
readability of a barcode that represents postage is quite a different
issue than reading a Postnet barcode. There are a number of modifiable
factors that contribute to the readability of a barcode, and the
product service provider must weigh the advantages and disadvantages of
the particular path they have chosen to implement IBIP products.
Many comments were received regarding the selection of PDF-417 as
the two-dimensional symbology.
Alternate symbologies may be submitted for consideration, as part
of product/service provider proposals.
Several comments were received regarding barcode characteristics.
Most of the comments received concerned the specifications of a
minimum mil feature size with a statement of concern that it was too
small because it would lead to the USPS' not being able to achieve a
99.9 percent read rate. The USPS plans to hand scan/sample mailpieces
in the initial phases of the IBIP program. The USPS will consider
raising the minimum X dimension to 15 mils. With regard to the
alignment (skew) tolerance of the barcode, the USPS has not specified
the tolerance levels at this time.
Many comments were received regarding the requirement to use the
facing identification mark (FIM). Additionally, comments were made
suggesting changes to the existing FIM printing requirements because of
the difficulty of printing close to the edge of an envelope.
FIM marks are needed for any IBIP mail subject to entry through our
opening 010 operation. This includes mail dropped in collection boxes.
No changes to existing FIM requirements are proposed in this
rulemaking.
Many comments were received regarding the applicability of
automation requirements to First-Class Mail.
In order to provide customer capabilities to print evidence of
postage using open systems including use of current desktop laser and
ink jet printing technologies, fluorescent ink is not required. To
compensate the handling of these mailpieces for facing, a facing
identification mark (FIM) is required for IBIP mail. The requirement
for inclusion of delivery point barcode and standardized addresses is
for IBIP open systems only. This is a security-based requirement.
A few comments were received regarding mailpiece design issues.
The USPS is not contemplating address block placement of the IBI
symbology on letter/flat mail at this time. The USPS will entertain the
placement of the indicia in a window of an envelope in the upper right
corner as long as the read rate is met.
A few comments were received regarding use of ink types.
If fluorescent ink is used, the facing identification mark is not
required. Additionally, black ink is not required per se. It is the
intent of IBIP for indicia to be produced using black ink.
Several questions and comments were received regarding key lengths
with the digital signature. Some comments argued that the key length
proposed is unnecessarily strong, increasing computation requirements
and indicia
[[Page 45473]]
size and resulting in more expensive meters.
The key lengths chosen were selected to ensure adequate device
lifetime against cryptographic attack.
Many comments were received regarding intellectual property and
patent issues.
The specifications included references to intellectual property and
patent issues to remind product service providers that technologies
they chose to use in implementing IBIP may be subject to third party
intellectual property rights. By including or referring to any specific
technology in the specifications, the USPS does not purport to grant
product service providers the right to use such technologies. The
indemnification provision is included to protect the USPS against
claims by third parties that a particular product service provider's
product infringes third party intellectual property rights. Product
service providers are responsible for securing any right, such as
license rights, that may be necessary to develop IBIP systems.
The USPS is internally studying intellectual property issues that
may be raised by the specifications based on USPS use of this
technology. The USPS does not intend to release the results of our
internal studies at this time. The USPS will consider amendments to the
specifications that may be helpful to the product service provider
community and the public in avoiding or resolving intellectual property
issues. Product service providers are encouraged to bring any known
issues to USPS' attention as soon as possible.
Postal Security Device Specification
A few questions were received regarding postage loading amounts and
the maximum and minimum postage value.
It is not the intent of section 3.2.1.5 of the Draft PSD
specification to imply that only rate break postage can be selected.
The maximum and minimum postage value will be announced in the policy
documents.
A few questions were received regarding the print function and
whether the print functions are to be controlled by the PSD.
The PSD specifications do not state that the PSD controls the print
function.
A few comments were received regarding the use of the transaction
ID. The transaction ID is PSD unique. All messages containing the
transaction ID will be signed.
Many comments were received regarding the use of the term ``IBIP
Infrastructure'' and its definition.
The use of the term IBIP Infrastructure in the document was
generalized at the time of the writing of the document to be referable
to either the USPS or the product service provider. For further
definition of the responsibilities of these, the Product Service
Provider should contact the USPS under the Interim Product Submission
Procedures. The proposed draft IBIP specifications are written with
respect to a target system that assumes that a USPS infrastructure is
in place to handle postage download, device audit, and other
interactions. Until that infrastructure is in place, an interim product
service provider-focused system will be used.
Many comments were received regarding resetting functions.
At this time all postage value downloads or resettings will be
handled by the product service providers through CMRS. All details for
this issue can be found in draft CFR section 502.26, Computerized
Remote Postage Resetting, and in The Cash Management Operating
Specifications for the Computerized Remote Postage Meter Resetting
System.
Several comments were received regarding the device audit message.
Because of the digital signature creation and verification process
that the Device Audit Message will be subjected to, both the format and
content of this message must be specified.
Many comments were received regarding PSD functionality.
The PSD will not be a general signature device, it will be used
only for IBIP signatures. Additionally, the PSD is anticipated to be
limited to the functionality detailed in the PSD specification. This
will be reflected in the next iteration of the PSD documentation. In
terms of remote loading of cryptographic keys into the PSD, the Postal
Service is considering the possibility of this action. Our response
will be reflected in the soon to be published draft Key Management
Plan.
Several comments were received requiring PSD specification
clarification.
The proposed draft IBIP specifications are written with respect to
a target system that assumes that a USPS infrastructure is in place to
handle postage download and device audit, among other things. Until
that infrastructure is in place, an interim product service provider-
centric system will be used.
A comment was received regarding device authorization.
When security is an issue, the USPS has a vested interest in the
communications link between the customer and the product service
provider even though the product service provider may own both ends of
that communication circuit. All such communications, formats,
protocols, and content will be subject to the approval of the USPS or
its representatives.
A comment was received regarding the watchdog timer function.
Yes, the watchdog timer is reset only after a successful device
audit.
A large number of comments were received regarding PSD physical
characteristics and FIPS 140-1 certification.
The PSD must conform to the FIPS 140-1 requirements. All questions
concerning FIPS validation testing should be directed to the specific
NIST Cryptographic Module Testing laboratory chosen by the product
service provider for validation testing. For further explanation
regarding specific PSD design issues, please contact one of the NIST
certified labs.
One comment was received regarding PSD testing. Testing of the PSD
by the product service provider should ensure that the registers cannot
be altered except as specified in the PSD specification.
Stanley F. Mires,
Chief Counsel, Legislative.
[FR Doc. 97-22695 Filed 8-26-97; 8:45 am]
BILLING CODE 7710-12-P