[Federal Register Volume 65, Number 31 (Tuesday, February 15, 2000)]
[Notices]
[Pages 7507-7508]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 00-3450]


-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Institute of Standareds and Technology

[Docket No. 981028268-9247-02]
RIN No. 0693-ZA-23


Announcing Approval of Federal Information Processing Standard 
(FIPS) 186-2, Digital Signature Standard (DSS)

AGENCY: National Institute of Standards and Technology (NIST), 
Commerce.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The Secretary of Commerce approved Federal Information 
Processing Standard 186-2, Digital Signature Standard (DSS), which 
supersedes Federal Information Processing Standard (FIPS) 186-1, 
Digital Signature Standard (DSS), FIPSs 186-2 expands FIPS 186-1 by

[[Page 7508]]

specifying an additional voluntary industry standard for generating and 
verifying digital signatures. This action will enable Federal agencies 
to use the Digital Signature Algorithm (DSA), which was originally the 
single approved technique for digital signatures, as well as two new 
ANSI standards that were developed for the financial community. These 
new standards are ANSI X9.31, Digital Signature Using Reversible Public 
Key Cryptography, and ANSI X9.62, Elliptic Curve Digital Signature 
Algorithm (ECDSA).

EFFECTIVE DATE: This standard is effective June 27, 2000.

FOR FURTHER INFORMATION CONTACT: Ms. Elaine Barker (301) 975-2911, 
National Institute of Standards and Technology, 100 Bureau Drive, STOP 
8930, Gaithersburg, MD 20899-8930.
    Specifications for FIPS 186-2 are available on NIST Web page: 
http://csrc.nist.gov/encryption>.
    Copies of ANSI X9.31, Digital Signatures Using Reversible Public 
Key Cryptography, and ANSI X9.62, Elliptic Curve Digital Signature 
Algorithm (ECDSA) are available from the American Bankers Assoc./DC, X9 
Customer Service Dept. P.O. Box 79064, Baltimore, MD 21279-0064; 
telephone 1-800-338-0626.

SUPPLEMENTARY INFORMATION: Under Section 5131 of the Information 
Technology Management Reform Act of 1996 and the Computer Security Act 
of 1987, the Secretary of Commerce is authorized to approve standards 
and guidelines for the cost effective security and privacy of sensitive 
information processed by federal computer systems. In May 1994, the 
Secretary of Commerce approved FIPS 186, Digital Signature Standard 
(DSS), which specified the Digital Signature Algorithm (DSA) as the 
single technique for the generation and verification of digital 
signatures. In 1997 NIST solicited comments on augmenting FIPS 186 with 
other digital signature techniques including the Rivest-Shamir-Adleman 
(RSA) and the elliptic curve technique. The comments received by NIST 
supported adding both techniques to FIPS 186. Both techniques were 
being considered by the financial services industry as voluntary 
industry standards.
    On December 15, 1998, (FR Vol. 63, No. 240, pp 69049-51) NIST 
announced that the Secretary of Commerce had approved FIPS 186-1, 
Digital Signature Standard (DSS) as an interim final standard. FIPS 
186-1 added the RSA digital signature technique, which had been 
approved as an industry standard (X9.31-1998, Digital Signatures Using 
Reversible Public Key Cryptography for the Financial Services 
Industry). The elliptic curve technique was not included in the interim 
final standard since it had not yet been approved by the American 
National Standards Institute (ANSI) as a voluntary industry standard.
    The December 1998 Notice from NIST invited comments from public, 
academic and research communities, manufacturers, voluntary standards 
organizations, and Federal, state, and local government organizations 
concerning the specification of two techniques (DSA and ANSI X9.31-
1998) for the generation and verification of digital signatures. That 
Notice also referred to the elliptic curve technique, which NIST had 
expected to be approved by ANSI as a voluntary industry standard. In 
addition to being published in the Federal Register, the Notice was 
posted on the NIST Web pages; information was provided for submission 
of electronic comments. NIST received comments from 15 private sector 
organizations and individuals, and from two federal government 
organizations. The comments supported the addition of the ANSI X9.31 
standard, as well as the addition of the elliptic curve technique to 
the Digital Signature Standard (DSS). NIST recommended that the 
Secretary of Commerce approve FIPS 186-2, which includes the DSA, ANSI 
X9.31, and the elliptic curve technique, which has now been approved as 
ECDSA, under ANSI X9.62, Elliptic Curve Digital Signature Algorithm. 
Other comments supported the continued use of another RSA signature 
algorithm that is specified by PKCS#1. The algorithm specified in 
PKCS#1 does not interoperate with the algorithm specified in ANSI 
X9.31. FIPS 186-2 allows for the continued acquisition of 
implementations of PKCS#1 for a transition period of eighteen months 
from the date of approval of this standard, which will enable federal 
agencies to plan for the acquisition of implementations of the 
algorithms promulgated by FIPS 186-2.

    Dated: February 8, 2000.
Karen H. Brown,
Deputy Director, NIST.
[FR Doc. 00-3450 Filed 2-14-00; 8:45 am]
BILLING CODE 3510-CN-M