Electronic Signature Prototype System (Correspondence, 02/08/94,
GAO/AIMD-94-70R).
GAO responded to a request from the Army Corps of Engineers to extend
its sanction of the Army's Electronic Signature Prototype System. GAO
noted that: (1) the prototype system's internal controls are adequate
and the electronic signatures generated by the system provide at least
the same quality of evidence as handwritten signatures; (2) certain key
controls for the system cannot be implemented at this time, but they
will be incorporated into the system as the Army gains experience; (3)
the Army will initially use cryptographic modules that do not meet all
the stated requirements, but these modules will eventually be replaced
with modules that meet the Army's requirements; (4) the National
Institute of Standards and Technology (NIST) will review the electronic
signature system's controls, and additional improvements will be made
based on the NIST review; and (5) its sanction of the prototype system
does not constitute approval of the Army's financial management system.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-94-70R
TITLE: Electronic Signature Prototype System
DATE: 02/08/94
SUBJECT: Internal controls
Financial management systems
Army procurement
Testing
Sanctions
Electronic equipment
Computer prototypes
Systems design
IDENTIFIER: Army Electronic Signature Prototype System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
February 1994
GAO/AIMD-94-70R
Electronic Signature Prototype System
(511471)
Abbreviations
=============================================================== ABBREV
NIST - National Institute of Standards and Technology
GAO - General Accounting Office
Letter
=============================================================== LETTER
B-256310
February 8, 1994
Mr. John F. Wallace
Director of Resources Management
U.S. Army Corps of Engineers
Dear Mr. Wallace:
This letter responds to your November 29, 1993, request that we
extend our sanction of the operation of your Electronic Signature
Prototype System being developed by the Corps of Engineers for use in
its new financial management system. On January 5, 1993,\1 we
sanctioned the use of a prototype system for electronic signatures
and message authentication at two divisions for a year beginning in
February 1993. We understand that you need an additional year to
complete system testing and evaluation since the originally scheduled
implementation date was delayed by about 1 year.
As noted in our original letter, we believe that the stated internal
controls, if properly implemented, are adequate for this prototype
system and that the electronic signatures generated by this system
provide at least the same quality of evidence as the handwritten
signatures they are designed to replace. However, as this is a
prototype system, we recognize that certain key controls required for
your production system cannot be implemented at this time. We have
discussed with your staff some of the control improvements that we
believe are needed before the prototype system is converted into a
production system. We were assured that such controls would be
properly implemented and that additional control improvements would
be incorporated as experience is gained.
We therefore extend our sanction on the prototype's operation at the
two divisions for an additional 1-year period ending in February
1995. However, this letter is to sanction your prototype electronic
signature system and does not constitute GAO approval of your
financial management system, as defined by 31 U.S.C. 3512(e)(2).
We understand that because of procurement delays you will initially
use "off-the-shelf" cryptographic modules which do not meet all the
stated requirements for locations within these two divisions. We
further understand that you plan to replace the "off-the-shelf"
modules installed at the first two divisions with modules meeting the
stated requirements and that installation of the electronic signature
system at the other divisions will await procurement of the proper
modules. In addition, we have been told that a review of the
electronic signature system's controls will be performed by the
National Institute of Standards and Technology (NIST) during this
testing period. We fully expect that additional improvements will be
made based on the test results and the review conducted by NIST.
We recognize the challenges your agency has experienced in attempting
to develop a system that will not only meet your needs but those of
other federal agencies as well. We look forward to working with your
agency on this and other efforts in the future. Should you have any
questions, please contact Chris Martin of my staff at (202) 512-9481.
Sincerely yours,
Gene L. Dodaro
Assistant Comptroller General
--------------------
\1 Electronic Signature Prototype System (GAO/AFMD-93-44R, January 5,
1993).
*** End of document. ***