CRYPTOGRAPHIC BUTTON PROGRAM

Cryptographic authentication has recently become a critical component of data surety and access control within Safeguards organizations. Proof of the authenticity of the data used to draw Safeguards conclusions has long been a primary and critical aspect of the entire Safeguards process. With the introduction of remote monitoring and networked review stations, access control has begun to be a consideration of equal concern. The cryptographic iButton provides the enabling technology that may allow safeguards agencies to implement cryptographically secure access to the sensitive Safeguards data as well as auditably demonstrate to the member countries that information about their facilities is rigorously access-controlled. The iButton, made by Dallas semiconductor, is a 16mm computer chip housed in a stainless steel can (16mm diameter x 3-6 mm depth). The iButton can be worn by a person or attached to an object for up-to-date information at the point of use. The steel button is rugged enough to withstand harsh outdoor environments; it is durable enough for a person to wear everyday on a digital accessory like a ring, key fob, wallet, or badge. Information is transferred between the iButton and any PC with a momentary contact, at up to 142K bits per second. The Cryptographic iButton features very strong cryptography and has three immediate applications: 1) Secure E-mail: iButton users can have universal access to their email from public connections - such as hotels, airports, and satellite offices - and still be confident that their mail is private. 2) Internet commerce: The iButton can store and manage units of value (such as money), and 3) Remote login authentication: Individuals on travel can access safeguards databases directly from their PCs. iButtons can perform the sophisticated challenge and response authentication typically required to access sensitive information. This paper will investigate the safeguards applications of the iButton, specifically in the areas of data access security and data surety.