Crypto Device Requirements_Final.docx

Description The Integrated Broadcast Service (IBS) System Program Office (SPO) is conducting market research on hardware/firmware based encryption/decryption systems that meet the technical requirements specified herein. With this request for information (RFI) the IBS SPO is seeking responses from interested parties to inform a potential acquisition strategy for the encryption/decryption system. The IBS SPO intends to use responses to this RFI to determine whether sources exist, and whether a potential acquisition can be competitively awarded and/or a Small Business Set-Aside.

The Government respectfully requests that interested parties respond to this RFI. However, this RFI does not commit the Government to issue a contract for any material, supply, or service. The Government is not at this time seeking proposals and will not accept unsolicited proposals. Responders are advised that the Government will not pay for any information or administrative costs incurred as a result of responding to this RFI. All costs associated with responding to this RFI will be solely at the expense of the interested party. Not responding to this RFI does not preclude participation in any future solicitation for proposals, if any is issued. If a solicitation is issued, it will be synopsized on Sam.gov.

Background The IBS SPO intends to replace an existing KIV 7M encryption/decryption device with the system that is being sought. The new system shall conform to existing COMSEC requirements, infill message encryption constraints, channel throughput requirements, security safeguards, existing physical data interfaces, and mechanical design constraints, while providing additional functionality.

The Government estimates a need of >10 devices to support fielding with sufficient sparing.

Functional Overview The encryption/decryption device will ingest data reports formatted IAW MIL-STD 188-186 that will be encapsulated in an IP packet. The size of each report will be an integral multiple of 16-byte blocks as shown in Figure 1. The encryption device will encrypt an incoming stream of classified data and output the encrypted data to a device which will broadcast the encrypted data across the network.

Figure 1. MIL-STD 188-186 report structure Performance Requirements

The unit shall encrypt the report data as shown in Figure 2 but shall not encrypt (bypass) the header.

Figure 2. Report After Encryption.

The Unit shall encrypt reports based on its subnet assignment as shown in Figure 3.

00001111 = Subnet 1 00110011 = Subnet 2 00111100 = Subnet 3 01010101 = Subnet 4 01011010 = Subnet 5 01100110 = Subnet 6 01101001 = Subnet 7 10010110 = Subnet 8 10011001 = Subnet 9 10100101 = Subnet 10 10101010 = Subnet 11 11000011 = Subnet 12 11001100 = Subnet 13 11110000 = Subnet 14 Other states not permissible

Figure 3. Subnet Assignment.

COMSEC Requirements The proposed solution shall incorporate the following COMSEC Requirements/Capabilities:

· The unit shall incorporate one or more embedded COMSEC modules for encryption/decryption of the data traffic using the appropriate crypto algorithm/modes.

· The unit shall be NSA Type-1 certified to support SECRET data (additional capability to also provide TOP SECRET processing is acceptable).

· The unit shall be able to store a unique key for each of up to 14 subnetworks.

· The unit shall identify the unique key to use for encryption by reading the subnet assignment in Figure 3.

· The unit shall be capable of switching between all applicable algorithms without re-loading algorithms, with the design and control determined by offeror. Requires crypto header bypass IAW MIL-STD-188-186.

· The unit shall utilize encrypted bitstreams in the FPGA implementation of the algorithms. Implementation should have growth for other algorithm implementations.

· Device shall meet specifications in Link Encryptor Family (LEF) Interoperability Specification (NSA 03-01A).

Infill Message Encryption

· The unit shall encrypt messages in accordance with MIL-STD-188-186 compatible modified cipher block chaining (CBC) using the MEDLEY algorithm.

· The unit shall deliver the encrypted messages as cipher text to the black data interface.

· The unit shall control and use the COMSEC functions to process information at the SECRET level (additional capability to also provide TOP SECRET processing is acceptable).

· The unit shall include the following states: zeroized, operate and keyloaded.

Key Handling In order to support interoperability, the unit shall use keys that are identical to the keys used in the IBS radios. In particular, the unit shall support the following:

· Accept keys via a DS-101 interface, as specified in EKMS-308.

· DS-101 keyfill (and storage) of a Black TEK/ Red KEK pair for Infill encryption

· Compatible with standard electronic keying devices including SKL, TKL, and RASKL. Compatibility with other standard keying devices is acceptable.

· The Black TEK is wrapped using the ACCORDION 1.3 algorithm in accordance with the CIB Annex to the HAIPlS compatible key spec (NSA 0N713275)

· The KEK and TEK are formatted according to NSA 0N713275

· The unit shall provide function(s) to control the load of TEKs and KEKs.

· The unit shall provide a means to verify the status of the key-loading process.

· The unit is required to provide key holdup power.

Zeroize Function The Unit shall provide a passive key zeroize function that erases all cryptographic keys and traffic upon removal of power.

Security Safeguards The Unit shall meet all applicable NSA security requirements IAW NSA 3-16.

Channel Throughput The latency of the encryption process for a 300-byte report shall be 4.999 milliseconds or less.

The message throughput encryption rate shall be greater than 100 messages per second (assuming a message size of 300 bytes).

Internal Clock Requirement(s) To be determined by offeror.

Electrostatic discharge (ESD) The data interfaces shall have ESD protection (as governed by the associated specifications (IEC 61000-4, MIL-STD-883, & JEDEC JS-001).

Interface Requirements:

Input power To be determined by offeror. Input power should be autosensing standard 110/240VAC.

Physical Data Interface The unit shall provide a serial (Threshold) or TCP/IP (Objective) input for the transfer of plaintext (red) and ciphertext (black) data to the unit, with an IP interface being preferred. The unit shall provide a serial (Threshold) or TCP/IP (Objective) output connection for the ciphertext (black) data from the unit, with an IP interface being preferred. Each report will be delivered to the unit in IP packet format. The preferred Encryption/Decryption interfacing solution is illustrated below in Figure 4, and additional acceptable interfacing solutions are illustrated below in Figure 5 and Figure 6 in order of preference.

If the design incorporates a serial data interface, it shall be as follows:

· RS-422 serial full-duplex.

· Synchronous

· Data rate: 500,000 bps (minimum)

· No hardware handshaking shall be utilized

· Utilizing Micro—D filter connectors Logical Data interface The logical data interface shall be as defined by the vendor. IP interface is preferred. Each report will be transferred as an IP packet from the IBS Report Handler to the encryption device and then from the encryption device to the IBS Queue and Burst Format (QBF).

Channels The Unit must have a minimum of supporting one channel consisting of one black interface and one red interface. The desired state is multiple channels configured and supported independently of one another.

Accessories The Unit shall be provided with data interface cabling to break out the red/black data connectors to two full size DB25 style connectors (Threshold) or RJ45 depending (Objective) on offeror solution.

Figure 4. Preferred Encryption/Decryption Interfacing Solution

Figure 5. Secondary Preference for Encryption/Decryption Interfacing Solution

Figure 6. Tertiary Preference for Encryption/Decryption Interfacing Solution

Physical Characteristics:

Enclosure The Unit enclosure shall be similar in size as the KIV-7M or smaller (5.75”W x 11.0” D x 1 11/16” H).

Connectors The power connector shall be on the back of the Unit for rack mount use.

The unit’s power connector shall be physically similar to the power connector used on the KIV-7M (threshold).

The red and black data connector(s) shall be on the back of the Unit for rack mount use.

The key fill connector shall be on the front of the unit.

The unit’s key fill connector shall be the standard DS-101 Key-fill connector

Front Panel - Indicators and Controls The front panel indicators and controls for the Unit shall be as described below:

· Key Fill

· Initiate Button sequences through keys (can also cancel key load)

· Key Status

· TEK key LEDs

· Key LED is Blinking to indicate waiting for key load

· Key LED is on to indicate key is loaded

· Key LED is off to indicate no key loaded

· Zeroize Status

· Zeroize Button to zeroize all keys

· Zeroized LED to indicate keys are zeroized

· Alarm Status

· Alarm LED

· Power

· LED as Power status indicator

· Online or Processing Indicator

· LED to acknowledge Interfaces or traffic flow

Mounting The mounting of the unit shall be proposed by the offeror, with objective not to be greater than 1U of rack space total.

Identification The labeling shall be clearly and permanently marked on the unit.

Each unit shall have a unique serial number.

The unit shall have a label on the front with the NSA nomenclature and serial number.

Maintainability Requirements:

Maintainability There shall be no periodic or scheduled maintenance required for the unit.

Parts Obsolescence No obsolete parts shall be used in the proposed solution.

Materials, processes, and parts Commercial specifications shall be used for the procurement of all non-electronic materials assemblies or parts and to specify all material, assemblies or parts used in vendor-supplied items.

Any material, assembly or part not covered by applicable commercial specifications shall be procured by specifications, specification control drawings or source control drawings prepared in accordance with MlL-STD-100

Packaging The Unit shall be packaged using best commercial practices to prevent damage during shipping and handling.

Mean Time Between Failures (MTBF) The Unit shall have a MTBF ≥ 100,000 hours, rates in accordance with MIL-HDBK-217 Requested Responses Business Information Please provide the following business information for your company:

· Company Name

· Address

· Point of Contact

· Phone Number

· Email Address

· Web Page Address

· Commercial and Government Entity (CAGE) Code

· Recommended North American Industry Classification System (NAICS Code) if other than 334220. Based on this NAICS code, identify your size status

· Small Business

· Small Disadvantaged

· Women-Owned

· Veteran-Owned

· Service Disabled Veteran Owned

· Hub-zone

· Large Business

· Specify whether your company is U.S. or foreign-owned

· Specify whether your interest in this effort is as a prime or sub-contractor

· Specify whether you are a party to any established Federal Government contract vehicle Potential Offeror Capabilities

1. Does your company have experience producing encryption/decryption devices? If so, please briefly describe.

2. Do you consider the system requirements as described in this RFI feasible?

3. Do you currently have the facilities, transportation, manufacturing, and manpower capabilities and capacity to support this acquisition? If so, please briefly describe.

4. Are you offering a fully certified off-the-shelf solution? Are you offering an off-the-shelf solution that is currently subject to the certifications process? Are you offering a developmental solution requiring NRE and certification?

5. Would you anticipate using subcontractors to partner with in this development acquisition? If so, please describe the quality control measures you have in place.

6. What would be the expected Period of Performance (PoP) to design, build, test, and certify the proposed solution?

7. What is your solution response? Your response should/may include capability, features, dimensions, and pictures of concept.

8. What other solutions are you aware of that may meet the government’s requirement? Do any of these proposed solutions have an existing Authority to Operate (ATO) in place?

9. What would you estimate your production capacity to be?

10. What product and vendor source data would be included in your solution offer?

11. Are you willing to provide a no-cost rough order of magnitude (ROM) for prototype and production units? If so, please include as part of your response, including assumptions.

12. How would you propose long-term sustainment for your solution and what warranties would you anticipate providing? If you offer a warranty, please explain the general terms of the warranty to include (as part of the no-cost ROM) and an estimate of contract costs with and without this warranty.

13. Respondents are encouraged to provide unit MTBF and a description of the analysis done to specify it.

14. Respondents should describe what, if any, buffering their solution does on ingested data before encryption and transmission.

15. Respondents are encouraged to provide any available analysis with respect to Diminishing Manufacturing Sources and Material Supply (DMSMS).

Response Submission Information

· All responses should include one cover page and formatted with size 12 Times New Roman font, one inch margins on all sides.

· No hard limit on pages.

· All information submitted shall be Unclassified. Information submitted containing restricted data distribution data should have the cover page and each page containing restricted data distribution needs to be clearly marked. Information submitted will be retained at AFLCMC and will not be returned. The Government requests the information be submitted in electronic format to Cedric Reese at cedric.reese@us.af.mil and Joseph Jones at joseph.jones.81@us.af.mil.

· RFI responses are due no later than March 31, 2023, 3:30PM EST.

Disclaimer Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract or agreement. The Government will not be obligated to pursue any particular acquisition alternative as a result of this notice. Responses to the notice will not be returned. Not responding to this notice does not preclude participation in any future solicitation, if one is issued. All responses are encouraged to keep in mind that this information is only intended to provide industry feedback. All responses are encouraged to be as direct and to the point as possible.

image4.emf

Microsoft_Visio_Drawing1.vsdx image5.emf

Microsoft_Visio_Drawing2.vsdx image1.jpeg image2.wmf image3.emf

Microsoft_Visio_Drawing.vsdx