JA 25-5F8.pdf

DMEA # 25-28

Defense Microelectronics Activity 4234 54th Street, McClellan, CA 95652

SOW/PWS # 25-5F8

Sole Source Justification

1. Agency and Contracting Activity: Office of Secretary of Defense, Defense Microelectronics Activity (DMEA).

2. Nature/Description of Action: The proposed action is a firm-fixed-price (FFP) contract award to WolfSSL Inc. on a sole source basis. This action is to procure perpetual software licenses, specialized FIPS-140-3 certification services, and multi-year support and maintenance.

3. Description of Supplies/Services: This procurement is for a specialized software encryption library and associated services for the DMEA-developed Secure Data Transfer Device (S-DTD).

The S-DTD is a critical technology providing cybersecurity for numerous USAF platforms, including the C-5, C-130, F-22, and B-2. The requirement includes:

Software Licenses: Perpetual, royalty-free licenses for wolfCrypt FIPS 140-3, wolfBoot, and wolfTPM software.

FIPS-140-3 Certification Services: Expert services to port, validate, and manage the submission process to the Cryptographic Module Validation Program (CMVP) to certify the software on DMEA's specific hardware/software Operating Environment (OE).

Support & Maintenance: A base year plus three (3) one-year option periods for premium support, including bug fixes, security patches, technical consultation, and access to new releases.

The total estimated value is $303,000.00 (including all option years).

4. Authority Cited:

FAR 6.302-1(a)(2)

5. Reason for Authority Cited: WolfSSL Inc. is the only known source capable of providing the required combination of software products and specialized services that meet all of DMEA's highly specific, interconnected requirements. An alternative solution would not be able to satisfy the government's minimum needs due to a unique combination of technical constraints:

The software must be optimized for a specific embedded system (STM32H7 series microcontroller), operate without a file system, and be resilient to sporadic power.

The software must support a comprehensive set of advanced cryptographic functions, including the PB7 file format, which is a key differentiator not found in other embedded libraries.

Crucially, the requirement is for both a FIPS-140-3 certified product and the vendor's direct services to achieve FIPS-140-3 certification on DMEA's unique S-DTD hardware.

Only the original developer, WolfSSL, possesses the proprietary knowledge of the source code and the established relationship with validation labs to efficiently perform this re-certification service on a new platform.

Attempting to use another vendor or an open-source solution would require a complete redesign and a cost-prohibitive, high-risk development and certification effort from the ground up, causing unacceptable delays to a critical national security program.

6. Efforts to Obtain Competition: Comprehensive market research was conducted by government technical and contracting experts. In accordance with FAR 6.302-1(d)(2), this approved justification will be posted on SAM.gov. The research confirmed that competition is not feasible for this unique requirement.

7. Fair and Reasonable Cost Determination: I hereby determine that the anticipated cost to the Government for this contract action will be fair and reasonable. This determination is based upon previously awarded contracts.

Typed Name: Michael Hallock

Title: Contracting Officer

8. Market Research: Market research concluded that only WolfSSL Inc. can meet the government’s requirements. The research analyzed multiple market segments:

Open-Source Solutions: Lack FIPS-140-3 certification and the professional certification support services required.

General Purpose Libraries (OpenSSL, Bouncy Castle, Microsoft CNG): Are not optimized for the required resource-constrained embedded environment and lack the required resilience and specific features.

Embedded-Specific Libraries: Other embedded solutions lack the comprehensive feature set (notably PB7 support and full certificate management) and do not have both an existing FIPS-140-3 certification and the associated service offering for re-certification on a new OE.

Hardware Vendor Solutions (STMicroelectronics): Provide only basic cryptographic functions and do not offer the complete software ecosystem or FIPS certification services.

No other source could provide a solution that meets all eight mandatory salient characteristics outlined in the requirements documentation.

9. Other Facts: This procurement is critical to maturing the Secure Data Transfer Device (S- DTD), which is essential for the cybersecurity of numerous high-priority USAF platforms.

Delays in obtaining FIPS-140-3 certification would reduce the cybersecurity posture of these aircraft and risk mission degradation due to the obsolescence of the commercial PCMCIA cards they currently rely on.

10. Listing of Sources:

WolfSSL Inc.

10016 Edmonds Way, Suite C-300

Edmonds, WA 98020

11. Actions to Increase Competition: For future, similar requirements, DMEA will continue to conduct market research to identify any new or emerging technologies or vendors that could provide competition in the embedded cryptographic market.

12. Contracting Officer Certification: I certify that this justification is accurate and complete to the best of the contracting officer’s knowledge and belief.

Typed Name: Michael Hallock

Title: Contracting Officer