ML17223A287

Use of Encryption Software for Electronic Submission of Safeguards Information

ML17223A287
Person / Time
Site:	Davis Besse
Issue date:	08/31/2017
From:	Blake Purnell Plant Licensing Branch III
To:	Bezilla M FirstEnergy Nuclear Operating Co
Purnell B, 415-1380
References
CAC MG0078
Download: ML17223A287 (3)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 August 31, 2017 Mr. Mark B. Bezilla Site Vice President FirstEnergy Nuclear Operating Company Mail Stop A-DB-3080 5501 N. State Route 2 Oak Harbor, OH 43449-9760

SUBJECT:

DAVIS-BESSE NUCLEAR POWER STATION, UNIT NO. 1 - USE OF ENCRYPTION SOFTWARE FOR ELECTRONIC TRANSMISSION OF SAFEGUARDS INFORMATION (CAC NO. MG0078)

Dear Mr. Bezilla:

By letter dated August 1, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17215A234), FirstEnergy Nuclear Operating Company (FENOC),

requested that the U.S. Nuclear Regulatory Commission (NRC) approve the use of Symantec Endpoint Encryption, Version 11.1.2, or the latest validated version, for the electronic transmission of safeguards information (SGI) at the Davis-Besse Nuclear Power Station, Unit No. 1. This request was made in accordance with Paragraph 73.22(f)(3), "External transmission of documents and material," of Title 10 of the Code of Federal Regulations (10 CFR).

The regulations in 10 CFR 73.22(f)(3) describe requirements for the transmission of SGI outside an authorized place of use or storage. The regulations in 10 CFR 73.22(f)(3) state, in part:

Except under emergency or extraordinary conditions, Safeguards Information shall be transmitted outside an authorized place of use or storage only by NRC approved secure electronic devices, such as facsimiles or telephone devices, provided that transmitters and receivers implement processes that will provide high assurance that Safeguards Information is protected before and after the transmission or electronic mail through the internet, provided that the information is encrypted by a method (Federal Information Processing Standard [FIPS] 140-2 or later) approved by the appropriate NRC Office; the information is produced by a self-contained secure automatic data process system; and transmitters and receivers implement the information handling processes that will provide high assurance that Safeguards Information is protected before and after transmission.

Guidance to licensees on the electronic transmission of SGI is provided in NRC Regulatory Issue Summary (RIS) 2002-15, Revision 1, "NRC Approval of Commercial Data Encryption Products for the Electronic Transmission of Safeguards Information," dated January 26, 2006 (ADAMS Accession No. ML050460031 ).

As stated in FENOC's letter, Symantec Endpoint Encryption, Version 11.1.2, was developed with PGP Cryptographic Engine Software, Version 4.3, and complies with FIPS 140-2 as validated by the National Institute of Standards and Technology (NIST) Consolidated Certificate No. 0053. A copy of the certificate was enclosed with FENOC's letter.

M. Bezilla The NRC approves only those cryptographic algorithms approved by NIST. Based on the NIST validation that the encryption software complies with FIPS 140-2, the NRC staff finds that the use of Symantec Endpoint Encryption, Version 11.1.2, is acceptable to use for electronic transmission of SGI in accordance with 10 CFR 73.22(f)(3). As described in RIS 2002-15, newer versions of encryption software may be used without prior NRC approval, provided that it is documented that the newer version uses the same cryptographic module as the current version. Therefore, in accordance with 10 CFR 73.22(f)(3), the staff approves the use of Symantec Endpoint Encryption, Version 11.1.2, at Davis-Besse Nuclear Power Station, Unit No. 1. If NIST no longer approves certain cryptographic algorithms, the NRC also does not approve use of that cryptographic algorithm.

If you have any questions, please contact me at 301-415-1380.

Sincerely,

/J£ /tvv' Blake Purnell, Project Manager Plant Licensing Branch Ill Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-346 cc: Distribution via Listserv

M. Bezilla

SUBJECT:

DAVIS-BESSE NUCLEAR POWER STATION, UNIT NO. 1 - USE OF ENCRYPTION SOFTWARE FOR ELECTRONIC SUBMISSION OF SAFEGUARDS INFORMATION (CAC NO. MG0078) DATED AUGUST 31, 2017 DISTRIBUTION:

PUBLIC RidsACRS_MailCTR Resource RidsNrrDorl Resource RidsNrrDorlLpl3 Resource RidsNrrLASRohrer Resource RidsNrrPMDavisBesse Resource RidsRgn3MailCenter Resource DParsons, NSIR RNorman, NSIR ADAMS Access1on N0. ML17223A287 *b1yema1*1 OFFICE NRR/DORL/LPL3/PM NRR/DORL/LPL3/LA NSIR/DSO/ISB/BC NAME BPurnell SRohrer DParsons*

DATE 08/15/17 08/15/17 08/15/17 OFFICE OGC (NLO) NRR/DORL/LPL3/BC NRR/DORL/LPL3/PM NAME BMizuno DWrona BPurnell DATE 08/16/17 08/30/17 08/31/17 OFFICIAL RECORD COPY