ML18309A362

Use of Encryption Software for Electronic Transmission of Safeguards Information

ML18309A362
Person / Time
Site:	Beaver Valley
Issue date:	11/16/2018
From:	Booma Venkataraman Plant Licensing Branch 1
To:	Bologna R FirstEnergy Nuclear Operating Co
Venkataraman, B, NRR/DORL/LPL1
References
EPID L-2018-LRO-0045
Download: ML18309A362 (3)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 November 16, 2018 Mr. Richard D. Bologna Site Vice President FirstEnergy Nuclear Operating Company Beaver Valley Power Station Mail Stop A-BV-SSB P.O. Box 4, Route 168 Shippingport, PA 15077

SUBJECT:

BEAVER VALLEY NUCLEAR POWER STATION, UNIT NOS. 1 AND 2-USE OF ENCRYPTION SOFTWARE FOR ELECTRONIC TRANSMISSION OF SAFEGUARDS INFORMATION (EPID L-2018-LR0-0045)

Dear Mr. Bologna:

By letter dated December 12, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17352A423), FirstEnergy Nuclear Operating Company (FENOC) requested that the U.S. Nuclear Regulatory Commission (NRC) approve the use of Symantec Endpoint Encryption Version 11.1.2,.or the latest validated version, to process and transmit safeguards information (SGI) at Beaver Valley Power Station, Unit Nos. 1 and 2. This request was made pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 73.22(f),

"External transmission of documents and material."

The regulations in 10 CFR 73.22(f)(3) describe requirements for the transmission of SGI outside an authorized place of use or storage. Paragraph (f)(3) of 10 CFR 73.22 states, in part:

Except under emergency or extraordinary conditions, Safeguards Information shall be transmitted outside an authorized place of use or storage only by NRC approved secure electronic devices, such as facsimiles or telephone devices, provided that transmitters and receivers implement processes that will provide high assurance that Safeguards Information is protected before and after the transmission or electronic mail through the internet, provided that the information is encrypted by a method (Federal Information Processing Standard [FIPS] 140-2 or later) approved by the appropriate NRC Office; the information is produced by a self contained secure automatic data process system; and transmitters and receivers implement the information handling processes that will provide high assurance that Safeguards Information is protected before and after transmission.

Guidance to licensees on the electronic transmission of SGI is provided in NRC Regulatory Issue Summary 2002-15, Revision 1, "NRC Approval of Commercial Data Encryption Products for the Electronic Transmission of Safeguards Information," dated January 26, 2006 (ADAMS Accession No. ML050460031 ).

R. Bologna As stated in the FENOC letter, Symantec Endpoint Encryption Version 11.1.2 was developed with PGP Cryptographic Engine Software, Version 4.3, and complies with FIPS 140-2 requirements, as validated by the National Institute of Standards and Technology (NIST}

Consolidated Certificate No. 0053. A copy of the certificate was enclosed with the FENOC letter.

The NRC approves only those cryptographic algorithms approved by NIST. Based on the NIST validation that the encryption software complies with FIPS 140-2, the NRC staff determines that the use of Symantec Endpoint Encryption, Version 11.1, is acceptable to use for electronic transmission of SGI in accordance with 10 CFR 73.22(f)(3). As described in Regulatory Issue Summary 2002-15, newer versions of encryption software may be used without prior NRC approval, provided that it is documented that the newer version uses the same cryptographic module as the current version. Therefore, in accordance with 10 CFR 73.22(f)(3), the NRC staff approves the use of Symantec Endpoint Encryption, Version 11.1 at Beaver Valley Power Station, Unit Nos. 1 and 2. If NIST no longer approves certain cryptographic algorithms, the NRC also does not approve use of that cryptographic algorithm.

If you have any questions, please contact me at 301-415-2934 or by e-mail to Booma.Venkataraman@nrc.gov.

Sincerely, Booma Venkataraman, Project Manager Plant Licensing Branch 1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-334 and 50-412 cc: Listserv

ML18309A362 *b e-mail OFFICE NRR/DORL/LPL 1/PM NRR/DORL/LPL 1/LA NSIR/DSO/ISB/BC*

NAME BVenkataraman LRonewicz DParsons DATE 11/05/2018 11/06/2018 11/02/2018 OFFICE NRR/DORL/LPL 1/BC NRR/DORL/LPL 1/PM NAME JDanna BVenkataraman DATE 11/14/2018 11/16/2018