Due to changes announced recently by USPS, patches must be installed in order to continue to use monthly USPS address updates (also known as "DataPacks") with SAS^® Data Management Products beyond July 2017.

If your organization does not license United States address verification functionality as part of your SAS Data Management deployment, you do not need to take any action.

Details

To improve the security levels of all of its products, the USPS is changing the digital signatures on USPS address reference data in 2017. The USPS is moving from a digital signature of SHA-1 to SHA-256. SHA stands for secure hash algorithm, and 256 indicates the more secure standard.

Because SAS licenses address data from the USPS to support United States address verification functionality in several products, USPS address verification in SAS Data Management offerings will no longer work with older DataPacks after July 2017.

What SAS Data Management functions will be affected?

Here is a list of affected functionality found in offerings that include DataFlux^® Data Management Studio and DataFlux^® Data Management Server:

• Address Verification and Address Update nodes using USPS data packs
• National Change of Address (NCOA^Link) from USPS
• Residential Delivery Indicator (RDI) data from USPS

If you use these features and are on version 2.3 or later, you must install patches as described in this document to all DataFlux Data Management Studio and DataFlux Data Management Server installations.

When will the patches become available?

The patches are available now. 

Where are the patches located?

For DataFlux Data Management Studio and DataFlux Data Management Server version 2.7, the recommended approach is to apply Update 1 for v2.7 (see Installation Note 61294).  Click the Hot Fix tab in this note to access the specific hot fix instead.

For DataFlux Data Management Studio and DataFlux Data Management Server versions 2.6, or 2.5.1, click the Hot Fix tab in this note to access the hot fix.

For DataFlux Data Management Studio and DataFlux Data Management Server versions 2.3 or 2.4, downloads are available on the SAS Data Management / DataFlux Path Downloads for products with B & C Support Levels page. Search using the following fix numbers:

• DataFlux Data Management Studio 2.3 - 21184
• DataFlux Data Management Server 2.3 - 21185
• DataFlux Data Management Studio 2.4 - 21186
• DataFlux Data Management Server 2.4 - 21190

Note: For customers using National Change of Address (NCOA^Link) from USPS, open a support track to request an additional NCOA-specific patch. 

What about the older Data Management Products such as DataFlux^® dfPower^® Studio 8.2.3 or SAS^® Data Management Platform 2.2?

No patches are planned for Support Level C Data Management products. This is consistent with SAS Technical Support Services and Policies. These products will no longer be able to use monthly USPS data pack updates newer than July 2017. USPS data packs from July 2017 or earlier might continue to be used with older products but results will degrade over time as actual USPS address information starts to deviate from the information contained in the older data packs. Customers who find themselves in this situation must upgrade their DataFlux Data Management Studio and DataFlux Data Management Server environments to version 2.3 at a minimum. Preferably, customers will upgrade to the latest version of SAS Data Management software, which is currently version 2.7.

Will there be a transition period?

In July 2017, the USPS data packs will be made available in either type of digital signature: SHA-256 or SHA-1. Patches are needed in order to use the USPS data packs with the SHA-256 digital signature. Apply the relevant patches and perform any desired testing during this transition period. Starting on August 1, 2017, new USPS data packs cannot be used without the patches in place on affected software.

Note: Only the encoding of the USPS data packs is being changed, so there are no accuracy or performance impacts although there might be a small number of differences when comparing SHA-1 and SHA-256 results. These differences will either produce a match on the SHA-1 data and a no-match on the SHA-256 data, or vice versa. The number of differences should be minimal and are not cause for concern. For more details, see this announcement from USPS.

Operating System and Release Information

A fix for this issue for DataFlux Data Management Studio 2.7 is available at:

A fix for this issue for DataFlux Data Management Server 2.7 is available at:

A fix for this issue for DataFlux Data Management Studio 2.6 is available at:

A fix for this issue for DataFlux Data Management Server 2.6 is available at:

A fix for this issue for DataFlux Data Management Studio 2.5_M1 is available at (search for 58733):

A fix for this issue for DataFlux Data Management Server 2.5_M1 is available at (search for 58733):