Subject: Does Smime works fine with Windows 2000 PKI

From: Thierry Van Doninck <[email-masked]>
Date: 11 May 2000 13:39:53 +0200

Hi,

Same message as on the smime mailing list.
Has any of you good people any info on Windows 2000 PKI ?

Thanks,

Thierry

====================================================================================

Hi everybody,

Just a question :

Is there any known issues using S/MIME with Win2000PKI-certificates ?
More generally, are Win2000 certificates usable with (and understood by ) the others mailers (especially Lotus Notes, Netscape, Eudora +plug-in?)

Isn't Baltimore Unicert a "better choice" due to its greater compatibility ?

Any advices are welcome.

Regards,

Laurent Deffranne

---

From: Philip Hallam-Baker <[email-masked]>
Date: Mon, 15 May 2000 06:04:40 -0700

Same answer, ask Microsoft, not an IETF development list.

-----Original Message-----
From: Thierry Van Doninck [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 7:40 AM
To: ietf-pkix
Subject: Does Smime works fine with Windows 2000 PKI

Hi,

Thanks,

Thierry

========================================================================
============

Hi everybody,

Just a question :

Is there any known issues using S/MIME with Win2000PKI-certificates ?
More generally, are Win2000 certificates usable with (and understood by
) the others mailers (especially Lotus Notes, Netscape, Eudora
+plug-in?)

Isn't Baltimore Unicert a "better choice" due to its greater
compatibility ?

Any advices are welcome.

Regards,

Laurent Deffranne

---

From: Peter Williams <[email-masked]>
Date: Mon, 15 May 2000 15:46:39 -0700

http://support.microsoft.com/support/exchange/content/whitepapers/win2k_kms.
doc

Thierry,

I disagree with Phil. I personally measure the state
of open-ness of the actual PKIX industry in the US by the work
that Microsoft does in X.509. Determining open standards adoption 
and interoperability over time is an important element of 
standards making and national infrastructure(s) planning, in my 
perhaps simplistic view.

http://www.microsoft.com/Exchange/55/gen/compare.htm
is a (Microsoft-marketing) comparison of Exchange
and PKI with competitive products that include PKI. The
link give a glimpse of reality of PKIX in average
enterprise mail products.

Some other URLs discussing important aspects
of S/MIME integration into commercial-grade
internet environments:

Beyond S/MIME and onto X.400 secure stacks/networks:
http://www.microsoft.com/exchange/55/gen/Security.htm

A Lotus study of PKI and S/MIME deployment - for Identrus banks:
http://www.lotus.com/99/session.nsf/187801dd8d07636a8525677d005a4ac8/78888aa
0af9ec29b8525684e0079a8d3

A Study of Novell's integration with the world-class Entrust solution.

http://support.novell.com/cgi-bin/search/search.pl?database_name=kb&type=HTM
L&docid=%03%1fF170985%3a958429713%3a%20%28%20S%2fMIME%20%29%20%20%07%01%00&b
yte_count=4399

If you add Netscape Certificate Server and RSA Keon/VeriSign to 
the analysis, we have moved quite a long way in the US from the 
PEM days.

Peter.

-----Original Message-----
From: Thierry Van Doninck [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 7:40 AM
To: ietf-pkix
Subject: Does Smime works fine with Windows 2000 PKI

Hi,

Thanks,

Thierry

Hi everybody,

Just a question :

Any advices are welcome.

Regards,

Laurent Deffranne

---

From: [email-masked]
Date: Tue, 16 May 2000 14:12:00 -0600

[My apologies -- in the course of reconfiguring my NT to be C2 compliant,
the setting for digitally signed mail reverted to base64 encoding, leaving some 
people who are not S/MIME capable (poor souls!) unable to read the text.
Sorry 'bout that.]

Peter,

Although I agree that such questions might better be addressed to the 
certalk list, I also agree with you that we should occasionally take the 
pulse of the industry and see who has actually rolled out commercial-grade 
products that implement that various standards.

And I thank you for including the link to one of Novell's web pages, which I was
not aware of.  I have contacted the document owner to have it updated.

For the record, Novell's GroupWise 5.5 Enhancement Pack e-mail product  
supports S/MIME using EITHER the Entrust PKI solution, OR a more conventional
PKI solution that is based on the CSP capabilities provided by MS-CAPI and Internet 
Explorer.

The current version supports S/MIME version 2, and most of version 3.  Release
schedules together with the uncertain state of CRL support by various CAs back 
in mid-1999 led us to delay the availability of CRL processing in GroupWise.
This capability is currently scheduled for later this year. 

Likewise, although support for S/MIME v3's separation between encryption keys 
and digital signature keys was part of the original development, we chose not to 
feature ro recommend that usage at this time, due to the fact that Outlook Express 
seriously mishandles such dual keys, and frequently ends up sending 
an encrypted reply to the sender, using the sender's signature key.

Entrust chose to try to undo that kind of mess by obligingly decrypting the message 
using the signature key, but we felt that such an approach would seriously distort
the intent of the key usage policy, including controls over how the keys were 
generated, how they were archived, etc.  We expect to fully support dual key usage
later this year, and we hope by that time the Outlook Express bug will have been fixed.

To the best of our knowledge, GroupWise can be used to request certificates from
any commercial CA, and our interoperability tests did not disclose any particular
difficulties with a rather wide variety of X.509 v3 certificates.

GroupWise can also consume certificates issued in bulk from Novell's own free
Novell Certificate Server product 2.0, of course, and those certificates can also 
be used by IE for SSL mutual authentication.

Sometimes it seems like it takes forever, but we have in fact come a long, long way 
from the PEM days.

Regards,

Bob

>>> Peter Williams <[email-masked]> 05/15/00 04:46PM >>>
http://support.microsoft.com/support/exchange/content/whitepapers/win2k_kms