Subject: Does Smime works fine with Windows 2000 PKI

From: "Stringfield, Robert Mr." <[email-masked]>
Date: Wed, 17 May 2000 08:26:04 +0200

It was not being able to read the text that I found interesting but the fact
that the cert came intact to me over a Listserver.  Using my DOD PKI cert I
was able to trust the Novell cert and read the tact.

Think that I also am able to use it to send SMIME mail to Bob.  How for I
have been unable to send SMIME text over Lsoft's ListServ.
--bob

	Robert L. Stringfield
	DMS/PKI 5th Signal Command
	DSN: 380-5857 FAX: 380-5858
	mailto:[email-masked]
	http://www.5sigcmd.army.mil/DMS/dms.htm
	http://www.5sigcmd.army.mil/pki/pki.htm
	http://144.170.207.251/archives/index.html
>     Truth:  We own the Night!!! - DeathStar Warriors
> 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]

[My apologies -- in the course of reconfiguring my NT to be C2 compliant,
the setting for digitally signed mail reverted to base64 encoding, leaving
some 
people who are not S/MIME capable (poor souls!) unable to read the text.
Sorry 'bout that.]

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<SNIP>>>>>>>>>>>>>>>>>>>>>>>>>>>>

---

From: Begoña Canas <[email-masked]>
Date: Thu, 18 May 2000 19:05:13 +0200

Hello,

Can anyone give me the address to subscribe to certalk list? Because this is to technical for me, I'm more interested on a list about certs, pki, ca, ... but not so
technical.

Thank you

[email-masked] wrote:

> Peter,
>
> Although I agree that such questions might better be addressed to the
> certalk list, I also agree with you that we should occasionally take the
> pulse of the industry and see who has actually rolled out commercial-grade
> products that implement that various standards.
>
> And I thank you for including the link to one of Novell's web pages, which I was
> not aware of.  I have contacted the document owner to have it updated.
>
> For the record, Novell's GroupWise 5.5 Enhancement Pack e-mail product
> supports S/MIME using EITHER the Entrust PKI solution, OR a more conventional
> PKI solution that is based on the CSP capabilities provided by MS-CAPI and Internet
> Explorer.
>
> The current version supports S/MIME version 2, and most of version 3.  Release
> schedules together with the uncertain state of CRL support by various CAs back
> in mid-1999 led us to delay the availability of CRL processing in GroupWise.
> This capability is currently scheduled for later this year.
>
> Likewise, although support for S/MIME v3's separation between encryption keys
> and digital signature keys was part of the original development, we chose not to
> feature ro recommend that usage at this time, due to the fact that Outlook Express
> seriously mishandles such dual keys, and frequently ends up sending
> an encrypted reply to the sender, using the sender's signature key.
>
> Entrust chose to try to undo that kind of mess by obligingly decrypting the message
> using the signature key, but we felt that such an approach would seriously distort
> the intent of the key usage policy, including controls over how the keys were
> generated, how they were archived, etc.  We expect to fully support dual key usage
> later this year, and we hope by that time the Outlook Express bug will have been fixed.
>
> To the best of our knowledge, GroupWise can be used to request certificates from
> any commercial CA, and our interoperability tests did not disclose any particular
> difficulties with a rather wide variety of X.509 v3 certificates.
>
> GroupWise can also consume certificates issued in bulk from Novell's own free
> Novell Certificate Server product 2.0, of course, and those certificates can also
> be used by IE for SSL mutual authentication.
>
> Sometimes it seems like it takes forever, but we have in fact come a long, long way
> from the PEM days.
>
> Regards,
>
> Bob
>
> >>> Peter Williams <[email-masked]> 05/15/00 04:46PM >>>
> http://support.microsoft.com/support/exchange/content/whitepapers/win2k_kms.
> doc
>
> Thierry,
>
> I disagree with Phil. I personally measure the state
> of open-ness of the actual PKIX industry in the US by the work
> that Microsoft does in X.509. Determining open standards adoption
> and interoperability over time is an important element of
> standards making and national infrastructure(s) planning, in my
> perhaps simplistic view.
>
> http://www.microsoft.com/Exchange/55/gen/compare.htm
> is a (Microsoft-marketing) comparison of Exchange
> and PKI with competitive products that include PKI. The
> link give a glimpse of reality of PKIX in average
> enterprise mail products.
>
> Some other URLs discussing important aspects
> of S/MIME integration into commercial-grade
> internet environments:
>
> Beyond S/MIME and onto X.400 secure stacks/networks:
> http://www.microsoft.com/exchange/55/gen/Security.htm
>
> A Lotus study of PKI and S/MIME deployment - for Identrus banks:
> http://www.lotus.com/99/session.nsf/187801dd8d07636a8525677d005a4ac8/78888aa
> 0af9ec29b8525684e0079a8d3
>
> A Study of Novell's integration with the world-class Entrust solution.
>
> http://support.novell.com/cgi-bin/search/search.pl?database_name=kb&type=HTML&docid=%03%1fF170985%3a958429713%3a%20%28%20S%2fMIME%20%29%20%20%07%01%00&byte_count=4399
>
> If you add Netscape Certificate Server and RSA Keon/VeriSign to
> the analysis, we have moved quite a long way in the US from the
> PEM days.
>
> Peter.
>
> From: Philip Hallam-Baker [mailto:[email-masked]]
> Sent: Monday, May 15, 2000 6:05 AM
> To: 'Thierry Van Doninck'; ietf-pkix
> Subject: RE: Does Smime works fine with Windows 2000 PKI
>
> Same answer, ask Microsoft, not an IETF development list.
>
> From: Thierry Van Doninck [mailto:[email-masked]]
> Sent: Thursday, May 11, 2000 7:40 AM
> To: ietf-pkix
> Subject: Does Smime works fine with Windows 2000 PKI
>
> Hi,
>
> Same message as on the smime mailing list.
> Has any of you good people any info on Windows 2000 PKI ?
>
> Thanks,
>
> Thierry
>
> ========================================================================
> ============
>
> Hi everybody,
>
> Just a question :
>
> Is there any known issues using S/MIME with Win2000PKI-certificates ?
> More generally, are Win2000 certificates usable with (and understood by
> ) the others mailers (especially Lotus Notes, Netscape, Eudora
> +plug-in?)
>
> Isn't Baltimore Unicert a "better choice" due to its greater
> compatibility ?
>
> Any advices are welcome.
>
> Regards,
>
> Laurent Deffranne

--
----------------------------------------
Begoña Canas
Sistemas Internet
Euskaltel
Tfno: 94 4011465
e-mail: [email-masked]
----------------------------------------