Subject: DoD Bridge Certification Authority Phase II Demonstrations

From: "Fillingham, David W." <[email-masked]>
Date: Fri, 6 Apr 2001 10:48:51 -0400

For the last few years, the National Security Agency has led the development
of Bridge Certification Authority (BCA) technology demonstrations.  In 1999,
Phase One of the Department of Defense BCA Technology Demonstration showed
the technical feasibility of achieving signed e-mail interoperability using
multi-vendor cross-certification in conjunction with chained directory
systems.
 
Phase Two of the demonstration is now ready to be shown.  Phase Two of the
DoD Bridge CA Phase II Technology Demonstration includes: 
 
Technologies: 
 
--  Certificate chain building in complex certificate graphs;
--  Integration of both mesh-style cross-certified PKIs and hierarchical
PKIs;
--  Multi-signature/hash algorithm processing in certificate chains;
--  Certificate acceptance/rejection based on Certificate Policy processing,
including policy mapping;
--  Transitive trust limitation using Name Constraints processing;
--  Access Control using X.509 compliant attribute certificates (same
attribute certificates used for e-mail and web based access control);
--  E-mail access control using S/MIME V3 labeling;
--  E-mail encryption using public key certificates authenticated via a
Bridge Certification Authority;
--  Border Directories; 
--  Multivendor directory interoperation via X.500 chaining; and,
--  Transparent sharing of certificate revocation information across several
PKIs using products of multiple PKI vendors.
 
Client Applications: 
 
--  Baltimore Technologies MailSecure enabled Microsoft Outlook
--  Entrust Enabled Microsoft Outlook
--  Getronics S/MIME Freeware Library, Certificate Management Library, and
Access Control Library enabled Qualcomm Eudora
--  Getronics Certificate Management Library and Access Control Library
enabled Netscape Web Server
 
Freeware Libraries:
 
--  Cygnacom Certificate Path Development Library
     <http://www.cygnacom.com/products/index.htm>

--  Getronics S/MIME (Version 3) Freeware Library
     <http://www.getronicsgov.com/hot/sfl_home.htm>

--  Getronics Certificate Management Library
     <http://www.getronicsgov.com/hot/cml_home.htm>

-- Getronics Access Control Library
          <http://www.getronicsgov.com/hot/acl_home.htm>

CA vendor interoperability demonstrations: 
 
--  Baltimore Technologies 
--  Entrust Technologies
--  Motorola 
--  SPYRUS 
 
Directory Interoperability:

--  Entrust ICL
--  Entegrity Safepages Directory

Demonstrations will be held at the following locations and dates (note that
you MUST REGISTER to attend!  Registration information is provided below):
 
----------
CygnaCom
Suite 100 West
7927 Jones Branch Dr.
McLean, Virginia
 
Directions to CygnaCom are located at:
<http://www.cygnacom.com/contact/directions.htm> 
 
26 April 2001 - 0900
 
26 April 2001 - 1300
 
16 May 2001 - 0900
 
16 May 2001 - 1300
 
---------
Getronics Government Solutions
141 National Business Parkway, Suite 210
Annapolis Junction, Maryland
 
From Washington DC: Take I-95 north; take MD Rt 32 east exit; take Dorsey
Run exit; at stop sign turn left on Dorsey Run; at stop light turn right on
Guilford Road which becomes National Business Pkwy. 
 
From Baltimore: Take BW Parkway (295) south; take MD Rt 32 west exit; stay
in right lane of the exit which runs into National Business Pkwy; make a
right on National Business Pkwy.
 
30 April 2001 - 1300
 
8 May 2001 - 0900
 
8 May 2001 - 1300
 
24 May 2001 - 0900
 
24 May 2001 - 1300 
 
---------
 
All showings last about half a day - with a mixture of conference room
briefings and laboratory demonstrations.
 
We are limited by available demonstration space to an absolute maximum of 20
participants at each showing.  
 
IMPORTANT:  PLEASE REGISTER WITH LISA FAULKNER ([email-masked]
<mailto:[email-masked]>) AND MYSELF ([email-masked]
<mailto:[email-masked]>) IF YOU PLAN TO ATTEND.  IF YOU DO NOT
REGISTER TO ATTEND, YOU WILL NOT BE ADMITTED TO THE DEMONSTRATION.
 
Please provide the following information to register:
 
--  Name
--  Organization
--  E-mail address
--  Date and time of the demonstration showing you wish to attend (with
alternates, if possible)
 
We look forward to seeing you at the demonstration!
 
Dave Fillingham
NSA

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 9 Apr 2001 20:07:51 +0200

David, 
This is indeed an ambitious project. Unfortunately I doubt that the Bridge model has any relevance in 
the private sector that for inter-organization communication, is more likely to deploy domain-based 
PKI-solutions, that have the major advantage of already being supported by global TTPs which makes
domain security solutions useful for organizations of any size. I.e. VeriSign's issuance of web-server
certificates is "approximately" what is needed. 

That domain security is incompatible with most current digital signature laws is a pity.  Particularly for
the lawyers who created them.  :-)

Using domain security, tracing, message archiving, and user-control is essentially built-in.

A further advantage of domain security models is that client security solutions can develop in a
different pace at each organization.  As they have for current Internet-banks that is so far the only
large-scale (almost) secure multi-organization transaction-environment on the Internet.

The question that comes to my mind is: Will all Governments in the world continue to adopt the
"All-speak-with-all-PKI" approach in spite of the fact that the private sector probably have shunned it
due to complexity, privacy concerns, lack of control, and cost?

Regard
Anders Rundgren
X-OBI  read: http://www.x-obi.com/purple  run: http://buyer.x-obi.com 

----- Original Message ----- 
From: Fillingham, David W. 
To: [email-masked]' ; 'KPCMWG' ; 'DoD PKI TWG' ; [email-masked]' ; 'Bridge CA Mail List' ; 'BCA Integration' ; * ALL FIREBURST USERS * ; 'Steve Capps' ; Wagner, Clark J. ; [email-masked]' ; [email-masked]' ; 'Steve Hanna (SUN)' ; 'Susan Dernik' 
Sent: Friday, April 06, 2001 16:48
Subject: DoD Bridge Certification Authority Phase II Demonstrations

For the last few years, the National Security Agency has led the development of Bridge Certification Authority (BCA) technology demonstrations.  In 1999, Phase One of the Department of Defense BCA Technology Demonstration showed the technical feasibility of achieving signed e-mail interoperability using multi-vendor cross-certification in conjunction with chained directory systems.
 
Phase Two of the demonstration is now ready to be shown.  Phase Two of the DoD Bridge CA Phase II Technology Demonstration includes: 
 
Technologies: 
  
--  Certificate chain building in complex certificate graphs; 
--  Integration of both mesh-style cross-certified PKIs and hierarchical PKIs; 
--  Multi-signature/hash algorithm processing in certificate chains; 
--  Certificate acceptance/rejection based on Certificate Policy processing, including policy mapping;
--  Transitive trust limitation using Name Constraints processing;
--  Access Control using X.509 compliant attribute certificates (same attribute certificates used for e-mail and web based access control);
--  E-mail access control using S/MIME V3 labeling;
--  E-mail encryption using public key certificates authenticated via a Bridge Certification Authority;
--  Border Directories;
--  Multivendor directory interoperation via X.500 chaining; and, 
--  Transparent sharing of certificate revocation information across several  PKIs using products of multiple PKI vendors.
 
Client Applications: 
  
--  Baltimore Technologies MailSecure enabled Microsoft Outlook 
--  Entrust Enabled Microsoft Outlook
--  Getronics S/MIME Freeware Library, Certificate Management Library, and Access Control Library enabled Qualcomm Eudora
--  Getronics Certificate Management Library and Access Control Library enabled Netscape Web Server 
  
Freeware Libraries: 

  
Directory Interoperability: 
--  Entrust ICL 
--  Entegrity Safepages Directory 
Demonstrations will be held at the following locations and dates (note that you MUST REGISTER to attend!  Registration information is provided below):
 
---------- 
CygnaCom 
Suite 100 West 
7927 Jones Branch Dr.
McLean, Virginia 
  
Directions to CygnaCom are located at:  <http://www.cygnacom.com/contact/directions.htm> 
  
26 April 2001 - 0900 
  
26 April 2001 - 1300 
  
16 May 2001 - 0900 
  
16 May 2001 - 1300 
  
--------- 

  
30 April 2001 - 1300 
  
8 May 2001 - 0900 
  
8 May 2001 - 1300 
  
24 May 2001 - 0900 
  
24 May 2001 - 1300 
  
--------- 
  
All showings last about half a day - with a mixture of conference room briefings and laboratory demonstrations. 
  
We are limited by available demonstration space to an absolute maximum of 20 participants at each showing.  
  
IMPORTANT:  PLEASE REGISTER WITH LISA FAULKNER ([email-masked] <mailto:[email-masked]>) AND MYSELF ([email-masked] <mailto:[email-masked]>) IF YOU PLAN TO ATTEND.  IF YOU DO NOT REGISTER TO ATTEND, YOU WILL NOT BE ADMITTED TO THE DEMONSTRATION.

--  Name 
--  Organization 
--  E-mail address 
--  Date and time of the demonstration showing you wish to attend (with alternates, if possible) 

Dave Fillingham 
NSA