------- Forwarded Message From: James M Galvin To: ietf-announce@cnri.reston.va.us, psrg-interest@isi.edu, pem-dev@TIS.COM, rsaref-users@rsa.com, saag@TIS.COM, tispem-users@TIS.COM Subject: TIS/PEM FAQ as of 8 June 1993 Date: Tue, 08 Jun 93 16:21:10 -0400 - -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-ID-Asymmetric: MFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNRDE kMCIGA1UEChMbVHJ1c3RlZCBJbmZvcm1hdGlvbiBTeXN0ZW1zMREwDwYDVQQLEwh HbGVud29vZA==,02 MIC-Info: RSA-MD5,RSA,BpCu5i/vNJFNX64bj4KuRr8Jm05gdfjIIO5WQaSTXAG kx09ivq97GtmdksgshOkdqynlLxTSph0s6DtNN5girn2Q/u08q44XLYbk6vYxA9g 37w/L1leqw7CldPLPOtQT Many of you will recall the announcement of the availability of TIS/PEM, the Internet reference implementation of PEM, distributed last week. Included below is the first TIS/PEM FAQ. We are posting it this one time to the same mailing lists that received the announcement last week. In the future, it will be posted to the mailing list and several appropriate newsgroups. We hope you find this useful. Thanks.  TIS/PEM FAQ Last updated 8 June 1993 Send questions and comments to tispem-support@tis.com Questions answered: 1) What is Privacy Enhanced Mail (PEM)? 2) Where are the PEM standards defined? 3) Is there a forum for PEM developers and others interested in the PEM standards? 4) Are there implementations of PEM available? 5) How do I get TIS/PEM? 6) Why is TIS/PEM only available in the US and Canada? 7) Are special privileges (e.g., root access) required to install TIS/PEM? 8) What about integrating TIS/PEM into mail user agents? 9) What about DOS and other non-UNIX platforms? 10) What about certificates? 11) What is a distinguished name? 12) What is a Certification Authority (CA)? 13) What does a PCA do and how are they differentiated? 14) What PCAs are available? 15) How much does it cost to sign up under a PCA? 16) What if I have questions about TIS PCA? 17) Is there a mailing list for TIS/PEM users? 18) What if I have questions about or problems with TIS/PEM? 1 Q: What is Privacy Enhanced Mail (PEM)? A: PEM is an Internet standard for providing security services to electronic mail. It uses cryptographic techniques to provide message integrity checking, originator authentication, and confidentiality. It lets you know that a message hasn't been changed, who it's from, and, optionally, allows you to keep it secret from all but the intended recipients. 2 Q: Where are the PEM standards defined? A: There is a set of Proposed Standard RFCs (Internet standards documents) that specify PEM. The four new documents are RFCs 1421 (obsoletes 1113), 1422 (obsoletes 1114), 1423 (obsoletes 1115), and 1424 (new). These documents may be found in your favorite RFC repository. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to "rfc-info@ISI.EDU" with the message body "help: ways_to_get_rfcs". For example: To: rfc-info@ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs 3 Q: Is there a forum for PEM developers and others interested in the PEM standards? A: Yes, there is an electronic mailing list that is used to discuss the PEM specifications, implementation issues, and it is used to conduct some of the business of the Internet Engineering Task Force (IETF) PEM working group. Send a message to "pem-dev-request@tis.com" if you would like to be added to the list. 4 Q: Are there implementations of PEM available? A: Yes, implementations are being made available as you read this. Trusted Information Systems (TIS), under ARPA sponsorship and in cooperation with RSA Data Security Incorporated (RSADSI), has released a reference implementation of Privacy Enhanced Mail (TIS/PEM) to the Internet community. TIS/PEM is a UNIX-based implementation that has been integrated with Rand MH 6.7.2 and is easily integrated into other mail user agents. TIS/PEM is distributed in source form. It is openly available within the United States and Canada for non-commercial use (not for resale). 5 Q: How do I get TIS/PEM? A: TIS/PEM is available via anonymous ftp in the United States and Canada to US and Canadian citizens and people with a US "green card." To retrieve TIS/PEM please FTP to host: ftp.tis.com login: anonymous and retrieve the files pub/PEM/README pub/PEM/LICENSE pub/PEM/BUGS The README file contains further instructions. 6 Q: Why is TIS/PEM only available in the US and Canada? A: The export from the United States of the cryptography used in TIS/PEM is controlled by the United States government. 7 Q: Are special privileges (e.g., root access) required to install TIS/PEM? A: TIS/PEM can be installed in multi-user mode, which is identified by the use of a single, system-wide, shared database of cryptographic and administrative information maintained by one or more privileged users called certificate administrators, and single-user mode, which allows individuals to maintain their own databases of cryptographic and administrative information. Multi-user mode installation requires privileges, while single-user mode installation does not. 8 Q: What about integrating TIS/PEM into mail user agents? A: TIS/PEM has been integrated with MH 6.7.2 and is easily integrated with other mail user agents. If you integrate TIS/PEM with a popular mail user agent, we would be happy to make it available to others. Additionally, a set of filters, similar to the UNIX cat command, that allow you to apply and remove PEM enhancements (enhance and de-enhance) text files are provided. These filters make it possible to use PEM with mail user agents that are not PEM aware. 9 Q: What about DOS and other non-UNIX platforms? A: TIS/PEM is currently limited to UNIX, but we are pursuing porting it to other operating systems. 10 Q: What about certificates? A: While PEM uses X.509 certificates to bind distinguished names to RSA public keys, it is not necessary to join the Internet certification hierarchy or otherwise pay to use TIS/PEM. TIS/PEM is capable of generating the certificates that you need. Joining the Internet certification hierarchy has the benefit of making it easier to verify others' mail and for them to verify yours. To join the Internet certification hierarchy, you must sign up your Certification Authority (CA) under a Policy-level Certification Authority (PCA). 11 Q: What is a distinguished name? A: A distinguished name is a hierarchical, globally unique name used to identify something or someone. RFC 1255 and several North American Directory Forum (NADF) documents describe how to select appropriate distinguished names. The distinguished name for Earl Sinclair (a fictional character, geographically displaced) might be Country=US State or Province=CA Organization=Wesayso Corporation Organizational Unit=Tree Pushing Division Common Name=Earl Sinclair 12 Q: What is a Certification Authority (CA)? A: A Certification Authority (CA) vouches for the binding between users' distinguished names and RSA public keys within an organization or organizational unit. The CA's distinguished name is that of the organization or organizational unit and users' distinguished names are created by starting with the CA distinguished name and adding something to uniquely and unambiguously identify the user, like a common name. 13 Q: What does a PCA do and how are they differentiated? A: PCAs vouch for the binding between a CA's distinguished name and RSA public key. By joining a PCA, others can verify your PEM messages by following the certification path to the Internet Policy-level Certification Authority certificate without having to have retrieved your RSA public key using secure, out of band means. PCAs may also make CA Certificate Revocation Lists (CRLs) and certificates available and provide other services for its members. PCAs can be differentiated by the policy that they advertise. The policy includes the level of effort -- and associated assurance -- that a PCA uses to insure the correctness of the binding and the requirements they place on CAs which issue certificates under them. They can also be differentiated by the other services they offer and their price. 14 Q: What PCAs are available? A: Several PCAs exist as part of the Internet certification hierarchy, including PCAs at RSADSI and TIS, and more may come online in the near future. 15 Q: How much does it cost to sign up under a PCA? A: Individual PCAs will have their own price schedules. Signing up under the TIS PCA is free during 1993. 16 Q: What if I have questions about TIS PCA? A: Sent them to tispca-info@tis.com. 17 Q: Is there a mailing list for TIS/PEM users? A: Yes, it's tispem-users@tis.com. Send mail to tispem-users-request@tis.com to be added to or deleted from the list. 18 Q: What if I have questions about or problems with TIS/PEM? A: Send them to tispem-support@tis.com. - -----END PRIVACY-ENHANCED MESSAGE----- ------- End of Forwarded Message