From: gnu (John Gilmore)
Date: Tue, 8 Jun 93 17:36:31 PDT
To: cypherpunks@toad.com
Subject: TIS/PEM FAQ as of 8 June 1993
Message-ID: <9306090036.AA02947@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


------- Forwarded Message

From: James M Galvin <tispem-support@TIS.COM>
To: ietf-announce@cnri.reston.va.us, psrg-interest@isi.edu, pem-dev@TIS.COM,
        rsaref-users@rsa.com, saag@TIS.COM, tispem-users@TIS.COM
Subject: TIS/PEM FAQ as of 8 June 1993
Date: Tue, 08 Jun 93 16:21:10 -0400

- -----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-ID-Asymmetric: MFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNRDE
 kMCIGA1UEChMbVHJ1c3RlZCBJbmZvcm1hdGlvbiBTeXN0ZW1zMREwDwYDVQQLEwh
 HbGVud29vZA==,02
MIC-Info: RSA-MD5,RSA,BpCu5i/vNJFNX64bj4KuRr8Jm05gdfjIIO5WQaSTXAG
 kx09ivq97GtmdksgshOkdqynlLxTSph0s6DtNN5girn2Q/u08q44XLYbk6vYxA9g
 37w/L1leqw7CldPLPOtQT

Many of you will recall the announcement of the availability of TIS/PEM,
the Internet reference implementation of PEM, distributed last week.

Included below is the first TIS/PEM FAQ.  We are posting it this one
time to the same mailing lists that received the announcement last week.
In the future, it will be posted to the <tispem-users@tis.com> mailing
list and several appropriate newsgroups.

We hope you find this useful.

Thanks.




                                 TIS/PEM FAQ
                          Last updated 8 June 1993
             Send questions and comments to tispem-support@tis.com

Questions answered:

  1) What is Privacy Enhanced Mail (PEM)?
  2) Where are the PEM standards defined?
  3) Is there a forum for PEM developers and others interested in the
     PEM standards?
  4) Are there implementations of PEM available?
  5) How do I get TIS/PEM?
  6) Why is TIS/PEM only available in the US and Canada?
  7) Are special privileges (e.g., root access) required to install
     TIS/PEM?
  8) What about integrating TIS/PEM into mail user agents?
  9) What about DOS and other non-UNIX platforms?
 10) What about certificates?
 11) What is a distinguished name?
 12) What is a Certification Authority (CA)?
 13) What does a PCA do and how are they differentiated?
 14) What PCAs are available?
 15) How much does it cost to sign up under a PCA?
 16) What if I have questions about TIS PCA?
 17) Is there a mailing list for TIS/PEM users?
 18) What if I have questions about or problems with TIS/PEM?

1
Q: What is Privacy Enhanced Mail (PEM)?

A: PEM is an Internet standard for providing security services to
   electronic mail.  It uses cryptographic techniques to provide
   message integrity checking, originator authentication, and
   confidentiality.  It lets you know that a message hasn't been
   changed, who it's from, and, optionally, allows you to keep it
   secret from all but the intended recipients.

2
Q: Where are the PEM standards defined?

A: There is a set of Proposed Standard RFCs (Internet standards
   documents) that specify PEM.  The four new documents are RFCs 1421
   (obsoletes 1113), 1422 (obsoletes 1114), 1423 (obsoletes 1115), and
   1424 (new).  These documents may be found in your favorite RFC
   repository.  Details on obtaining RFCs via FTP or EMAIL may be
   obtained by sending an EMAIL message to "rfc-info@ISI.EDU" with the
   message body "help: ways_to_get_rfcs".  For example:

        To: rfc-info@ISI.EDU
        Subject: getting rfcs

        help: ways_to_get_rfcs

3
Q: Is there a forum for PEM developers and others interested in the
   PEM standards?

A: Yes, there is an electronic mailing list that is used to discuss
   the PEM specifications, implementation issues, and it is used to
   conduct some of the business of the Internet Engineering Task Force
   (IETF) PEM working group.  Send a message to
   "pem-dev-request@tis.com" if you would like to be added to the
   list.

4
Q: Are there implementations of PEM available?

A: Yes, implementations are being made available as you read this.
   Trusted Information Systems (TIS), under ARPA sponsorship and in
   cooperation with RSA Data Security Incorporated (RSADSI), has
   released a reference implementation of Privacy Enhanced Mail
   (TIS/PEM) to the Internet community.  TIS/PEM is a UNIX-based
   implementation that has been integrated with Rand MH 6.7.2 and is
   easily integrated into other mail user agents.  TIS/PEM is
   distributed in source form.  It is openly available within the
   United States and Canada for non-commercial use (not for resale).

5
Q: How do I get TIS/PEM?

A: TIS/PEM is available via anonymous ftp in the United States and
   Canada to US and Canadian citizens and people with a US "green
   card."  To retrieve TIS/PEM please FTP to

     host:   ftp.tis.com
     login:  anonymous

   and retrieve the files

     pub/PEM/README
     pub/PEM/LICENSE
     pub/PEM/BUGS

   The README file contains further instructions.

6
Q: Why is TIS/PEM only available in the US and Canada?

A: The export from the United States of the cryptography used in
   TIS/PEM is controlled by the United States government.

7
Q: Are special privileges (e.g., root access) required to install TIS/PEM?

A: TIS/PEM can be installed in multi-user mode, which is identified by
   the use of a single, system-wide, shared database of cryptographic
   and administrative information maintained by one or more privileged
   users called certificate administrators, and single-user mode,
   which allows individuals to maintain their own databases of
   cryptographic and administrative information.  Multi-user mode
   installation requires privileges, while single-user mode
   installation does not.

8
Q: What about integrating TIS/PEM into mail user agents?

A: TIS/PEM has been integrated with MH 6.7.2 and is easily integrated
   with other mail user agents.  If you integrate TIS/PEM with a
   popular mail user agent, we would be happy to make it available to
   others.  Additionally, a set of filters, similar to the UNIX cat
   command, that allow you to apply and remove PEM enhancements
   (enhance and de-enhance) text files are provided.  These filters
   make it possible to use PEM with mail user agents that are not PEM
   aware.

9
Q: What about DOS and other non-UNIX platforms?

A: TIS/PEM is currently limited to UNIX, but we are pursuing porting
   it to other operating systems.

10
Q: What about certificates?

A: While PEM uses X.509 certificates to bind distinguished names to
   RSA public keys, it is not necessary to join the Internet
   certification hierarchy or otherwise pay to use TIS/PEM.  TIS/PEM
   is capable of generating the certificates that you need.  Joining
   the Internet certification hierarchy has the benefit of making it
   easier to verify others' mail and for them to verify yours.  To
   join the Internet certification hierarchy, you must sign up your
   Certification Authority (CA) under a Policy-level Certification
   Authority (PCA).  

11
Q: What is a distinguished name?

A: A distinguished name is a hierarchical, globally unique name used
   to identify something or someone.  RFC 1255 and several North
   American Directory Forum (NADF) documents describe how to select
   appropriate distinguished names.  The distinguished name for Earl
   Sinclair (a fictional character, geographically displaced) might be

     Country=US
     State or Province=CA 
     Organization=Wesayso Corporation
     Organizational Unit=Tree Pushing Division
     Common Name=Earl Sinclair

12
Q: What is a Certification Authority (CA)?

A: A Certification Authority (CA) vouches for the binding between
   users' distinguished names and RSA public keys within an
   organization or organizational unit.  The CA's distinguished name
   is that of the organization or organizational unit and users'
   distinguished names are created by starting with the CA
   distinguished name and adding something to uniquely and
   unambiguously identify the user, like a common name.

13
Q: What does a PCA do and how are they differentiated?

A: PCAs vouch for the binding between a CA's distinguished name and
   RSA public key.  By joining a PCA, others can verify your PEM
   messages by following the certification path to the Internet
   Policy-level Certification Authority certificate without having to
   have retrieved your RSA public key using secure, out of band
   means.  PCAs may also make CA Certificate Revocation Lists (CRLs)
   and certificates available and provide other services for its
   members.

   PCAs can be differentiated by the policy that they advertise.  The
   policy includes the level of effort -- and associated assurance --
   that a PCA uses to insure the correctness of the binding and the
   requirements they place on CAs which issue certificates under them.
   They can also be differentiated by the other services they offer
   and their price.

14
Q: What PCAs are available?

A: Several PCAs exist as part of the Internet certification hierarchy,
   including PCAs at RSADSI and TIS, and more may come online in the
   near future.

15
Q: How much does it cost to sign up under a PCA?

A: Individual PCAs will have their own price schedules.  Signing up
   under the TIS PCA is free during 1993. 

16
Q: What if I have questions about TIS PCA?

A: Sent them to tispca-info@tis.com.

17
Q: Is there a mailing list for TIS/PEM users?

A: Yes, it's tispem-users@tis.com.  Send mail to
   tispem-users-request@tis.com to be added to or deleted from the
   list.

18
Q: What if I have questions about or problems with TIS/PEM?

A: Send them to tispem-support@tis.com.
- -----END PRIVACY-ENHANCED MESSAGE-----

------- End of Forwarded Message