Subject: RE: Does Smime works fine with Windows 2000 PKI

From: Philip Hallam-Baker <[email-masked]>
Date: Thu, 11 May 2000 08:12:48 -0700

Actually it is possible to issue certs with W2K that are recognized
automatically by other mail recipients with the VeriSign Gateway CA 
product. In practice however this does not remove the obligation to
employ the required authentication standards...

In general however interroperability is not a market differentiator
that should provide a major competative advantage. If only one vendor
can claim to be interoperable something odd is happening.

It is failure to interoperate that is a market disadvantage!

IETF mailing lists are not a good place for discussing, plugging 
specific vendor products (although most folk feel free to correct
erroneous statements about their product like I did). 

		Phill

---

From: "Stuart Ross" <[email-masked]>
Date: Fri, 12 May 2000 10:48:59 +0100

Ongoing costs play the largest part in the cost of a PKI, for example
issuing Certificates, revoking certificates, rolling over certificates,
supporting users etc, the list goes on and it is non trivial, therefore
expensive either outsourcing or in-house. 

Stuart R 
 
-----Original Message-----
From: Walter Williams [mailto:[email-masked]]
Sent: Thursday, May 11, 2000 7:26 PM
To: [email-masked]; 'Laurent Deffranne'
Cc: 'ietf-smime'
Subject: RE: Does Smime works fine with Windows 2000 PKI

Free only if you own Windows 2000, but yes that means free for most folks
eventually.  However, most of the costs associated with a PKI are not in the
actual technology, but rather in the legal side of things.  Outsourcing to a
CA vendor such as Baltimore, Entrust or Verisign allows you to offset the
soft costs to a company which has already done its legal home work for you.
There is a lot of discussion on the cost/benefits on inhousing a CA which
can be found in EMA sessions, often available on www.ema.org.  Also look at
www.pki.org for interoperability testing (not just white papers here).  EMA
has recently published the findings of a large test regarding PKI interop
which involved many vendors, the federal government and this is available
again at www.ema.org.  I don't know if the tests have included W2K in the
past but we can ask Microsoft to participate as they are an ongoing process.

Walt

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Piers Chivers
> Sent: Thursday, May 11, 2000 1:17 PM
> To: 'Laurent Deffranne'; 'walter.williams'
> Cc: 'ietf-smime'
> Subject: RE: Does Smime works fine with Windows 2000 PKI
>
>
> MS have published a White Paper on Win2k PKI interoperability with other
> leading PKI vendor products.  The WP is available on their MSDN website
> (can't remember where but it's called win2kpkinterop.doc).
>
> In my experience Win2k PKI is excellent as choice for an
> Enterprise PKI.  It
> integrates well with AD (not surprisingly).  However, as a commercial PKI
> the best thing that can be said about it is that it is free.  And that
> probably sums it up succintly.
>
> Piers
>
> -----Original Message-----
> From: Laurent Deffranne [mailto:[email-masked]]
> Sent: 11 May 2000 14:19
> To: walter.williams
> Cc: ietf-smime
> Subject: RE: Does Smime works fine with Windows 2000 PKI
>
>
> Walt,
>
> Do you mean that there are difficulties to access through LDAP an Active
> Directory, as you want to read or use X509 certificates ?
>
> By the way,does somebody know issues about Active Directory LDAP, or
> issues to read a certificate in an Active Directory ?
>
> For me it would be a mistake to use now the "brand new" Active
> Directory, but if someone could tell me where I can find proofs of lack
> of compatibility (from Microsoft, there must be surely one of two), this
> would interrest me.
>
> Laurent
>
>
>
>
>
> walter.williams%genuity.com@Internet
> 11/05/2000 14:54
> To:	Laurent Deffranne/GKBCCB@GKBCCB, ietf-smime%imc.org@Internet
> cc:
>
> Subject:	RE: Does Smime works fine with Windows 2000 PKI
>
> Laurent;
>
> Yes, certs issued from a W2K CA can be used for S/MIME, and no less so
> than
> certs issued from Baltimore, Iplanet or any other CA vendor or product.
> The
> main issue is not will they work, but will you be able to validate the
> certs.  Unless the person issuing the cert from W2K has provided you
> with
> their server's cert, or they have certified their CA with the signature
> of
> the publicly known CAs you will not be able to easily verify the
> signature
> to its source.  This is not the most technically acurate way of saying
> this
> but I'm not awake yet.  Baltimore has preregistered there CA with the
> vendors distributing products, as has Verisign, Thaught, and many
> others.
> Just make certain that you have the certificates for the W2K CA, and
> access
> to its revocation list so you can validate properly and you'll be fine.
>
> Walt Williams
> TSD-Systems
> Senior IT Analyst
> Genuity
> www.genuity.com
>
> Please note: GTE Internetworking is now Genuity.
>
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]]On Behalf Of Laurent Deffranne
> > Sent: Thursday, May 11, 2000 5:45 AM
> > To: ietf-smime
> > Subject: Does Smime works fine with Windows 2000 PKI
> >
> >
> > Hi everybody,
> >
> > Just a question :
> >
> > Is there any known issues using S/MIME with Win2000PKI-certificates ?
> > More generally, are Win2000 certificates usable with (and
> > understood by ) the others mailers (especially Lotus Notes,
> > Netscape, Eudora +plug-in?)
> >
> > Isn't Baltimore Unicert a "better choice" due to its greater
> > compatibility ?
> >
> > Any advices are welcome.
> >
> > Regards,
> >
> > Laurent Deffranne
>
>
>
>
>