tispem.faq

应用密码学密码算法源代码 应用密码学密码算法源代码

                                 TIS/PEM FAQ
                          Last updated 11 May 1994
             Send questions and comments to [e-mail]

Questions answered:

   1) What is Privacy Enhanced Mail (PEM)?
*  2) Where are the PEM standards defined?
   3) Is there a forum for PEM developers and others interested in the
      PEM standards?
   4) Are there implementations of PEM available?
   5) How do I get TIS/PEM?
   6) Why is TIS/PEM only available in the US and Canada?
   7) Are special privileges (e.g., root access) required to install
      TIS/PEM?
*  8) What about integrating TIS/PEM into mail user agents?
   9) What about DOS and other non-UNIX platforms?
  10) What about certificates?
  11) What is a distinguished name?
  12) What is a Certification Authority (CA)?
  13) What does a PCA do and how are they differentiated?
  14) What PCAs are available?
* 15) How much does it cost to sign up under a PCA?
  16) What if I have questions about TIS PCA?
  17) Is there a mailing list for TIS/PEM users?
  18) What if I have questions about or problems with TIS/PEM?
* 19) Can PEM be used with MIME?

 * means that this entry has been recently updated.
 + means that this entry has been added recently.

1
Q: What is Privacy Enhanced Mail (PEM)?

A: PEM is an Internet standard for providing security services to
   electronic mail.  It uses cryptographic techniques to provide
   message integrity checking, originator authentication, and
   confidentiality.  It lets you know that a message hasn't been
   changed, who it's from, and, optionally, allows you to keep it
   secret from all but the intended recipients.

2
Q: Where are the PEM standards defined?

A: There is a set of Proposed Standard RFCs (Internet standards
   documents) that specify PEM.  The four documents are RFCs 1421
   (obsoletes 1113), 1422 (obsoletes 1114), 1423 (obsoletes 1115), and
   1424 (new).  These documents may be found in your favorite RFC
   repository.  Details on obtaining RFCs via FTP or EMAIL may be
   obtained by sending an EMAIL message to "[e-mail]" with the
   message body "help: ways_to_get_rfcs".  For example:

        To: [e-mail]
        Subject: getting rfcs

        help: ways_to_get_rfcs

   The integration of MIME (Multipurpose Internet Mail Extensions) and
   PEM will either produce a new RFC for message format or cause RFC
   1421 to be updated.

   An overview of PEM was presented in the August 1993 issue (Volume
   36, Number 8) of "Communications of the ACM" in an article entitled
   "Internet Privacy Enhanced Mail" by Stephen T. Kent.

3
Q: Is there a forum for PEM developers and others interested in the
   PEM standards?

A: Yes, there is an electronic mailing list that is used to discuss
   the PEM specifications, implementation issues, and it is used to
   conduct some of the business of the Internet Engineering Task Force
   (IETF) PEM working group.  Send a message to
   "[e-mail]" if you would like to be added to the
   list.

4
Q: Are there implementations of PEM available?

A: Yes, implementations are being made available as you read this.
   Trusted Information Systems (TIS), under ARPA sponsorship and in
   cooperation with RSA Data Security Incorporated (RSADSI), has
   released a reference implementation of Privacy Enhanced Mail
   (TIS/PEM) to the Internet community.  

   TIS/PEM is a UNIX-based implementation that has been integrated
   with Rand MH 6.7.2 and is easily integrated into other mail user
   agents.  TIS/PEM is distributed in source form.  It is openly
   available within the United States and Canada for non-commercial
   use (not for resale).

   The current version of TIS/PEM is 6.1.  If you are running an
   earlier version, we suggest that you install 6.1.  6.1 contains
   many bug fixes and functionality not available in previous
   versions.

   Vendors interested in including TIS/PEM functionality in their
   products can contact Trusted Information Systems about licensing
   Trusted Mail (tm).

5
Q: How do I get TIS/PEM?

A: TIS/PEM is available via anonymous ftp in the United States and
   Canada to US and Canadian citizens and people with a US "green
   card."  To retrieve TIS/PEM please FTP to

     host:   ftp.tis.com
     login:  anonymous

   and retrieve the files

     pub/PEM/README
     pub/PEM/LICENSE
     pub/PEM/BUGS

   The README file contains further instructions.  

   The current version of TIS/PEM is 6.1.  If you are running an
   earlier version, we suggest that you install 6.1.  6.1 contains
   many bug fixes and functionality not available in previous
   versions.

6
Q: Why is TIS/PEM only available in the US and Canada?

A: The export from the United States of the cryptography used in
   TIS/PEM is controlled by the United States government.

7
Q: Are special privileges (e.g., root access) required to install TIS/PEM?

A: TIS/PEM can be installed in multi-user mode, which is identified by
   the use of a single, system-wide, shared database of cryptographic
   and administrative information maintained by one or more privileged
   users called certificate administrators, and single-user mode,
   which allows individuals to maintain their own databases of
   cryptographic and administrative information.  Multi-user mode
   installation requires privileges, while single-user mode
   installation does not.

8
Q: What about integrating TIS/PEM into mail user agents?

A: TIS/PEM has been integrated with MH 6.7.2 and is easily integrated
   with other mail user agents.  If you integrate TIS/PEM with a
   popular mail user agent, we would be happy to make it available to
   others.  

   Future versions of TIS/PEM will follow the MIME-PEM intntegration
   standard that is currently being developed and will be integrated
   with newer versions of MH.

   Additionally, a set of filters, similar to the UNIX cat command,
   that allow you to apply and remove PEM enhancements (enhance and
   de-enhance) text files are provided.  These filters make it
   possible to use PEM with mail user agents that are not PEM aware.

   Future versions of TIS/PEM will provide programs and shell scripts
   that will make the intergation of MIME-PEM into other user agents
   an easier task.

9
Q: What about DOS and other non-UNIX platforms?

A: TIS/PEM is currently limited to UNIX, but we are pursuing porting
   it to other operating systems.

10
Q: What about certificates?

A: While PEM uses X.509 certificates to bind distinguished names to
   RSA public keys, it is not necessary to join the Internet
   certification hierarchy or otherwise pay to use TIS/PEM.  TIS/PEM
   is capable of generating the certificates that you need.  Joining
   the Internet certification hierarchy has the benefit of making it
   easier to verify others' mail and for them to verify yours.  To
   join the Internet certification hierarchy, you must sign up your
   Certification Authority (CA) under a Policy-level Certification
   Authority (PCA).  

11
Q: What is a distinguished name?

A: A distinguished name is a hierarchical, globally unique name used
   to identify something or someone.  RFC 1255 and several North
   American Directory Forum (NADF) documents describe how to select
   appropriate distinguished names.  The distinguished name for Earl
   Sinclair (a fictional character, geographically displaced) might be

     Country=US
     State or Province=CA 
     Organization=Wesayso Corporation
     Organizational Unit=Tree Pushing Division
     Common Name=Earl Sinclair

12
Q: What is a Certification Authority (CA)?

A: A Certification Authority (CA) vouches for the binding between
   users' distinguished names and RSA public keys within an
   organization or organizational unit.  The CA's distinguished name
   is that of the organization or organizational unit and users'
   distinguished names are created by starting with the CA
   distinguished name and adding something to uniquely and
   unambiguously identify the user, like a common name.

13
Q: What does a PCA do and how are they differentiated?

A: PCAs vouch for the binding between a CA's distinguished name and
   RSA public key.  By joining a PCA, others can verify your PEM
   messages by following the certification path to the Internet
   Policy-level Certification Authority certificate without having to
   have retrieved your RSA public key using secure, out of band
   means.  PCAs may also make CA Certificate Revocation Lists (CRLs)
   and certificates available and provide other services for its
   members.

   PCAs can be differentiated by the policy that they advertise.  The
   policy includes the level of effort -- and associated assurance --
   that a PCA uses to insure the correctness of the binding and the
   requirements they place on CAs which issue certificates under them.
   They can also be differentiated by the other services they offer
   and their price.

14
Q: What PCAs are available?

A: Several PCAs exist as part of the Internet certification hierarchy,
   including PCAs at RSADSI and TIS, and more may come online in the
   near future.

15
Q: How much does it cost to sign up under a PCA?

A: Individual PCAs will have their own price schedules.  Signing up
   under the TIS PCA is half price during 1994.  Send a note to 
   [e-mail] for a copy of the price schedule.

16
Q: What if I have questions about TIS PCA?

A: Sent them to [e-mail].

17
Q: Is there a mailing list for TIS/PEM users?

A: Yes, it's [e-mail].  Send mail to
   [e-mail] to be added to or deleted from the
   list.

18
Q: What if I have questions about or problems with TIS/PEM?

A: Send them to [e-mail].

19
Q: Can PEM be used with MIME?

A: Yes.  The body of PEM message, as defined by RFC 1421, could be
   placed inside a MIME body part labelled "application/pem-1421".  

   In addition, the PEM working group of the IETF is working on a
   specification for an integration that will allow PEM to take
   advantage of the structure framework provided by MIME.  A new
   standard for the format of MIME-PEM messages was introduced at the
   most recent IETF meeting and it is likely that when the standard is
   finalized it will replace RFC 1421 or cause it to be updated.

   You may ask for more information on the PEM developers mailing
   list, "[e-mail]".  To be added to the list, send your
   request to "[e-mail]".