Subject: [fwd] RSA Seeks To Establish Internet Encryption Standard

From: Paul Ferguson <[email-masked]>
Date: Sun, 02 Nov 1997 16:07:34 -0500

And exactly to whom did RSA 'formally apply' and in what
context? I would be curious (as I'm sure others in the IETF
would be also) to learn what RSA has exactly 'applied' for
and if it is within the spirit of the message that Jeff
Schiller sent to the [email-masked] list on 28 Aug
1997:

[snip]

2. Before the IESG would consider chartering a working group on S/MIME
   RSA Data Security (or appropriate parent company) needs to execute
   an agreement with the Internet Society along the lines of the
   agreement between Sun Microsystems and the ISOC as documented in
   RFC1790.

[snip]

- paul

[snip]

>Date: 	Sun, 2 Nov 1997 14:15:48 -0500
>From: Edupage Editors <[email-masked]>
>To: "EDUCOM Edupage Mailing List" <[email-masked]>
>Subject: Edupage, 2 November 1997

>
>RSA SEEKS TO ESTABLISH INTERNET ENCRYPTION STANDARD
>RSA Data Security has formally applied to the Internet Engineering Task
>Force to make its S/MIME encryption technology an Internet standard.
>Supporting RSA's drive is a group of 12 Japanese vendors that have announced
>they will form a Japanese consortium to advocate the adoption of S/MIME
>encryption in that country.  RSA's major competitor is Pretty Good Privacy,
>which has been pushing its own technology with the IETF.  "We think that RSA
>coming out and working within the standards organizations is a good thing,"
>says the director of technology at PGP, who adds that this is where these
>types of issues should be discussed.  (Net Insider 31 Oct 97)
>

[snip]

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Sun, 02 Nov 1997 19:14:47 -0800

At 04:07 PM 11/2/97 -0500, Paul Ferguson wrote:
>context?

The Educom article quoted simply repeated the words RSADSI used in their
press release that they put out on Friday. The press release on which the
article was based can be seen at
<http://www.rsa.com/smimelive/html/9710311.html>.

The press release is flat-out wrong. RSADSI has not formally applied for
anything. S/MIME has not been submitted as a standard.

The status of the S/MIME work is:

- S/MIME v2 will be submitted as an informational RFC soon (in IETF time,
meaning hopefully next week, but could be next month). The S/MIME v2 drafts
describe the current commercial practice for S/MIME, and are not believed
to be able to get on standards track because they require the use of RSA
signatures and support for weak encryption.

- The first Internet Drafts of S/MIME v3 have just been submitted this
week. The editors of these drafts, none of whom work for RSA, intend for
these drafts to be able to get on standards track.

- A charter for an S/MIME Working Group was submitted to Jeff Schiller, the
area director for security, and will hopefully be considered by the IESG at
their meeting this week. RSA did not submit the charter. The purpose of the
WG will be to create standards track documents for S/MIME 3 and to
coordinate with the OpenPGP Working Group where appropriate.

- A long-standing mailing list has been discussing the S/MIME v2 drafts and
is just now starting to discuss the S/MIME v3 drafts. You can subscribe to
this list by sending a message to "[email-masked]" with just
the word "subscribe" in the body of the message. Please note that this list
is for discussing the S/MIME drafts in the context of the IETF, not for
talking about the business practices of RSADSI, which are irrelevant for
S/MIME v3. More information on the mailing list, including a comlete
archive, can be found at <http://www.imc.org/ietf-smime/>.