Subject: RE: President Clinton digital signing

From: [email-masked]
Date: Tue, 22 Aug 2000 08:51:53 -0400

Terri suggests that the real significance of the certificate and smart card
used by President Clinton is that they were obtained through the Access
Certificates for Electronic Services (ACES) contract at GSA.  Through the
use of a Certificate Arbitrator Module (CAM), which is effectively a parser
and validation tool (offered to public domain by GSA), multiple CA's are
made available to the government applications.

More info at

http://www.gsa.gov/aces/

To me, though, the most significant thing is that the E-Sign bill was
signed, regardless of the technology utilized.

Cheers,

---------------------- Forwarded by Marion A. Royal/ME/CO/GSA/GOV on
08/22/2000 08:23 AM ---------------------------

 (Embedded     Terri F. Hobson                                         
 image moved   08/22/2000 08:08 AM                                     
 to file:      (Embedded image moved to file: pic14454.pcx)            
 pic17883.pcx)                                                         

To:   Marion A. Royal/ME/CO/GSA/GOV@GSA
cc:   Judith A. Spencer/TI/CO/GSA/GOV@GSA

Subject:  RE: President Clinton digital signing  (Document link: Marion A.
      Royal)

Marion,

Looks like they missed the point!  Clinton used an ACES certificate.  Yes,
under the ACES contract there are 3 primes and lots of subcontractors,
including Verisign, Entrust, XCert, AOL, and Valicert just to name a few.
However, reguardless of who, the standard x509v3 format as described in the
ACES Certificate Policy was used.

see ya!

Marion A. Royal
08/22/2000 07:44 AM

To:   Terri Hobson, Judy Spencer
cc:

Subject:  RE: President Clinton digital signing

I would be happy to forward any comments you might have on this subject.
This is the IETF PKIX work group.

marion

---------------------- Forwarded by Marion A. Royal/ME/CO/GSA/GOV on
08/22/2000 07:42 AM ---------------------------

"Yuriy Dzambasow" <[email-masked]> on 08/21/2000 01:06:34
PM

Please respond to [email-masked]

To:   "Alan Gibson" <[email-masked]>, "Timothy Fisher"
      <[email-masked]>, "Tom Strickland"
      <[email-masked]>
cc:   [email-masked]

Subject:  RE: President Clinton digital signing

DST uses a variety of CA technologies in our managed services offerings,
and
are not solely reliant on any one technology.

Yuriy

-----Original Message-----
From: Alan Gibson [mailto:[email-masked]]
Sent: Monday, August 21, 2000 9:06 AM
To: Timothy Fisher; Tom Strickland
Cc: [email-masked]
Subject: Re: President Clinton digital signing

Yes
----- Original Message -----
From: "Timothy Fisher" <[email-masked]>
To: "Tom Strickland" <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, August 20, 2000 12:41 PM
Subject: Re: President Clinton digital signing

> Does't DST also use Entrust software?
>
> Timothy Fisher
>
> Tom Strickland wrote:
>
> > Hello All,
> >
> > After reading several articles about President Clinton and the digital
> > signature signing, it appears that people have an inaccurate impression
> > regarding the PKI technology utilized.
> >
> > The actual smart card was produced by DataKey but the certs were
> > provided by Digital Signature Trust (DST) which is based on the CA
> > software designed and built by Xcert International.

---

From: <[email-masked]>
Date: Tue, 22 Aug 2000 11:19:12 -0400

this is very interexting, can somebody please comment on why the US govt
(GSA, at least) doesnt seem to want to embrace OCSP as a validation
mechanism for ACES (and other programs)??   the 'CAM' as they call it sems
to be an alternative mechanism....a duplication of much of the work OCSP has
already worked through...

-j

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, August 22, 2000 8:52 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: President Clinton digital signing

More info at

http://www.gsa.gov/aces/

Cheers,

---

From: Tim Polk <[email-masked]>
Date: Tue, 22 Aug 2000 11:44:01 -0400

If the ACES project was starting today, they might very well have used 
OCSP.  However, the ACES project was years in the making.  No standard 
solution was available, and GSA could not afford to wait.  Remember, OCSP 
didn't make it out of the editing queue until June 1999.  GSA was well into 
the contracting process before OCSP was stable enough to consider.

Considering the legal and contracting issues, GSA has done an amazing job 
bringing ACES on line.  Hopefully, ACES will evolve to take advantage of 
the IETF protocols in the future.

Tim

---

From: Tom Strickland <[email-masked]>
Date: Tue, 22 Aug 2000 12:17:52 -0400

You are correct to ask "why the US govt (GSA, at least) dosent seem to want to
embrace OCSP as a validation mechanism for ACES (and other programs)??".
You have to remember that ACES does have built in OCSP. The product that they
chose includes an OCSP "real time" responder, not antiquated CRLs.

Please review the following URLs to see how and why Xcert was chosen:

ACES announcement:
http://www.xcert.com/corp/Press_Releases/2000-04-04-aces.html

Reference to digital signature law:
http://www.xcert.com/resources/esign/index.html

Sentry CA functionality:
http://www.xcert.com/software/sentryca.html

Scalability to manage over 8 million certs on one CA and box:
http://www.xcert.com/corp/Press_Releases/2000-05-15-8million.html

---

From: Al Arsenault <[email-masked]>
Date: Tue, 22 Aug 2000 15:00:23 -0400

Tom Strickland wrote:
<gratuitous shot at CRLs snipped>
><long list of URLs snipped>

That's all fine and dandy, but I thought that the question was:

"Why was a DST/XCert certificate selected for use, vice something from
one of the other ACES contractors?"

Since IIRC DST had the first ACES contract, I can certainly see giving
them this task. But was there any special reason DST chose XCert, since
DST provides certificates using most if not all of the major CA
providers' equipments?

		Al Arsenault
		Chief Security Architect
		Diversinet Corp.