Software Announcement October 26, 1999

Transcription

1 Software Announcement October 26, 1999 IBM SecureWay Trust Authority Version 3.1 Issues Certificates Worthy of Trust, Providing the Ability to More Securely Register and Authenticate Users for Trusted e-business Overview SecureWay Trust Authority Version 3.1 is an integrated Public Key Infrastructure (PKI) solution that enables e-business by issuing digital certificates worthy of trust. Trust Authority is a cross-platform, easy-to-use offering with manual and automated registration capabilities targeted at medium and large enterprises and ISVs. It provides the ability to perform complete life cycle management of certificates via the Trust Authority Client or via standard Web browsers. SecureWay Trust Authority not only issues standard certificates, such as S/MIME, IPSec (for VPNs), and server certificates, but also provides the flexibility to add user-defined extensions. The Trust Authority application adheres to the PKI for X.509V3 (PKIX) standards. The CA includes advanced features such as cross-certification certificate extensions, and Trust Authority leverages IBM KeyWorks for cryptographic and key store function. Key Prerequisites SecureWay Trust Authority Version 3.1 can be installed on: RS/6000 systems with AIX Version or Intel-based systems with Microsoft Windows NT 4.0 (with Service Pack 5) SecureWay Trust Authority Version 3.1 also requires the following products included in the Trust Authority media pack: SecureWay Directory Version DB2 Version 5.2 Fix Pack 10 (Enterprise Edition) WebSphere Application Server Version 2.02 Standard Edition (plus recommended service packs) including IBM HTTP Web Server Version and JDK Version Planned Availability Date October 29, 1999 At a Glance A Trust Authority system can run on AIX/6000 and Microsoft Windows NT server platforms and includes: A trusted Certificate Authority (CA) that can be used to manage the complete life cycle of digital certificates. A Registration Authority (RA) that can be used to handle the administrative tasks behind user registration. A Web-based enrollment interface, making it easy to obtain certificates for browsers, servers, and other purposes, such as virtual private network (VPN) devices, smart cards, and secure . A Windows client-based enrollment interface for non-browser-based applications. The SecureWay Directory for publishing certificates and certificate revocation lists. DB2 Universal Database for maintaining registration information. For ordering, contact: Your IBM representative, an IBM Business Partner, or IBM Americas Call Centers at 800-IBM-CALL Reference: YE001 EXTRA! EXTRA!... Subscribe to IBM isource, your electronic source for customized IBM information! Go to our Web site at or send an to info@isource.ibm.com with the word SUBSCRIBE in the body. This announcement is provided for your information only. For additional information, contact your IBM representative, call 800-IBM-4YOU, or visit the IBM home page at: IBM United States IBM is a registered trademark of International Business Machines Corporation

2 Description A Trust Authority system can run on AIX/6000 and Microsoft Windows NT server platforms and includes the following: A trusted CA that manages the complete life cycle of digital certification. To provide for the authenticity of a certificate, the CA digitally signs each one it issues. It also signs certificate revocation lists (CRLs) to identify the fact that a certificate is no longer valid. To further protect its signing key, you can use cryptographic hardware, such as the SecureWay 4758 PCI Cryptographic Coprocessor. An RA that handles the administrative tasks behind user registration. The RA helps to ensure that only certificates that support your business activities are issued, and that they are issued only to authorized users. The administrative tasks can be handled through automated processes or human decision-making. A Web-based enrollment interface that makes it easy to obtain certificates for browsers, servers, and other purposes, such as VPN devices, smart cards, and secure . A Windows application, the Trust Authority Client, that enables end users to obtain and manage certificates without using a Web browser. A Web-based administration interface, the RA Desktop, that enables authorized registrars to approve or reject enrollment requests and administer certificates after they have been issued. An Audit subsystem that computes a message authentication code (MAC) for each audit record. If audit data is altered or deleted after it has been written to the audit database, the MAC enables you to detect the intrusion. Policy exits enable application developers to customize the registration processes. Integrated support for a cryptographic engine. To authenticate communications, the core Trust Authority components are signed with a factory-generated private key. Security objects, such as keys and MACs, are encrypted and stored in protected areas called KeyStores. Integrated support for SecureWay Directory. The Directory stores information about valid and revoked certificates in an LDAP-compliant format. Integrated support for WebSphere Application Server and IBM HTTP Server. The Web server works with the RA server to encrypt messages, authenticate requests, and transfer certificates to the intended recipient. Integrated support for the award-winning DB2 Universal Database. IBM Security and Privacy Services that will provide consulting and implementation services worldwide in support of Trust Authority. Benefits SecureWay Trust Authority Version 3.1: Provides all required components for an integrated PKI, which reduces cost and implementation schedules for organizations implementing PKI. Provides support for PKI for X.509 Version 3 (PKIX) and Common Data Security Architecture (CDSA) cryptographic standards, which allow for vendor interoperability. Includes a Registration Facility (RF) that handles the administrative tasks behind user registration, supporting browser and client-based requests. The RF helps to ensure that only certificates that support business activities are issued, and that are issued only to authorized users. The administrative tasks can be handled through automated processes or human decision-making. Year 2000 This product is Year 2000 ready. When used in accordance with its associated documentation, it is capable of correctly processing, providing, and/or receiving date data within and between the twentieth and twenty-first centuries, provided that all products (for example, hardware, software, and firmware) used with the product properly exchange accurate date data with it. The service end date for this Year-2000-ready product is November 30, Euro Currency This program is not impacted by euro currency. Statement of Direction A future release of IBM Vault Registry is currently targeted for availability in the first half of This release of the program is expected to build on prior releases of Vault Registry and Trust Authority to further establish IBM PKI offerings as the premium registration and certification solutions for enabling trusted e-business. In 1999, IBM expects to select a Common Criteria certification laboratory and expects to begin evaluation of this next release of Vault Registry. IBM plans to have this next release certified to International Organization for Standards (ISO) Common Criteria for Information Technology Security Evaluation (CC) Version 2.0. At a minimum, IBM intends to achieve Common Criteria Evaluation Assurance Level 3 (EAL-3). This is roughly comparable to an Information Technology Security Evaluation Criteria (ITSEC) E2 level of security assurance. We expect to complete this certification in The single Common Criteria standard replaces disparate standards for computer security product evaluations used by Canada, the European Community, and the United States. Other countries, including Australia and New Zealand, are also expected to support this standard. Common Criteria will replace older security assurance criteria such as ITSEC, National Institute of Standards and Technology s (NIST) Federal Information Processing Standard (FIPS) 140-1, and the National Security Agency s Trusted Computer System Evaluation Criteria, or Orange Book. Be advised that this statement provides a preliminary statement of IBM s direction with respect to the IBM Vault Registry product. Due to the variability of plans, schedules, and changes in the marketplace, statements of direction are subject to change without notice. Any decision by a customer to forego, or engage in any activity, to alter any business plan or direction, or to make any investment in anticipation of IBM releasing an available version of Vault Registry containing the functionality described in this Statement of Direction, is at the customer s sole discretion and risk, and will not create any actual or potential liability or obligation on IBM, even if IBM is aware of, or has been informed of or

3 has indicated approval of any such action, decision, or election. Trademarks SecureWay and WebSphere are trademarks of International Business Machines Corporation in the United States or other countries or both. AIX, RS/6000, DB2, AIX/6000, and DB2 Universal Database are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Microsoft, Windows NT, and Windows are trademarks of Microsoft Corporation. Other company, product, and service names may be trademarks or service marks of others

4 IBM US Announcement Supplemental Information October 26, 1999 Education Support The following classes will be available by January Course Title Course Availability Number Date PKI and IBM SecureWay IN56 January 2000 Trust Authority Fundamentals IBM SecureWay Trust Authority IN57 January 2000 Planning and Implementation The courses will be announced via the following sites. Visit these sites for additional information. MSE IBM Global Campus Keywords for accessing the courses are: IN56 Trust, Authority, PKI IN57 Trust, Authority The appropriate curriculum will include the enhancements described in this announcement. Call IBM Education and Training at 800-IBM-TEACH ( ) for catalogs, schedules, and enrollments. Offering Information Product Information is available through Offering Information (OITOOL) at: Publications The following softcopy publications are included on the Trust Authority (TA) documentation CD-ROM: Up and Running Provides a product overview and installation procedures System Administration Guide Provides general information about administering the TA system Configuration Guide Describes how to use the Setup Wizard to configure a TA system Registration Authority Desktop Guide Describes how to use the RA Desktop to administer certificates throughout the certificate life cycle User s Guide Describes how to obtain certificates using the browser and how to use TA Client to store and administer certificates The following hardcopy publication is in the Trust Authority documentation pack and is available through Lotus Passport Advantage: Up and Running Book Visit the following URL to obtain the order number: Technical Information Specified Operating Environment Hardware Requirements: SecureWay TA Version 3.1 can be installed on: RS/6000 systems (minimum 233 MHz, 256 MB RAM, 9.1 GB disk space) with AIX Version 4.3.2, or later Intel-based systems (minimum 450 MHz, 256 MB RAM, 9.1 GB disk space) with Microsoft Windows NT 4.0 (with Service Pack 5) Software Requirements: SecureWay TA Version 3.1 also requires the following products, which are included in the TA media pack: SecureWay Directory Version DB2 Version 5.2 Fix Pack 10 (Enterprise Edition) WebSphere Application Server Version 2.02 Standard Edition (plus recommended service packs) including IBM HTTP Web Server Version and JDK Version The DB2 UDB Enterprise Edition Version 5.2 program provided with SecureWay TA is a restricted license version. You can upgrade to the full license version of DB2 by ordering the 1 User from 1 User (part number 41L3134), and the 1 Server install from 1 Server install (part number 41L3135). Refer to Software Announcements , dated September 21, 1999, and , dated September 22, 1998, for additional DB2 upgrade information including ordering and pricing information. Planning Information Direct Customer Support: Technical support is available to customers and IBMers. The level of support ranges from self-help via the Internet, to base support, to enhanced support at an additional fee. This announcement is provided for your information only. For additional information, contact your IBM representative, call 800-IBM-4YOU, or visit the IBM home page at: IBM United States IBM is a registered trademark of International Business Machines Corporation

5 In the U.S., customers can access the IBM support team via voice at or electronically. For a wide range of contact numbers, access the Software Support handbook at: Packaging: The SecureWay TA Version 3.1 program is distributed in one package with the following: IBM International Program License Agreement in multilanguage booklet and its License Information TA program CD-ROM TA documentation CD-ROM 2-IBM SecureWay Directory CD-ROMs 4-DB2 5.2 Enterprise Edition CD-ROMs WebSphere Application Server CD-ROM Passport Advantage Media Pack Customer Letter (WW) Y2K Booklet Security, Auditability, and Control Sensitive user information and data is kept in encrypted format in the database. All information sent to or retrieved from the database by an RA is transmitted in encrypted format. It is recommended customers rely on proven industry standards for backup and recovery mechanisms for the DB2 databases, the SecureWay Directory, and the TA operating environment. The customer is still responsible for the physical security of the facility and operating environment and the selection of personnel suitable for work in an environment where a high level of security is desired. The customer is responsible for evaluation, selection, and implementation of security features, administrative procedures, and appropriate controls in application systems and communication facilities. Ordering Information IBM SecureWay Trust Authority 3.1 is available through Lotus Passport Advantage only. Passport Advantage Description VPO Instl TA VPO Instl/SW Sub TA 1 Year VPO Instl/SW Sub TA 2 Years VPO SW Sub Renewal TA VPO SW Sub TA 1 Year VPO SW Sub TA 2 Years CO Instl/SW Sub TA 1st Anniv CO Instl/SW Sub TA 2nd Anniv CO SW Sub Renewal TA CO SW Sub TA 1st Anniv CO SW Sub TA 2nd Anniv CO Supt TA 1st Anniv CO Supt TA 2nd Anniv CO License TA TA 3.1 Strong Media Package TA 3.1 Documentation Package English Part Number D461ZML D4621ML D46GAML E16GCML D46GDML D46GEML D46GFML D46GCML E16GDML D4721ML D4725ML AR6XZML AR70GML AR6ISML BE6KMML BE6PENA Terms and Conditions Licensing: IBM International Program License Agreement. Proofs of Entitlement (PoE) are required for all authorized use. License Information Form Number Description IBM SecureWay Trust Authority License Information Part Number CT7ZXML Program Unique Terms: You are licensed to use the program to issue digital certificates only for the number of users for whom you have paid. If you desire to increase the number of users, you must purchase additional authorizations. You are responsible for acquiring all of the prerequisite products required in order to use the program. Except as otherwise set forth herein, you may make as many copies of the program as is necessary to support the number of users for whom you have paid. You understand and agree that the program contains data encryption functions that are subject to special export licensing restrictions by the U.S. Department of Commerce. You understand and agree that the program contains software from RSA Data Security, Inc. ( RSA Code ). You may modify or directly access the RSA Code or its functions, except through the function calls of the program, which may not be modified. In addition, the program contains Standard Template Library software ( STL Software ) from Silicon Graphics Computer Systems, Inc. ( SG STL Software ) and Hewlett-Packard Company ( HP STL Software ). SG STL Software is copyrighted Silicon Graphics Computer Systems, Inc., and HP STL Software is copyrighted 1994 Hewlett-Packard Company. STL Software can be found on the Web at: and other places. Permission to use, copy, modify, distribute, and sell the SG STL Software and HP STL Software and their documentation for any purpose is hereby granted without fee, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation. Neither Silicon Graphics, Hewlett-Packard, nor IBM makes any representations about the suitability of the SG STL Software or HP STL Software for any purpose. The SG STL Software and HP STL Software are each provided AS IS without express or implied warranty. The program includes portions of DB2 Universal Database software ( DB2 Components ). You are not authorized to install or use the DB2 Components other than in connection with your licensed use of the program for the storage and management of data used or generated by the program. For example, this license does not include inbound connections to the database or the DB2 Components from other applications for queries or report generation. The DB2 Components must reside on the same machine as the program, and you are not authorized to install or use the DB2 Components separate from the program

6 The program includes portions of the IBM WebSphere Application Server and the IBM HTTP Web Server ( IBM Servers ). You are not authorized to install or use the IBM Servers other than in connection with your licensed use of the program. The IBM Servers must reside on the same machine as the program, and you are not authorized to install or use the IBM Servers separate from the program. You may not take any action, or permit any omissions, with respect to the program that would exceed the license rights granted in the Agreement and these Program-unique Terms. Any other use of the program is prohibited. You are responsible for maintaining the overall security of your systems, processes, and information. The program includes the following code modules (hereinafter referred to as Modules ), which are installed into the customer-chosen destination path for the Trust Authority Registration Authority portion of the program: 1. All configuration files (file extension.cfg) and letter templates (file extension.ltr) in the \etc directory; 2. The policy_exit file in the \bin directory; and 3. All files in the \webpages directory. You may copy and modify the Modules only for the purpose of customizing hypertext markup language ( HTML ) screens, Java Server Pages, graphics, policy exits, configuration files, and sample letters in connection with your own applications, which you create for use with the program. You may not distribute or otherwise copy or modify the Modules. IBM shall have no liability to you or your customers or end users for your or their use of the program, and you agree to indemnify, defend, and hold IBM and its subsidiaries and suppliers harmless from and against any claims (actual or alleged) that are based on or arise in connection with: 1. Your use of the program; 2. Any of your customers or end users use of or interaction with the program; 3. Any use of or reliance upon any digital certificates issued by you using or in connection with the program; and/or 4. Any representations made by you about the program, provided that IBM: Promptly notifies you in writing of such claim, and Allows you to control, and cooperates with you in the defense and any related settlement negotiations. IBM shall have the right to participate in such claim at its own expense. Limited Warranty Applies: Yes Program Services: Available until November 30, 2001 Money-Back Guarantee: Two-month, money-back guarantee Copy and Use on Home/Portable Computer: No Volume Orders (IVO): Yes; contact your IBM representative. Passport Advantage Applies: Yes Passport Advantage Subscription Applies: Yes Support Line: Yes AIX/UNIX Upgrade Protection Applies: No Entitled Upgrade for Current AIX/UNIX Upgrade Protection Licensees: No AS/400 Software Subscription Applies: No Variable Charges Apply: No Charges Trust Authority is available through Passport Advantage only. Passport Advantage Note: For Passport Advantage and charges, contact your Lotus representative or authorized Lotus Business Partner. Additional information is also available on the Passport Advantage URL: Customer Financing: IBM Global Financing offers attractive financing to credit-qualified commercial and government customers and Business Partners in more than 40 countries around the world. IBM Global Financing is provided by the IBM Credit Corporation in the United States. Offerings, rates, terms, and availability may vary by country. Contact your local IBM Global Financing organization. Country organizations are listed on the Web at: Call Now to Order Contact the IBM Americas Call Centers (to help IBM serve you, use the Reference Code): Phone: 800-IBM-CALL Fax: 800-2IBM-FAX Internet: ibm direct@vnet.ibm.com Mail: IBM Americas Call Centers Dept. YE001 P.O. Box 2690 Atlanta, GA Reference Code: YE001 You can also contact your local IBM Business Partner or IBM representative. To identify them, call 800-IBM-4YOU. Note: Shipments will begin after the planned availability date. IBM Americas Call Centers, our national direct marketing organization, can add your name to the mailing list for catalogs of IBM products. Trademarks SecureWay and WebSphere are trademarks of International Business Machines Corporation in the United States or other countries or both. RS/6000, AIX, DB2, DB2 Universal Database, and AS/400 are registered trademarks of International Business Machines Corporation in the United States or other countries or both

7 Microsoft and Windows NT are trademarks of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. UNIX is a registered trademark in the United States and other countries exclusively through X/Open Company Limited. Lotus Passport is a trademark of Lotus Development Corporation. Lotus is a registered trademark of Lotus Development Corporation. Other company, product, and service names may be trademarks or service marks of others. Year 2000 Readiness Disclosure Statements made in this announcement regarding Year 2000 are Year 2000 Readiness Disclosures under the Year 2000 Information and Readiness Disclosure Act of 1998, a U.S. statute enacted on October 19,