28 May 1998

    Date: Thu, 28 May 1998 12:15:26 +0100
    To: ukcrypto@maillist.ox.ac.uk
    From: Robert Willmott <rhw@makra.demon.co.uk>
    Subject: EEMA Security Framework announcement

    The European Eectronic Messaging Association Security Privacy and Legal
    Committee (EEMA - SPLC) will formally launch its Framework for Secure
    Inter-Organisational Messaging at its Annual Conference on Tuesday 2nd
    June next week. It may be of interest to members of this list since it
    addressess a number of issues which have arisen on this list over the
    last months:

    (1) Use of dual keys and algorithms to separate Signatures from
    Confidentiality as far as is possible to underline the desire to avoid
    escrow of signature keys;

    (2) Business definition of the meanings of the security functions made
    available to the user (i.e. distinctions are made between digital
    signatures generated for the Authentication/Integrity an SIGNATURE
    functions);

    (3) A mechanism for contractually binding users of the framework to the
    signatures they generate by means of hand signatures to a Memorandum of
    Understanding. The MoU acts as a mutilateral contract between all who
    sign it - the MoUs are administered by CAs;

    (4) Mapping the standards security functions and processing onto a
    variety of electronic messaging and information object formats (but
    retaining the same security semantics);

    (5) Cryptographic Algorithm flexibility - users declare their
    cryptographic capabilities in their X.500 Directory entry together with
    their X.509 Certificates. A cryptographic profile of algorithms is
    suggested, but users may declare and use others if need be;

    (6) Support for Authentication, Signature, Non-Repudiation of Receipt,
    Notarisation, Confidentiality, Firewalls (in some messaging systems
    through Labels), Message Sequence Integrity;

    EEMA is seeking ways of implementing a pilot project based on the
    framework, involving X.500 Directories, CAs, Messaging System Suppliers,
    Security System suppliers, and Users.

    There are three documents:

            The Memorandum of Understanding (the user contract);
            The Framework - the technical specification;
            A Guide.

    The first two can be obtained from the EEMA WEB site
    (http://www.eema.org/). The guide is free to members, but a charge will
    be made to non-members.

    EEMA is an association which brings together all who are interested in
    messaging and the messaging market. Its members include service
    providers, suppliers and users.

    I would be interested in any comments on the framework, and anyone who
    would like to get involved in implementing it.

    Regards
    --
    Robert Willmott - Independent IT Communications Consultant
    Tel: +44 1 7327 62211
    Fx:  +44 1 7327 61257