US Department of Defense PKI Program Management Office Selects Tumbleweed Validation Authority for Worldwide Deployment

Business Wire, Feb 7, 2005

REDWOOD CITY, Calif. -- Tumbleweed Valicert Validation Authority One of Two Highest Ranked Digital Certificate Validation Solutions by Independent Evaluation and Selected by DoD PKI PMO for 1.3 Million User Global Deployment

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of e-mail security, file transfer security, and identity validation solutions, today announced the US Department of Defense Public Key Infrastructure Program Management Office (DoD PKI PMO) has selected the Tumbleweed Valicert Validation Authority(TM) as one of two solutions for a global deployment, providing digital certificate validation to more than 1.3 million users worldwide.

DoD PKI PMO selected the Tumbleweed Valicert Validation Authority after an extensive independent evaluation of digital certificate validation solutions offered by nine vendors. The Tumbleweed Valicert Validation Authority was one of two highest ranked solutions under evaluation, making it a clear choice for digital certificate validation within the DOD Public Key Infrastructure (PKI). With a Common Access Card issued to almost 3.5 million users, the DOD PKI is the largest PKI deployment worldwide. DoD PKI PMO intends to deploy the Tumbleweed Valicert Validation Authority as part of a global infrastructure servicing more than 1.3 million users this year.

Based on the open standard Online Certificate Status Protocol (OCSP, RFC 2560), the Validation Authority allows applications to validate the status of a digital certificate in real time, ensuring that revoked credentials cannot be used for secure email, smart card login, web access, wireless, VPN or other electronic transactions. The Tumbleweed Valicert Validation Authority is the most widely deployed solution for digital certificate validation in the market today. Leading financial institutions, government agencies, as well as enterprises globally rely on the Valicert Validation Authority to secure their PKI transactions. The Valicert Validation Authority complies with Federal Information Protection Standard (FIPS) 140-l, DOD Joint Interoperability Testing Command, and Identrus standards. Additionally, the Valicert Validation Authority is currently under evaluation for Common Criteria (ISO/IEC 15408) Evaluation Assurance Level (EAL-3) by the National Information Assurance Partnership (NIAP), a collaboration between the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA).

"We are honored to have been selected by DoD PKI PMO to provide digital certificate validation. As a fourth generation product, our solution offers a robust feature set and a flexible architecture that has been deployed by numerous customers in many different operational environments," said John Hines, Director of Validation Authority Product Development at Tumbleweed. "Our proven track record makes us an ideal choice for DoD PKI PMO, and we are confident that our solution will enable DoD PKI PMO to meet its digital certificate validation objectives."

About the Tumbleweed Valicert Validation Authority

Tumbleweed Valicert Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments. Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time, and can validate a certificate issued by any CA.

The Validation Authority is the:

--Recognized leader in the field and is deployed at the majority of Identrus member banks

--Most widely deployed OCSP responder in the US Department of Defense PKI

In addition to the Tumbleweed Valicert Validation Authority, Tumbleweed also offers a suite of plug-in applications to simplify certificate validation processing at the application level. Server Validator (SV) is a plug-in for the most widely used Secure Web Servers on multiple OS platforms. Desktop Validator (DV) is a Microsoft OS based plug-in that provides highly flexible validation options for Microsoft Windows based applications.

About Tumbleweed

Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate, SecureTransport, and Valicert Validation Authority. MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. Valicert Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, the US Department of Defense, and all four branches of the US Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.