Contact Us Resource Center RSS How to Buy  

› Home › News & Events › Press Releases

Tumbleweed Valicert Validation Authority™ To Complete National Information Assurance Partnership (NIAP) Common Criteria Evaluation

VA 4.8 Server and Clients to be evaluated for conformance to the Common Criteria

Redwood City, CA – June 14, 2004 - Tumbleweed® Communications Corp. (NASDAQ:TMWD), a leading provider of secure Internet messaging software and hardware to enterprises and government agencies, today announced that the Tumbleweed Valicert Validation Authority™ (VA) has been accepted by the National Information Assurance Partnership (NIAP) for International Common Criteria for Information Technology Security Evaluation. Common Criteria evaluation is an activity managed by the National Institute of Science and Technology (NIST) and the National Security Agency (NSA). Completing the evaluation process is an important milestone for customers who want independent validation regarding the security capability of mission-critical products, like the VA.

“Common Criteria evaluation will make the Validation Authority the first complete Public Key Infrastructure (PKI) digital certificate validation solution that has passed FIPS 140-1, DOD DISA JITC and the Common Criteria evaluation,” said John Hines, Director of Validation Authority Product Development. “The Common Criteria evaluation will be completed later this year, and will provide customers an even greater level of confidence in our solution. The VA is the most widely deployed PKI digital certificate validation solution by the US Department of Defense as well as international banks and financial institutions. Common Critiera certification is recognized by 19 participating countries in the Common Criteria Mutual Recognition Agreement, which will open up new markets for the VA product line.”

Tumbleweed has chosen Science Applications International Corporation (SAIC), accredited by NIST’s National Voluntary Laboratory Accreditation Program (NVLAP), as the Common Criteria Testing Laboratory for the evaluation. Tumbleweed’s validation solution has been targeted for Evaluation Assurance Level (EAL) 3, and will be tested for conformance to the Certificate Issuing and Management Components Security Level 1 Protection Profile (CIMC SL 1PP). Tumbleweed has already successfully completed Common Criteria evaluation of its secure email firewall solution, Messaging Management System (MMS). The inclusion of VA into the ‘In Process’ list for Common Criteria can be found on http://niap.nist.gov/cc-scheme/in_evaluation.html#t.

About the Tumbleweed Valicert Validation Authority
Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments.

Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time. Validation Authority can validate a certificate issued by any CA.

The Validation Authority is the:

• Only validation solution that supports both stand-alone and distributed OCSP solutions
• Most widely deployed OCSP responder in the US Department of Defense PKI.
• Recognized leader in the field and is deployed at the majority of Identrus member banks

In addition to the Valicert Validation Authority, Tumbleweed also offers a suite of plug-in applications to simplify certificate validation processing at the application level. Server Validator (SV) is a plug-in for the most widely used Secure Web Servers on multiple OS platforms. Desktop Validator (DV) is a Microsoft OS based plug-in that provides highly flexible validation options for Microsoft Windows based applications.

About Tumbleweed Communications Corp.
Tumbleweed is a leading provider of secure Internet messaging software and appliances for enterprises and government agencies. By making Internet communications secure, reliable and automated, Tumbleweed's email firewall, secure file transfer, secure email, and identity validation solutions help customers significantly reduce the cost of doing business. Tumbleweed products are used by millions of end-users and tens of thousands of corporations. Tumbleweed customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, and the US Navy and Marine Corps. Tumbleweed Communications was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed, go to www.tumbleweed.com or call 650-216-2000.

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the usage, features, and performance of Tumbleweed’s Valicert Validation Authority products. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 15, 2004 and Form 10-Q filed May 10, 2004.

Tumbleweed assumes no obligation to update information contained in this press release, which represents the company's expectations only as of the date of this release and should not be viewed as a statement about the company's expectations after such date. Although this release may remain available on either company's website or elsewhere, its continued availability does not indicate that either company is reaffirming or confirming any of the information contained herein.