United States Air Force Pilots Tumbleweed to Validate Digital Identity for DoD's Public Key Infrastructure.

Business Editors/High-Tech Writers

REDWOOD CITY, Calif.--(BUSINESS WIRE)--Feb. 23, 2004

Provides Validation of Digital Certificates on Common

Access Cards to Help the U.S. Air Force Meet the DoD

Mandate for its Public Key Infrastructure

Tumbleweed(R) Communications Corp. (Nasdaq:TMWD), a leading provider of secure Internet messaging software for enterprises, financial services organizations and government, announced today that the United States Air Force is conducting a pilot of Tumbleweed's Valicert Validation Authority(TM) to validate Department of Defense (DoD) Common Access Card transactions as part of an initial capability effort. A critical first phase of the DoD Public Key Infrastructure (PKI) initiative that requires email messages to be digitally signed by DoD senders, beginning in 2004.

Common Access Cards (CACs) work as identification cards for members of the military and DoD contractors and serve as the authentication token for DoD's computerized public key infrastructure. Using the DoD's PKI, these smart cards offer a great deal of security to normal activities, such as adding identity and authentication, confidentiality and non-repudiation to email messages and web transactions, and permitting entry into DoD's computer networks.

The CAC smart cards include the user's X509v3 digital certificate, which includes the user's name, organization, and other identification information. However, these digital certificates expire or can be revoked for various reasons such as a lost or stolen CAC. As a result, the Air Force needs to confirm that the digital certificate on each CAC is current and valid before allowing a transaction to occur.

The Tumbleweed Valicert Validation Suite of products offer a comprehensive, scalable and reliable framework for validating X.509 digital certificates (issued by any certificate authority), in real time, with the ability to utilize multiple validation protocols. The Valicert Desktop Validator (DV), Server Validator (SV), and Enterprise Validation Authority (EVA) are the Tumbleweed components being piloted by the Air Force for checking the status of digital certificates by many client and server applications. The Air Force is utilizing the On-line Certificate Status Protocol (OCSP) for checking all software based and Common Access Card certificates, which is a well-accepted standard (IETF RFC 2560) for checking certificate revocation status.

"Certificate status checking is an important part of the defense in depth strategy that the DoD PKI affords relying parties across the Air Force enterprise," said Steven Knight, Lead Engineer for the Air Force PKI program. "OCSP represents an effective means of accomplishing that check for Air Force users, particularly those in bandwidth-constrained environments."

About the Tumbleweed Valicert Validation Authority Suite

Validation Authority ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a CA neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments.

Validation Authority (VA) delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time. Validation Authority can validate a certificate issued by any Certificate Authority (CA). The Validation Authority is the:

-- Recognized leader in the field and is deployed at the majority

of Identrus member banks

-- Most widely deployed OCSP responder in the DoD PKI.

In addition to the Valicert Validation Authority, Tumbleweed also offers a suite of plug-in applications to simplify certificate validation processing at the application level. Server Validator (SV) is a plug-in for the most widely used Secure Web Servers on multiple OS platforms. Desktop Validator (DV) is a Microsoft OS based plug-in that provides highly flexible validation options for Microsoft Windows based applications.

Downloading CRLs to the desktop is time consuming and impractical in the everyday environment, and even less practical in low bandwidth and tactical environments," said David Jevans, Senior Vice President of Marketing for Tumbleweed Communications. "Tumbleweed's Valicert Validation Authority utilizes DoD CRL data to produce OCSP responses in real time, dramatically reducing the size of data transmitted in order to perform certificate revocation checking. This is a huge efficiency win for DOD customers."

About Tumbleweed Communications Corp.

Tumbleweed is a leading provider of secure Internet messaging software products for enterprises, financial services organizations and government. By making Internet communications secure, reliable and automated, Tumbleweed's email firewall, secure file transfer, secure email, and identity validation solutions help customers significantly reduce the cost of doing business. Tumbleweed products are used by millions of end-users and tens of thousands of corporations. Tumbleweed customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), Society for Worldwide Interbank Financial Telecommunication (SWIFT), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, and the US Navy and Marine Corps. Tumbleweed Communications was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the features and performance of Tumbleweed's products, as well as the requirements of the Department of Defense's PKI initiative. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed June 4, 2003, Form 10-Q filed November 14, 2003, and Form S-3/A filed December 19, 2003.

Tumbleweed assumes no obligation to update information contained in this press release, which represents the company's expectations only as of the date of this release and should not be viewed as a statement about the company's expectations after such date. Although this release may remain available on either company's website or elsewhere, its continued availability does not indicate that either company is reaffirming or confirming any of the information contained herein.