Federal Interagency Working Group Qualifies Tumbleweed PKI Validation Solution for Use in Federal Bridge-Enabled Environment

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leadingprovider of e-mail security, file transfer security, and identityvalidation solutions, today announced that the Federal Public KeyInfrastructure (PKI) Policy Authority's Path Discovery and Validation(PD-Val) working group has qualified the Tumbleweed ValidationAuthority(TM) (VA) and Desktop Validator(TM) (DV) for Federalgovernment agencies employing enterprise-level, real time validationof digital certificates. Agencies can use Tumbleweed VA and DV toimplement a complete solution for enabling interoperability amongmultiple PKIs in the Federal Bridge-enabled environment.

Tumbleweed VA's real time validation capabilities are essentialfor protecting critical information infrastructures in large scaledistributed computing environments, and for enabling the trustedrelationships essential for secure and assured communications. Theprocess for establishing a trust relationship between two distinctentities, or certificate authorities, is called cross-certification.Cross-certification establishes how each entity agrees to trust andrely upon each other's public key certificates as if they had issuedthem themselves, enabling their respective users to interact securely.

The government created the Federal Bridge Certificate Authority(FBCA) to provide an environment in which Federal agencies can requestand perform cross-certification with other PKIs, which allows allentities participating in the FBCA to recognize and trust digitalsignatures and certificates sent from and between participatingorganizations. Currently, 13 PKIs have cross-certified with the FBCA,including the US Department of Defense, seven Federal agencies, theState of Illinois, and Wells Fargo.

For cross-certification of multiple agency PKIs to work, eachagency must implement a path discovery and validation solution capableof locating the correct certificate chains of trust (Path Discovery)and determine the validity and status of these trust relationships. Toensure compatibility and interoperability of such solutions within theFBCA, the National Institute of Standards and Technology (NIST)designed the Public Key Interoperability Test Suite (PKITS) and thePath Discovery Test Suite for use in evaluating and qualifyingcertificate validation solutions.

Chaired by the General Services Administration (GSA), the PD-Valworking group makes recommendations on infrastructure and desktopsolutions that will facilitate certificate validation, and itsrecommendations are based on the applicant's test results derived fromthe GSA's E-Authentication Lab. Enspier, which operates theinteroperability laboratory under the auspices of the E-Authenticationprogram, conducted extensive and rigorous tests on the Tumbleweedserver and desktop components according to NIST's specifications. Atthe completion of the testing process, the PD-Val working groupreviewed the results and recommended the inclusion of Tumbleweed'ssolution on the Qualified Validation List. The technical synopsis ofthe PD-Val evaluation and recommendation was posted online on February8, 2006, and is available via the following link:http://www.cio.gov/fbca/validation_solutions.htm.

"Tumbleweed's PKI validation solution addresses Federal agencies'requirements for a secure, reliable, and consistent method of pathdiscovery and validation for realizing the benefits ofcross-certification and extended interoperability of information andInternet communications systems," said Tumbleweed's Vice President,Federal Sales, Ann Smith. "As the provider of the most complete serverand desktop validation solution to be qualified for the FederalBridge, Tumbleweed is well positioned to help cross-certified Federalagencies achieve trusted communications in compliance withE-Authentication and other security initiatives, not only betweenagencies, but with other private and public sector organizations inthe U.S. and abroad."

The PD-Val working group's efforts are critical to achievingsecure and assured communications among Federal agencies participatingin the FBCA environment. In addition to enhancing the FBCAenvironment's operational capabilities, the rigorous testing andqualification process provides a framework that will also help Federalagencies align their efforts with other E-Authentication initiativessuch as Homeland Security Presidential Directive 12 (HSPD-12), whichcalls for a mandatory, government-wide standard for secure andreliable forms of identification, and Federal Information ProcessingStandard (FIPS) 201, which specifies the architecture and technicalrequirements for a common identification standard for Federalemployees and contractors.

Utilizing Tumbleweed Validation Authority and Desktop Validator,systems and end-users within any agency could seamlessly verify andvalidate certificates (used for authentication, digital signatures,etc.) from systems and end-users within other agencies that havecross-certified with the FBCA. Simultaneously validating identity andtrust relationships with other government and commercial entitiesoffers a number of benefits in terms of enhanced security and improvedefficiencies. As an example, Federal Contractor employees often dowork for multiple agencies, and the ability to validate credentialsand trust via the FBCA environment minimizes the number of smart cardsan individual would need to carry, while reducing the need foradditional credentials, since the same credential could be used forphysical and logical access as well as for secure messaging,cryptographic log-on, web access, wireless, VPN, or other electronictransactions.

About Tumbleweed Validation Authority

Tumbleweed Validation Authority (VA) ensures the validity andintegrity of highly valued and trusted transactions. ValidationAuthority is a Certificate Authority (CA) neutral, extensible serverthat utilizes multiple validation protocols for checking the validityof X.509 certificates within Public Key (PKI) environments. ValidationAuthority delivers a comprehensive, scalable, and reliable frameworkfor validating digital certificates in real time, and can validate acertificate issued by any CA. It complies with Federal InformationProtection Standard (FIPS) 140-1 (Software level 1), FIPS 140-2(Hardware level 3), DOD Joint Interoperability Testing Command, andIdentrus standards. Additionally the Validation Authority iscompleting Common Criteria (ISO/IEC 15408) Evaluation Assurance Level(EAL-3) certification by the National Information AssurancePartnership (NIAP), a collaboration between the National Institute ofStandards and Technology (NIST) and the National Security Agency(NSA).

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained inthis press release are based on plans and expectations as of the dateof this press release, and that a number of factors could cause theactual results to differ materially from the guidance given at thistime. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, thematters discussed in this press release may constitute forward-lookingstatements that involve risks and uncertainties that could causeactual results to differ materially from those projected, particularlywith respect to the qualification and deployment of Tumbleweed'sproducts by the U.S. government, as well as the functionality andperformance of Tumbleweed products. In some cases, forward-lookingstatements can be identified by terminology such as "may," "will,""should," "potential," "continue," "expects," "anticipates,""intends," "plans," "believes," "estimates," and similar expressions.For further cautions about the risks of investing in Tumbleweed, werefer you to the documents Tumbleweed files from time to time with theSecurities and Exchange Commission, particularly Tumbleweed's Form10-K filed March 16, 2005 and Form 10-Q filed November 2, 2005.

Tumbleweed assumes no obligation to update information containedin this press release, which represents Tumbleweed's expectations onlyas of the date of this release and should not be viewed as a statementabout Tumbleweed's expectations after such date. Although this releasemay remain available on Tumbleweed's website or elsewhere, itscontinued availability does not indicate that Tumbleweed isreaffirming or confirming any of the information contained herein.

About Tumbleweed Communications Corp.

Tumbleweed provides security solutions for email protection, filetransfers, and identity validation that allow organizations to safelyconduct business over the Internet. Tumbleweed offers these solutionsin three comprehensive product suites: MailGate(R),SecureTransport(TM), and Validation Authority(TM). MailGate providesprotection against spam, viruses, and attacks, and enablespolicy-based message filtering, encryption, and routing.SecureTransport enables businesses to safely exchange large files andtransactions without proprietary software. Validation Authority is theworld-leading solution for determining the validity of digitalcertificates. Tumbleweed's enterprise and government customers includeABN Amro, Bank of America Securities, Catholic Healthcare West, JPMorgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St.Luke's Episcopal Healthcare System, the U.S. Food and DrugAdministration, the U.S. Department of Defense, and all four branchesof the U.S. Armed Forces. Tumbleweed was founded in 1993 and isheadquartered in Redwood City, Calif. For additional information aboutTumbleweed go to www.tumbleweed.com or call 650-216-2000.

Tumbleweed, MailGate, SecureTransport, Tumbleweed ValidationAuthority, Validation Authority and Desktop Validator are eitherregistered trademarks or trademarks of Tumbleweed Communications Corp.in the United States and/or other countries. All other trademarks arethe property of their respective owners.