Adding X.400 Security Features

Adding X.400 Security Features

Isode has recently shipped some major new X.400 security capabilities, which you can read about in detail here: https://www.isode.com/whitepaper/amhs-security/

This post shares some notes on why we are shipping major new features for a very stable standard (the X.400 “final” edition was in 1999).

Security features were added to the X.400 (1988) version, the second version of X.400 after the original 1984 version. I worked on X.400(1988) standardization and implementation at University College London prior to founding Isode.

At this time, X.400 was, functionally, a long way ahead of the then-very-basic SMTP email. X.400(1988) added a comprehensive set of messaging security features, many of which are not provided in other standards (e.g., proof of delivery & non-repudiation of delivery).

These security features were not adopted by enterprise deployments of X.400 (historical) or EDI deployments (ongoing).

STANAG 4406 Edition 1, the NATO military messaging protocol based on X.400, used X.400 signing and encryption. However, in Edition 2, it shifted to using CMS (Cryptographic Message Syntax), which is what S/MIME uses.

AMHS is the Aviation standard for ground-to-ground messaging based on X.400, replacing older text-based protocols. AMHS is deployed worldwide. AMHS is specified in ICAO Doc 9880, which has always included a detailed specification of using X.400 security. Isode provided initial implementations of these capabilities many years ago, but there was no customer interest or adoption.

This all changed with Edition 3 of Doc 9880, which is leading to regional mandates to deploy with security.   Isode has responded to these mandates by implementing the security features to support our partners and customers. There are two key changes:

1. Peer Authentication for X.400 P1, P3, and P7 protocols.   Operation without strong authentication means exchanging clear-text passwords. Even on closed aviation networks, this is no longer considered acceptable.
2. Digital signatures of messages provide Origin Authentication and Content Integrity services. These are important for operationally critical messages, such as flight plans, that are exchanged via AMHS.

Digital signatures are provided in a special way. STANAG 4406 Ed1 uses Message Origin Authentication Check (MOAC), which is a per-message service. AMHS uses Message Token, which is a per-recipient service. The advantage of this approach is that it enables the Message Sequence Integrity service, which allows a recipient to securely determine whether messages are received in order (and whether any are missing). Ordering can be operationally critical – consider a Flight Plan followed by an update to the Flight Plan.

Although this use of the X.400 security services is far removed from the original X.400 vision of providing THE global mail service, it is nevertheless satisfying to see these capabilities moving towards providing important operational value.