NAI Update

[Scott Fullerton <sfullerton@glhec.org>]

This is for members of the Electronic Exchange listserve.  Much of this was 
already posted to the CommonLine listserve. In this message, I have included 
the events taken place since then.
----------------
This is an update on our negotiations with Network Associates Incorporated 
 (NAI) for the use of PGP software.   As you will see, there are as yet 
unresolved issues, although none seem yet to be show-stoppers.  I will follow 
this up with another report later in the week to keep you posted.

In the meantime, if you are interested in receiving PGP software for $130.50 
and have not already sent in the contact information, please send it _directly_ 
to Brian Jackman bjackman@pgp.com.  There should be a single contact from each 
company. He will get in touch with you.  I have passed along all the 
information sent to me.
-------------------------
Discussion in San Antonio
Those who attended the San Antonio meeting will recall that NAI put forward a 
very attractive offer to CommonLine members.  The offer consists of the 
following:
1)         Software for $130.50  (versions 4.x and compatible development tools 
along with the SDK, their newest toolset).
2)         License to embed software in SBS for $25/installation.  The licenses 
can be transferred when we upgrade to their current version.
3)         Support through May 1999.  There is no extra support charge. The 
offer stipulated that to be assured of acquiring licenses, we must purchase  in 
March.  They are interested in closing the deal as quickly as possible.
Their reasons for this derive primarily from their inability due to the 
 ongoing legal issues to guaranty availability of products using the RSA 
 algorithm much beyond that time.

The product set we will be using is several releases and one full version 
number behind their current offering, but it is the _only_ set of products that 
fully supports a common algorithm, RSA, across all platforms where CommonLine 
applications might run.  NAI is phasing out its use of the RSA algorithm in 
favor of Diffie-Hellman.  Unfortunately the two algorithms are mutually 
incompatible.  The most recent release of the development toolset (the SDK) 
does not support RSA, only Diffie-Hellman, and Diffie-Hellman is not available 
for 16-bit end-use or development. Our options are determined by the lowest 
common denominator.   Since many SBS products are still 16-bit Windows, our 
entire network must settle on an algorithm that is available to that platform 
and compatible with the rest.

The NAI offer contained two important protections to offset the obvious 
problems attending the purchase of outdated software -- promise of technical 
support through May 1999 and an easy upgrade path to their newest version, when 
CommonLine is ready to move away from 16-bit Windows.
---------------------------
Developments Since the San Antonio Meeting.
**Support
The engineer at NAI most knowledgeable about the software we are purchasing has 
 resigned.   NAI is attempting to set up a support structure to guarantee 
 satisfactory support through May 1999 with the understanding that our support 
needs will be heaviest in the first three or four months after purchase and 
 then sharply tapering off.   They are hoping to have this settled within the 
 next day or so.
--
3/19: It seems they will train at least two engineers to provide the support. 
 They are also still exploring the option of retaining the departing engineer 
most closely involved in development of 4.x and toolkit as a consultant for our 
purposes.  We are still awaiting clearer information.

**Licensing.
A legal counselor from PHEAA and I met Monday with David Tauber of the legal 
 department at NAI to identify issues involved in setting up licensing terms. 
  We received sample license agreements (available upon request) and have 
scheduled a follow-up meeting this week.
3/19 We are still awaiting a draft of the proposal as an addendum to the 
general terms and conditions from Brian Jackman. Next meeting with NAI 
scheduled for 3/20

**Deadlines
Given the facts that 1) the support issue is as of yet unresolved and 2) their 
offer is not yet formally in writing, the March 31 deadline for purchase does 
not seem feasible.  I told this to people at NAI, Brian Jackman and David 
Tauber, yesterday.   They will review their situation and get back to us.
3/19  Have heard nothing further from them yet.

**Transfer of Licenses
There was some discussion at the San Antonio meeting about how to accommodate 
lenders who wanted in to CommonLine after the offer was closed.  We discussed 
the possibility of purchasing extra copies of software to assist these lenders. 
 This possibility is acceptable to NAI.
3/19 NCHELP is willing to purchase some copies.  We are still trying to figure 
out how many.

**License Renewal
After May 1999, we will have to pay 10% of our initial purchase for support.  I 
believe this becomes a per-annum cost.
-----------------------------

Scott Fullerton
Chair CommonLine Electronic Exchange Subcommittee
608.246.1779
sfullerton@glhec.org