US Army Standardizing on Tumbleweed PKI Validation Solution for Secure Messaging and Cryptographic Log-on

Army Accelerating PKI Implementation to Meet New DoD-Wide MandateRequiring 100 Percent Smart Card Log-On Authentication by July 31,2006

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leadingprovider of email security, managed file transfer, and identityvalidation appliance and software products, today announced that theUnited States Army has contracted with TKCIS, an Alaskan Native 8(a)corporation, to procure the Tumbleweed Validation Authority(TM) (VA)in support of the Army's efforts to achieve enterprise-wide public keyinfrastructure (PKI) validation for smart card log-on and securemessaging. Tumbleweed VA is based on the open standard OnlineCertificate Status Protocol (OCSP, RFC 2560), and is already the mostwidely deployed PKI validation solution in the U.S. Department ofDefense (DoD). Designed to validate the status of digital certificatesin real time, Tumbleweed VA ensures that revoked credentials cannot beused for secure email, smart card login, web access, wireless, VPN, orother electronic transactions.

The Army began accelerating deployment of Tumbleweed VA earlierthis month in response to a new DoD-wide mandate requiring allmilitary services and agencies to implement PKI and 100 percent use ofsmart card cryptographic log-on to the Non-Classified IP RouterNetwork by July 31, 2006. The mandate also requires implementation ofpublic key enabling for user authentication, digital signatures, andencryption on all desktops, servers, and laptops. The Joint TaskForce-Global Network Operations (JTF-GNO) accelerated the PKIimplementation schedule in response to an increasing number of attacksand attempts to steal U.S. military secrets and slow networkoperations. The use of VA for enabling smart card cryptographic log-onalso meets other directives on identity protection, including HomelandSecurity Presidential Directive 12 (HSPD 12).

"This award supports the Army's goal to leverage the existinginvestment in its public key infrastructure, and to realize theTumbleweed VA's potential as an enabling technology for protectingcritical information infrastructures and assuring the integrity ofcommunications," said Ann Smith, Tumbleweed's Vice President, FederalSales. "Once VA is fully deployed, more than 800,000 Army personnelwill be able to use their Common Access Cards (CAC) in compliance withthe new DoD mandate to access department networks, communicate viae-mail, and conduct other transactions with a substantially greaterlevel of assurance."

Under its PKI initiative, the DoD has issued almost five milliondigital certificates to military personnel and civilian contractors.This digital certificate, stored on a CAC or "smart" card, includesthe user's name, organization, and other identification information.The smart card is used to secure mission-critical applications such asemail, web server access, network access, and system login.

As part of the DoD's "Defense In Depth" strategy, all DoD sendersmust digitally sign email messages using their smart card. Like anyphysical credential, however, digital certificates must be validatedat time of use to ensure the certificate is not revoked or expired. Inparticular, DoD organizations must validate the status of the digitalcertificate stored on the smart card when used to sign an emailmessage or perform any trusted transaction.

To align operations with the DoD's PKI and Defense In Depthinitiatives, the Army decided to standardize on Tumbleweed VA,concluding that the product satisfies its requirements for acost-effective solution that provides capabilities to speed thereal-time validation of digital certificates, ensure securecommunications, and to support the system-wide use of smart cards forcryptographic access to desktop, server, and network resources.Performing cryptographic logon via smart card will eliminate the needfor individuals to use multiple passwords for accessing networksystems.

In addition to supporting the Army's PKI initiatives, the contractaward to TKCIS will help the Army expand its efforts to increase thepercentage of government contracts awarded to Native American andtribally-owned small businesses. Partnering with Tumbleweed willenable TKCIS to expand the depth and breadth of the solutions andexpertise the company can offer.

TKCIS' Senior Vice President, GSA & Systems Integration Division,Joel Lipkin, notes that "as an IT solutions and services provider, youmust have the ability to offer industry-leading components to drivereal growth and satisfy customer requirements. Partnering on thiscontract with Tumbleweed, clearly a market leader in email security,file transfer security, and identity validation solutions, provides uswith a greater business development platform for driving growth in thesolutions as well as the services components of our operations."

About Tumbleweed Validation Authority

Tumbleweed Validation Authority (VA) ensures the validity andintegrity of highly valued and trusted transactions. ValidationAuthority is a Certificate Authority (CA) neutral, extensible serverthat utilizes multiple validation protocols for checking the validityof X.509 certificates within Public Key Infrastructure (PKI)environments. Validation Authority delivers a comprehensive, scalable,and reliable framework for validating digital certificates in realtime, and can validate a certificate issued by any CA. It complieswith Federal Information Protection Standard (FIPS) 140-l, DOD JointInteroperability Testing Command, and Identrus standards.Additionally, Validation Authority is completing Common Criteria(ISO/IEC 15408) Evaluation Assurance Level (EAL-3) certification bythe National Information Assurance Partnership (NIAP), a collaborationbetween the National Institute of Standards and Technology (NIST) andthe National Security Agency (NSA).

Tumbleweed VA is the first fully open standards product to enabledigital certificate status validation in large scale distributedcomputing environments through the introduction of a newRepeater-Responder architecture, a significant innovation in digitalcertificate validation and PKI. A Repeater is an OCSP caching serverwhich can be pre-loaded with OCSP responses generated by a Responder,as well as dynamically build up an OCSP response cache by acting as aproxy for client requests to a Responder. The product's flexiblearchitecture improves performance, security, fault-tolerance, andoverall robustness of PKI. Since Repeaters and Responders do not needto be in the same administrative domain, Responders (and theirassociated private keys) can be further secured via a firewall or airgap. Additionally, since Repeaters do not need to perform any digitalsigning operations, they enable organizations to scale their digitalcertificate validation infrastructures without incurring theadditional cost of hardware signing modules.

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained inthis press release are based on current plans and expectations, andthat a number of factors could cause the actual results to differmaterially from the guidance given at this time. These factors aredescribed in the Safe Harbor statement below.

Except for the historical information contained herein, thematters discussed in this press release may constitute forward-lookingstatements that involve risks and uncertainties that could causeactual results to differ materially from those projected, particularlywith respect to the deployment of Tumbleweed Validation Authority bythe U.S. Department of Defense, as well as the performance andfunctionality of Tumbleweed's products. In some cases, forward-lookingstatements can be identified by terminology such as "may," "will,""should," "potential," "continue," "expects," "anticipates,""intends," "plans," "believes," "estimates," and similar expressions.For further cautions about the risks of investing in Tumbleweed, werefer you to the documents Tumbleweed files from time to time with theSecurities and Exchange Commission, particularly Tumbleweed's Form10-K filed March 16, 2005 and Form 10-Q filed November 2, 2005.

Tumbleweed assumes no obligation to update information containedin this press release, including for example its guidance regardingits future performance, which represents Tumbleweed's expectationsonly as of the date of this release and should not be viewed as astatement about Tumbleweed's expectations after such date. Althoughthis release may remain available on Tumbleweed's website orelsewhere, its continued availability does not indicate thatTumbleweed is reaffirming or confirming any of the informationcontained herein.

About TKC Integration Services, LLC

TKC Integration Services (TKCIS) is a small disadvantagedbusiness, an SBA-certified 8(a) Corporation, a tribally-owned NativeAmerican Corporation, and an Alaskan Native Corporation with anextensive track record in delivering a wide spectrum of technologysolutions for the Federal government. TKCIS is 100% owned by TKCManagement Services Company (TKCMS), a holding company charged withgrowing companies that generate income to be distributed to over13,000 Native American shareholders. Known for phenomenal service andexceptional accuracy in client delivery, the TKC companies currentlyprovide over $140,000,000 in services to federal and commercialcustomers, with core expertise in telecommunications, informationtechnology, product development, major program management,construction management, facility operations, and operations support.For more information on TKCIS, go to www.tkcis.com. Additionalinformation on TKCMS and its subsidiaries is available atwww.tkcms.com.

About Tumbleweed Communications Corp.

Tumbleweed provides security solutions for email protection, filetransfers, and identity validation that allow organizations to safelyconduct business over the Internet. Tumbleweed offers these solutionsin three comprehensive product suites: MailGate(R),SecureTransport(TM), and Validation Authority(TM). MailGate providesprotection against spam, viruses, and attacks, and enablespolicy-based message filtering, encryption, and routing.SecureTransport enables business to safely exchange large files andtransactions without proprietary software. Validation Authority is theworld-leading solution for determining the validity of digitalcertificates. Tumbleweed's enterprise and government customers includeABN Amro, Bank of America Securities, Catholic Healthcare West, JPMorgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St.Luke's Episcopal Healthcare System, the U.S. Food and DrugAdministration, the U.S. Department of Defense, and all four branchesof the U.S. Armed Forces. Tumbleweed was founded in 1993 and isheadquartered in Redwood City, Calif. For additional information aboutTumbleweed go to www.tumbleweed.com or call 650-216-2000.

Tumbleweed, MailGate, SecureTransport and Validation Authority areeither registered trademarks or trademarks of TumbleweedCommunications Corp. in the United States and/or other countries. Allother trademarks are the property of their respective owners.