v0.6 SFL Release
[email protected] (John Pawling)
| Newsgroups | gmane.ietf.sfl |
|---|---|
| Message-ID | <[email protected]> |
All,
J.G. Van Dyke and Associates (VDA) has delivered the sixth interim
release (Version 0.6) of the S/MIME Freeware Library (SFL). It has
been successfully tested with the SunOS 4.1.3 and MS Windows NT/95
operating systems. The SFL is a reference implementation of the IETF
S/MIME v3 CMS (draft-ietf-smime-cms-10) and ESS
(draft-ietf-smime-ess-09) Internet-Drafts (I-D). The updated IETF
I-Ds will be implemented in the next release. For example, the
recent changes to the Diffie-Hellman Key Agreement Method
I-D are not yet implemented.
The following enhancements are included in the v0.6 SFL release:
- Integrated CMS I-D changes into the ASN.1 syntax modules
used by the SFL. Changed the C++ Class structures accordingly.
- Implemented further improvements to the RecipientInfo processing
in the Encrypt/Decrypt logic. The Classes are being updated to
reflect the shared User Key Material concept (ongoing effort).
This task has been complicated by the CMS changes.
- Performed further memory leak testing in the Sign/Verify and
Encrypt/Decrypt main logic paths.
- Implemented further improvements to signed receipt processing
(ongoing effort to support multiple signatures on a receipt).
- Added attributes defined in the new SMIME I-Ds.
- Enhanced multiple SignerInfo logic.
- Continued to develop new test code and configuration files
to implement additional test cases. This includes updating
the reporting capability.
- Created a new group of client level Classes for the test
environment. These new test Classes facilitate the test case
implementation and demonstrate the use of the SFL Classes more
clearly. The new test Classes significantly increase the
maintainability of the SFL and serve as an example to
implementers of how to use the SFL.
- Changed SFL Class names to better reflect the data contained, not
the operation to be performed. The "sm_CompatibilityR05.h" file can
be used to maintain backward compatibility with the old class names.
The following class names were modified:
CSM_SignMsg to CSM_MsgToSign
CSM_VerifyMsg to CSM_MsgToVerify
CSM_EncryptMsg to CSM_MsgToEncrypt
CSM_DecryptMsg to CSM_MsgToDecrypt
CSM_AddSignMsg to CSM_MsgToAddSignatures
CSM_VerifyReceiptMsg to CSM_ReceiptMsgToVerify
CSM_SignData to CSM_DataToSign
CSM_VerifyData to CSM_DataToVerify
CSM_EncryptData to CSM_DataToEncrypt
CSM_DecryptData to CSM_DataToDecrypt
CSM_ReceiptData to CSM_DataToReceipt
CSM_ContentInfoMsg to be left alone (Wrapper class).
- CSM_ReceiptData class was changed from inheritance by
CSM_VerifyData to a public member of CSM_VerifyData.
- Updated SFL API document to reflect new class names and
editorial comments.
NOTE: MS Visual C++ 6.0 is required on Windows platforms to compile
the v0.6 SFL due to linkage failures using MSVC++ 5.0.
The v0.6 SFL has been successfully used to sign, verify, encrypt and
decrypt CMS objects using the mandatory algorithms (DSA, D-H<our
flavor>, 3DES) provided by the Crypto++ library and SHA-1 provided by
Government-furnished freeware. The v0.6 SFL has also been used to
sign, verify, encrypt and decrypt CMS objects using the RSA suite of
algorithms provided by the RSA BSAFE library. The SFL uses the SNACC
ASN.1 Library to encode and decode CMS signedData and envelopedData
objects. VDA used the v0.6 SFL to successfully exchange a variety of
signed and encrypted S/MIME messages between MS Outlook Express
(S/MIME v2) and the v0.6 SFL (S/MIME v3) using the RSA suite of
algorithms. The v0.6 SFL release includes: SFL High-level library;
SFL Crypto++ Crypto Token Interface Library (CTIL); BSAFE CTIL;
VDA-enhanced GNU SNACC ASN.1 Compiler and Library; test drivers and
test data.
Although we have made significant progress with the development of the
SFL, this interim release of the SFL is NOT complete. We are still in
the process of developing and testing the SFL. For example, we will
be enhancing the BSAFE CTIL to store the user's private keys in an
encrypted form. Further releases will be provided as significant
capabilities are added. The SFL is being delivered incrementally to
provide software as soon as possible to allow developers to: work with
the API; begin integrating the SFL into their applications; and to
provide feedback to the ongoing SFL development process. The SFL
documents and software are still being developed and are subject to
change. The goal for completion of the SFL is March 1999. The
stability of the S/MIME v3 I-Ds is a prerequisite for
meeting this delivery goal.
Future releases will include: incorporate S/MIME I-D
changes; support for additional attributes; Fortezza CTIL; additional
helper functions; multiple signerInfos in signed receipts; enhanced
test routines; bug fixes; support for other crypto libraries; and
support for other operating systems. The SFL will be thoroughly
tested and all memory leaks fixed. Robustness testing will be
performed. The SFL will be tested for interoperability with S/MIME v2
and v3 products. Other possible future enhancements include additional
example CTILs supporting other Cryptographic APIs, such as Open
Group's Common Data Security Architecture. We will continue enhancing
utilities to generate certificates to be used as test data.
The IMC has established an SFL web page (http://www.imc.org/imc-sfl)
which includes links to the SFL files stored on the VDA SFL Page
(http://www.jgvandyke.com/services/infosec/sfl.htm) and on the
Fortezza Developer's S/MIME Page
(http://www.armadillo.huntsville.al.us/software/smime).
The following SFL files are not export-controlled. They are available
at the Fortezza Developer's S/MIME Page and VDA SFL Page:
1) SFL Documents: SFL Fact Sheet, SFL Software Design Description, SFL
Application Programming Interface, SFL CTI API and SFL Public License.
Note: Only the API document was updated for v0.6.
2) snacc-1.3vda.tar.Z (Unchanged for v0.6) : Compressed tar file
containing SNACC ASN.1 Compiler and Library source code compilable
for Unix that has been enhanced by VDA to implement the
Distinguished Encoding Rules. makefiles are included.
3) snaccvc.zip (Unchanged for v0.6) : zip file containing SNACC
ASN.1 Compiler and Library source code that has been enhanced by
VDA to implement DER. MS Windows NT/95 project files are included
for the SNACC code, MIME++ and Crypto++. Note that the Crypto++
and MIME++ libraries are not included.
See (http://www.eskimo.com/~weidai/cryptlib.html) and
(http://hunnysoft.com/mimepp/) for these two libraries.
The following SFL files are export controlled and are available at the
Fortezza Developer's S/MIME Page:
1) sfl6Unixtar.Z: Compressed tar file containing all SFL source code
including: SFL Hi-Level source code; VDA-enhanced SNACC-generated
ASN.1 source code; SFL Crypto++ CTIL source code; SFL BSAFE CTIL
source code; makefiles. This file also contains test driver source
code, sample CMS test data and test X.509 Certificates. This file
also includes test utilities to create X.509 Certificates that each
include a D-H, DSA or RSA public key.
2) smimeR06.zip: Zip file containing all SFL source code including:
SFL Hi-Level source code; VDA-enhanced SNACC-generated ASN.1 source
code; SFL Crypto++ CTIL source code; SFL BSAFE CTIL source code;
project files. This file also contains test driver source code,
sample CMS test data and test X.509 Certificates. This file also
includes test utilities to create X.509 Certificates that each include
a D-H, DSA or RSA public key. SNACC release and debug libraries
compiled for MS Windows NT/95.
3) csmime.mdl contains SFL Class diagrams created using Microsoft
Visual Modeler (can be viewed using Releation Rose C++ Demo 4.0).
(NOT UPDATED TO REFLECT NEW CLASS NAME CHANGES!)
Instructions for applying for an account on the Fortezza Developer's
S/MIME Page are available from that page. An account is required to
download the SFL files from the Fortezza Developer's S/MIME Page due
to U.S. export restrictions. See the U.S. Bureau of Export
Administration's Commercial Encryption Export Controls web site at
http://www.bxa.doc.gov/encstart.htm for more information regarding the
U.S. export restrictions.
All source code for the SFL is being provided at no cost and with no
financial limitations regarding its use and distribution.
Organizations can use the SFL without paying any royalties or
licensing fees. VDA is developing the SFL under contract to the U.S.
Government. The U.S. Government is furnishing the SFL software at no
cost to the vendor subject to the conditions of the "SFL Public
License" available from the VDA SFL Page and Fortezza Developer's
S/MIME Page.
The SFL is composed of a high-level library that performs generic CMS
and ESS processing independent of the crypto algorithms used to
protect a specific object. The SFL high-level library makes calls to
an algorithm-independent Crypto Token Interface API. The underlying,
external crypto token libraries are not distributed as part of the SFL
source code. The application developer must independently obtain these
libraries and then link them with the SFL. For example, the SFL uses
the freeware Crypto++ library to provide 3DES, D-H and DSA. To use
the SFL with Crypto++ the vendor must download the Crypto++ freeware
library from the Crypto++ Web Page and then compile it with the SFL
source code.
The SFL software is developed to maximize portability to 32-bit
operating systems. In the future, support may be added for the
following operating systems: Macintosh, HP/UX 9.x/10.x, IBM AIX 3.2,
Sun Solaris 2.6 and SCO ODT 3.0/5.0.
The IMC has established an SFL mail list which is used to: distribute
information regarding SFL releases; discuss SFL-related issues; and
provide a means for SFL users to provide feedback, comments, bug
reports, etc. Subscription information for the imc-sfl mailing list
is at the IMC web site listed above.
All comments regarding the SFL software and documents are welcome. We
recommend that comments should be sent to the imc-sfl mail list. We
will respond to all messages on that list.
=========================================================
John Pawling, Director - Systems Engineering
J.G. Van Dyke & Associates, Inc., a Wang Global Company
[email protected]
=========================================================