v1.0 SFL Now Available

All,

J.G. Van Dyke and Associates (VDA) has delivered Version 1.0 of the S/MIME 
Freeware Library (SFL).  v1.0 provides the basic functionality specified in
the 
IETF S/MIME v3 CMS (draft-ietf-smime-cms-13) and ESS
(draft-ietf-smime-ess-12) 
Internet-Drafts.  It has been successfully tested using the MS Windows NT/95
and Solaris 2.6 operating systems.  Further enhancements, ports and testing
are 
still in process.

The following enhancements are included in the v1.0 SFL release (compared
with 
the v0.7 interim release):

- Completed first level integration testing on Ephemeral Static (E-S) Diffie

Hellman (D-H) key management.

- Completed MLExpansionHistory processing in signed receipt logic.

- Added support for the signingCertificate attribute.
 
- Performed integration testing on CMS-13 3DES and RC2 key wrap algorithms. 

- Continued development on "C" API login.  This simplifies application
        login to SFL CTILs.

- Developing "C" API and documentation (see new SFL API document).

- Performed further Memory leak testing.

- Developed new test code and configuration files to implement test cases.

- Added test utility for reading MIME encoded messages containing single
body 
part or multi-part CMS components (SignedData or EnvelopedData) was
developed 
and tested.  This utility reports the contents of the CMS components, and
will 
perform limited signature verification operations. It will also read
ContentInfo 
wrapped CMS components, non-ContentInfo wrapped components, or certificates.

The v1.0 SFL has been successfully used to sign, verify, encrypt and decrypt

CMS objects using the mandatory algorithms (DSA, E-S D-H, 3DES) 
provided by the Crypto++ library and SHA-1 provided by Government-furnished 
freeware.  The v1.0 SFL has also been used to sign, verify, encrypt 
and decrypt CMS objects using the RSA suite of algorithms provided by 
the RSA BSAFE v3.0 library. The SFL uses the SNACC v1.3 ASN.1 Library to
encode 
and decode CMS signedData and envelopedData objects. The v1.0 SFL 
release includes: SFL High-level library; SFL Crypto++ 3.0 Crypto Token 
Interface Library (CTIL); BSAFE CTIL; VDA-enhanced GNU SNACC v1.3 rev 0.07 
ASN.1 Compiler and Library; test drivers and test data.

The SFL has been successfully used to exchange signedData and envelopedData 
messages with the Microsoft (MS) Internet Explorer Outlook Express v4.01 and

Netscape Communicator 4.X S/MIME v2 products.  Signed messages have been 
exchanged with the RSA S/MAIL, WorldTalk and Entrust S/MIME v2 products.  

A significant amount of progress has been made with S/MIME v3
interoperability 
testing between the SFL and MS.  We successfully completed testing the
CMS-13 
envelopedData features.  We used the SFL to successfully decrypt
MS-generated 
envelopedData messages containing KEKRecipientInfo syntaxes including 3DES-
wrapped and RC2-wrapped content encryption keys.  We also used the SFL to 
successfully decrypt MS-generated envelopedData messages containing 
KeyAgreeRecipientInfo syntaxes using an E-S D-H pairwise key with
3DES-wrapped 
and RC2-wrapped content encryption keys.  MS was able to successfully
decrypt 
SFL-generated messages including the same features as above.  As part of
this 
testing, MS was able to successfully use a VDA-generated D-H certificate.
In 
the past, we have successfully exchanged RSA-signed signedData messages.  We

still need to perform DSA interoperability testing 
and to ensure that we have thoroughly tested all applicable CMS-13/ESS-12 
features such as verifying a signed receipt.

We are still in the process of enhancing and testing the SFL.  For example,
we 
will be enhancing the BSAFE CTIL to store the user's private keys in an  
encrypted form.  Further releases will be provided as significant
capabilities 
are added.  Future releases will include: enhanced error reporting;  
countersignatures; Fortezza CTIL; Spyrus SPEX/ CTIL; encryptedData content
type; further "C" API testing; additional helper functions;  
enhanced test routines; bug fixes; support for other crypto libraries; and 
support for other operating systems. Other possible future enhancements
include 
additional example CTILs supporting other Cryptographic APIs, such as PKCS
#11.
We will enhance the utilities to generate certificates to be used as test
data.

The IMC has established an SFL web page (http://www.imc.org/imc-sfl) 
which includes links to the SFL files stored on the VDA SFL Page 
(http://www.jgvandyke.com/services/infosec/sfl.htm) and on the 
Fortezza Developer's S/MIME Page 
(http://www.armadillo.huntsville.al.us/software/smime).  

The VDA-enhanced SNACC ASN.1 software and SFL documentation are freely
available to everyone at the VDA SFL Page.  All other portions of the SFL
software are export controlled in accordance with the U.S. Government Export

Administration Regulations.  For specific details and guidance on 
exporting the SFL software, contact the U.S. Department of Commerce,
Bureau of Export Administration, Export Counseling Division, (202) 
482-4811.  The Bureau of Export Administration maintains additional 
resources online on its Commercial Encryption Export Controls page 
(http://www.bxa.doc.gov/Encryption/Default.htm).

Instructions for applying for an account on the Fortezza Developer's
S/MIME Page are available from that page.  An account is required to
download the SFL files from the Fortezza Developer's S/MIME Page due
to U.S. export restrictions.               

The following SFL files are not export-controlled.  They are available 
at the Fortezza Developer's S/MIME Page and VDA SFL Page:

1) SFL Documents: SFL Fact Sheet, SFL Software Design Description, SFL 
Application Programming Interface, SFL CTI API, SFL Software Test
Description,
SFL Overview Briefing and SFL Public License.
     
2) snaccvda07.zip: Zip file containing SNACC v1.3 rev 0.07 ASN.1 Compiler
and
Library source code compilable for Unix and MS Windows NT/95/98 that has
been 
enhanced by VDA to implement the Distinguished Encoding Rules.  
project files and makefiles are included.  This release of SNACC
does not depend on the SFL include files and libraries.
This file includes a sample test project demonstrating the use of the
SNACC classes.


The following SFL files are export controlled and are available at the 
Fortezza Developer's S/MIME Page:

Note: When this message was sent, the text of the Fortezza Developer's
S/MIME Page still needed to be updated to state that v1.0 is available,
but the correct v1.0 smimeR10.zip file and API document are available.

1) smimeR10.zip:  Zip file containing all SFL source code including: 
SFL Hi-Level source code; VDA-enhanced SNACC-generated ASN.1 source 
code; SFL Crypto++ CTIL source code; SFL BSAFE CTIL source code; 
project files.  This file also contains test driver source code, 
sample CMS test data and test X.509 Certificates.  This file also 
includes test utilities to create X.509 Certificates that each include 
a D-H, DSA or RSA public key.  SNACC release and debug libraries
are compiled for MS Windows NT/95/98 and Linux.  MS Windows NT/95/98
project files and Unix makefiles are included for the SNACC code, 
MIME++ and Crypto++.  Note that the Crypto++ and MIME++ libraries are not
included.  See (http://www.eskimo.com/~weidai/cryptlib.html) and
(http://hunnysoft.com/mimepp/) for these two libraries. 

2) csmime.mdl contains SFL Class diagrams created using Microsoft 
Visual Modeler (comes with MS Visual Studio 6.0, Enterprise Tools).
The file can also be viewed using Rational Rose C++ Demo 4.0
45 day evaluation copy which can be obtained from
http://www.rational.com/uml/resources/practice_uml/index.jtmpl.
Not all classes are documented in the MDL file at this time.

All source code for the SFL is being provided at no cost and with no 
financial limitations regarding its use and distribution. 
Organizations can use the SFL without paying any royalties or 
licensing fees.  VDA is developing the SFL under contract to the U.S. 
Government.  The U.S. Government is furnishing the SFL software at no 
cost to the vendor subject to the conditions of the "SFL Public 
License" available from the VDA SFL Page and Fortezza Developer's 
S/MIME Page.

The SFL is composed of a high-level library that performs generic CMS 
and ESS processing independent of the crypto algorithms used to 
protect a specific object.  The SFL high-level library makes calls to 
an algorithm-independent Crypto Token Interface API.  The underlying, 
external crypto token libraries are not distributed as part of the SFL 
source code. The application developer must independently obtain these 
libraries and then link them with the SFL.  For example, the SFL uses 
the freeware Crypto++ library to provide 3DES, D-H and DSA.  To use 
the SFL with Crypto++ the vendor must download the Crypto++ freeware 
library from the Crypto++ Web Page and then compile it with the SFL 
source code.  

The SFL software is developed to maximize portability to 32-bit 
operating systems.  We plan to port the SFL to the following 
operating systems: HP/UX 10.x, IBM AIX 3.2, and SCO ODT 3.0/5.0.

The IMC has established an SFL mail list which is used to: distribute 
information regarding SFL releases; discuss SFL-related issues; and 
provide a means for SFL users to provide feedback, comments, bug 
reports, etc.  Subscription information for the imc-sfl mailing list 
is at the IMC web site listed above.

All comments regarding the SFL software and documents are welcome.  We 
recommend that comments should be sent to the imc-sfl mail list.  We 
will respond to all messages on that list.

============================================================
John Pawling, [email protected]                             
J.G. Van Dyke & Associates, Inc.
www.jgvandyke.com         
============================================================