v1.3 S/MIME Freeware Library

All,

J.G. Van Dyke and Associates (VDA) has delivered Version 1.3 of the S/MIME
Freeware Library (SFL) and v1.3 SFL Application Programming Interface (API),
29 October 1999.  Note: The v1.2 SFL release was internal to VDA and was not
distributed.  The v1.3 SFL implements the IETF S/MIME v3 RFC 2630
Cryptographic Message Syntax (CMS) and RFC 2634 Enhanced Security Services
(ESS) specifications.  It also implements portions of the RFC 2633 Message
Specification and RFC 2632 Certificate Handling document.  When used in
conjunction with the Crypto++ freeware library, the SFL implements the RFC
2631 Diffie-Hellman (D-H) Key Agreement Method specification.  It has been
successfully tested using the MS Windows NT/95/98 and Solaris 2.6 operating
systems.  Further enhancements, ports and testing of the SFL are still in
process.  Further releases of the SFL will be provided as significant
capabilities are added. 

The SFL has been successfully used to sign, verify, encrypt and decrypt
CMS/ESS objects using the mandatory algorithms (DSA, E-S D-H, 3DES) provided
by the Crypto++ 3.1 library and SHA-1 provided by Government-furnished
freeware.  The SFL has also been used to sign, verify, encrypt and decrypt
CMS/ESS objects using the RSA suite of algorithms provided by the RSA BSAFE
v3.0 library. The SFL uses the VDA-enhanced SNACC v1.3 ASN.1 Library to
encode/decode objects. The v1.3 SFL release includes: SFL High-level
library; Crypto++ Crypto Token Interface Library (CTIL); BSAFE CTIL;
Fortezza CTIL; SPEX/ CTIL; VDA-enhanced GNU SNACC v1.3 rev 0.07 ASN.1
Compiler and Library; test drivers and test data.

The SFL has been successfully used to exchange signedData and envelopedData
messages with the Microsoft (MS) Internet Explorer Outlook Express v4.01 and
Netscape Communicator 4.X S/MIME v2 products.  Signed messages have been
exchanged with the RSA S/MAIL, WorldTalk and Entrust S/MIME v2 products. 

The SFL has also been used to perform S/MIME v3 interoperability testing
with Microsoft that exercised the majority of the features specified by RFCs
2630, 2631 and 2634.  We still need to perform signed receipt testing with
Microsoft.  We have also performed limited S/MIME v3 testing with Baltimore
and Entrust.  We are also participating in the IETF S/MIME WG
interoperability testing documented in the "Examples of S/MIME Messages"
document.  We have used the SFL to successfully verify many of the signed
messages included in the document.  We are continuing to set up test config
files to use the SFL to test the other messages included in the document.
We also plan to provide sample messages for inclusion in the document.

The following enhancements are included in the v1.3 SFL release (compared
with the v1.1 release):

1) The SNACC and CTIL Dynamically linked Libraries (DLL) delivered in
conjunction with the v1.3 SFL have been successfully tested with the v1.3
SFL and with the v1.55 Certificate Management Library, so these two
libraries can share the same set of CTIL DLLs.

2) Enhanced libCert library to meet requirements of CML team. 

3) Fixed bugs in CTILs reported during Bridge Certification Authority
testing.  

4) Enhanced Crypto++ (a.k.a Free) CTIL to use the RSA public key algorithm
provided by the Crypto++ 3.1 library.  We used the RSA algorithm provided by
the Crypto++ 3.1 library to successfully perform key transport interop
testing with the RSA BSAFE v3.0 library.  We are still in the process of
testing interoperable RSA signature verification.  Previously, we
successfully completed RC2 interop testing between Crypto++ 3.1 and BSAFE.
The Crypto++ CTIL includes VDA-developed code to use the RSA public key
algorithm implemented within the external Crypto++ library.  As with all of
the external crypto token libraries, the Crypto++ library is not distributed
as part of the SFL source or object code.  To use the Crypto++ library with
the SFL, the application developer must independently obtain the Crypto++
library from the Crypto++ Web Page and then compile it with the
VDA-developed Crypto++ CTIL source code.  The RSA public key algorithm is
covered by U.S. Patent 4,405,829 "Cryptographic Communication System and
Method".  Within the U.S., users of the RSA public key algorithm provided by
the external Crypto++ library must obtain a license from RSA granting them
permission to use the RSA algorithm.

5) All CTILs were tested using MS Windows.  The BSAFE CTIL and SNACC were
tested as shared objects using Solaris 2.6.  The Fortezza and Crypto++ CTILs
will also be tested as shared objects using Solaris 2.6.  If any changes are
required, then new CTILs will be delivered. 

6) The SFL can now be used to generate countersignatures.  We are still in
the process of testing the verification of countersignatures.

7) Added enhanced error reporting (for specific non-fatal error conditions)
such that the SFL will continue processing and will provide a linked list of
error information. 

8) Developed new test code and configuration files to implement test cases.

9) Performed regression testing to ensure that aforementioned enhancements
did not break existing SFL functionality.

We are still in the process of enhancing and testing the SFL.  We are
developing a Public Key Cryptographic Standard (PKCS) #11 CTIL.  The
majority of the coding is complete. We began testing the Litronic Maestro
crypto library that provides a PKCS #11 API.  We also plan to test the PKCS
#11 CTIL with the Spyrus SPEX/ II library that provides a PKCS #11 API.
Future releases will also include: libCert library converted to DLL/shared
object; additional enhanced error reporting; verification of
countersignatures; SPEX/ CTIL encrypt/decrypt/ESDH capabilities; PKCS #11
CTIL; add sMIMEEncryptionKeyPreference attribute; additional helper
functions; add "Certificate Management Messages over CMS" ASN.1
encode/decode functions; add enhanced test routines; bug fixes; support for
other crypto APIs (possible); and support for other operating systems.  We
will enhance the utilities to generate certificates to be used as test data.
We do not plan to further enhance the SFL "C" API capabilities unless
specifically requested. 

The SFL software is developed to maximize portability to 32-bit operating
systems.  We plan to port the SFL to the following 
operating systems: Linux, HP/UX 9.x/10.x, IBM AIX 3.2, SCO 5.0 (possibly)
and Macintosh (possibly).

The IMC has established an SFL web page (http://www.imc.org/imc-sfl) which
includes links to the SFL files stored on the VDA SFL Page
(http://www.jgvandyke.com/services/infosec/sfl.htm) and on the Fortezza
Developer's S/MIME Page 
(http://www.armadillo.huntsville.al.us/software/smime).  

The VDA-enhanced SNACC ASN.1 software and SFL documentation are freely
available to everyone at the VDA SFL Page.  All other portions of the SFL
software are export controlled in accordance with the U.S. Government Export
Administration Regulations.  For specific details and guidance on exporting
the SFL software, contact the U.S. Department of Commerce, Bureau of Export
Administration, Export Counseling Division, (202) 482-4811.  The Bureau of
Export Administration maintains additional resources online on its
Commercial Encryption Export Controls page
(http://www.bxa.doc.gov/Encryption/Default.htm).

Instructions for applying for an account on the Fortezza Developer's S/MIME
Page are available from that page.  An account is required to download the
SFL files from the Fortezza Developer's S/MIME Page due to U.S. export
restrictions.         

The following SFL files are not export-controlled.  They are available at
the Fortezza Developer's S/MIME Page and VDA SFL Page:

Note: The VDA SFL Page has not yet been updated, but all files are available
from the Fortezza Developer's S/MIME Page. 

1) SFL Documents: Fact Sheet, Software Design Description, API, CTI API,
Software Test Description, Implementers Guide, Overview Briefing and Public
License.
     
2) snaccvda07.zip: Zip file containing SNACC v1.3 rev 0.07 ASN.1 Compiler
and Library source code compilable for Unix and MS Windows NT/95/98 that has
been enhanced by VDA to implement the Distinguished Encoding Rules.  Project
files and makefiles are included.  This file includes a sample test project
demonstrating the use of the SNACC classes.


The following SFL files are export controlled and are available at the
Fortezza Developer's S/MIME Page:

1) smimeR13.zip:  Zip file containing all SFL source code including: 
SFL Hi-Level source code; VDA-enhanced SNACC-generated ASN.1 source 
code; project files.  This file also contains test driver source code, 
sample CMS/ESS test data and test X.509 Certificates.  This file also 
includes test utilities to create X.509 Certificates that each include 
a D-H, DSA or RSA public key.  SNACC release and debug libraries
are compiled for MS Windows NT/95/98. MS Windows NT/95/98
project files and Unix makefiles are included for the SNACC code and
Crypto++.  Note that the Crypto++ library is not included.  Crypto++
can be downloaded from (http://www.eskimo.com/~weidai/cryptlib.html). 

2) smR13CTI.zip:  Source code for the following CTILs:
Test (no crypto), Crypto++, BSAFE, Fortezza and SPEX/. 
The Win95/98/NT projects are also included.

3) csmime.mdl contains SFL Class diagrams created using Microsoft 
Visual Modeler (comes with MS Visual Studio 6.0, Enterprise Tools).
The file can also be viewed using Rational Rose C++ Demo 4.0
45 day evaluation copy which can be obtained from
http://www.rational.com/uml/resources/practice_uml/index.jtmpl.
Not all classes are documented in the MDL file at this time.

All source code for the SFL is being provided at no cost and with no 
financial limitations regarding its use and distribution. 
Organizations can use the SFL without paying any royalties or 
licensing fees.  VDA is developing the SFL under contract to the U.S. 
Government.  The U.S. Government is furnishing the SFL software at no 
cost to the vendor subject to the conditions of the "SFL Public 
License" available from the VDA SFL Page and Fortezza Developer's 
S/MIME Page.

The SFL is composed of a high-level library that performs generic CMS 
and ESS processing independent of the crypto algorithms used to 
protect a specific object.  The SFL high-level library makes calls to 
an algorithm-independent CTIL API.  The underlying, external crypto
token libraries are not distributed as part of the SFL 
source code. The application developer must independently obtain these 
libraries and then link them with the SFL.  For example, the SFL uses 
the freeware Crypto++ library to obtain 3DES, D-H and DSA.  To use 
the SFL with Crypto++ the vendor must download the Crypto++ freeware 
library from the Crypto++ Web Page and then compile it with the  
VDA-developed Crypto++ CTIL source code.  

The IMC has established an SFL mail list which is used to: distribute 
information regarding SFL releases; discuss SFL-related issues; and 
provide a means for SFL users to provide feedback, comments, bug 
reports, etc.  Subscription information for the imc-sfl mailing list 
is at the IMC web site listed above.

All comments regarding the SFL software and documents are welcome.  We 
recommend that comments should be sent to the imc-sfl mail list.  We 
will respond to all messages on that list.

============================================
John Pawling, Director - Systems Engineering
J.G. Van Dyke & Associates, Inc;
a Wang Government Services Company
[email protected]
============================================