Subject: v1.9 Certificate Management Library Now Available

From: "Pawling, John" <[email-masked]>
Date: Fri, 16 Feb 2001 16:26:11 -0500

All,

Getronics Government Solutions has delivered the Version 1.9 Certificate
Management Library (CML) for MS Windows, Solaris 2.7 and Linux.  The v1.9
CML is freely available to everyone from the Getronics CML web page
<http://www.getronicsgov.com/hot/cml_home.htm>.  This release includes two
major enhancements.  It implements the certificate policy processing
requirements specified in the 2000 X.509 Recommendation.  Also, the
Lightweight Directory Access Protocol (LDAP) and database callback functions
were moved from the CML to a separate, dynamic Storage & Retrieval Library
(SRL).  

The v1.9 CML is described in the v1.9 CML Application Programming Interface
(API) document.  It implements the 2000 X.509 Recommendation certification
path processing rules and SDN.706.  It meets the majority of the IETF PKIX
RFC 2459 Certificate/CRL Profile requirements.  It uses the v1.2 Certificate
Path Development Library (CPDL) developed by CygnaCom Solutions, an Entrust
Technologies company, to provide robust certification path building
capabilities such as using cross certificates. 

The CML has been used to validate X.509 Certificates and Certificate
Revocation Lists (CRL) signed using the Digital Signature Algorithm (DSA)
and RSA.  Further enhancements, ports and testing of the CML are still in
process.  Further releases of the CML will be provided as significant
capabilities are added. 

The following enhancements are included in the v1.9 CML release (compared
with the v1.8 release):

1) Added support for 2000 X.509 certificate policy processing.  We
successfully tested the CML using test certificate paths that we created to
thoroughly test the new features, including positive and negative tests.  
2) Enhanced the internal RAM cache to store validated CRLs.  This also
included adding the hash of the certificates and CRLs to the RAM cache to
uniquely identify the object in the cache.  
3) Added ASN.1 decoding support for the new 2000 X.509 certificate and CRL
extensions. 

4) Enhanced CML so that it can be used with any LDAP library. This includes
splitting the CML's database and LDAP callback functions into their own
dynamic library (SRL).  This moves the LDAP linkage from the CML to the SRL.
The SRL also provides local certificate and CRL storage management
functions.  This included enhancing the SRL so that implementing the
database callback functions will cause the native CML database to be
disregarded.  We tested the SRL with the Netscape LDAP library on Windows.
We tested the SRL with the OpenLDAP library on Linux and Solaris. 

5) Tested the v1.9 CML with the new version (v2.0) of the CPDL provided by
CygnaCom to fix bugs in the previous CPDL release.

6) We fixed bugs in the v1.81 CML.  The CML was always initializing the
require-explicit-policy value to "True" (rather than using the value
provided by the application).  The CML was crashing when it encountered a
CRL Distribution Point extension that included a Uniform Resource
Identifier.  

7) Enhanced CMTest automated test utility to test new features of v1.9 CML
and SRL. 

8) Delivered new CML and SRL documents.

The following v1.9 CML files are available from the Getronics CML web page:
1) Windows_CMLLibv1.9.zip: MS Windows Dynamically Linked Libraries (DLL) 
2) Windows_CM_Tool.tar.z: CM_Tool DLL
3) Solaris_CMLLibv1.9.tar.Z: Sun Solaris Libraries 
4) Solaris_CM_Tool.tar.z: CM_Tool for Solaris
5) Linux_CMLLibv1.9.tar.Z: Linux Libraries
6) Linux_CM_Tool.tar.z: CM_Tool for Linux
7) CML_source.tar.Z: Source, including Windows project files 
8) CMAPI_data.tar.Z: Test Certs and CRLs used to test v1.9 CML

The v1.9 CML API document (CMv1.9api.doc, CMv1.9api.pdf), v1.9 SRL API 
document (SRLv1.9api.doc, SRLv1.9api.pdf), and v1.9 CML readme file are
also available from the Getronics CML web page.

All source code for the CML is being provided at no cost and with no
financial limitations regarding its use and distribution. Organizations can
use the CML without paying any royalties or licensing fees.  The CML was
originally developed by the U.S. Government.  Getronics is enhancing and
supporting the CML under contract to the U.S. Government.  The U.S.
Government is furnishing the CML software at no cost to the vendor subject
to the conditions of the CML Public License provided with the CML software.
The CML software is not subject to U.S. Government encryption export
regulations, so it is freely available to everyone.

The v1.9 CML uses the Getronics v1.3 R5 Enhanced SNACC ASN.1 Library to
encode/decode objects.  Getronics has successfully tested the v1.9 CML with
the
SNACC and CTIL DLLs delivered in conjunction with the v1.9 SFL.  Source code
for the Getronics-developed CTILs is available from
<http://www.getronicsgov.com/hot/sfl_home.htm>.  The actual crypto libraries
are
not provided with the CML or SFL.  They must be independently obtained
from the appropriate source.  

The v1.9 CML can be used in conjunction with the v1.2 CPDL to successfully
meet all of the requirements of the Bridge Certification Authority
Demonstration effort which includes cross-certified Entrust, Spyrus and
Motorola v3 certificate domains.  The CML_source.tar.Z file includes the
CPDL
source code and public license.  <http://www.cygnacom.com/cpl> provides more
information regarding the CPDL.

The National Institute of Standards and Technology (NIST) is providing a
standard test suite of X.509 certificate paths
<http://csrc.nist.gov/pki/testing/x509paths.html> that can be used for
testing applications against RFC 2459.  The CML was used to successfully 
process the NIST test data.

The Internet Mail Consortium (IMC) has established a CML web page
<http://www.imc.org/imc-cml>   
and a CML mail list which is used to: distribute information regarding CML
releases; discuss CML-related issues; and allow CML users to provide
feedback, comments, bug reports, etc.  Subscription information for the
imc-cml mailing list is at the IMC web site listed above.  

All comments regarding the CML source code and documents are welcome. This
CML release announcement was sent to several mail lists, but please send all
messages regarding the CML to the imc-cml mail list ONLY.  Please do not
send messages regarding the CML to any of the IETF mail lists.  We will
respond to all messages sent to the imc-cml mail list.

===========================================
John Pawling, [email-masked]
Getronics Government Solutions, LLC
===========================================