Subject: Freeware Certificate Management Library (CML)

From: "Pawling, John" <[email-masked]>
Date: Thu, 4 Aug 2005 18:51:39 -0400

All,

The freeware, open-source Version 2.5 Certificate Management Library
(CML) for Microsoft Windows, Sun Solaris and Linux is freely available
at:
<http://www.digitalnet.com/knowledge/cml_home.htm>.

Applications requiring Public Key Infrastructure (PKI) security services
can use the CML to meet their X.509 certificate and Certificate
Revocation List (CRL) processing requirements. The CML provides X.509
certification path building and validation services through a
developer-friendly C and C++ Application Programming Interface (API).  

The CML performs all of the required certification path processing as
specified in X.509 Recommendation (2000) and IETF PKIX RFC 3280
Certificate/CRL Profile. The CML is capable of building certification
paths through simple and complex PKI topologies including hierarchical,
mesh, and bridge topologies, and any combination of the same.  The CML
has been successfully used to Public Key Enable (PKE) a variety of
applications to meet their X.509 certificate processing requirements.  

The CML supports digital signature verification using a variety of
cryptographic algorithms.  It supports revocation checking using CRLs
and the On-Line Certificate Status Protocol (OCSP). The accompanying
Storage and Retrieval Library (SRL) optionally provides local
certificate and CRL storage management functions.  The SRL also
optionally provides remote directory retrieval capabilities using the
Lightweight Directory Access Protocol (LDAP).  

All source code for the CML is being provided at no cost and with no
financial limitations regarding its use and distribution. Organizations
can use the CML without paying any royalties or licensing fees.  BAE
Systems is
enhancing and supporting the CML under contract to the U.S. Government.
The U.S. Government is furnishing the CML software at no cost to the
vendor subject to the conditions of the CML Public License provided with
the CML software.
  
The v2.5 CML Abstract Syntax Notation.1 (ASN.1) encodes and decodes
X.509 Certificates, CRLs and Attribute Certificates.  It requires the
v1.7 Enhanced SNACC ASN.1 software that is freely available from: 
<http://www.digitalnet.com/knowledge/snacc_home.htm>

The CML has been thoroughly tested including validating X.509
Certificates and CRLs created by a variety of Certification Authority
(CA) products, and signed using the Digital Signature Algorithm (DSA)
and RSA algorithms.  Further enhancements, ports and testing of the CML
are still in process.  Further releases of the CML will be provided as
significant capabilities are added. 

Public Key Interoperability Test Suite (PKITS) Testing: PKITS is a
comprehensive X.509 path validation test suite designed to cover most of
the features specified in X.509 and RFC 3280.  The National Institute of
Standards and Technology (NIST) is providing PKITS at 
<http://csrc.nist.gov/pki/testing/x509paths.html>. The CML was used to
successfully build and validate the X.509 certification paths included
in PKITS.

CML v2.5 includes the following enhancements (compared to v2.4 CML
release):

1. Enhanced path validation functions to allow a date to be specified
which is used as the validation date/time.
 
2. Added capability to return CRLs or OCSP responses that are used
during certificate path validation. 

3. Added Online Certificate Status Protocol (OCSP) client library, using
OpenSSL, to check revocation status of certificates using OCSP. 

4. Added new path validation error code, CM_INVALID_POLICY_MAPPING, that
is returned when a CA cert contains an invalid policy mapping (i.e.
either a policy is mapped from or to the special any-policy.)

The CML makes calls to PKCS #11-compliant libraries for cryptographic
support. BAE Systems provides a PKCS #11 implementation of Wei Dai's
Crypto++ <http://www.eskimo.com/~weidai/cryptlib.html> for use with the
CML. The underlying, external crypto libraries are not distributed as
part of the CML software. 

The CML has been successfully tested with the v2.5 S/MIME Freeware
Library (SFL) that is freely available from 
<http://www.DigitalNet.com/knowledge/sfl_home.htm>. 

The CML has been successfully tested with the v2.5 Access Control
Library (ACL) that is freely available to everyone from: 
<http://www.DigitalNet.com/knowledge/acl_home.htm>.

The Internet Mail Consortium (IMC) has established a CML web page
<http://www.imc.org/imc-cml> and a CML mail list which is used to: 
distribute information regarding CML releases; discuss CML-related
issues; and allow CML users to provide feedback, comments, bug reports,
etc. Subscription information for the imc-cml mailing list is at the IMC
web site listed above. 

All comments regarding the CML source code and documents are welcome.
This CML release announcement was sent to several mail lists, but please
send all messages regarding the CML to the imc-cml mail list ONLY.
Please do not send messages regarding the CML to any of the IETF mail
lists. We will respond to all messages sent to the imc-cml mail list. 

=============================
John Pawling
BAE SYSTEMS Information Technology
[email-masked]
=============================