Subject: [cicm] Does CICM only provide (specify) the "red" side API in a multilevel system?

From: "Linn, Charles" <[email-masked]>
Date: Wed, 2 Jun 2010 17:00:41 -0400

Forgive the ignorant newbie question!

For this post, my frame of reference is a red/black traditional
cryptosystem.  Imagine for the sake of discussion you have two general
purpose processors with a hardware (or otherwise abstracted) crypto
subsystem between the two.  Therefore all traffic for this example
crosses security domains, vs. being a coprocessor style interface.

In all the section 3 examples, the CICM API is only shown on the "red"
side of the CSS.  Indeed, when I look at a Decrypt::Stream, I don't see
where the caller provides the data to be decrypted, instead seeing only
how a buffer is supplied to receive the data.  This leads us (Anthony
DiBernardo first noticed this) to conclude that perhaps it is not the
intent of CICM to specify a black side API.  Contrast this with, for
example, the original SCA security API (the present RSS is ITAR, and
hence off bounds to this forum), which has both red and black side
interfaces.

Am I missing something?

Thanks,
Chuck Linn & Anthony DiBernardo

---

From: "Novikov, Lev" <[email-masked]>
Date: Thu, 3 Jun 2010 11:15:43 -0400

Chuck, Anthony,

> Forgive the ignorant newbie question!

Not ignorant at all! Excellent question.

> In all the section 3 examples, the CICM API is only shown 
> on the "red" side of the CSS.  Indeed, when I look at 
> a Decrypt::Stream, I don't see where the caller 
> provides the data to be decrypted, instead seeing only 
> how a buffer is supplied to receive the data.  

> ... perhaps it is not the intent of CICM to specify a black side API.

Indeed you are correct (but perhaps this needs to be changed).
Our design was motivated by the understanding that the transfer
of data from the black side to the module or vice-versa
was simply "data transfer" and not a crypto operation 
(i.e. outside the scope of CICM).

> Contrast this with, for example, the original SCA security API 
> (the present RSS is ITAR, and hence off bounds to this forum), 
> which has both red and black side interfaces.

So now the question is: Do we need to fix this?

Perhaps we could consider some sort of "get/put" channels
that could be used to received/supply data to the module 
on the black side.

If so, we should start discussing the ramifications
to channel definitions because currently we do not explicitly
define the "side" of any channel (you can use any channel
on any side that has software to support that channel).

Lev