The evaluated interface of PKIF, i.e. the target of evaluation security function interface (TSFI), is a subset of the interface exported from PKIF.dll. PKIF is being evaluated against the following packages from the U.S. Government Family of Protection Profiles for Public-Key Enabled Applications:
1. Certification Path Validation (CPV) – Basic Package,
2. CPV – Basic Policy Package,
3. CPV – Policy Mapping Package,
4. CPV – Name Constraints Package,
5. PKI Signature Generation Package,
6. PKI Signature Verification Package,
7. PKI Encryption using Key Transfer Algorithms Package,
8. PKI Decryption using Key Transfer Algorithms Package,
9. Online Certificate Status Protocol (OCSP) Client Package, and
10. Certificate Revocation List (CRL) Validation Package
PKIF functionality is divided into the following seven functional subsystems:
· Certificate/CRL Storage and Retrieval
· Cryptography
· Certification Path Processing
· Cryptographic Message Syntax
· Revocation Status
· X.509 and RFC 3280 Objects
· Timestamps
· Miscellaneous Functionality
Summary of PKIF security functionality can be found here
For each subsystem, a comprehensive reference book is provided as part of this help system. However, application developers need not be familiar with the entire library to enable an application to utilize the services provides by a PKI. The functionality addressed by the PP can be grouped into three categories: certification path processing, signature processing and public-key encryption processing.
To use PKIF for certification path processing, an application developer can elect to use the BuildAndValidatePath function of CPKIFPathProcessingMediator2 class to perform path development and path validation in a single function call or can use the BuildPath and ValidatePath functions of CPKIFPathProcessingMediator2 class to perform path development and validation directly.
Signature processing can be performed using the CPKIFSignedData class. CPKIFSignedData enables application developers to create and/or verify signed messages conforming to the Cryptographic Message Syntax specification. Verification can include certification path processing, enabling applications to verify a signature and perform certification path development and validation using a single function call.
Public-key encryption processing can be performed using the CPKIFEnvelopedData class. CPKIFEnvelopedData enables application developers to create and/or decrypt encrypted messages conforming to the Cryptographic Message Syntax specification. Encryption can include certification path processing for the recipient’s certificate.
The classes and interfaces described above require support from additional classes and functions in order to provide the intended functionality to applications and to address the requirements established in the PP. The list below identifies the functions, classes and class methods used by application developers to exercise the functionality addressed by the PP.
Certificate and CRL Storage and Retrieval
1) void CPKIFCacheMediator2::AddColleague(IPKIFColleaguePtr&)
2) CPKIFLDAPRepository::CPKIFLDAPRepository(void)
3) void CPKIFLDAPRepository::Set_Port(int)
4) void CPKIFLDAPRepository::SetHost(const char *)
Cryptography
5) const char * CPKIFCredential::ID(void)
6) const char * CPKIFCredential::Name(void)
7) void CPKIFCryptoMediator2::GetKeyList(CPKIFCredentialList &, std::bitset<9> *)
Cryptographic Message Syntax
8) CPKIFEncapsulatedContentInfo::CPKIFEncapsulatedContentInfo(void)
9) CPKIFBufferPtr CPKIFEncapsulatedContentInfo::GetContent(void)
10) CPKIFOIDPtr CPKIFEncapsulatedContentInfo::GetOID(void)
11) void CPKIFEncapsulatedContentInfo::SetContent(CPKIFBufferPtr &)
12) void CPKIFEncapsulatedContentInfo::SetOID(CPKIFOIDPtr &)
13) CPKIFEncryptedContentInfo::CPKIFEncryptedContentInfo(void)
14) CPKIFAlgorithmIdentifierPtr CPKIFEncryptedContentInfo::GetAlgorithmIdentifier(void)
15) CPKIFBufferPtr CPKIFEncryptedContentInfo::GetContent(void)
16) CPKIFOIDPtr CPKIFEncryptedContentInfo::GetOID(void)
17) void CPKIFEncryptedContentInfo::SetAlgorithmIdentifier(CPKIFAlgorithmIdentifierPtr &)
18) void CPKIFEncryptedContentInfo::SetContent(CPKIFBufferPtr &)
19) void CPKIFEncryptedContentInfo::SetOID(CPKIFOIDPtr &)
21) void CPKIFEnvelopedData::AddRecipient(CPKIFCertificatePtr &, CMSPathValidationStatus)
22) CPKIFEnvelopedData::CPKIFEnvelopedData(void)
23) void CPKIFEnvelopedData::Decode(CPKIFBufferPtr &)
24) CPKIFBufferPtr CPKIFEnvelopedData::Decrypt(CPKIFCredentialPtr &)
25) CPKIFBufferPtr CPKIFEnvelopedData::Encode(void)
26) void CPKIFEnvelopedData::SetDataToEncrypt(CPKIFEncryptedContentInfoPtr &)
27) void CPKIFEnvelopedData::SetPathSettings(CPKIFPathSettingsPtr &)
28) void CPKIFSignedData::AddSignerInfo(CPKIFSignerInfoPtr &)
29) CPKIFSignedData::CPKIFSignedData(void)
30) void CPKIFSignedData::Decode(CPKIFBufferPtr &)
31) CPKIFBufferPtr CPKIFSignedData::Encode(void)
32) CPKIFEncapsulatedContentInfoPtr CPKIFSignedData::GetEncapsulatedContent(void)
33) void CPKIFSignedData::SetEncapsulatedContent(CPKIFEncapsulatedContentInfoPtr &)
34) void CPKIFSignedData::SetPathSettings(CPKIFPathSettingsPtr &)
36) bool CPKIFSignedData::Verify(int, CMSVerificationStatus &,CMSPathValidationStatus)
37) CPKIFSignerInfo::CPKIFSignerInfo(void)
38) void CPKIFSignerInfo::SetCredential(CPKIFCredentialPtr &)
40) void PKIFCMS_API keyUsageChecker_Signature(const CPKIFCertificateNodeEntryPtr&, CPKIFPathValidationResults&, CertificateType)
Revocation Status
41) CPKIFOCSPChecker::CPKIFOCSPChecker(void)
42) void CPKIFOCSPChecker::Set_Port(int)
43) void CPKIFOCSPChecker::SetHost(const char *)
Path Processing
44) CPKIFCertificatePath::CPKIFCertificatePath(void)
45) void CPKIFCertificatePath::SetPathSettings(CPKIFPathSettingsPtr const &)
46) void CPKIFCertificatePath::SetTarget(CPKIFCertificatePtr const &)
50) bool CPKIFPathProcessingMediator2::BuildPath(CPKIFCertificatePath &)
52) CPKIFPathSettings::CPKIFPathSettings(void)
53) void CPKIFPathSettings::SetCheckRevocationStatus(bool)
54) void CPKIFPathSettings::SetInitialExplicitPolicyIndicator(bool)
55) void CPKIFPathSettings::SetInitialInhibitAnyPolicyIndicator(bool)
56) void CPKIFPathSettings::SetInitialPolicyMappingInhibitIndicator(bool)
57) void CPKIFPathSettings::SetInitialPolicySet(CPKIFPolicyInformationListPtr &)
58) void CPKIFPathSettings::SetRequireFreshRevocationData(bool)
59) void CPKIFPathSettings::SetRequireSufficientlyRecent(bool)
60) void CPKIFPathSettings::SetSufficientlyRecent(int)
61) void CPKIFPathSettings::SetValidationTime(CPKIFTimePtr &)
62) CPKIFPathValidationResults::CPKIFPathValidationResults(void)
63) int CPKIFPathValidationResults::DiagnosticCode(void)
64) voidCPKIFPathValidationResults::GetAuthorityConstrainedSet(CPKIFPolicyInformationListPtr &)
66) bool CPKIFPathValidationResults::GetExplicitPolicyIndicator(void)
67) void CPKIFPathValidationResults::GetUserConstrainedSet(CPKIFPolicyInformationListPtr &)
68) CPKIFAlgorithmIdentifierPtr CPKIFPathValidationResults::GetWorkingParams(void)
69) bool CPKIFPathValidationResults::PathSuccessfullyValidated(void)
Utility
70) const char * CPKIFException::GetDescription(void)
71) int CPKIFException::GetErrorCode(void)
72) CAC_API IPKIFMediatorPtr MakeDefaultMediator(bool, CPKIFOCSPCheckerPtr&)
73) template<class X> X* IPKIFColleague::GetMediator() const
X.509 ASN.1 Encoding/Decoding
74) CPKIFOIDPtr CPKIFAlgorithmIdentifier::oid(void)
75) bool CPKIFAlgorithmIdentifier::hasParameters() const
76) CPKIFBufferPtr CPKIFAlgorithmIdentifier::parameters(void)
77) CPKIFBuffer::CPKIFBuffer(const unsigned char *,unsigned int)
78) const unsigned char * CPKIFBuffer::GetBuffer(void)
79) unsigned int CPKIFBuffer::GetLength(void)
80) CPKIFCertificate::CPKIFCertificate(void)
81) void CPKIFCertificate::Decode(const unsigned char *,int)
82) CPKIFBufferPtr CPKIFCertificate::Encoded(void)
83) template <typename T> shared_ptr<T> CPKIFCertificate::GetExtension()
84) CPKIFNamePtr CPKIFCertificate::Subject(void)
85) CPKIFSubjectPublicKeyInfoPtr CPKIFCertificate::SubjectPublicKeyInfo(void)
86) void CPKIFExtendedKeyUsage::KeyPurposeIDs(std::vector<CPKIFOIDPtr> &)
87) CPKIFNamePtr CPKIFGeneralName::directoryName(void)
88) const char * CPKIFGeneralName::dnsName(void)
89) CPKIFGeneralName::GENNAMETYPE CPKIFGeneralName::GetType(void)
90) CPKIFBufferPtr CPKIFGeneralName::ipAddress(void)
91) CPKIFBufferPtr CPKIFGeneralName::otherName(void)
92) const char * CPKIFGeneralName::rfc822Name(void)
93) const char * CPKIFGeneralName::uri(void)
94) CPKIFBufferPtr CPKIFGeneralName::x400Address(void)
95) bool CPKIFKeyUsage::CRLSign(void)
96) bool CPKIFKeyUsage::DataEncipherment(void)
97) bool CPKIFKeyUsage::DecipherOnly(void)
98) bool CPKIFKeyUsage::DigitalSignature(void)
99) bool CPKIFKeyUsage::EncipherOnly(void)
100) bool CPKIFKeyUsage::KeyAgreement(void)
101) bool CPKIFKeyUsage::KeyCertSign(void)
102) bool CPKIFKeyUsage::KeyEncipherment(void)
103) bool CPKIFKeyUsage::NonRepudiation(void)
104) CPKIFOID::CPKIFOID(const std::string&)
105) const char* CPKIFOID::ToString(void)
106) CPKIFPolicyInformation::CPKIFPolicyInformation(const CPKIFOIDPtr &)
107) CPKIFOIDPtr CPKIFPolicyInformation::PolicyOID(void)
108) CPKIFPolicyQualifierListPtr CPKIFPolicyInformation::Qualifiers(void)
109) void CPKIFSubjectAltName::GeneralNames(CPKIFGeneralNameList &)
110) CPKIFAlgorithmIdentifierPtr CPKIFSubjectPublicKeyInfo::alg(void)