Common Data Security Architecture (CDSA) White Paper

38 Chapter1

Certiﬁcate Library Services (CL) API

The CL functions are accessible to the CSSM at attach time, when the CSSM receives the

certiﬁcate library’s function table. In the function table, any unsupported function has a

NULL function pointer.

Certiﬁcate operations fall into three general areas:

Cryptographic Operations, wherein a certiﬁcate is signed and its signature veriﬁed. The

certiﬁcate library determines the certiﬁcate ﬁelds to be signed or veriﬁed and manages the

interaction with a cryptographic service provider to perform the signing or veriﬁcation.

Certiﬁcate Field Management, which involves adding ﬁelds to a certiﬁcate when it is created.

Once the certiﬁcate is signed, the ﬁelds cannot be modiﬁed. However, they can be queried for

their values using the CSSM certiﬁcate interface.

The ﬁelds of a certiﬁcate format consist of tag/value pairs. The tag is an object identiﬁer

(OID) that references speciﬁc data types or data structures within the certiﬁcate or CRL.

Cryptographic operations and ﬁeld management operations affect the entire CRL and

individual revocation records. The entire CRL can be signed or veriﬁed, to ensure the

integrity of its contents as the CRL is passed between systems. Individual revocation records

can be signed when they are revoked and veriﬁed when they are queried. Certiﬁcates can be

revoked or unrevoked by adding or removing them from the CRL at any time before the CRL

is signed. The contents of the CRL can be queried for its revocation records, certiﬁcates, or

individual CRL ﬁelds.

Certiﬁcate Operations This section summarizes the functions that comprise the certiﬁcate

operations in the CLI, as to operation and parameter deﬁnitions.

CL_CertSign ( )

Creates a digital signature for the subject certiﬁcate using the signer’s certiﬁcate. The

cryptographic context handle indicates the algorithm and parameters to be used for signing.

CL_CertVerify ( )

Veriﬁes the signer certiﬁcate’s signature on the subject certiﬁcate. The cryptographic context

handle indicates the algorithm and parameters to be used for veriﬁcation.

CL_CertCreateTemplate ( )

Creates a certiﬁcate template in the CL’s own certiﬁcate template format from the OID/value

pairs provided by the application. The CL module makes its supported OIDs available to the

application via the CertTemplate registered with CSSM and via the CL_CertDescribeFormat

function. The CL indicates which ﬁelds are required to create a certiﬁcate. A returned

certiﬁcate template is not valid until it has been signed.

CL_CertGetFirstFieldValue ( )