HP UX Security Products and Features Software Certiﬁcate Operations

Common Data Security Architecture (CDSA) White Paper

Certiﬁcate Library Services (CL) API

The CL functions are accessible to the CSSM at attach time, when the CSSM receives the certiﬁcate library’s function table. In the function table, any unsupported function has a NULL function pointer.

Certiﬁcate operations fall into three general areas:

Cryptographic Operations, wherein a certiﬁcate is signed and its signature veriﬁed. The certiﬁcate library determines the certiﬁcate ﬁelds to be signed or veriﬁed and manages the interaction with a cryptographic service provider to perform the signing or veriﬁcation.

Certiﬁcate Field Management, which involves adding ﬁelds to a certiﬁcate when it is created. Once the certiﬁcate is signed, the ﬁelds cannot be modiﬁed. However, they can be queried for their values using the CSSM certiﬁcate interface.

The ﬁelds of a certiﬁcate format consist of tag/value pairs. The tag is an object identiﬁer (OID) that references speciﬁc data types or data structures within the certiﬁcate or CRL.

Cryptographic operations and ﬁeld management operations affect the entire CRL and individual revocation records. The entire CRL can be signed or veriﬁed, to ensure the integrity of its contents as the CRL is passed between systems. Individual revocation records can be signed when they are revoked and veriﬁed when they are queried. Certiﬁcates can be revoked or unrevoked by adding or removing them from the CRL at any time before the CRL is signed. The contents of the CRL can be queried for its revocation records, certiﬁcates, or individual CRL ﬁelds.

Certiﬁcate Operations This section summarizes the functions that comprise the certiﬁcate operations in the CLI, as to operation and parameter deﬁnitions.

CL_CertSign ( )

Creates a digital signature for the subject certiﬁcate using the signer’s certiﬁcate. The cryptographic context handle indicates the algorithm and parameters to be used for signing.

CL_CertVerify ( )

Veriﬁes the signer certiﬁcate’s signature on the subject certiﬁcate. The cryptographic context handle indicates the algorithm and parameters to be used for veriﬁcation.

CL_CertCreateTemplate ( )

Creates a certiﬁcate template in the CL’s own certiﬁcate template format from the OID/value pairs provided by the application. The CL module makes its supported OIDs available to the application via the CertTemplate registered with CSSM and via the CL_CertDescribeFormat function. The CL indicates which ﬁelds are required to create a certiﬁcate. A returned certiﬁcate template is not valid until it has been signed.

CL_CertGetFirstFieldValue ( )

Chapter 1