1. 1 DMP: A proposal for Security Manager Interface Sergio Sagliocco Victoria Alvaro SecureLab, Technology Department

2. 2 SAV e Security Manager The Security Manager is a component of the SAV that permit the interaction with the cryptographic key material. It exports an applicative interface in order to execute high level operation The implementation of the Security manager is strongly related to how the private key and certificate are stored. For this reason is necessary to split the security manager in two layer: an applicative frontend and one or more cryptographic engines. For example a user could use a certificate in PKCS12 file, in Java Key store or in a smart card. So the user have to be able to choose the key management system able to manage own keys

3. 3 Architecture SAV Manager Security Manager Engine PKCS12Engine CNSEngine CIE

4. 4 Security Manager Engine Requirements Each engine exports a well know interface to the security manager. The interface permits to call the following services: Initialization / Finalization (i.e.: integrity check of the key store, initialization of the smart card reader,…) Login/Logout (i.e.: request of the PIN and unblock private key) Decryption Configuration (i.e.: path of the PKCS12 or java key store) Generation of a new key pair (enrollment) Installation of a certificate Enumeration of installed certificates Elimination of a installed certificate

5. 5 Engine Interface Method NameInput ParameterOutput Parameter INIT-- LOGIN-- DECRYPTEncrypted buffer (i.e. PKCS7 format) Clear text buffer LOGOUT-- FINALIZE-- ENROLLKey Size, Distinguished Name, flag Certificate Request (i.e PKCS10 format) INSTALL(X509) Certificate- ENUMCERTidtypeArray of certificate IDs GETCERTid, idtipeCertificate GETKEYid, idtipePrivate Key (if possible) CONFIG-- GETINFO-Hash Table Attribute=Value

6. 6 Notes Depending on implementation language, each method have to manage error conditions The CONFIG method have to manage the GUI required to configure the engine In the ENROLL method the flag parameter represents a bit mask indicating particular attributes (i.e. ability to export private key) Idtype represent the key to search and select a certificate (i.e.: Issuer plus Serial Number, public key hash, …). Id represents the value

7. 7 Security Manager Interface The security manager exports an interface for the SAV manager This interface have to export engines services adding some method in order to manage the engines: –Enumeration of installed engines –Installation of new engines –Elimination of an installed engine –Engine configuration –Enabling / Disabling an installed engine In addition to the above methods the Security Manager can exports some utility functions like the following: –Hash calculation –Format conversion (PEM,DER,TXT,…) –Symmetric Encryption Functions (DES,AES,…) –…

8. 8 Security Manager Interface Method NameInput ParameterOutput Parameter DECRYPTEncrypted buffer (i.e. PKCS7 format) Clear text buffer ENROLLKey Size, Distinguished Name, flag Certificate Request (i.e PKCS10 format) INSTALLEngine Name, (X509) Certificate - ENUMCERTidtypeArray of certificate IDs GETCERTid, idtipeCertificate ENUMENGINE-Array of engine names ADDENGINEName, PATH of the engine library - ENABLEEngine Name- DISABLEEngine Name- REMOVEENGINEEngine Name- CONFIGEngine Name- GETEINFOEngine NameHash Table Attribute=Value

9. 9 Contacts Sergio Sagliocco SecureLab – Direzione Tecnologie mail: sergio.sagliocco@csp.it cell: +39 3486024078 tel. +39 011 4815140 CSP innovazione nelle ICT Sede via Livorno 60 - 10144 Torino Edificio Laboratori A1 Tel +39 011 4815111 Fax +39 011 4815001 E-mail: info@csp.it Seconda sede operativa Villa Gualino - Viale Settimio Severo 65 10133 Torino www.csp.it