S
L
T
A
A
C
N
I
D
N
A
H
R
C
D
ET
Technical Standard
Common Security:CDSA and CSSM, Version 2
(with Corrigenda)
[This page intentionally left blank]
Technical Standard
Common Security: CDSA and CSSM, Version 2.3
The Open Group
May 2000, The Open Group
All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, inany form or by any means, electronic, mechanical, photocopying, recording or otherwise,without the prior permission of the copyright owners.
Technical Standard
Common Security: CDSA and CSSM, Version 2.3
ISBN: 1-85912-202-7Document Number: C914
Published in the U.K. by The Open Group, May 2000.
Any comments relating to the material contained in this document may be submitted to:
The Open GroupApex PlazaForbury RoadReadingBerkshire, RG1 1AXUnited Kingdom
or by Electronic Mail to:
[email protected]
ii Technical Standard
Contents
Part 1 Common Data Security Architecture (CDSA)............. 1
Chapter 1 Introduction............................................................................................... 3 1.1 The Threat Model........................................................................................ 4 1.2 Common Data Security Architecture ..................................................... 5 1.2.1 Architectural Assumptions.................................................................... 5 1.2.2 Architectural Overview.......................................................................... 6 1.2.3 Layered Security Services ...................................................................... 7 1.2.4 Common Security Services Manager Layer ....................................... 8 1.2.5 Security Add-In Modules Layer ........................................................... 10 1.2.5.1 Cryptographic Service Providers (CSPs) ......................................... 10 1.2.5.2 Trust Policy Modules (TPs)................................................................. 11 1.2.5.3 Certificate Library Modules (CLs)..................................................... 11 1.2.5.4 Data Storage Library Modules (DLs)................................................ 12 1.2.5.5 Authorization Computation Modules (ACs).................................. 12 1.2.5.6 Multi-Service Library Module............................................................ 13 1.3 Interoperability Goals ................................................................................ 13
Chapter 2 Common Security Services Manager......................................... 15 2.1 Overview ...................................................................................................... 15 2.2 General Module Management Services ................................................. 16 2.3 Elective Module Managers ....................................................................... 17 2.3.1 Transparent, Dynamic Attach ............................................................... 17 2.3.2 Registering Module Managers .............................................................. 18 2.3.3 State Sharing Among Module Managers............................................ 18 2.4 Basic Module Managers ............................................................................ 19 2.5 Dispatching Application Calls for Security Services .......................... 20 2.6 Integrity Services ........................................................................................ 21 2.6.1 CSSM-Enforced Integrity Verification................................................. 21 2.7 Creating Checkable Components............................................................ 23 2.7.1 Verifying Components............................................................................ 23 2.8 Security Context Services.......................................................................... 24
Chapter 3 Multi-Service Modules....................................................................... 27 3.1 Overview ...................................................................................................... 27 3.2 Application Developer View of a Multi-Service Add-In Module .... 28 3.3 Service Provider View of a Multi-Service Add-In Module ................ 28
Chapter 4 Modules Control Access to Objects ........................................... 29 4.1 Overview ...................................................................................................... 29 4.2 Authentication as Part of Access Control.............................................. 29 4.3 Authorization as Part of Access Control................................................ 30
Common Security: CDSA and CSSM, Version 2.3 iii
Contents
4.4 Resource Owner.......................................................................................... 31
Chapter 5 System Security Services................................................................... 33
Part 2 CSSM Core Services......................................................................... 35
Chapter 6 CSSM Core Services............................................................................. 37 6.1 Common Data Security Architecture ..................................................... 37 6.2 Selecting CDSA Components................................................................... 39 6.3 Core Services................................................................................................ 40 6.3.1 Module Management Services.............................................................. 40 6.3.2 Memory Management Support ............................................................ 42 6.3.3 Integrity of the CSSM Environment .................................................... 42 6.3.4 CDSA and Privileges............................................................................... 42 6.3.5 CDSA and USEE Privileges ................................................................... 43 6.3.6 Module-Granted Use Exemptions........................................................ 44 6.3.7 Service Module Requirements if USEE Tags are Supported .......... 45 6.3.8 Application Privilege .............................................................................. 45 6.3.9 Multiple CSSM Vendors Authenticating Same Application .......... 45 6.4 Data Structures for Core Services............................................................ 47 6.4.1 CSSM_BOOL............................................................................................. 47 6.4.2 CSSM_RETURN....................................................................................... 47 6.4.3 CSSM_STRING ........................................................................................ 47 6.4.4 CSSM_DATA............................................................................................. 48 6.4.5 CSSM_GUID ............................................................................................. 48 6.4.6 CSSM_KEY_HIERARCHY .................................................................... 49 6.4.7 CSSM_PVC_MODE................................................................................. 49 6.4.8 CSSM_PRIVILEGE_SCOPE................................................................... 50 6.4.9 CSSM_VERSION ..................................................................................... 50 6.4.10 CSSM_SUBSERVICE_UID..................................................................... 51 6.4.11 CSSM_HANDLE...................................................................................... 51 6.4.12 CSSM_LONG_HANDLE ....................................................................... 51 6.4.13 CSSM_MODULE_HANDLE................................................................. 51 6.4.14 CSSM_MODULE_EVENT ..................................................................... 52 6.4.15 CSSM_SERVICE_MASK ........................................................................ 52 6.4.16 CSSM_SERVICE_TYPE .......................................................................... 52 6.4.17 CSSM_API_ModuleEventHandler....................................................... 52 6.4.18 CSSM_ATTACH_FLAGS ....................................................................... 53 6.4.19 CSSM_PRIVILEGE .................................................................................. 53 6.4.20 CSSM_NET_ADDRESS_TYPE.............................................................. 56 6.4.21 CSSM_NET_ADDRESS .......................................................................... 56 6.4.22 CSSM_NET_PROTOCOL ...................................................................... 56 6.4.23 CSSM_CALLBACK ................................................................................. 57 6.4.24 CSSM_CRYPTO_DATA.......................................................................... 57 6.4.25 CSSM_WORDID_TYPE.......................................................................... 58 6.4.26 CSSM_LIST_ELEMENT_TYPE............................................................. 61 6.4.27 CSSM_LIST_TYPE................................................................................... 61 6.4.28 CSSM_LIS
