SPARTA ISSO

Finished Projects

Cryptographic Technologies

International Cryptography Experiment (ICE)

Table of Contents

Overview of ICE

There are two aspects of the International Cryptography Experiment (ICE). The first aspect is a broad program seeking to encourage the provision of international cryptographic solutions capable of meeting global business information security needs. Cryptography is a crucial technology for the provision of information security services within the emerging Global Information Infrastructure (GII). However, many governments are concerned that the extensive and unconstrained availability of strong cryptography may undermine their law enforcement and national security interests. These conflicting pressures have resulted in a wide range of technical and non-technical activities that are seeking to offer solutions that achieve a widely accepted balance between the different interests involved. The ICE initiative has been running since early 1994 as an informal international alliance of government and industry groups with a common interest in promoting internationally interoperable cryptographic security solutions. A second aspect of ICE is the DARPA ICE project, which is a technical project developing and demonstrating cryptographic-based security components.

DARPA ICE Project*

(*Supported by DARPA under Contract #DABT 63-95-C00018)

OBJECTIVE: The overall objective of the DARPA ICE project is to develop and demonstrate modular, removeable, replaceable cryptographic-based security components that are commercially available and can be utilized in a wide range of secure software applications. A primary goal of the project is to test the notion that secure software applications can be separated from specific cryptographic security components such that users can employ a number of alternatives with minimal impact on the applications; and, conversely, that specific cryptographic implementations (such as hardware or software modules) can support a number of different applications. Such an approach should enable easier, widepsread development and use of secure applications utilizing cryptography, allow combinations of cryptographic security that support a range of protection levels (e.g., military, government, commercial, and multinational), and, hence, provide flexible, low-cost methods of cryptographically protecting sensitive information.

APPROACH: TIS has developed a high-level security architecture for a set of demonstrations to be implemented as part of the ICE project. The architecture depicts the layering of logical interfaces among secure applications, high-level security and security support services, and underlying cryptographic functions, separated by application program interfaces (APIs). The architecture logically separates secure applications from the myriad of security mechanisms/protocols and cryptographic modules/algorithms and supports the primary ICE objective of demonstrating and testing the advantages of modular, removable, replaceable cryptographic security components. To view a graphical explanation of this, click here.

Based on this security architecture, TIS is developing a set of demonstrations that integrate selected cryptographic security components into a secure electronic mail application. The TIS MIME Object Security Services (TIS/MOSS) application software, which provides integrity, authentication, and confidentiality for electronic mail, was selected as a vehicle for demonstration and testing. The TIS/MOSS software is being integrated with selected cryptographic APIs and hardware/software cryptographic modules embodying different cryptographic algorithms. The demonstrations were chosen to optimize return on investment, completeness of results, availability of resources, and balanced satisfaction of varying interests. They will enable us to explore how to effectively use multiple cryptographic security components in multiple applications. This includes how to specify, implement, and effectively use modular, removable, replaceable security components in the layered architecture. Satisfying varying protection requirements in diverse environments (e.g., military, government, commercial, and multi-national) with minimal impact on applications is included. Providing robustness or survivability through rapid deployment of alternative components without requiring reengineering or even field modifications is also included.

RECENT ACCOMPLISHMENTS: Completed development of primary ICE demonstration of secure electronic mail application utilizing multiple cryptographic modules and algorithms. Demo is based on Microsoft Windows. Integrated the TIS/MOSS software with Qualcomm's Eudora user agent software as a "plug-in" to provide integrity, authentication, and confidentiality services for electronic mail. Incorporated the Microsoft CryptoAPI into the TIS/MOSS software and developed CryptoAPI-compliant cryptographic services providers (CSPs) based on the NSA Fortezza PCMCIA crypto card and the Fischer International Crypto SmartDisk. Developed software module to "translate" Microsoft CryptoAPI function calls to the RSA Laboratories' Cryptographic Token Interface (Cryptoki). Translation module allows easier development and use of CryptoAPI-compliant CSPs based on commercially available cryptographic tokens that provide a Cryptoki interface. Developed UNIX version of Microsoft CryptoAPI interface, enabling TIS/MOSS software to maintain cross-platform support. Developed associated CSPs based on the NSA Fortezza card and the RSAREF software and successfully tested interoperability between Windows and UNIX versions of TIS/MOSS software.

CURRENT PLAN: Release secure electronic mail demonstration software to Internet community for experimental use and testing. Extend secure electronic mail demonstration through addition of common interfaces for security support functions, including certificate management. Extend secure electronic mail demonstration through addition of common, high-level interfaces for store-and-forward security services (e.g., Internet IDUP-GSS-API). Continue coordination efforts with government organizations, commercial organizations, and standards bodies, promote widespread development and use of common cryptographic security interfaces within secure applications and cryptographic security components.

TECHNOLOGY TRANSITION: TIS is coordinating its efforts under the ICE project with government organizations (NSA, NIST, UK MoD, etc.), commercial organizations (security framework, security product, and application developers, etc.), and standards bodies (IETF, Open Group, etc.) to facilitate widespread development and use of common cryptographic security interfaces to effectively incorporate cryptographic security components into secure applications. All of the software developed for the ICE demonstrations is being made available to government organizations, industry, and other researchers for experimental use and testing to determine the suitability of specific cryptographic security interfaces in achieving the overall goals of ICE. TIS is conducting a series of Technical Workshops for participants from government organizations and industry. The specific aims of the workshops are to report on and coordinate efforts to develop common cryptographic security interfaces and to showcase demonstrations of the effective use of common cryptographic security interfaces to incorporate cryptographic security components into secure applications. TIS is reporting on the results of the ICE project, including the layered security architecture and the demonstration development activities, to participants of the technical workshops as well as in conference papers and presentations and in PI meetings. TIS is also participating in, and contributing to, several industry and standards body efforts to develop common cryptographic security interfaces.

The DARPA/ITO Project Summary provides more information on recent accomplishments and plans.

Additional Information on ICE

Individuals and organizations that wish to participate in ICE or to remain abreast of its activities are encouraged to send email to ice@tis.com.

Numerous articles and papers have been written regarding ICE and CAPIs.

Web Links

Fourth International ICE/CAPI Workshop

December 3-4, 1996
Holiday Inn Gaithersburg, Maryland USA

The Fourth International Cryptographic Experiment (ICE) / Cryptographic API (CAPI) Workshop was held December 3-4, 1996 at the Holiday Inn in Gaithersburg, Maryland, USA. Participation in the workshop included representatives from many international industrial and government organizations. The workshop was sponsored by Trusted Information Systems (TIS).

ICE is an international program to promote the use of logical interfaces between computer applications needing security and the cryptographic algorithms and related functions implemented either in hardware or software form. The overall aim is to demonstrate Cryptographic Application Program Interfaces (CAPIs) in international secure applications which are independent of particular cryptographic implementations and algorithms.

The specific aims of this workshop were to:

  • Identify progress in the development of security service APIs and cryptographic APIs;
  • Identify progress in the area of security support service APIs, including certificate management, key management, and authentication APIs;
  • Demonstrate the use of CAPI related technology and products; and
  • Identify next steps in additional experiments and demonstrations.

The ICE/CAPI Workshop included a full agenda with a number of presentations on crypto-related security APIs as well as demonstrations of CAPI related technology. A summary of the discussions that occurred during the workshop is also available.

Third International ICE/CAPI Workshop

March 11-12, 1996
National Institute of Standards and Technology (NIST)
Gaithersburg, Maryland USA

The Third International Cryptographic Experiment (ICE) / Crypto API (CAPI) Workshop was held on March 11- 12, 1996 at the U.S. National Institute for Standards and Technology (NIST) in Gaithersburg, MD, USA. Participation in this workshop included representatives from many international industrial and government organizations. The workshop was jointly sponsored by NIST, Trusted Information Systems (TIS), and by the NATO Shape Technical Centre (STC). Miles Smid of NIST, Steve Walker of TIS, and Brian Gladman of STC were the co-hosts of this workshop.

The workshop included presentations on the ICE program and on the current status of several CAPIs. ICE Experiment 1.0, proposed at the Second ICE Workshop, was discussed and further plans established. Brian Gladman's concerns on US Government Controls on the Microsoft CryptoAPI were also presented.

The specific aims of this ICE Workshop were to identify:

  • Progress in the development of CAPIs;
  • Appropriate CAPIs for immediate international demonstration;
  • Additional participation in ICE Experiment 1.0;
  • Next steps in other experiments and demonstrations;

A summary of the discussions that occurred during the workshop is available.

Second International ICE Workshop

September 18-19, 1995
SHAPE Technical Center, The Hague, The Netherlands

The Second International Cryptographic Experiment (ICE) Workshop was held on September 18-19, 1995 at the SHAPE Technical Centre (STC) in The Hague, The Netherlands. Participation in this workshop included representatives from industry and government organizations within NATO nations. The workshop was hosted by Dr. Brian Gladman, then Deputy Director of the STC.
ICE is an international program to demonstrate the use of logical interfaces between computer applications needing security and the underlying cryptographic algorithms and related functions. The overall aim is to provide and demonstrate Cryptographic Application Program Interfaces (CAPIs) in international secure applications which are independent of particular algorithms and vendors. The workshop will include presentations on the ICE program, on the current status of several CAPIs, and demonstration of CAPI related technology and products.

The specific aims of this ICE Workshop were to identify:

  • Progress in the development of CAPIs;
  • Appropriate CAPIs for immediate international demonstration;
  • Participants in a cooperative international demonstration program;
  • Next steps in such a demonstration;

(Last updated: 3 March 1998)