PKE Tools Inventory.xlsx
XLSX spreadsheet 17 KB Posted
- Solicitation number
- 832572545
- Issued by
-
Defense Information Systems Agency
About this file
The document is an Excel-based inventory of Public Key Infrastructure (PKI) Tools maintained by the Department of Defense (DoD) Public Key Enabling (PKE) program. The inventory details 15 software tools across multiple operating systems (Windows and Linux), primarily written in languages like C#, Rust, Powershell, and Bash. These tools support critical PKI functions such as certificate management, trust store updates, CSR generation, email encryption, and interoperability testing, with many requiring updates to align with NSA memory safety guidance and post-quantum cryptography (PQC) requirements.
Key tools include InstallRoot (trust store management), CRLAutoCache (Certificate Revocation List download/injection), FileSigner (file integrity signing), SCL Troubleshooter (Smart Card Logon configuration assistance), and MailCrypt (email encryption). The inventory notes specific enhancement needs for each tool, such as updating signature validation, supporting new certificate authorities, addressing known bugs, and potentially rewriting tools in memory-safe languages like Rust. The associated federal contract opportunity is a pre-solicitation for multi-year engineering support from the Defense Information Systems Agency (DISA), focused on PKI consultation, custom code development, and interoperability support for DoD PKI systems.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 832572545 PKE Sources Sought.pdf | ||
| 832572545 PKE Draft PWS.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Current Tools
| Notes for full library: All tools need to be updated to support PQC and align with NSA memory safety guidance (https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY.PDF) ideally through re-writes in memory-safe languages | ||||||||
| Tool Name | Published Version | Last Updated | Language | Target OS | Description | Known Issues / Enhancements | Notes | |
| CRLAutoCache | 4.4 | 9/1/19 | C# | Windows | Windows tool that assists in downloading and injecting CRLs into the CAPI cache of Windows systems for various PKI groups (DoD, ECA, SIPR, etc). | Needs to be updated to ensure support for signatures on configuration files can be validated from signers under other DoD Root CAs. Update signature on the MSI and include the latest configuration files. | ||
| CRLAutoCache for Linux | 2.06 (NIPR) | |||||||
| 2.07 (SIPR) | 4/1/20 | Bash | Linux | Bash script that assists in downloading and locally caching CRLs for various PKI groups (DoD, ECA, SIPR, etc). | ||||
| Domain Controller CSR Generation script | 1.0 | 1/1/24 | Powershell | Windows | Script used to generate CSRs for Domain Controllers intended for use with our Windows Smart Card Logon configuration guides. | Needs to be updated (and re-signed) to utilize SHA-256 for CSR signature, include SID extension; revalidate/revisit GUID requirements | Version 1.1 addressing the SHA-256 signature is available unsigned from the help desk but hasn't been signed and published (primarily due to desire to include SID capability in next published version). | |
| FBCA Cross Cert Remover | 1.18 | 9/1/19 | Rust | Windows | Alleviates cross certificate chaining issues by removing and untrusting certain cross-certs that can cause path building issues. (Feature now available in InstallRoot). | Requires update for all current cross-certificates. | Could discontinue as InstallRoot provides the same functionality. However, InstallRoot is a heavier tool than the FBCA CC remover. Prototype developed in Rust. | |
| FileSigner | 2.3.6 | 12/1/24 | C#(Bundle)/Rust(Standalone) | Windows | Internal tool used to digitally sign files consumed by PKE tools for integrity. | Underlying libraries shared with InstallRoot need to be updated to ensure support for code signers issued from other DoD Root CAs. | ||
| InstallRoot | 5.6 | 1/1/24 | C#/C++ | Windows | Provides trust store management (Add/Delete/Untrust) for MSCAPI, Java, NSS, and NTAuth trust stores. Leverages Trust Anchor Management Protocol (TAMP) messages to ensure timely updates. | GSA request to open-source for collaboration with and use by FPKI community; would require rewriting portions to replace libraries that cannot be open-sourced and recommended course of action is full rewrite in Rust. Will also need to be updated to accept/validate TAMP messages signed from other code signers. 8JULY2025- "UI Crash on Load After Removing Configured Java Key Store": A bug has been discovered where if a single Java store or Java multi-store is saved to a UI configuration and the store is later removed from the filesystem, the UI may fail to load the saved configuration and can crash after displaying the following message: |
“ERROR Opening Java Key Store. An error was encountered when trying to perform an InstallRoot update: No certificate stores to display!”
This error can be resolved by removing the configuration for the missing store from the below registry path(s):
For Local Machine account:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\DoD-PKE\InstallRoot\5.6\Stores\ For Current User account:
Computer\HKEY_CURRENT_USER\Software\DoD-PKE\InstallRoot\5.6\Stores\
| Version 5.7, which updates dependencies, awaiting completion of Fortify scan prior to publication | |||||||
| InstallRoot Message Wizard | 2.3.6 | 12/1/24 | C#/C++ | Windows | Internal tool used to create Trust Anchor Management Protocol (TAMP) messages used by InstallRoot and other tools. | Currently limited to signing TAMPs with DoD PKI code signing certificates issued from DoD Root CA 3. Underlying libraries shared with InstallRoot need to be updated to ensure support for code signers issued from DoD Root CA 6 and potentially commercial providers to support requests from CC/S/As and FPKI community. | Underlying TAMP protocol may require an update to support PQC |
| Legacy ALT Token CSR Generation script | 1.0 | 9/1/24 | Powershell | Windows | Reference script for RAs to generate CSRs for use with the new Legacy ALT Token certificate profiles. | Currently written to support RSA 2048-bit/SHA-2 requests. If use of Legacy ALT Tokens continues after the transition to larger key sizes, the script would need to be updated. | |
| MailCrypt | 3.1.1 | 1/1/24 | C# | Windows | Supports mass decryption and reencryption of email using recovered encryption keys. | User reported: |
(1) Does not decrypt all emails properly (In user's test, Mailcrypt 3.1 processed 107 of 107 encrypted emails, while Mailcrypt 3.1.1 only processed 61 of 107).
(2) CC and BCC values are moved to the To field of re-encrypted emails (program is not properly transferring metadata).
| NSSdb CertLoader | 1.02 | 7/1/15 | Bash | Linux | Script facilitates trust store updates for NSS databases on Linux operating systems. | Should be tested with larger RSA key sizes and new NSSdb format. | |
| P7 Bundler | 1.0 | 2/20/25 | Rust | Windows | Internal tool used to create PKCS#7 trust store bundles for various PKI groups (DoD, ECA, WCF, etc). | ||
| PITTv2 | 2.0.6 | 9/1/15 | C++ | Windows | Internal tool designed to test interoperability with prospective partner PKIs and troubleshoot path processing problems. | Trust Anchor and Certificate Policies databases need to be reviewed and updated based on changes to infrastructure and policy since last update. | PITTv3 command line tool was independently developed in Rust by Red Hound (see https://github.com/carl-wallace/rust-pki) and some work has been done on GUI tool |
| SCL Troubleshooter | 1.0 | 10/1/22 | C# (with underlying Powershell scripts) | Windows | Designed to help system administrators and PKE help desk staff troubleshoot Windows Smart Card Logon configuration issues. Performs trust store analysis, gathers logs for review, and identifies potential problem areas. | Tool needs to include new logic to troubleshoot issues related to Microsoft strong name mapping capability. Needs to be updated to ship with the latest TAMP messages. | SCL Troubleshooter 1.2 development completed but needs to be tested (including confirmation that local TAMP message cache is manually updatable to support offline environments) and published |
| TACT | 1.2.6 | C++ | Windows/Linux | Set of web server plug-ins and management applications that enable web servers to authenticate DoD and external partner certificates with fewer client-side interoperability issues and with enhanced security. | Needs to be tested/updated for current versions of web platforms; database contents need to be reviewed/refreshed. | ||
| Kebler Revocaton Tool (KRT) | 2025 | Python | Windows | Tool that allows for revocaton of PKI certficates in bulk quantities. |
Other tools listed in PWS
| From PWS | Comments |
| MailCryptkey | Now called 'Mailcrypt' |
| CertAdmin | No code in C2SF. Tool has not been in use since before 2009. |
| InstallRoot for Mobile | Discontinued around 2014 and no code in C2SF. |
| MiniCRLFetch | No code in C2SF. Tool has not been in use since before 2009. |
| PKI Copy and Paste (PCP) | Not a PKE Tool. Developed for GSA by Red Hound. |
| WBBR | Not a PKE Tool. Infrastruture capability. |
File details come from the government source that posted it. Updated .