Index: java/net/deterlab/abac/InternalCredential.java
===================================================================
--- java/net/deterlab/abac/InternalCredential.java	(revision 3612811a572b962ff2efd7a1b55e778c7bae3b33)
+++ java/net/deterlab/abac/InternalCredential.java	(revision 3612811a572b962ff2efd7a1b55e778c7bae3b33)
@@ -0,0 +1,125 @@
+package net.deterlab.abac;
+
+import java.io.*;
+import java.math.*;
+
+import java.util.*;
+import java.security.*;
+import java.security.cert.*;
+
+import javax.security.auth.x500.*;
+
+import org.bouncycastle.asn1.*;
+import org.bouncycastle.asn1.x509.*;
+import org.bouncycastle.x509.*;
+import org.bouncycastle.x509.util.*;
+import org.bouncycastle.openssl.*;
+
+/**
+ * An Internal Credential, used to represent extra arcs in the proof graph.  It
+ * should never be converted to a cert or output.
+ * @author <a href="http://abac.deterlab.net">ISI ABAC team</a>
+ * @version 1.3
+ */
+public class InternalCredential extends Credential {
+
+    /**
+     * Create an empty InternalCredential.
+     */
+    public InternalCredential() { super(); }
+    /**
+     * Create a credential from a head and tail role.  This credential has no
+     * underlying certificate, and cannot be exported or used in real proofs.
+     * @param head the Role at the head of the credential
+     * @param tail the Role at the tail of the credential
+     */
+    public InternalCredential(Role head, Role tail) {super(head, tail); }
+
+    /**
+     * Create a credential from an attribute cert in a file.  This will always
+     * fail for in InternalCredential.
+     * @param filename a String containing the filename to read
+     * @param ids a Collection of Identities to use in validating the cert
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     */
+    public InternalCredential(String filename, Collection<Identity> ids) 
+	throws ABACException { this(); }
+
+    /**
+     * Create a credential from an attribute cert in a file.   This will always
+     * * fail for in InternalCredential.
+     * @param file the File to read
+     * @param ids a Collection of Identities to use in validating the cert
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     */
+    public InternalCredential(File file, Collection<Identity> ids) 
+	    throws ABACException {
+	 this();
+    }
+
+    /**
+     * Create a credential from an InputStream.  This will always
+     * fail for in InternalCredential.
+     * @param ids a Collection of Identities to use in validating the cert
+     * @throws CertInvalidException if the stream is unparsable
+     * @throws MissingIssuerException if none of the Identities can validate the
+     *				    certificate
+     * @throws BadSignatureException if the signature check fails
+     */
+    public InternalCredential(InputStream s, Collection<Identity> ids) 
+	    throws ABACException {
+	 this();
+    }
+
+
+    /**
+     * Create a certificate from this credential issued by the given identity.
+     * This will always fail for an InternalCredential.
+     * @param i the Identity that will issue the certificate
+     * @throws ABACException for Credential-specific errors
+     * @throws MissingIssuerException the identity is invalid
+     * @throws BadSignatureException if the signature creation fails
+     */
+    public void make_cert(Identity i) throws ABACException {
+	throw new ABACException("Cannot create certificate for " +
+		"an InternalCredential");
+    }
+
+    /**
+     * Output the DER formatted attribute certificate associated with this
+     * Credential to the OutputStream.  This will always fail for an
+     * InternalCredential.
+     * @param s the OutputStream on which to write
+     * @throws IOException if there is an error writing.
+     */
+    public void write(OutputStream s) throws IOException {
+	throw new IOException("Cannot write certificate for " +
+		"an InternalCredential");
+    }
+
+    /**
+     * Output the DER formatted attribute certificate associated with this
+     * Credential to the filename given.  This will always fail for an
+     * InternalCredential.
+     * @param fn a String containing the output filename
+     * @throws IOException if there is an error writing.
+     */
+    public void write(String fn) 
+	throws IOException, FileNotFoundException {
+	write((OutputStream) null);
+    }
+
+    /**
+     * Return true if this Credential has a certificate associated.  A jabac
+     * extension.  Always false for an InternalCredential.
+     * @return true if this Credential has a certificate associated.
+     */
+    public boolean hasCertificate() { return false; }
+
+}
