Index: doc/API
===================================================================
--- doc/API	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/API	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -86,4 +86,113 @@
         i.e., A.r1.r2, linked_role() returns A.r1
 
+ABAC::ID
+    ID(char *filename)
+        load an ID cert from a file
+        Will throw an exception if the cert cannot be loaded
+
+    ID(char *cn, int validity)
+        generates a new ID with the supplied CN and validity period
+        - CN must be alphanumeric and begin with a letter
+        - validity must be at least one second
+        Will throw an exception if either of the above is violated
+
+    void load_privkey(char *filename)
+        loads the private key associated with the cert
+        will throw an exception if the key cannot be loaded
+
+    char *keyid()
+        returns the SHA1 keyid of the cert
+
+    char *cert_filename()
+        returns a suggested filename for the generated ID cert, namely:
+            ${CN}_id.pem
+
+    char *privkey_filename()
+        returns a suggested filename for the private key of the ID cert:
+            ${CN}_key.pem
+
+    void write_cert(FILE *out)
+        writes a PEM-encoded cert to the file handle
+
+    void write_cert(string& out)
+        writes a PEM-encoded cert to a file named out
+
+    void write_cert(char *out)
+        writes a PEM-encoded cert to a file named out
+
+    void write_privkey(FILE *out)
+        writes a PEM-encoded private key to the file handle
+        throws an exception if no private key is loaded
+
+    void write_privkey(string& out)
+        writes a PEM-encoded private key to a file named out
+        throws an exception if no private key is loaded
+
+    void write_privkey(char *out)
+        writes a PEM-encoded private key a file named out
+        throws an exception if no private key is loaded
+
+    abac_chunk_t cert_chunk()
+        returns a DER-encoded binary representation of the X.509 ID cert
+        associated with this ID.
+        can be passed to libabac's Context::load_id_chunk()
+
+    In languages where swig is confused by overloading, the write_* functions 
+        are replaced with (for example) write_cert(FILE *) and 
+        write_cert_name(char*) to remove the ambiguity.  perl and python
+        use these names, and perl uses only the write_cert_name() forms.
+
+ABAC::Attribute
+
+    N.B., The way you use this class is by instantiating the object, adding
+    subjects to it, and then baking it. Only once it's baked can you access the
+    X.509 cert. Once it's been baked you can no longer add subjects to it.
+
+    Attribute(ID &issuer, char *role, int validity)
+        Create an object to be signed by the given issuer with the given role
+        and validity period
+        An exception will be thrown if:
+            - the issuer has no private key
+            - the role name is invalid (must be alphanumeric)
+            - the validity period is invalid (must be >= 1 second)
+
+    (The following three methods will throw an exception if the certificate has
+    been baked. They return false if there's an invalid principal or role name.)
+
+    bool principal(char *keyid)
+        Add a principal subject
+
+    bool role(char *keyid, char *role)
+        Add a role subject
+
+    bool linking_role(char *keyid, char *role, char *linked)
+        Add a linking role subject
+
+    bool bake()
+        Generate the cert. Call this after you've added subjects to your cert.
+        This returns false if there are no subjects
+        This will throw an exception if the cert's already been baked.
+
+    bool baked()
+        Returns true iff the cert has been baked.
+
+    void write(FILE *out)
+        Write the DER-encoded X.509 attribute cert to the open file handle
+        Throws an exception if the cert isn't baked
+
+    void write(string& out)
+        Write the DER-encoded X.509 attribute cert to a file named out
+        Throws an exception if the cert isn't baked
+
+    void write(char *out)
+        Write the DER-encoded X.509 attribute cert to a file named out
+        Throws an exception if the cert isn't baked
+
+    abac_chunk_t cert_chunk()
+        returns a DER-encoded binary representation of the X.509 attribute
+        cert associated with this cert
+        Throws an exception if the cert isn't baked
+        the chunk can be passed to libabac's Context::load_attribute_chunk()
+
 C API
 
@@ -96,4 +205,7 @@
     C++:    ctx.load_attribute_file("test_attr.der");
     C:      abac_context_load_attribute_file(ctx, "test_attr.der");
+
+    C++:    id.load_privkey("test_key.pem");
+    C:      ret = abac_id_load_privkey(id, "test_key.pem");
 
 Instead of copy constructors, the C API uses _dup. Therefore, to copy a
Index: doc/INSTALL
===================================================================
--- doc/INSTALL	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/INSTALL	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -1,30 +1,7 @@
 For Java installation instructions, see doc/java_install.
-
-Prior to building libabac you must install libstrongswan.
-
-Download strongswan-4.4.0 from strongswan.org:
-    http://download.strongswan.org/strongswan-4.4.0.tar.bz2
-
-FreeBSD users: add --with-group=wheel to strongswan ./configure
-
-Linux users: add --disable-gmp --enable-openssl to strongswan ./configure
-to avoid long credential creation times. The entropy sources
-libstrongswan uses by default gather entropy slowly on Linux.  These
-flags allow it to gather entropy from the same sources as openssl, which
-is noticeably faster.
-
-$ tar xjvf strongswan-4.4.0.tar.bz2
-$ cd strongswan-4.4.0
-$ # see note above about configure flags
-$ ./configure --enable-monolithic 
-$ cd src/libstrongswan
-$ make && sudo make install
-
-Be sure to make note of the directory into which you've untarred
-strongswan-4.4.0.tar.bz2. You will use this in the next step.
 
 BUILDING LIBABAC
 
-$ STRONGSWAN_SRC_DIR=path/to/strongswan-4.4.0
-$ ./configure --with-strongswan=$STRONGSWAN_SRC_DIR
+$ ./configure
 $ make && sudo make install
+
Index: doc/TOC
===================================================================
--- doc/TOC	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/TOC	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -11,4 +11,2 @@
 
 for creddy doc, see creddy(1) in the man pages
-
-creddy_API          libcreddy external API
Index: doc/creddy.1
===================================================================
--- doc/creddy.1	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/creddy.1	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -2,5 +2,5 @@
 
 .SH NAME
-creddy \- ABAC X.509 identity and attribute certificate manager (for cool kids)
+creddy \- ABAC X.509 identity and XML attribute certificate manager (for cool kids)
 
 .SH SYNOPSIS
@@ -12,5 +12,5 @@
 creddy is an awesome and wonderful ABAC credential management tool. It
 creates, verifies, and otherwise frobnicates X.509 identity and
-attribute certificates. The output of the tool is suitable for use with
+XML attribute certificates. The output of the tool is suitable for use with
 ABAC. Additionally, the self-signed X.509 identity certs (with
 associated private keys) can be used with OpenSSL.
@@ -44,5 +44,5 @@
 .TP
 .B --attrcert
-optional X.509 attribute cert. If omitted the self-signature of the ID cert is checked
+optional XML attribute cert. If omitted the self-signature of the ID cert is checked
 
 .SS --keyid
@@ -54,5 +54,5 @@
 
 .SS --attribute
-generate an X.509 attribute cert representing an ABAC credential
+generate a XML attribute cert representing an ABAC credential
 
 An attribute cert has one or more subjects. A single subject may be defined without a role. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-role. Providing multiple subjects creates an intersection certificate.
@@ -88,16 +88,16 @@
 .TP
 .B --out
-where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der.
+where to save the XML attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.xml.
 
 
 .SS --roles
-Extract the roles from an X.509 attribute cert
+Extract the roles from an XML attribute cert
 
 .TP
 .B --cert
-X.509 attribute cert containing ABAC roles
+XML attribute cert containing ABAC roles
 
 .SS --display
-Displays metadata from an X.509 identity or attribute cert
+Displays metadata from an X.509 identity or XML attribute cert
 
 .TP
@@ -113,5 +113,5 @@
 .TP
 .B --cert
-X.509 identity or attribute cert
+X.509 identity or XML attribute cert
 
 .SS --version
@@ -137,5 +137,6 @@
 .SH AUTHOR
 
-Written by Mike Ryan <mikeryan@ISI.EDU>. Like what you see? Buy me a beer!
+Written by Mike Ryan <mikeryan@ISI.EDU>
+Edited by Mei-Hui Su <mei@ISI.EDU>
 
 .SH BUGS
@@ -145,3 +146,3 @@
 .SH COPYRIGHT
 
-Copyright (c) 2010-2011 USC/ISI. Released under MIT license. See COPYING included with source for details.
+Copyright (c) 2010-2013 USC/ISI. Released under MIT license. See COPYING included with source for details.
Index: doc/creddy_API
===================================================================
--- doc/creddy_API	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ 	(revision )
@@ -1,139 +1,0 @@
-C++ API
-
-(see bottom for notes on C, Perl, and Python)
-
-see doc/API for notes on abac_chunk_t
-
-Creddy::ID
-    ID(char *filename)
-        load an ID cert from a file
-        Will throw an exception if the cert cannot be loaded
-
-    ID(char *cn, int validity)
-        generates a new ID with the supplied CN and validity period
-        - CN must be alphanumeric and begin with a letter
-        - validity must be at least one second
-        Will throw an exception if either of the above is violated
-
-    void load_privkey(char *filename)
-        loads the private key associated with the cert
-        will throw an exception if the key cannot be loaded
-
-    char *keyid()
-        returns the SHA1 keyid of the cert
-
-    char *cert_filename()
-        returns a suggested filename for the generated ID cert, namely:
-            ${CN}_id.pem
-
-    char *privkey_filename()
-        returns a suggested filename for the private key of the ID cert:
-            ${CN}_key.pem
-
-    void write_cert(FILE *out)
-        writes a PEM-encoded cert to the file handle
-
-    void write_cert(string& out)
-        writes a PEM-encoded cert to a file named out
-
-    void write_cert(char *out)
-        writes a PEM-encoded cert to a file named out
-
-    void write_privkey(FILE *out)
-        writes a PEM-encoded private key to the file handle
-        throws an exception if no private key is loaded
-
-    void write_privkey(string& out)
-        writes a PEM-encoded private key to a file named out
-        throws an exception if no private key is loaded
-
-    void write_privkey(char *out)
-        writes a PEM-encoded private key a file named out
-        throws an exception if no private key is loaded
-
-    abac_chunk_t cert_chunk()
-        returns a DER-encoded binary representation of the X.509 ID cert
-        associated with this ID.
-        can be passed to libabac's Context::load_id_chunk()
-
-    In languages where swig is confused by overloading, the write_* functions 
-        are replaced with (for example) write_cert(FILE *) and 
-        write_cert_name(char*) to remove the ambiguity.  perl and python
-        use these names, and perl uses only the write_cert_name() forms.
-
-Creddy::Attribute
-
-    N.B., The way you use this class is by instantiating the object, adding
-    subjects to it, and then baking it. Only once it's baked can you access the
-    X.509 cert. Once it's been baked you can no longer add subjects to it.
-
-    Attribute(ID &issuer, char *role, int validity)
-        Create an object to be signed by the given issuer with the given role
-        and validity period
-        An exception will be thrown if:
-            - the issuer has no private key
-            - the role name is invalid (must be alphanumeric)
-            - the validity period is invalid (must be >= 1 second)
-
-    (The following three methods will throw an exception if the certificate has
-    been baked. They return false if there's an invalid principal or role name.)
-
-    bool principal(char *keyid)
-        Add a principal subject
-
-    bool role(char *keyid, char *role)
-        Add a role subject
-
-    bool linking_role(char *keyid, char *role, char *linked)
-        Add a linking role subject
-
-    bool bake()
-        Generate the cert. Call this after you've added subjects to your cert.
-        This returns false if there are no subjects
-        This will throw an exception if the cert's already been baked.
-
-    bool baked()
-        Returns true iff the cert has been baked.
-
-    void write(FILE *out)
-        Write the DER-encoded X.509 attribute cert to the open file handle
-        Throws an exception if the cert isn't baked
-
-    void write(string& out)
-        Write the DER-encoded X.509 attribute cert to a file named out
-        Throws an exception if the cert isn't baked
-
-    void write(char *out)
-        Write the DER-encoded X.509 attribute cert to a file named out
-        Throws an exception if the cert isn't baked
-
-    abac_chunk_t cert_chunk()
-        returns a DER-encoded binary representation of the X.509 attribute
-        cert associated with this cert
-        Throws an exception if the cert isn't baked
-        the chunk can be passed to libabac's Context::load_attribute_chunk()
-
-
-    The overloaded write member functions are exported to perl and python
-    in ways analogous to the overloaded functions in the ID class above.
-
-C API
-
-(Mostly cut/pasted from ABAC)
-
-The C API is nearly identical to the C++ API. Due to lack of namespaces,
-all function names are preceeded by creddy_. Furthermore, the parameter
-representing the object must be passed explicitly.
-
-Due to a lack of exceptions, the C API uses return values for functions
-which can fail. See creddy.h for more details:
-
-Example:
-
-    C++:    id.load_privkey("test_key.pem");
-    C:      ret = creddy_id_load_privkey(id, "test_key.pem");
-
-Perl/Python:
-
-The API is identical to C++. Native types are used instead of C types, but this
-should be seamless to a user of the library.
Index: doc/dependencies
===================================================================
--- doc/dependencies	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/dependencies	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -1,13 +1,7 @@
-All software packages except strongswan-4.4.0 can be installed via
-distribution package.
+All software packages can be installed via distribution package.
 
-libstrongswan:
-    strongswan-4.4.0
-        http://strongswan.org/
-        http://download.strongswan.org/strongswan-4.4.0.tar.bz2
-
-    swig-1.3
-        http://swig.org/
-        http://sourceforge.net/projects/swig/files/swig/swig-1.3.40/
+swig-1.3
+    http://swig.org/
+    http://sourceforge.net/projects/swig/files/swig/swig-1.3.40/
 
 Perl modules (via CPAN or distribution package)
@@ -38,4 +32,5 @@
 python-dev
 swig
+libxmlsec1-dev
 
 BUILDING ON FREEBSD
@@ -46,2 +41,4 @@
 math/gmp
 devel/autoconf-archive
+security/xmlsec1
+
Index: doc/keystore
===================================================================
--- doc/keystore	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/keystore	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -1,4 +1,4 @@
 A libabac keystore is a simple directory filled with some number of X509
-identity and X509 attribute certificates. It may optionally include RSA
+identity and XML attribute certificates. It may optionally include RSA
 private keys.
 
@@ -8,4 +8,4 @@
 the CN you supplied.
 
-X509 attribute certs are identified as files whose names end in
-_attr.der. The portion before the _attr.der is irrelevant.
+XML attribute certs are identified as files whose names end in
+_attr.xml. The portion before the _attr.xml is irrelevant.
Index: doc/usage_scenario
===================================================================
--- doc/usage_scenario	(revision ab52de124656dd0edaa41adbe78a3248d0d54f4f)
+++ doc/usage_scenario	(revision 472161887a4822e907c5e9d23bd1a4a0ec6f950b)
@@ -1,5 +1,5 @@
 You (Acme, Inc.) are running a service and you would like to use ABAC to
 authenticate users before they can buy rockets from you. Abstractly,
-your local set of credentials (as encoded by X509 attribute
+your local set of credentials (as encoded by XML attribute
 certificates) looks like this:
 
@@ -10,5 +10,5 @@
 above credential.
 
-You have issued the following attribute (encoded in an X509 attribute
+You have issued the following attribute (encoded in an XML attribute
 cert), which is held by a user of your service:
 
@@ -16,5 +16,5 @@
 
 The Coyote will begin an SSL session to your service using his
-self-signed X509 identity certificate and will present this X509
+self-signed X509 identity certificate and will present this XML
 attribute certificate in the body of his message. You will clone the
 ABAC context and add the Coyote's identity certificate and the attribute
