Index: doc/API
===================================================================
--- doc/API	(revision 9b43fc3d618a238405947779470f1a092ba98648)
+++ doc/API	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -367,5 +367,5 @@
 
    ID(char *,int)
-     generates a new ID with the supplied CN and validity period
+     generates a new ID(cert&key) with the supplied CN and validity period
      - CN must be alphanumeric and begin with a letter
      - validity must be at least one second
@@ -373,8 +373,21 @@
      (C:abac_id_generate)
 
+   ID(char *,int, char*, char*)
+     generates a new ID from a supplied CN, keyfile, passphrase(optional) file
+     and validity period
+     - CN must be alphanumeric and begin with a letter
+     - validity must be at least one second
+     will throw an exception if either of the above is violated 
+     (C:abac_id_generate_with_key)
+
    void id_load_privkey_file(char *)
-     loads the private key associated with the ID credential
+     loads the private key associated with the ID credential,
      will throw an exception if the key cannot be loaded 
      (C:abac_id_load_privkey_file)
+
+   void id_load_encrypted_privkey_file(char *, char*)
+     loads an encrypted private key and pfile associated with the 
+     ID credential, will throw an exception if the key cannot be loaded 
+     (C:abac_id_load_enc_privkey_file)
 
    char *id_keyid()
@@ -556,7 +569,12 @@
 
    int load_id_file(char *)
-     load id cert from an idkey combo file. key retrieval will be attempt
+     load id cert from an idkey combo file. key retrieval will be attempted
      but won't fail if not found
      (C:abac_context_load_id_file)
+
+   int load_id_encrypted_file(char *, char *)
+     load id cert from an idkey combo file and a pfile. Encrypted key
+     retrieval will be attempted but won't fail if not found
+     (C:abac_context_load_encrypted_id_file)
 
    int load_id_files(char *, char *) 
@@ -564,4 +582,8 @@
      (C:abac_context_load_id_files)
 
+   int load_id_encrypted_files(char *, char *, char *) 
+     load id cert from an id file, an encrypted key file, and a pfile
+     (C:abac_context_load_encrypted_id_files)
+
    int load_id_chunk(abac_chunk_t) 
      load id cert from a chunk structure
@@ -569,6 +591,10 @@
 
    int load_id_chunks(abac_chunk_t, abac_chunk_t) 
-     load id privkey from a chunk structure
+     load id & privkey from chunk structures
      (C:abac_context_load_id_privkey_chunk)
+
+   int load_id_encrypted_chunks(abac_chunk_t, abac_chunk_t,char *pfile) 
+     load id & encrypted privkey from chunk structures
+     (C:abac_context_load_id_enc_privkey_chunk)
      returns:
        ABAC_CERT_SUCCESS   successfully loaded
@@ -637,4 +663,7 @@
      (C:abac_context_principals)
 
+   ID lookup_principal(char *)
+     find a particular principal from the context
+
    char *version()
      return the version of this interface
Index: doc/ChangeLog
===================================================================
--- doc/ChangeLog	(revision 9b43fc3d618a238405947779470f1a092ba98648)
+++ doc/ChangeLog	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -1,4 +1,18 @@
+= 0.2.2 =
+2012-08-06
+ * Added support for accepting encrypted private key with passphrase
+   for principal credential creation and for attribute rule creation 
+ * API is expanded to allow specifying private key file and passphrase
+   file 
+ * creddy attribute and generate options are expanded to accept 
+   a specific private key and allowing passphrase option
+ * a new keycheck option is added to creddy to do access check on
+   a key file (encrypted and none encrypted)
+ * add examples for encryption/passphrase
+ * migrate the sample scripts that used to be under swig directory to
+   examples directory and setup as part of regression test suite
+
 = 0.2.1 =
-2012-07-02
+2012-07-06
  * The API visible to programmers is much richer and should make
    development simpler.  As part of this, the libcreddy/libabac
Index: doc/creddy.1
===================================================================
--- doc/creddy.1	(revision 9b43fc3d618a238405947779470f1a092ba98648)
+++ doc/creddy.1	(revision ba6027a0fac78c4a2e819aabd3ccc80779620acc)
@@ -1,3 +1,3 @@
-.TH creddy 1 "July 2012" "ABAC 2.1.0"
+.TH creddy 1 "July 2012" "ABAC 0.2.2"
 
 .SH NAME
@@ -14,12 +14,13 @@
 attribute certificates. The output of the tool is suitable for use with
 ABAC. Additionally, the self-signed X.509 identity certs (with
-associated private keys) can be used with OpenSSL.
+associated private keys) can be used with OpenSSL
 
 .SH OPTIONS
 
 .SS --generate
-Generate an X.509 identity cert and private key pair. The certificate is saved in ${cn}_id.pem and the private key is saved in ${cn}_private.pem.
+Generate an X.509 identity cert and private key pair unless an external private key is specified. The certificate is saved in ${cn}_id.pem and the generated private key is saved in ${cn}_private.pem
+
 .P
-Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems.
+Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems
 
 .TP
@@ -29,9 +30,18 @@
 .TP
 .B --validity
-optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 1080 days.
+optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 1080 days
 
 .TP
 .B --out
-optional output directory. Must exist before invoking the command.
+optional output directory. Must exist before invoking the command
+
+.TP
+.B --key
+optional external private key to be use for this identity
+
+.TP
+.B --p
+optional passphrase flag if the external private key supplied is encrypted. If the passphrase
+is saved in a file 'pfile', then --p=pfile
 
 .SS --verify
@@ -56,5 +66,5 @@
 generate an X.509 attribute cert representing an ABAC credential
 
-An attribute cert has one or more subjects. A single subject may be defined without a role or oset. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-{role,oset} and may include an optional --subject-link or just --subject-obj or --subject-cert. Providing multiple subjects creates an intersection certificate.
+An attribute cert has one or more subjects. A single subject may be defined without a role or oset. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-{role,oset} and may include an optional --subject-link or just --subject-obj or --subject-cert. Providing multiple subjects creates an intersection certificate
 
 .TP
@@ -65,4 +75,8 @@
 .B --key
 private key associated with issuer cert
+
+.TP
+.B --p
+optional passphrase if the private key is encrypted
 
 .TP
@@ -76,34 +90,44 @@
 .TP
 .B --subject-cert
-X.509 identity cert representing the principal to which the role is being issued. This fulfills the same purpose as --subject-id and should only be used once per subject.
+X.509 identity cert representing the principal to which the role is being issued. This fulfills the same purpose as --subject-id and should only be used once per subject
 
 .TP
 .B --subject-id
-public key identifier (SHA1 hash) of the principal to which the role is being issued. This fulfills the same purpose as --subject-cert and should only be used once per subject.
+public key identifier (SHA1 hash) of the principal to which the role is being issued. This fulfills the same purpose as --subject-cert and should only be used once per subject
 
 .TP
 .B --subject-role
-optional role in subject's local attribute space. If the issuer is A, role is r1, subject is B, and subject-role is r2, the attribute issued will be A.r1 <- B.r2.
+optional role in subject's local attribute space. If the issuer is A, role is r1, subject is B, and subject-role is r2, the attribute issued will be A.r1 <- B.r2
 
 .TP
 .B --subject-oset
-optional oset in subject's local attribute space. If the issuer is A, oset is o1, subject is B, and subject-oset is o2, the attribute issued will be A.o1 <- B.o2.
+optional oset in subject's local attribute space. If the issuer is A, oset is o1, subject is B, and subject-oset is o2, the attribute issued will be A.o1 <- B.o2
 
 .TP
 .B --subject-link
-optional linking role in subject's local attribute space. If the issuer is A, oset is o1, subject is B, subject-link is r2 and subject-oset is o2, the attribute issued will be A.o1 <- B.r2.o2.
+optional linking role in subject's local attribute space. If the issuer is A, oset is o1, subject is B, subject-link is r2 and subject-oset is o2, the attribute issued will be A.o1 <- B.r2.o2
 
 .TP
 .B --subject-obj
-optional object in subject's local attribute space. If the issuer is A, oset is o1, and subject-obj is o2, the attribute issued will be A.o1 <- o2.
+optional object in subject's local attribute space. If the issuer is A, oset is o1, and subject-obj is o2, the attribute issued will be A.o1 <- o2
 
 .TP
 .B --validity
-optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 365 days.
+optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 365 days
 
 .TP
 .B --out
-where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der.
+where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der
 
+.SS --keycheck
+Do a sanity check on a private key file
+
+.TP
+.B --key
+private key to be used
+
+.TP
+.B --p
+private key to be used
 
 .SS --roles
