• file
• revisions
• annotate
• diff
• comparison
• raw

security/nss/lib/freebl/blapi.h@b8a032363ba2 (annotated)

security/nss/lib/freebl/blapi.h

Thu, 22 Jan 2015 13:21:57 +0100

author

Michael Schloh von Bennewitz <michael@schloh.com>

date

Thu, 22 Jan 2015 13:21:57 +0100

branch

TOR_BUG_9701

changeset 15

b8a032363ba2

permissions

-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0	1	/*
michael@0	2	* blapi.h - public prototypes for the freebl library
michael@0	3	*
michael@0	4	* This Source Code Form is subject to the terms of the Mozilla Public
michael@0	5	* License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0	6	* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0	7
michael@0	8	#ifndef _BLAPI_H_
michael@0	9	#define _BLAPI_H_
michael@0	10
michael@0	11	#include "blapit.h"
michael@0	12	#include "hasht.h"
michael@0	13	#include "alghmac.h"
michael@0	14
michael@0	15	SEC_BEGIN_PROTOS
michael@0	16
michael@0	17	/*
michael@0	18	** RSA encryption/decryption. When encrypting/decrypting the output
michael@0	19	** buffer must be at least the size of the public key modulus.
michael@0	20	*/
michael@0	21
michael@0	22	extern SECStatus BL_Init(void);
michael@0	23
michael@0	24	/*
michael@0	25	** Generate and return a new RSA public and private key.
michael@0	26	** Both keys are encoded in a single RSAPrivateKey structure.
michael@0	27	** "cx" is the random number generator context
michael@0	28	** "keySizeInBits" is the size of the key to be generated, in bits.
michael@0	29	** 512, 1024, etc.
michael@0	30	** "publicExponent" when not NULL is a pointer to some data that
michael@0	31	** represents the public exponent to use. The data is a byte
michael@0	32	** encoded integer, in "big endian" order.
michael@0	33	*/
michael@0	34	extern RSAPrivateKey *RSA_NewKey(int keySizeInBits,
michael@0	35	SECItem * publicExponent);
michael@0	36
michael@0	37	/*
michael@0	38	** Perform a raw public-key operation
michael@0	39	** Length of input and output buffers are equal to key's modulus len.
michael@0	40	*/
michael@0	41	extern SECStatus RSA_PublicKeyOp(RSAPublicKey * key,
michael@0	42	unsigned char * output,
michael@0	43	const unsigned char * input);
michael@0	44
michael@0	45	/*
michael@0	46	** Perform a raw private-key operation
michael@0	47	** Length of input and output buffers are equal to key's modulus len.
michael@0	48	*/
michael@0	49	extern SECStatus RSA_PrivateKeyOp(RSAPrivateKey * key,
michael@0	50	unsigned char * output,
michael@0	51	const unsigned char * input);
michael@0	52
michael@0	53	/*
michael@0	54	** Perform a raw private-key operation, and check the parameters used in
michael@0	55	** the operation for validity by performing a test operation first.
michael@0	56	** Length of input and output buffers are equal to key's modulus len.
michael@0	57	*/
michael@0	58	extern SECStatus RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey * key,
michael@0	59	unsigned char * output,
michael@0	60	const unsigned char * input);
michael@0	61
michael@0	62	/*
michael@0	63	** Perform a check of private key parameters for consistency.
michael@0	64	*/
michael@0	65	extern SECStatus RSA_PrivateKeyCheck(const RSAPrivateKey *key);
michael@0	66
michael@0	67	/*
michael@0	68	** Given only minimal private key parameters, fill in the rest of the
michael@0	69	** parameters.
michael@0	70	**
michael@0	71	**
michael@0	72	** All the entries, including those supplied by the caller, will be
michael@0	73	** overwritten with data alocated out of the arena.
michael@0	74	**
michael@0	75	** If no arena is supplied, one will be created.
michael@0	76	**
michael@0	77	** The following fields must be supplied in order for this function
michael@0	78	** to succeed:
michael@0	79	** one of either publicExponent or privateExponent
michael@0	80	** two more of the following 5 parameters (not counting the above).
michael@0	81	** modulus (n)
michael@0	82	** prime1 (p)
michael@0	83	** prime2 (q)
michael@0	84	** publicExponent (e)
michael@0	85	** privateExponent (d)
michael@0	86	**
michael@0	87	** NOTE: if only the publicExponent, privateExponent, and one prime is given,
michael@0	88	** then there may be more than one RSA key that matches that combination. If
michael@0	89	** we find 2 possible valid keys that meet this criteria, we return an error.
michael@0	90	** If we return the wrong key, and the original modulus is compared to the
michael@0	91	** new modulus, both can be factored by calculateing gcd(n_old,n_new) to get
michael@0	92	** the common prime.
michael@0	93	**
michael@0	94	** NOTE: in some cases the publicExponent must be less than 2^23 for this
michael@0	95	** function to work correctly. (The case where we have only one of: modulus
michael@0	96	** prime1 and prime2).
michael@0	97	**
michael@0	98	** All parameters will be replaced in the key structure with new parameters
michael@0	99	** allocated out of the arena. There is no attempt to free the old structures.
michael@0	100	** prime1 will always be greater than prime2 (even if the caller supplies the
michael@0	101	** smaller prime as prime1 or the larger prime as prime2). The parameters are
michael@0	102	** not overwritten on failure.
michael@0	103	**
michael@0	104	** While the remaining Chinese remainder theorem parameters (dp,dp, and qinv)
michael@0	105	** can also be used in reconstructing the private key, they are currently
michael@0	106	** ignored in this implementation.
michael@0	107	*/
michael@0	108	extern SECStatus RSA_PopulatePrivateKey(RSAPrivateKey *key);
michael@0	109
michael@0	110	/********************************************************************
michael@0	111	** RSA algorithm
michael@0	112	*/
michael@0	113
michael@0	114	/********************************************************************
michael@0	115	** Raw signing/encryption/decryption operations.
michael@0	116	**
michael@0	117	** No padding or formatting will be applied.
michael@0	118	** inputLen MUST be equivalent to the modulus size (in bytes).
michael@0	119	*/
michael@0	120	extern SECStatus
michael@0	121	RSA_SignRaw(RSAPrivateKey * key,
michael@0	122	unsigned char * output,
michael@0	123	unsigned int * outputLen,
michael@0	124	unsigned int maxOutputLen,
michael@0	125	const unsigned char * input,
michael@0	126	unsigned int inputLen);
michael@0	127
michael@0	128	extern SECStatus
michael@0	129	RSA_CheckSignRaw(RSAPublicKey * key,
michael@0	130	const unsigned char * sig,
michael@0	131	unsigned int sigLen,
michael@0	132	const unsigned char * hash,
michael@0	133	unsigned int hashLen);
michael@0	134
michael@0	135	extern SECStatus
michael@0	136	RSA_CheckSignRecoverRaw(RSAPublicKey * key,
michael@0	137	unsigned char * data,
michael@0	138	unsigned int * dataLen,
michael@0	139	unsigned int maxDataLen,
michael@0	140	const unsigned char * sig,
michael@0	141	unsigned int sigLen);
michael@0	142
michael@0	143	extern SECStatus
michael@0	144	RSA_EncryptRaw(RSAPublicKey * key,
michael@0	145	unsigned char * output,
michael@0	146	unsigned int * outputLen,
michael@0	147	unsigned int maxOutputLen,
michael@0	148	const unsigned char * input,
michael@0	149	unsigned int inputLen);
michael@0	150
michael@0	151	extern SECStatus
michael@0	152	RSA_DecryptRaw(RSAPrivateKey * key,
michael@0	153	unsigned char * output,
michael@0	154	unsigned int * outputLen,
michael@0	155	unsigned int maxOutputLen,
michael@0	156	const unsigned char * input,
michael@0	157	unsigned int inputLen);
michael@0	158
michael@0	159	/********************************************************************
michael@0	160	** RSAES-OAEP encryption/decryption, as defined in RFC 3447, Section 7.1.
michael@0	161	**
michael@0	162	** Note: Only MGF1 is supported as the mask generation function. It will be
michael@0	163	** used with maskHashAlg as the inner hash function.
michael@0	164	**
michael@0	165	** Unless performing Known Answer Tests, "seed" should be NULL, indicating that
michael@0	166	** freebl should generate a random value. Otherwise, it should be an octet
michael@0	167	** string of seedLen bytes, which should be the same size as the output of
michael@0	168	** hashAlg.
michael@0	169	*/
michael@0	170	extern SECStatus
michael@0	171	RSA_EncryptOAEP(RSAPublicKey * key,
michael@0	172	HASH_HashType hashAlg,
michael@0	173	HASH_HashType maskHashAlg,
michael@0	174	const unsigned char * label,
michael@0	175	unsigned int labelLen,
michael@0	176	const unsigned char * seed,
michael@0	177	unsigned int seedLen,
michael@0	178	unsigned char * output,
michael@0	179	unsigned int * outputLen,
michael@0	180	unsigned int maxOutputLen,
michael@0	181	const unsigned char * input,
michael@0	182	unsigned int inputLen);
michael@0	183
michael@0	184	extern SECStatus
michael@0	185	RSA_DecryptOAEP(RSAPrivateKey * key,
michael@0	186	HASH_HashType hashAlg,
michael@0	187	HASH_HashType maskHashAlg,
michael@0	188	const unsigned char * label,
michael@0	189	unsigned int labelLen,
michael@0	190	unsigned char * output,
michael@0	191	unsigned int * outputLen,
michael@0	192	unsigned int maxOutputLen,
michael@0	193	const unsigned char * input,
michael@0	194	unsigned int inputLen);
michael@0	195
michael@0	196	/********************************************************************
michael@0	197	** RSAES-PKCS1-v1_5 encryption/decryption, as defined in RFC 3447, Section 7.2.
michael@0	198	*/
michael@0	199	extern SECStatus
michael@0	200	RSA_EncryptBlock(RSAPublicKey * key,
michael@0	201	unsigned char * output,
michael@0	202	unsigned int * outputLen,
michael@0	203	unsigned int maxOutputLen,
michael@0	204	const unsigned char * input,
michael@0	205	unsigned int inputLen);
michael@0	206
michael@0	207	extern SECStatus
michael@0	208	RSA_DecryptBlock(RSAPrivateKey * key,
michael@0	209	unsigned char * output,
michael@0	210	unsigned int * outputLen,
michael@0	211	unsigned int maxOutputLen,
michael@0	212	const unsigned char * input,
michael@0	213	unsigned int inputLen);
michael@0	214
michael@0	215	/********************************************************************
michael@0	216	** RSASSA-PSS signing/verifying, as defined in RFC 3447, Section 8.1.
michael@0	217	**
michael@0	218	** Note: Only MGF1 is supported as the mask generation function. It will be
michael@0	219	** used with maskHashAlg as the inner hash function.
michael@0	220	**
michael@0	221	** Unless performing Known Answer Tests, "salt" should be NULL, indicating that
michael@0	222	** freebl should generate a random value.
michael@0	223	*/
michael@0	224	extern SECStatus
michael@0	225	RSA_SignPSS(RSAPrivateKey * key,
michael@0	226	HASH_HashType hashAlg,
michael@0	227	HASH_HashType maskHashAlg,
michael@0	228	const unsigned char * salt,
michael@0	229	unsigned int saltLen,
michael@0	230	unsigned char * output,
michael@0	231	unsigned int * outputLen,
michael@0	232	unsigned int maxOutputLen,
michael@0	233	const unsigned char * input,
michael@0	234	unsigned int inputLen);
michael@0	235
michael@0	236	extern SECStatus
michael@0	237	RSA_CheckSignPSS(RSAPublicKey * key,
michael@0	238	HASH_HashType hashAlg,
michael@0	239	HASH_HashType maskHashAlg,
michael@0	240	unsigned int saltLen,
michael@0	241	const unsigned char * sig,
michael@0	242	unsigned int sigLen,
michael@0	243	const unsigned char * hash,
michael@0	244	unsigned int hashLen);
michael@0	245
michael@0	246	/********************************************************************
michael@0	247	** RSASSA-PKCS1-v1_5 signing/verifying, as defined in RFC 3447, Section 8.2.
michael@0	248	**
michael@0	249	** These functions expect as input to be the raw value to be signed. For most
michael@0	250	** cases using PKCS1-v1_5, this should be the value of T, the DER-encoded
michael@0	251	** DigestInfo structure defined in Section 9.2, Step 2.
michael@0	252	** Note: This can also be used for signatures that use PKCS1-v1_5 padding, such
michael@0	253	** as the signatures used in SSL/TLS, which sign a raw hash.
michael@0	254	*/
michael@0	255	extern SECStatus
michael@0	256	RSA_Sign(RSAPrivateKey * key,
michael@0	257	unsigned char * output,
michael@0	258	unsigned int * outputLen,
michael@0	259	unsigned int maxOutputLen,
michael@0	260	const unsigned char * data,
michael@0	261	unsigned int dataLen);
michael@0	262
michael@0	263	extern SECStatus
michael@0	264	RSA_CheckSign(RSAPublicKey * key,
michael@0	265	const unsigned char * sig,
michael@0	266	unsigned int sigLen,
michael@0	267	const unsigned char * data,
michael@0	268	unsigned int dataLen);
michael@0	269
michael@0	270	extern SECStatus
michael@0	271	RSA_CheckSignRecover(RSAPublicKey * key,
michael@0	272	unsigned char * output,
michael@0	273	unsigned int * outputLen,
michael@0	274	unsigned int maxOutputLen,
michael@0	275	const unsigned char * sig,
michael@0	276	unsigned int sigLen);
michael@0	277
michael@0	278	/********************************************************************
michael@0	279	** DSA signing algorithm
michael@0	280	*/
michael@0	281
michael@0	282	/* Generate a new random value within the interval [2, q-1].
michael@0	283	*/
michael@0	284	extern SECStatus DSA_NewRandom(PLArenaPool * arena, const SECItem * q,
michael@0	285	SECItem * random);
michael@0	286
michael@0	287	/*
michael@0	288	** Generate and return a new DSA public and private key pair,
michael@0	289	** both of which are encoded into a single DSAPrivateKey struct.
michael@0	290	** "params" is a pointer to the PQG parameters for the domain
michael@0	291	** Uses a random seed.
michael@0	292	*/
michael@0	293	extern SECStatus DSA_NewKey(const PQGParams * params,
michael@0	294	DSAPrivateKey ** privKey);
michael@0	295
michael@0	296	/* signature is caller-supplied buffer of at least 20 bytes.
michael@0	297	** On input, signature->len == size of buffer to hold signature.
michael@0	298	** digest->len == size of digest.
michael@0	299	** On output, signature->len == size of signature in buffer.
michael@0	300	** Uses a random seed.
michael@0	301	*/
michael@0	302	extern SECStatus DSA_SignDigest(DSAPrivateKey * key,
michael@0	303	SECItem * signature,
michael@0	304	const SECItem * digest);
michael@0	305
michael@0	306	/* signature is caller-supplied buffer of at least 20 bytes.
michael@0	307	** On input, signature->len == size of buffer to hold signature.
michael@0	308	** digest->len == size of digest.
michael@0	309	*/
michael@0	310	extern SECStatus DSA_VerifyDigest(DSAPublicKey * key,
michael@0	311	const SECItem * signature,
michael@0	312	const SECItem * digest);
michael@0	313
michael@0	314	/* For FIPS compliance testing. Seed must be exactly 20 bytes long */
michael@0	315	extern SECStatus DSA_NewKeyFromSeed(const PQGParams *params,
michael@0	316	const unsigned char * seed,
michael@0	317	DSAPrivateKey **privKey);
michael@0	318
michael@0	319	/* For FIPS compliance testing. Seed must be exactly 20 bytes. */
michael@0	320	extern SECStatus DSA_SignDigestWithSeed(DSAPrivateKey * key,
michael@0	321	SECItem * signature,
michael@0	322	const SECItem * digest,
michael@0	323	const unsigned char * seed);
michael@0	324
michael@0	325	/******************************************************
michael@0	326	** Diffie Helman key exchange algorithm
michael@0	327	*/
michael@0	328
michael@0	329	/* Generates parameters for Diffie-Helman key generation.
michael@0	330	** primeLen is the length in bytes of prime P to be generated.
michael@0	331	*/
michael@0	332	extern SECStatus DH_GenParam(int primeLen, DHParams ** params);
michael@0	333
michael@0	334	/* Generates a public and private key, both of which are encoded in a single
michael@0	335	** DHPrivateKey struct. Params is input, privKey are output.
michael@0	336	** This is Phase 1 of Diffie Hellman.
michael@0	337	*/
michael@0	338	extern SECStatus DH_NewKey(DHParams * params,
michael@0	339	DHPrivateKey ** privKey);
michael@0	340
michael@0	341	/*
michael@0	342	** DH_Derive does the Diffie-Hellman phase 2 calculation, using the
michael@0	343	** other party's publicValue, and the prime and our privateValue.
michael@0	344	** maxOutBytes is the requested length of the generated secret in bytes.
michael@0	345	** A zero value means produce a value of any length up to the size of
michael@0	346	** the prime. If successful, derivedSecret->data is set
michael@0	347	** to the address of the newly allocated buffer containing the derived
michael@0	348	** secret, and derivedSecret->len is the size of the secret produced.
michael@0	349	** The size of the secret produced will depend on the value of outBytes.
michael@0	350	** If outBytes is 0, the key length will be all the significant bytes of
michael@0	351	** the derived secret (leading zeros are dropped). This length could be less
michael@0	352	** than the length of the prime. If outBytes is nonzero, the length of the
michael@0	353	** produced key will be outBytes long. If the key is truncated, the most
michael@0	354	** significant bytes are truncated. If it is expanded, zero bytes are added
michael@0	355	** at the beginning.
michael@0	356	** It is the caller's responsibility to free the allocated buffer
michael@0	357	** containing the derived secret.
michael@0	358	*/
michael@0	359	extern SECStatus DH_Derive(SECItem * publicValue,
michael@0	360	SECItem * prime,
michael@0	361	SECItem * privateValue,
michael@0	362	SECItem * derivedSecret,
michael@0	363	unsigned int outBytes);
michael@0	364
michael@0	365	/*
michael@0	366	** KEA_CalcKey returns octet string with the private key for a dual
michael@0	367	** Diffie-Helman key generation as specified for government key exchange.
michael@0	368	*/
michael@0	369	extern SECStatus KEA_Derive(SECItem *prime,
michael@0	370	SECItem *public1,
michael@0	371	SECItem *public2,
michael@0	372	SECItem *private1,
michael@0	373	SECItem *private2,
michael@0	374	SECItem *derivedSecret);
michael@0	375
michael@0	376	/*
michael@0	377	* verify that a KEA or DSA public key is a valid key for this prime and
michael@0	378	* subprime domain.
michael@0	379	*/
michael@0	380	extern PRBool KEA_Verify(SECItem *Y, SECItem *prime, SECItem *subPrime);
michael@0	381
michael@0	382	/****************************************
michael@0	383	* J-PAKE key transport
michael@0	384	*/
michael@0	385
michael@0	386	/* Given gx == g^x, create a Schnorr zero-knowledge proof for the value x
michael@0	387	* using the specified hash algorithm and signer ID. The signature is
michael@0	388	* returned in the values gv and r. testRandom must be NULL for a PRNG
michael@0	389	* generated random committment to be used in the sigature. When testRandom
michael@0	390	* is non-NULL, that value must contain a value in the subgroup q; that
michael@0	391	* value will be used instead of a PRNG-generated committment in order to
michael@0	392	* facilitate known-answer tests.
michael@0	393	*
michael@0	394	* If gxIn is non-NULL then it must contain a pre-computed value of g^x that
michael@0	395	* will be used by the function; in this case, the gxOut parameter must be NULL.
michael@0	396	* If the gxIn parameter is NULL then gxOut must be non-NULL; in this case
michael@0	397	* gxOut will contain the value g^x on output.
michael@0	398	*
michael@0	399	* gx (if not supplied by the caller), gv, and r will be allocated in the arena.
michael@0	400	* The arena is *not* optional so do not pass NULL for the arena parameter.
michael@0	401	* The arena should be zeroed when it is freed.
michael@0	402	*/
michael@0	403	SECStatus
michael@0	404	JPAKE_Sign(PLArenaPool * arena, const PQGParams * pqg, HASH_HashType hashType,
michael@0	405	const SECItem * signerID, const SECItem * x,
michael@0	406	const SECItem * testRandom, const SECItem * gxIn, SECItem * gxOut,
michael@0	407	SECItem * gv, SECItem * r);
michael@0	408
michael@0	409	/* Given gx == g^x, verify the Schnorr zero-knowledge proof (gv, r) for the
michael@0	410	* value x using the specified hash algorithm and signer ID.
michael@0	411	*
michael@0	412	* The arena is *not* optional so do not pass NULL for the arena parameter.
michael@0	413	*/
michael@0	414	SECStatus
michael@0	415	JPAKE_Verify(PLArenaPool * arena, const PQGParams * pqg,
michael@0	416	HASH_HashType hashType, const SECItem * signerID,
michael@0	417	const SECItem * peerID, const SECItem * gx,
michael@0	418	const SECItem * gv, const SECItem * r);
michael@0	419
michael@0	420	/* Call before round 2 with x2, s, and x2s all non-NULL. This will calculate
michael@0	421	* base = g^(x1+x3+x4) (mod p) and x2s = x2*s (mod q). The values to send in
michael@0	422	* round 2 (A and the proof of knowledge of x2s) can then be calculated with
michael@0	423	* JPAKE_Sign using pqg->base = base and x = x2s.
michael@0	424	*
michael@0	425	* Call after round 2 with x2, s, and x2s all NULL, and passing (gx1, gx2, gx3)
michael@0	426	* instead of (gx1, gx3, gx4). This will calculate base = g^(x1+x2+x3). Then call
michael@0	427	* JPAKE_Verify with pqg->base = base and then JPAKE_Final.
michael@0	428	*
michael@0	429	* base and x2s will be allocated in the arena. The arena is *not* optional so
michael@0	430	* do not pass NULL for the arena parameter. The arena should be zeroed when it
michael@0	431	* is freed.
michael@0	432	*/
michael@0	433	SECStatus
michael@0	434	JPAKE_Round2(PLArenaPool * arena, const SECItem * p, const SECItem *q,
michael@0	435	const SECItem * gx1, const SECItem * gx3, const SECItem * gx4,
michael@0	436	SECItem * base, const SECItem * x2, const SECItem * s, SECItem * x2s);
michael@0	437
michael@0	438	/* K = (B/g^(x2*x4*s))^x2 (mod p)
michael@0	439	*
michael@0	440	* K will be allocated in the arena. The arena is *not* optional so do not pass
michael@0	441	* NULL for the arena parameter. The arena should be zeroed when it is freed.
michael@0	442	*/
michael@0	443	SECStatus
michael@0	444	JPAKE_Final(PLArenaPool * arena, const SECItem * p, const SECItem *q,
michael@0	445	const SECItem * x2, const SECItem * gx4, const SECItem * x2s,
michael@0	446	const SECItem * B, SECItem * K);
michael@0	447
michael@0	448	/******************************************************
michael@0	449	** Elliptic Curve algorithms
michael@0	450	*/
michael@0	451
michael@0	452	/* Generates a public and private key, both of which are encoded
michael@0	453	** in a single ECPrivateKey struct. Params is input, privKey are
michael@0	454	** output.
michael@0	455	*/
michael@0	456	extern SECStatus EC_NewKey(ECParams * params,
michael@0	457	ECPrivateKey ** privKey);
michael@0	458
michael@0	459	extern SECStatus EC_NewKeyFromSeed(ECParams * params,
michael@0	460	ECPrivateKey ** privKey,
michael@0	461	const unsigned char* seed,
michael@0	462	int seedlen);
michael@0	463
michael@0	464	/* Validates an EC public key as described in Section 5.2.2 of
michael@0	465	* X9.62. Such validation prevents against small subgroup attacks
michael@0	466	* when the ECDH primitive is used with the cofactor.
michael@0	467	*/
michael@0	468	extern SECStatus EC_ValidatePublicKey(ECParams * params,
michael@0	469	SECItem * publicValue);
michael@0	470
michael@0	471	/*
michael@0	472	** ECDH_Derive performs a scalar point multiplication of a point
michael@0	473	** representing a (peer's) public key and a large integer representing
michael@0	474	** a private key (its own). Both keys must use the same elliptic curve
michael@0	475	** parameters. If the withCofactor parameter is true, the
michael@0	476	** multiplication also uses the cofactor associated with the curve
michael@0	477	** parameters. The output of this scheme is the x-coordinate of the
michael@0	478	** resulting point. If successful, derivedSecret->data is set to the
michael@0	479	** address of the newly allocated buffer containing the derived
michael@0	480	** secret, and derivedSecret->len is the size of the secret
michael@0	481	** produced. It is the caller's responsibility to free the allocated
michael@0	482	** buffer containing the derived secret.
michael@0	483	*/
michael@0	484	extern SECStatus ECDH_Derive(SECItem * publicValue,
michael@0	485	ECParams * params,
michael@0	486	SECItem * privateValue,
michael@0	487	PRBool withCofactor,
michael@0	488	SECItem * derivedSecret);
michael@0	489
michael@0	490	/* On input, signature->len == size of buffer to hold signature.
michael@0	491	** digest->len == size of digest.
michael@0	492	** On output, signature->len == size of signature in buffer.
michael@0	493	** Uses a random seed.
michael@0	494	*/
michael@0	495	extern SECStatus ECDSA_SignDigest(ECPrivateKey *key,
michael@0	496	SECItem *signature,
michael@0	497	const SECItem *digest);
michael@0	498
michael@0	499	/* On input, signature->len == size of buffer to hold signature.
michael@0	500	** digest->len == size of digest.
michael@0	501	*/
michael@0	502	extern SECStatus ECDSA_VerifyDigest(ECPublicKey *key,
michael@0	503	const SECItem *signature,
michael@0	504	const SECItem *digest);
michael@0	505
michael@0	506	/* Uses the provided seed. */
michael@0	507	extern SECStatus ECDSA_SignDigestWithSeed(ECPrivateKey *key,
michael@0	508	SECItem *signature,
michael@0	509	const SECItem *digest,
michael@0	510	const unsigned char *seed,
michael@0	511	const int seedlen);
michael@0	512
michael@0	513	/******************************************/
michael@0	514	/*
michael@0	515	** RC4 symmetric stream cypher
michael@0	516	*/
michael@0	517
michael@0	518	/*
michael@0	519	** Create a new RC4 context suitable for RC4 encryption/decryption.
michael@0	520	** "key" raw key data
michael@0	521	** "len" the number of bytes of key data
michael@0	522	*/
michael@0	523	extern RC4Context *RC4_CreateContext(const unsigned char *key, int len);
michael@0	524
michael@0	525	extern RC4Context *RC4_AllocateContext(void);
michael@0	526	extern SECStatus RC4_InitContext(RC4Context *cx,
michael@0	527	const unsigned char *key,
michael@0	528	unsigned int keylen,
michael@0	529	const unsigned char *,
michael@0	530	int,
michael@0	531	unsigned int ,
michael@0	532	unsigned int );
michael@0	533
michael@0	534	/*
michael@0	535	** Destroy an RC4 encryption/decryption context.
michael@0	536	** "cx" the context
michael@0	537	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	538	*/
michael@0	539	extern void RC4_DestroyContext(RC4Context *cx, PRBool freeit);
michael@0	540
michael@0	541	/*
michael@0	542	** Perform RC4 encryption.
michael@0	543	** "cx" the context
michael@0	544	** "output" the output buffer to store the encrypted data.
michael@0	545	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	546	** after some data is stored in output.
michael@0	547	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	548	** stored in "output"
michael@0	549	** "input" the input data
michael@0	550	** "inputLen" the amount of input data
michael@0	551	*/
michael@0	552	extern SECStatus RC4_Encrypt(RC4Context *cx, unsigned char *output,
michael@0	553	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	554	const unsigned char *input, unsigned int inputLen);
michael@0	555
michael@0	556	/*
michael@0	557	** Perform RC4 decryption.
michael@0	558	** "cx" the context
michael@0	559	** "output" the output buffer to store the decrypted data.
michael@0	560	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	561	** after some data is stored in output.
michael@0	562	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	563	** stored in "output"
michael@0	564	** "input" the input data
michael@0	565	** "inputLen" the amount of input data
michael@0	566	*/
michael@0	567	extern SECStatus RC4_Decrypt(RC4Context *cx, unsigned char *output,
michael@0	568	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	569	const unsigned char *input, unsigned int inputLen);
michael@0	570
michael@0	571	/******************************************/
michael@0	572	/*
michael@0	573	** RC2 symmetric block cypher
michael@0	574	*/
michael@0	575
michael@0	576	/*
michael@0	577	** Create a new RC2 context suitable for RC2 encryption/decryption.
michael@0	578	** "key" raw key data
michael@0	579	** "len" the number of bytes of key data
michael@0	580	** "iv" is the CBC initialization vector (if mode is NSS_RC2_CBC)
michael@0	581	** "mode" one of NSS_RC2 or NSS_RC2_CBC
michael@0	582	** "effectiveKeyLen" is the effective key length (as specified in
michael@0	583	** RFC 2268) in bytes (not bits).
michael@0	584	**
michael@0	585	** When mode is set to NSS_RC2_CBC the RC2 cipher is run in "cipher block
michael@0	586	** chaining" mode.
michael@0	587	*/
michael@0	588	extern RC2Context *RC2_CreateContext(const unsigned char *key, unsigned int len,
michael@0	589	const unsigned char *iv, int mode,
michael@0	590	unsigned effectiveKeyLen);
michael@0	591	extern RC2Context *RC2_AllocateContext(void);
michael@0	592	extern SECStatus RC2_InitContext(RC2Context *cx,
michael@0	593	const unsigned char *key,
michael@0	594	unsigned int keylen,
michael@0	595	const unsigned char *iv,
michael@0	596	int mode,
michael@0	597	unsigned int effectiveKeyLen,
michael@0	598	unsigned int );
michael@0	599
michael@0	600	/*
michael@0	601	** Destroy an RC2 encryption/decryption context.
michael@0	602	** "cx" the context
michael@0	603	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	604	*/
michael@0	605	extern void RC2_DestroyContext(RC2Context *cx, PRBool freeit);
michael@0	606
michael@0	607	/*
michael@0	608	** Perform RC2 encryption.
michael@0	609	** "cx" the context
michael@0	610	** "output" the output buffer to store the encrypted data.
michael@0	611	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	612	** after some data is stored in output.
michael@0	613	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	614	** stored in "output"
michael@0	615	** "input" the input data
michael@0	616	** "inputLen" the amount of input data
michael@0	617	*/
michael@0	618	extern SECStatus RC2_Encrypt(RC2Context *cx, unsigned char *output,
michael@0	619	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	620	const unsigned char *input, unsigned int inputLen);
michael@0	621
michael@0	622	/*
michael@0	623	** Perform RC2 decryption.
michael@0	624	** "cx" the context
michael@0	625	** "output" the output buffer to store the decrypted data.
michael@0	626	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	627	** after some data is stored in output.
michael@0	628	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	629	** stored in "output"
michael@0	630	** "input" the input data
michael@0	631	** "inputLen" the amount of input data
michael@0	632	*/
michael@0	633	extern SECStatus RC2_Decrypt(RC2Context *cx, unsigned char *output,
michael@0	634	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	635	const unsigned char *input, unsigned int inputLen);
michael@0	636
michael@0	637	/******************************************/
michael@0	638	/*
michael@0	639	** RC5 symmetric block cypher -- 64-bit block size
michael@0	640	*/
michael@0	641
michael@0	642	/*
michael@0	643	** Create a new RC5 context suitable for RC5 encryption/decryption.
michael@0	644	** "key" raw key data
michael@0	645	** "len" the number of bytes of key data
michael@0	646	** "iv" is the CBC initialization vector (if mode is NSS_RC5_CBC)
michael@0	647	** "mode" one of NSS_RC5 or NSS_RC5_CBC
michael@0	648	**
michael@0	649	** When mode is set to NSS_RC5_CBC the RC5 cipher is run in "cipher block
michael@0	650	** chaining" mode.
michael@0	651	*/
michael@0	652	extern RC5Context *RC5_CreateContext(const SECItem *key, unsigned int rounds,
michael@0	653	unsigned int wordSize, const unsigned char *iv, int mode);
michael@0	654	extern RC5Context *RC5_AllocateContext(void);
michael@0	655	extern SECStatus RC5_InitContext(RC5Context *cx,
michael@0	656	const unsigned char *key,
michael@0	657	unsigned int keylen,
michael@0	658	const unsigned char *iv,
michael@0	659	int mode,
michael@0	660	unsigned int rounds,
michael@0	661	unsigned int wordSize);
michael@0	662
michael@0	663	/*
michael@0	664	** Destroy an RC5 encryption/decryption context.
michael@0	665	** "cx" the context
michael@0	666	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	667	*/
michael@0	668	extern void RC5_DestroyContext(RC5Context *cx, PRBool freeit);
michael@0	669
michael@0	670	/*
michael@0	671	** Perform RC5 encryption.
michael@0	672	** "cx" the context
michael@0	673	** "output" the output buffer to store the encrypted data.
michael@0	674	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	675	** after some data is stored in output.
michael@0	676	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	677	** stored in "output"
michael@0	678	** "input" the input data
michael@0	679	** "inputLen" the amount of input data
michael@0	680	*/
michael@0	681	extern SECStatus RC5_Encrypt(RC5Context *cx, unsigned char *output,
michael@0	682	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	683	const unsigned char *input, unsigned int inputLen);
michael@0	684
michael@0	685	/*
michael@0	686	** Perform RC5 decryption.
michael@0	687	** "cx" the context
michael@0	688	** "output" the output buffer to store the decrypted data.
michael@0	689	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	690	** after some data is stored in output.
michael@0	691	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	692	** stored in "output"
michael@0	693	** "input" the input data
michael@0	694	** "inputLen" the amount of input data
michael@0	695	*/
michael@0	696
michael@0	697	extern SECStatus RC5_Decrypt(RC5Context *cx, unsigned char *output,
michael@0	698	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	699	const unsigned char *input, unsigned int inputLen);
michael@0	700
michael@0	701
michael@0	702
michael@0	703	/******************************************/
michael@0	704	/*
michael@0	705	** DES symmetric block cypher
michael@0	706	*/
michael@0	707
michael@0	708	/*
michael@0	709	** Create a new DES context suitable for DES encryption/decryption.
michael@0	710	** "key" raw key data
michael@0	711	** "len" the number of bytes of key data
michael@0	712	** "iv" is the CBC initialization vector (if mode is NSS_DES_CBC or
michael@0	713	** mode is DES_EDE3_CBC)
michael@0	714	** "mode" one of NSS_DES, NSS_DES_CBC, NSS_DES_EDE3 or NSS_DES_EDE3_CBC
michael@0	715	** "encrypt" is PR_TRUE if the context will be used for encryption
michael@0	716	**
michael@0	717	** When mode is set to NSS_DES_CBC or NSS_DES_EDE3_CBC then the DES
michael@0	718	** cipher is run in "cipher block chaining" mode.
michael@0	719	*/
michael@0	720	extern DESContext *DES_CreateContext(const unsigned char *key,
michael@0	721	const unsigned char *iv,
michael@0	722	int mode, PRBool encrypt);
michael@0	723	extern DESContext *DES_AllocateContext(void);
michael@0	724	extern SECStatus DES_InitContext(DESContext *cx,
michael@0	725	const unsigned char *key,
michael@0	726	unsigned int keylen,
michael@0	727	const unsigned char *iv,
michael@0	728	int mode,
michael@0	729	unsigned int encrypt,
michael@0	730	unsigned int );
michael@0	731
michael@0	732	/*
michael@0	733	** Destroy an DES encryption/decryption context.
michael@0	734	** "cx" the context
michael@0	735	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	736	*/
michael@0	737	extern void DES_DestroyContext(DESContext *cx, PRBool freeit);
michael@0	738
michael@0	739	/*
michael@0	740	** Perform DES encryption.
michael@0	741	** "cx" the context
michael@0	742	** "output" the output buffer to store the encrypted data.
michael@0	743	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	744	** after some data is stored in output.
michael@0	745	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	746	** stored in "output"
michael@0	747	** "input" the input data
michael@0	748	** "inputLen" the amount of input data
michael@0	749	**
michael@0	750	** NOTE: the inputLen must be a multiple of DES_KEY_LENGTH
michael@0	751	*/
michael@0	752	extern SECStatus DES_Encrypt(DESContext *cx, unsigned char *output,
michael@0	753	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	754	const unsigned char *input, unsigned int inputLen);
michael@0	755
michael@0	756	/*
michael@0	757	** Perform DES decryption.
michael@0	758	** "cx" the context
michael@0	759	** "output" the output buffer to store the decrypted data.
michael@0	760	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	761	** after some data is stored in output.
michael@0	762	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	763	** stored in "output"
michael@0	764	** "input" the input data
michael@0	765	** "inputLen" the amount of input data
michael@0	766	**
michael@0	767	** NOTE: the inputLen must be a multiple of DES_KEY_LENGTH
michael@0	768	*/
michael@0	769	extern SECStatus DES_Decrypt(DESContext *cx, unsigned char *output,
michael@0	770	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	771	const unsigned char *input, unsigned int inputLen);
michael@0	772
michael@0	773	/******************************************/
michael@0	774	/*
michael@0	775	** SEED symmetric block cypher
michael@0	776	*/
michael@0	777	extern SEEDContext *
michael@0	778	SEED_CreateContext(const unsigned char *key, const unsigned char *iv,
michael@0	779	int mode, PRBool encrypt);
michael@0	780	extern SEEDContext *SEED_AllocateContext(void);
michael@0	781	extern SECStatus SEED_InitContext(SEEDContext *cx,
michael@0	782	const unsigned char *key,
michael@0	783	unsigned int keylen,
michael@0	784	const unsigned char *iv,
michael@0	785	int mode, unsigned int encrypt,
michael@0	786	unsigned int );
michael@0	787	extern void SEED_DestroyContext(SEEDContext *cx, PRBool freeit);
michael@0	788	extern SECStatus
michael@0	789	SEED_Encrypt(SEEDContext *cx, unsigned char *output,
michael@0	790	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	791	const unsigned char *input, unsigned int inputLen);
michael@0	792	extern SECStatus
michael@0	793	SEED_Decrypt(SEEDContext *cx, unsigned char *output,
michael@0	794	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	795	const unsigned char *input, unsigned int inputLen);
michael@0	796
michael@0	797	/******************************************/
michael@0	798	/*
michael@0	799	** AES symmetric block cypher (Rijndael)
michael@0	800	*/
michael@0	801
michael@0	802	/*
michael@0	803	** Create a new AES context suitable for AES encryption/decryption.
michael@0	804	** "key" raw key data
michael@0	805	** "keylen" the number of bytes of key data (16, 24, or 32)
michael@0	806	** "blocklen" is the blocksize to use (16, 24, or 32)
michael@0	807	** XXX currently only blocksize==16 has been tested!
michael@0	808	*/
michael@0	809	extern AESContext *
michael@0	810	AES_CreateContext(const unsigned char *key, const unsigned char *iv,
michael@0	811	int mode, int encrypt,
michael@0	812	unsigned int keylen, unsigned int blocklen);
michael@0	813	extern AESContext *AES_AllocateContext(void);
michael@0	814	extern SECStatus AES_InitContext(AESContext *cx,
michael@0	815	const unsigned char *key,
michael@0	816	unsigned int keylen,
michael@0	817	const unsigned char *iv,
michael@0	818	int mode,
michael@0	819	unsigned int encrypt,
michael@0	820	unsigned int blocklen);
michael@0	821
michael@0	822	/*
michael@0	823	** Destroy a AES encryption/decryption context.
michael@0	824	** "cx" the context
michael@0	825	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	826	*/
michael@0	827	extern void
michael@0	828	AES_DestroyContext(AESContext *cx, PRBool freeit);
michael@0	829
michael@0	830	/*
michael@0	831	** Perform AES encryption.
michael@0	832	** "cx" the context
michael@0	833	** "output" the output buffer to store the encrypted data.
michael@0	834	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	835	** after some data is stored in output.
michael@0	836	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	837	** stored in "output"
michael@0	838	** "input" the input data
michael@0	839	** "inputLen" the amount of input data
michael@0	840	*/
michael@0	841	extern SECStatus
michael@0	842	AES_Encrypt(AESContext *cx, unsigned char *output,
michael@0	843	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	844	const unsigned char *input, unsigned int inputLen);
michael@0	845
michael@0	846	/*
michael@0	847	** Perform AES decryption.
michael@0	848	** "cx" the context
michael@0	849	** "output" the output buffer to store the decrypted data.
michael@0	850	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	851	** after some data is stored in output.
michael@0	852	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	853	** stored in "output"
michael@0	854	** "input" the input data
michael@0	855	** "inputLen" the amount of input data
michael@0	856	*/
michael@0	857	extern SECStatus
michael@0	858	AES_Decrypt(AESContext *cx, unsigned char *output,
michael@0	859	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	860	const unsigned char *input, unsigned int inputLen);
michael@0	861
michael@0	862	/******************************************/
michael@0	863	/*
michael@0	864	** AES key wrap algorithm, RFC 3394
michael@0	865	*/
michael@0	866
michael@0	867	/*
michael@0	868	** Create a new AES context suitable for AES encryption/decryption.
michael@0	869	** "key" raw key data
michael@0	870	** "iv" The 8 byte "initial value"
michael@0	871	** "encrypt", a boolean, true for key wrapping, false for unwrapping.
michael@0	872	** "keylen" the number of bytes of key data (16, 24, or 32)
michael@0	873	*/
michael@0	874	extern AESKeyWrapContext *
michael@0	875	AESKeyWrap_CreateContext(const unsigned char *key, const unsigned char *iv,
michael@0	876	int encrypt, unsigned int keylen);
michael@0	877	extern AESKeyWrapContext * AESKeyWrap_AllocateContext(void);
michael@0	878	extern SECStatus
michael@0	879	AESKeyWrap_InitContext(AESKeyWrapContext *cx,
michael@0	880	const unsigned char *key,
michael@0	881	unsigned int keylen,
michael@0	882	const unsigned char *iv,
michael@0	883	int ,
michael@0	884	unsigned int encrypt,
michael@0	885	unsigned int );
michael@0	886
michael@0	887	/*
michael@0	888	** Destroy a AES KeyWrap context.
michael@0	889	** "cx" the context
michael@0	890	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	891	*/
michael@0	892	extern void
michael@0	893	AESKeyWrap_DestroyContext(AESKeyWrapContext *cx, PRBool freeit);
michael@0	894
michael@0	895	/*
michael@0	896	** Perform AES key wrap.
michael@0	897	** "cx" the context
michael@0	898	** "output" the output buffer to store the encrypted data.
michael@0	899	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	900	** after some data is stored in output.
michael@0	901	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	902	** stored in "output"
michael@0	903	** "input" the input data
michael@0	904	** "inputLen" the amount of input data
michael@0	905	*/
michael@0	906	extern SECStatus
michael@0	907	AESKeyWrap_Encrypt(AESKeyWrapContext *cx, unsigned char *output,
michael@0	908	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	909	const unsigned char *input, unsigned int inputLen);
michael@0	910
michael@0	911	/*
michael@0	912	** Perform AES key unwrap.
michael@0	913	** "cx" the context
michael@0	914	** "output" the output buffer to store the decrypted data.
michael@0	915	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	916	** after some data is stored in output.
michael@0	917	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	918	** stored in "output"
michael@0	919	** "input" the input data
michael@0	920	** "inputLen" the amount of input data
michael@0	921	*/
michael@0	922	extern SECStatus
michael@0	923	AESKeyWrap_Decrypt(AESKeyWrapContext *cx, unsigned char *output,
michael@0	924	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	925	const unsigned char *input, unsigned int inputLen);
michael@0	926
michael@0	927	/******************************************/
michael@0	928	/*
michael@0	929	** Camellia symmetric block cypher
michael@0	930	*/
michael@0	931
michael@0	932	/*
michael@0	933	** Create a new Camellia context suitable for Camellia encryption/decryption.
michael@0	934	** "key" raw key data
michael@0	935	** "keylen" the number of bytes of key data (16, 24, or 32)
michael@0	936	*/
michael@0	937	extern CamelliaContext *
michael@0	938	Camellia_CreateContext(const unsigned char *key, const unsigned char *iv,
michael@0	939	int mode, int encrypt, unsigned int keylen);
michael@0	940
michael@0	941	extern CamelliaContext *Camellia_AllocateContext(void);
michael@0	942	extern SECStatus Camellia_InitContext(CamelliaContext *cx,
michael@0	943	const unsigned char *key,
michael@0	944	unsigned int keylen,
michael@0	945	const unsigned char *iv,
michael@0	946	int mode,
michael@0	947	unsigned int encrypt,
michael@0	948	unsigned int unused);
michael@0	949	/*
michael@0	950	** Destroy a Camellia encryption/decryption context.
michael@0	951	** "cx" the context
michael@0	952	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	953	*/
michael@0	954	extern void
michael@0	955	Camellia_DestroyContext(CamelliaContext *cx, PRBool freeit);
michael@0	956
michael@0	957	/*
michael@0	958	** Perform Camellia encryption.
michael@0	959	** "cx" the context
michael@0	960	** "output" the output buffer to store the encrypted data.
michael@0	961	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	962	** after some data is stored in output.
michael@0	963	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	964	** stored in "output"
michael@0	965	** "input" the input data
michael@0	966	** "inputLen" the amount of input data
michael@0	967	*/
michael@0	968	extern SECStatus
michael@0	969	Camellia_Encrypt(CamelliaContext *cx, unsigned char *output,
michael@0	970	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	971	const unsigned char *input, unsigned int inputLen);
michael@0	972
michael@0	973	/*
michael@0	974	** Perform Camellia decryption.
michael@0	975	** "cx" the context
michael@0	976	** "output" the output buffer to store the decrypted data.
michael@0	977	** "outputLen" how much data is stored in "output". Set by the routine
michael@0	978	** after some data is stored in output.
michael@0	979	** "maxOutputLen" the maximum amount of data that can ever be
michael@0	980	** stored in "output"
michael@0	981	** "input" the input data
michael@0	982	** "inputLen" the amount of input data
michael@0	983	*/
michael@0	984	extern SECStatus
michael@0	985	Camellia_Decrypt(CamelliaContext *cx, unsigned char *output,
michael@0	986	unsigned int *outputLen, unsigned int maxOutputLen,
michael@0	987	const unsigned char *input, unsigned int inputLen);
michael@0	988
michael@0	989
michael@0	990	/******************************************/
michael@0	991	/*
michael@0	992	** MD5 secure hash function
michael@0	993	*/
michael@0	994
michael@0	995	/*
michael@0	996	** Hash a null terminated string "src" into "dest" using MD5
michael@0	997	*/
michael@0	998	extern SECStatus MD5_Hash(unsigned char *dest, const char *src);
michael@0	999
michael@0	1000	/*
michael@0	1001	** Hash a non-null terminated string "src" into "dest" using MD5
michael@0	1002	*/
michael@0	1003	extern SECStatus MD5_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1004	PRUint32 src_length);
michael@0	1005
michael@0	1006	/*
michael@0	1007	** Create a new MD5 context
michael@0	1008	*/
michael@0	1009	extern MD5Context *MD5_NewContext(void);
michael@0	1010
michael@0	1011
michael@0	1012	/*
michael@0	1013	** Destroy an MD5 secure hash context.
michael@0	1014	** "cx" the context
michael@0	1015	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	1016	*/
michael@0	1017	extern void MD5_DestroyContext(MD5Context *cx, PRBool freeit);
michael@0	1018
michael@0	1019	/*
michael@0	1020	** Reset an MD5 context, preparing it for a fresh round of hashing
michael@0	1021	*/
michael@0	1022	extern void MD5_Begin(MD5Context *cx);
michael@0	1023
michael@0	1024	/*
michael@0	1025	** Update the MD5 hash function with more data.
michael@0	1026	** "cx" the context
michael@0	1027	** "input" the data to hash
michael@0	1028	** "inputLen" the amount of data to hash
michael@0	1029	*/
michael@0	1030	extern void MD5_Update(MD5Context *cx,
michael@0	1031	const unsigned char *input, unsigned int inputLen);
michael@0	1032
michael@0	1033	/*
michael@0	1034	** Finish the MD5 hash function. Produce the digested results in "digest"
michael@0	1035	** "cx" the context
michael@0	1036	** "digest" where the 16 bytes of digest data are stored
michael@0	1037	** "digestLen" where the digest length (16) is stored
michael@0	1038	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1039	** stored in "digest"
michael@0	1040	*/
michael@0	1041	extern void MD5_End(MD5Context *cx, unsigned char *digest,
michael@0	1042	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1043
michael@0	1044	/*
michael@0	1045	** Export the current state of the MD5 hash without appending the standard
michael@0	1046	** padding and length bytes. Produce the digested results in "digest"
michael@0	1047	** "cx" the context
michael@0	1048	** "digest" where the 16 bytes of digest data are stored
michael@0	1049	** "digestLen" where the digest length (16) is stored (optional)
michael@0	1050	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1051	** stored in "digest"
michael@0	1052	*/
michael@0	1053	extern void MD5_EndRaw(MD5Context *cx, unsigned char *digest,
michael@0	1054	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1055
michael@0	1056	/*
michael@0	1057	* Return the the size of a buffer needed to flatten the MD5 Context into
michael@0	1058	* "cx" the context
michael@0	1059	* returns size;
michael@0	1060	*/
michael@0	1061	extern unsigned int MD5_FlattenSize(MD5Context *cx);
michael@0	1062
michael@0	1063	/*
michael@0	1064	* Flatten the MD5 Context into a buffer:
michael@0	1065	* "cx" the context
michael@0	1066	* "space" the buffer to flatten to
michael@0	1067	* returns status;
michael@0	1068	*/
michael@0	1069	extern SECStatus MD5_Flatten(MD5Context *cx,unsigned char *space);
michael@0	1070
michael@0	1071	/*
michael@0	1072	* Resurrect a flattened context into a MD5 Context
michael@0	1073	* "space" the buffer of the flattend buffer
michael@0	1074	* "arg" ptr to void used by cryptographic resurrect
michael@0	1075	* returns resurected context;
michael@0	1076	*/
michael@0	1077	extern MD5Context * MD5_Resurrect(unsigned char *space, void *arg);
michael@0	1078	extern void MD5_Clone(MD5Context *dest, MD5Context *src);
michael@0	1079
michael@0	1080	/*
michael@0	1081	** trace the intermediate state info of the MD5 hash.
michael@0	1082	*/
michael@0	1083	extern void MD5_TraceState(MD5Context *cx);
michael@0	1084
michael@0	1085
michael@0	1086	/******************************************/
michael@0	1087	/*
michael@0	1088	** MD2 secure hash function
michael@0	1089	*/
michael@0	1090
michael@0	1091	/*
michael@0	1092	** Hash a null terminated string "src" into "dest" using MD2
michael@0	1093	*/
michael@0	1094	extern SECStatus MD2_Hash(unsigned char *dest, const char *src);
michael@0	1095
michael@0	1096	/*
michael@0	1097	** Create a new MD2 context
michael@0	1098	*/
michael@0	1099	extern MD2Context *MD2_NewContext(void);
michael@0	1100
michael@0	1101
michael@0	1102	/*
michael@0	1103	** Destroy an MD2 secure hash context.
michael@0	1104	** "cx" the context
michael@0	1105	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	1106	*/
michael@0	1107	extern void MD2_DestroyContext(MD2Context *cx, PRBool freeit);
michael@0	1108
michael@0	1109	/*
michael@0	1110	** Reset an MD2 context, preparing it for a fresh round of hashing
michael@0	1111	*/
michael@0	1112	extern void MD2_Begin(MD2Context *cx);
michael@0	1113
michael@0	1114	/*
michael@0	1115	** Update the MD2 hash function with more data.
michael@0	1116	** "cx" the context
michael@0	1117	** "input" the data to hash
michael@0	1118	** "inputLen" the amount of data to hash
michael@0	1119	*/
michael@0	1120	extern void MD2_Update(MD2Context *cx,
michael@0	1121	const unsigned char *input, unsigned int inputLen);
michael@0	1122
michael@0	1123	/*
michael@0	1124	** Finish the MD2 hash function. Produce the digested results in "digest"
michael@0	1125	** "cx" the context
michael@0	1126	** "digest" where the 16 bytes of digest data are stored
michael@0	1127	** "digestLen" where the digest length (16) is stored
michael@0	1128	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1129	** stored in "digest"
michael@0	1130	*/
michael@0	1131	extern void MD2_End(MD2Context *cx, unsigned char *digest,
michael@0	1132	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1133
michael@0	1134	/*
michael@0	1135	* Return the the size of a buffer needed to flatten the MD2 Context into
michael@0	1136	* "cx" the context
michael@0	1137	* returns size;
michael@0	1138	*/
michael@0	1139	extern unsigned int MD2_FlattenSize(MD2Context *cx);
michael@0	1140
michael@0	1141	/*
michael@0	1142	* Flatten the MD2 Context into a buffer:
michael@0	1143	* "cx" the context
michael@0	1144	* "space" the buffer to flatten to
michael@0	1145	* returns status;
michael@0	1146	*/
michael@0	1147	extern SECStatus MD2_Flatten(MD2Context *cx,unsigned char *space);
michael@0	1148
michael@0	1149	/*
michael@0	1150	* Resurrect a flattened context into a MD2 Context
michael@0	1151	* "space" the buffer of the flattend buffer
michael@0	1152	* "arg" ptr to void used by cryptographic resurrect
michael@0	1153	* returns resurected context;
michael@0	1154	*/
michael@0	1155	extern MD2Context * MD2_Resurrect(unsigned char *space, void *arg);
michael@0	1156	extern void MD2_Clone(MD2Context *dest, MD2Context *src);
michael@0	1157
michael@0	1158	/******************************************/
michael@0	1159	/*
michael@0	1160	** SHA-1 secure hash function
michael@0	1161	*/
michael@0	1162
michael@0	1163	/*
michael@0	1164	** Hash a null terminated string "src" into "dest" using SHA-1
michael@0	1165	*/
michael@0	1166	extern SECStatus SHA1_Hash(unsigned char *dest, const char *src);
michael@0	1167
michael@0	1168	/*
michael@0	1169	** Hash a non-null terminated string "src" into "dest" using SHA-1
michael@0	1170	*/
michael@0	1171	extern SECStatus SHA1_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1172	PRUint32 src_length);
michael@0	1173
michael@0	1174	/*
michael@0	1175	** Create a new SHA-1 context
michael@0	1176	*/
michael@0	1177	extern SHA1Context *SHA1_NewContext(void);
michael@0	1178
michael@0	1179
michael@0	1180	/*
michael@0	1181	** Destroy a SHA-1 secure hash context.
michael@0	1182	** "cx" the context
michael@0	1183	** "freeit" if PR_TRUE then free the object as well as its sub-objects
michael@0	1184	*/
michael@0	1185	extern void SHA1_DestroyContext(SHA1Context *cx, PRBool freeit);
michael@0	1186
michael@0	1187	/*
michael@0	1188	** Reset a SHA-1 context, preparing it for a fresh round of hashing
michael@0	1189	*/
michael@0	1190	extern void SHA1_Begin(SHA1Context *cx);
michael@0	1191
michael@0	1192	/*
michael@0	1193	** Update the SHA-1 hash function with more data.
michael@0	1194	** "cx" the context
michael@0	1195	** "input" the data to hash
michael@0	1196	** "inputLen" the amount of data to hash
michael@0	1197	*/
michael@0	1198	extern void SHA1_Update(SHA1Context *cx, const unsigned char *input,
michael@0	1199	unsigned int inputLen);
michael@0	1200
michael@0	1201	/*
michael@0	1202	** Finish the SHA-1 hash function. Produce the digested results in "digest"
michael@0	1203	** "cx" the context
michael@0	1204	** "digest" where the 16 bytes of digest data are stored
michael@0	1205	** "digestLen" where the digest length (20) is stored
michael@0	1206	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1207	** stored in "digest"
michael@0	1208	*/
michael@0	1209	extern void SHA1_End(SHA1Context *cx, unsigned char *digest,
michael@0	1210	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1211
michael@0	1212	/*
michael@0	1213	** Export the current state of the SHA-1 hash without appending the standard
michael@0	1214	** padding and length bytes. Produce the digested results in "digest"
michael@0	1215	** "cx" the context
michael@0	1216	** "digest" where the 20 bytes of digest data are stored
michael@0	1217	** "digestLen" where the digest length (20) is stored (optional)
michael@0	1218	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1219	** stored in "digest"
michael@0	1220	*/
michael@0	1221	extern void SHA1_EndRaw(SHA1Context *cx, unsigned char *digest,
michael@0	1222	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1223
michael@0	1224	/*
michael@0	1225	** trace the intermediate state info of the SHA1 hash.
michael@0	1226	*/
michael@0	1227	extern void SHA1_TraceState(SHA1Context *cx);
michael@0	1228
michael@0	1229	/*
michael@0	1230	* Return the the size of a buffer needed to flatten the SHA-1 Context into
michael@0	1231	* "cx" the context
michael@0	1232	* returns size;
michael@0	1233	*/
michael@0	1234	extern unsigned int SHA1_FlattenSize(SHA1Context *cx);
michael@0	1235
michael@0	1236	/*
michael@0	1237	* Flatten the SHA-1 Context into a buffer:
michael@0	1238	* "cx" the context
michael@0	1239	* "space" the buffer to flatten to
michael@0	1240	* returns status;
michael@0	1241	*/
michael@0	1242	extern SECStatus SHA1_Flatten(SHA1Context *cx,unsigned char *space);
michael@0	1243
michael@0	1244	/*
michael@0	1245	* Resurrect a flattened context into a SHA-1 Context
michael@0	1246	* "space" the buffer of the flattend buffer
michael@0	1247	* "arg" ptr to void used by cryptographic resurrect
michael@0	1248	* returns resurected context;
michael@0	1249	*/
michael@0	1250	extern SHA1Context * SHA1_Resurrect(unsigned char *space, void *arg);
michael@0	1251	extern void SHA1_Clone(SHA1Context *dest, SHA1Context *src);
michael@0	1252
michael@0	1253	/******************************************/
michael@0	1254
michael@0	1255	extern SHA224Context *SHA224_NewContext(void);
michael@0	1256	extern void SHA224_DestroyContext(SHA224Context *cx, PRBool freeit);
michael@0	1257	extern void SHA224_Begin(SHA224Context *cx);
michael@0	1258	extern void SHA224_Update(SHA224Context *cx, const unsigned char *input,
michael@0	1259	unsigned int inputLen);
michael@0	1260	extern void SHA224_End(SHA224Context *cx, unsigned char *digest,
michael@0	1261	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1262	/*
michael@0	1263	** Export the current state of the SHA-224 hash without appending the standard
michael@0	1264	** padding and length bytes. Produce the digested results in "digest"
michael@0	1265	** "cx" the context
michael@0	1266	** "digest" where the 28 bytes of digest data are stored
michael@0	1267	** "digestLen" where the digest length (28) is stored (optional)
michael@0	1268	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1269	** stored in "digest"
michael@0	1270	*/
michael@0	1271	extern void SHA224_EndRaw(SHA224Context *cx, unsigned char *digest,
michael@0	1272	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1273	extern SECStatus SHA224_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1274	PRUint32 src_length);
michael@0	1275	extern SECStatus SHA224_Hash(unsigned char *dest, const char *src);
michael@0	1276	extern void SHA224_TraceState(SHA224Context *cx);
michael@0	1277	extern unsigned int SHA224_FlattenSize(SHA224Context *cx);
michael@0	1278	extern SECStatus SHA224_Flatten(SHA224Context *cx,unsigned char *space);
michael@0	1279	extern SHA224Context * SHA224_Resurrect(unsigned char *space, void *arg);
michael@0	1280	extern void SHA224_Clone(SHA224Context *dest, SHA224Context *src);
michael@0	1281
michael@0	1282	/******************************************/
michael@0	1283
michael@0	1284	extern SHA256Context *SHA256_NewContext(void);
michael@0	1285	extern void SHA256_DestroyContext(SHA256Context *cx, PRBool freeit);
michael@0	1286	extern void SHA256_Begin(SHA256Context *cx);
michael@0	1287	extern void SHA256_Update(SHA256Context *cx, const unsigned char *input,
michael@0	1288	unsigned int inputLen);
michael@0	1289	extern void SHA256_End(SHA256Context *cx, unsigned char *digest,
michael@0	1290	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1291	/*
michael@0	1292	** Export the current state of the SHA-256 hash without appending the standard
michael@0	1293	** padding and length bytes. Produce the digested results in "digest"
michael@0	1294	** "cx" the context
michael@0	1295	** "digest" where the 32 bytes of digest data are stored
michael@0	1296	** "digestLen" where the digest length (32) is stored (optional)
michael@0	1297	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1298	** stored in "digest"
michael@0	1299	*/
michael@0	1300	extern void SHA256_EndRaw(SHA256Context *cx, unsigned char *digest,
michael@0	1301	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1302	extern SECStatus SHA256_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1303	PRUint32 src_length);
michael@0	1304	extern SECStatus SHA256_Hash(unsigned char *dest, const char *src);
michael@0	1305	extern void SHA256_TraceState(SHA256Context *cx);
michael@0	1306	extern unsigned int SHA256_FlattenSize(SHA256Context *cx);
michael@0	1307	extern SECStatus SHA256_Flatten(SHA256Context *cx,unsigned char *space);
michael@0	1308	extern SHA256Context * SHA256_Resurrect(unsigned char *space, void *arg);
michael@0	1309	extern void SHA256_Clone(SHA256Context *dest, SHA256Context *src);
michael@0	1310
michael@0	1311	/******************************************/
michael@0	1312
michael@0	1313	extern SHA512Context *SHA512_NewContext(void);
michael@0	1314	extern void SHA512_DestroyContext(SHA512Context *cx, PRBool freeit);
michael@0	1315	extern void SHA512_Begin(SHA512Context *cx);
michael@0	1316	extern void SHA512_Update(SHA512Context *cx, const unsigned char *input,
michael@0	1317	unsigned int inputLen);
michael@0	1318	/*
michael@0	1319	** Export the current state of the SHA-512 hash without appending the standard
michael@0	1320	** padding and length bytes. Produce the digested results in "digest"
michael@0	1321	** "cx" the context
michael@0	1322	** "digest" where the 64 bytes of digest data are stored
michael@0	1323	** "digestLen" where the digest length (64) is stored (optional)
michael@0	1324	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1325	** stored in "digest"
michael@0	1326	*/
michael@0	1327	extern void SHA512_EndRaw(SHA512Context *cx, unsigned char *digest,
michael@0	1328	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1329	extern void SHA512_End(SHA512Context *cx, unsigned char *digest,
michael@0	1330	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1331	extern SECStatus SHA512_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1332	PRUint32 src_length);
michael@0	1333	extern SECStatus SHA512_Hash(unsigned char *dest, const char *src);
michael@0	1334	extern void SHA512_TraceState(SHA512Context *cx);
michael@0	1335	extern unsigned int SHA512_FlattenSize(SHA512Context *cx);
michael@0	1336	extern SECStatus SHA512_Flatten(SHA512Context *cx,unsigned char *space);
michael@0	1337	extern SHA512Context * SHA512_Resurrect(unsigned char *space, void *arg);
michael@0	1338	extern void SHA512_Clone(SHA512Context *dest, SHA512Context *src);
michael@0	1339
michael@0	1340	/******************************************/
michael@0	1341
michael@0	1342	extern SHA384Context *SHA384_NewContext(void);
michael@0	1343	extern void SHA384_DestroyContext(SHA384Context *cx, PRBool freeit);
michael@0	1344	extern void SHA384_Begin(SHA384Context *cx);
michael@0	1345	extern void SHA384_Update(SHA384Context *cx, const unsigned char *input,
michael@0	1346	unsigned int inputLen);
michael@0	1347	extern void SHA384_End(SHA384Context *cx, unsigned char *digest,
michael@0	1348	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1349	/*
michael@0	1350	** Export the current state of the SHA-384 hash without appending the standard
michael@0	1351	** padding and length bytes. Produce the digested results in "digest"
michael@0	1352	** "cx" the context
michael@0	1353	** "digest" where the 48 bytes of digest data are stored
michael@0	1354	** "digestLen" where the digest length (48) is stored (optional)
michael@0	1355	** "maxDigestLen" the maximum amount of data that can ever be
michael@0	1356	** stored in "digest"
michael@0	1357	*/
michael@0	1358	extern void SHA384_EndRaw(SHA384Context *cx, unsigned char *digest,
michael@0	1359	unsigned int *digestLen, unsigned int maxDigestLen);
michael@0	1360	extern SECStatus SHA384_HashBuf(unsigned char *dest, const unsigned char *src,
michael@0	1361	PRUint32 src_length);
michael@0	1362	extern SECStatus SHA384_Hash(unsigned char *dest, const char *src);
michael@0	1363	extern void SHA384_TraceState(SHA384Context *cx);
michael@0	1364	extern unsigned int SHA384_FlattenSize(SHA384Context *cx);
michael@0	1365	extern SECStatus SHA384_Flatten(SHA384Context *cx,unsigned char *space);
michael@0	1366	extern SHA384Context * SHA384_Resurrect(unsigned char *space, void *arg);
michael@0	1367	extern void SHA384_Clone(SHA384Context *dest, SHA384Context *src);
michael@0	1368
michael@0	1369	/****************************************
michael@0	1370	* implement TLS 1.0 Pseudo Random Function (PRF) and TLS P_hash function
michael@0	1371	*/
michael@0	1372
michael@0	1373	extern SECStatus
michael@0	1374	TLS_PRF(const SECItem *secret, const char *label, SECItem *seed,
michael@0	1375	SECItem *result, PRBool isFIPS);
michael@0	1376
michael@0	1377	extern SECStatus
michael@0	1378	TLS_P_hash(HASH_HashType hashAlg, const SECItem *secret, const char *label,
michael@0	1379	SECItem *seed, SECItem *result, PRBool isFIPS);
michael@0	1380
michael@0	1381	/******************************************/
michael@0	1382	/*
michael@0	1383	** Pseudo Random Number Generation. FIPS compliance desirable.
michael@0	1384	*/
michael@0	1385
michael@0	1386	/*
michael@0	1387	** Initialize the global RNG context and give it some seed input taken
michael@0	1388	** from the system. This function is thread-safe and will only allow
michael@0	1389	** the global context to be initialized once. The seed input is likely
michael@0	1390	** small, so it is imperative that RNG_RandomUpdate() be called with
michael@0	1391	** additional seed data before the generator is used. A good way to
michael@0	1392	** provide the generator with additional entropy is to call
michael@0	1393	** RNG_SystemInfoForRNG(). Note that NSS_Init() does exactly that.
michael@0	1394	*/
michael@0	1395	extern SECStatus RNG_RNGInit(void);
michael@0	1396
michael@0	1397	/*
michael@0	1398	** Update the global random number generator with more seeding
michael@0	1399	** material
michael@0	1400	*/
michael@0	1401	extern SECStatus RNG_RandomUpdate(const void *data, size_t bytes);
michael@0	1402
michael@0	1403	/*
michael@0	1404	** Generate some random bytes, using the global random number generator
michael@0	1405	** object.
michael@0	1406	*/
michael@0	1407	extern SECStatus RNG_GenerateGlobalRandomBytes(void *dest, size_t len);
michael@0	1408
michael@0	1409	/* Destroy the global RNG context. After a call to RNG_RNGShutdown()
michael@0	1410	** a call to RNG_RNGInit() is required in order to use the generator again,
michael@0	1411	** along with seed data (see the comment above RNG_RNGInit()).
michael@0	1412	*/
michael@0	1413	extern void RNG_RNGShutdown(void);
michael@0	1414
michael@0	1415	extern void RNG_SystemInfoForRNG(void);
michael@0	1416
michael@0	1417	/*
michael@0	1418	* FIPS 186-2 Change Notice 1 RNG Algorithm 1, used both to
michael@0	1419	* generate the DSA X parameter and as a generic purpose RNG.
michael@0	1420	*
michael@0	1421	* The following two FIPS186Change functions are needed for
michael@0	1422	* NIST RNG Validation System.
michael@0	1423	*/
michael@0	1424
michael@0	1425	/*
michael@0	1426	* FIPS186Change_GenerateX is now deprecated. It will return SECFailure with
michael@0	1427	* the error set to PR_NOT_IMPLEMENTED_ERROR.
michael@0	1428	*/
michael@0	1429	extern SECStatus
michael@0	1430	FIPS186Change_GenerateX(unsigned char *XKEY,
michael@0	1431	const unsigned char *XSEEDj,
michael@0	1432	unsigned char *x_j);
michael@0	1433
michael@0	1434	/*
michael@0	1435	* When generating the DSA X parameter, we generate 2*GSIZE bytes
michael@0	1436	* of random output and reduce it mod q.
michael@0	1437	*
michael@0	1438	* Input: w, 2*GSIZE bytes
michael@0	1439	* q, DSA_SUBPRIME_LEN bytes
michael@0	1440	* Output: xj, DSA_SUBPRIME_LEN bytes
michael@0	1441	*/
michael@0	1442	extern SECStatus
michael@0	1443	FIPS186Change_ReduceModQForDSA(const unsigned char *w,
michael@0	1444	const unsigned char *q,
michael@0	1445	unsigned char *xj);
michael@0	1446
michael@0	1447	/*
michael@0	1448	* The following functions are for FIPS poweron self test and FIPS algorithm
michael@0	1449	* testing.
michael@0	1450	*/
michael@0	1451	extern SECStatus
michael@0	1452	PRNGTEST_Instantiate(const PRUint8 *entropy, unsigned int entropy_len,
michael@0	1453	const PRUint8 *nonce, unsigned int nonce_len,
michael@0	1454	const PRUint8 *personal_string, unsigned int ps_len);
michael@0	1455
michael@0	1456	extern SECStatus
michael@0	1457	PRNGTEST_Reseed(const PRUint8 *entropy, unsigned int entropy_len,
michael@0	1458	const PRUint8 *additional, unsigned int additional_len);
michael@0	1459
michael@0	1460	extern SECStatus
michael@0	1461	PRNGTEST_Generate(PRUint8 *bytes, unsigned int bytes_len,
michael@0	1462	const PRUint8 *additional, unsigned int additional_len);
michael@0	1463
michael@0	1464	extern SECStatus
michael@0	1465	PRNGTEST_Uninstantiate(void);
michael@0	1466
michael@0	1467	extern SECStatus
michael@0	1468	PRNGTEST_RunHealthTests(void);
michael@0	1469
michael@0	1470	/* Generate PQGParams and PQGVerify structs.
michael@0	1471	* Length of seed and length of h both equal length of P.
michael@0	1472	* All lengths are specified by "j", according to the table above.
michael@0	1473	*
michael@0	1474	* The verify parameters will conform to FIPS186-1.
michael@0	1475	*/
michael@0	1476	extern SECStatus
michael@0	1477	PQG_ParamGen(unsigned int j, /* input : determines length of P. */
michael@0	1478	PQGParams **pParams, /* output: P Q and G returned here */
michael@0	1479	PQGVerify **pVfy); /* output: counter and seed. */
michael@0	1480
michael@0	1481	/* Generate PQGParams and PQGVerify structs.
michael@0	1482	* Length of P specified by j. Length of h will match length of P.
michael@0	1483	* Length of SEED in bytes specified in seedBytes.
michael@0	1484	* seedBbytes must be in the range [20..255] or an error will result.
michael@0	1485	*
michael@0	1486	* The verify parameters will conform to FIPS186-1.
michael@0	1487	*/
michael@0	1488	extern SECStatus
michael@0	1489	PQG_ParamGenSeedLen(
michael@0	1490	unsigned int j, /* input : determines length of P. */
michael@0	1491	unsigned int seedBytes, /* input : length of seed in bytes.*/
michael@0	1492	PQGParams **pParams, /* output: P Q and G returned here */
michael@0	1493	PQGVerify **pVfy); /* output: counter and seed. */
michael@0	1494
michael@0	1495	/* Generate PQGParams and PQGVerify structs.
michael@0	1496	* Length of P specified by L in bits.
michael@0	1497	* Length of Q specified by N in bits.
michael@0	1498	* Length of SEED in bytes specified in seedBytes.
michael@0	1499	* seedBbytes must be in the range [N..L*2] or an error will result.
michael@0	1500	*
michael@0	1501	* Not that J uses the above table, L is the length exact. L and N must
michael@0	1502	* match the table below or an error will result:
michael@0	1503	*
michael@0	1504	* L N
michael@0	1505	* 1024 160
michael@0	1506	* 2048 224
michael@0	1507	* 2048 256
michael@0	1508	* 3072 256
michael@0	1509	*
michael@0	1510	* If N or seedBytes are set to zero, then PQG_ParamGenSeedLen will
michael@0	1511	* pick a default value (typically the smallest secure value for these
michael@0	1512	* variables).
michael@0	1513	*
michael@0	1514	* The verify parameters will conform to FIPS186-3 using the smallest
michael@0	1515	* permissible hash for the key strength.
michael@0	1516	*/
michael@0	1517	extern SECStatus
michael@0	1518	PQG_ParamGenV2(
michael@0	1519	unsigned int L, /* input : determines length of P. */
michael@0	1520	unsigned int N, /* input : determines length of Q. */
michael@0	1521	unsigned int seedBytes, /* input : length of seed in bytes.*/
michael@0	1522	PQGParams **pParams, /* output: P Q and G returned here */
michael@0	1523	PQGVerify **pVfy); /* output: counter and seed. */
michael@0	1524
michael@0	1525
michael@0	1526	/* Test PQGParams for validity as DSS PQG values.
michael@0	1527	* If vfy is non-NULL, test PQGParams to make sure they were generated
michael@0	1528	* using the specified seed, counter, and h values.
michael@0	1529	*
michael@0	1530	* Return value indicates whether Verification operation ran successfully
michael@0	1531	* to completion, but does not indicate if PQGParams are valid or not.
michael@0	1532	* If return value is SECSuccess, then *pResult has these meanings:
michael@0	1533	* SECSuccess: PQGParams are valid.
michael@0	1534	* SECFailure: PQGParams are invalid.
michael@0	1535	*
michael@0	1536	* Verify the PQG againts the counter, SEED and h.
michael@0	1537	* These tests are specified in FIPS 186-3 Appendix A.1.1.1, A.1.1.3, and A.2.2
michael@0	1538	* PQG_VerifyParams will automatically choose the appropriate test.
michael@0	1539	*/
michael@0	1540
michael@0	1541	extern SECStatus PQG_VerifyParams(const PQGParams *params,
michael@0	1542	const PQGVerify *vfy, SECStatus *result);
michael@0	1543
michael@0	1544	extern void PQG_DestroyParams(PQGParams *params);
michael@0	1545
michael@0	1546	extern void PQG_DestroyVerify(PQGVerify *vfy);
michael@0	1547
michael@0	1548
michael@0	1549	/*
michael@0	1550	* clean-up any global tables freebl may have allocated after it starts up.
michael@0	1551	* This function is not thread safe and should be called only after the
michael@0	1552	* library has been quiessed.
michael@0	1553	*/
michael@0	1554	extern void BL_Cleanup(void);
michael@0	1555
michael@0	1556	/* unload freebl shared library from memory */
michael@0	1557	extern void BL_Unload(void);
michael@0	1558
michael@0	1559	/**************************************************************************
michael@0	1560	* Verify a given Shared library signature *
michael@0	1561	**************************************************************************/
michael@0	1562	PRBool BLAPI_SHVerify(const char *name, PRFuncPtr addr);
michael@0	1563
michael@0	1564	/**************************************************************************
michael@0	1565	* Verify a given filename's signature *
michael@0	1566	**************************************************************************/
michael@0	1567	PRBool BLAPI_SHVerifyFile(const char *shName);
michael@0	1568
michael@0	1569	/**************************************************************************
michael@0	1570	* Verify Are Own Shared library signature *
michael@0	1571	**************************************************************************/
michael@0	1572	PRBool BLAPI_VerifySelf(const char *name);
michael@0	1573
michael@0	1574	/*********************************************************************/
michael@0	1575	extern const SECHashObject * HASH_GetRawHashObject(HASH_HashType hashType);
michael@0	1576
michael@0	1577	extern void BL_SetForkState(PRBool forked);
michael@0	1578
michael@0	1579	#ifndef NSS_DISABLE_ECC
michael@0	1580	/*
michael@0	1581	** pepare an ECParam structure from DEREncoded params
michael@0	1582	*/
michael@0	1583	extern SECStatus EC_FillParams(PLArenaPool *arena,
michael@0	1584	const SECItem *encodedParams, ECParams *params);
michael@0	1585	extern SECStatus EC_DecodeParams(const SECItem *encodedParams,
michael@0	1586	ECParams **ecparams);
michael@0	1587	extern SECStatus EC_CopyParams(PLArenaPool *arena, ECParams *dstParams,
michael@0	1588	const ECParams *srcParams);
michael@0	1589	#endif
michael@0	1590
michael@0	1591	SEC_END_PROTOS
michael@0	1592
michael@0	1593	#endif /* _BLAPI_H_ */