The Tor Browser / annotate

security/nss/lib/pk11wrap/pk11pub.h@b8a032363ba2 (annotated)

security/nss/lib/pk11wrap/pk11pub.h

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4 #ifndef _PK11PUB_H_
michael@0 5 #define _PK11PUB_H_
michael@0 6 #include "plarena.h"
michael@0 7 #include "seccomon.h"
michael@0 8 #include "secoidt.h"
michael@0 9 #include "secdert.h"
michael@0 10 #include "keyt.h"
michael@0 11 #include "certt.h"
michael@0 12 #include "pkcs11t.h"
michael@0 13 #include "secmodt.h"
michael@0 14 #include "seccomon.h"
michael@0 15 #include "pkcs7t.h"
michael@0 16 #include "cmsreclist.h"
michael@0 17
michael@0 18 /*
michael@0 19 * Exported PK11 wrap functions.
michael@0 20 */
michael@0 21
michael@0 22 SEC_BEGIN_PROTOS
michael@0 23
michael@0 24 /************************************************************
michael@0 25 * Generic Slot Lists Management
michael@0 26 ************************************************************/
michael@0 27 void PK11_FreeSlotList(PK11SlotList *list);
michael@0 28 SECStatus PK11_FreeSlotListElement(PK11SlotList *list, PK11SlotListElement *le);
michael@0 29 PK11SlotListElement * PK11_GetFirstSafe(PK11SlotList *list);
michael@0 30 PK11SlotListElement *PK11_GetNextSafe(PK11SlotList *list,
michael@0 31 PK11SlotListElement *le, PRBool restart);
michael@0 32
michael@0 33 /************************************************************
michael@0 34 * Generic Slot Management
michael@0 35 ************************************************************/
michael@0 36 PK11SlotInfo *PK11_ReferenceSlot(PK11SlotInfo *slot);
michael@0 37 void PK11_FreeSlot(PK11SlotInfo *slot);
michael@0 38 SECStatus PK11_DestroyObject(PK11SlotInfo *slot,CK_OBJECT_HANDLE object);
michael@0 39 SECStatus PK11_DestroyTokenObject(PK11SlotInfo *slot,CK_OBJECT_HANDLE object);
michael@0 40 PK11SlotInfo *PK11_GetInternalKeySlot(void);
michael@0 41 PK11SlotInfo *PK11_GetInternalSlot(void);
michael@0 42 SECStatus PK11_Logout(PK11SlotInfo *slot);
michael@0 43 void PK11_LogoutAll(void);
michael@0 44
michael@0 45
michael@0 46 /************************************************************
michael@0 47 * Slot Password Management
michael@0 48 ************************************************************/
michael@0 49 void PK11_SetSlotPWValues(PK11SlotInfo *slot,int askpw, int timeout);
michael@0 50 void PK11_GetSlotPWValues(PK11SlotInfo *slot,int *askpw, int *timeout);
michael@0 51 SECStatus PK11_CheckSSOPassword(PK11SlotInfo *slot, char *ssopw);
michael@0 52 SECStatus PK11_CheckUserPassword(PK11SlotInfo *slot, const char *pw);
michael@0 53 PRBool PK11_IsLoggedIn(PK11SlotInfo *slot, void *wincx);
michael@0 54 SECStatus PK11_InitPin(PK11SlotInfo *slot,const char *ssopw,
michael@0 55 const char *pk11_userpwd);
michael@0 56 SECStatus PK11_ChangePW(PK11SlotInfo *slot, const char *oldpw,
michael@0 57 const char *newpw);
michael@0 58 void PK11_SetPasswordFunc(PK11PasswordFunc func);
michael@0 59 int PK11_GetMinimumPwdLength(PK11SlotInfo *slot);
michael@0 60 SECStatus PK11_ResetToken(PK11SlotInfo *slot, char *sso_pwd);
michael@0 61 SECStatus PK11_Authenticate(PK11SlotInfo *slot, PRBool loadCerts, void *wincx);
michael@0 62 SECStatus PK11_TokenRefresh(PK11SlotInfo *slot);
michael@0 63
michael@0 64
michael@0 65 /******************************************************************
michael@0 66 * Slot info functions
michael@0 67 ******************************************************************/
michael@0 68 PK11SlotInfo *PK11_FindSlotByName(const char *name);
michael@0 69 /******************************************************************
michael@0 70 * PK11_FindSlotsByNames searches for a PK11SlotInfo using one or
michael@0 71 * more criteria : dllName, slotName and tokenName . In addition, if
michael@0 72 * presentOnly is set , only slots with a token inserted will be
michael@0 73 * returned.
michael@0 74 ******************************************************************/
michael@0 75 PK11SlotList *PK11_FindSlotsByNames(const char *dllName,
michael@0 76 const char* slotName, const char* tokenName, PRBool presentOnly);
michael@0 77 PRBool PK11_IsReadOnly(PK11SlotInfo *slot);
michael@0 78 PRBool PK11_IsInternal(PK11SlotInfo *slot);
michael@0 79 PRBool PK11_IsInternalKeySlot(PK11SlotInfo *slot);
michael@0 80 char * PK11_GetTokenName(PK11SlotInfo *slot);
michael@0 81 char * PK11_GetSlotName(PK11SlotInfo *slot);
michael@0 82 PRBool PK11_NeedLogin(PK11SlotInfo *slot);
michael@0 83 PRBool PK11_IsFriendly(PK11SlotInfo *slot);
michael@0 84 PRBool PK11_IsHW(PK11SlotInfo *slot);
michael@0 85 PRBool PK11_IsRemovable(PK11SlotInfo *slot);
michael@0 86 PRBool PK11_NeedUserInit(PK11SlotInfo *slot);
michael@0 87 PRBool PK11_ProtectedAuthenticationPath(PK11SlotInfo *slot);
michael@0 88 int PK11_GetSlotSeries(PK11SlotInfo *slot);
michael@0 89 int PK11_GetCurrentWrapIndex(PK11SlotInfo *slot);
michael@0 90 unsigned long PK11_GetDefaultFlags(PK11SlotInfo *slot);
michael@0 91 CK_SLOT_ID PK11_GetSlotID(PK11SlotInfo *slot);
michael@0 92 SECMODModuleID PK11_GetModuleID(PK11SlotInfo *slot);
michael@0 93 SECStatus PK11_GetSlotInfo(PK11SlotInfo *slot, CK_SLOT_INFO *info);
michael@0 94 SECStatus PK11_GetTokenInfo(PK11SlotInfo *slot, CK_TOKEN_INFO *info);
michael@0 95 PRBool PK11_IsDisabled(PK11SlotInfo *slot);
michael@0 96 PRBool PK11_HasRootCerts(PK11SlotInfo *slot);
michael@0 97 PK11DisableReasons PK11_GetDisabledReason(PK11SlotInfo *slot);
michael@0 98 /* Prevents the slot from being used, and set disable reason to user-disable */
michael@0 99 /* NOTE: Mechanisms that were ON continue to stay ON */
michael@0 100 /* Therefore, when the slot is enabled, it will remember */
michael@0 101 /* what mechanisms needs to be turned on */
michael@0 102 PRBool PK11_UserDisableSlot(PK11SlotInfo *slot);
michael@0 103 /* Allow all mechanisms that are ON before UserDisableSlot() */
michael@0 104 /* was called to be available again */
michael@0 105 PRBool PK11_UserEnableSlot(PK11SlotInfo *slot);
michael@0 106 /*
michael@0 107 * wait for a specific slot event.
michael@0 108 * event is a specific event to wait for. Currently only
michael@0 109 * PK11TokenChangeOrRemovalEvent and PK11TokenPresentEvents are defined.
michael@0 110 * timeout can be an interval time to wait, PR_INTERVAL_NO_WAIT (meaning only
michael@0 111 * poll once), or PR_INTERVAL_NO_TIMEOUT (meaning block until a change).
michael@0 112 * pollInterval is a suggested pulling interval value. '0' means use the
michael@0 113 * default. Future implementations that don't poll may ignore this value.
michael@0 114 * series is the current series for the last slot. This should be the series
michael@0 115 * value for the slot the last time you read persistant information from the
michael@0 116 * slot. For instance, if you publish a cert from the slot, you should obtain
michael@0 117 * the slot series at that time. Then PK11_WaitForTokenEvent can detect a
michael@0 118 * a change in the slot between the time you publish and the time
michael@0 119 * PK11_WaitForTokenEvent is called, elliminating potential race conditions.
michael@0 120 *
michael@0 121 * The current status that is returned is:
michael@0 122 * PK11TokenNotRemovable - always returned for any non-removable token.
michael@0 123 * PK11TokenPresent - returned when the token is present and we are waiting
michael@0 124 * on a PK11TokenPresentEvent. Then next event to look for is a
michael@0 125 * PK11TokenChangeOrRemovalEvent.
michael@0 126 * PK11TokenChanged - returned when the old token has been removed and a new
michael@0 127 * token ad been inserted, and we are waiting for a
michael@0 128 * PK11TokenChangeOrRemovalEvent. The next event to look for is another
michael@0 129 * PK11TokenChangeOrRemovalEvent.
michael@0 130 * PK11TokenRemoved - returned when the token is not present and we are
michael@0 131 * waiting for a PK11TokenChangeOrRemovalEvent. The next event to look for
michael@0 132 * is a PK11TokenPresentEvent.
michael@0 133 */
michael@0 134 PK11TokenStatus PK11_WaitForTokenEvent(PK11SlotInfo *slot, PK11TokenEvent event,
michael@0 135 PRIntervalTime timeout, PRIntervalTime pollInterval, int series);
michael@0 136
michael@0 137 PRBool PK11_NeedPWInit(void);
michael@0 138 PRBool PK11_TokenExists(CK_MECHANISM_TYPE);
michael@0 139 SECStatus PK11_GetModInfo(SECMODModule *mod, CK_INFO *info);
michael@0 140 PRBool PK11_IsFIPS(void);
michael@0 141 SECMODModule *PK11_GetModule(PK11SlotInfo *slot);
michael@0 142
michael@0 143 /*********************************************************************
michael@0 144 * Slot mapping utility functions.
michael@0 145 *********************************************************************/
michael@0 146 PRBool PK11_IsPresent(PK11SlotInfo *slot);
michael@0 147 PRBool PK11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
michael@0 148 PK11SlotList * PK11_GetAllTokens(CK_MECHANISM_TYPE type,PRBool needRW,
michael@0 149 PRBool loadCerts, void *wincx);
michael@0 150 PK11SlotInfo *PK11_GetBestSlotMultipleWithAttributes(CK_MECHANISM_TYPE *type,
michael@0 151 CK_FLAGS *mechFlag, unsigned int *keySize,
michael@0 152 unsigned int count, void *wincx);
michael@0 153 PK11SlotInfo *PK11_GetBestSlotMultiple(CK_MECHANISM_TYPE *type,
michael@0 154 unsigned int count, void *wincx);
michael@0 155 PK11SlotInfo *PK11_GetBestSlot(CK_MECHANISM_TYPE type, void *wincx);
michael@0 156 PK11SlotInfo *PK11_GetBestSlotWithAttributes(CK_MECHANISM_TYPE type,
michael@0 157 CK_FLAGS mechFlag, unsigned int keySize, void *wincx);
michael@0 158 CK_MECHANISM_TYPE PK11_GetBestWrapMechanism(PK11SlotInfo *slot);
michael@0 159 int PK11_GetBestKeyLength(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
michael@0 160
michael@0 161 /*
michael@0 162 * Open a new database using the softoken. The caller is responsible for making
michael@0 163 * sure the module spec is correct and usable. The caller should ask for one
michael@0 164 * new database per call if the caller wants to get meaningful information
michael@0 165 * about the new database.
michael@0 166 *
michael@0 167 * moduleSpec is the same data that you would pass to softoken at
michael@0 168 * initialization time under the 'tokens' options. For example, if you were
michael@0 169 * to specify tokens=<0x4=[configdir='./mybackup' tokenDescription='Backup']>
michael@0 170 * You would specify "configdir='./mybackup' tokenDescription='Backup'" as your
michael@0 171 * module spec here. The slot ID will be calculated for you by
michael@0 172 * SECMOD_OpenUserDB().
michael@0 173 *
michael@0 174 * Typical parameters here are configdir, tokenDescription and flags.
michael@0 175 *
michael@0 176 * a Full list is below:
michael@0 177 *
michael@0 178 *
michael@0 179 * configDir - The location of the databases for this token. If configDir is
michael@0 180 * not specified, and noCertDB and noKeyDB is not specified, the load
michael@0 181 * will fail.
michael@0 182 * certPrefix - Cert prefix for this token.
michael@0 183 * keyPrefix - Prefix for the key database for this token. (if not specified,
michael@0 184 * certPrefix will be used).
michael@0 185 * tokenDescription - The label value for this token returned in the
michael@0 186 * CK_TOKEN_INFO structure with an internationalize string (UTF8).
michael@0 187 * This value will be truncated at 32 bytes (no NULL, partial UTF8
michael@0 188 * characters dropped). You should specify a user friendly name here
michael@0 189 * as this is the value the token will be referred to in most
michael@0 190 * application UI's. You should make sure tokenDescription is unique.
michael@0 191 * slotDescription - The slotDescription value for this token returned
michael@0 192 * in the CK_SLOT_INFO structure with an internationalize string
michael@0 193 * (UTF8). This value will be truncated at 64 bytes (no NULL, partial
michael@0 194 * UTF8 characters dropped). This name will not change after the
michael@0 195 * database is closed. It should have some number to make this unique.
michael@0 196 * minPWLen - minimum password length for this token.
michael@0 197 * flags - comma separated list of flag values, parsed case-insensitive.
michael@0 198 * Valid flags are:
michael@0 199 * readOnly - Databases should be opened read only.
michael@0 200 * noCertDB - Don't try to open a certificate database.
michael@0 201 * noKeyDB - Don't try to open a key database.
michael@0 202 * forceOpen - Don't fail to initialize the token if the
michael@0 203 * databases could not be opened.
michael@0 204 * passwordRequired - zero length passwords are not acceptable
michael@0 205 * (valid only if there is a keyDB).
michael@0 206 * optimizeSpace - allocate smaller hash tables and lock tables.
michael@0 207 * When this flag is not specified, Softoken will allocate
michael@0 208 * large tables to prevent lock contention.
michael@0 209 */
michael@0 210 PK11SlotInfo *SECMOD_OpenUserDB(const char *moduleSpec);
michael@0 211 SECStatus SECMOD_CloseUserDB(PK11SlotInfo *slot);
michael@0 212
michael@0 213 /*
michael@0 214 * This is exactly the same as OpenUserDB except it can be called on any
michael@0 215 * module that understands softoken style new slot entries. The resulting
michael@0 216 * slot can be closed using SECMOD_CloseUserDB above. Value of moduleSpec
michael@0 217 * is token specific.
michael@0 218 */
michael@0 219 PK11SlotInfo *SECMOD_OpenNewSlot(SECMODModule *mod, const char *moduleSpec);
michael@0 220
michael@0 221
michael@0 222 /*
michael@0 223 * merge the permanent objects from on token to another
michael@0 224 */
michael@0 225 SECStatus PK11_MergeTokens(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot,
michael@0 226 PK11MergeLog *log, void *targetPwArg, void *sourcePwArg);
michael@0 227
michael@0 228 /*
michael@0 229 * create and destroy merge logs needed by PK11_MergeTokens
michael@0 230 */
michael@0 231 PK11MergeLog * PK11_CreateMergeLog(void);
michael@0 232 void PK11_DestroyMergeLog(PK11MergeLog *log);
michael@0 233
michael@0 234
michael@0 235
michael@0 236 /*********************************************************************
michael@0 237 * Mechanism Mapping functions
michael@0 238 *********************************************************************/
michael@0 239 CK_KEY_TYPE PK11_GetKeyType(CK_MECHANISM_TYPE type,unsigned long len);
michael@0 240 CK_MECHANISM_TYPE PK11_GetKeyGen(CK_MECHANISM_TYPE type);
michael@0 241 int PK11_GetBlockSize(CK_MECHANISM_TYPE type,SECItem *params);
michael@0 242 int PK11_GetIVLength(CK_MECHANISM_TYPE type);
michael@0 243 SECItem *PK11_ParamFromIV(CK_MECHANISM_TYPE type,SECItem *iv);
michael@0 244 unsigned char *PK11_IVFromParam(CK_MECHANISM_TYPE type,SECItem *param,int *len);
michael@0 245 SECItem * PK11_BlockData(SECItem *data,unsigned long size);
michael@0 246
michael@0 247 /* PKCS #11 to DER mapping functions */
michael@0 248 SECItem *PK11_ParamFromAlgid(SECAlgorithmID *algid);
michael@0 249 SECItem *PK11_GenerateNewParam(CK_MECHANISM_TYPE, PK11SymKey *);
michael@0 250 CK_MECHANISM_TYPE PK11_AlgtagToMechanism(SECOidTag algTag);
michael@0 251 SECOidTag PK11_MechanismToAlgtag(CK_MECHANISM_TYPE type);
michael@0 252 SECOidTag PK11_FortezzaMapSig(SECOidTag algTag);
michael@0 253 SECStatus PK11_ParamToAlgid(SECOidTag algtag, SECItem *param,
michael@0 254 PLArenaPool *arena, SECAlgorithmID *algid);
michael@0 255 SECStatus PK11_SeedRandom(PK11SlotInfo *,unsigned char *data,int len);
michael@0 256 SECStatus PK11_GenerateRandomOnSlot(PK11SlotInfo *,unsigned char *data,int len);
michael@0 257 SECStatus PK11_RandomUpdate(void *data, size_t bytes);
michael@0 258 SECStatus PK11_GenerateRandom(unsigned char *data,int len);
michael@0 259
michael@0 260 /* warning: cannot work with pkcs 5 v2
michael@0 261 * use algorithm ID s instead of pkcs #11 mechanism pointers */
michael@0 262 CK_RV PK11_MapPBEMechanismToCryptoMechanism(CK_MECHANISM_PTR pPBEMechanism,
michael@0 263 CK_MECHANISM_PTR pCryptoMechanism,
michael@0 264 SECItem *pbe_pwd, PRBool bad3DES);
michael@0 265 CK_MECHANISM_TYPE PK11_GetPadMechanism(CK_MECHANISM_TYPE);
michael@0 266 CK_MECHANISM_TYPE PK11_MapSignKeyType(KeyType keyType);
michael@0 267
michael@0 268 /**********************************************************************
michael@0 269 * Symmetric, Public, and Private Keys
michael@0 270 **********************************************************************/
michael@0 271 void PK11_FreeSymKey(PK11SymKey *key);
michael@0 272 PK11SymKey *PK11_ReferenceSymKey(PK11SymKey *symKey);
michael@0 273 PK11SymKey *PK11_ImportSymKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
michael@0 274 PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key, void *wincx);
michael@0 275 PK11SymKey *PK11_ImportSymKeyWithFlags(PK11SlotInfo *slot,
michael@0 276 CK_MECHANISM_TYPE type, PK11Origin origin, CK_ATTRIBUTE_TYPE operation,
michael@0 277 SECItem *key, CK_FLAGS flags, PRBool isPerm, void *wincx);
michael@0 278 PK11SymKey *PK11_SymKeyFromHandle(PK11SlotInfo *slot, PK11SymKey *parent,
michael@0 279 PK11Origin origin, CK_MECHANISM_TYPE type, CK_OBJECT_HANDLE keyID,
michael@0 280 PRBool owner, void *wincx);
michael@0 281 PK11SymKey *PK11_GetWrapKey(PK11SlotInfo *slot, int wrap,
michael@0 282 CK_MECHANISM_TYPE type,int series, void *wincx);
michael@0 283 /*
michael@0 284 * This function is not thread-safe. It can only be called when only
michael@0 285 * one thread has a reference to wrapKey.
michael@0 286 */
michael@0 287 void PK11_SetWrapKey(PK11SlotInfo *slot, int wrap, PK11SymKey *wrapKey);
michael@0 288 CK_MECHANISM_TYPE PK11_GetMechanism(PK11SymKey *symKey);
michael@0 289 /*
michael@0 290 * import a public key into the desired slot
michael@0 291 *
michael@0 292 * This function takes a public key structure and creates a public key in a
michael@0 293 * given slot. If isToken is set, then a persistant public key is created.
michael@0 294 *
michael@0 295 * Note: it is possible for this function to return a handle for a key which
michael@0 296 * is persistant, even if isToken is not set.
michael@0 297 */
michael@0 298 CK_OBJECT_HANDLE PK11_ImportPublicKey(PK11SlotInfo *slot,
michael@0 299 SECKEYPublicKey *pubKey, PRBool isToken);
michael@0 300 PK11SymKey *PK11_KeyGen(PK11SlotInfo *slot,CK_MECHANISM_TYPE type,
michael@0 301 SECItem *param, int keySize,void *wincx);
michael@0 302 PK11SymKey *PK11_TokenKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
michael@0 303 SECItem *param, int keySize, SECItem *keyid,
michael@0 304 PRBool isToken, void *wincx);
michael@0 305 PK11SymKey *PK11_TokenKeyGenWithFlags(PK11SlotInfo *slot,
michael@0 306 CK_MECHANISM_TYPE type, SECItem *param,
michael@0 307 int keySize, SECItem *keyid, CK_FLAGS opFlags,
michael@0 308 PK11AttrFlags attrFlags, void *wincx);
michael@0 309 /* Generates a key using the exact template supplied by the caller. The other
michael@0 310 * PK11_[Token]KeyGen mechanisms should be used instead of this one whenever
michael@0 311 * they work because they include/exclude the CKA_VALUE_LEN template value
michael@0 312 * based on the mechanism type as required by many tokens.
michael@0 313 *
michael@0 314 * keyGenType should be PK11_GetKeyGenWithSize(type, <key size>) or it should
michael@0 315 * be equal to type if PK11_GetKeyGenWithSize cannot be used (e.g. because
michael@0 316 * pk11wrap does not know about the mechanisms).
michael@0 317 */
michael@0 318 PK11SymKey *PK11_KeyGenWithTemplate(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
michael@0 319 CK_MECHANISM_TYPE keyGenType,
michael@0 320 SECItem *param, CK_ATTRIBUTE * attrs,
michael@0 321 unsigned int attrsCount, void *wincx);
michael@0 322 PK11SymKey * PK11_ListFixedKeysInSlot(PK11SlotInfo *slot, char *nickname,
michael@0 323 void *wincx);
michael@0 324 PK11SymKey *PK11_GetNextSymKey(PK11SymKey *symKey);
michael@0 325 CK_KEY_TYPE PK11_GetSymKeyType(PK11SymKey *key);
michael@0 326 CK_OBJECT_HANDLE PK11_GetSymKeyHandle(PK11SymKey *symKey);
michael@0 327
michael@0 328
michael@0 329 /*
michael@0 330 * PK11_SetSymKeyUserData
michael@0 331 * sets generic user data on keys (usually a pointer to a data structure)
michael@0 332 * that can later be retrieved by PK11_GetSymKeyUserData().
michael@0 333 * symKey - key where data will be set.
michael@0 334 * data - data to be set.
michael@0 335 * freefunc - function used to free the data.
michael@0 336 * Setting user data on symKeys with existing user data already set will cause
michael@0 337 * the existing user data to be freed before the new user data is set.
michael@0 338 * Freeing user data is done by calling the user specified freefunc.
michael@0 339 * If freefunc is NULL, the user data is assumed to be global or static an
michael@0 340 * not freed. Passing NULL for user data to PK11_SetSymKeyUserData has the
michael@0 341 * effect of freeing any existing user data, and clearing the user data
michael@0 342 * pointer. If user data exists when the symKey is finally freed, that
michael@0 343 * data will be freed with freefunc.
michael@0 344 *
michael@0 345 * Applications should only use this function on keys which the application
michael@0 346 * has created directly, as there is only one user data value per key.
michael@0 347 */
michael@0 348 void PK11_SetSymKeyUserData(PK11SymKey *symKey, void *data,
michael@0 349 PK11FreeDataFunc freefunc);
michael@0 350 /* PK11_GetSymKeyUserData
michael@0 351 * retrieves generic user data which was set on a key by
michael@0 352 * PK11_SetSymKeyUserData.
michael@0 353 * symKey - key with data to be fetched
michael@0 354 *
michael@0 355 * If no data exists, or the data has been cleared, PK11_GetSymKeyUserData
michael@0 356 * will return NULL. Returned data is still owned and managed by the SymKey,
michael@0 357 * the caller should not free the data.
michael@0 358 *
michael@0 359 */
michael@0 360 void *PK11_GetSymKeyUserData(PK11SymKey *symKey);
michael@0 361
michael@0 362 SECStatus PK11_PubWrapSymKey(CK_MECHANISM_TYPE type, SECKEYPublicKey *pubKey,
michael@0 363 PK11SymKey *symKey, SECItem *wrappedKey);
michael@0 364 SECStatus PK11_WrapSymKey(CK_MECHANISM_TYPE type, SECItem *params,
michael@0 365 PK11SymKey *wrappingKey, PK11SymKey *symKey, SECItem *wrappedKey);
michael@0 366 /* move a key to 'slot' optionally set the key attributes according to either
michael@0 367 * operation or the flags and making the key permanent at the same time.
michael@0 368 * If the key is moved to the same slot, operation and flags values are
michael@0 369 * currently ignored */
michael@0 370 PK11SymKey *PK11_MoveSymKey(PK11SlotInfo *slot, CK_ATTRIBUTE_TYPE operation,
michael@0 371 CK_FLAGS flags, PRBool perm, PK11SymKey *symKey);
michael@0 372 /*
michael@0 373 * derive a new key from the base key.
michael@0 374 * PK11_Derive returns a key which can do exactly one operation, and is
michael@0 375 * ephemeral (session key).
michael@0 376 * PK11_DeriveWithFlags is the same as PK11_Derive, except you can use
michael@0 377 * CKF_ flags to enable more than one operation.
michael@0 378 * PK11_DeriveWithFlagsPerm is the same as PK11_DeriveWithFlags except you can
michael@0 379 * (optionally) make the key permanent (token key).
michael@0 380 */
michael@0 381 PK11SymKey *PK11_Derive(PK11SymKey *baseKey, CK_MECHANISM_TYPE mechanism,
michael@0 382 SECItem *param, CK_MECHANISM_TYPE target,
michael@0 383 CK_ATTRIBUTE_TYPE operation, int keySize);
michael@0 384 PK11SymKey *PK11_DeriveWithFlags( PK11SymKey *baseKey,
michael@0 385 CK_MECHANISM_TYPE derive, SECItem *param, CK_MECHANISM_TYPE target,
michael@0 386 CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags);
michael@0 387 PK11SymKey * PK11_DeriveWithFlagsPerm( PK11SymKey *baseKey,
michael@0 388 CK_MECHANISM_TYPE derive,
michael@0 389 SECItem *param, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation,
michael@0 390 int keySize, CK_FLAGS flags, PRBool isPerm);
michael@0 391 PK11SymKey *
michael@0 392 PK11_DeriveWithTemplate( PK11SymKey *baseKey, CK_MECHANISM_TYPE derive,
michael@0 393 SECItem *param, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation,
michael@0 394 int keySize, CK_ATTRIBUTE *userAttr, unsigned int numAttrs,
michael@0 395 PRBool isPerm);
michael@0 396
michael@0 397
michael@0 398 PK11SymKey *PK11_PubDerive( SECKEYPrivateKey *privKey,
michael@0 399 SECKEYPublicKey *pubKey, PRBool isSender, SECItem *randomA, SECItem *randomB,
michael@0 400 CK_MECHANISM_TYPE derive, CK_MECHANISM_TYPE target,
michael@0 401 CK_ATTRIBUTE_TYPE operation, int keySize,void *wincx) ;
michael@0 402 PK11SymKey *PK11_PubDeriveWithKDF( SECKEYPrivateKey *privKey,
michael@0 403 SECKEYPublicKey *pubKey, PRBool isSender, SECItem *randomA, SECItem *randomB,
michael@0 404 CK_MECHANISM_TYPE derive, CK_MECHANISM_TYPE target,
michael@0 405 CK_ATTRIBUTE_TYPE operation, int keySize,
michael@0 406 CK_ULONG kdf, SECItem *sharedData, void *wincx);
michael@0 407
michael@0 408 /*
michael@0 409 * unwrap a new key with a symetric key.
michael@0 410 * PK11_Unwrap returns a key which can do exactly one operation, and is
michael@0 411 * ephemeral (session key).
michael@0 412 * PK11_UnwrapWithFlags is the same as PK11_Unwrap, except you can use
michael@0 413 * CKF_ flags to enable more than one operation.
michael@0 414 * PK11_UnwrapWithFlagsPerm is the same as PK11_UnwrapWithFlags except you can
michael@0 415 * (optionally) make the key permanent (token key).
michael@0 416 */
michael@0 417 PK11SymKey *PK11_UnwrapSymKey(PK11SymKey *key,
michael@0 418 CK_MECHANISM_TYPE wraptype, SECItem *param, SECItem *wrapppedKey,
michael@0 419 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize);
michael@0 420 PK11SymKey *PK11_UnwrapSymKeyWithFlags(PK11SymKey *wrappingKey,
michael@0 421 CK_MECHANISM_TYPE wrapType, SECItem *param, SECItem *wrappedKey,
michael@0 422 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize,
michael@0 423 CK_FLAGS flags);
michael@0 424 PK11SymKey * PK11_UnwrapSymKeyWithFlagsPerm(PK11SymKey *wrappingKey,
michael@0 425 CK_MECHANISM_TYPE wrapType,
michael@0 426 SECItem *param, SECItem *wrappedKey,
michael@0 427 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation,
michael@0 428 int keySize, CK_FLAGS flags, PRBool isPerm);
michael@0 429
michael@0 430 /*
michael@0 431 * unwrap a new key with a private key.
michael@0 432 * PK11_PubUnwrap returns a key which can do exactly one operation, and is
michael@0 433 * ephemeral (session key).
michael@0 434 * PK11_PubUnwrapWithFlagsPerm is the same as PK11_PubUnwrap except you can
michael@0 435 * use * CKF_ flags to enable more than one operation, and optionally make
michael@0 436 * the key permanent (token key).
michael@0 437 */
michael@0 438 PK11SymKey *PK11_PubUnwrapSymKey(SECKEYPrivateKey *key, SECItem *wrapppedKey,
michael@0 439 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize);
michael@0 440 PK11SymKey * PK11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey,
michael@0 441 SECItem *wrappedKey, CK_MECHANISM_TYPE target,
michael@0 442 CK_ATTRIBUTE_TYPE operation, int keySize,
michael@0 443 CK_FLAGS flags, PRBool isPerm);
michael@0 444 PK11SymKey *PK11_FindFixedKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
michael@0 445 SECItem *keyID, void *wincx);
michael@0 446 SECStatus PK11_DeleteTokenPrivateKey(SECKEYPrivateKey *privKey,PRBool force);
michael@0 447 SECStatus PK11_DeleteTokenPublicKey(SECKEYPublicKey *pubKey);
michael@0 448 SECStatus PK11_DeleteTokenSymKey(PK11SymKey *symKey);
michael@0 449 SECStatus PK11_DeleteTokenCertAndKey(CERTCertificate *cert,void *wincx);
michael@0 450 SECKEYPrivateKey * PK11_LoadPrivKey(PK11SlotInfo *slot,
michael@0 451 SECKEYPrivateKey *privKey, SECKEYPublicKey *pubKey,
michael@0 452 PRBool token, PRBool sensitive);
michael@0 453 char * PK11_GetSymKeyNickname(PK11SymKey *symKey);
michael@0 454 char * PK11_GetPrivateKeyNickname(SECKEYPrivateKey *privKey);
michael@0 455 char * PK11_GetPublicKeyNickname(SECKEYPublicKey *pubKey);
michael@0 456 SECStatus PK11_SetSymKeyNickname(PK11SymKey *symKey, const char *nickname);
michael@0 457 SECStatus PK11_SetPrivateKeyNickname(SECKEYPrivateKey *privKey,
michael@0 458 const char *nickname);
michael@0 459 SECStatus PK11_SetPublicKeyNickname(SECKEYPublicKey *pubKey,
michael@0 460 const char *nickname);
michael@0 461
michael@0 462 /* size to hold key in bytes */
michael@0 463 unsigned int PK11_GetKeyLength(PK11SymKey *key);
michael@0 464 /* size of actual secret parts of key in bits */
michael@0 465 /* algid is because RC4 strength is determined by the effective bits as well
michael@0 466 * as the key bits */
michael@0 467 unsigned int PK11_GetKeyStrength(PK11SymKey *key,SECAlgorithmID *algid);
michael@0 468 SECStatus PK11_ExtractKeyValue(PK11SymKey *symKey);
michael@0 469 SECItem * PK11_GetKeyData(PK11SymKey *symKey);
michael@0 470 PK11SlotInfo * PK11_GetSlotFromKey(PK11SymKey *symKey);
michael@0 471 void *PK11_GetWindow(PK11SymKey *symKey);
michael@0 472
michael@0 473 /*
michael@0 474 * Explicitly set the key usage for the generated private key.
michael@0 475 *
michael@0 476 * This allows us to specify single use EC and RSA keys whose usage
michael@0 477 * can be regulated by the underlying token.
michael@0 478 *
michael@0 479 * The underlying key usage is set using opFlags. opFlagsMask specifies
michael@0 480 * which operations are specified by opFlags. For instance to turn encrypt
michael@0 481 * on and signing off, opFlags would be CKF_ENCRYPT|CKF_DECRYPT and
michael@0 482 * opFlagsMask would be CKF_ENCRYPT|CKF_DECRYPT|CKF_SIGN|CKF_VERIFY. You
michael@0 483 * need to specify both the public and private key flags,
michael@0 484 * PK11_GenerateKeyPairWithOpFlags will sort out the correct flag to the
michael@0 485 * correct key type. Flags not specified in opFlagMask will be defaulted
michael@0 486 * according to mechanism type and token capabilities.
michael@0 487 */
michael@0 488 SECKEYPrivateKey *PK11_GenerateKeyPairWithOpFlags(PK11SlotInfo *slot,
michael@0 489 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk,
michael@0 490 PK11AttrFlags attrFlags, CK_FLAGS opFlags, CK_FLAGS opFlagsMask,
michael@0 491 void *wincx);
michael@0 492 /*
michael@0 493 * The attrFlags is the logical OR of the PK11_ATTR_XXX bitflags.
michael@0 494 * These flags apply to the private key. The PK11_ATTR_TOKEN,
michael@0 495 * PK11_ATTR_SESSION, PK11_ATTR_MODIFIABLE, and PK11_ATTR_UNMODIFIABLE
michael@0 496 * flags also apply to the public key.
michael@0 497 */
michael@0 498 SECKEYPrivateKey *PK11_GenerateKeyPairWithFlags(PK11SlotInfo *slot,
michael@0 499 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk,
michael@0 500 PK11AttrFlags attrFlags, void *wincx);
michael@0 501 SECKEYPrivateKey *PK11_GenerateKeyPair(PK11SlotInfo *slot,
michael@0 502 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk,
michael@0 503 PRBool isPerm, PRBool isSensitive, void *wincx);
michael@0 504 SECKEYPrivateKey * PK11_FindPrivateKeyFromCert(PK11SlotInfo *slot,
michael@0 505 CERTCertificate *cert, void *wincx);
michael@0 506 SECKEYPrivateKey * PK11_FindKeyByAnyCert(CERTCertificate *cert, void *wincx);
michael@0 507 SECKEYPrivateKey * PK11_FindKeyByKeyID(PK11SlotInfo *slot, SECItem *keyID,
michael@0 508 void *wincx);
michael@0 509 int PK11_GetPrivateModulusLen(SECKEYPrivateKey *key);
michael@0 510
michael@0 511 SECStatus PK11_Decrypt(PK11SymKey *symkey,
michael@0 512 CK_MECHANISM_TYPE mechanism, SECItem *param,
michael@0 513 unsigned char *out, unsigned int *outLen,
michael@0 514 unsigned int maxLen,
michael@0 515 const unsigned char *enc, unsigned int encLen);
michael@0 516 SECStatus PK11_Encrypt(PK11SymKey *symKey,
michael@0 517 CK_MECHANISM_TYPE mechanism, SECItem *param,
michael@0 518 unsigned char *out, unsigned int *outLen,
michael@0 519 unsigned int maxLen,
michael@0 520 const unsigned char *data, unsigned int dataLen);
michael@0 521
michael@0 522 /* note: despite the name, this function takes a private key. */
michael@0 523 SECStatus PK11_PubDecryptRaw(SECKEYPrivateKey *key,
michael@0 524 unsigned char *data, unsigned *outLen,
michael@0 525 unsigned int maxLen,
michael@0 526 const unsigned char *enc, unsigned encLen);
michael@0 527 #define PK11_PrivDecryptRaw PK11_PubDecryptRaw
michael@0 528 /* The encrypt function that complements the above decrypt function. */
michael@0 529 SECStatus PK11_PubEncryptRaw(SECKEYPublicKey *key,
michael@0 530 unsigned char *enc,
michael@0 531 const unsigned char *data, unsigned dataLen,
michael@0 532 void *wincx);
michael@0 533
michael@0 534 SECStatus PK11_PrivDecryptPKCS1(SECKEYPrivateKey *key,
michael@0 535 unsigned char *data, unsigned *outLen,
michael@0 536 unsigned int maxLen,
michael@0 537 const unsigned char *enc, unsigned encLen);
michael@0 538 /* The encrypt function that complements the above decrypt function. */
michael@0 539 SECStatus PK11_PubEncryptPKCS1(SECKEYPublicKey *key,
michael@0 540 unsigned char *enc,
michael@0 541 const unsigned char *data, unsigned dataLen,
michael@0 542 void *wincx);
michael@0 543
michael@0 544 SECStatus PK11_PrivDecrypt(SECKEYPrivateKey *key,
michael@0 545 CK_MECHANISM_TYPE mechanism, SECItem *param,
michael@0 546 unsigned char *out, unsigned int *outLen,
michael@0 547 unsigned int maxLen,
michael@0 548 const unsigned char *enc, unsigned int encLen);
michael@0 549 SECStatus PK11_PubEncrypt(SECKEYPublicKey *key,
michael@0 550 CK_MECHANISM_TYPE mechanism, SECItem *param,
michael@0 551 unsigned char *out, unsigned int *outLen,
michael@0 552 unsigned int maxLen,
michael@0 553 const unsigned char *data, unsigned int dataLen,
michael@0 554 void *wincx);
michael@0 555
michael@0 556 SECStatus PK11_ImportPrivateKeyInfo(PK11SlotInfo *slot,
michael@0 557 SECKEYPrivateKeyInfo *pki, SECItem *nickname,
michael@0 558 SECItem *publicValue, PRBool isPerm, PRBool isPrivate,
michael@0 559 unsigned int usage, void *wincx);
michael@0 560 SECStatus PK11_ImportPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot,
michael@0 561 SECKEYPrivateKeyInfo *pki, SECItem *nickname,
michael@0 562 SECItem *publicValue, PRBool isPerm, PRBool isPrivate,
michael@0 563 unsigned int usage, SECKEYPrivateKey** privk, void *wincx);
michael@0 564 SECStatus PK11_ImportDERPrivateKeyInfo(PK11SlotInfo *slot,
michael@0 565 SECItem *derPKI, SECItem *nickname,
michael@0 566 SECItem *publicValue, PRBool isPerm, PRBool isPrivate,
michael@0 567 unsigned int usage, void *wincx);
michael@0 568 SECStatus PK11_ImportDERPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot,
michael@0 569 SECItem *derPKI, SECItem *nickname,
michael@0 570 SECItem *publicValue, PRBool isPerm, PRBool isPrivate,
michael@0 571 unsigned int usage, SECKEYPrivateKey** privk, void *wincx);
michael@0 572 SECStatus PK11_ImportEncryptedPrivateKeyInfo(PK11SlotInfo *slot,
michael@0 573 SECKEYEncryptedPrivateKeyInfo *epki, SECItem *pwitem,
michael@0 574 SECItem *nickname, SECItem *publicValue, PRBool isPerm,
michael@0 575 PRBool isPrivate, KeyType type,
michael@0 576 unsigned int usage, void *wincx);
michael@0 577 SECStatus PK11_ImportEncryptedPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot,
michael@0 578 SECKEYEncryptedPrivateKeyInfo *epki, SECItem *pwitem,
michael@0 579 SECItem *nickname, SECItem *publicValue, PRBool isPerm,
michael@0 580 PRBool isPrivate, KeyType type,
michael@0 581 unsigned int usage, SECKEYPrivateKey** privk, void *wincx);
michael@0 582 SECItem *PK11_ExportDERPrivateKeyInfo(SECKEYPrivateKey *pk, void *wincx);
michael@0 583 SECKEYPrivateKeyInfo *PK11_ExportPrivKeyInfo(
michael@0 584 SECKEYPrivateKey *pk, void *wincx);
michael@0 585 SECKEYPrivateKeyInfo *PK11_ExportPrivateKeyInfo(
michael@0 586 CERTCertificate *cert, void *wincx);
michael@0 587 SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivKeyInfo(
michael@0 588 PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem,
michael@0 589 SECKEYPrivateKey *pk, int iteration, void *wincx);
michael@0 590 SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivateKeyInfo(
michael@0 591 PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem,
michael@0 592 CERTCertificate *cert, int iteration, void *wincx);
michael@0 593 SECKEYPrivateKey *PK11_FindKeyByDERCert(PK11SlotInfo *slot,
michael@0 594 CERTCertificate *cert, void *wincx);
michael@0 595 SECKEYPublicKey *PK11_MakeKEAPubKey(unsigned char *data, int length);
michael@0 596 SECStatus PK11_DigestKey(PK11Context *context, PK11SymKey *key);
michael@0 597 PRBool PK11_VerifyKeyOK(PK11SymKey *key);
michael@0 598 SECKEYPrivateKey *PK11_UnwrapPrivKey(PK11SlotInfo *slot,
michael@0 599 PK11SymKey *wrappingKey, CK_MECHANISM_TYPE wrapType,
michael@0 600 SECItem *param, SECItem *wrappedKey, SECItem *label,
michael@0 601 SECItem *publicValue, PRBool token, PRBool sensitive,
michael@0 602 CK_KEY_TYPE keyType, CK_ATTRIBUTE_TYPE *usage, int usageCount,
michael@0 603 void *wincx);
michael@0 604 SECStatus PK11_WrapPrivKey(PK11SlotInfo *slot, PK11SymKey *wrappingKey,
michael@0 605 SECKEYPrivateKey *privKey, CK_MECHANISM_TYPE wrapType,
michael@0 606 SECItem *param, SECItem *wrappedKey, void *wincx);
michael@0 607 /*
michael@0 608 * The caller of PK11_DEREncodePublicKey should free the returned SECItem with
michael@0 609 * a SECITEM_FreeItem(..., PR_TRUE) call.
michael@0 610 */
michael@0 611 SECItem* PK11_DEREncodePublicKey(const SECKEYPublicKey *pubk);
michael@0 612 PK11SymKey* PK11_CopySymKeyForSigning(PK11SymKey *originalKey,
michael@0 613 CK_MECHANISM_TYPE mech);
michael@0 614 SECKEYPrivateKeyList* PK11_ListPrivKeysInSlot(PK11SlotInfo *slot,
michael@0 615 char *nickname, void *wincx);
michael@0 616 SECKEYPublicKeyList* PK11_ListPublicKeysInSlot(PK11SlotInfo *slot,
michael@0 617 char *nickname);
michael@0 618 SECKEYPQGParams *PK11_GetPQGParamsFromPrivateKey(SECKEYPrivateKey *privKey);
michael@0 619 /* deprecated */
michael@0 620 SECKEYPrivateKeyList* PK11_ListPrivateKeysInSlot(PK11SlotInfo *slot);
michael@0 621
michael@0 622 PK11SymKey *PK11_ConvertSessionSymKeyToTokenSymKey(PK11SymKey *symk,
michael@0 623 void *wincx);
michael@0 624 SECKEYPrivateKey *PK11_ConvertSessionPrivKeyToTokenPrivKey(
michael@0 625 SECKEYPrivateKey *privk, void* wincx);
michael@0 626 SECKEYPrivateKey * PK11_CopyTokenPrivKeyToSessionPrivKey(PK11SlotInfo *destSlot,
michael@0 627 SECKEYPrivateKey *privKey);
michael@0 628
michael@0 629 /**********************************************************************
michael@0 630 * Certs
michael@0 631 **********************************************************************/
michael@0 632 SECItem *PK11_MakeIDFromPubKey(SECItem *pubKeyData);
michael@0 633 SECStatus PK11_TraverseSlotCerts(
michael@0 634 SECStatus(* callback)(CERTCertificate*,SECItem *,void *),
michael@0 635 void *arg, void *wincx);
michael@0 636 CERTCertificate * PK11_FindCertFromNickname(const char *nickname, void *wincx);
michael@0 637 CERTCertList * PK11_FindCertsFromEmailAddress(const char *email, void *wincx);
michael@0 638 CERTCertList * PK11_FindCertsFromNickname(const char *nickname, void *wincx);
michael@0 639 CERTCertificate *PK11_GetCertFromPrivateKey(SECKEYPrivateKey *privKey);
michael@0 640 SECStatus PK11_ImportCert(PK11SlotInfo *slot, CERTCertificate *cert,
michael@0 641 CK_OBJECT_HANDLE key, const char *nickname,
michael@0 642 PRBool includeTrust);
michael@0 643 SECStatus PK11_ImportDERCert(PK11SlotInfo *slot, SECItem *derCert,
michael@0 644 CK_OBJECT_HANDLE key, char *nickname, PRBool includeTrust);
michael@0 645 PK11SlotInfo *PK11_ImportCertForKey(CERTCertificate *cert,
michael@0 646 const char *nickname, void *wincx);
michael@0 647 PK11SlotInfo *PK11_ImportDERCertForKey(SECItem *derCert, char *nickname,
michael@0 648 void *wincx);
michael@0 649 PK11SlotInfo *PK11_KeyForCertExists(CERTCertificate *cert,
michael@0 650 CK_OBJECT_HANDLE *keyPtr, void *wincx);
michael@0 651 PK11SlotInfo *PK11_KeyForDERCertExists(SECItem *derCert,
michael@0 652 CK_OBJECT_HANDLE *keyPtr, void *wincx);
michael@0 653 CERTCertificate * PK11_FindCertByIssuerAndSN(PK11SlotInfo **slot,
michael@0 654 CERTIssuerAndSN *sn, void *wincx);
michael@0 655 CERTCertificate * PK11_FindCertAndKeyByRecipientList(PK11SlotInfo **slot,
michael@0 656 SEC_PKCS7RecipientInfo **array, SEC_PKCS7RecipientInfo **rip,
michael@0 657 SECKEYPrivateKey**privKey, void *wincx);
michael@0 658 int PK11_FindCertAndKeyByRecipientListNew(NSSCMSRecipient **recipientlist,
michael@0 659 void *wincx);
michael@0 660 SECStatus PK11_TraverseCertsForSubjectInSlot(CERTCertificate *cert,
michael@0 661 PK11SlotInfo *slot, SECStatus(*callback)(CERTCertificate *, void *),
michael@0 662 void *arg);
michael@0 663 CERTCertificate *PK11_FindCertFromDERCert(PK11SlotInfo *slot,
michael@0 664 CERTCertificate *cert, void *wincx);
michael@0 665 CERTCertificate *PK11_FindCertFromDERCertItem(PK11SlotInfo *slot,
michael@0 666 const SECItem *derCert, void *wincx);
michael@0 667 SECStatus PK11_ImportCertForKeyToSlot(PK11SlotInfo *slot, CERTCertificate *cert,
michael@0 668 char *nickname, PRBool addUsage,
michael@0 669 void *wincx);
michael@0 670 CERTCertificate *PK11_FindBestKEAMatch(CERTCertificate *serverCert,void *wincx);
michael@0 671 PRBool PK11_FortezzaHasKEA(CERTCertificate *cert);
michael@0 672 CK_OBJECT_HANDLE PK11_FindCertInSlot(PK11SlotInfo *slot, CERTCertificate *cert,
michael@0 673 void *wincx);
michael@0 674 SECStatus PK11_TraverseCertsForNicknameInSlot(SECItem *nickname,
michael@0 675 PK11SlotInfo *slot, SECStatus(*callback)(CERTCertificate *, void *),
michael@0 676 void *arg);
michael@0 677 CERTCertList * PK11_ListCerts(PK11CertListType type, void *pwarg);
michael@0 678 CERTCertList * PK11_ListCertsInSlot(PK11SlotInfo *slot);
michael@0 679 CERTSignedCrl* PK11_ImportCRL(PK11SlotInfo * slot, SECItem *derCRL, char *url,
michael@0 680 int type, void *wincx, PRInt32 importOptions, PLArenaPool* arena, PRInt32 decodeOptions);
michael@0 681
michael@0 682 /**********************************************************************
michael@0 683 * Sign/Verify
michael@0 684 **********************************************************************/
michael@0 685
michael@0 686 /*
michael@0 687 * Return the length in bytes of a signature generated with the
michael@0 688 * private key.
michael@0 689 *
michael@0 690 * Return 0 or -1 on failure. (XXX Should we fix it to always return
michael@0 691 * -1 on failure?)
michael@0 692 */
michael@0 693 int PK11_SignatureLen(SECKEYPrivateKey *key);
michael@0 694 PK11SlotInfo * PK11_GetSlotFromPrivateKey(SECKEYPrivateKey *key);
michael@0 695 SECStatus PK11_Sign(SECKEYPrivateKey *key, SECItem *sig,
michael@0 696 const SECItem *hash);
michael@0 697 SECStatus PK11_SignWithSymKey(PK11SymKey *symKey, CK_MECHANISM_TYPE mechanism,
michael@0 698 SECItem *param, SECItem *sig, const SECItem *data);
michael@0 699 SECStatus PK11_VerifyRecover(SECKEYPublicKey *key, const SECItem *sig,
michael@0 700 SECItem *dsig, void * wincx);
michael@0 701 SECStatus PK11_Verify(SECKEYPublicKey *key, const SECItem *sig,
michael@0 702 const SECItem *hash, void *wincx);
michael@0 703
michael@0 704
michael@0 705
michael@0 706 /**********************************************************************
michael@0 707 * Crypto Contexts
michael@0 708 **********************************************************************/
michael@0 709 void PK11_DestroyContext(PK11Context *context, PRBool freeit);
michael@0 710 PK11Context *PK11_CreateContextBySymKey(CK_MECHANISM_TYPE type,
michael@0 711 CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey, SECItem *param);
michael@0 712 PK11Context *PK11_CreateDigestContext(SECOidTag hashAlg);
michael@0 713 PK11Context *PK11_CloneContext(PK11Context *old);
michael@0 714 SECStatus PK11_DigestBegin(PK11Context *cx);
michael@0 715 /*
michael@0 716 * The output buffer 'out' must be big enough to hold the output of
michael@0 717 * the hash algorithm 'hashAlg'.
michael@0 718 */
michael@0 719 SECStatus PK11_HashBuf(SECOidTag hashAlg, unsigned char *out,
michael@0 720 const unsigned char *in, PRInt32 len);
michael@0 721 SECStatus PK11_DigestOp(PK11Context *context, const unsigned char *in,
michael@0 722 unsigned len);
michael@0 723 SECStatus PK11_CipherOp(PK11Context *context, unsigned char * out, int *outlen,
michael@0 724 int maxout, const unsigned char *in, int inlen);
michael@0 725 SECStatus PK11_Finalize(PK11Context *context);
michael@0 726 SECStatus PK11_DigestFinal(PK11Context *context, unsigned char *data,
michael@0 727 unsigned int *outLen, unsigned int length);
michael@0 728 #define PK11_CipherFinal PK11_DigestFinal
michael@0 729 SECStatus PK11_SaveContext(PK11Context *cx,unsigned char *save,
michael@0 730 int *len, int saveLength);
michael@0 731
michael@0 732 /* Save the context's state, with possible allocation.
michael@0 733 * The caller may supply an already allocated buffer in preAllocBuf,
michael@0 734 * with length pabLen. If the buffer is large enough for the context's
michael@0 735 * state, it will receive the state.
michael@0 736 * If the buffer is not large enough (or NULL), then a new buffer will
michael@0 737 * be allocated with PORT_Alloc.
michael@0 738 * In either case, the state will be returned as a buffer, and the length
michael@0 739 * of the state will be given in *stateLen.
michael@0 740 */
michael@0 741 unsigned char *
michael@0 742 PK11_SaveContextAlloc(PK11Context *cx,
michael@0 743 unsigned char *preAllocBuf, unsigned int pabLen,
michael@0 744 unsigned int *stateLen);
michael@0 745
michael@0 746 SECStatus PK11_RestoreContext(PK11Context *cx,unsigned char *save,int len);
michael@0 747 SECStatus PK11_GenerateFortezzaIV(PK11SymKey *symKey,unsigned char *iv,int len);
michael@0 748 void PK11_SetFortezzaHack(PK11SymKey *symKey) ;
michael@0 749
michael@0 750
michael@0 751 /**********************************************************************
michael@0 752 * PBE functions
michael@0 753 **********************************************************************/
michael@0 754
michael@0 755 /* This function creates PBE parameters from the given inputs. The result
michael@0 756 * can be used to create a password integrity key for PKCS#12, by sending
michael@0 757 * the return value to PK11_KeyGen along with the appropriate mechanism.
michael@0 758 */
michael@0 759 SECItem *
michael@0 760 PK11_CreatePBEParams(SECItem *salt, SECItem *pwd, unsigned int iterations);
michael@0 761
michael@0 762 /* free params created above (can be called after keygen is done */
michael@0 763 void PK11_DestroyPBEParams(SECItem *params);
michael@0 764
michael@0 765 SECAlgorithmID *
michael@0 766 PK11_CreatePBEAlgorithmID(SECOidTag algorithm, int iteration, SECItem *salt);
michael@0 767
michael@0 768 /* use to create PKCS5 V2 algorithms with finder control than that provided
michael@0 769 * by PK11_CreatePBEAlgorithmID. */
michael@0 770 SECAlgorithmID *
michael@0 771 PK11_CreatePBEV2AlgorithmID(SECOidTag pbeAlgTag, SECOidTag cipherAlgTag,
michael@0 772 SECOidTag prfAlgTag, int keyLength, int iteration,
michael@0 773 SECItem *salt);
michael@0 774 PK11SymKey *
michael@0 775 PK11_PBEKeyGen(PK11SlotInfo *slot, SECAlgorithmID *algid, SECItem *pwitem,
michael@0 776 PRBool faulty3DES, void *wincx);
michael@0 777
michael@0 778 /* warning: cannot work with PKCS 5 v2 use PK11_PBEKeyGen instead */
michael@0 779 PK11SymKey *
michael@0 780 PK11_RawPBEKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *params,
michael@0 781 SECItem *pwitem, PRBool faulty3DES, void *wincx);
michael@0 782 SECItem *
michael@0 783 PK11_GetPBEIV(SECAlgorithmID *algid, SECItem *pwitem);
michael@0 784 /*
michael@0 785 * Get the Mechanism and parameter of the base encryption or mac scheme from
michael@0 786 * a PBE algorithm ID.
michael@0 787 * Caller is responsible for freeing the return parameter (param).
michael@0 788 */
michael@0 789 CK_MECHANISM_TYPE
michael@0 790 PK11_GetPBECryptoMechanism(SECAlgorithmID *algid,
michael@0 791 SECItem **param, SECItem *pwd);
michael@0 792
michael@0 793 /**********************************************************************
michael@0 794 * Functions to manage secmod flags
michael@0 795 **********************************************************************/
michael@0 796 const PK11DefaultArrayEntry *PK11_GetDefaultArray(int *size);
michael@0 797 SECStatus PK11_UpdateSlotAttribute(PK11SlotInfo *slot,
michael@0 798 const PK11DefaultArrayEntry *entry,
michael@0 799 PRBool add);
michael@0 800
michael@0 801 /**********************************************************************
michael@0 802 * Functions to look at PKCS #11 dependent data
michael@0 803 **********************************************************************/
michael@0 804 PK11GenericObject *PK11_FindGenericObjects(PK11SlotInfo *slot,
michael@0 805 CK_OBJECT_CLASS objClass);
michael@0 806 PK11GenericObject *PK11_GetNextGenericObject(PK11GenericObject *object);
michael@0 807 PK11GenericObject *PK11_GetPrevGenericObject(PK11GenericObject *object);
michael@0 808 SECStatus PK11_UnlinkGenericObject(PK11GenericObject *object);
michael@0 809 SECStatus PK11_LinkGenericObject(PK11GenericObject *list,
michael@0 810 PK11GenericObject *object);
michael@0 811 SECStatus PK11_DestroyGenericObjects(PK11GenericObject *object);
michael@0 812 SECStatus PK11_DestroyGenericObject(PK11GenericObject *object);
michael@0 813 PK11GenericObject *PK11_CreateGenericObject(PK11SlotInfo *slot,
michael@0 814 const CK_ATTRIBUTE *pTemplate,
michael@0 815 int count, PRBool token);
michael@0 816
michael@0 817 /*
michael@0 818 * PK11_ReadRawAttribute and PK11_WriteRawAttribute are generic
michael@0 819 * functions to read and modify the actual PKCS #11 attributes of
michael@0 820 * the underlying pkcs #11 object.
michael@0 821 *
michael@0 822 * object is a pointer to an NSS object that represents the underlying
michael@0 823 * PKCS #11 object. It's type must match the type of PK11ObjectType
michael@0 824 * as follows:
michael@0 825 *
michael@0 826 * type object
michael@0 827 * PK11_TypeGeneric PK11GenericObject *
michael@0 828 * PK11_TypePrivKey SECKEYPrivateKey *
michael@0 829 * PK11_TypePubKey SECKEYPublicKey *
michael@0 830 * PK11_TypeSymKey PK11SymKey *
michael@0 831 *
michael@0 832 * All other types are considered invalid. If type does not match the object
michael@0 833 * passed, unpredictable results will occur.
michael@0 834 *
michael@0 835 * PK11_ReadRawAttribute allocates the buffer for returning the attribute
michael@0 836 * value. The caller of PK11_ReadRawAttribute should free the data buffer
michael@0 837 * pointed to by item using a SECITEM_FreeItem(item, PR_FALSE) or
michael@0 838 * PORT_Free(item->data) call.
michael@0 839 */
michael@0 840 SECStatus PK11_ReadRawAttribute(PK11ObjectType type, void *object,
michael@0 841 CK_ATTRIBUTE_TYPE attr, SECItem *item);
michael@0 842 SECStatus PK11_WriteRawAttribute(PK11ObjectType type, void *object,
michael@0 843 CK_ATTRIBUTE_TYPE attr, SECItem *item);
michael@0 844
michael@0 845 /*
michael@0 846 * PK11_GetAllSlotsForCert returns all the slots that a given certificate
michael@0 847 * exists on, since it's possible for a cert to exist on more than one
michael@0 848 * PKCS#11 token.
michael@0 849 */
michael@0 850 PK11SlotList *
michael@0 851 PK11_GetAllSlotsForCert(CERTCertificate *cert, void *arg);
michael@0 852
michael@0 853 /**********************************************************************
michael@0 854 * New functions which are already deprecated....
michael@0 855 **********************************************************************/
michael@0 856 SECItem *
michael@0 857 PK11_GetLowLevelKeyIDForCert(PK11SlotInfo *slot,
michael@0 858 CERTCertificate *cert, void *pwarg);
michael@0 859 SECItem *
michael@0 860 PK11_GetLowLevelKeyIDForPrivateKey(SECKEYPrivateKey *key);
michael@0 861
michael@0 862 PRBool SECMOD_HasRootCerts(void);
michael@0 863
michael@0 864 SEC_END_PROTOS
michael@0 865
michael@0 866 #endif

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial