The Tor Browser / annotate

security/nss/lib/smime/cms.h@b8a032363ba2 (annotated)

security/nss/lib/smime/cms.h

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4
michael@0 5 /*
michael@0 6 * Interfaces of the CMS implementation.
michael@0 7 */
michael@0 8
michael@0 9 #ifndef _CMS_H_
michael@0 10 #define _CMS_H_
michael@0 11
michael@0 12 #include "seccomon.h"
michael@0 13
michael@0 14 #include "secoidt.h"
michael@0 15 #include "certt.h"
michael@0 16 #include "keyt.h"
michael@0 17 #include "hasht.h"
michael@0 18 #include "cmst.h"
michael@0 19
michael@0 20 /************************************************************************/
michael@0 21 SEC_BEGIN_PROTOS
michael@0 22
michael@0 23 /************************************************************************
michael@0 24 * cmsdecode.c - CMS decoding
michael@0 25 ************************************************************************/
michael@0 26
michael@0 27 /*
michael@0 28 * NSS_CMSDecoder_Start - set up decoding of a DER-encoded CMS message
michael@0 29 *
michael@0 30 * "poolp" - pointer to arena for message, or NULL if new pool should be created
michael@0 31 * "cb", "cb_arg" - callback function and argument for delivery of inner content
michael@0 32 * inner content will be stored in the message if cb is NULL.
michael@0 33 * "pwfn", pwfn_arg" - callback function for getting token password
michael@0 34 * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0 35 */
michael@0 36 extern NSSCMSDecoderContext *
michael@0 37 NSS_CMSDecoder_Start(PLArenaPool *poolp,
michael@0 38 NSSCMSContentCallback cb, void *cb_arg,
michael@0 39 PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0 40 NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg);
michael@0 41
michael@0 42 /*
michael@0 43 * NSS_CMSDecoder_Update - feed DER-encoded data to decoder
michael@0 44 */
michael@0 45 extern SECStatus
michael@0 46 NSS_CMSDecoder_Update(NSSCMSDecoderContext *p7dcx, const char *buf, unsigned long len);
michael@0 47
michael@0 48 /*
michael@0 49 * NSS_CMSDecoder_Cancel - cancel a decoding process
michael@0 50 */
michael@0 51 extern void
michael@0 52 NSS_CMSDecoder_Cancel(NSSCMSDecoderContext *p7dcx);
michael@0 53
michael@0 54 /*
michael@0 55 * NSS_CMSDecoder_Finish - mark the end of inner content and finish decoding
michael@0 56 */
michael@0 57 extern NSSCMSMessage *
michael@0 58 NSS_CMSDecoder_Finish(NSSCMSDecoderContext *p7dcx);
michael@0 59
michael@0 60 /*
michael@0 61 * NSS_CMSMessage_CreateFromDER - decode a CMS message from DER encoded data
michael@0 62 */
michael@0 63 extern NSSCMSMessage *
michael@0 64 NSS_CMSMessage_CreateFromDER(SECItem *DERmessage,
michael@0 65 NSSCMSContentCallback cb, void *cb_arg,
michael@0 66 PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0 67 NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg);
michael@0 68
michael@0 69 /************************************************************************
michael@0 70 * cmsencode.c - CMS encoding
michael@0 71 ************************************************************************/
michael@0 72
michael@0 73 /*
michael@0 74 * NSS_CMSEncoder_Start - set up encoding of a CMS message
michael@0 75 *
michael@0 76 * "cmsg" - message to encode
michael@0 77 * "outputfn", "outputarg" - callback function for delivery of DER-encoded output
michael@0 78 * will not be called if NULL.
michael@0 79 * "dest" - if non-NULL, pointer to SECItem that will hold the DER-encoded output
michael@0 80 * "destpoolp" - pool to allocate DER-encoded output in
michael@0 81 * "pwfn", pwfn_arg" - callback function for getting token password
michael@0 82 * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0 83 * "detached_digestalgs", "detached_digests" - digests from detached content
michael@0 84 */
michael@0 85 extern NSSCMSEncoderContext *
michael@0 86 NSS_CMSEncoder_Start(NSSCMSMessage *cmsg,
michael@0 87 NSSCMSContentCallback outputfn, void *outputarg,
michael@0 88 SECItem *dest, PLArenaPool *destpoolp,
michael@0 89 PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0 90 NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
michael@0 91 SECAlgorithmID **detached_digestalgs, SECItem **detached_digests);
michael@0 92
michael@0 93 /*
michael@0 94 * NSS_CMSEncoder_Update - take content data delivery from the user
michael@0 95 *
michael@0 96 * "p7ecx" - encoder context
michael@0 97 * "data" - content data
michael@0 98 * "len" - length of content data
michael@0 99 */
michael@0 100 extern SECStatus
michael@0 101 NSS_CMSEncoder_Update(NSSCMSEncoderContext *p7ecx, const char *data, unsigned long len);
michael@0 102
michael@0 103 /*
michael@0 104 * NSS_CMSEncoder_Cancel - stop all encoding
michael@0 105 */
michael@0 106 extern SECStatus
michael@0 107 NSS_CMSEncoder_Cancel(NSSCMSEncoderContext *p7ecx);
michael@0 108
michael@0 109 /*
michael@0 110 * NSS_CMSEncoder_Finish - signal the end of data
michael@0 111 *
michael@0 112 * we need to walk down the chain of encoders and the finish them from the innermost out
michael@0 113 */
michael@0 114 extern SECStatus
michael@0 115 NSS_CMSEncoder_Finish(NSSCMSEncoderContext *p7ecx);
michael@0 116
michael@0 117 /************************************************************************
michael@0 118 * cmsmessage.c - CMS message object
michael@0 119 ************************************************************************/
michael@0 120
michael@0 121 /*
michael@0 122 * NSS_CMSMessage_Create - create a CMS message object
michael@0 123 *
michael@0 124 * "poolp" - arena to allocate memory from, or NULL if new arena should be created
michael@0 125 */
michael@0 126 extern NSSCMSMessage *
michael@0 127 NSS_CMSMessage_Create(PLArenaPool *poolp);
michael@0 128
michael@0 129 /*
michael@0 130 * NSS_CMSMessage_SetEncodingParams - set up a CMS message object for encoding or decoding
michael@0 131 *
michael@0 132 * "cmsg" - message object
michael@0 133 * "pwfn", pwfn_arg" - callback function for getting token password
michael@0 134 * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0 135 * "detached_digestalgs", "detached_digests" - digests from detached content
michael@0 136 *
michael@0 137 * used internally.
michael@0 138 */
michael@0 139 extern void
michael@0 140 NSS_CMSMessage_SetEncodingParams(NSSCMSMessage *cmsg,
michael@0 141 PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0 142 NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
michael@0 143 SECAlgorithmID **detached_digestalgs, SECItem **detached_digests);
michael@0 144
michael@0 145 /*
michael@0 146 * NSS_CMSMessage_Destroy - destroy a CMS message and all of its sub-pieces.
michael@0 147 */
michael@0 148 extern void
michael@0 149 NSS_CMSMessage_Destroy(NSSCMSMessage *cmsg);
michael@0 150
michael@0 151 /*
michael@0 152 * NSS_CMSMessage_Copy - return a copy of the given message.
michael@0 153 *
michael@0 154 * The copy may be virtual or may be real -- either way, the result needs
michael@0 155 * to be passed to NSS_CMSMessage_Destroy later (as does the original).
michael@0 156 */
michael@0 157 extern NSSCMSMessage *
michael@0 158 NSS_CMSMessage_Copy(NSSCMSMessage *cmsg);
michael@0 159
michael@0 160 /*
michael@0 161 * NSS_CMSMessage_GetArena - return a pointer to the message's arena pool
michael@0 162 */
michael@0 163 extern PLArenaPool *
michael@0 164 NSS_CMSMessage_GetArena(NSSCMSMessage *cmsg);
michael@0 165
michael@0 166 /*
michael@0 167 * NSS_CMSMessage_GetContentInfo - return a pointer to the top level contentInfo
michael@0 168 */
michael@0 169 extern NSSCMSContentInfo *
michael@0 170 NSS_CMSMessage_GetContentInfo(NSSCMSMessage *cmsg);
michael@0 171
michael@0 172 /*
michael@0 173 * Return a pointer to the actual content.
michael@0 174 * In the case of those types which are encrypted, this returns the *plain* content.
michael@0 175 * In case of nested contentInfos, this descends and retrieves the innermost content.
michael@0 176 */
michael@0 177 extern SECItem *
michael@0 178 NSS_CMSMessage_GetContent(NSSCMSMessage *cmsg);
michael@0 179
michael@0 180 /*
michael@0 181 * NSS_CMSMessage_ContentLevelCount - count number of levels of CMS content objects in this message
michael@0 182 *
michael@0 183 * CMS data content objects do not count.
michael@0 184 */
michael@0 185 extern int
michael@0 186 NSS_CMSMessage_ContentLevelCount(NSSCMSMessage *cmsg);
michael@0 187
michael@0 188 /*
michael@0 189 * NSS_CMSMessage_ContentLevel - find content level #n
michael@0 190 *
michael@0 191 * CMS data content objects do not count.
michael@0 192 */
michael@0 193 extern NSSCMSContentInfo *
michael@0 194 NSS_CMSMessage_ContentLevel(NSSCMSMessage *cmsg, int n);
michael@0 195
michael@0 196 /*
michael@0 197 * NSS_CMSMessage_ContainsCertsOrCrls - see if message contains certs along the way
michael@0 198 */
michael@0 199 extern PRBool
michael@0 200 NSS_CMSMessage_ContainsCertsOrCrls(NSSCMSMessage *cmsg);
michael@0 201
michael@0 202 /*
michael@0 203 * NSS_CMSMessage_IsEncrypted - see if message contains a encrypted submessage
michael@0 204 */
michael@0 205 extern PRBool
michael@0 206 NSS_CMSMessage_IsEncrypted(NSSCMSMessage *cmsg);
michael@0 207
michael@0 208 /*
michael@0 209 * NSS_CMSMessage_IsSigned - see if message contains a signed submessage
michael@0 210 *
michael@0 211 * If the CMS message has a SignedData with a signature (not just a SignedData)
michael@0 212 * return true; false otherwise. This can/should be called before calling
michael@0 213 * VerifySignature, which will always indicate failure if no signature is
michael@0 214 * present, but that does not mean there even was a signature!
michael@0 215 * Note that the content itself can be empty (detached content was sent
michael@0 216 * another way); it is the presence of the signature that matters.
michael@0 217 */
michael@0 218 extern PRBool
michael@0 219 NSS_CMSMessage_IsSigned(NSSCMSMessage *cmsg);
michael@0 220
michael@0 221 /*
michael@0 222 * NSS_CMSMessage_IsContentEmpty - see if content is empty
michael@0 223 *
michael@0 224 * returns PR_TRUE is innermost content length is < minLen
michael@0 225 * XXX need the encrypted content length (why?)
michael@0 226 */
michael@0 227 extern PRBool
michael@0 228 NSS_CMSMessage_IsContentEmpty(NSSCMSMessage *cmsg, unsigned int minLen);
michael@0 229
michael@0 230 /************************************************************************
michael@0 231 * cmscinfo.c - CMS contentInfo methods
michael@0 232 ************************************************************************/
michael@0 233
michael@0 234 /*
michael@0 235 * NSS_CMSContentInfo_Destroy - destroy a CMS contentInfo and all of its sub-pieces.
michael@0 236 */
michael@0 237 extern void
michael@0 238 NSS_CMSContentInfo_Destroy(NSSCMSContentInfo *cinfo);
michael@0 239
michael@0 240 /*
michael@0 241 * NSS_CMSContentInfo_GetChildContentInfo - get content's contentInfo (if it exists)
michael@0 242 */
michael@0 243 extern NSSCMSContentInfo *
michael@0 244 NSS_CMSContentInfo_GetChildContentInfo(NSSCMSContentInfo *cinfo);
michael@0 245
michael@0 246 /*
michael@0 247 * NSS_CMSContentInfo_SetContent - set cinfo's content type & content to CMS object
michael@0 248 */
michael@0 249 extern SECStatus
michael@0 250 NSS_CMSContentInfo_SetContent(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, SECOidTag type, void *ptr);
michael@0 251
michael@0 252 /*
michael@0 253 * NSS_CMSContentInfo_SetContent_XXXX - typesafe wrappers for NSS_CMSContentInfo_SetType
michael@0 254 * set cinfo's content type & content to CMS object
michael@0 255 */
michael@0 256 extern SECStatus
michael@0 257 NSS_CMSContentInfo_SetContent_Data(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, SECItem *data, PRBool detached);
michael@0 258
michael@0 259 extern SECStatus
michael@0 260 NSS_CMSContentInfo_SetContent_SignedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSSignedData *sigd);
michael@0 261
michael@0 262 extern SECStatus
michael@0 263 NSS_CMSContentInfo_SetContent_EnvelopedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSEnvelopedData *envd);
michael@0 264
michael@0 265 extern SECStatus
michael@0 266 NSS_CMSContentInfo_SetContent_DigestedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSDigestedData *digd);
michael@0 267
michael@0 268 extern SECStatus
michael@0 269 NSS_CMSContentInfo_SetContent_EncryptedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSEncryptedData *encd);
michael@0 270
michael@0 271 /*
michael@0 272 * turn off streaming for this content type.
michael@0 273 * This could fail with SEC_ERROR_NO_MEMORY in memory constrained conditions.
michael@0 274 */
michael@0 275 extern SECStatus
michael@0 276 NSS_CMSContentInfo_SetDontStream(NSSCMSContentInfo *cinfo, PRBool dontStream);
michael@0 277
michael@0 278
michael@0 279 /*
michael@0 280 * NSS_CMSContentInfo_GetContent - get pointer to inner content
michael@0 281 *
michael@0 282 * needs to be casted...
michael@0 283 */
michael@0 284 extern void *
michael@0 285 NSS_CMSContentInfo_GetContent(NSSCMSContentInfo *cinfo);
michael@0 286
michael@0 287 /*
michael@0 288 * NSS_CMSContentInfo_GetInnerContent - get pointer to innermost content
michael@0 289 *
michael@0 290 * this is typically only called by NSS_CMSMessage_GetContent()
michael@0 291 */
michael@0 292 extern SECItem *
michael@0 293 NSS_CMSContentInfo_GetInnerContent(NSSCMSContentInfo *cinfo);
michael@0 294
michael@0 295 /*
michael@0 296 * NSS_CMSContentInfo_GetContentType{Tag,OID} - find out (saving pointer to lookup result
michael@0 297 * for future reference) and return the inner content type.
michael@0 298 */
michael@0 299 extern SECOidTag
michael@0 300 NSS_CMSContentInfo_GetContentTypeTag(NSSCMSContentInfo *cinfo);
michael@0 301
michael@0 302 extern SECItem *
michael@0 303 NSS_CMSContentInfo_GetContentTypeOID(NSSCMSContentInfo *cinfo);
michael@0 304
michael@0 305 /*
michael@0 306 * NSS_CMSContentInfo_GetContentEncAlgTag - find out (saving pointer to lookup result
michael@0 307 * for future reference) and return the content encryption algorithm tag.
michael@0 308 */
michael@0 309 extern SECOidTag
michael@0 310 NSS_CMSContentInfo_GetContentEncAlgTag(NSSCMSContentInfo *cinfo);
michael@0 311
michael@0 312 /*
michael@0 313 * NSS_CMSContentInfo_GetContentEncAlg - find out and return the content encryption algorithm tag.
michael@0 314 */
michael@0 315 extern SECAlgorithmID *
michael@0 316 NSS_CMSContentInfo_GetContentEncAlg(NSSCMSContentInfo *cinfo);
michael@0 317
michael@0 318 extern SECStatus
michael@0 319 NSS_CMSContentInfo_SetContentEncAlg(PLArenaPool *poolp, NSSCMSContentInfo *cinfo,
michael@0 320 SECOidTag bulkalgtag, SECItem *parameters, int keysize);
michael@0 321
michael@0 322 extern SECStatus
michael@0 323 NSS_CMSContentInfo_SetContentEncAlgID(PLArenaPool *poolp, NSSCMSContentInfo *cinfo,
michael@0 324 SECAlgorithmID *algid, int keysize);
michael@0 325
michael@0 326 extern void
michael@0 327 NSS_CMSContentInfo_SetBulkKey(NSSCMSContentInfo *cinfo, PK11SymKey *bulkkey);
michael@0 328
michael@0 329 extern PK11SymKey *
michael@0 330 NSS_CMSContentInfo_GetBulkKey(NSSCMSContentInfo *cinfo);
michael@0 331
michael@0 332 extern int
michael@0 333 NSS_CMSContentInfo_GetBulkKeySize(NSSCMSContentInfo *cinfo);
michael@0 334
michael@0 335 /************************************************************************
michael@0 336 * cmsutil.c - CMS misc utility functions
michael@0 337 ************************************************************************/
michael@0 338
michael@0 339 /*
michael@0 340 * NSS_CMSArray_SortByDER - sort array of objects by objects' DER encoding
michael@0 341 *
michael@0 342 * make sure that the order of the objects guarantees valid DER (which must be
michael@0 343 * in lexigraphically ascending order for a SET OF); if reordering is necessary it
michael@0 344 * will be done in place (in objs).
michael@0 345 */
michael@0 346 extern SECStatus
michael@0 347 NSS_CMSArray_SortByDER(void **objs, const SEC_ASN1Template *objtemplate, void **objs2);
michael@0 348
michael@0 349 /*
michael@0 350 * NSS_CMSUtil_DERCompare - for use with NSS_CMSArray_Sort to
michael@0 351 * sort arrays of SECItems containing DER
michael@0 352 */
michael@0 353 extern int
michael@0 354 NSS_CMSUtil_DERCompare(void *a, void *b);
michael@0 355
michael@0 356 /*
michael@0 357 * NSS_CMSAlgArray_GetIndexByAlgID - find a specific algorithm in an array of
michael@0 358 * algorithms.
michael@0 359 *
michael@0 360 * algorithmArray - array of algorithm IDs
michael@0 361 * algid - algorithmid of algorithm to pick
michael@0 362 *
michael@0 363 * Returns:
michael@0 364 * An integer containing the index of the algorithm in the array or -1 if
michael@0 365 * algorithm was not found.
michael@0 366 */
michael@0 367 extern int
michael@0 368 NSS_CMSAlgArray_GetIndexByAlgID(SECAlgorithmID **algorithmArray, SECAlgorithmID *algid);
michael@0 369
michael@0 370 /*
michael@0 371 * NSS_CMSAlgArray_GetIndexByAlgID - find a specific algorithm in an array of
michael@0 372 * algorithms.
michael@0 373 *
michael@0 374 * algorithmArray - array of algorithm IDs
michael@0 375 * algiddata - id of algorithm to pick
michael@0 376 *
michael@0 377 * Returns:
michael@0 378 * An integer containing the index of the algorithm in the array or -1 if
michael@0 379 * algorithm was not found.
michael@0 380 */
michael@0 381 extern int
michael@0 382 NSS_CMSAlgArray_GetIndexByAlgTag(SECAlgorithmID **algorithmArray, SECOidTag algtag);
michael@0 383
michael@0 384 extern const SECHashObject *
michael@0 385 NSS_CMSUtil_GetHashObjByAlgID(SECAlgorithmID *algid);
michael@0 386
michael@0 387 extern const SEC_ASN1Template *
michael@0 388 NSS_CMSUtil_GetTemplateByTypeTag(SECOidTag type);
michael@0 389
michael@0 390 extern size_t
michael@0 391 NSS_CMSUtil_GetSizeByTypeTag(SECOidTag type);
michael@0 392
michael@0 393 extern NSSCMSContentInfo *
michael@0 394 NSS_CMSContent_GetContentInfo(void *msg, SECOidTag type);
michael@0 395
michael@0 396 extern const char *
michael@0 397 NSS_CMSUtil_VerificationStatusToString(NSSCMSVerificationStatus vs);
michael@0 398
michael@0 399 /************************************************************************
michael@0 400 * cmssigdata.c - CMS signedData methods
michael@0 401 ************************************************************************/
michael@0 402
michael@0 403 extern NSSCMSSignedData *
michael@0 404 NSS_CMSSignedData_Create(NSSCMSMessage *cmsg);
michael@0 405
michael@0 406 extern void
michael@0 407 NSS_CMSSignedData_Destroy(NSSCMSSignedData *sigd);
michael@0 408
michael@0 409 /*
michael@0 410 * NSS_CMSSignedData_Encode_BeforeStart - do all the necessary things to a SignedData
michael@0 411 * before start of encoding.
michael@0 412 *
michael@0 413 * In detail:
michael@0 414 * - find out about the right value to put into sigd->version
michael@0 415 * - come up with a list of digestAlgorithms (which should be the union of the algorithms
michael@0 416 * in the signerinfos).
michael@0 417 * If we happen to have a pre-set list of algorithms (and digest values!), we
michael@0 418 * check if we have all the signerinfos' algorithms. If not, this is an error.
michael@0 419 */
michael@0 420 extern SECStatus
michael@0 421 NSS_CMSSignedData_Encode_BeforeStart(NSSCMSSignedData *sigd);
michael@0 422
michael@0 423 extern SECStatus
michael@0 424 NSS_CMSSignedData_Encode_BeforeData(NSSCMSSignedData *sigd);
michael@0 425
michael@0 426 /*
michael@0 427 * NSS_CMSSignedData_Encode_AfterData - do all the necessary things to a SignedData
michael@0 428 * after all the encapsulated data was passed through the encoder.
michael@0 429 *
michael@0 430 * In detail:
michael@0 431 * - create the signatures in all the SignerInfos
michael@0 432 *
michael@0 433 * Please note that nothing is done to the Certificates and CRLs in the message - this
michael@0 434 * is entirely the responsibility of our callers.
michael@0 435 */
michael@0 436 extern SECStatus
michael@0 437 NSS_CMSSignedData_Encode_AfterData(NSSCMSSignedData *sigd);
michael@0 438
michael@0 439 extern SECStatus
michael@0 440 NSS_CMSSignedData_Decode_BeforeData(NSSCMSSignedData *sigd);
michael@0 441
michael@0 442 /*
michael@0 443 * NSS_CMSSignedData_Decode_AfterData - do all the necessary things to a SignedData
michael@0 444 * after all the encapsulated data was passed through the decoder.
michael@0 445 */
michael@0 446 extern SECStatus
michael@0 447 NSS_CMSSignedData_Decode_AfterData(NSSCMSSignedData *sigd);
michael@0 448
michael@0 449 /*
michael@0 450 * NSS_CMSSignedData_Decode_AfterEnd - do all the necessary things to a SignedData
michael@0 451 * after all decoding is finished.
michael@0 452 */
michael@0 453 extern SECStatus
michael@0 454 NSS_CMSSignedData_Decode_AfterEnd(NSSCMSSignedData *sigd);
michael@0 455
michael@0 456 /*
michael@0 457 * NSS_CMSSignedData_GetSignerInfos - retrieve the SignedData's signer list
michael@0 458 */
michael@0 459 extern NSSCMSSignerInfo **
michael@0 460 NSS_CMSSignedData_GetSignerInfos(NSSCMSSignedData *sigd);
michael@0 461
michael@0 462 extern int
michael@0 463 NSS_CMSSignedData_SignerInfoCount(NSSCMSSignedData *sigd);
michael@0 464
michael@0 465 extern NSSCMSSignerInfo *
michael@0 466 NSS_CMSSignedData_GetSignerInfo(NSSCMSSignedData *sigd, int i);
michael@0 467
michael@0 468 /*
michael@0 469 * NSS_CMSSignedData_GetDigestAlgs - retrieve the SignedData's digest algorithm list
michael@0 470 */
michael@0 471 extern SECAlgorithmID **
michael@0 472 NSS_CMSSignedData_GetDigestAlgs(NSSCMSSignedData *sigd);
michael@0 473
michael@0 474 /*
michael@0 475 * NSS_CMSSignedData_GetContentInfo - return pointer to this signedData's contentinfo
michael@0 476 */
michael@0 477 extern NSSCMSContentInfo *
michael@0 478 NSS_CMSSignedData_GetContentInfo(NSSCMSSignedData *sigd);
michael@0 479
michael@0 480 /*
michael@0 481 * NSS_CMSSignedData_GetCertificateList - retrieve the SignedData's certificate list
michael@0 482 */
michael@0 483 extern SECItem **
michael@0 484 NSS_CMSSignedData_GetCertificateList(NSSCMSSignedData *sigd);
michael@0 485
michael@0 486 extern SECStatus
michael@0 487 NSS_CMSSignedData_ImportCerts(NSSCMSSignedData *sigd, CERTCertDBHandle *certdb,
michael@0 488 SECCertUsage certusage, PRBool keepcerts);
michael@0 489
michael@0 490 /*
michael@0 491 * NSS_CMSSignedData_HasDigests - see if we have digests in place
michael@0 492 */
michael@0 493 extern PRBool
michael@0 494 NSS_CMSSignedData_HasDigests(NSSCMSSignedData *sigd);
michael@0 495
michael@0 496 /*
michael@0 497 * NSS_CMSSignedData_VerifySignerInfo - check a signature.
michael@0 498 *
michael@0 499 * The digests were either calculated during decoding (and are stored in the
michael@0 500 * signedData itself) or set after decoding using NSS_CMSSignedData_SetDigests.
michael@0 501 *
michael@0 502 * The verification checks if the signing cert is valid and has a trusted chain
michael@0 503 * for the purpose specified by "certusage".
michael@0 504 */
michael@0 505 extern SECStatus
michael@0 506 NSS_CMSSignedData_VerifySignerInfo(NSSCMSSignedData *sigd, int i, CERTCertDBHandle *certdb,
michael@0 507 SECCertUsage certusage);
michael@0 508
michael@0 509 /*
michael@0 510 * NSS_CMSSignedData_VerifyCertsOnly - verify the certs in a certs-only message
michael@0 511 */
michael@0 512 extern SECStatus
michael@0 513 NSS_CMSSignedData_VerifyCertsOnly(NSSCMSSignedData *sigd,
michael@0 514 CERTCertDBHandle *certdb,
michael@0 515 SECCertUsage usage);
michael@0 516
michael@0 517 extern SECStatus
michael@0 518 NSS_CMSSignedData_AddCertList(NSSCMSSignedData *sigd, CERTCertificateList *certlist);
michael@0 519
michael@0 520 /*
michael@0 521 * NSS_CMSSignedData_AddCertChain - add cert and its entire chain to the set of certs
michael@0 522 */
michael@0 523 extern SECStatus
michael@0 524 NSS_CMSSignedData_AddCertChain(NSSCMSSignedData *sigd, CERTCertificate *cert);
michael@0 525
michael@0 526 extern SECStatus
michael@0 527 NSS_CMSSignedData_AddCertificate(NSSCMSSignedData *sigd, CERTCertificate *cert);
michael@0 528
michael@0 529 extern PRBool
michael@0 530 NSS_CMSSignedData_ContainsCertsOrCrls(NSSCMSSignedData *sigd);
michael@0 531
michael@0 532 extern SECStatus
michael@0 533 NSS_CMSSignedData_AddSignerInfo(NSSCMSSignedData *sigd,
michael@0 534 NSSCMSSignerInfo *signerinfo);
michael@0 535
michael@0 536 extern SECStatus
michael@0 537 NSS_CMSSignedData_SetDigests(NSSCMSSignedData *sigd,
michael@0 538 SECAlgorithmID **digestalgs,
michael@0 539 SECItem **digests);
michael@0 540
michael@0 541 extern SECStatus
michael@0 542 NSS_CMSSignedData_SetDigestValue(NSSCMSSignedData *sigd,
michael@0 543 SECOidTag digestalgtag,
michael@0 544 SECItem *digestdata);
michael@0 545
michael@0 546 extern SECStatus
michael@0 547 NSS_CMSSignedData_AddDigest(PLArenaPool *poolp,
michael@0 548 NSSCMSSignedData *sigd,
michael@0 549 SECOidTag digestalgtag,
michael@0 550 SECItem *digest);
michael@0 551
michael@0 552 extern SECItem *
michael@0 553 NSS_CMSSignedData_GetDigestValue(NSSCMSSignedData *sigd, SECOidTag digestalgtag);
michael@0 554
michael@0 555 /*
michael@0 556 * NSS_CMSSignedData_CreateCertsOnly - create a certs-only SignedData.
michael@0 557 *
michael@0 558 * cert - base certificates that will be included
michael@0 559 * include_chain - if true, include the complete cert chain for cert
michael@0 560 *
michael@0 561 * More certs and chains can be added via AddCertificate and AddCertChain.
michael@0 562 *
michael@0 563 * An error results in a return value of NULL and an error set.
michael@0 564 */
michael@0 565 extern NSSCMSSignedData *
michael@0 566 NSS_CMSSignedData_CreateCertsOnly(NSSCMSMessage *cmsg, CERTCertificate *cert, PRBool include_chain);
michael@0 567
michael@0 568 /************************************************************************
michael@0 569 * cmssiginfo.c - signerinfo methods
michael@0 570 ************************************************************************/
michael@0 571
michael@0 572 extern NSSCMSSignerInfo *
michael@0 573 NSS_CMSSignerInfo_Create(NSSCMSMessage *cmsg, CERTCertificate *cert, SECOidTag digestalgtag);
michael@0 574 extern NSSCMSSignerInfo *
michael@0 575 NSS_CMSSignerInfo_CreateWithSubjKeyID(NSSCMSMessage *cmsg, SECItem *subjKeyID, SECKEYPublicKey *pubKey, SECKEYPrivateKey *signingKey, SECOidTag digestalgtag);
michael@0 576
michael@0 577 /*
michael@0 578 * NSS_CMSSignerInfo_Destroy - destroy a SignerInfo data structure
michael@0 579 */
michael@0 580 extern void
michael@0 581 NSS_CMSSignerInfo_Destroy(NSSCMSSignerInfo *si);
michael@0 582
michael@0 583 /*
michael@0 584 * NSS_CMSSignerInfo_Sign - sign something
michael@0 585 *
michael@0 586 */
michael@0 587 extern SECStatus
michael@0 588 NSS_CMSSignerInfo_Sign(NSSCMSSignerInfo *signerinfo, SECItem *digest, SECItem *contentType);
michael@0 589
michael@0 590 extern SECStatus
michael@0 591 NSS_CMSSignerInfo_VerifyCertificate(NSSCMSSignerInfo *signerinfo, CERTCertDBHandle *certdb,
michael@0 592 SECCertUsage certusage);
michael@0 593
michael@0 594 /*
michael@0 595 * NSS_CMSSignerInfo_Verify - verify the signature of a single SignerInfo
michael@0 596 *
michael@0 597 * Just verifies the signature. The assumption is that verification of the certificate
michael@0 598 * is done already.
michael@0 599 */
michael@0 600 extern SECStatus
michael@0 601 NSS_CMSSignerInfo_Verify(NSSCMSSignerInfo *signerinfo, SECItem *digest, SECItem *contentType);
michael@0 602
michael@0 603 extern NSSCMSVerificationStatus
michael@0 604 NSS_CMSSignerInfo_GetVerificationStatus(NSSCMSSignerInfo *signerinfo);
michael@0 605
michael@0 606 extern SECOidData *
michael@0 607 NSS_CMSSignerInfo_GetDigestAlg(NSSCMSSignerInfo *signerinfo);
michael@0 608
michael@0 609 extern SECOidTag
michael@0 610 NSS_CMSSignerInfo_GetDigestAlgTag(NSSCMSSignerInfo *signerinfo);
michael@0 611
michael@0 612 extern int
michael@0 613 NSS_CMSSignerInfo_GetVersion(NSSCMSSignerInfo *signerinfo);
michael@0 614
michael@0 615 extern CERTCertificateList *
michael@0 616 NSS_CMSSignerInfo_GetCertList(NSSCMSSignerInfo *signerinfo);
michael@0 617
michael@0 618 /*
michael@0 619 * NSS_CMSSignerInfo_GetSigningTime - return the signing time,
michael@0 620 * in UTCTime format, of a CMS signerInfo.
michael@0 621 *
michael@0 622 * sinfo - signerInfo data for this signer
michael@0 623 *
michael@0 624 * Returns a pointer to XXXX (what?)
michael@0 625 * A return value of NULL is an error.
michael@0 626 */
michael@0 627 extern SECStatus
michael@0 628 NSS_CMSSignerInfo_GetSigningTime(NSSCMSSignerInfo *sinfo, PRTime *stime);
michael@0 629
michael@0 630 /*
michael@0 631 * Return the signing cert of a CMS signerInfo.
michael@0 632 *
michael@0 633 * the certs in the enclosing SignedData must have been imported already
michael@0 634 */
michael@0 635 extern CERTCertificate *
michael@0 636 NSS_CMSSignerInfo_GetSigningCertificate(NSSCMSSignerInfo *signerinfo, CERTCertDBHandle *certdb);
michael@0 637
michael@0 638 /*
michael@0 639 * NSS_CMSSignerInfo_GetSignerCommonName - return the common name of the signer
michael@0 640 *
michael@0 641 * sinfo - signerInfo data for this signer
michael@0 642 *
michael@0 643 * Returns a pointer to allocated memory, which must be freed with PORT_Free.
michael@0 644 * A return value of NULL is an error.
michael@0 645 */
michael@0 646 extern char *
michael@0 647 NSS_CMSSignerInfo_GetSignerCommonName(NSSCMSSignerInfo *sinfo);
michael@0 648
michael@0 649 /*
michael@0 650 * NSS_CMSSignerInfo_GetSignerEmailAddress - return the common name of the signer
michael@0 651 *
michael@0 652 * sinfo - signerInfo data for this signer
michael@0 653 *
michael@0 654 * Returns a pointer to allocated memory, which must be freed.
michael@0 655 * A return value of NULL is an error.
michael@0 656 */
michael@0 657 extern char *
michael@0 658 NSS_CMSSignerInfo_GetSignerEmailAddress(NSSCMSSignerInfo *sinfo);
michael@0 659
michael@0 660 /*
michael@0 661 * NSS_CMSSignerInfo_AddAuthAttr - add an attribute to the
michael@0 662 * authenticated (i.e. signed) attributes of "signerinfo".
michael@0 663 */
michael@0 664 extern SECStatus
michael@0 665 NSS_CMSSignerInfo_AddAuthAttr(NSSCMSSignerInfo *signerinfo, NSSCMSAttribute *attr);
michael@0 666
michael@0 667 /*
michael@0 668 * NSS_CMSSignerInfo_AddUnauthAttr - add an attribute to the
michael@0 669 * unauthenticated attributes of "signerinfo".
michael@0 670 */
michael@0 671 extern SECStatus
michael@0 672 NSS_CMSSignerInfo_AddUnauthAttr(NSSCMSSignerInfo *signerinfo, NSSCMSAttribute *attr);
michael@0 673
michael@0 674 /*
michael@0 675 * NSS_CMSSignerInfo_AddSigningTime - add the signing time to the
michael@0 676 * authenticated (i.e. signed) attributes of "signerinfo".
michael@0 677 *
michael@0 678 * This is expected to be included in outgoing signed
michael@0 679 * messages for email (S/MIME) but is likely useful in other situations.
michael@0 680 *
michael@0 681 * This should only be added once; a second call will do nothing.
michael@0 682 *
michael@0 683 * XXX This will probably just shove the current time into "signerinfo"
michael@0 684 * but it will not actually get signed until the entire item is
michael@0 685 * processed for encoding. Is this (expected to be small) delay okay?
michael@0 686 */
michael@0 687 extern SECStatus
michael@0 688 NSS_CMSSignerInfo_AddSigningTime(NSSCMSSignerInfo *signerinfo, PRTime t);
michael@0 689
michael@0 690 /*
michael@0 691 * NSS_CMSSignerInfo_AddSMIMECaps - add a SMIMECapabilities attribute to the
michael@0 692 * authenticated (i.e. signed) attributes of "signerinfo".
michael@0 693 *
michael@0 694 * This is expected to be included in outgoing signed
michael@0 695 * messages for email (S/MIME).
michael@0 696 */
michael@0 697 extern SECStatus
michael@0 698 NSS_CMSSignerInfo_AddSMIMECaps(NSSCMSSignerInfo *signerinfo);
michael@0 699
michael@0 700 /*
michael@0 701 * NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs - add a SMIMEEncryptionKeyPreferences attribute to the
michael@0 702 * authenticated (i.e. signed) attributes of "signerinfo".
michael@0 703 *
michael@0 704 * This is expected to be included in outgoing signed messages for email (S/MIME).
michael@0 705 */
michael@0 706 SECStatus
michael@0 707 NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs(NSSCMSSignerInfo *signerinfo, CERTCertificate *cert, CERTCertDBHandle *certdb);
michael@0 708
michael@0 709 /*
michael@0 710 * NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs - add a SMIMEEncryptionKeyPreferences attribute to the
michael@0 711 * authenticated (i.e. signed) attributes of "signerinfo", using the OID preferred by Microsoft.
michael@0 712 *
michael@0 713 * This is expected to be included in outgoing signed messages for email (S/MIME),
michael@0 714 * if compatibility with Microsoft mail clients is wanted.
michael@0 715 */
michael@0 716 SECStatus
michael@0 717 NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs(NSSCMSSignerInfo *signerinfo, CERTCertificate *cert, CERTCertDBHandle *certdb);
michael@0 718
michael@0 719 /*
michael@0 720 * NSS_CMSSignerInfo_AddCounterSignature - countersign a signerinfo
michael@0 721 */
michael@0 722 extern SECStatus
michael@0 723 NSS_CMSSignerInfo_AddCounterSignature(NSSCMSSignerInfo *signerinfo,
michael@0 724 SECOidTag digestalg, CERTCertificate signingcert);
michael@0 725
michael@0 726 /*
michael@0 727 * XXXX the following needs to be done in the S/MIME layer code
michael@0 728 * after signature of a signerinfo is verified
michael@0 729 */
michael@0 730 extern SECStatus
michael@0 731 NSS_SMIMESignerInfo_SaveSMIMEProfile(NSSCMSSignerInfo *signerinfo);
michael@0 732
michael@0 733 /*
michael@0 734 * NSS_CMSSignerInfo_IncludeCerts - set cert chain inclusion mode for this signer
michael@0 735 */
michael@0 736 extern SECStatus
michael@0 737 NSS_CMSSignerInfo_IncludeCerts(NSSCMSSignerInfo *signerinfo, NSSCMSCertChainMode cm, SECCertUsage usage);
michael@0 738
michael@0 739 /************************************************************************
michael@0 740 * cmsenvdata.c - CMS envelopedData methods
michael@0 741 ************************************************************************/
michael@0 742
michael@0 743 /*
michael@0 744 * NSS_CMSEnvelopedData_Create - create an enveloped data message
michael@0 745 */
michael@0 746 extern NSSCMSEnvelopedData *
michael@0 747 NSS_CMSEnvelopedData_Create(NSSCMSMessage *cmsg, SECOidTag algorithm, int keysize);
michael@0 748
michael@0 749 /*
michael@0 750 * NSS_CMSEnvelopedData_Destroy - destroy an enveloped data message
michael@0 751 */
michael@0 752 extern void
michael@0 753 NSS_CMSEnvelopedData_Destroy(NSSCMSEnvelopedData *edp);
michael@0 754
michael@0 755 /*
michael@0 756 * NSS_CMSEnvelopedData_GetContentInfo - return pointer to this envelopedData's contentinfo
michael@0 757 */
michael@0 758 extern NSSCMSContentInfo *
michael@0 759 NSS_CMSEnvelopedData_GetContentInfo(NSSCMSEnvelopedData *envd);
michael@0 760
michael@0 761 /*
michael@0 762 * NSS_CMSEnvelopedData_AddRecipient - add a recipientinfo to the enveloped data msg
michael@0 763 *
michael@0 764 * rip must be created on the same pool as edp - this is not enforced, though.
michael@0 765 */
michael@0 766 extern SECStatus
michael@0 767 NSS_CMSEnvelopedData_AddRecipient(NSSCMSEnvelopedData *edp, NSSCMSRecipientInfo *rip);
michael@0 768
michael@0 769 /*
michael@0 770 * NSS_CMSEnvelopedData_Encode_BeforeStart - prepare this envelopedData for encoding
michael@0 771 *
michael@0 772 * at this point, we need
michael@0 773 * - recipientinfos set up with recipient's certificates
michael@0 774 * - a content encryption algorithm (if none, 3DES will be used)
michael@0 775 *
michael@0 776 * this function will generate a random content encryption key (aka bulk key),
michael@0 777 * initialize the recipientinfos with certificate identification and wrap the bulk key
michael@0 778 * using the proper algorithm for every certificiate.
michael@0 779 * it will finally set the bulk algorithm and key so that the encode step can find it.
michael@0 780 */
michael@0 781 extern SECStatus
michael@0 782 NSS_CMSEnvelopedData_Encode_BeforeStart(NSSCMSEnvelopedData *envd);
michael@0 783
michael@0 784 /*
michael@0 785 * NSS_CMSEnvelopedData_Encode_BeforeData - set up encryption
michael@0 786 */
michael@0 787 extern SECStatus
michael@0 788 NSS_CMSEnvelopedData_Encode_BeforeData(NSSCMSEnvelopedData *envd);
michael@0 789
michael@0 790 /*
michael@0 791 * NSS_CMSEnvelopedData_Encode_AfterData - finalize this envelopedData for encoding
michael@0 792 */
michael@0 793 extern SECStatus
michael@0 794 NSS_CMSEnvelopedData_Encode_AfterData(NSSCMSEnvelopedData *envd);
michael@0 795
michael@0 796 /*
michael@0 797 * NSS_CMSEnvelopedData_Decode_BeforeData - find our recipientinfo,
michael@0 798 * derive bulk key & set up our contentinfo
michael@0 799 */
michael@0 800 extern SECStatus
michael@0 801 NSS_CMSEnvelopedData_Decode_BeforeData(NSSCMSEnvelopedData *envd);
michael@0 802
michael@0 803 /*
michael@0 804 * NSS_CMSEnvelopedData_Decode_AfterData - finish decrypting this envelopedData's content
michael@0 805 */
michael@0 806 extern SECStatus
michael@0 807 NSS_CMSEnvelopedData_Decode_AfterData(NSSCMSEnvelopedData *envd);
michael@0 808
michael@0 809 /*
michael@0 810 * NSS_CMSEnvelopedData_Decode_AfterEnd - finish decoding this envelopedData
michael@0 811 */
michael@0 812 extern SECStatus
michael@0 813 NSS_CMSEnvelopedData_Decode_AfterEnd(NSSCMSEnvelopedData *envd);
michael@0 814
michael@0 815
michael@0 816 /************************************************************************
michael@0 817 * cmsrecinfo.c - CMS recipientInfo methods
michael@0 818 ************************************************************************/
michael@0 819
michael@0 820 /*
michael@0 821 * NSS_CMSRecipientInfo_Create - create a recipientinfo
michael@0 822 *
michael@0 823 * we currently do not create KeyAgreement recipientinfos with multiple recipientEncryptedKeys
michael@0 824 * the certificate is supposed to have been verified by the caller
michael@0 825 */
michael@0 826 extern NSSCMSRecipientInfo *
michael@0 827 NSS_CMSRecipientInfo_Create(NSSCMSMessage *cmsg, CERTCertificate *cert);
michael@0 828
michael@0 829 extern NSSCMSRecipientInfo *
michael@0 830 NSS_CMSRecipientInfo_CreateWithSubjKeyID(NSSCMSMessage *cmsg,
michael@0 831 SECItem *subjKeyID,
michael@0 832 SECKEYPublicKey *pubKey);
michael@0 833
michael@0 834 extern NSSCMSRecipientInfo *
michael@0 835 NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert(NSSCMSMessage *cmsg,
michael@0 836 CERTCertificate *cert);
michael@0 837
michael@0 838 /*
michael@0 839 * NSS_CMSRecipientInfo_CreateNew - create a blank recipientinfo for
michael@0 840 * applications which want to encode their own CMS structures and
michael@0 841 * key exchange types.
michael@0 842 */
michael@0 843 extern NSSCMSRecipientInfo *
michael@0 844 NSS_CMSRecipientInfo_CreateNew(void* pwfn_arg);
michael@0 845
michael@0 846 /*
michael@0 847 * NSS_CMSRecipientInfo_CreateFromDER - create a recipientinfo from partially
michael@0 848 * decoded DER data for applications which want to encode their own CMS
michael@0 849 * structures and key exchange types.
michael@0 850 */
michael@0 851 extern NSSCMSRecipientInfo *
michael@0 852 NSS_CMSRecipientInfo_CreateFromDER(SECItem* input, void* pwfn_arg);
michael@0 853
michael@0 854 extern void
michael@0 855 NSS_CMSRecipientInfo_Destroy(NSSCMSRecipientInfo *ri);
michael@0 856
michael@0 857 /*
michael@0 858 * NSS_CMSRecipientInfo_GetCertAndKey - retrieve the cert and key from the
michael@0 859 * recipientInfo struct. If retcert or retkey are NULL, the cert or
michael@0 860 * key (respectively) would not be returned). This function is a no-op if both
michael@0 861 * retcert and retkey are NULL. Caller inherits ownership of the cert and key
michael@0 862 * he requested (and is responsible to free them).
michael@0 863 */
michael@0 864 SECStatus NSS_CMSRecipientInfo_GetCertAndKey(NSSCMSRecipientInfo *ri,
michael@0 865 CERTCertificate** retcert, SECKEYPrivateKey** retkey);
michael@0 866
michael@0 867 extern int
michael@0 868 NSS_CMSRecipientInfo_GetVersion(NSSCMSRecipientInfo *ri);
michael@0 869
michael@0 870 extern SECItem *
michael@0 871 NSS_CMSRecipientInfo_GetEncryptedKey(NSSCMSRecipientInfo *ri, int subIndex);
michael@0 872
michael@0 873 /*
michael@0 874 * NSS_CMSRecipientInfo_Encode - encode an NSS_CMSRecipientInfo as ASN.1
michael@0 875 */
michael@0 876 SECStatus NSS_CMSRecipientInfo_Encode(PLArenaPool* poolp,
michael@0 877 const NSSCMSRecipientInfo *src,
michael@0 878 SECItem* returned);
michael@0 879
michael@0 880 extern SECOidTag
michael@0 881 NSS_CMSRecipientInfo_GetKeyEncryptionAlgorithmTag(NSSCMSRecipientInfo *ri);
michael@0 882
michael@0 883 extern SECStatus
michael@0 884 NSS_CMSRecipientInfo_WrapBulkKey(NSSCMSRecipientInfo *ri, PK11SymKey *bulkkey, SECOidTag bulkalgtag);
michael@0 885
michael@0 886 extern PK11SymKey *
michael@0 887 NSS_CMSRecipientInfo_UnwrapBulkKey(NSSCMSRecipientInfo *ri, int subIndex,
michael@0 888 CERTCertificate *cert, SECKEYPrivateKey *privkey, SECOidTag bulkalgtag);
michael@0 889
michael@0 890 /************************************************************************
michael@0 891 * cmsencdata.c - CMS encryptedData methods
michael@0 892 ************************************************************************/
michael@0 893 /*
michael@0 894 * NSS_CMSEncryptedData_Create - create an empty encryptedData object.
michael@0 895 *
michael@0 896 * "algorithm" specifies the bulk encryption algorithm to use.
michael@0 897 * "keysize" is the key size.
michael@0 898 *
michael@0 899 * An error results in a return value of NULL and an error set.
michael@0 900 * (Retrieve specific errors via PORT_GetError()/XP_GetError().)
michael@0 901 */
michael@0 902 extern NSSCMSEncryptedData *
michael@0 903 NSS_CMSEncryptedData_Create(NSSCMSMessage *cmsg, SECOidTag algorithm, int keysize);
michael@0 904
michael@0 905 /*
michael@0 906 * NSS_CMSEncryptedData_Destroy - destroy an encryptedData object
michael@0 907 */
michael@0 908 extern void
michael@0 909 NSS_CMSEncryptedData_Destroy(NSSCMSEncryptedData *encd);
michael@0 910
michael@0 911 /*
michael@0 912 * NSS_CMSEncryptedData_GetContentInfo - return pointer to encryptedData object's contentInfo
michael@0 913 */
michael@0 914 extern NSSCMSContentInfo *
michael@0 915 NSS_CMSEncryptedData_GetContentInfo(NSSCMSEncryptedData *encd);
michael@0 916
michael@0 917 /*
michael@0 918 * NSS_CMSEncryptedData_Encode_BeforeStart - do all the necessary things to a EncryptedData
michael@0 919 * before encoding begins.
michael@0 920 *
michael@0 921 * In particular:
michael@0 922 * - set the correct version value.
michael@0 923 * - get the encryption key
michael@0 924 */
michael@0 925 extern SECStatus
michael@0 926 NSS_CMSEncryptedData_Encode_BeforeStart(NSSCMSEncryptedData *encd);
michael@0 927
michael@0 928 /*
michael@0 929 * NSS_CMSEncryptedData_Encode_BeforeData - set up encryption
michael@0 930 */
michael@0 931 extern SECStatus
michael@0 932 NSS_CMSEncryptedData_Encode_BeforeData(NSSCMSEncryptedData *encd);
michael@0 933
michael@0 934 /*
michael@0 935 * NSS_CMSEncryptedData_Encode_AfterData - finalize this encryptedData for encoding
michael@0 936 */
michael@0 937 extern SECStatus
michael@0 938 NSS_CMSEncryptedData_Encode_AfterData(NSSCMSEncryptedData *encd);
michael@0 939
michael@0 940 /*
michael@0 941 * NSS_CMSEncryptedData_Decode_BeforeData - find bulk key & set up decryption
michael@0 942 */
michael@0 943 extern SECStatus
michael@0 944 NSS_CMSEncryptedData_Decode_BeforeData(NSSCMSEncryptedData *encd);
michael@0 945
michael@0 946 /*
michael@0 947 * NSS_CMSEncryptedData_Decode_AfterData - finish decrypting this encryptedData's content
michael@0 948 */
michael@0 949 extern SECStatus
michael@0 950 NSS_CMSEncryptedData_Decode_AfterData(NSSCMSEncryptedData *encd);
michael@0 951
michael@0 952 /*
michael@0 953 * NSS_CMSEncryptedData_Decode_AfterEnd - finish decoding this encryptedData
michael@0 954 */
michael@0 955 extern SECStatus
michael@0 956 NSS_CMSEncryptedData_Decode_AfterEnd(NSSCMSEncryptedData *encd);
michael@0 957
michael@0 958 /************************************************************************
michael@0 959 * cmsdigdata.c - CMS encryptedData methods
michael@0 960 ************************************************************************/
michael@0 961 /*
michael@0 962 * NSS_CMSDigestedData_Create - create a digestedData object (presumably for encoding)
michael@0 963 *
michael@0 964 * version will be set by NSS_CMSDigestedData_Encode_BeforeStart
michael@0 965 * digestAlg is passed as parameter
michael@0 966 * contentInfo must be filled by the user
michael@0 967 * digest will be calculated while encoding
michael@0 968 */
michael@0 969 extern NSSCMSDigestedData *
michael@0 970 NSS_CMSDigestedData_Create(NSSCMSMessage *cmsg, SECAlgorithmID *digestalg);
michael@0 971
michael@0 972 /*
michael@0 973 * NSS_CMSDigestedData_Destroy - destroy a digestedData object
michael@0 974 */
michael@0 975 extern void
michael@0 976 NSS_CMSDigestedData_Destroy(NSSCMSDigestedData *digd);
michael@0 977
michael@0 978 /*
michael@0 979 * NSS_CMSDigestedData_GetContentInfo - return pointer to digestedData object's contentInfo
michael@0 980 */
michael@0 981 extern NSSCMSContentInfo *
michael@0 982 NSS_CMSDigestedData_GetContentInfo(NSSCMSDigestedData *digd);
michael@0 983
michael@0 984 /*
michael@0 985 * NSS_CMSDigestedData_Encode_BeforeStart - do all the necessary things to a DigestedData
michael@0 986 * before encoding begins.
michael@0 987 *
michael@0 988 * In particular:
michael@0 989 * - set the right version number. The contentInfo's content type must be set up already.
michael@0 990 */
michael@0 991 extern SECStatus
michael@0 992 NSS_CMSDigestedData_Encode_BeforeStart(NSSCMSDigestedData *digd);
michael@0 993
michael@0 994 /*
michael@0 995 * NSS_CMSDigestedData_Encode_BeforeData - do all the necessary things to a DigestedData
michael@0 996 * before the encapsulated data is passed through the encoder.
michael@0 997 *
michael@0 998 * In detail:
michael@0 999 * - set up the digests if necessary
michael@0 1000 */
michael@0 1001 extern SECStatus
michael@0 1002 NSS_CMSDigestedData_Encode_BeforeData(NSSCMSDigestedData *digd);
michael@0 1003
michael@0 1004 /*
michael@0 1005 * NSS_CMSDigestedData_Encode_AfterData - do all the necessary things to a DigestedData
michael@0 1006 * after all the encapsulated data was passed through the encoder.
michael@0 1007 *
michael@0 1008 * In detail:
michael@0 1009 * - finish the digests
michael@0 1010 */
michael@0 1011 extern SECStatus
michael@0 1012 NSS_CMSDigestedData_Encode_AfterData(NSSCMSDigestedData *digd);
michael@0 1013
michael@0 1014 /*
michael@0 1015 * NSS_CMSDigestedData_Decode_BeforeData - do all the necessary things to a DigestedData
michael@0 1016 * before the encapsulated data is passed through the encoder.
michael@0 1017 *
michael@0 1018 * In detail:
michael@0 1019 * - set up the digests if necessary
michael@0 1020 */
michael@0 1021 extern SECStatus
michael@0 1022 NSS_CMSDigestedData_Decode_BeforeData(NSSCMSDigestedData *digd);
michael@0 1023
michael@0 1024 /*
michael@0 1025 * NSS_CMSDigestedData_Decode_AfterData - do all the necessary things to a DigestedData
michael@0 1026 * after all the encapsulated data was passed through the encoder.
michael@0 1027 *
michael@0 1028 * In detail:
michael@0 1029 * - finish the digests
michael@0 1030 */
michael@0 1031 extern SECStatus
michael@0 1032 NSS_CMSDigestedData_Decode_AfterData(NSSCMSDigestedData *digd);
michael@0 1033
michael@0 1034 /*
michael@0 1035 * NSS_CMSDigestedData_Decode_AfterEnd - finalize a digestedData.
michael@0 1036 *
michael@0 1037 * In detail:
michael@0 1038 * - check the digests for equality
michael@0 1039 */
michael@0 1040 extern SECStatus
michael@0 1041 NSS_CMSDigestedData_Decode_AfterEnd(NSSCMSDigestedData *digd);
michael@0 1042
michael@0 1043 /************************************************************************
michael@0 1044 * cmsdigest.c - digestion routines
michael@0 1045 ************************************************************************/
michael@0 1046
michael@0 1047 /*
michael@0 1048 * NSS_CMSDigestContext_StartMultiple - start digest calculation using all the
michael@0 1049 * digest algorithms in "digestalgs" in parallel.
michael@0 1050 */
michael@0 1051 extern NSSCMSDigestContext *
michael@0 1052 NSS_CMSDigestContext_StartMultiple(SECAlgorithmID **digestalgs);
michael@0 1053
michael@0 1054 /*
michael@0 1055 * NSS_CMSDigestContext_StartSingle - same as NSS_CMSDigestContext_StartMultiple, but
michael@0 1056 * only one algorithm.
michael@0 1057 */
michael@0 1058 extern NSSCMSDigestContext *
michael@0 1059 NSS_CMSDigestContext_StartSingle(SECAlgorithmID *digestalg);
michael@0 1060
michael@0 1061 /*
michael@0 1062 * NSS_CMSDigestContext_Update - feed more data into the digest machine
michael@0 1063 */
michael@0 1064 extern void
michael@0 1065 NSS_CMSDigestContext_Update(NSSCMSDigestContext *cmsdigcx, const unsigned char *data, int len);
michael@0 1066
michael@0 1067 /*
michael@0 1068 * NSS_CMSDigestContext_Cancel - cancel digesting operation
michael@0 1069 */
michael@0 1070 extern void
michael@0 1071 NSS_CMSDigestContext_Cancel(NSSCMSDigestContext *cmsdigcx);
michael@0 1072
michael@0 1073 /*
michael@0 1074 * NSS_CMSDigestContext_FinishMultiple - finish the digests and put them
michael@0 1075 * into an array of SECItems (allocated on poolp)
michael@0 1076 */
michael@0 1077 extern SECStatus
michael@0 1078 NSS_CMSDigestContext_FinishMultiple(NSSCMSDigestContext *cmsdigcx, PLArenaPool *poolp,
michael@0 1079 SECItem ***digestsp);
michael@0 1080
michael@0 1081 /*
michael@0 1082 * NSS_CMSDigestContext_FinishSingle - same as NSS_CMSDigestContext_FinishMultiple,
michael@0 1083 * but for one digest.
michael@0 1084 */
michael@0 1085 extern SECStatus
michael@0 1086 NSS_CMSDigestContext_FinishSingle(NSSCMSDigestContext *cmsdigcx, PLArenaPool *poolp,
michael@0 1087 SECItem *digest);
michael@0 1088
michael@0 1089 /************************************************************************
michael@0 1090 *
michael@0 1091 ************************************************************************/
michael@0 1092
michael@0 1093 /* shortcuts for basic use */
michael@0 1094
michael@0 1095 /*
michael@0 1096 * NSS_CMSDEREncode - DER Encode a CMS message, with input being
michael@0 1097 * the plaintext message and derOut being the output,
michael@0 1098 * stored in arena's pool.
michael@0 1099 */
michael@0 1100 extern SECStatus
michael@0 1101 NSS_CMSDEREncode(NSSCMSMessage *cmsg, SECItem *input, SECItem *derOut,
michael@0 1102 PLArenaPool *arena);
michael@0 1103
michael@0 1104
michael@0 1105 /************************************************************************
michael@0 1106 *
michael@0 1107 ************************************************************************/
michael@0 1108
michael@0 1109 /*
michael@0 1110 * define new S/MIME content type entries
michael@0 1111 *
michael@0 1112 * S/MIME uses the builtin PKCS7 oid types for encoding and decoding the
michael@0 1113 * various S/MIME content. Some applications have their own content type
michael@0 1114 * which is different from the standard content type defined by S/MIME.
michael@0 1115 *
michael@0 1116 * This function allows you to register new content types. There are basically
michael@0 1117 * Two different types of content, Wrappping content, and Data.
michael@0 1118 *
michael@0 1119 * For data types, All the functions below can be zero or NULL excext
michael@0 1120 * type and is isData, which should be your oid tag and PR_FALSE respectively
michael@0 1121 *
michael@0 1122 * For wrapping types, everything must be provided, or you will get encoder
michael@0 1123 * failures.
michael@0 1124 *
michael@0 1125 * If NSS doesn't already define the OID that you need, you can register
michael@0 1126 * your own with SECOID_AddEntry.
michael@0 1127 *
michael@0 1128 * Once you have defined your new content type, you can pass your new content
michael@0 1129 * type to NSS_CMSContentInfo_SetContent().
michael@0 1130 *
michael@0 1131 * If you are using a wrapping type you can pass your own data structure in
michael@0 1132 * the ptr field, but it must contain and embedded NSSCMSGenericWrappingData
michael@0 1133 * structure as the first element. The size you pass to
michael@0 1134 * NSS_CMSType_RegisterContentType is the total size of your self defined
michael@0 1135 * data structure. NSS_CMSContentInfo_GetContent will return that data
michael@0 1136 * structure from the content info. Your ASN1Template will be evaluated
michael@0 1137 * against that data structure.
michael@0 1138 */
michael@0 1139 SECStatus NSS_CMSType_RegisterContentType(SECOidTag type,
michael@0 1140 SEC_ASN1Template *asn1Template, size_t size,
michael@0 1141 NSSCMSGenericWrapperDataDestroy destroy,
michael@0 1142 NSSCMSGenericWrapperDataCallback decode_before,
michael@0 1143 NSSCMSGenericWrapperDataCallback decode_after,
michael@0 1144 NSSCMSGenericWrapperDataCallback decode_end,
michael@0 1145 NSSCMSGenericWrapperDataCallback encode_start,
michael@0 1146 NSSCMSGenericWrapperDataCallback encode_before,
michael@0 1147 NSSCMSGenericWrapperDataCallback encode_after,
michael@0 1148 PRBool isData);
michael@0 1149
michael@0 1150 /************************************************************************/
michael@0 1151 SEC_END_PROTOS
michael@0 1152
michael@0 1153 #endif /* _CMS_H_ */

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial