The Tor Browser: security/nss/lib/util/secoid.c@b8a032363ba2

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 /* This Source Code Form is subject to the terms of the Mozilla Public

     2  * License, v. 2.0. If a copy of the MPL was not distributed with this

     3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

     5 #include "secoid.h"

     6 #include "pkcs11t.h"

     7 #include "secitem.h"

     8 #include "secerr.h"

     9 #include "prenv.h"

    10 #include "plhash.h"

    11 #include "nssrwlk.h"

    12 #include "nssutil.h"

    14 /* Library identity and versioning */

    16 #if defined(DEBUG)

    17 #define _DEBUG_STRING " (debug)"

    18 #else

    19 #define _DEBUG_STRING ""

    20 #endif

    22 /*

    23  * Version information for the 'ident' and 'what commands

    24  *

    25  * NOTE: the first component of the concatenated rcsid string

    26  * must not end in a '$' to prevent rcs keyword substitution.

    27  */

    28 const char __nss_util_rcsid[] = "$Header: NSS " NSSUTIL_VERSION _DEBUG_STRING

    29         "  " __DATE__ " " __TIME__ " $";

    30 const char __nss_util_sccsid[] = "@(#)NSS " NSSUTIL_VERSION _DEBUG_STRING

    31         "  " __DATE__ " " __TIME__;

    33 /* MISSI Mosaic Object ID space */

    34 /* USGov algorithm OID space: { 2 16 840 1 101 } */

    35 #define USGOV                   0x60, 0x86, 0x48, 0x01, 0x65

    36 #define MISSI	                USGOV, 0x02, 0x01, 0x01

    37 #define MISSI_OLD_KEA_DSS	MISSI, 0x0c

    38 #define MISSI_OLD_DSS		MISSI, 0x02

    39 #define MISSI_KEA_DSS		MISSI, 0x14

    40 #define MISSI_DSS		MISSI, 0x13

    41 #define MISSI_KEA               MISSI, 0x0a

    42 #define MISSI_ALT_KEA           MISSI, 0x16

    44 #define NISTALGS    USGOV, 3, 4

    45 #define AES         NISTALGS, 1

    46 #define SHAXXX      NISTALGS, 2

    47 #define DSA2        NISTALGS, 3

    49 /**

    50  ** The Netscape OID space is allocated by Terry Hayes.  If you need

    51  ** a piece of the space, contact him at thayes@netscape.com.

    52  **/

    54 /* Netscape Communications Corporation Object ID space */

    55 /* { 2 16 840 1 113730 } */

    56 #define NETSCAPE_OID	          0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42

    57 #define NETSCAPE_CERT_EXT 	  NETSCAPE_OID, 0x01

    58 #define NETSCAPE_DATA_TYPE 	  NETSCAPE_OID, 0x02

    59 /* netscape directory oid - owned by Mark Smith (mcs@netscape.com) */

    60 #define NETSCAPE_DIRECTORY 	  NETSCAPE_OID, 0x03

    61 #define NETSCAPE_POLICY 	  NETSCAPE_OID, 0x04

    62 #define NETSCAPE_CERT_SERVER 	  NETSCAPE_OID, 0x05

    63 #define NETSCAPE_ALGS 		  NETSCAPE_OID, 0x06 /* algorithm OIDs */

    64 #define NETSCAPE_NAME_COMPONENTS  NETSCAPE_OID, 0x07

    66 #define NETSCAPE_CERT_EXT_AIA     NETSCAPE_CERT_EXT, 0x10

    67 #define NETSCAPE_CERT_SERVER_CRMF NETSCAPE_CERT_SERVER, 0x01

    69 /* these are old and should go away soon */

    70 #define OLD_NETSCAPE		0x60, 0x86, 0x48, 0xd8, 0x6a

    71 #define NS_CERT_EXT		OLD_NETSCAPE, 0x01

    72 #define NS_FILE_TYPE		OLD_NETSCAPE, 0x02

    73 #define NS_IMAGE_TYPE		OLD_NETSCAPE, 0x03

    75 /* RSA OID name space */

    76 #define RSADSI			0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d

    77 #define PKCS			RSADSI, 0x01

    78 #define DIGEST			RSADSI, 0x02

    79 #define CIPHER			RSADSI, 0x03

    80 #define PKCS1			PKCS, 0x01

    81 #define PKCS5			PKCS, 0x05

    82 #define PKCS7			PKCS, 0x07

    83 #define PKCS9			PKCS, 0x09

    84 #define PKCS12			PKCS, 0x0c

    86 /* Other OID name spaces */

    87 #define ALGORITHM		0x2b, 0x0e, 0x03, 0x02

    88 #define X500			0x55

    89 #define X520_ATTRIBUTE_TYPE	X500, 0x04

    90 #define X500_ALG		X500, 0x08

    91 #define X500_ALG_ENCRYPTION	X500_ALG, 0x01

    93 /** X.509 v3 Extension OID

    94  ** {joint-iso-ccitt (2) ds(5) 29}

    95  **/

    96 #define	ID_CE_OID 		X500, 0x1d

    98 #define RFC1274_ATTR_TYPE  0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x1

    99 /* #define RFC2247_ATTR_TYPE  0x09, 0x92, 0x26, 0xf5, 0x98, 0x1e, 0x64, 0x1 this is WRONG! */

   101 /* PKCS #12 name spaces */

   102 #define PKCS12_MODE_IDS		PKCS12, 0x01

   103 #define PKCS12_ESPVK_IDS	PKCS12, 0x02

   104 #define PKCS12_BAG_IDS		PKCS12, 0x03

   105 #define PKCS12_CERT_BAG_IDS	PKCS12, 0x04

   106 #define PKCS12_OIDS		PKCS12, 0x05

   107 #define PKCS12_PBE_IDS		PKCS12_OIDS, 0x01

   108 #define PKCS12_ENVELOPING_IDS	PKCS12_OIDS, 0x02

   109 #define PKCS12_SIGNATURE_IDS	PKCS12_OIDS, 0x03

   110 #define PKCS12_V2_PBE_IDS	PKCS12, 0x01

   111 #define PKCS9_CERT_TYPES	PKCS9, 0x16

   112 #define PKCS9_CRL_TYPES		PKCS9, 0x17

   113 #define PKCS9_SMIME_IDS		PKCS9, 0x10

   114 #define PKCS9_SMIME_ATTRS	PKCS9_SMIME_IDS, 2

   115 #define PKCS9_SMIME_ALGS	PKCS9_SMIME_IDS, 3

   116 #define PKCS12_VERSION1		PKCS12, 0x0a

   117 #define PKCS12_V1_BAG_IDS	PKCS12_VERSION1, 1

   119 /* for DSA algorithm */

   120 /* { iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) } */

   121 #define ANSI_X9_ALGORITHM  0x2a, 0x86, 0x48, 0xce, 0x38, 0x4

   123 /* for DH algorithm */

   124 /* { iso(1) member-body(2) us(840) x9-57(10046) number-type(2) } */

   125 /* need real OID person to look at this, copied the above line

   126  * and added 6 to second to last value (and changed '4' to '2' */

   127 #define ANSI_X942_ALGORITHM  0x2a, 0x86, 0x48, 0xce, 0x3e, 0x2

   129 #define VERISIGN 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x45

   131 #define PKIX 			0x2b, 0x06, 0x01, 0x05, 0x05, 0x07

   132 #define PKIX_CERT_EXTENSIONS    PKIX, 1

   133 #define PKIX_POLICY_QUALIFIERS  PKIX, 2

   134 #define PKIX_KEY_USAGE 		PKIX, 3

   135 #define PKIX_ACCESS_DESCRIPTION PKIX, 0x30

   136 #define PKIX_OCSP 		PKIX_ACCESS_DESCRIPTION, 1

   137 #define PKIX_CA_ISSUERS		PKIX_ACCESS_DESCRIPTION, 2

   139 #define PKIX_ID_PKIP     	PKIX, 5

   140 #define PKIX_ID_REGCTRL  	PKIX_ID_PKIP, 1

   141 #define PKIX_ID_REGINFO  	PKIX_ID_PKIP, 2

   143 /* Microsoft Object ID space */

   144 /* { 1.3.6.1.4.1.311 } */

   145 #define MICROSOFT_OID 0x2b, 0x6, 0x1, 0x4, 0x1, 0x82, 0x37

   146 #define EV_NAME_ATTRIBUTE 	MICROSOFT_OID, 60, 2, 1

   148 /* Microsoft Crypto 2.0 ID space */

   149 /* { 1.3.6.1.4.1.311.10 } */

   150 #define MS_CRYPTO_20            MICROSOFT_OID, 10

   151 /* Microsoft Crypto 2.0 Extended Key Usage ID space */

   152 /* { 1.3.6.1.4.1.311.10.3 } */

   153 #define MS_CRYPTO_EKU           MS_CRYPTO_20, 3

   155 #define CERTICOM_OID            0x2b, 0x81, 0x04

   156 #define SECG_OID                CERTICOM_OID, 0x00

   158 #define ANSI_X962_OID           0x2a, 0x86, 0x48, 0xce, 0x3d

   159 #define ANSI_X962_CURVE_OID     ANSI_X962_OID, 0x03

   160 #define ANSI_X962_GF2m_OID      ANSI_X962_CURVE_OID, 0x00

   161 #define ANSI_X962_GFp_OID       ANSI_X962_CURVE_OID, 0x01

   162 #define ANSI_X962_SIGNATURE_OID ANSI_X962_OID, 0x04

   163 #define ANSI_X962_SPECIFY_OID   ANSI_X962_SIGNATURE_OID, 0x03

   165 /* for Camellia: iso(1) member-body(2) jisc(392)

   166  *    mitsubishi(200011) isl(61) security(1) algorithm(1)

   167  */

   168 #define MITSUBISHI_ALG 0x2a,0x83,0x08,0x8c,0x9a,0x4b,0x3d,0x01,0x01

   169 #define CAMELLIA_ENCRYPT_OID MITSUBISHI_ALG,1

   170 #define CAMELLIA_WRAP_OID    MITSUBISHI_ALG,3

   172 /* for SEED : iso(1) member-body(2) korea(410)

   173  *    kisa(200004) algorithm(1)

   174  */

   175 #define SEED_OID		 0x2a,0x83,0x1a,0x8c,0x9a,0x44,0x01

   177 #define CONST_OID static const unsigned char

   179 CONST_OID md2[]        				= { DIGEST, 0x02 };

   180 CONST_OID md4[]        				= { DIGEST, 0x04 };

   181 CONST_OID md5[]        				= { DIGEST, 0x05 };

   182 CONST_OID hmac_sha1[]   			= { DIGEST, 7 };

   183 CONST_OID hmac_sha224[]				= { DIGEST, 8 };

   184 CONST_OID hmac_sha256[]				= { DIGEST, 9 };

   185 CONST_OID hmac_sha384[]				= { DIGEST, 10 };

   186 CONST_OID hmac_sha512[]				= { DIGEST, 11 };

   188 CONST_OID rc2cbc[]     				= { CIPHER, 0x02 };

   189 CONST_OID rc4[]        				= { CIPHER, 0x04 };

   190 CONST_OID desede3cbc[] 				= { CIPHER, 0x07 };

   191 CONST_OID rc5cbcpad[]  				= { CIPHER, 0x09 };

   193 CONST_OID desecb[]                           = { ALGORITHM, 0x06 };

   194 CONST_OID descbc[]                           = { ALGORITHM, 0x07 };

   195 CONST_OID desofb[]                           = { ALGORITHM, 0x08 };

   196 CONST_OID descfb[]                           = { ALGORITHM, 0x09 };

   197 CONST_OID desmac[]                           = { ALGORITHM, 0x0a };

   198 CONST_OID sdn702DSASignature[]               = { ALGORITHM, 0x0c };

   199 CONST_OID isoSHAWithRSASignature[]           = { ALGORITHM, 0x0f };

   200 CONST_OID desede[]                           = { ALGORITHM, 0x11 };

   201 CONST_OID sha1[]                             = { ALGORITHM, 0x1a };

   202 CONST_OID bogusDSASignaturewithSHA1Digest[]  = { ALGORITHM, 0x1b };

   203 CONST_OID isoSHA1WithRSASignature[]          = { ALGORITHM, 0x1d };

   205 CONST_OID pkcs1RSAEncryption[]         		= { PKCS1, 0x01 };

   206 CONST_OID pkcs1MD2WithRSAEncryption[]  		= { PKCS1, 0x02 };

   207 CONST_OID pkcs1MD4WithRSAEncryption[]  		= { PKCS1, 0x03 };

   208 CONST_OID pkcs1MD5WithRSAEncryption[]  		= { PKCS1, 0x04 };

   209 CONST_OID pkcs1SHA1WithRSAEncryption[] 		= { PKCS1, 0x05 };

   210 CONST_OID pkcs1RSAOAEPEncryption[]		= { PKCS1, 0x07 };

   211 CONST_OID pkcs1MGF1[]				= { PKCS1, 0x08 };

   212 CONST_OID pkcs1PSpecified[]			= { PKCS1, 0x09 };

   213 CONST_OID pkcs1RSAPSSSignature[]		= { PKCS1, 10 };

   214 CONST_OID pkcs1SHA256WithRSAEncryption[] 	= { PKCS1, 11 };

   215 CONST_OID pkcs1SHA384WithRSAEncryption[] 	= { PKCS1, 12 };

   216 CONST_OID pkcs1SHA512WithRSAEncryption[] 	= { PKCS1, 13 };

   217 CONST_OID pkcs1SHA224WithRSAEncryption[] 	= { PKCS1, 14 };

   219 CONST_OID pkcs5PbeWithMD2AndDEScbc[]  		= { PKCS5, 0x01 };

   220 CONST_OID pkcs5PbeWithMD5AndDEScbc[]  		= { PKCS5, 0x03 };

   221 CONST_OID pkcs5PbeWithSha1AndDEScbc[] 		= { PKCS5, 0x0a };

   222 CONST_OID pkcs5Pbkdf2[]  			= { PKCS5, 12 };

   223 CONST_OID pkcs5Pbes2[]  			= { PKCS5, 13 };

   224 CONST_OID pkcs5Pbmac1[]				= { PKCS5, 14 };

   226 CONST_OID pkcs7[]                     		= { PKCS7 };

   227 CONST_OID pkcs7Data[]                 		= { PKCS7, 0x01 };

   228 CONST_OID pkcs7SignedData[]           		= { PKCS7, 0x02 };

   229 CONST_OID pkcs7EnvelopedData[]        		= { PKCS7, 0x03 };

   230 CONST_OID pkcs7SignedEnvelopedData[]  		= { PKCS7, 0x04 };

   231 CONST_OID pkcs7DigestedData[]         		= { PKCS7, 0x05 };

   232 CONST_OID pkcs7EncryptedData[]        		= { PKCS7, 0x06 };

   234 CONST_OID pkcs9EmailAddress[]                  = { PKCS9, 0x01 };

   235 CONST_OID pkcs9UnstructuredName[]              = { PKCS9, 0x02 };

   236 CONST_OID pkcs9ContentType[]                   = { PKCS9, 0x03 };

   237 CONST_OID pkcs9MessageDigest[]                 = { PKCS9, 0x04 };

   238 CONST_OID pkcs9SigningTime[]                   = { PKCS9, 0x05 };

   239 CONST_OID pkcs9CounterSignature[]              = { PKCS9, 0x06 };

   240 CONST_OID pkcs9ChallengePassword[]             = { PKCS9, 0x07 };

   241 CONST_OID pkcs9UnstructuredAddress[]           = { PKCS9, 0x08 };

   242 CONST_OID pkcs9ExtendedCertificateAttributes[] = { PKCS9, 0x09 };

   243 CONST_OID pkcs9ExtensionRequest[]              = { PKCS9, 14 };

   244 CONST_OID pkcs9SMIMECapabilities[]             = { PKCS9, 15 };

   245 CONST_OID pkcs9FriendlyName[]                  = { PKCS9, 20 };

   246 CONST_OID pkcs9LocalKeyID[]                    = { PKCS9, 21 };

   248 CONST_OID pkcs9X509Certificate[]        	= { PKCS9_CERT_TYPES, 1 };

   249 CONST_OID pkcs9SDSICertificate[]        	= { PKCS9_CERT_TYPES, 2 };

   250 CONST_OID pkcs9X509CRL[]                	= { PKCS9_CRL_TYPES, 1 };

   252 /* RFC2630 (CMS) OIDs */

   253 CONST_OID cmsESDH[]     			= { PKCS9_SMIME_ALGS, 5 };

   254 CONST_OID cms3DESwrap[] 			= { PKCS9_SMIME_ALGS, 6 };

   255 CONST_OID cmsRC2wrap[]  			= { PKCS9_SMIME_ALGS, 7 };

   257 /* RFC2633 SMIME message attributes */

   258 CONST_OID smimeEncryptionKeyPreference[] 	= { PKCS9_SMIME_ATTRS, 11 };

   259 CONST_OID ms_smimeEncryptionKeyPreference[] 	= { MICROSOFT_OID, 0x10, 0x4 };

   261 CONST_OID x520CommonName[]                      = { X520_ATTRIBUTE_TYPE, 3 };

   262 CONST_OID x520SurName[]                         = { X520_ATTRIBUTE_TYPE, 4 };

   263 CONST_OID x520SerialNumber[]                    = { X520_ATTRIBUTE_TYPE, 5 };

   264 CONST_OID x520CountryName[]                     = { X520_ATTRIBUTE_TYPE, 6 };

   265 CONST_OID x520LocalityName[]                    = { X520_ATTRIBUTE_TYPE, 7 };

   266 CONST_OID x520StateOrProvinceName[]             = { X520_ATTRIBUTE_TYPE, 8 };

   267 CONST_OID x520StreetAddress[]                   = { X520_ATTRIBUTE_TYPE, 9 };

   268 CONST_OID x520OrgName[]                         = { X520_ATTRIBUTE_TYPE, 10 };

   269 CONST_OID x520OrgUnitName[]                     = { X520_ATTRIBUTE_TYPE, 11 };

   270 CONST_OID x520Title[]                           = { X520_ATTRIBUTE_TYPE, 12 };

   271 CONST_OID x520BusinessCategory[]                = { X520_ATTRIBUTE_TYPE, 15 };

   272 CONST_OID x520PostalAddress[]                   = { X520_ATTRIBUTE_TYPE, 16 };

   273 CONST_OID x520PostalCode[]                      = { X520_ATTRIBUTE_TYPE, 17 };

   274 CONST_OID x520PostOfficeBox[]                   = { X520_ATTRIBUTE_TYPE, 18 };

   275 CONST_OID x520Name[]                            = { X520_ATTRIBUTE_TYPE, 41 };

   276 CONST_OID x520GivenName[]                       = { X520_ATTRIBUTE_TYPE, 42 };

   277 CONST_OID x520Initials[]                        = { X520_ATTRIBUTE_TYPE, 43 };

   278 CONST_OID x520GenerationQualifier[]             = { X520_ATTRIBUTE_TYPE, 44 };

   279 CONST_OID x520DnQualifier[]                     = { X520_ATTRIBUTE_TYPE, 46 };

   280 CONST_OID x520HouseIdentifier[]                 = { X520_ATTRIBUTE_TYPE, 51 };

   281 CONST_OID x520Pseudonym[]                       = { X520_ATTRIBUTE_TYPE, 65 };

   283 CONST_OID nsTypeGIF[]          			= { NETSCAPE_DATA_TYPE, 0x01 };

   284 CONST_OID nsTypeJPEG[]         			= { NETSCAPE_DATA_TYPE, 0x02 };

   285 CONST_OID nsTypeURL[]          			= { NETSCAPE_DATA_TYPE, 0x03 };

   286 CONST_OID nsTypeHTML[]         			= { NETSCAPE_DATA_TYPE, 0x04 };

   287 CONST_OID nsTypeCertSeq[]      			= { NETSCAPE_DATA_TYPE, 0x05 };

   289 CONST_OID missiCertKEADSSOld[] 			= { MISSI_OLD_KEA_DSS };

   290 CONST_OID missiCertDSSOld[]    			= { MISSI_OLD_DSS };

   291 CONST_OID missiCertKEADSS[]    			= { MISSI_KEA_DSS };

   292 CONST_OID missiCertDSS[]       			= { MISSI_DSS };

   293 CONST_OID missiCertKEA[]       			= { MISSI_KEA };

   294 CONST_OID missiCertAltKEA[]    			= { MISSI_ALT_KEA };

   295 CONST_OID x500RSAEncryption[]  			= { X500_ALG_ENCRYPTION, 0x01 };

   297 /* added for alg 1485 */

   298 CONST_OID rfc1274Uid[]             		= { RFC1274_ATTR_TYPE, 1 };

   299 CONST_OID rfc1274Mail[]            		= { RFC1274_ATTR_TYPE, 3 };

   300 CONST_OID rfc2247DomainComponent[] 		= { RFC1274_ATTR_TYPE, 25 };

   302 /* Netscape private certificate extensions */

   303 CONST_OID nsCertExtNetscapeOK[]  		= { NS_CERT_EXT, 1 };

   304 CONST_OID nsCertExtIssuerLogo[]  		= { NS_CERT_EXT, 2 };

   305 CONST_OID nsCertExtSubjectLogo[] 		= { NS_CERT_EXT, 3 };

   306 CONST_OID nsExtCertType[]        		= { NETSCAPE_CERT_EXT, 0x01 };

   307 CONST_OID nsExtBaseURL[]         		= { NETSCAPE_CERT_EXT, 0x02 };

   308 CONST_OID nsExtRevocationURL[]   		= { NETSCAPE_CERT_EXT, 0x03 };

   309 CONST_OID nsExtCARevocationURL[] 		= { NETSCAPE_CERT_EXT, 0x04 };

   310 CONST_OID nsExtCACRLURL[]        		= { NETSCAPE_CERT_EXT, 0x05 };

   311 CONST_OID nsExtCACertURL[]       		= { NETSCAPE_CERT_EXT, 0x06 };

   312 CONST_OID nsExtCertRenewalURL[]  		= { NETSCAPE_CERT_EXT, 0x07 };

   313 CONST_OID nsExtCAPolicyURL[]     		= { NETSCAPE_CERT_EXT, 0x08 };

   314 CONST_OID nsExtHomepageURL[]     		= { NETSCAPE_CERT_EXT, 0x09 };

   315 CONST_OID nsExtEntityLogo[]      		= { NETSCAPE_CERT_EXT, 0x0a };

   316 CONST_OID nsExtUserPicture[]     		= { NETSCAPE_CERT_EXT, 0x0b };

   317 CONST_OID nsExtSSLServerName[]   		= { NETSCAPE_CERT_EXT, 0x0c };

   318 CONST_OID nsExtComment[]         		= { NETSCAPE_CERT_EXT, 0x0d };

   320 /* the following 2 extensions are defined for and used by Cartman(NSM) */

   321 CONST_OID nsExtLostPasswordURL[] 		= { NETSCAPE_CERT_EXT, 0x0e };

   322 CONST_OID nsExtCertRenewalTime[] 		= { NETSCAPE_CERT_EXT, 0x0f };

   324 CONST_OID nsExtAIACertRenewal[]    	= { NETSCAPE_CERT_EXT_AIA, 0x01 };

   325 CONST_OID nsExtCertScopeOfUse[]    	= { NETSCAPE_CERT_EXT, 0x11 };

   326 /* Reserved Netscape (2 16 840 1 113730 1 18) = { NETSCAPE_CERT_EXT, 0x12 }; */

   328 /* Netscape policy values */

   329 CONST_OID nsKeyUsageGovtApproved[] 	= { NETSCAPE_POLICY, 0x01 };

   331 /* Netscape other name types */

   332 CONST_OID netscapeNickname[] 		= { NETSCAPE_NAME_COMPONENTS, 0x01 };

   333 CONST_OID netscapeAOLScreenname[] 	= { NETSCAPE_NAME_COMPONENTS, 0x02 };

   335 /* OIDs needed for cert server */

   336 CONST_OID netscapeRecoveryRequest[] 	= { NETSCAPE_CERT_SERVER_CRMF, 0x01 };

   339 /* Standard x.509 v3 Certificate & CRL Extensions */

   340 CONST_OID x509SubjectDirectoryAttr[]  		= { ID_CE_OID,  9 };

   341 CONST_OID x509SubjectKeyID[]          		= { ID_CE_OID, 14 };

   342 CONST_OID x509KeyUsage[]              		= { ID_CE_OID, 15 };

   343 CONST_OID x509PrivateKeyUsagePeriod[] 		= { ID_CE_OID, 16 };

   344 CONST_OID x509SubjectAltName[]        		= { ID_CE_OID, 17 };

   345 CONST_OID x509IssuerAltName[]         		= { ID_CE_OID, 18 };

   346 CONST_OID x509BasicConstraints[]      		= { ID_CE_OID, 19 };

   347 CONST_OID x509CRLNumber[]                    	= { ID_CE_OID, 20 };

   348 CONST_OID x509ReasonCode[]                   	= { ID_CE_OID, 21 };

   349 CONST_OID x509HoldInstructionCode[]             = { ID_CE_OID, 23 };

   350 CONST_OID x509InvalidDate[]                     = { ID_CE_OID, 24 };

   351 CONST_OID x509DeltaCRLIndicator[]               = { ID_CE_OID, 27 };

   352 CONST_OID x509IssuingDistributionPoint[]        = { ID_CE_OID, 28 };

   353 CONST_OID x509CertIssuer[]                      = { ID_CE_OID, 29 };

   354 CONST_OID x509NameConstraints[]       		= { ID_CE_OID, 30 };

   355 CONST_OID x509CRLDistPoints[]         		= { ID_CE_OID, 31 };

   356 CONST_OID x509CertificatePolicies[]   		= { ID_CE_OID, 32 };

   357 CONST_OID x509PolicyMappings[]        		= { ID_CE_OID, 33 };

   358 CONST_OID x509AuthKeyID[]             		= { ID_CE_OID, 35 };

   359 CONST_OID x509PolicyConstraints[]     		= { ID_CE_OID, 36 };

   360 CONST_OID x509ExtKeyUsage[]           		= { ID_CE_OID, 37 };

   361 CONST_OID x509FreshestCRL[]           		= { ID_CE_OID, 46 };

   362 CONST_OID x509InhibitAnyPolicy[]           	= { ID_CE_OID, 54 };

   364 CONST_OID x509CertificatePoliciesAnyPolicy[]    = { ID_CE_OID, 32, 0 };

   366 CONST_OID x509AuthInfoAccess[]        		= { PKIX_CERT_EXTENSIONS,  1 };

   367 CONST_OID x509SubjectInfoAccess[]               = { PKIX_CERT_EXTENSIONS, 11 };

   369 CONST_OID x509SIATimeStamping[]                 = {PKIX_ACCESS_DESCRIPTION, 0x03};

   370 CONST_OID x509SIACaRepository[]                 = {PKIX_ACCESS_DESCRIPTION, 0x05};

   372 /* pkcs 12 additions */

   373 CONST_OID pkcs12[]                           = { PKCS12 };

   374 CONST_OID pkcs12ModeIDs[]                    = { PKCS12_MODE_IDS };

   375 CONST_OID pkcs12ESPVKIDs[]                   = { PKCS12_ESPVK_IDS };

   376 CONST_OID pkcs12BagIDs[]                     = { PKCS12_BAG_IDS };

   377 CONST_OID pkcs12CertBagIDs[]                 = { PKCS12_CERT_BAG_IDS };

   378 CONST_OID pkcs12OIDs[]                       = { PKCS12_OIDS };

   379 CONST_OID pkcs12PBEIDs[]                     = { PKCS12_PBE_IDS };

   380 CONST_OID pkcs12EnvelopingIDs[]              = { PKCS12_ENVELOPING_IDS };

   381 CONST_OID pkcs12SignatureIDs[]               = { PKCS12_SIGNATURE_IDS };

   382 CONST_OID pkcs12PKCS8KeyShrouding[]          = { PKCS12_ESPVK_IDS, 0x01 };

   383 CONST_OID pkcs12KeyBagID[]                   = { PKCS12_BAG_IDS, 0x01 };

   384 CONST_OID pkcs12CertAndCRLBagID[]            = { PKCS12_BAG_IDS, 0x02 };

   385 CONST_OID pkcs12SecretBagID[]                = { PKCS12_BAG_IDS, 0x03 };

   386 CONST_OID pkcs12X509CertCRLBag[]             = { PKCS12_CERT_BAG_IDS, 0x01 };

   387 CONST_OID pkcs12SDSICertBag[]                = { PKCS12_CERT_BAG_IDS, 0x02 };

   388 CONST_OID pkcs12PBEWithSha1And128BitRC4[]    = { PKCS12_PBE_IDS, 0x01 };

   389 CONST_OID pkcs12PBEWithSha1And40BitRC4[]     = { PKCS12_PBE_IDS, 0x02 };

   390 CONST_OID pkcs12PBEWithSha1AndTripleDESCBC[] = { PKCS12_PBE_IDS, 0x03 };

   391 CONST_OID pkcs12PBEWithSha1And128BitRC2CBC[] = { PKCS12_PBE_IDS, 0x04 };

   392 CONST_OID pkcs12PBEWithSha1And40BitRC2CBC[]  = { PKCS12_PBE_IDS, 0x05 };

   393 CONST_OID pkcs12RSAEncryptionWith128BitRC4[] = { PKCS12_ENVELOPING_IDS, 0x01 };

   394 CONST_OID pkcs12RSAEncryptionWith40BitRC4[]  = { PKCS12_ENVELOPING_IDS, 0x02 };

   395 CONST_OID pkcs12RSAEncryptionWithTripleDES[] = { PKCS12_ENVELOPING_IDS, 0x03 };

   396 CONST_OID pkcs12RSASignatureWithSHA1Digest[] = { PKCS12_SIGNATURE_IDS, 0x01 };

   398 /* pkcs 12 version 1.0 ids */

   399 CONST_OID pkcs12V2PBEWithSha1And128BitRC4[]       = { PKCS12_V2_PBE_IDS, 0x01 };

   400 CONST_OID pkcs12V2PBEWithSha1And40BitRC4[]        = { PKCS12_V2_PBE_IDS, 0x02 };

   401 CONST_OID pkcs12V2PBEWithSha1And3KeyTripleDEScbc[]= { PKCS12_V2_PBE_IDS, 0x03 };

   402 CONST_OID pkcs12V2PBEWithSha1And2KeyTripleDEScbc[]= { PKCS12_V2_PBE_IDS, 0x04 };

   403 CONST_OID pkcs12V2PBEWithSha1And128BitRC2cbc[]    = { PKCS12_V2_PBE_IDS, 0x05 };

   404 CONST_OID pkcs12V2PBEWithSha1And40BitRC2cbc[]     = { PKCS12_V2_PBE_IDS, 0x06 };

   406 CONST_OID pkcs12SafeContentsID[]                  = { PKCS12_BAG_IDS, 0x04 };

   407 CONST_OID pkcs12PKCS8ShroudedKeyBagID[]           = { PKCS12_BAG_IDS, 0x05 };

   409 CONST_OID pkcs12V1KeyBag[]              	= { PKCS12_V1_BAG_IDS, 0x01 };

   410 CONST_OID pkcs12V1PKCS8ShroudedKeyBag[] 	= { PKCS12_V1_BAG_IDS, 0x02 };

   411 CONST_OID pkcs12V1CertBag[]             	= { PKCS12_V1_BAG_IDS, 0x03 };

   412 CONST_OID pkcs12V1CRLBag[]              	= { PKCS12_V1_BAG_IDS, 0x04 };

   413 CONST_OID pkcs12V1SecretBag[]           	= { PKCS12_V1_BAG_IDS, 0x05 };

   414 CONST_OID pkcs12V1SafeContentsBag[]     	= { PKCS12_V1_BAG_IDS, 0x06 };

   416 /* The following encoding is INCORRECT, but correcting it would create a

   417  * duplicate OID in the table.  So, we will leave it alone.

   418  */

   419 CONST_OID pkcs12KeyUsageAttr[]          	= { 2, 5, 29, 15 };

   421 CONST_OID ansix9DSASignature[]               	= { ANSI_X9_ALGORITHM, 0x01 };

   422 CONST_OID ansix9DSASignaturewithSHA1Digest[] 	= { ANSI_X9_ALGORITHM, 0x03 };

   423 CONST_OID nistDSASignaturewithSHA224Digest[]	= { DSA2, 0x01 };

   424 CONST_OID nistDSASignaturewithSHA256Digest[]	= { DSA2, 0x02 };

   426 /* verisign OIDs */

   427 CONST_OID verisignUserNotices[]     		= { VERISIGN, 1, 7, 1, 1 };

   429 /* pkix OIDs */

   430 CONST_OID pkixCPSPointerQualifier[] 		= { PKIX_POLICY_QUALIFIERS, 1 };

   431 CONST_OID pkixUserNoticeQualifier[] 		= { PKIX_POLICY_QUALIFIERS, 2 };

   433 CONST_OID pkixOCSP[]				= { PKIX_OCSP };

   434 CONST_OID pkixOCSPBasicResponse[]		= { PKIX_OCSP, 1 };

   435 CONST_OID pkixOCSPNonce[]			= { PKIX_OCSP, 2 };

   436 CONST_OID pkixOCSPCRL[] 			= { PKIX_OCSP, 3 };

   437 CONST_OID pkixOCSPResponse[]			= { PKIX_OCSP, 4 };

   438 CONST_OID pkixOCSPNoCheck[]			= { PKIX_OCSP, 5 };

   439 CONST_OID pkixOCSPArchiveCutoff[]		= { PKIX_OCSP, 6 };

   440 CONST_OID pkixOCSPServiceLocator[]		= { PKIX_OCSP, 7 };

   442 CONST_OID pkixCAIssuers[]			= { PKIX_CA_ISSUERS };

   444 CONST_OID pkixRegCtrlRegToken[]       		= { PKIX_ID_REGCTRL, 1};

   445 CONST_OID pkixRegCtrlAuthenticator[]  		= { PKIX_ID_REGCTRL, 2};

   446 CONST_OID pkixRegCtrlPKIPubInfo[]     		= { PKIX_ID_REGCTRL, 3};

   447 CONST_OID pkixRegCtrlPKIArchOptions[] 		= { PKIX_ID_REGCTRL, 4};

   448 CONST_OID pkixRegCtrlOldCertID[]      		= { PKIX_ID_REGCTRL, 5};

   449 CONST_OID pkixRegCtrlProtEncKey[]     		= { PKIX_ID_REGCTRL, 6};

   450 CONST_OID pkixRegInfoUTF8Pairs[]      		= { PKIX_ID_REGINFO, 1};

   451 CONST_OID pkixRegInfoCertReq[]        		= { PKIX_ID_REGINFO, 2};

   453 CONST_OID pkixExtendedKeyUsageServerAuth[]    	= { PKIX_KEY_USAGE, 1 };

   454 CONST_OID pkixExtendedKeyUsageClientAuth[]    	= { PKIX_KEY_USAGE, 2 };

   455 CONST_OID pkixExtendedKeyUsageCodeSign[]      	= { PKIX_KEY_USAGE, 3 };

   456 CONST_OID pkixExtendedKeyUsageEMailProtect[]  	= { PKIX_KEY_USAGE, 4 };

   457 CONST_OID pkixExtendedKeyUsageTimeStamp[]     	= { PKIX_KEY_USAGE, 8 };

   458 CONST_OID pkixOCSPResponderExtendedKeyUsage[] 	= { PKIX_KEY_USAGE, 9 };

   459 CONST_OID msExtendedKeyUsageTrustListSigning[]	= { MS_CRYPTO_EKU, 1 };

   461 /* OIDs for Netscape defined algorithms */

   462 CONST_OID netscapeSMimeKEA[] 			= { NETSCAPE_ALGS, 0x01 };

   464 /* Fortezza algorithm OIDs */

   465 CONST_OID skipjackCBC[] 			= { MISSI, 0x04 };

   466 CONST_OID dhPublicKey[] 			= { ANSI_X942_ALGORITHM, 0x1 };

   468 CONST_OID aes128_ECB[] 				= { AES, 1 };

   469 CONST_OID aes128_CBC[] 				= { AES, 2 };

   470 #ifdef DEFINE_ALL_AES_CIPHERS

   471 CONST_OID aes128_OFB[] 				= { AES, 3 };

   472 CONST_OID aes128_CFB[] 				= { AES, 4 };

   473 #endif

   474 CONST_OID aes128_KEY_WRAP[]			= { AES, 5 };

   476 CONST_OID aes192_ECB[] 				= { AES, 21 };

   477 CONST_OID aes192_CBC[] 				= { AES, 22 };

   478 #ifdef DEFINE_ALL_AES_CIPHERS

   479 CONST_OID aes192_OFB[] 				= { AES, 23 };

   480 CONST_OID aes192_CFB[] 				= { AES, 24 };

   481 #endif

   482 CONST_OID aes192_KEY_WRAP[]			= { AES, 25 };

   484 CONST_OID aes256_ECB[] 				= { AES, 41 };

   485 CONST_OID aes256_CBC[] 				= { AES, 42 };

   486 #ifdef DEFINE_ALL_AES_CIPHERS

   487 CONST_OID aes256_OFB[] 				= { AES, 43 };

   488 CONST_OID aes256_CFB[] 				= { AES, 44 };

   489 #endif

   490 CONST_OID aes256_KEY_WRAP[]			= { AES, 45 };

   492 CONST_OID camellia128_CBC[]			= { CAMELLIA_ENCRYPT_OID, 2};

   493 CONST_OID camellia192_CBC[]			= { CAMELLIA_ENCRYPT_OID, 3};

   494 CONST_OID camellia256_CBC[]			= { CAMELLIA_ENCRYPT_OID, 4};

   495 CONST_OID camellia128_KEY_WRAP[]		= { CAMELLIA_WRAP_OID, 2};

   496 CONST_OID camellia192_KEY_WRAP[]		= { CAMELLIA_WRAP_OID, 3};

   497 CONST_OID camellia256_KEY_WRAP[]		= { CAMELLIA_WRAP_OID, 4};

   499 CONST_OID sha256[]                              = { SHAXXX, 1 };

   500 CONST_OID sha384[]                              = { SHAXXX, 2 };

   501 CONST_OID sha512[]                              = { SHAXXX, 3 };

   502 CONST_OID sha224[]                              = { SHAXXX, 4 };

   504 CONST_OID ansix962ECPublicKey[]             = { ANSI_X962_OID, 0x02, 0x01 };

   505 CONST_OID ansix962SignaturewithSHA1Digest[] = { ANSI_X962_SIGNATURE_OID, 0x01 };

   506 CONST_OID ansix962SignatureRecommended[]    = { ANSI_X962_SIGNATURE_OID, 0x02 };

   507 CONST_OID ansix962SignatureSpecified[]      = { ANSI_X962_SPECIFY_OID };

   508 CONST_OID ansix962SignaturewithSHA224Digest[] = { ANSI_X962_SPECIFY_OID, 0x01 };

   509 CONST_OID ansix962SignaturewithSHA256Digest[] = { ANSI_X962_SPECIFY_OID, 0x02 };

   510 CONST_OID ansix962SignaturewithSHA384Digest[] = { ANSI_X962_SPECIFY_OID, 0x03 };

   511 CONST_OID ansix962SignaturewithSHA512Digest[] = { ANSI_X962_SPECIFY_OID, 0x04 };

   513 /* ANSI X9.62 prime curve OIDs */

   514 /* NOTE: prime192v1 is the same as secp192r1, prime256v1 is the

   515  * same as secp256r1

   516  */

   517 CONST_OID ansiX962prime192v1[] = { ANSI_X962_GFp_OID, 0x01 };

   518 CONST_OID ansiX962prime192v2[] = { ANSI_X962_GFp_OID, 0x02 };

   519 CONST_OID ansiX962prime192v3[] = { ANSI_X962_GFp_OID, 0x03 };

   520 CONST_OID ansiX962prime239v1[] = { ANSI_X962_GFp_OID, 0x04 };

   521 CONST_OID ansiX962prime239v2[] = { ANSI_X962_GFp_OID, 0x05 };

   522 CONST_OID ansiX962prime239v3[] = { ANSI_X962_GFp_OID, 0x06 };

   523 CONST_OID ansiX962prime256v1[] = { ANSI_X962_GFp_OID, 0x07 };

   525 /* SECG prime curve OIDs */

   526 CONST_OID secgECsecp112r1[] = { SECG_OID, 0x06 };

   527 CONST_OID secgECsecp112r2[] = { SECG_OID, 0x07 };

   528 CONST_OID secgECsecp128r1[] = { SECG_OID, 0x1c };

   529 CONST_OID secgECsecp128r2[] = { SECG_OID, 0x1d };

   530 CONST_OID secgECsecp160k1[] = { SECG_OID, 0x09 };

   531 CONST_OID secgECsecp160r1[] = { SECG_OID, 0x08 };

   532 CONST_OID secgECsecp160r2[] = { SECG_OID, 0x1e };

   533 CONST_OID secgECsecp192k1[] = { SECG_OID, 0x1f };

   534 CONST_OID secgECsecp224k1[] = { SECG_OID, 0x20 };

   535 CONST_OID secgECsecp224r1[] = { SECG_OID, 0x21 };

   536 CONST_OID secgECsecp256k1[] = { SECG_OID, 0x0a };

   537 CONST_OID secgECsecp384r1[] = { SECG_OID, 0x22 };

   538 CONST_OID secgECsecp521r1[] = { SECG_OID, 0x23 };

   540 /* ANSI X9.62 characteristic two curve OIDs */

   541 CONST_OID ansiX962c2pnb163v1[] = { ANSI_X962_GF2m_OID, 0x01 };

   542 CONST_OID ansiX962c2pnb163v2[] = { ANSI_X962_GF2m_OID, 0x02 };

   543 CONST_OID ansiX962c2pnb163v3[] = { ANSI_X962_GF2m_OID, 0x03 };

   544 CONST_OID ansiX962c2pnb176v1[] = { ANSI_X962_GF2m_OID, 0x04 };

   545 CONST_OID ansiX962c2tnb191v1[] = { ANSI_X962_GF2m_OID, 0x05 };

   546 CONST_OID ansiX962c2tnb191v2[] = { ANSI_X962_GF2m_OID, 0x06 };

   547 CONST_OID ansiX962c2tnb191v3[] = { ANSI_X962_GF2m_OID, 0x07 };

   548 CONST_OID ansiX962c2onb191v4[] = { ANSI_X962_GF2m_OID, 0x08 };

   549 CONST_OID ansiX962c2onb191v5[] = { ANSI_X962_GF2m_OID, 0x09 };

   550 CONST_OID ansiX962c2pnb208w1[] = { ANSI_X962_GF2m_OID, 0x0a };

   551 CONST_OID ansiX962c2tnb239v1[] = { ANSI_X962_GF2m_OID, 0x0b };

   552 CONST_OID ansiX962c2tnb239v2[] = { ANSI_X962_GF2m_OID, 0x0c };

   553 CONST_OID ansiX962c2tnb239v3[] = { ANSI_X962_GF2m_OID, 0x0d };

   554 CONST_OID ansiX962c2onb239v4[] = { ANSI_X962_GF2m_OID, 0x0e };

   555 CONST_OID ansiX962c2onb239v5[] = { ANSI_X962_GF2m_OID, 0x0f };

   556 CONST_OID ansiX962c2pnb272w1[] = { ANSI_X962_GF2m_OID, 0x10 };

   557 CONST_OID ansiX962c2pnb304w1[] = { ANSI_X962_GF2m_OID, 0x11 };

   558 CONST_OID ansiX962c2tnb359v1[] = { ANSI_X962_GF2m_OID, 0x12 };

   559 CONST_OID ansiX962c2pnb368w1[] = { ANSI_X962_GF2m_OID, 0x13 };

   560 CONST_OID ansiX962c2tnb431r1[] = { ANSI_X962_GF2m_OID, 0x14 };

   562 /* SECG characterisitic two curve OIDs */

   563 CONST_OID secgECsect113r1[] = {SECG_OID, 0x04 };

   564 CONST_OID secgECsect113r2[] = {SECG_OID, 0x05 };

   565 CONST_OID secgECsect131r1[] = {SECG_OID, 0x16 };

   566 CONST_OID secgECsect131r2[] = {SECG_OID, 0x17 };

   567 CONST_OID secgECsect163k1[] = {SECG_OID, 0x01 };

   568 CONST_OID secgECsect163r1[] = {SECG_OID, 0x02 };

   569 CONST_OID secgECsect163r2[] = {SECG_OID, 0x0f };

   570 CONST_OID secgECsect193r1[] = {SECG_OID, 0x18 };

   571 CONST_OID secgECsect193r2[] = {SECG_OID, 0x19 };

   572 CONST_OID secgECsect233k1[] = {SECG_OID, 0x1a };

   573 CONST_OID secgECsect233r1[] = {SECG_OID, 0x1b };

   574 CONST_OID secgECsect239k1[] = {SECG_OID, 0x03 };

   575 CONST_OID secgECsect283k1[] = {SECG_OID, 0x10 };

   576 CONST_OID secgECsect283r1[] = {SECG_OID, 0x11 };

   577 CONST_OID secgECsect409k1[] = {SECG_OID, 0x24 };

   578 CONST_OID secgECsect409r1[] = {SECG_OID, 0x25 };

   579 CONST_OID secgECsect571k1[] = {SECG_OID, 0x26 };

   580 CONST_OID secgECsect571r1[] = {SECG_OID, 0x27 };

   582 CONST_OID seed_CBC[]				= { SEED_OID, 4 };

   584 CONST_OID evIncorporationLocality[]     = { EV_NAME_ATTRIBUTE, 1 };

   585 CONST_OID evIncorporationState[]        = { EV_NAME_ATTRIBUTE, 2 };

   586 CONST_OID evIncorporationCountry[]      = { EV_NAME_ATTRIBUTE, 3 };

   588 #define OI(x) { siDEROID, (unsigned char *)x, sizeof x }

   589 #ifndef SECOID_NO_STRINGS

   590 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, desc, mech, ext }

   591 #else

   592 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, 0, mech, ext }

   593 #endif

   595 #if defined(NSS_ALLOW_UNSUPPORTED_CRITICAL)

   596 #define FAKE_SUPPORTED_CERT_EXTENSION   SUPPORTED_CERT_EXTENSION

   597 #else

   598 #define FAKE_SUPPORTED_CERT_EXTENSION UNSUPPORTED_CERT_EXTENSION

   599 #endif

   601 /*

   602  * NOTE: the order of these entries must mach the SECOidTag enum in secoidt.h!

   603  */

   604 const static SECOidData oids[SEC_OID_TOTAL] = {

   605     { { siDEROID, NULL, 0 }, SEC_OID_UNKNOWN,

   606 	"Unknown OID", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION },

   607     OD( md2, SEC_OID_MD2, "MD2", CKM_MD2, INVALID_CERT_EXTENSION ),

   608     OD( md4, SEC_OID_MD4,

   609 	"MD4", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   610     OD( md5, SEC_OID_MD5, "MD5", CKM_MD5, INVALID_CERT_EXTENSION ),

   611     OD( sha1, SEC_OID_SHA1, "SHA-1", CKM_SHA_1, INVALID_CERT_EXTENSION ),

   612     OD( rc2cbc, SEC_OID_RC2_CBC,

   613 	"RC2-CBC", CKM_RC2_CBC, INVALID_CERT_EXTENSION ),

   614     OD( rc4, SEC_OID_RC4, "RC4", CKM_RC4, INVALID_CERT_EXTENSION ),

   615     OD( desede3cbc, SEC_OID_DES_EDE3_CBC,

   616 	"DES-EDE3-CBC", CKM_DES3_CBC, INVALID_CERT_EXTENSION ),

   617     OD( rc5cbcpad, SEC_OID_RC5_CBC_PAD,

   618 	"RC5-CBCPad", CKM_RC5_CBC, INVALID_CERT_EXTENSION ),

   619     OD( desecb, SEC_OID_DES_ECB,

   620 	"DES-ECB", CKM_DES_ECB, INVALID_CERT_EXTENSION ),

   621     OD( descbc, SEC_OID_DES_CBC,

   622 	"DES-CBC", CKM_DES_CBC, INVALID_CERT_EXTENSION ),

   623     OD( desofb, SEC_OID_DES_OFB,

   624 	"DES-OFB", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   625     OD( descfb, SEC_OID_DES_CFB,

   626 	"DES-CFB", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   627     OD( desmac, SEC_OID_DES_MAC,

   628 	"DES-MAC", CKM_DES_MAC, INVALID_CERT_EXTENSION ),

   629     OD( desede, SEC_OID_DES_EDE,

   630 	"DES-EDE", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   631     OD( isoSHAWithRSASignature, SEC_OID_ISO_SHA_WITH_RSA_SIGNATURE,

   632 	"ISO SHA with RSA Signature",

   633 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   634     OD( pkcs1RSAEncryption, SEC_OID_PKCS1_RSA_ENCRYPTION,

   635 	"PKCS #1 RSA Encryption", CKM_RSA_PKCS, INVALID_CERT_EXTENSION ),

   637     /* the following Signing mechanisms should get new CKM_ values when

   638      * values for CKM_RSA_WITH_MDX and CKM_RSA_WITH_SHA_1 get defined in

   639      * PKCS #11.

   640      */

   641     OD( pkcs1MD2WithRSAEncryption, SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION,

   642 	"PKCS #1 MD2 With RSA Encryption", CKM_MD2_RSA_PKCS,

   643 	INVALID_CERT_EXTENSION ),

   644     OD( pkcs1MD4WithRSAEncryption, SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION,

   645 	"PKCS #1 MD4 With RSA Encryption",

   646 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   647     OD( pkcs1MD5WithRSAEncryption, SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION,

   648 	"PKCS #1 MD5 With RSA Encryption", CKM_MD5_RSA_PKCS,

   649 	INVALID_CERT_EXTENSION ),

   650     OD( pkcs1SHA1WithRSAEncryption, SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION,

   651 	"PKCS #1 SHA-1 With RSA Encryption", CKM_SHA1_RSA_PKCS,

   652 	INVALID_CERT_EXTENSION ),

   654     OD( pkcs5PbeWithMD2AndDEScbc, SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC,

   655 	"PKCS #5 Password Based Encryption with MD2 and DES-CBC",

   656 	CKM_PBE_MD2_DES_CBC, INVALID_CERT_EXTENSION ),

   657     OD( pkcs5PbeWithMD5AndDEScbc, SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC,

   658 	"PKCS #5 Password Based Encryption with MD5 and DES-CBC",

   659 	CKM_PBE_MD5_DES_CBC, INVALID_CERT_EXTENSION ),

   660     OD( pkcs5PbeWithSha1AndDEScbc, SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC,

   661 	"PKCS #5 Password Based Encryption with SHA-1 and DES-CBC",

   662 	CKM_NETSCAPE_PBE_SHA1_DES_CBC, INVALID_CERT_EXTENSION ),

   663     OD( pkcs7, SEC_OID_PKCS7,

   664 	"PKCS #7", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   665     OD( pkcs7Data, SEC_OID_PKCS7_DATA,

   666 	"PKCS #7 Data", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   667     OD( pkcs7SignedData, SEC_OID_PKCS7_SIGNED_DATA,

   668 	"PKCS #7 Signed Data", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   669     OD( pkcs7EnvelopedData, SEC_OID_PKCS7_ENVELOPED_DATA,

   670 	"PKCS #7 Enveloped Data",

   671 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   672     OD( pkcs7SignedEnvelopedData, SEC_OID_PKCS7_SIGNED_ENVELOPED_DATA,

   673 	"PKCS #7 Signed And Enveloped Data",

   674 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   675     OD( pkcs7DigestedData, SEC_OID_PKCS7_DIGESTED_DATA,

   676 	"PKCS #7 Digested Data",

   677 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   678     OD( pkcs7EncryptedData, SEC_OID_PKCS7_ENCRYPTED_DATA,

   679 	"PKCS #7 Encrypted Data",

   680 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   681     OD( pkcs9EmailAddress, SEC_OID_PKCS9_EMAIL_ADDRESS,

   682 	"PKCS #9 Email Address",

   683 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   684     OD( pkcs9UnstructuredName, SEC_OID_PKCS9_UNSTRUCTURED_NAME,

   685 	"PKCS #9 Unstructured Name",

   686 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   687     OD( pkcs9ContentType, SEC_OID_PKCS9_CONTENT_TYPE,

   688 	"PKCS #9 Content Type",

   689 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   690     OD( pkcs9MessageDigest, SEC_OID_PKCS9_MESSAGE_DIGEST,

   691 	"PKCS #9 Message Digest",

   692 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   693     OD( pkcs9SigningTime, SEC_OID_PKCS9_SIGNING_TIME,

   694 	"PKCS #9 Signing Time",

   695 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   696     OD( pkcs9CounterSignature, SEC_OID_PKCS9_COUNTER_SIGNATURE,

   697 	"PKCS #9 Counter Signature",

   698 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   699     OD( pkcs9ChallengePassword, SEC_OID_PKCS9_CHALLENGE_PASSWORD,

   700 	"PKCS #9 Challenge Password",

   701 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   702     OD( pkcs9UnstructuredAddress, SEC_OID_PKCS9_UNSTRUCTURED_ADDRESS,

   703 	"PKCS #9 Unstructured Address",

   704 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   705     OD( pkcs9ExtendedCertificateAttributes,

   706 	SEC_OID_PKCS9_EXTENDED_CERTIFICATE_ATTRIBUTES,

   707 	"PKCS #9 Extended Certificate Attributes",

   708 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   709     OD( pkcs9SMIMECapabilities, SEC_OID_PKCS9_SMIME_CAPABILITIES,

   710 	"PKCS #9 S/MIME Capabilities",

   711 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   712     OD( x520CommonName, SEC_OID_AVA_COMMON_NAME,

   713 	"X520 Common Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   714     OD( x520CountryName, SEC_OID_AVA_COUNTRY_NAME,

   715 	"X520 Country Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   716     OD( x520LocalityName, SEC_OID_AVA_LOCALITY,

   717 	"X520 Locality Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   718     OD( x520StateOrProvinceName, SEC_OID_AVA_STATE_OR_PROVINCE,

   719 	"X520 State Or Province Name",

   720 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   721     OD( x520OrgName, SEC_OID_AVA_ORGANIZATION_NAME,

   722 	"X520 Organization Name",

   723 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   724     OD( x520OrgUnitName, SEC_OID_AVA_ORGANIZATIONAL_UNIT_NAME,

   725 	"X520 Organizational Unit Name",

   726 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   727     OD( x520DnQualifier, SEC_OID_AVA_DN_QUALIFIER,

   728 	"X520 DN Qualifier", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   729     OD( rfc2247DomainComponent, SEC_OID_AVA_DC,

   730 	"RFC 2247 Domain Component",

   731 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   733     OD( nsTypeGIF, SEC_OID_NS_TYPE_GIF,

   734 	"GIF", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   735     OD( nsTypeJPEG, SEC_OID_NS_TYPE_JPEG,

   736 	"JPEG", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   737     OD( nsTypeURL, SEC_OID_NS_TYPE_URL,

   738 	"URL", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   739     OD( nsTypeHTML, SEC_OID_NS_TYPE_HTML,

   740 	"HTML", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   741     OD( nsTypeCertSeq, SEC_OID_NS_TYPE_CERT_SEQUENCE,

   742 	"Certificate Sequence",

   743 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   744     OD( missiCertKEADSSOld, SEC_OID_MISSI_KEA_DSS_OLD,

   745 	"MISSI KEA and DSS Algorithm (Old)",

   746 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   747     OD( missiCertDSSOld, SEC_OID_MISSI_DSS_OLD,

   748 	"MISSI DSS Algorithm (Old)",

   749 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   750     OD( missiCertKEADSS, SEC_OID_MISSI_KEA_DSS,

   751 	"MISSI KEA and DSS Algorithm",

   752 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   753     OD( missiCertDSS, SEC_OID_MISSI_DSS,

   754 	"MISSI DSS Algorithm",

   755 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   756     OD( missiCertKEA, SEC_OID_MISSI_KEA,

   757 	"MISSI KEA Algorithm",

   758 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   759     OD( missiCertAltKEA, SEC_OID_MISSI_ALT_KEA,

   760 	"MISSI Alternate KEA Algorithm",

   761           CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   763     /* Netscape private extensions */

   764     OD( nsCertExtNetscapeOK, SEC_OID_NS_CERT_EXT_NETSCAPE_OK,

   765 	"Netscape says this cert is OK",

   766 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   767     OD( nsCertExtIssuerLogo, SEC_OID_NS_CERT_EXT_ISSUER_LOGO,

   768 	"Certificate Issuer Logo",

   769 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   770     OD( nsCertExtSubjectLogo, SEC_OID_NS_CERT_EXT_SUBJECT_LOGO,

   771 	"Certificate Subject Logo",

   772 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   773     OD( nsExtCertType, SEC_OID_NS_CERT_EXT_CERT_TYPE,

   774 	"Certificate Type",

   775 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   776     OD( nsExtBaseURL, SEC_OID_NS_CERT_EXT_BASE_URL,

   777 	"Certificate Extension Base URL",

   778 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   779     OD( nsExtRevocationURL, SEC_OID_NS_CERT_EXT_REVOCATION_URL,

   780 	"Certificate Revocation URL",

   781 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   782     OD( nsExtCARevocationURL, SEC_OID_NS_CERT_EXT_CA_REVOCATION_URL,

   783 	"Certificate Authority Revocation URL",

   784 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   785     OD( nsExtCACRLURL, SEC_OID_NS_CERT_EXT_CA_CRL_URL,

   786 	"Certificate Authority CRL Download URL",

   787 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   788     OD( nsExtCACertURL, SEC_OID_NS_CERT_EXT_CA_CERT_URL,

   789 	"Certificate Authority Certificate Download URL",

   790 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   791     OD( nsExtCertRenewalURL, SEC_OID_NS_CERT_EXT_CERT_RENEWAL_URL,

   792 	"Certificate Renewal URL",

   793 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   794     OD( nsExtCAPolicyURL, SEC_OID_NS_CERT_EXT_CA_POLICY_URL,

   795 	"Certificate Authority Policy URL",

   796 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   797     OD( nsExtHomepageURL, SEC_OID_NS_CERT_EXT_HOMEPAGE_URL,

   798 	"Certificate Homepage URL",

   799 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   800     OD( nsExtEntityLogo, SEC_OID_NS_CERT_EXT_ENTITY_LOGO,

   801 	"Certificate Entity Logo",

   802 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   803     OD( nsExtUserPicture, SEC_OID_NS_CERT_EXT_USER_PICTURE,

   804 	"Certificate User Picture",

   805 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   806     OD( nsExtSSLServerName, SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME,

   807 	"Certificate SSL Server Name",

   808 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   809     OD( nsExtComment, SEC_OID_NS_CERT_EXT_COMMENT,

   810 	"Certificate Comment",

   811 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   812     OD( nsExtLostPasswordURL, SEC_OID_NS_CERT_EXT_LOST_PASSWORD_URL,

   813         "Lost Password URL",

   814 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   815     OD( nsExtCertRenewalTime, SEC_OID_NS_CERT_EXT_CERT_RENEWAL_TIME,

   816 	"Certificate Renewal Time",

   817 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   818     OD( nsKeyUsageGovtApproved, SEC_OID_NS_KEY_USAGE_GOVT_APPROVED,

   819 	"Strong Crypto Export Approved",

   820 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   823     /* x.509 v3 certificate extensions */

   824     OD( x509SubjectDirectoryAttr, SEC_OID_X509_SUBJECT_DIRECTORY_ATTR,

   825 	"Certificate Subject Directory Attributes",

   826 	CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION),

   827     OD( x509SubjectKeyID, SEC_OID_X509_SUBJECT_KEY_ID,

   828 	"Certificate Subject Key ID",

   829 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   830     OD( x509KeyUsage, SEC_OID_X509_KEY_USAGE,

   831 	"Certificate Key Usage",

   832 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   833     OD( x509PrivateKeyUsagePeriod, SEC_OID_X509_PRIVATE_KEY_USAGE_PERIOD,

   834 	"Certificate Private Key Usage Period",

   835         CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   836     OD( x509SubjectAltName, SEC_OID_X509_SUBJECT_ALT_NAME,

   837 	"Certificate Subject Alt Name",

   838         CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   839     OD( x509IssuerAltName, SEC_OID_X509_ISSUER_ALT_NAME,

   840 	"Certificate Issuer Alt Name",

   841         CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),

   842     OD( x509BasicConstraints, SEC_OID_X509_BASIC_CONSTRAINTS,

   843 	"Certificate Basic Constraints",

   844 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   845     OD( x509NameConstraints, SEC_OID_X509_NAME_CONSTRAINTS,

   846 	"Certificate Name Constraints",

   847 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   848     OD( x509CRLDistPoints, SEC_OID_X509_CRL_DIST_POINTS,

   849 	"CRL Distribution Points",

   850 	CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),

   851     OD( x509CertificatePolicies, SEC_OID_X509_CERTIFICATE_POLICIES,

   852  	"Certificate Policies",

   853         CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),

   854     OD( x509PolicyMappings, SEC_OID_X509_POLICY_MAPPINGS,

   855  	"Certificate Policy Mappings",

   856         CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),

   857     OD( x509PolicyConstraints, SEC_OID_X509_POLICY_CONSTRAINTS,

   858  	"Certificate Policy Constraints",

   859         CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),

   860     OD( x509AuthKeyID, SEC_OID_X509_AUTH_KEY_ID,

   861 	"Certificate Authority Key Identifier",

   862 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   863     OD( x509ExtKeyUsage, SEC_OID_X509_EXT_KEY_USAGE,

   864 	"Extended Key Usage",

   865 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   866     OD( x509AuthInfoAccess, SEC_OID_X509_AUTH_INFO_ACCESS,

   867 	"Authority Information Access",

   868         CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   870     /* x.509 v3 CRL extensions */

   871     OD( x509CRLNumber, SEC_OID_X509_CRL_NUMBER,

   872 	"CRL Number", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   873     OD( x509ReasonCode, SEC_OID_X509_REASON_CODE,

   874 	"CRL reason code", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   875     OD( x509InvalidDate, SEC_OID_X509_INVALID_DATE,

   876 	"Invalid Date", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

   878     OD( x500RSAEncryption, SEC_OID_X500_RSA_ENCRYPTION,

   879 	"X500 RSA Encryption", CKM_RSA_X_509, INVALID_CERT_EXTENSION ),

   881     /* added for alg 1485 */

   882     OD( rfc1274Uid, SEC_OID_RFC1274_UID,

   883 	"RFC1274 User Id", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   884     OD( rfc1274Mail, SEC_OID_RFC1274_MAIL,

   885 	"RFC1274 E-mail Address",

   886 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   888     /* pkcs 12 additions */

   889     OD( pkcs12, SEC_OID_PKCS12,

   890 	"PKCS #12", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   891     OD( pkcs12ModeIDs, SEC_OID_PKCS12_MODE_IDS,

   892 	"PKCS #12 Mode IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   893     OD( pkcs12ESPVKIDs, SEC_OID_PKCS12_ESPVK_IDS,

   894 	"PKCS #12 ESPVK IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   895     OD( pkcs12BagIDs, SEC_OID_PKCS12_BAG_IDS,

   896 	"PKCS #12 Bag IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   897     OD( pkcs12CertBagIDs, SEC_OID_PKCS12_CERT_BAG_IDS,

   898 	"PKCS #12 Cert Bag IDs",

   899 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   900     OD( pkcs12OIDs, SEC_OID_PKCS12_OIDS,

   901 	"PKCS #12 OIDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   902     OD( pkcs12PBEIDs, SEC_OID_PKCS12_PBE_IDS,

   903 	"PKCS #12 PBE IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   904     OD( pkcs12SignatureIDs, SEC_OID_PKCS12_SIGNATURE_IDS,

   905 	"PKCS #12 Signature IDs",

   906 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   907     OD( pkcs12EnvelopingIDs, SEC_OID_PKCS12_ENVELOPING_IDS,

   908 	"PKCS #12 Enveloping IDs",

   909 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   910     OD( pkcs12PKCS8KeyShrouding, SEC_OID_PKCS12_PKCS8_KEY_SHROUDING,

   911 	"PKCS #12 Key Shrouding",

   912 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   913     OD( pkcs12KeyBagID, SEC_OID_PKCS12_KEY_BAG_ID,

   914 	"PKCS #12 Key Bag ID",

   915 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   916     OD( pkcs12CertAndCRLBagID, SEC_OID_PKCS12_CERT_AND_CRL_BAG_ID,

   917 	"PKCS #12 Cert And CRL Bag ID",

   918 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   919     OD( pkcs12SecretBagID, SEC_OID_PKCS12_SECRET_BAG_ID,

   920 	"PKCS #12 Secret Bag ID",

   921 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   922     OD( pkcs12X509CertCRLBag, SEC_OID_PKCS12_X509_CERT_CRL_BAG,

   923 	"PKCS #12 X509 Cert CRL Bag",

   924 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   925     OD( pkcs12SDSICertBag, SEC_OID_PKCS12_SDSI_CERT_BAG,

   926 	"PKCS #12 SDSI Cert Bag",

   927 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   928     OD( pkcs12PBEWithSha1And128BitRC4,

   929 	SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4,

   930 	"PKCS #12 PBE With SHA-1 and 128 Bit RC4",

   931 	CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4, INVALID_CERT_EXTENSION ),

   932     OD( pkcs12PBEWithSha1And40BitRC4,

   933 	SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4,

   934 	"PKCS #12 PBE With SHA-1 and 40 Bit RC4",

   935 	CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4, INVALID_CERT_EXTENSION ),

   936     OD( pkcs12PBEWithSha1AndTripleDESCBC,

   937 	SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC,

   938 	"PKCS #12 PBE With SHA-1 and Triple DES-CBC",

   939 	CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC, INVALID_CERT_EXTENSION ),

   940     OD( pkcs12PBEWithSha1And128BitRC2CBC,

   941 	SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC,

   942 	"PKCS #12 PBE With SHA-1 and 128 Bit RC2 CBC",

   943 	CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC, INVALID_CERT_EXTENSION ),

   944     OD( pkcs12PBEWithSha1And40BitRC2CBC,

   945 	SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC,

   946 	"PKCS #12 PBE With SHA-1 and 40 Bit RC2 CBC",

   947 	CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC, INVALID_CERT_EXTENSION ),

   948     OD( pkcs12RSAEncryptionWith128BitRC4,

   949 	SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_128_BIT_RC4,

   950 	"PKCS #12 RSA Encryption with 128 Bit RC4",

   951 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   952     OD( pkcs12RSAEncryptionWith40BitRC4,

   953 	SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_40_BIT_RC4,

   954 	"PKCS #12 RSA Encryption with 40 Bit RC4",

   955 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   956     OD( pkcs12RSAEncryptionWithTripleDES,

   957 	SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_TRIPLE_DES,

   958 	"PKCS #12 RSA Encryption with Triple DES",

   959 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   960     OD( pkcs12RSASignatureWithSHA1Digest,

   961 	SEC_OID_PKCS12_RSA_SIGNATURE_WITH_SHA1_DIGEST,

   962 	"PKCS #12 RSA Encryption with Triple DES",

   963 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   965     /* DSA signatures */

   966     OD( ansix9DSASignature, SEC_OID_ANSIX9_DSA_SIGNATURE,

   967 	"ANSI X9.57 DSA Signature", CKM_DSA, INVALID_CERT_EXTENSION ),

   968     OD( ansix9DSASignaturewithSHA1Digest,

   969         SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST,

   970 	"ANSI X9.57 DSA Signature with SHA-1 Digest",

   971 	CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),

   972     OD( bogusDSASignaturewithSHA1Digest,

   973         SEC_OID_BOGUS_DSA_SIGNATURE_WITH_SHA1_DIGEST,

   974 	"FORTEZZA DSA Signature with SHA-1 Digest",

   975 	CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),

   977     /* verisign oids */

   978     OD( verisignUserNotices, SEC_OID_VERISIGN_USER_NOTICES,

   979 	"Verisign User Notices",

   980 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   982     /* pkix oids */

   983     OD( pkixCPSPointerQualifier, SEC_OID_PKIX_CPS_POINTER_QUALIFIER,

   984 	"PKIX CPS Pointer Qualifier",

   985 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   986     OD( pkixUserNoticeQualifier, SEC_OID_PKIX_USER_NOTICE_QUALIFIER,

   987 	"PKIX User Notice Qualifier",

   988 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   990     OD( pkixOCSP, SEC_OID_PKIX_OCSP,

   991 	"PKIX Online Certificate Status Protocol",

   992 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   993     OD( pkixOCSPBasicResponse, SEC_OID_PKIX_OCSP_BASIC_RESPONSE,

   994 	"OCSP Basic Response", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   995     OD( pkixOCSPNonce, SEC_OID_PKIX_OCSP_NONCE,

   996 	"OCSP Nonce Extension", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

   997     OD( pkixOCSPCRL, SEC_OID_PKIX_OCSP_CRL,

   998 	"OCSP CRL Reference Extension",

   999 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1000     OD( pkixOCSPResponse, SEC_OID_PKIX_OCSP_RESPONSE,

  1001 	"OCSP Response Types Extension",

  1002 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1003     OD( pkixOCSPNoCheck, SEC_OID_PKIX_OCSP_NO_CHECK,

  1004 	"OCSP No Check Extension",

  1005 	CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),

  1006     OD( pkixOCSPArchiveCutoff, SEC_OID_PKIX_OCSP_ARCHIVE_CUTOFF,

  1007 	"OCSP Archive Cutoff Extension",

  1008 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1009     OD( pkixOCSPServiceLocator, SEC_OID_PKIX_OCSP_SERVICE_LOCATOR,

  1010 	"OCSP Service Locator Extension",

  1011 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1013     OD( pkixRegCtrlRegToken, SEC_OID_PKIX_REGCTRL_REGTOKEN,

  1014         "PKIX CRMF Registration Control, Registration Token",

  1015         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1016     OD( pkixRegCtrlAuthenticator, SEC_OID_PKIX_REGCTRL_AUTHENTICATOR,

  1017         "PKIX CRMF Registration Control, Registration Authenticator",

  1018         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1019     OD( pkixRegCtrlPKIPubInfo, SEC_OID_PKIX_REGCTRL_PKIPUBINFO,

  1020         "PKIX CRMF Registration Control, PKI Publication Info",

  1021         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1022     OD( pkixRegCtrlPKIArchOptions,

  1023         SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS,

  1024         "PKIX CRMF Registration Control, PKI Archive Options",

  1025         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1026     OD( pkixRegCtrlOldCertID, SEC_OID_PKIX_REGCTRL_OLD_CERT_ID,

  1027         "PKIX CRMF Registration Control, Old Certificate ID",

  1028         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1029     OD( pkixRegCtrlProtEncKey, SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY,

  1030         "PKIX CRMF Registration Control, Protocol Encryption Key",

  1031         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1032     OD( pkixRegInfoUTF8Pairs, SEC_OID_PKIX_REGINFO_UTF8_PAIRS,

  1033         "PKIX CRMF Registration Info, UTF8 Pairs",

  1034         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1035     OD( pkixRegInfoCertReq, SEC_OID_PKIX_REGINFO_CERT_REQUEST,

  1036         "PKIX CRMF Registration Info, Certificate Request",

  1037         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1038     OD( pkixExtendedKeyUsageServerAuth,

  1039         SEC_OID_EXT_KEY_USAGE_SERVER_AUTH,

  1040         "TLS Web Server Authentication Certificate",

  1041         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1042     OD( pkixExtendedKeyUsageClientAuth,

  1043         SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH,

  1044         "TLS Web Client Authentication Certificate",

  1045         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1046     OD( pkixExtendedKeyUsageCodeSign, SEC_OID_EXT_KEY_USAGE_CODE_SIGN,

  1047         "Code Signing Certificate",

  1048         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1049     OD( pkixExtendedKeyUsageEMailProtect,

  1050         SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT,

  1051         "E-Mail Protection Certificate",

  1052         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1053     OD( pkixExtendedKeyUsageTimeStamp,

  1054         SEC_OID_EXT_KEY_USAGE_TIME_STAMP,

  1055         "Time Stamping Certifcate",

  1056         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1057     OD( pkixOCSPResponderExtendedKeyUsage, SEC_OID_OCSP_RESPONDER,

  1058           "OCSP Responder Certificate",

  1059           CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),

  1061     /* Netscape Algorithm OIDs */

  1063     OD( netscapeSMimeKEA, SEC_OID_NETSCAPE_SMIME_KEA,

  1064 	"Netscape S/MIME KEA", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1066       /* Skipjack OID -- ### mwelch temporary */

  1067     OD( skipjackCBC, SEC_OID_FORTEZZA_SKIPJACK,

  1068 	"Skipjack CBC64", CKM_SKIPJACK_CBC64, INVALID_CERT_EXTENSION ),

  1070     /* pkcs12 v2 oids */

  1071     OD( pkcs12V2PBEWithSha1And128BitRC4,

  1072         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4,

  1073 	"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4",

  1074 	CKM_PBE_SHA1_RC4_128, INVALID_CERT_EXTENSION ),

  1075     OD( pkcs12V2PBEWithSha1And40BitRC4,

  1076         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4,

  1077 	"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4",

  1078 	CKM_PBE_SHA1_RC4_40, INVALID_CERT_EXTENSION ),

  1079     OD( pkcs12V2PBEWithSha1And3KeyTripleDEScbc,

  1080         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC,

  1081 	"PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC",

  1082 	CKM_PBE_SHA1_DES3_EDE_CBC, INVALID_CERT_EXTENSION ),

  1083     OD( pkcs12V2PBEWithSha1And2KeyTripleDEScbc,

  1084         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC,

  1085 	"PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC",

  1086 	CKM_PBE_SHA1_DES2_EDE_CBC, INVALID_CERT_EXTENSION ),

  1087     OD( pkcs12V2PBEWithSha1And128BitRC2cbc,

  1088         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC,

  1089 	"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC",

  1090 	CKM_PBE_SHA1_RC2_128_CBC, INVALID_CERT_EXTENSION ),

  1091     OD( pkcs12V2PBEWithSha1And40BitRC2cbc,

  1092         SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC,

  1093 	"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC",

  1094 	CKM_PBE_SHA1_RC2_40_CBC, INVALID_CERT_EXTENSION ),

  1095     OD( pkcs12SafeContentsID, SEC_OID_PKCS12_SAFE_CONTENTS_ID,

  1096 	"PKCS #12 Safe Contents ID",

  1097 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1098     OD( pkcs12PKCS8ShroudedKeyBagID,

  1099 	SEC_OID_PKCS12_PKCS8_SHROUDED_KEY_BAG_ID,

  1100 	"PKCS #12 Safe Contents ID",

  1101 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1102     OD( pkcs12V1KeyBag, SEC_OID_PKCS12_V1_KEY_BAG_ID,

  1103 	"PKCS #12 V1 Key Bag",

  1104 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1105     OD( pkcs12V1PKCS8ShroudedKeyBag,

  1106 	SEC_OID_PKCS12_V1_PKCS8_SHROUDED_KEY_BAG_ID,

  1107 	"PKCS #12 V1 PKCS8 Shrouded Key Bag",

  1108 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1109     OD( pkcs12V1CertBag, SEC_OID_PKCS12_V1_CERT_BAG_ID,

  1110 	"PKCS #12 V1 Cert Bag",

  1111 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1112     OD( pkcs12V1CRLBag, SEC_OID_PKCS12_V1_CRL_BAG_ID,

  1113 	"PKCS #12 V1 CRL Bag",

  1114 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1115     OD( pkcs12V1SecretBag, SEC_OID_PKCS12_V1_SECRET_BAG_ID,

  1116 	"PKCS #12 V1 Secret Bag",

  1117 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1118     OD( pkcs12V1SafeContentsBag, SEC_OID_PKCS12_V1_SAFE_CONTENTS_BAG_ID,

  1119 	"PKCS #12 V1 Safe Contents Bag",

  1120 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1122     OD( pkcs9X509Certificate, SEC_OID_PKCS9_X509_CERT,

  1123 	"PKCS #9 X509 Certificate",

  1124 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1125     OD( pkcs9SDSICertificate, SEC_OID_PKCS9_SDSI_CERT,

  1126 	"PKCS #9 SDSI Certificate",

  1127 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1128     OD( pkcs9X509CRL, SEC_OID_PKCS9_X509_CRL,

  1129 	"PKCS #9 X509 CRL", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1130     OD( pkcs9FriendlyName, SEC_OID_PKCS9_FRIENDLY_NAME,

  1131 	"PKCS #9 Friendly Name",

  1132 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1133     OD( pkcs9LocalKeyID, SEC_OID_PKCS9_LOCAL_KEY_ID,

  1134 	"PKCS #9 Local Key ID",

  1135 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1136     OD( pkcs12KeyUsageAttr, SEC_OID_BOGUS_KEY_USAGE,

  1137 	"Bogus Key Usage", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1138     OD( dhPublicKey, SEC_OID_X942_DIFFIE_HELMAN_KEY,

  1139 	"Diffie-Helman Public Key", CKM_DH_PKCS_DERIVE,

  1140 	INVALID_CERT_EXTENSION ),

  1141     OD( netscapeNickname, SEC_OID_NETSCAPE_NICKNAME,

  1142 	"Netscape Nickname", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1144     /* Cert Server specific OIDs */

  1145     OD( netscapeRecoveryRequest, SEC_OID_NETSCAPE_RECOVERY_REQUEST,

  1146         "Recovery Request OID",

  1147 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1149     OD( nsExtAIACertRenewal, SEC_OID_CERT_RENEWAL_LOCATOR,

  1150         "Certificate Renewal Locator OID", CKM_INVALID_MECHANISM,

  1151         INVALID_CERT_EXTENSION ),

  1153     OD( nsExtCertScopeOfUse, SEC_OID_NS_CERT_EXT_SCOPE_OF_USE,

  1154         "Certificate Scope-of-Use Extension", CKM_INVALID_MECHANISM,

  1155         SUPPORTED_CERT_EXTENSION ),

  1157     /* CMS stuff */

  1158     OD( cmsESDH, SEC_OID_CMS_EPHEMERAL_STATIC_DIFFIE_HELLMAN,

  1159         "Ephemeral-Static Diffie-Hellman", CKM_INVALID_MECHANISM /* XXX */,

  1160         INVALID_CERT_EXTENSION ),

  1161     OD( cms3DESwrap, SEC_OID_CMS_3DES_KEY_WRAP,

  1162         "CMS Triple DES Key Wrap", CKM_INVALID_MECHANISM /* XXX */,

  1163         INVALID_CERT_EXTENSION ),

  1164     OD( cmsRC2wrap, SEC_OID_CMS_RC2_KEY_WRAP,

  1165         "CMS RC2 Key Wrap", CKM_INVALID_MECHANISM /* XXX */,

  1166         INVALID_CERT_EXTENSION ),

  1167     OD( smimeEncryptionKeyPreference, SEC_OID_SMIME_ENCRYPTION_KEY_PREFERENCE,

  1168 	"S/MIME Encryption Key Preference",

  1169 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1171     /* AES algorithm OIDs */

  1172     OD( aes128_ECB, SEC_OID_AES_128_ECB,

  1173 	"AES-128-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),

  1174     OD( aes128_CBC, SEC_OID_AES_128_CBC,

  1175 	"AES-128-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),

  1176     OD( aes192_ECB, SEC_OID_AES_192_ECB,

  1177 	"AES-192-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),

  1178     OD( aes192_CBC, SEC_OID_AES_192_CBC,

  1179 	"AES-192-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),

  1180     OD( aes256_ECB, SEC_OID_AES_256_ECB,

  1181 	"AES-256-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),

  1182     OD( aes256_CBC, SEC_OID_AES_256_CBC,

  1183 	"AES-256-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),

  1185     /* More bogus DSA OIDs */

  1186     OD( sdn702DSASignature, SEC_OID_SDN702_DSA_SIGNATURE,

  1187 	"SDN.702 DSA Signature", CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),

  1189     OD( ms_smimeEncryptionKeyPreference,

  1190         SEC_OID_MS_SMIME_ENCRYPTION_KEY_PREFERENCE,

  1191 	"Microsoft S/MIME Encryption Key Preference",

  1192 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1194     OD( sha256, SEC_OID_SHA256, "SHA-256", CKM_SHA256, INVALID_CERT_EXTENSION),

  1195     OD( sha384, SEC_OID_SHA384, "SHA-384", CKM_SHA384, INVALID_CERT_EXTENSION),

  1196     OD( sha512, SEC_OID_SHA512, "SHA-512", CKM_SHA512, INVALID_CERT_EXTENSION),

  1198     OD( pkcs1SHA256WithRSAEncryption, SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,

  1199 	"PKCS #1 SHA-256 With RSA Encryption", CKM_SHA256_RSA_PKCS,

  1200 	INVALID_CERT_EXTENSION ),

  1201     OD( pkcs1SHA384WithRSAEncryption, SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION,

  1202 	"PKCS #1 SHA-384 With RSA Encryption", CKM_SHA384_RSA_PKCS,

  1203 	INVALID_CERT_EXTENSION ),

  1204     OD( pkcs1SHA512WithRSAEncryption, SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION,

  1205 	"PKCS #1 SHA-512 With RSA Encryption", CKM_SHA512_RSA_PKCS,

  1206 	INVALID_CERT_EXTENSION ),

  1208     OD( aes128_KEY_WRAP, SEC_OID_AES_128_KEY_WRAP,

  1209 	"AES-128 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),

  1210     OD( aes192_KEY_WRAP, SEC_OID_AES_192_KEY_WRAP,

  1211 	"AES-192 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),

  1212     OD( aes256_KEY_WRAP, SEC_OID_AES_256_KEY_WRAP,

  1213 	"AES-256 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),

  1215     /* Elliptic Curve Cryptography (ECC) OIDs */

  1216     OD( ansix962ECPublicKey, SEC_OID_ANSIX962_EC_PUBLIC_KEY,

  1217 	"X9.62 elliptic curve public key", CKM_ECDH1_DERIVE,

  1218 	INVALID_CERT_EXTENSION ),

  1219     OD( ansix962SignaturewithSHA1Digest,

  1220 	SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE,

  1221 	"X9.62 ECDSA signature with SHA-1", CKM_ECDSA_SHA1,

  1222 	INVALID_CERT_EXTENSION ),

  1224     /* Named curves */

  1226     /* ANSI X9.62 named elliptic curves (prime field) */

  1227     OD( ansiX962prime192v1, SEC_OID_ANSIX962_EC_PRIME192V1,

  1228 	"ANSI X9.62 elliptic curve prime192v1 (aka secp192r1, NIST P-192)",

  1229 	CKM_INVALID_MECHANISM,

  1230 	INVALID_CERT_EXTENSION ),

  1231     OD( ansiX962prime192v2, SEC_OID_ANSIX962_EC_PRIME192V2,

  1232 	"ANSI X9.62 elliptic curve prime192v2",

  1233 	CKM_INVALID_MECHANISM,

  1234 	INVALID_CERT_EXTENSION ),

  1235     OD( ansiX962prime192v3, SEC_OID_ANSIX962_EC_PRIME192V3,

  1236 	"ANSI X9.62 elliptic curve prime192v3",

  1237 	CKM_INVALID_MECHANISM,

  1238 	INVALID_CERT_EXTENSION ),

  1239     OD( ansiX962prime239v1, SEC_OID_ANSIX962_EC_PRIME239V1,

  1240 	"ANSI X9.62 elliptic curve prime239v1",

  1241 	CKM_INVALID_MECHANISM,

  1242 	INVALID_CERT_EXTENSION ),

  1243     OD( ansiX962prime239v2, SEC_OID_ANSIX962_EC_PRIME239V2,

  1244 	"ANSI X9.62 elliptic curve prime239v2",

  1245 	CKM_INVALID_MECHANISM,

  1246 	INVALID_CERT_EXTENSION ),

  1247     OD( ansiX962prime239v3, SEC_OID_ANSIX962_EC_PRIME239V3,

  1248 	"ANSI X9.62 elliptic curve prime239v3",

  1249 	CKM_INVALID_MECHANISM,

  1250 	INVALID_CERT_EXTENSION ),

  1251     OD( ansiX962prime256v1, SEC_OID_ANSIX962_EC_PRIME256V1,

  1252 	"ANSI X9.62 elliptic curve prime256v1 (aka secp256r1, NIST P-256)",

  1253 	CKM_INVALID_MECHANISM,

  1254 	INVALID_CERT_EXTENSION ),

  1256     /* SECG named elliptic curves (prime field) */

  1257     OD( secgECsecp112r1, SEC_OID_SECG_EC_SECP112R1,

  1258 	"SECG elliptic curve secp112r1",

  1259 	CKM_INVALID_MECHANISM,

  1260 	INVALID_CERT_EXTENSION ),

  1261     OD( secgECsecp112r2, SEC_OID_SECG_EC_SECP112R2,

  1262 	"SECG elliptic curve secp112r2",

  1263 	CKM_INVALID_MECHANISM,

  1264 	INVALID_CERT_EXTENSION ),

  1265     OD( secgECsecp128r1, SEC_OID_SECG_EC_SECP128R1,

  1266 	"SECG elliptic curve secp128r1",

  1267 	CKM_INVALID_MECHANISM,

  1268 	INVALID_CERT_EXTENSION ),

  1269     OD( secgECsecp128r2, SEC_OID_SECG_EC_SECP128R2,

  1270 	"SECG elliptic curve secp128r2",

  1271 	CKM_INVALID_MECHANISM,

  1272 	INVALID_CERT_EXTENSION ),

  1273     OD( secgECsecp160k1, SEC_OID_SECG_EC_SECP160K1,

  1274 	"SECG elliptic curve secp160k1",

  1275 	CKM_INVALID_MECHANISM,

  1276 	INVALID_CERT_EXTENSION ),

  1277     OD( secgECsecp160r1, SEC_OID_SECG_EC_SECP160R1,

  1278 	"SECG elliptic curve secp160r1",

  1279 	CKM_INVALID_MECHANISM,

  1280 	INVALID_CERT_EXTENSION ),

  1281     OD( secgECsecp160r2, SEC_OID_SECG_EC_SECP160R2,

  1282 	"SECG elliptic curve secp160r2",

  1283 	CKM_INVALID_MECHANISM,

  1284 	INVALID_CERT_EXTENSION ),

  1285     OD( secgECsecp192k1, SEC_OID_SECG_EC_SECP192K1,

  1286 	"SECG elliptic curve secp192k1",

  1287 	CKM_INVALID_MECHANISM,

  1288 	INVALID_CERT_EXTENSION ),

  1289     OD( secgECsecp224k1, SEC_OID_SECG_EC_SECP224K1,

  1290 	"SECG elliptic curve secp224k1",

  1291 	CKM_INVALID_MECHANISM,

  1292 	INVALID_CERT_EXTENSION ),

  1293     OD( secgECsecp224r1, SEC_OID_SECG_EC_SECP224R1,

  1294 	"SECG elliptic curve secp224r1 (aka NIST P-224)",

  1295 	CKM_INVALID_MECHANISM,

  1296 	INVALID_CERT_EXTENSION ),

  1297     OD( secgECsecp256k1, SEC_OID_SECG_EC_SECP256K1,

  1298 	"SECG elliptic curve secp256k1",

  1299 	CKM_INVALID_MECHANISM,

  1300 	INVALID_CERT_EXTENSION ),

  1301     OD( secgECsecp384r1, SEC_OID_SECG_EC_SECP384R1,

  1302 	"SECG elliptic curve secp384r1 (aka NIST P-384)",

  1303 	CKM_INVALID_MECHANISM,

  1304 	INVALID_CERT_EXTENSION ),

  1305     OD( secgECsecp521r1, SEC_OID_SECG_EC_SECP521R1,

  1306 	"SECG elliptic curve secp521r1 (aka NIST P-521)",

  1307 	CKM_INVALID_MECHANISM,

  1308 	INVALID_CERT_EXTENSION ),

  1310     /* ANSI X9.62 named elliptic curves (characteristic two field) */

  1311     OD( ansiX962c2pnb163v1, SEC_OID_ANSIX962_EC_C2PNB163V1,

  1312 	"ANSI X9.62 elliptic curve c2pnb163v1",

  1313 	CKM_INVALID_MECHANISM,

  1314 	INVALID_CERT_EXTENSION ),

  1315     OD( ansiX962c2pnb163v2, SEC_OID_ANSIX962_EC_C2PNB163V2,

  1316 	"ANSI X9.62 elliptic curve c2pnb163v2",

  1317 	CKM_INVALID_MECHANISM,

  1318 	INVALID_CERT_EXTENSION ),

  1319     OD( ansiX962c2pnb163v3, SEC_OID_ANSIX962_EC_C2PNB163V3,

  1320 	"ANSI X9.62 elliptic curve c2pnb163v3",

  1321 	CKM_INVALID_MECHANISM,

  1322 	INVALID_CERT_EXTENSION ),

  1323     OD( ansiX962c2pnb176v1, SEC_OID_ANSIX962_EC_C2PNB176V1,

  1324 	"ANSI X9.62 elliptic curve c2pnb176v1",

  1325 	CKM_INVALID_MECHANISM,

  1326 	INVALID_CERT_EXTENSION ),

  1327     OD( ansiX962c2tnb191v1, SEC_OID_ANSIX962_EC_C2TNB191V1,

  1328 	"ANSI X9.62 elliptic curve c2tnb191v1",

  1329 	CKM_INVALID_MECHANISM,

  1330 	INVALID_CERT_EXTENSION ),

  1331     OD( ansiX962c2tnb191v2, SEC_OID_ANSIX962_EC_C2TNB191V2,

  1332 	"ANSI X9.62 elliptic curve c2tnb191v2",

  1333 	CKM_INVALID_MECHANISM,

  1334 	INVALID_CERT_EXTENSION ),

  1335     OD( ansiX962c2tnb191v3, SEC_OID_ANSIX962_EC_C2TNB191V3,

  1336 	"ANSI X9.62 elliptic curve c2tnb191v3",

  1337 	CKM_INVALID_MECHANISM,

  1338 	INVALID_CERT_EXTENSION ),

  1339     OD( ansiX962c2onb191v4, SEC_OID_ANSIX962_EC_C2ONB191V4,

  1340 	"ANSI X9.62 elliptic curve c2onb191v4",

  1341 	CKM_INVALID_MECHANISM,

  1342 	INVALID_CERT_EXTENSION ),

  1343     OD( ansiX962c2onb191v5, SEC_OID_ANSIX962_EC_C2ONB191V5,

  1344 	"ANSI X9.62 elliptic curve c2onb191v5",

  1345 	CKM_INVALID_MECHANISM,

  1346 	INVALID_CERT_EXTENSION ),

  1347     OD( ansiX962c2pnb208w1, SEC_OID_ANSIX962_EC_C2PNB208W1,

  1348 	"ANSI X9.62 elliptic curve c2pnb208w1",

  1349 	CKM_INVALID_MECHANISM,

  1350 	INVALID_CERT_EXTENSION ),

  1351     OD( ansiX962c2tnb239v1, SEC_OID_ANSIX962_EC_C2TNB239V1,

  1352 	"ANSI X9.62 elliptic curve c2tnb239v1",

  1353 	CKM_INVALID_MECHANISM,

  1354 	INVALID_CERT_EXTENSION ),

  1355     OD( ansiX962c2tnb239v2, SEC_OID_ANSIX962_EC_C2TNB239V2,

  1356 	"ANSI X9.62 elliptic curve c2tnb239v2",

  1357 	CKM_INVALID_MECHANISM,

  1358 	INVALID_CERT_EXTENSION ),

  1359     OD( ansiX962c2tnb239v3, SEC_OID_ANSIX962_EC_C2TNB239V3,

  1360 	"ANSI X9.62 elliptic curve c2tnb239v3",

  1361 	CKM_INVALID_MECHANISM,

  1362 	INVALID_CERT_EXTENSION ),

  1363     OD( ansiX962c2onb239v4, SEC_OID_ANSIX962_EC_C2ONB239V4,

  1364 	"ANSI X9.62 elliptic curve c2onb239v4",

  1365 	CKM_INVALID_MECHANISM,

  1366 	INVALID_CERT_EXTENSION ),

  1367     OD( ansiX962c2onb239v5, SEC_OID_ANSIX962_EC_C2ONB239V5,

  1368 	"ANSI X9.62 elliptic curve c2onb239v5",

  1369 	CKM_INVALID_MECHANISM,

  1370 	INVALID_CERT_EXTENSION ),

  1371     OD( ansiX962c2pnb272w1, SEC_OID_ANSIX962_EC_C2PNB272W1,

  1372 	"ANSI X9.62 elliptic curve c2pnb272w1",

  1373 	CKM_INVALID_MECHANISM,

  1374 	INVALID_CERT_EXTENSION ),

  1375     OD( ansiX962c2pnb304w1, SEC_OID_ANSIX962_EC_C2PNB304W1,

  1376 	"ANSI X9.62 elliptic curve c2pnb304w1",

  1377 	CKM_INVALID_MECHANISM,

  1378 	INVALID_CERT_EXTENSION ),

  1379     OD( ansiX962c2tnb359v1, SEC_OID_ANSIX962_EC_C2TNB359V1,

  1380 	"ANSI X9.62 elliptic curve c2tnb359v1",

  1381 	CKM_INVALID_MECHANISM,

  1382 	INVALID_CERT_EXTENSION ),

  1383     OD( ansiX962c2pnb368w1, SEC_OID_ANSIX962_EC_C2PNB368W1,

  1384 	"ANSI X9.62 elliptic curve c2pnb368w1",

  1385 	CKM_INVALID_MECHANISM,

  1386 	INVALID_CERT_EXTENSION ),

  1387     OD( ansiX962c2tnb431r1, SEC_OID_ANSIX962_EC_C2TNB431R1,

  1388 	"ANSI X9.62 elliptic curve c2tnb431r1",

  1389 	CKM_INVALID_MECHANISM,

  1390 	INVALID_CERT_EXTENSION ),

  1392     /* SECG named elliptic curves (characterisitic two field) */

  1393     OD( secgECsect113r1, SEC_OID_SECG_EC_SECT113R1,

  1394 	"SECG elliptic curve sect113r1",

  1395 	CKM_INVALID_MECHANISM,

  1396 	INVALID_CERT_EXTENSION ),

  1397     OD( secgECsect113r2, SEC_OID_SECG_EC_SECT113R2,

  1398 	"SECG elliptic curve sect113r2",

  1399 	CKM_INVALID_MECHANISM,

  1400 	INVALID_CERT_EXTENSION ),

  1401     OD( secgECsect131r1, SEC_OID_SECG_EC_SECT131R1,

  1402 	"SECG elliptic curve sect131r1",

  1403 	CKM_INVALID_MECHANISM,

  1404 	INVALID_CERT_EXTENSION ),

  1405     OD( secgECsect131r2, SEC_OID_SECG_EC_SECT131R2,

  1406 	"SECG elliptic curve sect131r2",

  1407 	CKM_INVALID_MECHANISM,

  1408 	INVALID_CERT_EXTENSION ),

  1409     OD( secgECsect163k1, SEC_OID_SECG_EC_SECT163K1,

  1410 	"SECG elliptic curve sect163k1 (aka NIST K-163)",

  1411 	CKM_INVALID_MECHANISM,

  1412 	INVALID_CERT_EXTENSION ),

  1413     OD( secgECsect163r1, SEC_OID_SECG_EC_SECT163R1,

  1414 	"SECG elliptic curve sect163r1",

  1415 	CKM_INVALID_MECHANISM,

  1416 	INVALID_CERT_EXTENSION ),

  1417     OD( secgECsect163r2, SEC_OID_SECG_EC_SECT163R2,

  1418 	"SECG elliptic curve sect163r2 (aka NIST B-163)",

  1419 	CKM_INVALID_MECHANISM,

  1420 	INVALID_CERT_EXTENSION ),

  1421     OD( secgECsect193r1, SEC_OID_SECG_EC_SECT193R1,

  1422 	"SECG elliptic curve sect193r1",

  1423 	CKM_INVALID_MECHANISM,

  1424 	INVALID_CERT_EXTENSION ),

  1425     OD( secgECsect193r2, SEC_OID_SECG_EC_SECT193R2,

  1426 	"SECG elliptic curve sect193r2",

  1427 	CKM_INVALID_MECHANISM,

  1428 	INVALID_CERT_EXTENSION ),

  1429     OD( secgECsect233k1, SEC_OID_SECG_EC_SECT233K1,

  1430 	"SECG elliptic curve sect233k1 (aka NIST K-233)",

  1431 	CKM_INVALID_MECHANISM,

  1432 	INVALID_CERT_EXTENSION ),

  1433     OD( secgECsect233r1, SEC_OID_SECG_EC_SECT233R1,

  1434 	"SECG elliptic curve sect233r1 (aka NIST B-233)",

  1435 	CKM_INVALID_MECHANISM,

  1436 	INVALID_CERT_EXTENSION ),

  1437     OD( secgECsect239k1, SEC_OID_SECG_EC_SECT239K1,

  1438 	"SECG elliptic curve sect239k1",

  1439 	CKM_INVALID_MECHANISM,

  1440 	INVALID_CERT_EXTENSION ),

  1441     OD( secgECsect283k1, SEC_OID_SECG_EC_SECT283K1,

  1442 	"SECG elliptic curve sect283k1 (aka NIST K-283)",

  1443 	CKM_INVALID_MECHANISM,

  1444 	INVALID_CERT_EXTENSION ),

  1445     OD( secgECsect283r1, SEC_OID_SECG_EC_SECT283R1,

  1446 	"SECG elliptic curve sect283r1 (aka NIST B-283)",

  1447 	CKM_INVALID_MECHANISM,

  1448 	INVALID_CERT_EXTENSION ),

  1449     OD( secgECsect409k1, SEC_OID_SECG_EC_SECT409K1,

  1450 	"SECG elliptic curve sect409k1 (aka NIST K-409)",

  1451 	CKM_INVALID_MECHANISM,

  1452 	INVALID_CERT_EXTENSION ),

  1453     OD( secgECsect409r1, SEC_OID_SECG_EC_SECT409R1,

  1454 	"SECG elliptic curve sect409r1 (aka NIST B-409)",

  1455 	CKM_INVALID_MECHANISM,

  1456 	INVALID_CERT_EXTENSION ),

  1457     OD( secgECsect571k1, SEC_OID_SECG_EC_SECT571K1,

  1458 	"SECG elliptic curve sect571k1 (aka NIST K-571)",

  1459 	CKM_INVALID_MECHANISM,

  1460 	INVALID_CERT_EXTENSION ),

  1461     OD( secgECsect571r1, SEC_OID_SECG_EC_SECT571R1,

  1462 	"SECG elliptic curve sect571r1 (aka NIST B-571)",

  1463 	CKM_INVALID_MECHANISM,

  1464 	INVALID_CERT_EXTENSION ),

  1466     OD( netscapeAOLScreenname, SEC_OID_NETSCAPE_AOLSCREENNAME,

  1467 	"AOL Screenname", CKM_INVALID_MECHANISM,

  1468 	INVALID_CERT_EXTENSION ),

  1470     OD( x520SurName, SEC_OID_AVA_SURNAME,

  1471     	"X520 Title",         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1472     OD( x520SerialNumber, SEC_OID_AVA_SERIAL_NUMBER,

  1473         "X520 Serial Number", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1474     OD( x520StreetAddress, SEC_OID_AVA_STREET_ADDRESS,

  1475         "X520 Street Address", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1476     OD( x520Title, SEC_OID_AVA_TITLE,

  1477     	"X520 Title",         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1478     OD( x520PostalAddress, SEC_OID_AVA_POSTAL_ADDRESS,

  1479     	"X520 Postal Address", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1480     OD( x520PostalCode, SEC_OID_AVA_POSTAL_CODE,

  1481     	"X520 Postal Code",   CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1482     OD( x520PostOfficeBox, SEC_OID_AVA_POST_OFFICE_BOX,

  1483     	"X520 Post Office Box", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1484     OD( x520GivenName, SEC_OID_AVA_GIVEN_NAME,

  1485     	"X520 Given Name",    CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1486     OD( x520Initials, SEC_OID_AVA_INITIALS,

  1487     	"X520 Initials",      CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1488     OD( x520GenerationQualifier, SEC_OID_AVA_GENERATION_QUALIFIER,

  1489     	"X520 Generation Qualifier",

  1490 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1491     OD( x520HouseIdentifier, SEC_OID_AVA_HOUSE_IDENTIFIER,

  1492     	"X520 House Identifier",

  1493 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1494     OD( x520Pseudonym, SEC_OID_AVA_PSEUDONYM,

  1495     	"X520 Pseudonym",     CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1497     /* More OIDs */

  1498     OD( pkixCAIssuers, SEC_OID_PKIX_CA_ISSUERS,

  1499         "PKIX CA issuers access method",

  1500         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1501     OD( pkcs9ExtensionRequest, SEC_OID_PKCS9_EXTENSION_REQUEST,

  1502     	"PKCS #9 Extension Request",

  1503         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1505     /* more ECC Signature Oids */

  1506     OD( ansix962SignatureRecommended,

  1507 	SEC_OID_ANSIX962_ECDSA_SIGNATURE_RECOMMENDED_DIGEST,

  1508 	"X9.62 ECDSA signature with recommended digest", CKM_INVALID_MECHANISM,

  1509 	INVALID_CERT_EXTENSION ),

  1510     OD( ansix962SignatureSpecified,

  1511 	SEC_OID_ANSIX962_ECDSA_SIGNATURE_SPECIFIED_DIGEST,

  1512 	"X9.62 ECDSA signature with specified digest", CKM_ECDSA,

  1513 	INVALID_CERT_EXTENSION ),

  1514     OD( ansix962SignaturewithSHA224Digest,

  1515 	SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE,

  1516 	"X9.62 ECDSA signature with SHA224", CKM_INVALID_MECHANISM,

  1517 	INVALID_CERT_EXTENSION ),

  1518     OD( ansix962SignaturewithSHA256Digest,

  1519 	SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE,

  1520 	"X9.62 ECDSA signature with SHA256", CKM_INVALID_MECHANISM,

  1521 	INVALID_CERT_EXTENSION ),

  1522     OD( ansix962SignaturewithSHA384Digest,

  1523 	SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE,

  1524 	"X9.62 ECDSA signature with SHA384", CKM_INVALID_MECHANISM,

  1525 	INVALID_CERT_EXTENSION ),

  1526     OD( ansix962SignaturewithSHA512Digest,

  1527 	SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE,

  1528 	"X9.62 ECDSA signature with SHA512", CKM_INVALID_MECHANISM,

  1529 	INVALID_CERT_EXTENSION ),

  1531     /* More id-ce and id-pe OIDs from RFC 3280 */

  1532     OD( x509HoldInstructionCode,      SEC_OID_X509_HOLD_INSTRUCTION_CODE,

  1533         "CRL Hold Instruction Code",  CKM_INVALID_MECHANISM,

  1534 	UNSUPPORTED_CERT_EXTENSION ),

  1535     OD( x509DeltaCRLIndicator,        SEC_OID_X509_DELTA_CRL_INDICATOR,

  1536         "Delta CRL Indicator",        CKM_INVALID_MECHANISM,

  1537 	FAKE_SUPPORTED_CERT_EXTENSION ),

  1538     OD( x509IssuingDistributionPoint, SEC_OID_X509_ISSUING_DISTRIBUTION_POINT,

  1539         "Issuing Distribution Point", CKM_INVALID_MECHANISM,

  1540 	FAKE_SUPPORTED_CERT_EXTENSION ),

  1541     OD( x509CertIssuer,               SEC_OID_X509_CERT_ISSUER,

  1542         "Certificate Issuer Extension",CKM_INVALID_MECHANISM,

  1543 	FAKE_SUPPORTED_CERT_EXTENSION ),

  1544     OD( x509FreshestCRL,              SEC_OID_X509_FRESHEST_CRL,

  1545         "Freshest CRL",               CKM_INVALID_MECHANISM,

  1546 	UNSUPPORTED_CERT_EXTENSION ),

  1547     OD( x509InhibitAnyPolicy,         SEC_OID_X509_INHIBIT_ANY_POLICY,

  1548         "Inhibit Any Policy",         CKM_INVALID_MECHANISM,

  1549 	FAKE_SUPPORTED_CERT_EXTENSION ),

  1550     OD( x509SubjectInfoAccess,        SEC_OID_X509_SUBJECT_INFO_ACCESS,

  1551         "Subject Info Access",        CKM_INVALID_MECHANISM,

  1552 	UNSUPPORTED_CERT_EXTENSION ),

  1554     /* Camellia algorithm OIDs */

  1555     OD( camellia128_CBC, SEC_OID_CAMELLIA_128_CBC,

  1556 	"CAMELLIA-128-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),

  1557     OD( camellia192_CBC, SEC_OID_CAMELLIA_192_CBC,

  1558 	"CAMELLIA-192-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),

  1559     OD( camellia256_CBC, SEC_OID_CAMELLIA_256_CBC,

  1560 	"CAMELLIA-256-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),

  1562     /* PKCS 5 v2 OIDS */

  1563     OD( pkcs5Pbkdf2, SEC_OID_PKCS5_PBKDF2,

  1564 	"PKCS #5 Password Based Key Dervive Function v2 ",

  1565 	CKM_PKCS5_PBKD2, INVALID_CERT_EXTENSION ),

  1566     OD( pkcs5Pbes2, SEC_OID_PKCS5_PBES2,

  1567 	"PKCS #5 Password Based Encryption v2 ",

  1568 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1569     OD( pkcs5Pbmac1, SEC_OID_PKCS5_PBMAC1,

  1570 	"PKCS #5 Password Based Authentication v1 ",

  1571 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1572     OD( hmac_sha1, SEC_OID_HMAC_SHA1, "HMAC SHA-1",

  1573 	CKM_SHA_1_HMAC, INVALID_CERT_EXTENSION ),

  1574     OD( hmac_sha224, SEC_OID_HMAC_SHA224, "HMAC SHA-224",

  1575 	CKM_SHA224_HMAC, INVALID_CERT_EXTENSION ),

  1576     OD( hmac_sha256, SEC_OID_HMAC_SHA256, "HMAC SHA-256",

  1577 	CKM_SHA256_HMAC, INVALID_CERT_EXTENSION ),

  1578     OD( hmac_sha384, SEC_OID_HMAC_SHA384, "HMAC SHA-384",

  1579 	CKM_SHA384_HMAC, INVALID_CERT_EXTENSION ),

  1580     OD( hmac_sha512, SEC_OID_HMAC_SHA512, "HMAC SHA-512",

  1581 	CKM_SHA512_HMAC, INVALID_CERT_EXTENSION ),

  1583     /* SIA extension OIDs */

  1584     OD( x509SIATimeStamping,          SEC_OID_PKIX_TIMESTAMPING,

  1585         "SIA Time Stamping",          CKM_INVALID_MECHANISM,

  1586 	INVALID_CERT_EXTENSION ),

  1587     OD( x509SIACaRepository,          SEC_OID_PKIX_CA_REPOSITORY,

  1588         "SIA CA Repository",          CKM_INVALID_MECHANISM,

  1589 	INVALID_CERT_EXTENSION ),

  1591     OD( isoSHA1WithRSASignature, SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE,

  1592 	"ISO SHA-1 with RSA Signature",

  1593 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1595     /* SEED algorithm OIDs */

  1596     OD( seed_CBC, SEC_OID_SEED_CBC,

  1597 	"SEED-CBC", CKM_SEED_CBC, INVALID_CERT_EXTENSION),

  1599     OD( x509CertificatePoliciesAnyPolicy, SEC_OID_X509_ANY_POLICY,

  1600  	"Certificate Policies AnyPolicy",

  1601         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1603     OD( pkcs1RSAOAEPEncryption, SEC_OID_PKCS1_RSA_OAEP_ENCRYPTION,

  1604 	"PKCS #1 RSA-OAEP Encryption", CKM_RSA_PKCS_OAEP,

  1605 	INVALID_CERT_EXTENSION ),

  1607     OD( pkcs1MGF1, SEC_OID_PKCS1_MGF1,

  1608 	"PKCS #1 MGF1 Mask Generation Function", CKM_INVALID_MECHANISM,

  1609 	INVALID_CERT_EXTENSION ),

  1611     OD( pkcs1PSpecified, SEC_OID_PKCS1_PSPECIFIED,

  1612 	"PKCS #1 RSA-OAEP Explicitly Specified Encoding Parameters",

  1613 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1615     OD( pkcs1RSAPSSSignature, SEC_OID_PKCS1_RSA_PSS_SIGNATURE,

  1616 	"PKCS #1 RSA-PSS Signature", CKM_RSA_PKCS_PSS,

  1617 	INVALID_CERT_EXTENSION ),

  1619     OD( pkcs1SHA224WithRSAEncryption, SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION,

  1620 	"PKCS #1 SHA-224 With RSA Encryption", CKM_SHA224_RSA_PKCS,

  1621 	INVALID_CERT_EXTENSION ),

  1623     OD( sha224, SEC_OID_SHA224, "SHA-224", CKM_SHA224, INVALID_CERT_EXTENSION),

  1625     OD( evIncorporationLocality, SEC_OID_EV_INCORPORATION_LOCALITY,

  1626         "Jurisdiction of Incorporation Locality Name",

  1627 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1628     OD( evIncorporationState,    SEC_OID_EV_INCORPORATION_STATE,

  1629         "Jurisdiction of Incorporation State Name",

  1630 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1631     OD( evIncorporationCountry,  SEC_OID_EV_INCORPORATION_COUNTRY,

  1632         "Jurisdiction of Incorporation Country Name",

  1633 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1634     OD( x520BusinessCategory,    SEC_OID_BUSINESS_CATEGORY,

  1635         "Business Category",

  1636 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1638     OD( nistDSASignaturewithSHA224Digest,

  1639 	SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA224_DIGEST,

  1640 	"DSA with SHA-224 Signature",

  1641 	CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),

  1642     OD( nistDSASignaturewithSHA256Digest,

  1643 	SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA256_DIGEST,

  1644 	"DSA with SHA-256 Signature",

  1645 	CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),

  1646     OD( msExtendedKeyUsageTrustListSigning,

  1647         SEC_OID_MS_EXT_KEY_USAGE_CTL_SIGNING,

  1648         "Microsoft Trust List Signing",

  1649 	CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),

  1650     OD( x520Name, SEC_OID_AVA_NAME,

  1651     	"X520 Name",    CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION )

  1652 };

  1654 /* PRIVATE EXTENDED SECOID Table

  1655  * This table is private. Its structure is opaque to the outside.

  1656  * It is indexed by the same SECOidTag as the oids table above.

  1657  * Every member of this struct must have accessor functions (set, get)

  1658  * and those functions must operate by value, not by reference.

  1659  * The addresses of the contents of this table must not be exposed

  1660  * by the accessor functions.

  1661  */

  1662 typedef struct privXOidStr {

  1663     PRUint32	notPolicyFlags; /* ones complement of policy flags */

  1664 } privXOid;

  1666 static privXOid xOids[SEC_OID_TOTAL];

  1668 /*

  1669  * now the dynamic table. The dynamic table gets build at init time.

  1670  * and conceivably gets modified if the user loads new crypto modules.

  1671  * All this static data, and the allocated data to which it points,

  1672  * is protected by a global reader/writer lock.

  1673  * The c language guarantees that global and static data that is not

  1674  * explicitly initialized will be initialized with zeros.  If we

  1675  * initialize it with zeros, the data goes into the initialized data

  1676  * secment, and increases the size of the library.  By leaving it

  1677  * uninitialized, it is allocated in BSS, and does NOT increase the

  1678  * library size.

  1679  */

  1681 typedef struct dynXOidStr {

  1682     SECOidData  data;

  1683     privXOid    priv;

  1684 } dynXOid;

  1686 static NSSRWLock   * dynOidLock;

  1687 static PLArenaPool * dynOidPool;

  1688 static PLHashTable * dynOidHash;

  1689 static dynXOid    ** dynOidTable;	/* not in the pool */

  1690 static int           dynOidEntriesAllocated;

  1691 static int           dynOidEntriesUsed;

  1693 /* Creates NSSRWLock and dynOidPool at initialization time.

  1694 */

  1695 static SECStatus

  1696 secoid_InitDynOidData(void)

  1697 {

  1698     SECStatus   rv = SECSuccess;

  1700     dynOidLock = NSSRWLock_New(1, "dynamic OID data");

  1701     if (!dynOidLock) {

  1702     	return SECFailure; /* Error code should already be set. */

  1703     }

  1704     dynOidPool = PORT_NewArena(2048);

  1705     if (!dynOidPool) {

  1706         rv = SECFailure /* Error code should already be set. */;

  1707     }

  1708     return rv;

  1709 }

  1711 /* Add oidData to hash table.  Caller holds write lock dynOidLock. */

  1712 static SECStatus

  1713 secoid_HashDynamicOiddata(const SECOidData * oid)

  1714 {

  1715     PLHashEntry *entry;

  1717     if (!dynOidHash) {

  1718         dynOidHash = PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,

  1719 			PL_CompareValues, NULL, NULL);

  1720 	if ( !dynOidHash ) {

  1721 	    return SECFailure;

  1722 	}

  1723     }

  1725     entry = PL_HashTableAdd( dynOidHash, &oid->oid, (void *)oid );

  1726     return entry ? SECSuccess : SECFailure;

  1727 }

  1730 /*

  1731  * Lookup a Dynamic OID. Dynamic OID's still change slowly, so it's

  1732  * cheaper to rehash the table when it changes than it is to do the loop

  1733  * each time.

  1734  */

  1735 static SECOidData *

  1736 secoid_FindDynamic(const SECItem *key)

  1737 {

  1738     SECOidData *ret = NULL;

  1740     if (dynOidHash) {

  1741 	NSSRWLock_LockRead(dynOidLock);

  1742 	if (dynOidHash) { /* must check it again with lock held. */

  1743 	    ret = (SECOidData *)PL_HashTableLookup(dynOidHash, key);

  1744 	}

  1745 	NSSRWLock_UnlockRead(dynOidLock);

  1746     }

  1747     if (ret == NULL) {

  1748 	PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);

  1749     }

  1750     return ret;

  1751 }

  1753 static dynXOid *

  1754 secoid_FindDynamicByTag(SECOidTag tagnum)

  1755 {

  1756     dynXOid *dxo = NULL;

  1757     int tagNumDiff;

  1759     if (tagnum < SEC_OID_TOTAL) {

  1760 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  1761 	return NULL;

  1762     }

  1763     tagNumDiff = tagnum - SEC_OID_TOTAL;

  1765     if (dynOidTable) {

  1766 	NSSRWLock_LockRead(dynOidLock);

  1767 	if (dynOidTable != NULL && /* must check it again with lock held. */

  1768 	    tagNumDiff < dynOidEntriesUsed) {

  1769 	    dxo = dynOidTable[tagNumDiff];

  1770 	}

  1771 	NSSRWLock_UnlockRead(dynOidLock);

  1772     }

  1773     if (dxo == NULL) {

  1774 	PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);

  1775     }

  1776     return dxo;

  1777 }

  1779 /*

  1780  * This routine is thread safe now.

  1781  */

  1782 SECOidTag

  1783 SECOID_AddEntry(const SECOidData * src)

  1784 {

  1785     SECOidData * dst;

  1786     dynXOid    **table;

  1787     SECOidTag    ret         = SEC_OID_UNKNOWN;

  1788     SECStatus    rv;

  1789     int          tableEntries;

  1790     int          used;

  1792     if (!src || !src->oid.data || !src->oid.len || \

  1793         !src->desc || !strlen(src->desc)) {

  1794 	PORT_SetError(SEC_ERROR_INVALID_ARGS);

  1795 	return ret;

  1796     }

  1797     if (src->supportedExtension != INVALID_CERT_EXTENSION     &&

  1798     	src->supportedExtension != UNSUPPORTED_CERT_EXTENSION &&

  1799     	src->supportedExtension != SUPPORTED_CERT_EXTENSION     ) {

  1800 	PORT_SetError(SEC_ERROR_INVALID_ARGS);

  1801 	return ret;

  1802     }

  1804     if (!dynOidPool || !dynOidLock) {

  1805 	PORT_SetError(SEC_ERROR_NOT_INITIALIZED);

  1806     	return ret;

  1807     }

  1809     NSSRWLock_LockWrite(dynOidLock);

  1811     /* We've just acquired the write lock, and now we call FindOIDTag

  1812     ** which will acquire and release the read lock.  NSSRWLock has been

  1813     ** designed to allow this very case without deadlock.  This approach

  1814     ** makes the test for the presence of the OID, and the subsequent

  1815     ** addition of the OID to the table a single atomic write operation.

  1816     */

  1817     ret = SECOID_FindOIDTag(&src->oid);

  1818     if (ret != SEC_OID_UNKNOWN) {

  1819     	/* we could return an error here, but I chose not to do that.

  1820 	** This way, if we add an OID to the shared library's built in

  1821 	** list of OIDs in some future release, and that OID is the same

  1822 	** as some OID that a program has been adding, the program will

  1823 	** not suddenly stop working.

  1824 	*/

  1825 	goto done;

  1826     }

  1828     table        = dynOidTable;

  1829     tableEntries = dynOidEntriesAllocated;

  1830     used         = dynOidEntriesUsed;

  1832     if (used + 1 > tableEntries) {

  1833 	dynXOid   ** newTable;

  1834 	int          newTableEntries = tableEntries + 16;

  1836 	newTable = (dynXOid **)PORT_Realloc(table,

  1837 				       newTableEntries * sizeof(dynXOid *));

  1838 	if (newTable == NULL) {

  1839 	    goto done;

  1840 	}

  1841 	dynOidTable            = table        = newTable;

  1842 	dynOidEntriesAllocated = tableEntries = newTableEntries;

  1843     }

  1845     /* copy oid structure */

  1846     dst = (SECOidData *)PORT_ArenaZNew(dynOidPool, dynXOid);

  1847     if (!dst) {

  1848     	goto done;

  1849     }

  1850     rv  = SECITEM_CopyItem(dynOidPool, &dst->oid, &src->oid);

  1851     if (rv != SECSuccess) {

  1852 	goto done;

  1853     }

  1854     dst->desc = PORT_ArenaStrdup(dynOidPool, src->desc);

  1855     if (!dst->desc) {

  1856 	goto done;

  1857     }

  1858     dst->offset             = (SECOidTag)(used + SEC_OID_TOTAL);

  1859     dst->mechanism          = src->mechanism;

  1860     dst->supportedExtension = src->supportedExtension;

  1862     rv = secoid_HashDynamicOiddata(dst);

  1863     if (rv == SECSuccess) {

  1864 	table[used++] = (dynXOid *)dst;

  1865 	dynOidEntriesUsed = used;

  1866 	ret = dst->offset;

  1867     }

  1868 done:

  1869     NSSRWLock_UnlockWrite(dynOidLock);

  1870     return ret;

  1871 }

  1874 /* normal static table processing */

  1875 static PLHashTable *oidhash     = NULL;

  1876 static PLHashTable *oidmechhash = NULL;

  1878 static PLHashNumber

  1879 secoid_HashNumber(const void *key)

  1880 {

  1881     return (PLHashNumber) key;

  1882 }

  1884 static void

  1885 handleHashAlgSupport(char * envVal)

  1886 {

  1887     char * myVal = PORT_Strdup(envVal);  /* Get a copy we can alter */

  1888     char * arg   = myVal;

  1890     while (arg && *arg) {

  1891 	char *   nextArg = PL_strpbrk(arg, ";");

  1892 	PRUint32 notEnable;

  1894 	if (nextArg) {

  1895 	    while (*nextArg == ';') {

  1896 		*nextArg++ = '\0';

  1897 	    }

  1898 	}

  1899 	notEnable = (*arg == '-') ? NSS_USE_ALG_IN_CERT_SIGNATURE : 0;

  1900 	if ((*arg == '+' || *arg == '-') && *++arg) {

  1901 	    int i;

  1903 	    for (i = 1; i < SEC_OID_TOTAL; i++) {

  1904 	        if (oids[i].desc && strstr(arg, oids[i].desc)) {

  1905 		     xOids[i].notPolicyFlags = notEnable |

  1906 		    (xOids[i].notPolicyFlags & ~NSS_USE_ALG_IN_CERT_SIGNATURE);

  1907 		}

  1908 	    }

  1909 	}

  1910 	arg = nextArg;

  1911     }

  1912     PORT_Free(myVal);  /* can handle NULL argument OK */

  1913 }

  1915 SECStatus

  1916 SECOID_Init(void)

  1917 {

  1918     PLHashEntry *entry;

  1919     const SECOidData *oid;

  1920     int i;

  1921     char * envVal;

  1922     volatile char c; /* force a reference that won't get optimized away */

  1924     c = __nss_util_rcsid[0] + __nss_util_sccsid[0];

  1926     if (oidhash) {

  1927 	return SECSuccess; /* already initialized */

  1928     }

  1930     if (!PR_GetEnv("NSS_ALLOW_WEAK_SIGNATURE_ALG")) {

  1931 	/* initialize any policy flags that are disabled by default */

  1932 	xOids[SEC_OID_MD2                           ].notPolicyFlags = ~0;

  1933 	xOids[SEC_OID_MD4                           ].notPolicyFlags = ~0;

  1934 	xOids[SEC_OID_MD5                           ].notPolicyFlags = ~0;

  1935 	xOids[SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;

  1936 	xOids[SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;

  1937 	xOids[SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;

  1938 	xOids[SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC].notPolicyFlags = ~0;

  1939 	xOids[SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC].notPolicyFlags = ~0;

  1940     }

  1942     envVal = PR_GetEnv("NSS_HASH_ALG_SUPPORT");

  1943     if (envVal)

  1944     	handleHashAlgSupport(envVal);

  1946     if (secoid_InitDynOidData() != SECSuccess) {

  1947         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  1948         PORT_Assert(0); /* this function should never fail */

  1949     	return SECFailure;

  1950     }

  1952     oidhash = PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,

  1953 			PL_CompareValues, NULL, NULL);

  1954     oidmechhash = PL_NewHashTable(0, secoid_HashNumber, PL_CompareValues,

  1955 			PL_CompareValues, NULL, NULL);

  1957     if ( !oidhash || !oidmechhash) {

  1958 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  1959  	PORT_Assert(0); /*This function should never fail. */

  1960 	return(SECFailure);

  1961     }

  1963     for ( i = 0; i < SEC_OID_TOTAL; i++ ) {

  1964 	oid = &oids[i];

  1966 	PORT_Assert ( oid->offset == i );

  1968 	entry = PL_HashTableAdd( oidhash, &oid->oid, (void *)oid );

  1969 	if ( entry == NULL ) {

  1970 	    PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  1971             PORT_Assert(0); /*This function should never fail. */

  1972 	    return(SECFailure);

  1973 	}

  1975 	if ( oid->mechanism != CKM_INVALID_MECHANISM ) {

  1976 	    entry = PL_HashTableAdd( oidmechhash,

  1977 					(void *)oid->mechanism, (void *)oid );

  1978 	    if ( entry == NULL ) {

  1979 	        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  1980                 PORT_Assert(0); /* This function should never fail. */

  1981 		return(SECFailure);

  1982 	    }

  1983 	}

  1984     }

  1986     PORT_Assert (i == SEC_OID_TOTAL);

  1988     return(SECSuccess);

  1989 }

  1991 SECOidData *

  1992 SECOID_FindOIDByMechanism(unsigned long mechanism)

  1993 {

  1994     SECOidData *ret;

  1996     PR_ASSERT(oidhash != NULL);

  1998     ret = PL_HashTableLookupConst ( oidmechhash, (void *)mechanism);

  1999     if ( ret == NULL ) {

  2000         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

  2001     }

  2003     return (ret);

  2004 }

  2006 SECOidData *

  2007 SECOID_FindOID(const SECItem *oid)

  2008 {

  2009     SECOidData *ret;

  2011     PR_ASSERT(oidhash != NULL);

  2013     ret = PL_HashTableLookupConst ( oidhash, oid );

  2014     if ( ret == NULL ) {

  2015 	ret  = secoid_FindDynamic(oid);

  2016 	if (ret == NULL) {

  2017 	    PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);

  2018 	}

  2019     }

  2021     return(ret);

  2022 }

  2024 SECOidTag

  2025 SECOID_FindOIDTag(const SECItem *oid)

  2026 {

  2027     SECOidData *oiddata;

  2029     oiddata = SECOID_FindOID (oid);

  2030     if (oiddata == NULL)

  2031 	return SEC_OID_UNKNOWN;

  2033     return oiddata->offset;

  2034 }

  2036 /* This really should return const. */

  2037 SECOidData *

  2038 SECOID_FindOIDByTag(SECOidTag tagnum)

  2039 {

  2040     if (tagnum >= SEC_OID_TOTAL) {

  2041 	return (SECOidData *)secoid_FindDynamicByTag(tagnum);

  2042     }

  2044     PORT_Assert((unsigned int)tagnum < SEC_OID_TOTAL);

  2045     return (SECOidData *)(&oids[tagnum]);

  2046 }

  2048 PRBool SECOID_KnownCertExtenOID (SECItem *extenOid)

  2049 {

  2050     SECOidData * oidData;

  2052     oidData = SECOID_FindOID (extenOid);

  2053     if (oidData == (SECOidData *)NULL)

  2054 	return (PR_FALSE);

  2055     return ((oidData->supportedExtension == SUPPORTED_CERT_EXTENSION) ?

  2056             PR_TRUE : PR_FALSE);

  2057 }

  2060 const char *

  2061 SECOID_FindOIDTagDescription(SECOidTag tagnum)

  2062 {

  2063   const SECOidData *oidData = SECOID_FindOIDByTag(tagnum);

  2064   return oidData ? oidData->desc : 0;

  2065 }

  2067 /* --------- opaque extended OID table accessor functions ---------------*/

  2068 /*

  2069  * Any of these functions may return SECSuccess or SECFailure with the error

  2070  * code set to SEC_ERROR_UNKNOWN_OBJECT_TYPE if the SECOidTag is out of range.

  2071  */

  2073 static privXOid *

  2074 secoid_FindXOidByTag(SECOidTag tagnum)

  2075 {

  2076     if (tagnum >= SEC_OID_TOTAL) {

  2077 	dynXOid *dxo = secoid_FindDynamicByTag(tagnum);

  2078 	return (dxo ? &dxo->priv : NULL);

  2079     }

  2081     PORT_Assert((unsigned int)tagnum < SEC_OID_TOTAL);

  2082     return &xOids[tagnum];

  2083 }

  2085 /* The Get function outputs the 32-bit value associated with the SECOidTag.

  2086  * Flags bits are the NSS_USE_ALG_ #defines in "secoidt.h".

  2087  * Default value for any algorithm is 0xffffffff (enabled for all purposes).

  2088  * No value is output if function returns SECFailure.

  2089  */

  2090 SECStatus

  2091 NSS_GetAlgorithmPolicy(SECOidTag tag, PRUint32 *pValue)

  2092 {

  2093     privXOid * pxo = secoid_FindXOidByTag(tag);

  2094     if (!pxo)

  2095     	return SECFailure;

  2096     if (!pValue) {

  2097         PORT_SetError(SEC_ERROR_INVALID_ARGS);

  2098 	return SECFailure;

  2099     }

  2100     *pValue = ~(pxo->notPolicyFlags);

  2101     return SECSuccess;

  2102 }

  2104 /* The Set function modifies the stored value according to the following

  2105  * algorithm:

  2106  *   policy[tag] = (policy[tag] & ~clearBits) | setBits;

  2107  */

  2108 SECStatus

  2109 NSS_SetAlgorithmPolicy(SECOidTag tag, PRUint32 setBits, PRUint32 clearBits)

  2110 {

  2111     privXOid * pxo = secoid_FindXOidByTag(tag);

  2112     PRUint32   policyFlags;

  2113     if (!pxo)

  2114     	return SECFailure;

  2115     /* The stored policy flags are the ones complement of the flags as

  2116      * seen by the user.  This is not atomic, but these changes should

  2117      * be done rarely, e.g. at initialization time.

  2118      */

  2119     policyFlags = ~(pxo->notPolicyFlags);

  2120     policyFlags = (policyFlags & ~clearBits) | setBits;

  2121     pxo->notPolicyFlags = ~policyFlags;

  2122     return SECSuccess;

  2123 }

  2125 /* --------- END OF opaque extended OID table accessor functions ---------*/

  2127 /* for now, this is only used in a single place, so it can remain static */

  2128 static PRBool parentForkedAfterC_Initialize;

  2130 #define SKIP_AFTER_FORK(x) if (!parentForkedAfterC_Initialize) x

  2132 /*

  2133  * free up the oid tables.

  2134  */

  2135 SECStatus

  2136 SECOID_Shutdown(void)

  2137 {

  2138     if (oidhash) {

  2139 	PL_HashTableDestroy(oidhash);

  2140 	oidhash = NULL;

  2141     }

  2142     if (oidmechhash) {

  2143 	PL_HashTableDestroy(oidmechhash);

  2144 	oidmechhash = NULL;

  2145     }

  2146     /* Have to handle the case where the lock was created, but

  2147     ** the pool wasn't.

  2148     ** I'm not going to attempt to create the lock, just to protect

  2149     ** the destruction of data that probably isn't initialized anyway.

  2150     */

  2151     if (dynOidLock) {

  2152 	SKIP_AFTER_FORK(NSSRWLock_LockWrite(dynOidLock));

  2153 	if (dynOidHash) {

  2154 	    PL_HashTableDestroy(dynOidHash);

  2155 	    dynOidHash = NULL;

  2156 	}

  2157 	if (dynOidPool) {

  2158 	    PORT_FreeArena(dynOidPool, PR_FALSE);

  2159 	    dynOidPool = NULL;

  2160 	}

  2161 	if (dynOidTable) {

  2162 	    PORT_Free(dynOidTable);

  2163 	    dynOidTable = NULL;

  2164 	}

  2165 	dynOidEntriesAllocated = 0;

  2166 	dynOidEntriesUsed = 0;

  2168 	SKIP_AFTER_FORK(NSSRWLock_UnlockWrite(dynOidLock));

  2169 	SKIP_AFTER_FORK(NSSRWLock_Destroy(dynOidLock));

  2170 	dynOidLock = NULL;

  2171     } else {

  2172     	/* Since dynOidLock doesn't exist, then all the data it protects

  2173 	** should be uninitialized.  We'll check that (in DEBUG builds),

  2174 	** and then make sure it is so, in case NSS is reinitialized.

  2175 	*/

  2176 	PORT_Assert(!dynOidHash && !dynOidPool && !dynOidTable && \

  2177 	            !dynOidEntriesAllocated && !dynOidEntriesUsed);

  2178 	dynOidHash = NULL;

  2179 	dynOidPool = NULL;

  2180 	dynOidTable = NULL;

  2181 	dynOidEntriesAllocated = 0;

  2182 	dynOidEntriesUsed = 0;

  2183     }

  2184     memset(xOids, 0, sizeof xOids);

  2185     return SECSuccess;

  2186 }

  2188 void UTIL_SetForkState(PRBool forked)

  2189 {

  2190     parentForkedAfterC_Initialize = forked;

  2191 }

  2193 const char *

  2194 NSSUTIL_GetVersion(void)

  2195 {

  2196     return NSSUTIL_VERSION;

  2197 }

The Tor Browser / file revision

security/nss/lib/util/secoid.c@b8a032363ba2

security/nss/lib/util/secoid.c