michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /*
michael@0:  * Interfaces of the CMS implementation.
michael@0:  */
michael@0: 
michael@0: #ifndef _CMS_H_
michael@0: #define _CMS_H_
michael@0: 
michael@0: #include "seccomon.h"
michael@0: 
michael@0: #include "secoidt.h"
michael@0: #include "certt.h"
michael@0: #include "keyt.h"
michael@0: #include "hasht.h"
michael@0: #include "cmst.h"
michael@0: 
michael@0: /************************************************************************/
michael@0: SEC_BEGIN_PROTOS
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsdecode.c - CMS decoding
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDecoder_Start - set up decoding of a DER-encoded CMS message
michael@0:  *
michael@0:  * "poolp" - pointer to arena for message, or NULL if new pool should be created
michael@0:  * "cb", "cb_arg" - callback function and argument for delivery of inner content
michael@0:  *                  inner content will be stored in the message if cb is NULL.
michael@0:  * "pwfn", pwfn_arg" - callback function for getting token password
michael@0:  * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0:  */
michael@0: extern NSSCMSDecoderContext *
michael@0: NSS_CMSDecoder_Start(PLArenaPool *poolp,
michael@0: 		      NSSCMSContentCallback cb, void *cb_arg,
michael@0: 		      PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0: 		      NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDecoder_Update - feed DER-encoded data to decoder
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDecoder_Update(NSSCMSDecoderContext *p7dcx, const char *buf, unsigned long len);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDecoder_Cancel - cancel a decoding process
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSDecoder_Cancel(NSSCMSDecoderContext *p7dcx);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDecoder_Finish - mark the end of inner content and finish decoding
michael@0:  */
michael@0: extern NSSCMSMessage *
michael@0: NSS_CMSDecoder_Finish(NSSCMSDecoderContext *p7dcx);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_CreateFromDER - decode a CMS message from DER encoded data
michael@0:  */
michael@0: extern NSSCMSMessage *
michael@0: NSS_CMSMessage_CreateFromDER(SECItem *DERmessage,
michael@0: 		    NSSCMSContentCallback cb, void *cb_arg,
michael@0: 		    PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0: 		    NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsencode.c - CMS encoding
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncoder_Start - set up encoding of a CMS message
michael@0:  *
michael@0:  * "cmsg" - message to encode
michael@0:  * "outputfn", "outputarg" - callback function for delivery of DER-encoded output
michael@0:  *                           will not be called if NULL.
michael@0:  * "dest" - if non-NULL, pointer to SECItem that will hold the DER-encoded output
michael@0:  * "destpoolp" - pool to allocate DER-encoded output in
michael@0:  * "pwfn", pwfn_arg" - callback function for getting token password
michael@0:  * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0:  * "detached_digestalgs", "detached_digests" - digests from detached content
michael@0:  */
michael@0: extern NSSCMSEncoderContext *
michael@0: NSS_CMSEncoder_Start(NSSCMSMessage *cmsg,
michael@0: 			NSSCMSContentCallback outputfn, void *outputarg,
michael@0: 			SECItem *dest, PLArenaPool *destpoolp,
michael@0: 			PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0: 			NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
michael@0: 			SECAlgorithmID **detached_digestalgs, SECItem **detached_digests);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncoder_Update - take content data delivery from the user
michael@0:  *
michael@0:  * "p7ecx" - encoder context
michael@0:  * "data" - content data
michael@0:  * "len" - length of content data
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncoder_Update(NSSCMSEncoderContext *p7ecx, const char *data, unsigned long len);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncoder_Cancel - stop all encoding
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncoder_Cancel(NSSCMSEncoderContext *p7ecx);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncoder_Finish - signal the end of data
michael@0:  *
michael@0:  * we need to walk down the chain of encoders and the finish them from the innermost out
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncoder_Finish(NSSCMSEncoderContext *p7ecx);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsmessage.c - CMS message object
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_Create - create a CMS message object
michael@0:  *
michael@0:  * "poolp" - arena to allocate memory from, or NULL if new arena should be created
michael@0:  */
michael@0: extern NSSCMSMessage *
michael@0: NSS_CMSMessage_Create(PLArenaPool *poolp);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_SetEncodingParams - set up a CMS message object for encoding or decoding
michael@0:  *
michael@0:  * "cmsg" - message object
michael@0:  * "pwfn", pwfn_arg" - callback function for getting token password
michael@0:  * "decrypt_key_cb", "decrypt_key_cb_arg" - callback function for getting bulk key for encryptedData
michael@0:  * "detached_digestalgs", "detached_digests" - digests from detached content
michael@0:  *
michael@0:  * used internally.
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSMessage_SetEncodingParams(NSSCMSMessage *cmsg,
michael@0: 			PK11PasswordFunc pwfn, void *pwfn_arg,
michael@0: 			NSSCMSGetDecryptKeyCallback decrypt_key_cb, void *decrypt_key_cb_arg,
michael@0: 			SECAlgorithmID **detached_digestalgs, SECItem **detached_digests);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_Destroy - destroy a CMS message and all of its sub-pieces.
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSMessage_Destroy(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_Copy - return a copy of the given message. 
michael@0:  *
michael@0:  * The copy may be virtual or may be real -- either way, the result needs
michael@0:  * to be passed to NSS_CMSMessage_Destroy later (as does the original).
michael@0:  */
michael@0: extern NSSCMSMessage *
michael@0: NSS_CMSMessage_Copy(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_GetArena - return a pointer to the message's arena pool
michael@0:  */
michael@0: extern PLArenaPool *
michael@0: NSS_CMSMessage_GetArena(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_GetContentInfo - return a pointer to the top level contentInfo
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSMessage_GetContentInfo(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * Return a pointer to the actual content. 
michael@0:  * In the case of those types which are encrypted, this returns the *plain* content.
michael@0:  * In case of nested contentInfos, this descends and retrieves the innermost content.
michael@0:  */
michael@0: extern SECItem *
michael@0: NSS_CMSMessage_GetContent(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_ContentLevelCount - count number of levels of CMS content objects in this message
michael@0:  *
michael@0:  * CMS data content objects do not count.
michael@0:  */
michael@0: extern int
michael@0: NSS_CMSMessage_ContentLevelCount(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_ContentLevel - find content level #n
michael@0:  *
michael@0:  * CMS data content objects do not count.
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSMessage_ContentLevel(NSSCMSMessage *cmsg, int n);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_ContainsCertsOrCrls - see if message contains certs along the way
michael@0:  */
michael@0: extern PRBool
michael@0: NSS_CMSMessage_ContainsCertsOrCrls(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_IsEncrypted - see if message contains a encrypted submessage
michael@0:  */
michael@0: extern PRBool
michael@0: NSS_CMSMessage_IsEncrypted(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_IsSigned - see if message contains a signed submessage
michael@0:  *
michael@0:  * If the CMS message has a SignedData with a signature (not just a SignedData)
michael@0:  * return true; false otherwise.  This can/should be called before calling
michael@0:  * VerifySignature, which will always indicate failure if no signature is
michael@0:  * present, but that does not mean there even was a signature!
michael@0:  * Note that the content itself can be empty (detached content was sent
michael@0:  * another way); it is the presence of the signature that matters.
michael@0:  */
michael@0: extern PRBool
michael@0: NSS_CMSMessage_IsSigned(NSSCMSMessage *cmsg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSMessage_IsContentEmpty - see if content is empty
michael@0:  *
michael@0:  * returns PR_TRUE is innermost content length is < minLen
michael@0:  * XXX need the encrypted content length (why?)
michael@0:  */
michael@0: extern PRBool
michael@0: NSS_CMSMessage_IsContentEmpty(NSSCMSMessage *cmsg, unsigned int minLen);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmscinfo.c - CMS contentInfo methods
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_Destroy - destroy a CMS contentInfo and all of its sub-pieces.
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSContentInfo_Destroy(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_GetChildContentInfo - get content's contentInfo (if it exists)
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSContentInfo_GetChildContentInfo(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_SetContent - set cinfo's content type & content to CMS object
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, SECOidTag type, void *ptr);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_SetContent_XXXX - typesafe wrappers for NSS_CMSContentInfo_SetType
michael@0:  *   set cinfo's content type & content to CMS object
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent_Data(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, SECItem *data, PRBool detached);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent_SignedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent_EnvelopedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent_DigestedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSDigestedData *digd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContent_EncryptedData(NSSCMSMessage *cmsg, NSSCMSContentInfo *cinfo, NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * turn off streaming for this content type.
michael@0:  * This could fail with SEC_ERROR_NO_MEMORY in memory constrained conditions.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetDontStream(NSSCMSContentInfo *cinfo, PRBool dontStream);
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_GetContent - get pointer to inner content
michael@0:  *
michael@0:  * needs to be casted...
michael@0:  */
michael@0: extern void *
michael@0: NSS_CMSContentInfo_GetContent(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSContentInfo_GetInnerContent - get pointer to innermost content
michael@0:  *
michael@0:  * this is typically only called by NSS_CMSMessage_GetContent()
michael@0:  */
michael@0: extern SECItem *
michael@0: NSS_CMSContentInfo_GetInnerContent(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_GetContentType{Tag,OID} - find out (saving pointer to lookup result
michael@0:  * for future reference) and return the inner content type.
michael@0:  */
michael@0: extern SECOidTag
michael@0: NSS_CMSContentInfo_GetContentTypeTag(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: extern SECItem *
michael@0: NSS_CMSContentInfo_GetContentTypeOID(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_GetContentEncAlgTag - find out (saving pointer to lookup result
michael@0:  * for future reference) and return the content encryption algorithm tag.
michael@0:  */
michael@0: extern SECOidTag
michael@0: NSS_CMSContentInfo_GetContentEncAlgTag(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSContentInfo_GetContentEncAlg - find out and return the content encryption algorithm tag.
michael@0:  */
michael@0: extern SECAlgorithmID *
michael@0: NSS_CMSContentInfo_GetContentEncAlg(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContentEncAlg(PLArenaPool *poolp, NSSCMSContentInfo *cinfo,
michael@0: 				    SECOidTag bulkalgtag, SECItem *parameters, int keysize);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSContentInfo_SetContentEncAlgID(PLArenaPool *poolp, NSSCMSContentInfo *cinfo,
michael@0: 				    SECAlgorithmID *algid, int keysize);
michael@0: 
michael@0: extern void
michael@0: NSS_CMSContentInfo_SetBulkKey(NSSCMSContentInfo *cinfo, PK11SymKey *bulkkey);
michael@0: 
michael@0: extern PK11SymKey *
michael@0: NSS_CMSContentInfo_GetBulkKey(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: extern int
michael@0: NSS_CMSContentInfo_GetBulkKeySize(NSSCMSContentInfo *cinfo);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsutil.c - CMS misc utility functions
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSArray_SortByDER - sort array of objects by objects' DER encoding
michael@0:  *
michael@0:  * make sure that the order of the objects guarantees valid DER (which must be
michael@0:  * in lexigraphically ascending order for a SET OF); if reordering is necessary it
michael@0:  * will be done in place (in objs).
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSArray_SortByDER(void **objs, const SEC_ASN1Template *objtemplate, void **objs2);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSUtil_DERCompare - for use with NSS_CMSArray_Sort to
michael@0:  *  sort arrays of SECItems containing DER
michael@0:  */
michael@0: extern int
michael@0: NSS_CMSUtil_DERCompare(void *a, void *b);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSAlgArray_GetIndexByAlgID - find a specific algorithm in an array of 
michael@0:  * algorithms.
michael@0:  *
michael@0:  * algorithmArray - array of algorithm IDs
michael@0:  * algid - algorithmid of algorithm to pick
michael@0:  *
michael@0:  * Returns:
michael@0:  *  An integer containing the index of the algorithm in the array or -1 if 
michael@0:  *  algorithm was not found.
michael@0:  */
michael@0: extern int
michael@0: NSS_CMSAlgArray_GetIndexByAlgID(SECAlgorithmID **algorithmArray, SECAlgorithmID *algid);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSAlgArray_GetIndexByAlgID - find a specific algorithm in an array of 
michael@0:  * algorithms.
michael@0:  *
michael@0:  * algorithmArray - array of algorithm IDs
michael@0:  * algiddata - id of algorithm to pick
michael@0:  *
michael@0:  * Returns:
michael@0:  *  An integer containing the index of the algorithm in the array or -1 if 
michael@0:  *  algorithm was not found.
michael@0:  */
michael@0: extern int
michael@0: NSS_CMSAlgArray_GetIndexByAlgTag(SECAlgorithmID **algorithmArray, SECOidTag algtag);
michael@0: 
michael@0: extern const SECHashObject *
michael@0: NSS_CMSUtil_GetHashObjByAlgID(SECAlgorithmID *algid);
michael@0: 
michael@0: extern const SEC_ASN1Template *
michael@0: NSS_CMSUtil_GetTemplateByTypeTag(SECOidTag type);
michael@0: 
michael@0: extern size_t
michael@0: NSS_CMSUtil_GetSizeByTypeTag(SECOidTag type);
michael@0: 
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSContent_GetContentInfo(void *msg, SECOidTag type);
michael@0: 
michael@0: extern const char *
michael@0: NSS_CMSUtil_VerificationStatusToString(NSSCMSVerificationStatus vs);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmssigdata.c - CMS signedData methods
michael@0:  ************************************************************************/
michael@0: 
michael@0: extern NSSCMSSignedData *
michael@0: NSS_CMSSignedData_Create(NSSCMSMessage *cmsg);
michael@0: 
michael@0: extern void
michael@0: NSS_CMSSignedData_Destroy(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_Encode_BeforeStart - do all the necessary things to a SignedData
michael@0:  *     before start of encoding.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - find out about the right value to put into sigd->version
michael@0:  *  - come up with a list of digestAlgorithms (which should be the union of the algorithms
michael@0:  *         in the signerinfos).
michael@0:  *         If we happen to have a pre-set list of algorithms (and digest values!), we
michael@0:  *         check if we have all the signerinfos' algorithms. If not, this is an error.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Encode_BeforeStart(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Encode_BeforeData(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_Encode_AfterData - do all the necessary things to a SignedData
michael@0:  *     after all the encapsulated data was passed through the encoder.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - create the signatures in all the SignerInfos
michael@0:  *
michael@0:  * Please note that nothing is done to the Certificates and CRLs in the message - this
michael@0:  * is entirely the responsibility of our callers.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Encode_AfterData(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Decode_BeforeData(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_Decode_AfterData - do all the necessary things to a SignedData
michael@0:  *     after all the encapsulated data was passed through the decoder.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Decode_AfterData(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_Decode_AfterEnd - do all the necessary things to a SignedData
michael@0:  *     after all decoding is finished.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_Decode_AfterEnd(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSSignedData_GetSignerInfos - retrieve the SignedData's signer list
michael@0:  */
michael@0: extern NSSCMSSignerInfo **
michael@0: NSS_CMSSignedData_GetSignerInfos(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern int
michael@0: NSS_CMSSignedData_SignerInfoCount(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern NSSCMSSignerInfo *
michael@0: NSS_CMSSignedData_GetSignerInfo(NSSCMSSignedData *sigd, int i);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSSignedData_GetDigestAlgs - retrieve the SignedData's digest algorithm list
michael@0:  */
michael@0: extern SECAlgorithmID **
michael@0: NSS_CMSSignedData_GetDigestAlgs(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_GetContentInfo - return pointer to this signedData's contentinfo
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSSignedData_GetContentInfo(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSSignedData_GetCertificateList - retrieve the SignedData's certificate list
michael@0:  */
michael@0: extern SECItem **
michael@0: NSS_CMSSignedData_GetCertificateList(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_ImportCerts(NSSCMSSignedData *sigd, CERTCertDBHandle *certdb,
michael@0: 				SECCertUsage certusage, PRBool keepcerts);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_HasDigests - see if we have digests in place
michael@0:  */
michael@0: extern PRBool
michael@0: NSS_CMSSignedData_HasDigests(NSSCMSSignedData *sigd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_VerifySignerInfo - check a signature.
michael@0:  *
michael@0:  * The digests were either calculated during decoding (and are stored in the
michael@0:  * signedData itself) or set after decoding using NSS_CMSSignedData_SetDigests.
michael@0:  *
michael@0:  * The verification checks if the signing cert is valid and has a trusted chain
michael@0:  * for the purpose specified by "certusage".
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_VerifySignerInfo(NSSCMSSignedData *sigd, int i, CERTCertDBHandle *certdb,
michael@0: 				    SECCertUsage certusage);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_VerifyCertsOnly - verify the certs in a certs-only message
michael@0: */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_VerifyCertsOnly(NSSCMSSignedData *sigd, 
michael@0:                                   CERTCertDBHandle *certdb, 
michael@0:                                   SECCertUsage usage);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_AddCertList(NSSCMSSignedData *sigd, CERTCertificateList *certlist);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_AddCertChain - add cert and its entire chain to the set of certs 
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_AddCertChain(NSSCMSSignedData *sigd, CERTCertificate *cert);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_AddCertificate(NSSCMSSignedData *sigd, CERTCertificate *cert);
michael@0: 
michael@0: extern PRBool
michael@0: NSS_CMSSignedData_ContainsCertsOrCrls(NSSCMSSignedData *sigd);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_AddSignerInfo(NSSCMSSignedData *sigd,
michael@0: 				NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_SetDigests(NSSCMSSignedData *sigd,
michael@0: 				SECAlgorithmID **digestalgs,
michael@0: 				SECItem **digests);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_SetDigestValue(NSSCMSSignedData *sigd,
michael@0: 				SECOidTag digestalgtag,
michael@0: 				SECItem *digestdata);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignedData_AddDigest(PLArenaPool *poolp,
michael@0: 				NSSCMSSignedData *sigd,
michael@0: 				SECOidTag digestalgtag,
michael@0: 				SECItem *digest);
michael@0: 
michael@0: extern SECItem *
michael@0: NSS_CMSSignedData_GetDigestValue(NSSCMSSignedData *sigd, SECOidTag digestalgtag);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignedData_CreateCertsOnly - create a certs-only SignedData.
michael@0:  *
michael@0:  * cert          - base certificates that will be included
michael@0:  * include_chain - if true, include the complete cert chain for cert
michael@0:  *
michael@0:  * More certs and chains can be added via AddCertificate and AddCertChain.
michael@0:  *
michael@0:  * An error results in a return value of NULL and an error set.
michael@0:  */
michael@0: extern NSSCMSSignedData *
michael@0: NSS_CMSSignedData_CreateCertsOnly(NSSCMSMessage *cmsg, CERTCertificate *cert, PRBool include_chain);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmssiginfo.c - signerinfo methods
michael@0:  ************************************************************************/
michael@0: 
michael@0: extern NSSCMSSignerInfo *
michael@0: NSS_CMSSignerInfo_Create(NSSCMSMessage *cmsg, CERTCertificate *cert, SECOidTag digestalgtag);
michael@0: extern NSSCMSSignerInfo *
michael@0: NSS_CMSSignerInfo_CreateWithSubjKeyID(NSSCMSMessage *cmsg, SECItem *subjKeyID, SECKEYPublicKey *pubKey, SECKEYPrivateKey *signingKey, SECOidTag digestalgtag);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_Destroy - destroy a SignerInfo data structure
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSSignerInfo_Destroy(NSSCMSSignerInfo *si);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_Sign - sign something
michael@0:  *
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_Sign(NSSCMSSignerInfo *signerinfo, SECItem *digest, SECItem *contentType);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_VerifyCertificate(NSSCMSSignerInfo *signerinfo, CERTCertDBHandle *certdb,
michael@0: 			    SECCertUsage certusage);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_Verify - verify the signature of a single SignerInfo
michael@0:  *
michael@0:  * Just verifies the signature. The assumption is that verification of the certificate
michael@0:  * is done already.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_Verify(NSSCMSSignerInfo *signerinfo, SECItem *digest, SECItem *contentType);
michael@0: 
michael@0: extern NSSCMSVerificationStatus
michael@0: NSS_CMSSignerInfo_GetVerificationStatus(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: extern SECOidData *
michael@0: NSS_CMSSignerInfo_GetDigestAlg(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: extern SECOidTag
michael@0: NSS_CMSSignerInfo_GetDigestAlgTag(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: extern int
michael@0: NSS_CMSSignerInfo_GetVersion(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: extern CERTCertificateList *
michael@0: NSS_CMSSignerInfo_GetCertList(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_GetSigningTime - return the signing time,
michael@0:  *				      in UTCTime format, of a CMS signerInfo.
michael@0:  *
michael@0:  * sinfo - signerInfo data for this signer
michael@0:  *
michael@0:  * Returns a pointer to XXXX (what?)
michael@0:  * A return value of NULL is an error.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_GetSigningTime(NSSCMSSignerInfo *sinfo, PRTime *stime);
michael@0: 
michael@0: /*
michael@0:  * Return the signing cert of a CMS signerInfo.
michael@0:  *
michael@0:  * the certs in the enclosing SignedData must have been imported already
michael@0:  */
michael@0: extern CERTCertificate *
michael@0: NSS_CMSSignerInfo_GetSigningCertificate(NSSCMSSignerInfo *signerinfo, CERTCertDBHandle *certdb);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_GetSignerCommonName - return the common name of the signer
michael@0:  *
michael@0:  * sinfo - signerInfo data for this signer
michael@0:  *
michael@0:  * Returns a pointer to allocated memory, which must be freed with PORT_Free.
michael@0:  * A return value of NULL is an error.
michael@0:  */
michael@0: extern char *
michael@0: NSS_CMSSignerInfo_GetSignerCommonName(NSSCMSSignerInfo *sinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_GetSignerEmailAddress - return the common name of the signer
michael@0:  *
michael@0:  * sinfo - signerInfo data for this signer
michael@0:  *
michael@0:  * Returns a pointer to allocated memory, which must be freed.
michael@0:  * A return value of NULL is an error.
michael@0:  */
michael@0: extern char *
michael@0: NSS_CMSSignerInfo_GetSignerEmailAddress(NSSCMSSignerInfo *sinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_AddAuthAttr - add an attribute to the
michael@0:  * authenticated (i.e. signed) attributes of "signerinfo". 
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_AddAuthAttr(NSSCMSSignerInfo *signerinfo, NSSCMSAttribute *attr);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_AddUnauthAttr - add an attribute to the
michael@0:  * unauthenticated attributes of "signerinfo". 
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_AddUnauthAttr(NSSCMSSignerInfo *signerinfo, NSSCMSAttribute *attr);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSSignerInfo_AddSigningTime - add the signing time to the
michael@0:  * authenticated (i.e. signed) attributes of "signerinfo". 
michael@0:  *
michael@0:  * This is expected to be included in outgoing signed
michael@0:  * messages for email (S/MIME) but is likely useful in other situations.
michael@0:  *
michael@0:  * This should only be added once; a second call will do nothing.
michael@0:  *
michael@0:  * XXX This will probably just shove the current time into "signerinfo"
michael@0:  * but it will not actually get signed until the entire item is
michael@0:  * processed for encoding.  Is this (expected to be small) delay okay?
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_AddSigningTime(NSSCMSSignerInfo *signerinfo, PRTime t);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_AddSMIMECaps - add a SMIMECapabilities attribute to the
michael@0:  * authenticated (i.e. signed) attributes of "signerinfo".
michael@0:  *
michael@0:  * This is expected to be included in outgoing signed
michael@0:  * messages for email (S/MIME).
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_AddSMIMECaps(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs - add a SMIMEEncryptionKeyPreferences attribute to the
michael@0:  * authenticated (i.e. signed) attributes of "signerinfo".
michael@0:  *
michael@0:  * This is expected to be included in outgoing signed messages for email (S/MIME).
michael@0:  */
michael@0: SECStatus
michael@0: NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs(NSSCMSSignerInfo *signerinfo, CERTCertificate *cert, CERTCertDBHandle *certdb);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs - add a SMIMEEncryptionKeyPreferences attribute to the
michael@0:  * authenticated (i.e. signed) attributes of "signerinfo", using the OID preferred by Microsoft.
michael@0:  *
michael@0:  * This is expected to be included in outgoing signed messages for email (S/MIME),
michael@0:  * if compatibility with Microsoft mail clients is wanted.
michael@0:  */
michael@0: SECStatus
michael@0: NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs(NSSCMSSignerInfo *signerinfo, CERTCertificate *cert, CERTCertDBHandle *certdb);
michael@0: 
michael@0: /* 
michael@0:  * NSS_CMSSignerInfo_AddCounterSignature - countersign a signerinfo
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_AddCounterSignature(NSSCMSSignerInfo *signerinfo,
michael@0: 				    SECOidTag digestalg, CERTCertificate signingcert);
michael@0: 
michael@0: /*
michael@0:  * XXXX the following needs to be done in the S/MIME layer code
michael@0:  * after signature of a signerinfo is verified
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_SMIMESignerInfo_SaveSMIMEProfile(NSSCMSSignerInfo *signerinfo);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSSignerInfo_IncludeCerts - set cert chain inclusion mode for this signer
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSSignerInfo_IncludeCerts(NSSCMSSignerInfo *signerinfo, NSSCMSCertChainMode cm, SECCertUsage usage);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsenvdata.c - CMS envelopedData methods
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Create - create an enveloped data message
michael@0:  */
michael@0: extern NSSCMSEnvelopedData *
michael@0: NSS_CMSEnvelopedData_Create(NSSCMSMessage *cmsg, SECOidTag algorithm, int keysize);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Destroy - destroy an enveloped data message
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSEnvelopedData_Destroy(NSSCMSEnvelopedData *edp);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_GetContentInfo - return pointer to this envelopedData's contentinfo
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSEnvelopedData_GetContentInfo(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_AddRecipient - add a recipientinfo to the enveloped data msg
michael@0:  *
michael@0:  * rip must be created on the same pool as edp - this is not enforced, though.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_AddRecipient(NSSCMSEnvelopedData *edp, NSSCMSRecipientInfo *rip);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Encode_BeforeStart - prepare this envelopedData for encoding
michael@0:  *
michael@0:  * at this point, we need
michael@0:  * - recipientinfos set up with recipient's certificates
michael@0:  * - a content encryption algorithm (if none, 3DES will be used)
michael@0:  *
michael@0:  * this function will generate a random content encryption key (aka bulk key),
michael@0:  * initialize the recipientinfos with certificate identification and wrap the bulk key
michael@0:  * using the proper algorithm for every certificiate.
michael@0:  * it will finally set the bulk algorithm and key so that the encode step can find it.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Encode_BeforeStart(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Encode_BeforeData - set up encryption
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Encode_BeforeData(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Encode_AfterData - finalize this envelopedData for encoding
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Encode_AfterData(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Decode_BeforeData - find our recipientinfo, 
michael@0:  * derive bulk key & set up our contentinfo
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Decode_BeforeData(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Decode_AfterData - finish decrypting this envelopedData's content
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Decode_AfterData(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEnvelopedData_Decode_AfterEnd - finish decoding this envelopedData
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEnvelopedData_Decode_AfterEnd(NSSCMSEnvelopedData *envd);
michael@0: 
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsrecinfo.c - CMS recipientInfo methods
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSRecipientInfo_Create - create a recipientinfo
michael@0:  *
michael@0:  * we currently do not create KeyAgreement recipientinfos with multiple recipientEncryptedKeys
michael@0:  * the certificate is supposed to have been verified by the caller
michael@0:  */
michael@0: extern NSSCMSRecipientInfo *
michael@0: NSS_CMSRecipientInfo_Create(NSSCMSMessage *cmsg, CERTCertificate *cert);
michael@0: 
michael@0: extern NSSCMSRecipientInfo *
michael@0: NSS_CMSRecipientInfo_CreateWithSubjKeyID(NSSCMSMessage   *cmsg, 
michael@0:                                          SECItem         *subjKeyID,
michael@0:                                          SECKEYPublicKey *pubKey);
michael@0: 
michael@0: extern NSSCMSRecipientInfo *
michael@0: NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert(NSSCMSMessage *cmsg, 
michael@0:                                                  CERTCertificate *cert);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSRecipientInfo_CreateNew - create a blank recipientinfo for 
michael@0:  * applications which want to encode their own CMS structures and
michael@0:  * key exchange types.
michael@0:  */
michael@0: extern NSSCMSRecipientInfo *
michael@0: NSS_CMSRecipientInfo_CreateNew(void* pwfn_arg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSRecipientInfo_CreateFromDER - create a recipientinfo  from partially
michael@0:  * decoded DER data for applications which want to encode their own CMS 
michael@0:  * structures and key exchange types.
michael@0:  */
michael@0: extern NSSCMSRecipientInfo *
michael@0: NSS_CMSRecipientInfo_CreateFromDER(SECItem* input, void* pwfn_arg);
michael@0: 
michael@0: extern void
michael@0: NSS_CMSRecipientInfo_Destroy(NSSCMSRecipientInfo *ri);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSRecipientInfo_GetCertAndKey - retrieve the cert and key from the
michael@0:  * recipientInfo struct. If retcert or retkey are NULL, the cert or 
michael@0:  * key (respectively) would not be returned). This function is a no-op if both 
michael@0:  * retcert and retkey are NULL. Caller inherits ownership of the cert and key
michael@0:  * he requested (and is responsible to free them).
michael@0:  */
michael@0: SECStatus NSS_CMSRecipientInfo_GetCertAndKey(NSSCMSRecipientInfo *ri,
michael@0:    CERTCertificate** retcert, SECKEYPrivateKey** retkey);
michael@0: 
michael@0: extern int
michael@0: NSS_CMSRecipientInfo_GetVersion(NSSCMSRecipientInfo *ri);
michael@0: 
michael@0: extern SECItem *
michael@0: NSS_CMSRecipientInfo_GetEncryptedKey(NSSCMSRecipientInfo *ri, int subIndex);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSRecipientInfo_Encode - encode an NSS_CMSRecipientInfo as ASN.1
michael@0:  */
michael@0: SECStatus NSS_CMSRecipientInfo_Encode(PLArenaPool* poolp,
michael@0:                                       const NSSCMSRecipientInfo *src,
michael@0:                                       SECItem* returned);
michael@0: 
michael@0: extern SECOidTag
michael@0: NSS_CMSRecipientInfo_GetKeyEncryptionAlgorithmTag(NSSCMSRecipientInfo *ri);
michael@0: 
michael@0: extern SECStatus
michael@0: NSS_CMSRecipientInfo_WrapBulkKey(NSSCMSRecipientInfo *ri, PK11SymKey *bulkkey, SECOidTag bulkalgtag);
michael@0: 
michael@0: extern PK11SymKey *
michael@0: NSS_CMSRecipientInfo_UnwrapBulkKey(NSSCMSRecipientInfo *ri, int subIndex,
michael@0: 		CERTCertificate *cert, SECKEYPrivateKey *privkey, SECOidTag bulkalgtag);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsencdata.c - CMS encryptedData methods
michael@0:  ************************************************************************/
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Create - create an empty encryptedData object.
michael@0:  *
michael@0:  * "algorithm" specifies the bulk encryption algorithm to use.
michael@0:  * "keysize" is the key size.
michael@0:  * 
michael@0:  * An error results in a return value of NULL and an error set.
michael@0:  * (Retrieve specific errors via PORT_GetError()/XP_GetError().)
michael@0:  */
michael@0: extern NSSCMSEncryptedData *
michael@0: NSS_CMSEncryptedData_Create(NSSCMSMessage *cmsg, SECOidTag algorithm, int keysize);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Destroy - destroy an encryptedData object
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSEncryptedData_Destroy(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_GetContentInfo - return pointer to encryptedData object's contentInfo
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSEncryptedData_GetContentInfo(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Encode_BeforeStart - do all the necessary things to a EncryptedData
michael@0:  *     before encoding begins.
michael@0:  *
michael@0:  * In particular:
michael@0:  *  - set the correct version value.
michael@0:  *  - get the encryption key
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Encode_BeforeStart(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Encode_BeforeData - set up encryption
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Encode_BeforeData(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Encode_AfterData - finalize this encryptedData for encoding
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Encode_AfterData(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Decode_BeforeData - find bulk key & set up decryption
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Decode_BeforeData(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Decode_AfterData - finish decrypting this encryptedData's content
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Decode_AfterData(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSEncryptedData_Decode_AfterEnd - finish decoding this encryptedData
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSEncryptedData_Decode_AfterEnd(NSSCMSEncryptedData *encd);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsdigdata.c - CMS encryptedData methods
michael@0:  ************************************************************************/
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Create - create a digestedData object (presumably for encoding)
michael@0:  *
michael@0:  * version will be set by NSS_CMSDigestedData_Encode_BeforeStart
michael@0:  * digestAlg is passed as parameter
michael@0:  * contentInfo must be filled by the user
michael@0:  * digest will be calculated while encoding
michael@0:  */
michael@0: extern NSSCMSDigestedData *
michael@0: NSS_CMSDigestedData_Create(NSSCMSMessage *cmsg, SECAlgorithmID *digestalg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Destroy - destroy a digestedData object
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSDigestedData_Destroy(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_GetContentInfo - return pointer to digestedData object's contentInfo
michael@0:  */
michael@0: extern NSSCMSContentInfo *
michael@0: NSS_CMSDigestedData_GetContentInfo(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Encode_BeforeStart - do all the necessary things to a DigestedData
michael@0:  *     before encoding begins.
michael@0:  *
michael@0:  * In particular:
michael@0:  *  - set the right version number. The contentInfo's content type must be set up already.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Encode_BeforeStart(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Encode_BeforeData - do all the necessary things to a DigestedData
michael@0:  *     before the encapsulated data is passed through the encoder.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - set up the digests if necessary
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Encode_BeforeData(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Encode_AfterData - do all the necessary things to a DigestedData
michael@0:  *     after all the encapsulated data was passed through the encoder.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - finish the digests
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Encode_AfterData(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Decode_BeforeData - do all the necessary things to a DigestedData
michael@0:  *     before the encapsulated data is passed through the encoder.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - set up the digests if necessary
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Decode_BeforeData(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Decode_AfterData - do all the necessary things to a DigestedData
michael@0:  *     after all the encapsulated data was passed through the encoder.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - finish the digests
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Decode_AfterData(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestedData_Decode_AfterEnd - finalize a digestedData.
michael@0:  *
michael@0:  * In detail:
michael@0:  *  - check the digests for equality
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestedData_Decode_AfterEnd(NSSCMSDigestedData *digd);
michael@0: 
michael@0: /************************************************************************
michael@0:  * cmsdigest.c - digestion routines
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_StartMultiple - start digest calculation using all the
michael@0:  *  digest algorithms in "digestalgs" in parallel.
michael@0:  */
michael@0: extern NSSCMSDigestContext *
michael@0: NSS_CMSDigestContext_StartMultiple(SECAlgorithmID **digestalgs);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_StartSingle - same as NSS_CMSDigestContext_StartMultiple, but
michael@0:  *  only one algorithm.
michael@0:  */
michael@0: extern NSSCMSDigestContext *
michael@0: NSS_CMSDigestContext_StartSingle(SECAlgorithmID *digestalg);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_Update - feed more data into the digest machine
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSDigestContext_Update(NSSCMSDigestContext *cmsdigcx, const unsigned char *data, int len);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_Cancel - cancel digesting operation
michael@0:  */
michael@0: extern void
michael@0: NSS_CMSDigestContext_Cancel(NSSCMSDigestContext *cmsdigcx);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_FinishMultiple - finish the digests and put them
michael@0:  *  into an array of SECItems (allocated on poolp)
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestContext_FinishMultiple(NSSCMSDigestContext *cmsdigcx, PLArenaPool *poolp,
michael@0: 			    SECItem ***digestsp);
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_FinishSingle - same as NSS_CMSDigestContext_FinishMultiple,
michael@0:  *  but for one digest.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDigestContext_FinishSingle(NSSCMSDigestContext *cmsdigcx, PLArenaPool *poolp,
michael@0: 			    SECItem *digest);
michael@0: 
michael@0: /************************************************************************
michael@0:  * 
michael@0:  ************************************************************************/
michael@0: 
michael@0: /* shortcuts for basic use */
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDEREncode - DER Encode a CMS message, with input being
michael@0:  *                    the plaintext message and derOut being the output,
michael@0:  *                    stored in arena's pool.
michael@0:  */
michael@0: extern SECStatus
michael@0: NSS_CMSDEREncode(NSSCMSMessage *cmsg, SECItem *input, SECItem *derOut, 
michael@0:                  PLArenaPool *arena);
michael@0: 
michael@0: 
michael@0: /************************************************************************
michael@0:  * 
michael@0:  ************************************************************************/
michael@0: 
michael@0: /*
michael@0:  *  define new S/MIME content type entries
michael@0:  *
michael@0:  *  S/MIME uses the builtin PKCS7 oid types for encoding and decoding the
michael@0:  *  various S/MIME content. Some applications have their own content type
michael@0:  *  which is different from the standard content type defined by S/MIME.
michael@0:  *
michael@0:  *  This function allows you to register new content types. There are basically
michael@0:  *  Two different types of content, Wrappping content, and Data.
michael@0:  *
michael@0:  *  For data types, All the functions below can be zero or NULL excext 
michael@0:  *  type and is isData, which should be your oid tag and PR_FALSE respectively
michael@0:  *
michael@0:  *  For wrapping types, everything must be provided, or you will get encoder
michael@0:  *  failures.
michael@0:  *
michael@0:  *  If NSS doesn't already define the OID that you need, you can register 
michael@0:  *  your own with SECOID_AddEntry.
michael@0:  * 
michael@0:  *  Once you have defined your new content type, you can pass your new content
michael@0:  *  type to NSS_CMSContentInfo_SetContent().
michael@0:  * 
michael@0:  *  If you are using a wrapping type you can pass your own data structure in 
michael@0:  *  the ptr field, but it must contain and embedded NSSCMSGenericWrappingData 
michael@0:  *  structure as the first element. The size you pass to 
michael@0:  *  NSS_CMSType_RegisterContentType is the total size of your self defined 
michael@0:  *  data structure. NSS_CMSContentInfo_GetContent will return that data 
michael@0:  *  structure from the content info. Your ASN1Template will be evaluated 
michael@0:  *  against that data structure.
michael@0:  */
michael@0: SECStatus NSS_CMSType_RegisterContentType(SECOidTag type,
michael@0:                           SEC_ASN1Template *asn1Template, size_t size,
michael@0:                           NSSCMSGenericWrapperDataDestroy  destroy,
michael@0:                           NSSCMSGenericWrapperDataCallback decode_before,
michael@0:                           NSSCMSGenericWrapperDataCallback decode_after,
michael@0:                           NSSCMSGenericWrapperDataCallback decode_end,
michael@0:                           NSSCMSGenericWrapperDataCallback encode_start,
michael@0:                           NSSCMSGenericWrapperDataCallback encode_before,
michael@0:                           NSSCMSGenericWrapperDataCallback encode_after,
michael@0:                           PRBool isData);
michael@0: 
michael@0: /************************************************************************/
michael@0: SEC_END_PROTOS
michael@0: 
michael@0: #endif /* _CMS_H_ */