| OLD | NEW |
|---|
| (Empty) |
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 #ifndef _PK11PUB_H_ | |
| 5 #define _PK11PUB_H_ | |
| 6 #include "plarena.h" | |
| 7 #include "seccomon.h" | |
| 8 #include "secoidt.h" | |
| 9 #include "secdert.h" | |
| 10 #include "keyt.h" | |
| 11 #include "certt.h" | |
| 12 #include "pkcs11t.h" | |
| 13 #include "secmodt.h" | |
| 14 #include "seccomon.h" | |
| 15 #include "pkcs7t.h" | |
| 16 #include "cmsreclist.h" | |
| 17 | |
| 18 /* | |
| 19 * Exported PK11 wrap functions. | |
| 20 */ | |
| 21 | |
| 22 SEC_BEGIN_PROTOS | |
| 23 | |
| 24 /************************************************************ | |
| 25 * Generic Slot Lists Management | |
| 26 ************************************************************/ | |
| 27 void PK11_FreeSlotList(PK11SlotList *list); | |
| 28 SECStatus PK11_FreeSlotListElement(PK11SlotList *list, PK11SlotListElement *le); | |
| 29 PK11SlotListElement * PK11_GetFirstSafe(PK11SlotList *list); | |
| 30 PK11SlotListElement *PK11_GetNextSafe(PK11SlotList *list, | |
| 31 PK11SlotListElement *le, PRBool restart); | |
| 32 | |
| 33 /************************************************************ | |
| 34 * Generic Slot Management | |
| 35 ************************************************************/ | |
| 36 PK11SlotInfo *PK11_ReferenceSlot(PK11SlotInfo *slot); | |
| 37 void PK11_FreeSlot(PK11SlotInfo *slot); | |
| 38 SECStatus PK11_DestroyObject(PK11SlotInfo *slot,CK_OBJECT_HANDLE object); | |
| 39 SECStatus PK11_DestroyTokenObject(PK11SlotInfo *slot,CK_OBJECT_HANDLE object); | |
| 40 PK11SlotInfo *PK11_GetInternalKeySlot(void); | |
| 41 PK11SlotInfo *PK11_GetInternalSlot(void); | |
| 42 SECStatus PK11_Logout(PK11SlotInfo *slot); | |
| 43 void PK11_LogoutAll(void); | |
| 44 | |
| 45 | |
| 46 /************************************************************ | |
| 47 * Slot Password Management | |
| 48 ************************************************************/ | |
| 49 void PK11_SetSlotPWValues(PK11SlotInfo *slot,int askpw, int timeout); | |
| 50 void PK11_GetSlotPWValues(PK11SlotInfo *slot,int *askpw, int *timeout); | |
| 51 SECStatus PK11_CheckSSOPassword(PK11SlotInfo *slot, char *ssopw); | |
| 52 SECStatus PK11_CheckUserPassword(PK11SlotInfo *slot, const char *pw); | |
| 53 PRBool PK11_IsLoggedIn(PK11SlotInfo *slot, void *wincx); | |
| 54 SECStatus PK11_InitPin(PK11SlotInfo *slot,const char *ssopw, | |
| 55 const char *pk11_userpwd); | |
| 56 SECStatus PK11_ChangePW(PK11SlotInfo *slot, const char *oldpw, | |
| 57 const char *newpw); | |
| 58 void PK11_SetPasswordFunc(PK11PasswordFunc func); | |
| 59 int PK11_GetMinimumPwdLength(PK11SlotInfo *slot); | |
| 60 SECStatus PK11_ResetToken(PK11SlotInfo *slot, char *sso_pwd); | |
| 61 SECStatus PK11_Authenticate(PK11SlotInfo *slot, PRBool loadCerts, void *wincx); | |
| 62 SECStatus PK11_TokenRefresh(PK11SlotInfo *slot); | |
| 63 | |
| 64 | |
| 65 /****************************************************************** | |
| 66 * Slot info functions | |
| 67 ******************************************************************/ | |
| 68 PK11SlotInfo *PK11_FindSlotByName(const char *name); | |
| 69 /****************************************************************** | |
| 70 * PK11_FindSlotsByNames searches for a PK11SlotInfo using one or | |
| 71 * more criteria : dllName, slotName and tokenName . In addition, if | |
| 72 * presentOnly is set , only slots with a token inserted will be | |
| 73 * returned. | |
| 74 ******************************************************************/ | |
| 75 PK11SlotList *PK11_FindSlotsByNames(const char *dllName, | |
| 76 const char* slotName, const char* tokenName, PRBool presentOnly); | |
| 77 PRBool PK11_IsReadOnly(PK11SlotInfo *slot); | |
| 78 PRBool PK11_IsInternal(PK11SlotInfo *slot); | |
| 79 PRBool PK11_IsInternalKeySlot(PK11SlotInfo *slot); | |
| 80 char * PK11_GetTokenName(PK11SlotInfo *slot); | |
| 81 char * PK11_GetSlotName(PK11SlotInfo *slot); | |
| 82 PRBool PK11_NeedLogin(PK11SlotInfo *slot); | |
| 83 PRBool PK11_IsFriendly(PK11SlotInfo *slot); | |
| 84 PRBool PK11_IsHW(PK11SlotInfo *slot); | |
| 85 PRBool PK11_IsRemovable(PK11SlotInfo *slot); | |
| 86 PRBool PK11_NeedUserInit(PK11SlotInfo *slot); | |
| 87 PRBool PK11_ProtectedAuthenticationPath(PK11SlotInfo *slot); | |
| 88 int PK11_GetSlotSeries(PK11SlotInfo *slot); | |
| 89 int PK11_GetCurrentWrapIndex(PK11SlotInfo *slot); | |
| 90 unsigned long PK11_GetDefaultFlags(PK11SlotInfo *slot); | |
| 91 CK_SLOT_ID PK11_GetSlotID(PK11SlotInfo *slot); | |
| 92 SECMODModuleID PK11_GetModuleID(PK11SlotInfo *slot); | |
| 93 SECStatus PK11_GetSlotInfo(PK11SlotInfo *slot, CK_SLOT_INFO *info); | |
| 94 SECStatus PK11_GetTokenInfo(PK11SlotInfo *slot, CK_TOKEN_INFO *info); | |
| 95 PRBool PK11_IsDisabled(PK11SlotInfo *slot); | |
| 96 PRBool PK11_HasRootCerts(PK11SlotInfo *slot); | |
| 97 PK11DisableReasons PK11_GetDisabledReason(PK11SlotInfo *slot); | |
| 98 /* Prevents the slot from being used, and set disable reason to user-disable */ | |
| 99 /* NOTE: Mechanisms that were ON continue to stay ON */ | |
| 100 /* Therefore, when the slot is enabled, it will remember */ | |
| 101 /* what mechanisms needs to be turned on */ | |
| 102 PRBool PK11_UserDisableSlot(PK11SlotInfo *slot); | |
| 103 /* Allow all mechanisms that are ON before UserDisableSlot() */ | |
| 104 /* was called to be available again */ | |
| 105 PRBool PK11_UserEnableSlot(PK11SlotInfo *slot); | |
| 106 /* | |
| 107 * wait for a specific slot event. | |
| 108 * event is a specific event to wait for. Currently only | |
| 109 * PK11TokenChangeOrRemovalEvent and PK11TokenPresentEvents are defined. | |
| 110 * timeout can be an interval time to wait, PR_INTERVAL_NO_WAIT (meaning only | |
| 111 * poll once), or PR_INTERVAL_NO_TIMEOUT (meaning block until a change). | |
| 112 * pollInterval is a suggested pulling interval value. '0' means use the | |
| 113 * default. Future implementations that don't poll may ignore this value. | |
| 114 * series is the current series for the last slot. This should be the series | |
| 115 * value for the slot the last time you read persistant information from the | |
| 116 * slot. For instance, if you publish a cert from the slot, you should obtain | |
| 117 * the slot series at that time. Then PK11_WaitForTokenEvent can detect a | |
| 118 * a change in the slot between the time you publish and the time | |
| 119 * PK11_WaitForTokenEvent is called, elliminating potential race conditions. | |
| 120 * | |
| 121 * The current status that is returned is: | |
| 122 * PK11TokenNotRemovable - always returned for any non-removable token. | |
| 123 * PK11TokenPresent - returned when the token is present and we are waiting | |
| 124 * on a PK11TokenPresentEvent. Then next event to look for is a | |
| 125 * PK11TokenChangeOrRemovalEvent. | |
| 126 * PK11TokenChanged - returned when the old token has been removed and a new | |
| 127 * token ad been inserted, and we are waiting for a | |
| 128 * PK11TokenChangeOrRemovalEvent. The next event to look for is another | |
| 129 * PK11TokenChangeOrRemovalEvent. | |
| 130 * PK11TokenRemoved - returned when the token is not present and we are | |
| 131 * waiting for a PK11TokenChangeOrRemovalEvent. The next event to look for | |
| 132 * is a PK11TokenPresentEvent. | |
| 133 */ | |
| 134 PK11TokenStatus PK11_WaitForTokenEvent(PK11SlotInfo *slot, PK11TokenEvent event, | |
| 135 PRIntervalTime timeout, PRIntervalTime pollInterval, int series); | |
| 136 | |
| 137 PRBool PK11_NeedPWInit(void); | |
| 138 PRBool PK11_TokenExists(CK_MECHANISM_TYPE); | |
| 139 SECStatus PK11_GetModInfo(SECMODModule *mod, CK_INFO *info); | |
| 140 PRBool PK11_IsFIPS(void); | |
| 141 SECMODModule *PK11_GetModule(PK11SlotInfo *slot); | |
| 142 | |
| 143 /********************************************************************* | |
| 144 * Slot mapping utility functions. | |
| 145 *********************************************************************/ | |
| 146 PRBool PK11_IsPresent(PK11SlotInfo *slot); | |
| 147 PRBool PK11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type); | |
| 148 PK11SlotList * PK11_GetAllTokens(CK_MECHANISM_TYPE type,PRBool needRW, | |
| 149 PRBool loadCerts, void *wincx); | |
| 150 PK11SlotInfo *PK11_GetBestSlotMultipleWithAttributes(CK_MECHANISM_TYPE *type, | |
| 151 CK_FLAGS *mechFlag, unsigned int *keySize, | |
| 152 unsigned int count, void *wincx); | |
| 153 PK11SlotInfo *PK11_GetBestSlotMultiple(CK_MECHANISM_TYPE *type, | |
| 154 unsigned int count, void *wincx); | |
| 155 PK11SlotInfo *PK11_GetBestSlot(CK_MECHANISM_TYPE type, void *wincx); | |
| 156 PK11SlotInfo *PK11_GetBestSlotWithAttributes(CK_MECHANISM_TYPE type, | |
| 157 CK_FLAGS mechFlag, unsigned int keySize, void *wincx); | |
| 158 CK_MECHANISM_TYPE PK11_GetBestWrapMechanism(PK11SlotInfo *slot); | |
| 159 int PK11_GetBestKeyLength(PK11SlotInfo *slot, CK_MECHANISM_TYPE type); | |
| 160 | |
| 161 /* | |
| 162 * Open a new database using the softoken. The caller is responsible for making | |
| 163 * sure the module spec is correct and usable. The caller should ask for one | |
| 164 * new database per call if the caller wants to get meaningful information | |
| 165 * about the new database. | |
| 166 * | |
| 167 * moduleSpec is the same data that you would pass to softoken at | |
| 168 * initialization time under the 'tokens' options. For example, if you were | |
| 169 * to specify tokens=<0x4=[configdir='./mybackup' tokenDescription='Backup']> | |
| 170 * You would specify "configdir='./mybackup' tokenDescription='Backup'" as your | |
| 171 * module spec here. The slot ID will be calculated for you by | |
| 172 * SECMOD_OpenUserDB(). | |
| 173 * | |
| 174 * Typical parameters here are configdir, tokenDescription and flags. | |
| 175 * | |
| 176 * a Full list is below: | |
| 177 * | |
| 178 * | |
| 179 * configDir - The location of the databases for this token. If configDir is | |
| 180 * not specified, and noCertDB and noKeyDB is not specified, the load | |
| 181 * will fail. | |
| 182 * certPrefix - Cert prefix for this token. | |
| 183 * keyPrefix - Prefix for the key database for this token. (if not specified, | |
| 184 * certPrefix will be used). | |
| 185 * tokenDescription - The label value for this token returned in the | |
| 186 * CK_TOKEN_INFO structure with an internationalize string (UTF8). | |
| 187 * This value will be truncated at 32 bytes (no NULL, partial UTF8 | |
| 188 * characters dropped). You should specify a user friendly name here | |
| 189 * as this is the value the token will be referred to in most | |
| 190 * application UI's. You should make sure tokenDescription is unique. | |
| 191 * slotDescription - The slotDescription value for this token returned | |
| 192 * in the CK_SLOT_INFO structure with an internationalize string | |
| 193 * (UTF8). This value will be truncated at 64 bytes (no NULL, partial | |
| 194 * UTF8 characters dropped). This name will not change after the | |
| 195 * database is closed. It should have some number to make this unique. | |
| 196 * minPWLen - minimum password length for this token. | |
| 197 * flags - comma separated list of flag values, parsed case-insensitive. | |
| 198 * Valid flags are: | |
| 199 * readOnly - Databases should be opened read only. | |
| 200 * noCertDB - Don't try to open a certificate database. | |
| 201 * noKeyDB - Don't try to open a key database. | |
| 202 * forceOpen - Don't fail to initialize the token if the | |
| 203 * databases could not be opened. | |
| 204 * passwordRequired - zero length passwords are not acceptable | |
| 205 * (valid only if there is a keyDB). | |
| 206 * optimizeSpace - allocate smaller hash tables and lock tables. | |
| 207 * When this flag is not specified, Softoken will allocate | |
| 208 * large tables to prevent lock contention. | |
| 209 */ | |
| 210 PK11SlotInfo *SECMOD_OpenUserDB(const char *moduleSpec); | |
| 211 SECStatus SECMOD_CloseUserDB(PK11SlotInfo *slot); | |
| 212 | |
| 213 /* | |
| 214 * This is exactly the same as OpenUserDB except it can be called on any | |
| 215 * module that understands softoken style new slot entries. The resulting | |
| 216 * slot can be closed using SECMOD_CloseUserDB above. Value of moduleSpec | |
| 217 * is token specific. | |
| 218 */ | |
| 219 PK11SlotInfo *SECMOD_OpenNewSlot(SECMODModule *mod, const char *moduleSpec); | |
| 220 | |
| 221 | |
| 222 /* | |
| 223 * merge the permanent objects from on token to another | |
| 224 */ | |
| 225 SECStatus PK11_MergeTokens(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, | |
| 226 PK11MergeLog *log, void *targetPwArg, void *sourcePwArg); | |
| 227 | |
| 228 /* | |
| 229 * create and destroy merge logs needed by PK11_MergeTokens | |
| 230 */ | |
| 231 PK11MergeLog * PK11_CreateMergeLog(void); | |
| 232 void PK11_DestroyMergeLog(PK11MergeLog *log); | |
| 233 | |
| 234 | |
| 235 | |
| 236 /********************************************************************* | |
| 237 * Mechanism Mapping functions | |
| 238 *********************************************************************/ | |
| 239 CK_KEY_TYPE PK11_GetKeyType(CK_MECHANISM_TYPE type,unsigned long len); | |
| 240 CK_MECHANISM_TYPE PK11_GetKeyGen(CK_MECHANISM_TYPE type); | |
| 241 int PK11_GetBlockSize(CK_MECHANISM_TYPE type,SECItem *params); | |
| 242 int PK11_GetIVLength(CK_MECHANISM_TYPE type); | |
| 243 SECItem *PK11_ParamFromIV(CK_MECHANISM_TYPE type,SECItem *iv); | |
| 244 unsigned char *PK11_IVFromParam(CK_MECHANISM_TYPE type,SECItem *param,int *len); | |
| 245 SECItem * PK11_BlockData(SECItem *data,unsigned long size); | |
| 246 | |
| 247 /* PKCS #11 to DER mapping functions */ | |
| 248 SECItem *PK11_ParamFromAlgid(SECAlgorithmID *algid); | |
| 249 SECItem *PK11_GenerateNewParam(CK_MECHANISM_TYPE, PK11SymKey *); | |
| 250 CK_MECHANISM_TYPE PK11_AlgtagToMechanism(SECOidTag algTag); | |
| 251 SECOidTag PK11_MechanismToAlgtag(CK_MECHANISM_TYPE type); | |
| 252 SECOidTag PK11_FortezzaMapSig(SECOidTag algTag); | |
| 253 SECStatus PK11_ParamToAlgid(SECOidTag algtag, SECItem *param, | |
| 254 PLArenaPool *arena, SECAlgorithmID *algid); | |
| 255 SECStatus PK11_SeedRandom(PK11SlotInfo *,unsigned char *data,int len); | |
| 256 SECStatus PK11_GenerateRandomOnSlot(PK11SlotInfo *,unsigned char *data,int len); | |
| 257 SECStatus PK11_RandomUpdate(void *data, size_t bytes); | |
| 258 SECStatus PK11_GenerateRandom(unsigned char *data,int len); | |
| 259 | |
| 260 /* warning: cannot work with pkcs 5 v2 | |
| 261 * use algorithm ID s instead of pkcs #11 mechanism pointers */ | |
| 262 CK_RV PK11_MapPBEMechanismToCryptoMechanism(CK_MECHANISM_PTR pPBEMechanism, | |
| 263 CK_MECHANISM_PTR pCryptoMechanism, | |
| 264 SECItem *pbe_pwd, PRBool bad3DES); | |
| 265 CK_MECHANISM_TYPE PK11_GetPadMechanism(CK_MECHANISM_TYPE); | |
| 266 CK_MECHANISM_TYPE PK11_MapSignKeyType(KeyType keyType); | |
| 267 | |
| 268 /********************************************************************** | |
| 269 * Symmetric, Public, and Private Keys | |
| 270 **********************************************************************/ | |
| 271 void PK11_FreeSymKey(PK11SymKey *key); | |
| 272 PK11SymKey *PK11_ReferenceSymKey(PK11SymKey *symKey); | |
| 273 PK11SymKey *PK11_ImportSymKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, | |
| 274 PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key, void *wincx); | |
| 275 PK11SymKey *PK11_ImportSymKeyWithFlags(PK11SlotInfo *slot, | |
| 276 CK_MECHANISM_TYPE type, PK11Origin origin, CK_ATTRIBUTE_TYPE operation, | |
| 277 SECItem *key, CK_FLAGS flags, PRBool isPerm, void *wincx); | |
| 278 PK11SymKey *PK11_SymKeyFromHandle(PK11SlotInfo *slot, PK11SymKey *parent, | |
| 279 PK11Origin origin, CK_MECHANISM_TYPE type, CK_OBJECT_HANDLE keyID, | |
| 280 PRBool owner, void *wincx); | |
| 281 PK11SymKey *PK11_GetWrapKey(PK11SlotInfo *slot, int wrap, | |
| 282 CK_MECHANISM_TYPE type,int series, void *wincx); | |
| 283 /* | |
| 284 * This function is not thread-safe. It can only be called when only | |
| 285 * one thread has a reference to wrapKey. | |
| 286 */ | |
| 287 void PK11_SetWrapKey(PK11SlotInfo *slot, int wrap, PK11SymKey *wrapKey); | |
| 288 CK_MECHANISM_TYPE PK11_GetMechanism(PK11SymKey *symKey); | |
| 289 /* | |
| 290 * import a public key into the desired slot | |
| 291 * | |
| 292 * This function takes a public key structure and creates a public key in a | |
| 293 * given slot. If isToken is set, then a persistant public key is created. | |
| 294 * | |
| 295 * Note: it is possible for this function to return a handle for a key which | |
| 296 * is persistant, even if isToken is not set. | |
| 297 */ | |
| 298 CK_OBJECT_HANDLE PK11_ImportPublicKey(PK11SlotInfo *slot, | |
| 299 SECKEYPublicKey *pubKey, PRBool isToken); | |
| 300 PK11SymKey *PK11_KeyGen(PK11SlotInfo *slot,CK_MECHANISM_TYPE type, | |
| 301 SECItem *param, int keySize,void *wincx); | |
| 302 PK11SymKey *PK11_TokenKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, | |
| 303 SECItem *param, int keySize, SECItem *keyid, | |
| 304 PRBool isToken, void *wincx); | |
| 305 PK11SymKey *PK11_TokenKeyGenWithFlags(PK11SlotInfo *slot, | |
| 306 CK_MECHANISM_TYPE type, SECItem *param, | |
| 307 int keySize, SECItem *keyid, CK_FLAGS opFlags, | |
| 308 PK11AttrFlags attrFlags, void *wincx); | |
| 309 /* Generates a key using the exact template supplied by the caller. The other | |
| 310 * PK11_[Token]KeyGen mechanisms should be used instead of this one whenever | |
| 311 * they work because they include/exclude the CKA_VALUE_LEN template value | |
| 312 * based on the mechanism type as required by many tokens. | |
| 313 * | |
| 314 * keyGenType should be PK11_GetKeyGenWithSize(type, <key size>) or it should | |
| 315 * be equal to type if PK11_GetKeyGenWithSize cannot be used (e.g. because | |
| 316 * pk11wrap does not know about the mechanisms). | |
| 317 */ | |
| 318 PK11SymKey *PK11_KeyGenWithTemplate(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, | |
| 319 CK_MECHANISM_TYPE keyGenType, | |
| 320 SECItem *param, CK_ATTRIBUTE * attrs, | |
| 321 unsigned int attrsCount, void *wincx); | |
| 322 PK11SymKey * PK11_ListFixedKeysInSlot(PK11SlotInfo *slot, char *nickname, | |
| 323 void *wincx); | |
| 324 PK11SymKey *PK11_GetNextSymKey(PK11SymKey *symKey); | |
| 325 CK_KEY_TYPE PK11_GetSymKeyType(PK11SymKey *key); | |
| 326 CK_OBJECT_HANDLE PK11_GetSymKeyHandle(PK11SymKey *symKey); | |
| 327 | |
| 328 | |
| 329 /* | |
| 330 * PK11_SetSymKeyUserData | |
| 331 * sets generic user data on keys (usually a pointer to a data structure) | |
| 332 * that can later be retrieved by PK11_GetSymKeyUserData(). | |
| 333 * symKey - key where data will be set. | |
| 334 * data - data to be set. | |
| 335 * freefunc - function used to free the data. | |
| 336 * Setting user data on symKeys with existing user data already set will cause | |
| 337 * the existing user data to be freed before the new user data is set. | |
| 338 * Freeing user data is done by calling the user specified freefunc. | |
| 339 * If freefunc is NULL, the user data is assumed to be global or static an | |
| 340 * not freed. Passing NULL for user data to PK11_SetSymKeyUserData has the | |
| 341 * effect of freeing any existing user data, and clearing the user data | |
| 342 * pointer. If user data exists when the symKey is finally freed, that | |
| 343 * data will be freed with freefunc. | |
| 344 * | |
| 345 * Applications should only use this function on keys which the application | |
| 346 * has created directly, as there is only one user data value per key. | |
| 347 */ | |
| 348 void PK11_SetSymKeyUserData(PK11SymKey *symKey, void *data, | |
| 349 PK11FreeDataFunc freefunc); | |
| 350 /* PK11_GetSymKeyUserData | |
| 351 * retrieves generic user data which was set on a key by | |
| 352 * PK11_SetSymKeyUserData. | |
| 353 * symKey - key with data to be fetched | |
| 354 * | |
| 355 * If no data exists, or the data has been cleared, PK11_GetSymKeyUserData | |
| 356 * will return NULL. Returned data is still owned and managed by the SymKey, | |
| 357 * the caller should not free the data. | |
| 358 * | |
| 359 */ | |
| 360 void *PK11_GetSymKeyUserData(PK11SymKey *symKey); | |
| 361 | |
| 362 SECStatus PK11_PubWrapSymKey(CK_MECHANISM_TYPE type, SECKEYPublicKey *pubKey, | |
| 363 PK11SymKey *symKey, SECItem *wrappedKey); | |
| 364 SECStatus PK11_WrapSymKey(CK_MECHANISM_TYPE type, SECItem *params, | |
| 365 PK11SymKey *wrappingKey, PK11SymKey *symKey, SECItem *wrappedKey); | |
| 366 /* move a key to 'slot' optionally set the key attributes according to either | |
| 367 * operation or the flags and making the key permanent at the same time. | |
| 368 * If the key is moved to the same slot, operation and flags values are | |
| 369 * currently ignored */ | |
| 370 PK11SymKey *PK11_MoveSymKey(PK11SlotInfo *slot, CK_ATTRIBUTE_TYPE operation, | |
| 371 CK_FLAGS flags, PRBool perm, PK11SymKey *symKey); | |
| 372 /* | |
| 373 * derive a new key from the base key. | |
| 374 * PK11_Derive returns a key which can do exactly one operation, and is | |
| 375 * ephemeral (session key). | |
| 376 * PK11_DeriveWithFlags is the same as PK11_Derive, except you can use | |
| 377 * CKF_ flags to enable more than one operation. | |
| 378 * PK11_DeriveWithFlagsPerm is the same as PK11_DeriveWithFlags except you can | |
| 379 * (optionally) make the key permanent (token key). | |
| 380 */ | |
| 381 PK11SymKey *PK11_Derive(PK11SymKey *baseKey, CK_MECHANISM_TYPE mechanism, | |
| 382 SECItem *param, CK_MECHANISM_TYPE target, | |
| 383 CK_ATTRIBUTE_TYPE operation, int keySize); | |
| 384 PK11SymKey *PK11_DeriveWithFlags( PK11SymKey *baseKey, | |
| 385 CK_MECHANISM_TYPE derive, SECItem *param, CK_MECHANISM_TYPE target, | |
| 386 CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags); | |
| 387 PK11SymKey * PK11_DeriveWithFlagsPerm( PK11SymKey *baseKey, | |
| 388 CK_MECHANISM_TYPE derive, | |
| 389 SECItem *param, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, | |
| 390 int keySize, CK_FLAGS flags, PRBool isPerm); | |
| 391 PK11SymKey * | |
| 392 PK11_DeriveWithTemplate( PK11SymKey *baseKey, CK_MECHANISM_TYPE derive, | |
| 393 SECItem *param, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, | |
| 394 int keySize, CK_ATTRIBUTE *userAttr, unsigned int numAttrs, | |
| 395 PRBool isPerm); | |
| 396 | |
| 397 | |
| 398 PK11SymKey *PK11_PubDerive( SECKEYPrivateKey *privKey, | |
| 399 SECKEYPublicKey *pubKey, PRBool isSender, SECItem *randomA, SECItem *randomB, | |
| 400 CK_MECHANISM_TYPE derive, CK_MECHANISM_TYPE target, | |
| 401 CK_ATTRIBUTE_TYPE operation, int keySize,void *wincx) ; | |
| 402 PK11SymKey *PK11_PubDeriveWithKDF( SECKEYPrivateKey *privKey, | |
| 403 SECKEYPublicKey *pubKey, PRBool isSender, SECItem *randomA, SECItem *randomB, | |
| 404 CK_MECHANISM_TYPE derive, CK_MECHANISM_TYPE target, | |
| 405 CK_ATTRIBUTE_TYPE operation, int keySize, | |
| 406 CK_ULONG kdf, SECItem *sharedData, void *wincx); | |
| 407 | |
| 408 /* | |
| 409 * unwrap a new key with a symetric key. | |
| 410 * PK11_Unwrap returns a key which can do exactly one operation, and is | |
| 411 * ephemeral (session key). | |
| 412 * PK11_UnwrapWithFlags is the same as PK11_Unwrap, except you can use | |
| 413 * CKF_ flags to enable more than one operation. | |
| 414 * PK11_UnwrapWithFlagsPerm is the same as PK11_UnwrapWithFlags except you can | |
| 415 * (optionally) make the key permanent (token key). | |
| 416 */ | |
| 417 PK11SymKey *PK11_UnwrapSymKey(PK11SymKey *key, | |
| 418 CK_MECHANISM_TYPE wraptype, SECItem *param, SECItem *wrapppedKey, | |
| 419 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize); | |
| 420 PK11SymKey *PK11_UnwrapSymKeyWithFlags(PK11SymKey *wrappingKey, | |
| 421 CK_MECHANISM_TYPE wrapType, SECItem *param, SECItem *wrappedKey, | |
| 422 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, | |
| 423 CK_FLAGS flags); | |
| 424 PK11SymKey * PK11_UnwrapSymKeyWithFlagsPerm(PK11SymKey *wrappingKey, | |
| 425 CK_MECHANISM_TYPE wrapType, | |
| 426 SECItem *param, SECItem *wrappedKey, | |
| 427 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, | |
| 428 int keySize, CK_FLAGS flags, PRBool isPerm); | |
| 429 | |
| 430 /* | |
| 431 * unwrap a new key with a private key. | |
| 432 * PK11_PubUnwrap returns a key which can do exactly one operation, and is | |
| 433 * ephemeral (session key). | |
| 434 * PK11_PubUnwrapWithFlagsPerm is the same as PK11_PubUnwrap except you can | |
| 435 * use * CKF_ flags to enable more than one operation, and optionally make | |
| 436 * the key permanent (token key). | |
| 437 */ | |
| 438 PK11SymKey *PK11_PubUnwrapSymKey(SECKEYPrivateKey *key, SECItem *wrapppedKey, | |
| 439 CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize); | |
| 440 PK11SymKey * PK11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, | |
| 441 SECItem *wrappedKey, CK_MECHANISM_TYPE target, | |
| 442 CK_ATTRIBUTE_TYPE operation, int keySize, | |
| 443 CK_FLAGS flags, PRBool isPerm); | |
| 444 PK11SymKey *PK11_FindFixedKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, | |
| 445 SECItem *keyID, void *wincx); | |
| 446 SECStatus PK11_DeleteTokenPrivateKey(SECKEYPrivateKey *privKey,PRBool force); | |
| 447 SECStatus PK11_DeleteTokenPublicKey(SECKEYPublicKey *pubKey); | |
| 448 SECStatus PK11_DeleteTokenSymKey(PK11SymKey *symKey); | |
| 449 SECStatus PK11_DeleteTokenCertAndKey(CERTCertificate *cert,void *wincx); | |
| 450 SECKEYPrivateKey * PK11_LoadPrivKey(PK11SlotInfo *slot, | |
| 451 SECKEYPrivateKey *privKey, SECKEYPublicKey *pubKey, | |
| 452 PRBool token, PRBool sensitive); | |
| 453 char * PK11_GetSymKeyNickname(PK11SymKey *symKey); | |
| 454 char * PK11_GetPrivateKeyNickname(SECKEYPrivateKey *privKey); | |
| 455 char * PK11_GetPublicKeyNickname(SECKEYPublicKey *pubKey); | |
| 456 SECStatus PK11_SetSymKeyNickname(PK11SymKey *symKey, const char *nickname); | |
| 457 SECStatus PK11_SetPrivateKeyNickname(SECKEYPrivateKey *privKey, | |
| 458 const char *nickname); | |
| 459 SECStatus PK11_SetPublicKeyNickname(SECKEYPublicKey *pubKey, | |
| 460 const char *nickname); | |
| 461 | |
| 462 /* | |
| 463 * Using __PK11_SetCertificateNickname is *DANGEROUS*. | |
| 464 * | |
| 465 * The API will update the NSS database, but it *will NOT* update the in-memory
data. | |
| 466 * As a result, after calling this API, there will be INCONSISTENCY between | |
| 467 * in-memory data and the database. | |
| 468 * | |
| 469 * Use of the API should be limited to short-lived tools, which will exit immedi
ately | |
| 470 * after using this API. | |
| 471 * | |
| 472 * If you ignore this warning, your process is TAINTED and will most likely misb
ehave. | |
| 473 */ | |
| 474 SECStatus __PK11_SetCertificateNickname(CERTCertificate *cert, | |
| 475 const char *nickname); | |
| 476 | |
| 477 /* size to hold key in bytes */ | |
| 478 unsigned int PK11_GetKeyLength(PK11SymKey *key); | |
| 479 /* size of actual secret parts of key in bits */ | |
| 480 /* algid is because RC4 strength is determined by the effective bits as well | |
| 481 * as the key bits */ | |
| 482 unsigned int PK11_GetKeyStrength(PK11SymKey *key,SECAlgorithmID *algid); | |
| 483 SECStatus PK11_ExtractKeyValue(PK11SymKey *symKey); | |
| 484 SECItem * PK11_GetKeyData(PK11SymKey *symKey); | |
| 485 PK11SlotInfo * PK11_GetSlotFromKey(PK11SymKey *symKey); | |
| 486 void *PK11_GetWindow(PK11SymKey *symKey); | |
| 487 | |
| 488 /* | |
| 489 * Explicitly set the key usage for the generated private key. | |
| 490 * | |
| 491 * This allows us to specify single use EC and RSA keys whose usage | |
| 492 * can be regulated by the underlying token. | |
| 493 * | |
| 494 * The underlying key usage is set using opFlags. opFlagsMask specifies | |
| 495 * which operations are specified by opFlags. For instance to turn encrypt | |
| 496 * on and signing off, opFlags would be CKF_ENCRYPT|CKF_DECRYPT and | |
| 497 * opFlagsMask would be CKF_ENCRYPT|CKF_DECRYPT|CKF_SIGN|CKF_VERIFY. You | |
| 498 * need to specify both the public and private key flags, | |
| 499 * PK11_GenerateKeyPairWithOpFlags will sort out the correct flag to the | |
| 500 * correct key type. Flags not specified in opFlagMask will be defaulted | |
| 501 * according to mechanism type and token capabilities. | |
| 502 */ | |
| 503 SECKEYPrivateKey *PK11_GenerateKeyPairWithOpFlags(PK11SlotInfo *slot, | |
| 504 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk, | |
| 505 PK11AttrFlags attrFlags, CK_FLAGS opFlags, CK_FLAGS opFlagsMask, | |
| 506 void *wincx); | |
| 507 /* | |
| 508 * The attrFlags is the logical OR of the PK11_ATTR_XXX bitflags. | |
| 509 * These flags apply to the private key. The PK11_ATTR_TOKEN, | |
| 510 * PK11_ATTR_SESSION, PK11_ATTR_MODIFIABLE, and PK11_ATTR_UNMODIFIABLE | |
| 511 * flags also apply to the public key. | |
| 512 */ | |
| 513 SECKEYPrivateKey *PK11_GenerateKeyPairWithFlags(PK11SlotInfo *slot, | |
| 514 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk, | |
| 515 PK11AttrFlags attrFlags, void *wincx); | |
| 516 SECKEYPrivateKey *PK11_GenerateKeyPair(PK11SlotInfo *slot, | |
| 517 CK_MECHANISM_TYPE type, void *param, SECKEYPublicKey **pubk, | |
| 518 PRBool isPerm, PRBool isSensitive, void *wincx); | |
| 519 SECKEYPrivateKey * PK11_FindPrivateKeyFromCert(PK11SlotInfo *slot, | |
| 520 CERTCertificate *cert, void *wincx); | |
| 521 SECKEYPrivateKey * PK11_FindKeyByAnyCert(CERTCertificate *cert, void *wincx); | |
| 522 SECKEYPrivateKey * PK11_FindKeyByKeyID(PK11SlotInfo *slot, SECItem *keyID, | |
| 523 void *wincx); | |
| 524 int PK11_GetPrivateModulusLen(SECKEYPrivateKey *key); | |
| 525 | |
| 526 SECStatus PK11_Decrypt(PK11SymKey *symkey, | |
| 527 CK_MECHANISM_TYPE mechanism, SECItem *param, | |
| 528 unsigned char *out, unsigned int *outLen, | |
| 529 unsigned int maxLen, | |
| 530 const unsigned char *enc, unsigned int encLen); | |
| 531 SECStatus PK11_Encrypt(PK11SymKey *symKey, | |
| 532 CK_MECHANISM_TYPE mechanism, SECItem *param, | |
| 533 unsigned char *out, unsigned int *outLen, | |
| 534 unsigned int maxLen, | |
| 535 const unsigned char *data, unsigned int dataLen); | |
| 536 | |
| 537 /* note: despite the name, this function takes a private key. */ | |
| 538 SECStatus PK11_PubDecryptRaw(SECKEYPrivateKey *key, | |
| 539 unsigned char *data, unsigned *outLen, | |
| 540 unsigned int maxLen, | |
| 541 const unsigned char *enc, unsigned encLen); | |
| 542 #define PK11_PrivDecryptRaw PK11_PubDecryptRaw | |
| 543 /* The encrypt function that complements the above decrypt function. */ | |
| 544 SECStatus PK11_PubEncryptRaw(SECKEYPublicKey *key, | |
| 545 unsigned char *enc, | |
| 546 const unsigned char *data, unsigned dataLen, | |
| 547 void *wincx); | |
| 548 | |
| 549 SECStatus PK11_PrivDecryptPKCS1(SECKEYPrivateKey *key, | |
| 550 unsigned char *data, unsigned *outLen, | |
| 551 unsigned int maxLen, | |
| 552 const unsigned char *enc, unsigned encLen); | |
| 553 /* The encrypt function that complements the above decrypt function. */ | |
| 554 SECStatus PK11_PubEncryptPKCS1(SECKEYPublicKey *key, | |
| 555 unsigned char *enc, | |
| 556 const unsigned char *data, unsigned dataLen, | |
| 557 void *wincx); | |
| 558 | |
| 559 SECStatus PK11_PrivDecrypt(SECKEYPrivateKey *key, | |
| 560 CK_MECHANISM_TYPE mechanism, SECItem *param, | |
| 561 unsigned char *out, unsigned int *outLen, | |
| 562 unsigned int maxLen, | |
| 563 const unsigned char *enc, unsigned int encLen); | |
| 564 SECStatus PK11_PubEncrypt(SECKEYPublicKey *key, | |
| 565 CK_MECHANISM_TYPE mechanism, SECItem *param, | |
| 566 unsigned char *out, unsigned int *outLen, | |
| 567 unsigned int maxLen, | |
| 568 const unsigned char *data, unsigned int dataLen, | |
| 569 void *wincx); | |
| 570 | |
| 571 SECStatus PK11_ImportPrivateKeyInfo(PK11SlotInfo *slot, | |
| 572 SECKEYPrivateKeyInfo *pki, SECItem *nickname, | |
| 573 SECItem *publicValue, PRBool isPerm, PRBool isPrivate, | |
| 574 unsigned int usage, void *wincx); | |
| 575 SECStatus PK11_ImportPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot, | |
| 576 SECKEYPrivateKeyInfo *pki, SECItem *nickname, | |
| 577 SECItem *publicValue, PRBool isPerm, PRBool isPrivate, | |
| 578 unsigned int usage, SECKEYPrivateKey** privk, void *wincx); | |
| 579 SECStatus PK11_ImportDERPrivateKeyInfo(PK11SlotInfo *slot, | |
| 580 SECItem *derPKI, SECItem *nickname, | |
| 581 SECItem *publicValue, PRBool isPerm, PRBool isPrivate, | |
| 582 unsigned int usage, void *wincx); | |
| 583 SECStatus PK11_ImportDERPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot, | |
| 584 SECItem *derPKI, SECItem *nickname, | |
| 585 SECItem *publicValue, PRBool isPerm, PRBool isPrivate, | |
| 586 unsigned int usage, SECKEYPrivateKey** privk, void *wincx); | |
| 587 SECStatus PK11_ImportEncryptedPrivateKeyInfo(PK11SlotInfo *slot, | |
| 588 SECKEYEncryptedPrivateKeyInfo *epki, SECItem *pwitem, | |
| 589 SECItem *nickname, SECItem *publicValue, PRBool isPerm, | |
| 590 PRBool isPrivate, KeyType type, | |
| 591 unsigned int usage, void *wincx); | |
| 592 SECStatus PK11_ImportEncryptedPrivateKeyInfoAndReturnKey(PK11SlotInfo *slot, | |
| 593 SECKEYEncryptedPrivateKeyInfo *epki, SECItem *pwitem, | |
| 594 SECItem *nickname, SECItem *publicValue, PRBool isPerm, | |
| 595 PRBool isPrivate, KeyType type, | |
| 596 unsigned int usage, SECKEYPrivateKey** privk, void *wincx); | |
| 597 SECItem *PK11_ExportDERPrivateKeyInfo(SECKEYPrivateKey *pk, void *wincx); | |
| 598 SECKEYPrivateKeyInfo *PK11_ExportPrivKeyInfo( | |
| 599 SECKEYPrivateKey *pk, void *wincx); | |
| 600 SECKEYPrivateKeyInfo *PK11_ExportPrivateKeyInfo( | |
| 601 CERTCertificate *cert, void *wincx); | |
| 602 SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivKeyInfo( | |
| 603 PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem, | |
| 604 SECKEYPrivateKey *pk, int iteration, void *wincx); | |
| 605 SECKEYEncryptedPrivateKeyInfo *PK11_ExportEncryptedPrivateKeyInfo( | |
| 606 PK11SlotInfo *slot, SECOidTag algTag, SECItem *pwitem, | |
| 607 CERTCertificate *cert, int iteration, void *wincx); | |
| 608 SECKEYPrivateKey *PK11_FindKeyByDERCert(PK11SlotInfo *slot, | |
| 609 CERTCertificate *cert, void *wincx); | |
| 610 SECKEYPublicKey *PK11_MakeKEAPubKey(unsigned char *data, int length); | |
| 611 SECStatus PK11_DigestKey(PK11Context *context, PK11SymKey *key); | |
| 612 PRBool PK11_VerifyKeyOK(PK11SymKey *key); | |
| 613 SECKEYPrivateKey *PK11_UnwrapPrivKey(PK11SlotInfo *slot, | |
| 614 PK11SymKey *wrappingKey, CK_MECHANISM_TYPE wrapType, | |
| 615 SECItem *param, SECItem *wrappedKey, SECItem *label, | |
| 616 SECItem *publicValue, PRBool token, PRBool sensitive, | |
| 617 CK_KEY_TYPE keyType, CK_ATTRIBUTE_TYPE *usage, int usageCount, | |
| 618 void *wincx); | |
| 619 SECStatus PK11_WrapPrivKey(PK11SlotInfo *slot, PK11SymKey *wrappingKey, | |
| 620 SECKEYPrivateKey *privKey, CK_MECHANISM_TYPE wrapType
, | |
| 621 SECItem *param, SECItem *wrappedKey, void *wincx); | |
| 622 /* | |
| 623 * The caller of PK11_DEREncodePublicKey should free the returned SECItem with | |
| 624 * a SECITEM_FreeItem(..., PR_TRUE) call. | |
| 625 */ | |
| 626 SECItem* PK11_DEREncodePublicKey(const SECKEYPublicKey *pubk); | |
| 627 PK11SymKey* PK11_CopySymKeyForSigning(PK11SymKey *originalKey, | |
| 628 CK_MECHANISM_TYPE mech); | |
| 629 SECKEYPrivateKeyList* PK11_ListPrivKeysInSlot(PK11SlotInfo *slot, | |
| 630 char *nickname, void *wincx); | |
| 631 SECKEYPublicKeyList* PK11_ListPublicKeysInSlot(PK11SlotInfo *slot, | |
| 632 char *nickname); | |
| 633 SECKEYPQGParams *PK11_GetPQGParamsFromPrivateKey(SECKEYPrivateKey *privKey); | |
| 634 /* deprecated */ | |
| 635 SECKEYPrivateKeyList* PK11_ListPrivateKeysInSlot(PK11SlotInfo *slot); | |
| 636 | |
| 637 PK11SymKey *PK11_ConvertSessionSymKeyToTokenSymKey(PK11SymKey *symk, | |
| 638 void *wincx); | |
| 639 SECKEYPrivateKey *PK11_ConvertSessionPrivKeyToTokenPrivKey( | |
| 640 SECKEYPrivateKey *privk, void* wincx); | |
| 641 SECKEYPrivateKey * PK11_CopyTokenPrivKeyToSessionPrivKey(PK11SlotInfo *destSlot, | |
| 642 SECKEYPrivateKey *privKey); | |
| 643 | |
| 644 /********************************************************************** | |
| 645 * Certs | |
| 646 **********************************************************************/ | |
| 647 SECItem *PK11_MakeIDFromPubKey(SECItem *pubKeyData); | |
| 648 SECStatus PK11_TraverseSlotCerts( | |
| 649 SECStatus(* callback)(CERTCertificate*,SECItem *,void *), | |
| 650 void *arg, void *wincx); | |
| 651 CERTCertificate * PK11_FindCertFromNickname(const char *nickname, void *wincx); | |
| 652 CERTCertList * PK11_FindCertsFromEmailAddress(const char *email, void *wincx); | |
| 653 CERTCertList * PK11_FindCertsFromNickname(const char *nickname, void *wincx); | |
| 654 CERTCertificate *PK11_GetCertFromPrivateKey(SECKEYPrivateKey *privKey); | |
| 655 SECStatus PK11_ImportCert(PK11SlotInfo *slot, CERTCertificate *cert, | |
| 656 CK_OBJECT_HANDLE key, const char *nickname, | |
| 657 PRBool includeTrust); | |
| 658 SECStatus PK11_ImportDERCert(PK11SlotInfo *slot, SECItem *derCert, | |
| 659 CK_OBJECT_HANDLE key, char *nickname, PRBool includeTrust); | |
| 660 PK11SlotInfo *PK11_ImportCertForKey(CERTCertificate *cert, | |
| 661 const char *nickname, void *wincx); | |
| 662 PK11SlotInfo *PK11_ImportDERCertForKey(SECItem *derCert, char *nickname, | |
| 663 void *wincx); | |
| 664 PK11SlotInfo *PK11_KeyForCertExists(CERTCertificate *cert, | |
| 665 CK_OBJECT_HANDLE *keyPtr, void *wincx); | |
| 666 PK11SlotInfo *PK11_KeyForDERCertExists(SECItem *derCert, | |
| 667 CK_OBJECT_HANDLE *keyPtr, void *wincx); | |
| 668 CERTCertificate * PK11_FindCertByIssuerAndSN(PK11SlotInfo **slot, | |
| 669 CERTIssuerAndSN *sn, void *wincx); | |
| 670 CERTCertificate * PK11_FindCertAndKeyByRecipientList(PK11SlotInfo **slot, | |
| 671 SEC_PKCS7RecipientInfo **array, SEC_PKCS7RecipientInfo **rip, | |
| 672 SECKEYPrivateKey**privKey, void *wincx); | |
| 673 int PK11_FindCertAndKeyByRecipientListNew(NSSCMSRecipient **recipientlist, | |
| 674 void *wincx); | |
| 675 SECStatus PK11_TraverseCertsForSubjectInSlot(CERTCertificate *cert, | |
| 676 PK11SlotInfo *slot, SECStatus(*callback)(CERTCertificate *, void *), | |
| 677 void *arg); | |
| 678 CERTCertificate *PK11_FindCertFromDERCert(PK11SlotInfo *slot, | |
| 679 CERTCertificate *cert, void *wincx); | |
| 680 CERTCertificate *PK11_FindCertFromDERCertItem(PK11SlotInfo *slot, | |
| 681 const SECItem *derCert, void *wincx); | |
| 682 SECStatus PK11_ImportCertForKeyToSlot(PK11SlotInfo *slot, CERTCertificate *cert, | |
| 683 char *nickname, PRBool addUsage, | |
| 684 void *wincx); | |
| 685 CERTCertificate *PK11_FindBestKEAMatch(CERTCertificate *serverCert,void *wincx); | |
| 686 PRBool PK11_FortezzaHasKEA(CERTCertificate *cert); | |
| 687 CK_OBJECT_HANDLE PK11_FindCertInSlot(PK11SlotInfo *slot, CERTCertificate *cert, | |
| 688 void *wincx); | |
| 689 SECStatus PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, | |
| 690 PK11SlotInfo *slot, SECStatus(*callback)(CERTCertificate *, void *), | |
| 691 void *arg); | |
| 692 CERTCertList * PK11_ListCerts(PK11CertListType type, void *pwarg); | |
| 693 CERTCertList * PK11_ListCertsInSlot(PK11SlotInfo *slot); | |
| 694 CERTSignedCrl* PK11_ImportCRL(PK11SlotInfo * slot, SECItem *derCRL, char *url, | |
| 695 int type, void *wincx, PRInt32 importOptions, PLArenaPool* arena, PRInt32 de
codeOptions); | |
| 696 | |
| 697 /********************************************************************** | |
| 698 * Sign/Verify | |
| 699 **********************************************************************/ | |
| 700 | |
| 701 /* | |
| 702 * Return the length in bytes of a signature generated with the | |
| 703 * private key. | |
| 704 * | |
| 705 * Return 0 or -1 on failure. (XXX Should we fix it to always return | |
| 706 * -1 on failure?) | |
| 707 */ | |
| 708 int PK11_SignatureLen(SECKEYPrivateKey *key); | |
| 709 PK11SlotInfo * PK11_GetSlotFromPrivateKey(SECKEYPrivateKey *key); | |
| 710 SECStatus PK11_Sign(SECKEYPrivateKey *key, SECItem *sig, | |
| 711 const SECItem *hash); | |
| 712 SECStatus PK11_SignWithMechanism(SECKEYPrivateKey *key, | |
| 713 CK_MECHANISM_TYPE mechanism, | |
| 714 const SECItem *param, SECItem *sig, | |
| 715 const SECItem *hash); | |
| 716 SECStatus PK11_SignWithSymKey(PK11SymKey *symKey, CK_MECHANISM_TYPE mechanism, | |
| 717 SECItem *param, SECItem *sig, const SECItem *data); | |
| 718 SECStatus PK11_VerifyRecover(SECKEYPublicKey *key, const SECItem *sig, | |
| 719 SECItem *dsig, void * wincx); | |
| 720 SECStatus PK11_Verify(SECKEYPublicKey *key, const SECItem *sig, | |
| 721 const SECItem *hash, void *wincx); | |
| 722 SECStatus PK11_VerifyWithMechanism(SECKEYPublicKey *key, | |
| 723 CK_MECHANISM_TYPE mechanism, | |
| 724 const SECItem *param, const SECItem *sig, | |
| 725 const SECItem *hash, void *wincx); | |
| 726 | |
| 727 | |
| 728 | |
| 729 /********************************************************************** | |
| 730 * Crypto Contexts | |
| 731 **********************************************************************/ | |
| 732 void PK11_DestroyContext(PK11Context *context, PRBool freeit); | |
| 733 PK11Context *PK11_CreateContextBySymKey(CK_MECHANISM_TYPE type, | |
| 734 CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey, SECItem *param); | |
| 735 PK11Context *PK11_CreateDigestContext(SECOidTag hashAlg); | |
| 736 PK11Context *PK11_CloneContext(PK11Context *old); | |
| 737 SECStatus PK11_DigestBegin(PK11Context *cx); | |
| 738 /* | |
| 739 * The output buffer 'out' must be big enough to hold the output of | |
| 740 * the hash algorithm 'hashAlg'. | |
| 741 */ | |
| 742 SECStatus PK11_HashBuf(SECOidTag hashAlg, unsigned char *out, | |
| 743 const unsigned char *in, PRInt32 len); | |
| 744 SECStatus PK11_DigestOp(PK11Context *context, const unsigned char *in, | |
| 745 unsigned len); | |
| 746 SECStatus PK11_CipherOp(PK11Context *context, unsigned char * out, int *outlen, | |
| 747 int maxout, const unsigned char *in, int inlen); | |
| 748 SECStatus PK11_Finalize(PK11Context *context); | |
| 749 SECStatus PK11_DigestFinal(PK11Context *context, unsigned char *data, | |
| 750 unsigned int *outLen, unsigned int length); | |
| 751 #define PK11_CipherFinal PK11_DigestFinal | |
| 752 SECStatus PK11_SaveContext(PK11Context *cx,unsigned char *save, | |
| 753 int *len, int saveLength); | |
| 754 | |
| 755 /* Save the context's state, with possible allocation. | |
| 756 * The caller may supply an already allocated buffer in preAllocBuf, | |
| 757 * with length pabLen. If the buffer is large enough for the context's | |
| 758 * state, it will receive the state. | |
| 759 * If the buffer is not large enough (or NULL), then a new buffer will | |
| 760 * be allocated with PORT_Alloc. | |
| 761 * In either case, the state will be returned as a buffer, and the length | |
| 762 * of the state will be given in *stateLen. | |
| 763 */ | |
| 764 unsigned char * | |
| 765 PK11_SaveContextAlloc(PK11Context *cx, | |
| 766 unsigned char *preAllocBuf, unsigned int pabLen, | |
| 767 unsigned int *stateLen); | |
| 768 | |
| 769 SECStatus PK11_RestoreContext(PK11Context *cx,unsigned char *save,int len); | |
| 770 SECStatus PK11_GenerateFortezzaIV(PK11SymKey *symKey,unsigned char *iv,int len); | |
| 771 void PK11_SetFortezzaHack(PK11SymKey *symKey) ; | |
| 772 | |
| 773 | |
| 774 /********************************************************************** | |
| 775 * PBE functions | |
| 776 **********************************************************************/ | |
| 777 | |
| 778 /* This function creates PBE parameters from the given inputs. The result | |
| 779 * can be used to create a password integrity key for PKCS#12, by sending | |
| 780 * the return value to PK11_KeyGen along with the appropriate mechanism. | |
| 781 */ | |
| 782 SECItem * | |
| 783 PK11_CreatePBEParams(SECItem *salt, SECItem *pwd, unsigned int iterations); | |
| 784 | |
| 785 /* free params created above (can be called after keygen is done */ | |
| 786 void PK11_DestroyPBEParams(SECItem *params); | |
| 787 | |
| 788 SECAlgorithmID * | |
| 789 PK11_CreatePBEAlgorithmID(SECOidTag algorithm, int iteration, SECItem *salt); | |
| 790 | |
| 791 /* use to create PKCS5 V2 algorithms with finder control than that provided | |
| 792 * by PK11_CreatePBEAlgorithmID. */ | |
| 793 SECAlgorithmID * | |
| 794 PK11_CreatePBEV2AlgorithmID(SECOidTag pbeAlgTag, SECOidTag cipherAlgTag, | |
| 795 SECOidTag prfAlgTag, int keyLength, int iteration, | |
| 796 SECItem *salt); | |
| 797 PK11SymKey * | |
| 798 PK11_PBEKeyGen(PK11SlotInfo *slot, SECAlgorithmID *algid, SECItem *pwitem, | |
| 799 PRBool faulty3DES, void *wincx); | |
| 800 | |
| 801 /* warning: cannot work with PKCS 5 v2 use PK11_PBEKeyGen instead */ | |
| 802 PK11SymKey * | |
| 803 PK11_RawPBEKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *params, | |
| 804 SECItem *pwitem, PRBool faulty3DES, void *wincx); | |
| 805 SECItem * | |
| 806 PK11_GetPBEIV(SECAlgorithmID *algid, SECItem *pwitem); | |
| 807 /* | |
| 808 * Get the Mechanism and parameter of the base encryption or mac scheme from | |
| 809 * a PBE algorithm ID. | |
| 810 * Caller is responsible for freeing the return parameter (param). | |
| 811 */ | |
| 812 CK_MECHANISM_TYPE | |
| 813 PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, | |
| 814 SECItem **param, SECItem *pwd); | |
| 815 | |
| 816 /********************************************************************** | |
| 817 * Functions to manage secmod flags | |
| 818 **********************************************************************/ | |
| 819 const PK11DefaultArrayEntry *PK11_GetDefaultArray(int *size); | |
| 820 SECStatus PK11_UpdateSlotAttribute(PK11SlotInfo *slot, | |
| 821 const PK11DefaultArrayEntry *entry, | |
| 822 PRBool add); | |
| 823 | |
| 824 /********************************************************************** | |
| 825 * Functions to look at PKCS #11 dependent data | |
| 826 **********************************************************************/ | |
| 827 PK11GenericObject *PK11_FindGenericObjects(PK11SlotInfo *slot, | |
| 828 CK_OBJECT_CLASS objClass); | |
| 829 PK11GenericObject *PK11_GetNextGenericObject(PK11GenericObject *object); | |
| 830 PK11GenericObject *PK11_GetPrevGenericObject(PK11GenericObject *object); | |
| 831 SECStatus PK11_UnlinkGenericObject(PK11GenericObject *object); | |
| 832 SECStatus PK11_LinkGenericObject(PK11GenericObject *list, | |
| 833 PK11GenericObject *object); | |
| 834 SECStatus PK11_DestroyGenericObjects(PK11GenericObject *object); | |
| 835 SECStatus PK11_DestroyGenericObject(PK11GenericObject *object); | |
| 836 PK11GenericObject *PK11_CreateGenericObject(PK11SlotInfo *slot, | |
| 837 const CK_ATTRIBUTE *pTemplate, | |
| 838 int count, PRBool token); | |
| 839 | |
| 840 /* | |
| 841 * PK11_ReadRawAttribute and PK11_WriteRawAttribute are generic | |
| 842 * functions to read and modify the actual PKCS #11 attributes of | |
| 843 * the underlying pkcs #11 object. | |
| 844 * | |
| 845 * object is a pointer to an NSS object that represents the underlying | |
| 846 * PKCS #11 object. It's type must match the type of PK11ObjectType | |
| 847 * as follows: | |
| 848 * | |
| 849 * type object | |
| 850 * PK11_TypeGeneric PK11GenericObject * | |
| 851 * PK11_TypePrivKey SECKEYPrivateKey * | |
| 852 * PK11_TypePubKey SECKEYPublicKey * | |
| 853 * PK11_TypeSymKey PK11SymKey * | |
| 854 * | |
| 855 * All other types are considered invalid. If type does not match the object | |
| 856 * passed, unpredictable results will occur. | |
| 857 * | |
| 858 * PK11_ReadRawAttribute allocates the buffer for returning the attribute | |
| 859 * value. The caller of PK11_ReadRawAttribute should free the data buffer | |
| 860 * pointed to by item using a SECITEM_FreeItem(item, PR_FALSE) or | |
| 861 * PORT_Free(item->data) call. | |
| 862 */ | |
| 863 SECStatus PK11_ReadRawAttribute(PK11ObjectType type, void *object, | |
| 864 CK_ATTRIBUTE_TYPE attr, SECItem *item); | |
| 865 SECStatus PK11_WriteRawAttribute(PK11ObjectType type, void *object, | |
| 866 CK_ATTRIBUTE_TYPE attr, SECItem *item); | |
| 867 | |
| 868 /* | |
| 869 * PK11_GetAllSlotsForCert returns all the slots that a given certificate | |
| 870 * exists on, since it's possible for a cert to exist on more than one | |
| 871 * PKCS#11 token. | |
| 872 */ | |
| 873 PK11SlotList * | |
| 874 PK11_GetAllSlotsForCert(CERTCertificate *cert, void *arg); | |
| 875 | |
| 876 /********************************************************************** | |
| 877 * New functions which are already deprecated.... | |
| 878 **********************************************************************/ | |
| 879 SECItem * | |
| 880 PK11_GetLowLevelKeyIDForCert(PK11SlotInfo *slot, | |
| 881 CERTCertificate *cert, void *pwarg); | |
| 882 SECItem * | |
| 883 PK11_GetLowLevelKeyIDForPrivateKey(SECKEYPrivateKey *key); | |
| 884 | |
| 885 PRBool SECMOD_HasRootCerts(void); | |
| 886 | |
| 887 SEC_END_PROTOS | |
| 888 | |
| 889 #endif | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2078763002:
Delete bundled copy of NSS and replace with README. (Closed)
Base URL: https://chromium.googlesource.com/chromium/deps/nss@master