Add the nss/lib/pkcs12 directory from NSS (Mozilla's Network Security Services) to third_party. Th…

nss_pkcs12/p12e.c

+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "p12t.h"
+#include "p12.h"
+#include "plarena.h"
+#include "secitem.h"
+#include "secoid.h"
+#include "seccomon.h"
+#include "secport.h"
+#include "cert.h"
+#include "secpkcs7.h"
+#include "secasn1.h"
+#include "secerr.h"
+#include "pk11func.h"
+#include "p12plcy.h"
+#include "p12local.h"
+#include "prcpucfg.h"
+
+extern const int NSS_PBE_DEFAULT_ITERATION_COUNT; /* defined in p7create.c */
+
+/*
+** This PKCS12 file encoder uses numerous nested ASN.1 and PKCS7 encoder
+** contexts.  It can be difficult to keep straight.  Here's a picture:
+**
+**  "outer"  ASN.1 encoder.  The output goes to the library caller's CB.
+**  "middle" PKCS7 encoder.  Feeds    the "outer" ASN.1 encoder.
+**  "middle" ASN1  encoder.  Encodes  the encrypted aSafes. 
+**                           Feeds    the "middle" P7 encoder above.
+**  "inner"  PKCS7 encoder.  Encrypts the "authenticated Safes" (aSafes)
+**                           Feeds    the "middle" ASN.1 encoder above.
+**  "inner"  ASN.1 encoder.  Encodes  the unencrypted aSafes.  
+**                           Feeds    the "inner" P7 enocder above.
+**
+** Buffering has been added at each point where the output of an ASN.1
+** encoder feeds the input of a PKCS7 encoder.
+*/
+
+/*********************************
+ * Output buffer object, used to buffer output from ASN.1 encoder
+ * before passing data on down to the next PKCS7 encoder.
+ *********************************/
+
+#define PK12_OUTPUT_BUFFER_SIZE  8192
+
+struct sec_pkcs12OutputBufferStr {
+    SEC_PKCS7EncoderContext * p7eCx;
+    PK11Context             * hmacCx;
+    unsigned int              numBytes;
+    unsigned int              bufBytes;
+             char             buf[PK12_OUTPUT_BUFFER_SIZE];
+};
+typedef struct sec_pkcs12OutputBufferStr sec_pkcs12OutputBuffer;
+
+/*********************************
+ * Structures used in exporting the PKCS 12 blob
+ *********************************/
+
+/* A SafeInfo is used for each ContentInfo which makes up the
+ * sequence of safes in the AuthenticatedSafe portion of the
+ * PFX structure.
+ */
+struct SEC_PKCS12SafeInfoStr {
+    PLArenaPool *arena;
+
+    /* information for setting up password encryption */
+    SECItem pwitem;
+    SECOidTag algorithm;
+    PK11SymKey *encryptionKey;
+
+    /* how many items have been stored in this safe,
+     * we will skip any safe which does not contain any
+     * items
+      */
+    unsigned int itemCount;
+
+    /* the content info for the safe */
+    SEC_PKCS7ContentInfo *cinfo;
+
+    sec_PKCS12SafeContents *safe;
+};
+
+/* An opaque structure which contains information needed for exporting
+ * certificates and keys through PKCS 12.
+ */
+struct SEC_PKCS12ExportContextStr {
+    PLArenaPool *arena;
+    PK11SlotInfo *slot;
+    void *wincx;
+
+    /* integrity information */
+    PRBool integrityEnabled;
+    PRBool      pwdIntegrity;
+    union {
+        struct sec_PKCS12PasswordModeInfo pwdInfo;
+        struct sec_PKCS12PublicKeyModeInfo pubkeyInfo;
+    } integrityInfo; 
+
+    /* helper functions */
+    /* retrieve the password call back */
+    SECKEYGetPasswordKey pwfn;
+    void *pwfnarg;
+
+    /* safe contents bags */
+    SEC_PKCS12SafeInfo **safeInfos;
+    unsigned int safeInfoCount;
+
+    /* the sequence of safes */
+    sec_PKCS12AuthenticatedSafe authSafe;
+
+    /* information needing deletion */
+    CERTCertificate **certList;
+};
+
+/* structures for passing information to encoder callbacks when processing
+ * data through the ASN1 engine.
+ */
+struct sec_pkcs12_encoder_output {
+    SEC_PKCS12EncoderOutputCallback outputfn;
+    void *outputarg;
+};
+
+struct sec_pkcs12_hmac_and_output_info {
+    void *arg;
+    struct sec_pkcs12_encoder_output output;
+};
+
+/* An encoder context which is used for the actual encoding
+ * portion of PKCS 12. 
+ */
+typedef struct sec_PKCS12EncoderContextStr {
+    PLArenaPool *arena;
+    SEC_PKCS12ExportContext *p12exp;
+
+    /* encoder information - this is set up based on whether 
+     * password based or public key pased privacy is being used
+     */
+    SEC_ASN1EncoderContext *outerA1ecx;
+    union {
+        struct sec_pkcs12_hmac_and_output_info hmacAndOutputInfo;
+        struct sec_pkcs12_encoder_output       encOutput;
+    } output;
+
+    /* structures for encoding of PFX and MAC */
+    sec_PKCS12PFXItem        pfx;
+    sec_PKCS12MacData        mac;
+
+    /* authenticated safe encoding tracking information */
+    SEC_PKCS7ContentInfo    *aSafeCinfo;
+    SEC_PKCS7EncoderContext *middleP7ecx;
+    SEC_ASN1EncoderContext  *middleA1ecx;
+    unsigned int             currentSafe;
+
+    /* hmac context */
+    PK11Context             *hmacCx;
+
+    /* output buffers */
+    sec_pkcs12OutputBuffer  middleBuf;
+    sec_pkcs12OutputBuffer  innerBuf;
+
+} sec_PKCS12EncoderContext;
+
+
+/*********************************
+ * Export setup routines
+ *********************************/
+
+/* SEC_PKCS12CreateExportContext 
+ *   Creates an export context and sets the unicode and password retrieval
+ *   callbacks.  This is the first call which must be made when exporting
+ *   a PKCS 12 blob.
+ *
+ * pwfn, pwfnarg - password retrieval callback and argument.  these are
+ *                 required for password-authentication mode.
+ */
+SEC_PKCS12ExportContext *
+SEC_PKCS12CreateExportContext(SECKEYGetPasswordKey pwfn, void *pwfnarg,  
+                              PK11SlotInfo *slot, void *wincx)
+{
+    PLArenaPool *arena = NULL;
+    SEC_PKCS12ExportContext *p12ctxt = NULL;
+
+    /* allocate the arena and create the context */
+    arena = PORT_NewArena(4096);
+    if(!arena) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    p12ctxt = (SEC_PKCS12ExportContext *)PORT_ArenaZAlloc(arena, 
+                                        sizeof(SEC_PKCS12ExportContext));
+    if(!p12ctxt) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* password callback for key retrieval */
+    p12ctxt->pwfn = pwfn;
+    p12ctxt->pwfnarg = pwfnarg;
+
+    p12ctxt->integrityEnabled = PR_FALSE;
+    p12ctxt->arena = arena;
+    p12ctxt->wincx = wincx;
+    p12ctxt->slot = (slot) ? PK11_ReferenceSlot(slot) : PK11_GetInternalSlot();
+
+    return p12ctxt;
+
+loser:
+    if(arena) {
+        PORT_FreeArena(arena, PR_TRUE);
+    }
+
+    return NULL;
+}
+
+/* 
+ * Adding integrity mode
+ */
+
+/* SEC_PKCS12AddPasswordIntegrity 
+ *      Add password integrity to the exported data.  If an integrity method
+ *      has already been set, then return an error.
+ *      
+ *      p12ctxt - the export context
+ *      pwitem - the password for integrity mode
+ *      integAlg - the integrity algorithm to use for authentication.
+ */
+SECStatus
+SEC_PKCS12AddPasswordIntegrity(SEC_PKCS12ExportContext *p12ctxt,
+                               SECItem *pwitem, SECOidTag integAlg) 
+{                              
+    if(!p12ctxt || p12ctxt->integrityEnabled) {
+        return SECFailure;
+    }
+   
+    /* set up integrity information */
+    p12ctxt->pwdIntegrity = PR_TRUE;
+    p12ctxt->integrityInfo.pwdInfo.password = 
+        (SECItem*)PORT_ArenaZAlloc(p12ctxt->arena, sizeof(SECItem));
+    if(!p12ctxt->integrityInfo.pwdInfo.password) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return SECFailure;
+    }
+    if(SECITEM_CopyItem(p12ctxt->arena, 
+                        p12ctxt->integrityInfo.pwdInfo.password, pwitem)
+                != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return SECFailure;
+    }
+    p12ctxt->integrityInfo.pwdInfo.algorithm = integAlg;
+    p12ctxt->integrityEnabled = PR_TRUE;
+
+    return SECSuccess;
+}
+
+/* SEC_PKCS12AddPublicKeyIntegrity
+ *      Add public key integrity to the exported data.  If an integrity method
+ *      has already been set, then return an error.  The certificate must be
+ *      allowed to be used as a signing cert.
+ *      
+ *      p12ctxt - the export context
+ *      cert - signer certificate
+ *      certDb - the certificate database
+ *      algorithm - signing algorithm
+ *      keySize - size of the signing key (?)
+ */
+SECStatus
+SEC_PKCS12AddPublicKeyIntegrity(SEC_PKCS12ExportContext *p12ctxt,
+                                CERTCertificate *cert, CERTCertDBHandle *certDb,
+                                SECOidTag algorithm, int keySize)
+{
+    if(!p12ctxt) {
+        return SECFailure;
+    }
+    
+    p12ctxt->integrityInfo.pubkeyInfo.cert = cert;
+    p12ctxt->integrityInfo.pubkeyInfo.certDb = certDb;
+    p12ctxt->integrityInfo.pubkeyInfo.algorithm = algorithm;
+    p12ctxt->integrityInfo.pubkeyInfo.keySize = keySize;
+    p12ctxt->integrityEnabled = PR_TRUE;
+
+    return SECSuccess;
+}
+
+
+/*
+ * Adding safes - encrypted (password/public key) or unencrypted
+ *      Each of the safe creation routines return an opaque pointer which
+ *      are later passed into the routines for exporting certificates and
+ *      keys.
+ */
+
+/* append the newly created safeInfo to list of safeInfos in the export
+ * context.  
+ */
+static SECStatus
+sec_pkcs12_append_safe_info(SEC_PKCS12ExportContext *p12ctxt, SEC_PKCS12SafeInfo *info)
+{
+    void *mark = NULL, *dummy1 = NULL, *dummy2 = NULL;
+
+    if(!p12ctxt || !info) {
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(p12ctxt->arena);
+
+    /* if no safeInfos have been set, create the list, otherwise expand it. */
+    if(!p12ctxt->safeInfoCount) {
+        p12ctxt->safeInfos = (SEC_PKCS12SafeInfo **)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                              2 * sizeof(SEC_PKCS12SafeInfo *));
+        dummy1 = p12ctxt->safeInfos;
+        p12ctxt->authSafe.encodedSafes = (SECItem **)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                        2 * sizeof(SECItem *));
+        dummy2 = p12ctxt->authSafe.encodedSafes;
+    } else {
+        dummy1 = PORT_ArenaGrow(p12ctxt->arena, p12ctxt->safeInfos, 
+                               (p12ctxt->safeInfoCount + 1) * sizeof(SEC_PKCS12SafeInfo *),
+                               (p12ctxt->safeInfoCount + 2) * sizeof(SEC_PKCS12SafeInfo *));
+        p12ctxt->safeInfos = (SEC_PKCS12SafeInfo **)dummy1;
+        dummy2 = PORT_ArenaGrow(p12ctxt->arena, p12ctxt->authSafe.encodedSafes, 
+                               (p12ctxt->authSafe.safeCount + 1) * sizeof(SECItem *),
+                               (p12ctxt->authSafe.safeCount + 2) * sizeof(SECItem *));
+        p12ctxt->authSafe.encodedSafes = (SECItem**)dummy2;
+    }
+    if(!dummy1 || !dummy2) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* append the new safeInfo and null terminate the list */
+    p12ctxt->safeInfos[p12ctxt->safeInfoCount] = info;
+    p12ctxt->safeInfos[++p12ctxt->safeInfoCount] = NULL;
+    p12ctxt->authSafe.encodedSafes[p12ctxt->authSafe.safeCount] = 
+        (SECItem*)PORT_ArenaZAlloc(p12ctxt->arena, sizeof(SECItem));
+    if(!p12ctxt->authSafe.encodedSafes[p12ctxt->authSafe.safeCount]) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    p12ctxt->authSafe.encodedSafes[++p12ctxt->authSafe.safeCount] = NULL;
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    return SECFailure;
+}
+
+/* SEC_PKCS12CreatePasswordPrivSafe
+ *      Create a password privacy safe to store exported information in.
+ *
+ *      p12ctxt - export context
+ *      pwitem - password for encryption
+ *      privAlg - pbe algorithm through which encryption is done.
+ */
+SEC_PKCS12SafeInfo *
+SEC_PKCS12CreatePasswordPrivSafe(SEC_PKCS12ExportContext *p12ctxt, 
+                                 SECItem *pwitem, SECOidTag privAlg)
+{
+    SEC_PKCS12SafeInfo *safeInfo = NULL;
+    void *mark = NULL;
+    PK11SlotInfo *slot = NULL;
+    SECAlgorithmID *algId;
+    SECItem uniPwitem = {siBuffer, NULL, 0};
+
+    if(!p12ctxt) {
+        return NULL;
+    }
+
+    /* allocate the safe info */
+    mark = PORT_ArenaMark(p12ctxt->arena);
+    safeInfo = (SEC_PKCS12SafeInfo *)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                                sizeof(SEC_PKCS12SafeInfo));
+    if(!safeInfo) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        return NULL;
+    }
+
+    safeInfo->itemCount = 0;
+
+    /* create the encrypted safe */
+    safeInfo->cinfo = SEC_PKCS7CreateEncryptedData(privAlg, 0, p12ctxt->pwfn, 
+                                                   p12ctxt->pwfnarg);
+    if(!safeInfo->cinfo) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    safeInfo->arena = p12ctxt->arena;
+
+    /* convert the password to unicode */ 
+    if(!sec_pkcs12_convert_item_to_unicode(NULL, &uniPwitem, pwitem,
+                                               PR_TRUE, PR_TRUE, PR_TRUE)) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    if(SECITEM_CopyItem(p12ctxt->arena, &safeInfo->pwitem, &uniPwitem) != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* generate the encryption key */
+    slot = PK11_ReferenceSlot(p12ctxt->slot);
+    if(!slot) {
+        slot = PK11_GetInternalKeySlot();
+        if(!slot) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+    }
+
+    algId = SEC_PKCS7GetEncryptionAlgorithm(safeInfo->cinfo);
+    safeInfo->encryptionKey = PK11_PBEKeyGen(slot, algId, &uniPwitem, 
+                                             PR_FALSE, p12ctxt->wincx);
+    if(!safeInfo->encryptionKey) {
+        goto loser;
+    }
+
+    safeInfo->arena = p12ctxt->arena;
+    safeInfo->safe = NULL;
+    if(sec_pkcs12_append_safe_info(p12ctxt, safeInfo) != SECSuccess) {
+        goto loser;
+    }
+
+    if(uniPwitem.data) {
+        SECITEM_ZfreeItem(&uniPwitem, PR_FALSE);
+    }
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+
+    if (slot) {
+        PK11_FreeSlot(slot);
+    }
+    return safeInfo;
+
+loser:
+    if (slot) {
+        PK11_FreeSlot(slot);
+    }
+    if(safeInfo->cinfo) {
+        SEC_PKCS7DestroyContentInfo(safeInfo->cinfo);
+    }
+
+    if(uniPwitem.data) {
+        SECITEM_ZfreeItem(&uniPwitem, PR_FALSE);
+    }
+
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    return NULL;
+}
+
+/* SEC_PKCS12CreateUnencryptedSafe 
+ *      Creates an unencrypted safe within the export context.
+ *
+ *      p12ctxt - the export context 
+ */
+SEC_PKCS12SafeInfo *
+SEC_PKCS12CreateUnencryptedSafe(SEC_PKCS12ExportContext *p12ctxt)
+{
+    SEC_PKCS12SafeInfo *safeInfo = NULL;
+    void *mark = NULL;
+
+    if(!p12ctxt) {
+        return NULL;
+    }
+
+    /* create the safe info */
+    mark = PORT_ArenaMark(p12ctxt->arena);
+    safeInfo = (SEC_PKCS12SafeInfo *)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                              sizeof(SEC_PKCS12SafeInfo));
+    if(!safeInfo) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    safeInfo->itemCount = 0;
+
+    /* create the safe content */
+    safeInfo->cinfo = SEC_PKCS7CreateData();
+    if(!safeInfo->cinfo) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    if(sec_pkcs12_append_safe_info(p12ctxt, safeInfo) != SECSuccess) {
+        goto loser;
+    }
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return safeInfo;
+
+loser:
+    if(safeInfo->cinfo) {
+        SEC_PKCS7DestroyContentInfo(safeInfo->cinfo);
+    }
+
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    return NULL;
+}
+
+/* SEC_PKCS12CreatePubKeyEncryptedSafe
+ *      Creates a safe which is protected by public key encryption.  
+ *
+ *      p12ctxt - the export context
+ *      certDb - the certificate database
+ *      signer - the signer's certificate
+ *      recipients - the list of recipient certificates.
+ *      algorithm - the encryption algorithm to use
+ *      keysize - the algorithms key size (?)
+ */
+SEC_PKCS12SafeInfo *
+SEC_PKCS12CreatePubKeyEncryptedSafe(SEC_PKCS12ExportContext *p12ctxt,
+                                    CERTCertDBHandle *certDb,
+                                    CERTCertificate *signer,
+                                    CERTCertificate **recipients,
+                                    SECOidTag algorithm, int keysize) 
+{
+    SEC_PKCS12SafeInfo *safeInfo = NULL;
+    void *mark = NULL;
+
+    if(!p12ctxt || !signer || !recipients || !(*recipients)) {
+        return NULL;
+    }
+
+    /* allocate the safeInfo */
+    mark = PORT_ArenaMark(p12ctxt->arena);
+    safeInfo = (SEC_PKCS12SafeInfo *)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                                      sizeof(SEC_PKCS12SafeInfo));
+    if(!safeInfo) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    safeInfo->itemCount = 0;
+    safeInfo->arena = p12ctxt->arena;
+
+    /* create the enveloped content info using certUsageEmailSigner currently.
+     * XXX We need to eventually use something other than certUsageEmailSigner
+     */
+    safeInfo->cinfo = SEC_PKCS7CreateEnvelopedData(signer, certUsageEmailSigner,
+                                        certDb, algorithm, keysize, 
+                                        p12ctxt->pwfn, p12ctxt->pwfnarg);
+    if(!safeInfo->cinfo) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* add recipients */
+    if(recipients) {
+        unsigned int i = 0;
+        while(recipients[i] != NULL) {
+            SECStatus rv = SEC_PKCS7AddRecipient(safeInfo->cinfo, recipients[i],
+                                               certUsageEmailRecipient, certDb);
+            if(rv != SECSuccess) {
+                goto loser;
+            }
+            i++;
+        }
+    }
+
+    if(sec_pkcs12_append_safe_info(p12ctxt, safeInfo) != SECSuccess) {
+        goto loser;
+    }
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return safeInfo;
+
+loser:
+    if(safeInfo->cinfo) {
+        SEC_PKCS7DestroyContentInfo(safeInfo->cinfo);
+        safeInfo->cinfo = NULL;
+    }
+
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    return NULL;
+} 
+
+/*********************************
+ * Routines to handle the exporting of the keys and certificates
+ *********************************/
+
+/* creates a safe contents which safeBags will be appended to */
+sec_PKCS12SafeContents *
+sec_PKCS12CreateSafeContents(PLArenaPool *arena)
+{
+    sec_PKCS12SafeContents *safeContents;
+
+    if(arena == NULL) {
+        return NULL; 
+    }
+
+    /* create the safe contents */
+    safeContents = (sec_PKCS12SafeContents *)PORT_ArenaZAlloc(arena,
+                                            sizeof(sec_PKCS12SafeContents));
+    if(!safeContents) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* set up the internal contents info */
+    safeContents->safeBags = NULL;
+    safeContents->arena = arena;
+    safeContents->bagCount = 0;
+
+    return safeContents;
+
+loser:
+    return NULL;
+}   
+
+/* appends a safe bag to a safeContents using the specified arena. 
+ */
+SECStatus
+sec_pkcs12_append_bag_to_safe_contents(PLArenaPool *arena,
+                                       sec_PKCS12SafeContents *safeContents,
+                                       sec_PKCS12SafeBag *safeBag)
+{
+    void *mark = NULL, *dummy = NULL;
+
+    if(!arena || !safeBag || !safeContents) {
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(arena);
+    if(!mark) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return SECFailure;
+    }
+
+    /* allocate space for the list, or reallocate to increase space */
+    if(!safeContents->safeBags) {
+        safeContents->safeBags = (sec_PKCS12SafeBag **)PORT_ArenaZAlloc(arena, 
+                                                (2 * sizeof(sec_PKCS12SafeBag *)));
+        dummy = safeContents->safeBags;
+        safeContents->bagCount = 0;
+    } else {
+        dummy = PORT_ArenaGrow(arena, safeContents->safeBags, 
+                        (safeContents->bagCount + 1) * sizeof(sec_PKCS12SafeBag *),
+                        (safeContents->bagCount + 2) * sizeof(sec_PKCS12SafeBag *));
+        safeContents->safeBags = (sec_PKCS12SafeBag **)dummy;
+    }
+
+    if(!dummy) {
+        PORT_ArenaRelease(arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return SECFailure;
+    }
+
+    /* append the bag at the end and null terminate the list */
+    safeContents->safeBags[safeContents->bagCount++] = safeBag;
+    safeContents->safeBags[safeContents->bagCount] = NULL;
+
+    PORT_ArenaUnmark(arena, mark);
+
+    return SECSuccess;
+}
+
+/* appends a safeBag to a specific safeInfo.
+ */
+SECStatus
+sec_pkcs12_append_bag(SEC_PKCS12ExportContext *p12ctxt, 
+                      SEC_PKCS12SafeInfo *safeInfo, sec_PKCS12SafeBag *safeBag)
+{
+    sec_PKCS12SafeContents *dest;
+    SECStatus rv = SECFailure;
+
+    if(!p12ctxt || !safeBag || !safeInfo) {
+        return SECFailure;
+    }
+
+    if(!safeInfo->safe) {
+        safeInfo->safe = sec_PKCS12CreateSafeContents(p12ctxt->arena);
+        if(!safeInfo->safe) {
+            return SECFailure;
+        }
+    }
+
+    dest = safeInfo->safe;
+    rv = sec_pkcs12_append_bag_to_safe_contents(p12ctxt->arena, dest, safeBag);
+    if(rv == SECSuccess) {
+        safeInfo->itemCount++;
+    }
+    
+    return rv;
+} 
+
+/* Creates a safeBag of the specified type, and if bagData is specified,
+ * the contents are set.  The contents could be set later by the calling
+ * routine.
+ */
+sec_PKCS12SafeBag *
+sec_PKCS12CreateSafeBag(SEC_PKCS12ExportContext *p12ctxt, SECOidTag bagType, 
+                        void *bagData)
+{
+    sec_PKCS12SafeBag *safeBag;
+    PRBool setName = PR_TRUE;
+    void *mark = NULL;
+    SECStatus rv = SECSuccess;
+    SECOidData *oidData = NULL;
+
+    if(!p12ctxt) {
+        return NULL;
+    }
+
+    mark = PORT_ArenaMark(p12ctxt->arena);
+    if(!mark) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    safeBag = (sec_PKCS12SafeBag *)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                                    sizeof(sec_PKCS12SafeBag));
+    if(!safeBag) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    /* set the bags content based upon bag type */
+    switch(bagType) {
+        case SEC_OID_PKCS12_V1_KEY_BAG_ID:
+            safeBag->safeBagContent.pkcs8KeyBag =
+                (SECKEYPrivateKeyInfo *)bagData;
+            break;
+        case SEC_OID_PKCS12_V1_CERT_BAG_ID:
+            safeBag->safeBagContent.certBag = (sec_PKCS12CertBag *)bagData;
+            break;
+        case SEC_OID_PKCS12_V1_CRL_BAG_ID:
+            safeBag->safeBagContent.crlBag = (sec_PKCS12CRLBag *)bagData;
+            break;
+        case SEC_OID_PKCS12_V1_SECRET_BAG_ID:
+            safeBag->safeBagContent.secretBag = (sec_PKCS12SecretBag *)bagData;
+            break;
+        case SEC_OID_PKCS12_V1_PKCS8_SHROUDED_KEY_BAG_ID:
+            safeBag->safeBagContent.pkcs8ShroudedKeyBag = 
+                (SECKEYEncryptedPrivateKeyInfo *)bagData;
+            break;
+        case SEC_OID_PKCS12_V1_SAFE_CONTENTS_BAG_ID:
+            safeBag->safeBagContent.safeContents = 
+                (sec_PKCS12SafeContents *)bagData;
+            setName = PR_FALSE;
+            break;
+        default:
+            goto loser;
+    }
+
+    oidData = SECOID_FindOIDByTag(bagType);
+    if(oidData) {
+        rv = SECITEM_CopyItem(p12ctxt->arena, &safeBag->safeBagType, &oidData->oid);
+        if(rv != SECSuccess) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+    } else {
+        goto loser;
+    }
+    
+    safeBag->arena = p12ctxt->arena;
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+
+    return safeBag;
+
+loser:
+    if(mark) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+    }
+
+    return NULL;
+}
+
+/* Creates a new certificate bag and returns a pointer to it.  If an error
+ * occurs NULL is returned.
+ */
+sec_PKCS12CertBag *
+sec_PKCS12NewCertBag(PLArenaPool *arena, SECOidTag certType)
+{
+    sec_PKCS12CertBag *certBag = NULL;
+    SECOidData *bagType = NULL;
+    SECStatus rv;
+    void *mark = NULL;
+
+    if(!arena) {
+        return NULL;
+    }
+
+    mark = PORT_ArenaMark(arena);
+    certBag = (sec_PKCS12CertBag *)PORT_ArenaZAlloc(arena, 
+                                                    sizeof(sec_PKCS12CertBag));
+    if(!certBag) {
+        PORT_ArenaRelease(arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    bagType = SECOID_FindOIDByTag(certType);
+    if(!bagType) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    rv = SECITEM_CopyItem(arena, &certBag->bagID, &bagType->oid);
+    if(rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+        
+    PORT_ArenaUnmark(arena, mark);
+    return certBag;
+
+loser:
+    PORT_ArenaRelease(arena, mark);
+    return NULL;
+}
+
+/* Creates a new CRL bag and returns a pointer to it.  If an error
+ * occurs NULL is returned.
+ */
+sec_PKCS12CRLBag *
+sec_PKCS12NewCRLBag(PLArenaPool *arena, SECOidTag crlType)
+{
+    sec_PKCS12CRLBag *crlBag = NULL;
+    SECOidData *bagType = NULL;
+    SECStatus rv;
+    void *mark = NULL;
+
+    if(!arena) {
+        return NULL;
+    }
+
+    mark = PORT_ArenaMark(arena);
+    crlBag = (sec_PKCS12CRLBag *)PORT_ArenaZAlloc(arena, 
+                                                  sizeof(sec_PKCS12CRLBag));
+    if(!crlBag) {
+        PORT_ArenaRelease(arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    bagType = SECOID_FindOIDByTag(crlType);
+    if(!bagType) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    rv = SECITEM_CopyItem(arena, &crlBag->bagID, &bagType->oid);
+    if(rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+        
+    PORT_ArenaUnmark(arena, mark);
+    return crlBag;
+
+loser:
+    PORT_ArenaRelease(arena, mark);
+    return NULL;
+}
+
+/* sec_PKCS12AddAttributeToBag
+ * adds an attribute to a safeBag.  currently, the only attributes supported
+ * are those which are specified within PKCS 12.  
+ *
+ *      p12ctxt - the export context 
+ *      safeBag - the safeBag to which attributes are appended
+ *      attrType - the attribute type
+ *      attrData - the attribute data
+ */
+SECStatus
+sec_PKCS12AddAttributeToBag(SEC_PKCS12ExportContext *p12ctxt, 
+                            sec_PKCS12SafeBag *safeBag, SECOidTag attrType,
+                            SECItem *attrData)
+{
+    sec_PKCS12Attribute *attribute;
+    void *mark = NULL, *dummy = NULL;
+    SECOidData *oiddata = NULL;
+    SECItem unicodeName = { siBuffer, NULL, 0};
+    void *src = NULL;
+    unsigned int nItems = 0;
+    SECStatus rv;
+
+    if(!safeBag || !p12ctxt) {
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(safeBag->arena);
+
+    /* allocate the attribute */
+    attribute = (sec_PKCS12Attribute *)PORT_ArenaZAlloc(safeBag->arena, 
+                                                sizeof(sec_PKCS12Attribute));
+    if(!attribute) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* set up the attribute */
+    oiddata = SECOID_FindOIDByTag(attrType);
+    if(!oiddata) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    if(SECITEM_CopyItem(p12ctxt->arena, &attribute->attrType, &oiddata->oid) !=
+                SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    nItems = 1;
+    switch(attrType) {
+        case SEC_OID_PKCS9_LOCAL_KEY_ID:
+            {
+                src = attrData;
+                break;
+            }
+        case SEC_OID_PKCS9_FRIENDLY_NAME:
+            {
+                if(!sec_pkcs12_convert_item_to_unicode(p12ctxt->arena, 
+                                        &unicodeName, attrData, PR_FALSE, 
+                                        PR_FALSE, PR_TRUE)) {
+                    goto loser;
+                }
+                src = &unicodeName;
+                break;
+            }
+        default:
+            goto loser;
+    }
+
+    /* append the attribute to the attribute value list  */
+    attribute->attrValue = (SECItem **)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                            ((nItems + 1) * sizeof(SECItem *)));
+    if(!attribute->attrValue) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* XXX this will need to be changed if attributes requiring more than
+     * one element are ever used.
+     */
+    attribute->attrValue[0] = (SECItem *)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                                          sizeof(SECItem));
+    if(!attribute->attrValue[0]) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    attribute->attrValue[1] = NULL;
+
+    rv = SECITEM_CopyItem(p12ctxt->arena, attribute->attrValue[0], 
+                          (SECItem*)src);
+    if(rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* append the attribute to the safeBag attributes */
+    if(safeBag->nAttribs) {
+        dummy = PORT_ArenaGrow(p12ctxt->arena, safeBag->attribs, 
+                        ((safeBag->nAttribs + 1) * sizeof(sec_PKCS12Attribute *)),
+                        ((safeBag->nAttribs + 2) * sizeof(sec_PKCS12Attribute *)));
+        safeBag->attribs = (sec_PKCS12Attribute **)dummy;
+    } else {
+        safeBag->attribs = (sec_PKCS12Attribute **)PORT_ArenaZAlloc(p12ctxt->arena, 
+                                                2 * sizeof(sec_PKCS12Attribute *));
+        dummy = safeBag->attribs;
+    }
+    if(!dummy) {
+        goto loser;
+    }
+
+    safeBag->attribs[safeBag->nAttribs] = attribute;
+    safeBag->attribs[++safeBag->nAttribs] = NULL;
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return SECSuccess;
+
+loser:
+    if(mark) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+    }
+
+    return SECFailure;
+}
+
+/* SEC_PKCS12AddCert
+ *      Adds a certificate to the data being exported.  
+ *
+ *      p12ctxt - the export context
+ *      safe - the safeInfo to which the certificate is placed 
+ *      nestedDest - if the cert is to be placed within a nested safeContents then,
+ *                   this value is to be specified with the destination
+ *      cert - the cert to export
+ *      certDb - the certificate database handle
+ *      keyId - a unique identifier to associate a certificate/key pair
+ *      includeCertChain - PR_TRUE if the certificate chain is to be included.
+ */
+SECStatus
+SEC_PKCS12AddCert(SEC_PKCS12ExportContext *p12ctxt, SEC_PKCS12SafeInfo *safe, 
+                  void *nestedDest, CERTCertificate *cert, 
+                  CERTCertDBHandle *certDb, SECItem *keyId,
+                  PRBool includeCertChain)
+{
+    sec_PKCS12CertBag *certBag;
+    sec_PKCS12SafeBag *safeBag;
+    void *mark;
+    SECStatus rv;
+    SECItem nick = {siBuffer, NULL,0};
+
+    if(!p12ctxt || !cert) {
+        return SECFailure;
+    }
+    mark = PORT_ArenaMark(p12ctxt->arena);
+
+    /* allocate the cert bag */
+    certBag = sec_PKCS12NewCertBag(p12ctxt->arena, 
+                                   SEC_OID_PKCS9_X509_CERT);
+    if(!certBag) {
+        goto loser;
+    }
+
+    if(SECITEM_CopyItem(p12ctxt->arena, &certBag->value.x509Cert, 
+                        &cert->derCert) != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* if the cert chain is to be included, we should only be exporting
+     * the cert from our internal database.
+     */
+    if(includeCertChain) {
+        CERTCertificateList *certList = CERT_CertChainFromCert(cert,
+                                                               certUsageSSLClient,
+                                                               PR_TRUE);
+        unsigned int count = 0;
+        if(!certList) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+
+        /* add cert chain */
+        for(count = 0; count < (unsigned int)certList->len; count++) {
+            if(SECITEM_CompareItem(&certList->certs[count], &cert->derCert)
+                                != SECEqual) {
+                CERTCertificate *tempCert;
+
+                /* decode the certificate */
+                /* XXX
+                 * This was rather silly.  The chain is constructed above
+                 * by finding all of the CERTCertificate's in the database.
+                 * Then the chain is put into a CERTCertificateList, which only
+                 * contains the DER.  Finally, the DER was decoded, and the
+                 * decoded cert was sent recursively back to this function.
+                 * Beyond being inefficent, this causes data loss (specifically,
+                 * the nickname).  Instead, for 3.4, we'll do a lookup by the
+                 * DER, which should return the cached entry.
+                 */
+                tempCert = CERT_FindCertByDERCert(CERT_GetDefaultCertDB(),
+                                                  &certList->certs[count]);
+                if(!tempCert) {
+                    CERT_DestroyCertificateList(certList);
+                    goto loser;
+                }
+
+                /* add the certificate */
+                if(SEC_PKCS12AddCert(p12ctxt, safe, nestedDest, tempCert,
+                                 certDb, NULL, PR_FALSE) != SECSuccess) {
+                    CERT_DestroyCertificate(tempCert);
+                    CERT_DestroyCertificateList(certList);
+                    goto loser;
+                }
+                CERT_DestroyCertificate(tempCert);
+            }
+        }
+        CERT_DestroyCertificateList(certList);
+    }
+
+    /* if the certificate has a nickname, we will set the friendly name
+     * to that.
+     */
+    if(cert->nickname) {
+        if (cert->slot && !PK11_IsInternal(cert->slot)) {
+          /*
+           * The cert is coming off of an external token, 
+           * let's strip the token name from the nickname
+           * and only add what comes after the colon as the
+           * nickname. -javi
+           */
+            char *delimit;
+            
+            delimit = PORT_Strchr(cert->nickname,':');
+            if (delimit == NULL) {
+                nick.data = (unsigned char *)cert->nickname;
+                nick.len = PORT_Strlen(cert->nickname);
+            } else {
+                delimit++;
+                nick.data = (unsigned char *)PORT_ArenaStrdup(p12ctxt->arena,
+                                                              delimit);
+                nick.len = PORT_Strlen(delimit);
+            }
+        } else {
+            nick.data = (unsigned char *)cert->nickname;
+            nick.len = PORT_Strlen(cert->nickname);
+        }
+    }
+
+    safeBag = sec_PKCS12CreateSafeBag(p12ctxt, SEC_OID_PKCS12_V1_CERT_BAG_ID, 
+                                      certBag);
+    if(!safeBag) {
+        goto loser;
+    }
+
+    /* add the friendly name and keyId attributes, if necessary */
+    if(nick.data) {
+        if(sec_PKCS12AddAttributeToBag(p12ctxt, safeBag, 
+                                       SEC_OID_PKCS9_FRIENDLY_NAME, &nick) 
+                                       != SECSuccess) {
+            goto loser;
+        }
+    }
+           
+    if(keyId) {
+        if(sec_PKCS12AddAttributeToBag(p12ctxt, safeBag, SEC_OID_PKCS9_LOCAL_KEY_ID,
+                                       keyId) != SECSuccess) {
+            goto loser;
+        }
+    }
+
+    /* append the cert safeBag */
+    if(nestedDest) {
+        rv = sec_pkcs12_append_bag_to_safe_contents(p12ctxt->arena, 
+                                          (sec_PKCS12SafeContents*)nestedDest, 
+                                           safeBag);
+    } else {
+        rv = sec_pkcs12_append_bag(p12ctxt, safe, safeBag);
+    }
+
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return SECSuccess;
+
+loser:
+    if(mark) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+    }
+
+    return SECFailure;
+}
+
+/* SEC_PKCS12AddKeyForCert
+ *      Extracts the key associated with a particular certificate and exports
+ *      it.
+ *
+ *      p12ctxt - the export context 
+ *      safe - the safeInfo to place the key in
+ *      nestedDest - the nested safeContents to place a key
+ *      cert - the certificate which the key belongs to
+ *      shroudKey - encrypt the private key for export.  This value should 
+ *              always be true.  lower level code will not allow the export
+ *              of unencrypted private keys.
+ *      algorithm - the algorithm with which to encrypt the private key
+ *      pwitem - the password to encrypt the private key with
+ *      keyId - the keyID attribute
+ *      nickName - the nickname attribute
+ */
+SECStatus
+SEC_PKCS12AddKeyForCert(SEC_PKCS12ExportContext *p12ctxt, SEC_PKCS12SafeInfo *safe, 
+                        void *nestedDest, CERTCertificate *cert,
+                        PRBool shroudKey, SECOidTag algorithm, SECItem *pwitem,
+                        SECItem *keyId, SECItem *nickName)
+{
+    void *mark;
+    void *keyItem;
+    SECOidTag keyType;
+    SECStatus rv = SECFailure;
+    SECItem nickname = {siBuffer,NULL,0}, uniPwitem = {siBuffer, NULL, 0};
+    sec_PKCS12SafeBag *returnBag;
+
+    if(!p12ctxt || !cert || !safe) {
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(p12ctxt->arena);
+
+    /* retrieve the key based upon the type that it is and 
+     * specify the type of safeBag to store the key in
+     */    
+    if(!shroudKey) {
+
+        /* extract the key unencrypted.  this will most likely go away */
+        SECKEYPrivateKeyInfo *pki = PK11_ExportPrivateKeyInfo(cert, 
+                                                              p12ctxt->wincx);
+        if(!pki) {
+            PORT_ArenaRelease(p12ctxt->arena, mark);
+            PORT_SetError(SEC_ERROR_PKCS12_UNABLE_TO_EXPORT_KEY);
+            return SECFailure;
+        }   
+        keyItem = PORT_ArenaZAlloc(p12ctxt->arena, sizeof(SECKEYPrivateKeyInfo));
+        if(!keyItem) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+        rv = SECKEY_CopyPrivateKeyInfo(p12ctxt->arena, 
+                                       (SECKEYPrivateKeyInfo *)keyItem, pki);
+        keyType = SEC_OID_PKCS12_V1_KEY_BAG_ID;
+        SECKEY_DestroyPrivateKeyInfo(pki, PR_TRUE);
+    } else {
+
+        /* extract the key encrypted */
+        SECKEYEncryptedPrivateKeyInfo *epki = NULL;
+        PK11SlotInfo *slot = NULL;
+
+        if(!sec_pkcs12_convert_item_to_unicode(p12ctxt->arena, &uniPwitem,
+                                 pwitem, PR_TRUE, PR_TRUE, PR_TRUE)) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+
+        /* we want to make sure to take the key out of the key slot */
+        if(PK11_IsInternal(p12ctxt->slot)) {
+            slot = PK11_GetInternalKeySlot();
+        } else {
+            slot = PK11_ReferenceSlot(p12ctxt->slot);
+        }
+
+        epki = PK11_ExportEncryptedPrivateKeyInfo(slot, algorithm, 
+                                            &uniPwitem, cert,
+                                            NSS_PBE_DEFAULT_ITERATION_COUNT,
+                                            p12ctxt->wincx);
+        PK11_FreeSlot(slot);
+        if(!epki) {
+            PORT_SetError(SEC_ERROR_PKCS12_UNABLE_TO_EXPORT_KEY);
+            goto loser;
+        }   
+        
+        keyItem = PORT_ArenaZAlloc(p12ctxt->arena, 
+                                  sizeof(SECKEYEncryptedPrivateKeyInfo));
+        if(!keyItem) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            goto loser;
+        }
+        rv = SECKEY_CopyEncryptedPrivateKeyInfo(p12ctxt->arena, 
+                                        (SECKEYEncryptedPrivateKeyInfo *)keyItem,
+                                        epki);
+        keyType = SEC_OID_PKCS12_V1_PKCS8_SHROUDED_KEY_BAG_ID;
+        SECKEY_DestroyEncryptedPrivateKeyInfo(epki, PR_TRUE);
+    }
+
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+        
+    /* if no nickname specified, let's see if the certificate has a 
+     * nickname.
+     */                                   
+    if(!nickName) {
+        if(cert->nickname) {
+            nickname.data = (unsigned char *)cert->nickname;
+            nickname.len = PORT_Strlen(cert->nickname);
+            nickName = &nickname;
+        }
+    }
+
+    /* create the safe bag and set any attributes */
+    returnBag = sec_PKCS12CreateSafeBag(p12ctxt, keyType, keyItem);
+    if(!returnBag) {
+        rv = SECFailure;
+        goto loser;
+    }
+
+    if(nickName) {
+        if(sec_PKCS12AddAttributeToBag(p12ctxt, returnBag, 
+                                       SEC_OID_PKCS9_FRIENDLY_NAME, nickName) 
+                                       != SECSuccess) {
+            goto loser;
+        }
+    }
+           
+    if(keyId) {
+        if(sec_PKCS12AddAttributeToBag(p12ctxt, returnBag, SEC_OID_PKCS9_LOCAL_KEY_ID,
+                                       keyId) != SECSuccess) {
+            goto loser;
+        }
+    }
+
+    if(nestedDest) {
+        rv = sec_pkcs12_append_bag_to_safe_contents(p12ctxt->arena,
+                                          (sec_PKCS12SafeContents*)nestedDest, 
+                                          returnBag);
+    } else {
+        rv = sec_pkcs12_append_bag(p12ctxt, safe, returnBag);
+    }
+
+loser:
+
+    if (rv != SECSuccess) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+    } else {
+        PORT_ArenaUnmark(p12ctxt->arena, mark);
+    }
+
+    return rv;
+}
+
+/* SEC_PKCS12AddCertOrChainAndKey
+ *      Add a certificate and key pair to be exported.
+ *
+ *      p12ctxt          - the export context 
+ *      certSafe         - the safeInfo where the cert is stored
+ *      certNestedDest   - the nested safeContents to store the cert
+ *      keySafe          - the safeInfo where the key is stored
+ *      keyNestedDest    - the nested safeContents to store the key
+ *      shroudKey        - extract the private key encrypted?
+ *      pwitem           - the password with which the key is encrypted
+ *      algorithm        - the algorithm with which the key is encrypted
+ *      includeCertChain - also add certs from chain to bag.
+ */
+SECStatus
+SEC_PKCS12AddCertOrChainAndKey(SEC_PKCS12ExportContext *p12ctxt, 
+                               void *certSafe, void *certNestedDest, 
+                               CERTCertificate *cert, CERTCertDBHandle *certDb,
+                               void *keySafe, void *keyNestedDest, 
+                               PRBool shroudKey, SECItem *pwitem, 
+                               SECOidTag algorithm, PRBool includeCertChain)
+{
+    SECStatus rv = SECFailure;
+    SGNDigestInfo *digest = NULL;
+    void *mark = NULL;
+
+    if(!p12ctxt || !certSafe || !keySafe || !cert) {
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(p12ctxt->arena);
+
+    /* generate the thumbprint of the cert to use as a keyId */
+    digest = sec_pkcs12_compute_thumbprint(&cert->derCert);
+    if(!digest) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        return SECFailure;
+    }
+
+    /* add the certificate */
+    rv = SEC_PKCS12AddCert(p12ctxt, (SEC_PKCS12SafeInfo*)certSafe, 
+                           (SEC_PKCS12SafeInfo*)certNestedDest, cert, certDb,
+                           &digest->digest, includeCertChain);
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+
+    /* add the key */
+    rv = SEC_PKCS12AddKeyForCert(p12ctxt, (SEC_PKCS12SafeInfo*)keySafe, 
+                                 keyNestedDest, cert, 
+                                 shroudKey, algorithm, pwitem, 
+                                 &digest->digest, NULL );
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+
+    SGN_DestroyDigestInfo(digest);
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return SECSuccess;
+
+loser:
+    SGN_DestroyDigestInfo(digest);
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    
+    return SECFailure; 
+}
+
+/* like SEC_PKCS12AddCertOrChainAndKey, but always adds cert chain */
+SECStatus
+SEC_PKCS12AddCertAndKey(SEC_PKCS12ExportContext *p12ctxt, 
+                        void *certSafe, void *certNestedDest, 
+                        CERTCertificate *cert, CERTCertDBHandle *certDb,
+                        void *keySafe, void *keyNestedDest, 
+                        PRBool shroudKey, SECItem *pwItem, SECOidTag algorithm)
+{
+    return SEC_PKCS12AddCertOrChainAndKey(p12ctxt, certSafe, certNestedDest,
+                cert, certDb, keySafe, keyNestedDest, shroudKey, pwItem, 
+                algorithm, PR_TRUE);
+}
+
+
+/* SEC_PKCS12CreateNestedSafeContents
+ *      Allows nesting of safe contents to be implemented.  No limit imposed on 
+ *      depth.  
+ *
+ *      p12ctxt - the export context 
+ *      baseSafe - the base safeInfo 
+ *      nestedDest - a parent safeContents (?)
+ */
+void *
+SEC_PKCS12CreateNestedSafeContents(SEC_PKCS12ExportContext *p12ctxt,
+                                   void *baseSafe, void *nestedDest)
+{
+    sec_PKCS12SafeContents *newSafe;
+    sec_PKCS12SafeBag *safeContentsBag;
+    void *mark;
+    SECStatus rv;
+
+    if(!p12ctxt || !baseSafe) {
+        return NULL;
+    }
+
+    mark = PORT_ArenaMark(p12ctxt->arena);
+
+    newSafe = sec_PKCS12CreateSafeContents(p12ctxt->arena);
+    if(!newSafe) {
+        PORT_ArenaRelease(p12ctxt->arena, mark);
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    /* create the safeContents safeBag */
+    safeContentsBag = sec_PKCS12CreateSafeBag(p12ctxt, 
+                                        SEC_OID_PKCS12_V1_SAFE_CONTENTS_BAG_ID,
+                                        newSafe);
+    if(!safeContentsBag) {
+        goto loser;
+    }
+
+    /* append the safeContents to the appropriate area */
+    if(nestedDest) {
+        rv = sec_pkcs12_append_bag_to_safe_contents(p12ctxt->arena, 
+                                           (sec_PKCS12SafeContents*)nestedDest,
+                                           safeContentsBag);
+    } else {
+        rv = sec_pkcs12_append_bag(p12ctxt, (SEC_PKCS12SafeInfo*)baseSafe, 
+                                   safeContentsBag);
+    }
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+
+    PORT_ArenaUnmark(p12ctxt->arena, mark);
+    return newSafe;
+
+loser:
+    PORT_ArenaRelease(p12ctxt->arena, mark);
+    return NULL;
+}
+
+/*********************************
+ * Encoding routines
+ *********************************/
+
+/* Clean up the resources allocated by a sec_PKCS12EncoderContext. */
+static void
+sec_pkcs12_encoder_destroy_context(sec_PKCS12EncoderContext *p12enc)
+{
+    if(p12enc) {
+        if(p12enc->outerA1ecx) {
+            SEC_ASN1EncoderFinish(p12enc->outerA1ecx);
+            p12enc->outerA1ecx = NULL;
+        }
+        if(p12enc->aSafeCinfo) {
+            SEC_PKCS7DestroyContentInfo(p12enc->aSafeCinfo);
+            p12enc->aSafeCinfo = NULL;
+        }
+        if(p12enc->middleP7ecx) {
+            SEC_PKCS7EncoderFinish(p12enc->middleP7ecx, p12enc->p12exp->pwfn,
+                                   p12enc->p12exp->pwfnarg);
+            p12enc->middleP7ecx = NULL;
+        }
+        if(p12enc->middleA1ecx) {
+            SEC_ASN1EncoderFinish(p12enc->middleA1ecx);
+            p12enc->middleA1ecx = NULL;
+        }
+        if(p12enc->hmacCx) {
+            PK11_DestroyContext(p12enc->hmacCx, PR_TRUE);
+            p12enc->hmacCx = NULL;
+        }
+    }
+}
+
+/* set up the encoder context based on information in the export context
+ * and return the newly allocated enocoder context.  A return of NULL 
+ * indicates an error occurred. 
+ */
+static sec_PKCS12EncoderContext *
+sec_pkcs12_encoder_start_context(SEC_PKCS12ExportContext *p12exp)
+{
+    sec_PKCS12EncoderContext *p12enc = NULL;
+    unsigned int i, nonEmptyCnt;
+    SECStatus rv;
+    SECItem ignore = {0};
+    void *mark;
+
+    if(!p12exp || !p12exp->safeInfos) {
+        return NULL;
+    }
+
+    /* check for any empty safes and skip them */
+    i = nonEmptyCnt = 0;
+    while(p12exp->safeInfos[i]) {
+        if(p12exp->safeInfos[i]->itemCount) {
+            nonEmptyCnt++;
+        }
+        i++;
+    }
+    if(nonEmptyCnt == 0) {
+        return NULL;
+    }
+    p12exp->authSafe.encodedSafes[nonEmptyCnt] = NULL;
+
+    /* allocate the encoder context */
+    mark = PORT_ArenaMark(p12exp->arena);
+    p12enc = PORT_ArenaZNew(p12exp->arena, sec_PKCS12EncoderContext);
+    if(!p12enc) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+
+    p12enc->arena = p12exp->arena;
+    p12enc->p12exp = p12exp;
+
+    /* set up the PFX version and information */
+    PORT_Memset(&p12enc->pfx, 0, sizeof(sec_PKCS12PFXItem));
+    if(!SEC_ASN1EncodeInteger(p12exp->arena, &(p12enc->pfx.version), 
+                              SEC_PKCS12_VERSION) ) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* set up the authenticated safe content info based on the 
+     * type of integrity being used.  this should be changed to
+     * enforce integrity mode, but will not be implemented until
+     * it is confirmed that integrity must be in place
+     */
+    if(p12exp->integrityEnabled && !p12exp->pwdIntegrity) {
+        SECStatus rv;
+
+        /* create public key integrity mode */
+        p12enc->aSafeCinfo = SEC_PKCS7CreateSignedData(
+                                p12exp->integrityInfo.pubkeyInfo.cert,
+                                certUsageEmailSigner,
+                                p12exp->integrityInfo.pubkeyInfo.certDb,
+                                p12exp->integrityInfo.pubkeyInfo.algorithm,
+                                NULL,
+                                p12exp->pwfn,
+                                p12exp->pwfnarg);
+        if(!p12enc->aSafeCinfo) {
+            goto loser;
+        }
+        if(SEC_PKCS7IncludeCertChain(p12enc->aSafeCinfo,NULL) != SECSuccess) {
+            goto loser;
+        }
+        rv = SEC_PKCS7AddSigningTime(p12enc->aSafeCinfo);
+        PORT_Assert(rv == SECSuccess);
+    } else {
+        p12enc->aSafeCinfo = SEC_PKCS7CreateData();
+
+        /* init password pased integrity mode */
+        if(p12exp->integrityEnabled) {
+            SECItem  pwd = {siBuffer,NULL, 0};
+            SECItem *salt = sec_pkcs12_generate_salt();
+            PK11SymKey *symKey;
+            SECItem *params;
+            CK_MECHANISM_TYPE integrityMechType;
+            CK_MECHANISM_TYPE hmacMechType;
+
+            /* zero out macData and set values */
+            PORT_Memset(&p12enc->mac, 0, sizeof(sec_PKCS12MacData));
+
+            if(!salt) {
+                PORT_SetError(SEC_ERROR_NO_MEMORY);
+                goto loser;
+            }
+            if(SECITEM_CopyItem(p12exp->arena, &(p12enc->mac.macSalt), salt) 
+                        != SECSuccess) {
+                /* XXX salt is leaked */
+                PORT_SetError(SEC_ERROR_NO_MEMORY);
+                goto loser;
+            }   
+            if (!SEC_ASN1EncodeInteger(p12exp->arena, &(p12enc->mac.iter),
+                                       NSS_PBE_DEFAULT_ITERATION_COUNT)) {
+                /* XXX salt is leaked */
+                goto loser;
+            }
+
+            /* generate HMAC key */
+            if(!sec_pkcs12_convert_item_to_unicode(NULL, &pwd, 
+                        p12exp->integrityInfo.pwdInfo.password, PR_TRUE, 
+                        PR_TRUE, PR_TRUE)) {
+                /* XXX salt is leaked */
+                goto loser;
+            }
+            /*
+             * This code only works with PKCS #12 Mac using PKCS #5 v1
+             * PBA keygens. PKCS #5 v2 support will require a change to
+             * the PKCS #12 spec.
+             */
+            params = PK11_CreatePBEParams(salt, &pwd,
+                                          NSS_PBE_DEFAULT_ITERATION_COUNT);
+            SECITEM_ZfreeItem(salt, PR_TRUE);
+            SECITEM_ZfreeItem(&pwd, PR_FALSE);
+
+            /* get the PBA Mechanism to generate the key */
+            switch (p12exp->integrityInfo.pwdInfo.algorithm) {
+            case SEC_OID_SHA1:
+                integrityMechType = CKM_PBA_SHA1_WITH_SHA1_HMAC; break;
+            case SEC_OID_MD5:
+                integrityMechType = CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN;  break;
+            case SEC_OID_MD2:
+                integrityMechType = CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN;  break;
+            default:
+                /* XXX params is leaked */
+                goto loser;
+            }
+
+            /* generate the key */
+            symKey = PK11_KeyGen(NULL, integrityMechType, params, 20, NULL);
+            PK11_DestroyPBEParams(params);
+            if(!symKey) {
+                goto loser;
+            }
+
+            /* initialize HMAC */
+            /* Get the HMAC mechanism from the hash OID */
+            hmacMechType=  sec_pkcs12_algtag_to_mech( 
+                                      p12exp->integrityInfo.pwdInfo.algorithm);
+
+            p12enc->hmacCx = PK11_CreateContextBySymKey( hmacMechType,
+                                                 CKA_SIGN, symKey, &ignore);
+
+            PK11_FreeSymKey(symKey);
+            if(!p12enc->hmacCx) {
+                PORT_SetError(SEC_ERROR_NO_MEMORY);
+                goto loser;
+            }
+            rv = PK11_DigestBegin(p12enc->hmacCx);
+            if (rv != SECSuccess)
+                goto loser;
+        }
+    }
+
+    if(!p12enc->aSafeCinfo) {
+        goto loser;
+    }
+
+    PORT_ArenaUnmark(p12exp->arena, mark);
+
+    return p12enc;
+
+loser:
+    sec_pkcs12_encoder_destroy_context(p12enc);
+    if (p12exp->arena != NULL)
+        PORT_ArenaRelease(p12exp->arena, mark);
+
+    return NULL;
+}
+
+/* The outermost ASN.1 encoder calls this function for output.
+** This function calls back to the library caller's output routine,
+** which typically writes to a PKCS12 file.
+ */
+static void
+sec_P12A1OutputCB_Outer(void *arg, const char *buf, unsigned long len,
+                       int depth, SEC_ASN1EncodingPart data_kind)
+{
+    struct sec_pkcs12_encoder_output *output;
+
+    output = (struct sec_pkcs12_encoder_output*)arg;
+    (* output->outputfn)(output->outputarg, buf, len);
+}
+
+/* The "middle" and "inner" ASN.1 encoders call this function to output. 
+** This function does HMACing, if appropriate, and then buffers the data.
+** The buffered data is eventually passed down to the underlying PKCS7 encoder.
+ */
+static void
+sec_P12A1OutputCB_HmacP7Update(void *arg, const char *buf,
+                               unsigned long        len, 
+                               int                  depth,
+                               SEC_ASN1EncodingPart data_kind)
+{
+    sec_pkcs12OutputBuffer *  bufcx = (sec_pkcs12OutputBuffer *)arg;
+
+    if(!buf || !len) 
+        return;
+
+    if (bufcx->hmacCx) {
+        PK11_DigestOp(bufcx->hmacCx, (unsigned char *)buf, len);
+    }
+
+    /* buffer */
+    if (bufcx->numBytes > 0) {
+        int toCopy;
+        if (len + bufcx->numBytes <= bufcx->bufBytes) {
+            memcpy(bufcx->buf + bufcx->numBytes, buf, len);
+            bufcx->numBytes += len;
+            if (bufcx->numBytes < bufcx->bufBytes) 
+                return;
+            SEC_PKCS7EncoderUpdate(bufcx->p7eCx, bufcx->buf, bufcx->bufBytes);
+            bufcx->numBytes = 0;
+            return;
+        } 
+        toCopy = bufcx->bufBytes - bufcx->numBytes;
+        memcpy(bufcx->buf + bufcx->numBytes, buf, toCopy);
+        SEC_PKCS7EncoderUpdate(bufcx->p7eCx, bufcx->buf, bufcx->bufBytes);
+        bufcx->numBytes = 0;
+        len -= toCopy;
+        buf += toCopy;
+    } 
+    /* buffer is presently empty */
+    if (len >= bufcx->bufBytes) {
+        /* Just pass it through */
+        SEC_PKCS7EncoderUpdate(bufcx->p7eCx, buf, len);
+    } else {
+        /* copy it all into the buffer, and return */
+        memcpy(bufcx->buf, buf, len);
+        bufcx->numBytes = len;
+    }
+}
+
+void
+sec_FlushPkcs12OutputBuffer( sec_pkcs12OutputBuffer *  bufcx)
+{
+    if (bufcx->numBytes > 0) {
+        SEC_PKCS7EncoderUpdate(bufcx->p7eCx, bufcx->buf, bufcx->numBytes);
+        bufcx->numBytes = 0;
+    }
+}
+
+/* Feeds the output of a PKCS7 encoder into the next outward ASN.1 encoder.
+** This function is used by both the inner and middle PCS7 encoders.
+*/
+static void
+sec_P12P7OutputCB_CallA1Update(void *arg, const char *buf, unsigned long len)
+{
+    SEC_ASN1EncoderContext *cx = (SEC_ASN1EncoderContext*)arg;
+
+    if (!buf || !len) 
+        return;
+
+    SEC_ASN1EncoderUpdate(cx, buf, len);
+}
+
+
+/* this function encodes content infos which are part of the
+ * sequence of content infos labeled AuthenticatedSafes 
+ */
+static SECStatus 
+sec_pkcs12_encoder_asafe_process(sec_PKCS12EncoderContext *p12ecx)
+{
+    SEC_PKCS7EncoderContext *innerP7ecx;
+    SEC_PKCS7ContentInfo    *cinfo;
+    PK11SymKey              *bulkKey      = NULL;
+    SEC_ASN1EncoderContext  *innerA1ecx   = NULL;
+    SECStatus                rv           = SECSuccess;
+
+    if(p12ecx->currentSafe < p12ecx->p12exp->authSafe.safeCount) {
+        SEC_PKCS12SafeInfo *safeInfo;
+        SECOidTag cinfoType;
+
+        safeInfo = p12ecx->p12exp->safeInfos[p12ecx->currentSafe];
+
+        /* skip empty safes */
+        if(safeInfo->itemCount == 0) {
+            return SECSuccess;
+        }
+
+        cinfo = safeInfo->cinfo;
+        cinfoType = SEC_PKCS7ContentType(cinfo);
+
+        /* determine the safe type and set the appropriate argument */
+        switch(cinfoType) {
+            case SEC_OID_PKCS7_DATA:
+            case SEC_OID_PKCS7_ENVELOPED_DATA:
+                break;
+            case SEC_OID_PKCS7_ENCRYPTED_DATA:
+                bulkKey = safeInfo->encryptionKey;
+                PK11_SetSymKeyUserData(bulkKey, &safeInfo->pwitem, NULL);
+                break;
+            default:
+                return SECFailure;
+
+        }
+
+        /* start the PKCS7 encoder */
+        innerP7ecx = SEC_PKCS7EncoderStart(cinfo, 
+                                  sec_P12P7OutputCB_CallA1Update,
+                                  p12ecx->middleA1ecx, bulkKey);
+        if(!innerP7ecx) {
+            goto loser;
+        }
+
+        /* encode safe contents */
+        p12ecx->innerBuf.p7eCx    = innerP7ecx;
+        p12ecx->innerBuf.hmacCx   = NULL;
+        p12ecx->innerBuf.numBytes = 0;
+        p12ecx->innerBuf.bufBytes = sizeof p12ecx->innerBuf.buf;
+
+        innerA1ecx = SEC_ASN1EncoderStart(safeInfo->safe, 
+                                   sec_PKCS12SafeContentsTemplate,
+                                   sec_P12A1OutputCB_HmacP7Update, 
+                                   &p12ecx->innerBuf);
+        if(!innerA1ecx) {
+            goto loser;
+        }   
+        rv = SEC_ASN1EncoderUpdate(innerA1ecx, NULL, 0);
+        SEC_ASN1EncoderFinish(innerA1ecx);
+        sec_FlushPkcs12OutputBuffer( &p12ecx->innerBuf);
+        innerA1ecx = NULL;
+        if(rv != SECSuccess) {
+            goto loser;
+        }
+
+
+        /* finish up safe content info */
+        rv = SEC_PKCS7EncoderFinish(innerP7ecx, p12ecx->p12exp->pwfn, 
+                                    p12ecx->p12exp->pwfnarg);
+    }
+    memset(&p12ecx->innerBuf, 0, sizeof p12ecx->innerBuf);
+    return SECSuccess;
+
+loser:
+    if(innerP7ecx) {
+        SEC_PKCS7EncoderFinish(innerP7ecx, p12ecx->p12exp->pwfn, 
+                               p12ecx->p12exp->pwfnarg);
+    }
+
+    if(innerA1ecx) {
+        SEC_ASN1EncoderFinish(innerA1ecx);
+    }
+    memset(&p12ecx->innerBuf, 0, sizeof p12ecx->innerBuf);
+    return SECFailure;
+}
+
+/* finish the HMAC and encode the macData so that it can be
+ * encoded.
+ */
+static SECStatus
+sec_Pkcs12FinishMac(sec_PKCS12EncoderContext *p12ecx)
+{
+    SECItem hmac = { siBuffer, NULL, 0 };
+    SECStatus rv;
+    SGNDigestInfo *di = NULL;
+    void *dummy;
+
+    if(!p12ecx) {
+        return SECFailure;
+    }
+
+    /* make sure we are using password integrity mode */
+    if(!p12ecx->p12exp->integrityEnabled) {
+        return SECSuccess;
+    }
+
+    if(!p12ecx->p12exp->pwdIntegrity) {
+        return SECSuccess;
+    }
+
+    /* finish the hmac */
+    hmac.data = (unsigned char *)PORT_ZAlloc(SHA1_LENGTH);
+    if(!hmac.data) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return SECFailure;
+    }
+
+    rv = PK11_DigestFinal(p12ecx->hmacCx, hmac.data, &hmac.len, SHA1_LENGTH);
+
+    if(rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* create the digest info */
+    di = SGN_CreateDigestInfo(p12ecx->p12exp->integrityInfo.pwdInfo.algorithm,
+                              hmac.data, hmac.len);
+    if(!di) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        rv = SECFailure;
+        goto loser;
+    }
+
+    rv = SGN_CopyDigestInfo(p12ecx->arena, &p12ecx->mac.safeMac, di);
+    if(rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    /* encode the mac data */
+    dummy = SEC_ASN1EncodeItem(p12ecx->arena, &p12ecx->pfx.encodedMacData, 
+                            &p12ecx->mac, sec_PKCS12MacDataTemplate);
+    if(!dummy) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        rv = SECFailure;
+    }
+
+loser:
+    if(di) {
+        SGN_DestroyDigestInfo(di);
+    }
+    if(hmac.data) {
+        SECITEM_ZfreeItem(&hmac, PR_FALSE);
+    }
+    PK11_DestroyContext(p12ecx->hmacCx, PR_TRUE);
+    p12ecx->hmacCx = NULL;
+
+    return rv;
+}
+
+/* pfx notify function for ASN1 encoder.  
+ * We want to stop encoding once we reach the authenticated safe.  
+ * At that point, the encoder will be updated via streaming
+ * as the authenticated safe is  encoded. 
+ */
+static void
+sec_pkcs12_encoder_pfx_notify(void *arg, PRBool before, void *dest, int real_depth)
+{
+    sec_PKCS12EncoderContext *p12ecx;
+
+    if(!before) {
+        return;
+    }
+
+    /* look for authenticated safe */
+    p12ecx = (sec_PKCS12EncoderContext*)arg;
+    if(dest != &p12ecx->pfx.encodedAuthSafe) {
+        return;
+    }
+
+    SEC_ASN1EncoderSetTakeFromBuf(p12ecx->outerA1ecx);
+    SEC_ASN1EncoderSetStreaming(p12ecx->outerA1ecx);
+    SEC_ASN1EncoderClearNotifyProc(p12ecx->outerA1ecx);
+}
+
+/* SEC_PKCS12Encode
+ *      Encodes the PFX item and returns it to the output function, via
+ *      callback.  the output function must be capable of multiple updates.
+ *      
+ *      p12exp - the export context 
+ *      output - the output function callback, will be called more than once,
+ *               must be able to accept streaming data.
+ *      outputarg - argument for the output callback.
+ */
+SECStatus
+SEC_PKCS12Encode(SEC_PKCS12ExportContext *p12exp, 
+                 SEC_PKCS12EncoderOutputCallback output, void *outputarg)
+{
+    sec_PKCS12EncoderContext *p12enc;
+    struct sec_pkcs12_encoder_output outInfo;
+    SECStatus rv;
+
+    if(!p12exp || !output) {
+        return SECFailure;
+    }
+
+    /* get the encoder context */
+    p12enc = sec_pkcs12_encoder_start_context(p12exp);
+    if(!p12enc) {
+        return SECFailure;
+    }
+
+    outInfo.outputfn = output;
+    outInfo.outputarg = outputarg;
+
+    /* set up PFX encoder, the "outer" encoder.  Set it for streaming */
+    p12enc->outerA1ecx = SEC_ASN1EncoderStart(&p12enc->pfx, 
+                                       sec_PKCS12PFXItemTemplate,
+                                       sec_P12A1OutputCB_Outer, 
+                                       &outInfo);
+    if(!p12enc->outerA1ecx) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        rv = SECFailure;
+        goto loser;
+    }
+    SEC_ASN1EncoderSetStreaming(p12enc->outerA1ecx);
+    SEC_ASN1EncoderSetNotifyProc(p12enc->outerA1ecx, 
+                                 sec_pkcs12_encoder_pfx_notify, p12enc);
+    rv = SEC_ASN1EncoderUpdate(p12enc->outerA1ecx, NULL, 0);
+    if(rv != SECSuccess) {
+        rv = SECFailure;
+        goto loser;
+    }
+
+    /* set up asafe cinfo - the output of the encoder feeds the PFX encoder */
+    p12enc->middleP7ecx = SEC_PKCS7EncoderStart(p12enc->aSafeCinfo, 
+                                       sec_P12P7OutputCB_CallA1Update,
+                                       p12enc->outerA1ecx, NULL);
+    if(!p12enc->middleP7ecx) {
+        rv = SECFailure;
+        goto loser;
+    }
+
+    /* encode asafe */
+    p12enc->middleBuf.p7eCx    = p12enc->middleP7ecx;
+    p12enc->middleBuf.hmacCx   = NULL;
+    p12enc->middleBuf.numBytes = 0;
+    p12enc->middleBuf.bufBytes = sizeof p12enc->middleBuf.buf;
+
+    /* Setup the "inner ASN.1 encoder for Authenticated Safes.  */
+    if(p12enc->p12exp->integrityEnabled && 
+       p12enc->p12exp->pwdIntegrity) {
+        p12enc->middleBuf.hmacCx = p12enc->hmacCx;
+    }
+    p12enc->middleA1ecx = SEC_ASN1EncoderStart(&p12enc->p12exp->authSafe,
+                            sec_PKCS12AuthenticatedSafeTemplate,
+                            sec_P12A1OutputCB_HmacP7Update,
+                            &p12enc->middleBuf);
+    if(!p12enc->middleA1ecx) {
+        rv = SECFailure;
+        goto loser;
+    }
+    SEC_ASN1EncoderSetStreaming(p12enc->middleA1ecx);
+    SEC_ASN1EncoderSetTakeFromBuf(p12enc->middleA1ecx); 
+        
+    /* encode each of the safes */                       
+    while(p12enc->currentSafe != p12enc->p12exp->safeInfoCount) {
+        sec_pkcs12_encoder_asafe_process(p12enc);
+        p12enc->currentSafe++;
+    }
+    SEC_ASN1EncoderClearTakeFromBuf(p12enc->middleA1ecx);
+    SEC_ASN1EncoderClearStreaming(p12enc->middleA1ecx);
+    SEC_ASN1EncoderUpdate(p12enc->middleA1ecx, NULL, 0);
+    SEC_ASN1EncoderFinish(p12enc->middleA1ecx);
+    p12enc->middleA1ecx = NULL;
+
+    sec_FlushPkcs12OutputBuffer( &p12enc->middleBuf);
+
+    /* finish the encoding of the authenticated safes */
+    rv = SEC_PKCS7EncoderFinish(p12enc->middleP7ecx, p12exp->pwfn, 
+                                p12exp->pwfnarg);
+    p12enc->middleP7ecx = NULL;
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+
+    SEC_ASN1EncoderClearTakeFromBuf(p12enc->outerA1ecx);
+    SEC_ASN1EncoderClearStreaming(p12enc->outerA1ecx);
+
+    /* update the mac, if necessary */
+    rv = sec_Pkcs12FinishMac(p12enc);
+    if(rv != SECSuccess) {
+        goto loser;
+    }
+   
+    /* finish encoding the pfx */ 
+    rv = SEC_ASN1EncoderUpdate(p12enc->outerA1ecx, NULL, 0);
+
+    SEC_ASN1EncoderFinish(p12enc->outerA1ecx);
+    p12enc->outerA1ecx = NULL;
+
+loser:
+    sec_pkcs12_encoder_destroy_context(p12enc);
+    return rv;
+}
+
+void
+SEC_PKCS12DestroyExportContext(SEC_PKCS12ExportContext *p12ecx)
+{
+    int i = 0;
+
+    if(!p12ecx) {
+        return;
+    }
+
+    if(p12ecx->safeInfos) {
+        i = 0;
+        while(p12ecx->safeInfos[i] != NULL) {
+            if(p12ecx->safeInfos[i]->encryptionKey) {
+                PK11_FreeSymKey(p12ecx->safeInfos[i]->encryptionKey);
+            }
+            if(p12ecx->safeInfos[i]->cinfo) {
+                SEC_PKCS7DestroyContentInfo(p12ecx->safeInfos[i]->cinfo);
+            }
+            i++;
+        }
+    }
+
+    PK11_FreeSlot(p12ecx->slot);
+
+    PORT_FreeArena(p12ecx->arena, PR_TRUE);
+}