cmslocal.h (13875B)
1 /* This Source Code Form is subject to the terms of the Mozilla Public 2 * License, v. 2.0. If a copy of the MPL was not distributed with this 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 4 5 /* 6 * Support routines for CMS implementation, none of which are exported. 7 * 8 * Do not export this file! If something in here is really needed outside 9 * of smime code, first try to add a CMS interface which will do it for 10 * you. If that has a problem, then just move out what you need, changing 11 * its name as appropriate! 12 */ 13 14 #ifndef _CMSLOCAL_H_ 15 #define _CMSLOCAL_H_ 16 17 #include "cms.h" 18 #include "cmsreclist.h" 19 #include "secasn1t.h" 20 21 extern const SEC_ASN1Template NSSCMSContentInfoTemplate[]; 22 23 struct NSSCMSContentInfoPrivateStr { 24 NSSCMSCipherContext *ciphcx; 25 NSSCMSDigestContext *digcx; 26 PRBool dontStream; 27 }; 28 29 /************************************************************************/ 30 SEC_BEGIN_PROTOS 31 32 /* 33 * private content Info stuff 34 */ 35 36 /* initialize the private content info field. If this returns 37 * SECSuccess, the cinfo->private field is safe to dereference. 38 */ 39 SECStatus NSS_CMSContentInfo_Private_Init(NSSCMSContentInfo *cinfo); 40 41 /*********************************************************************** 42 * cmscipher.c - en/decryption routines 43 ***********************************************************************/ 44 45 /* 46 * NSS_CMSCipherContext_StartDecrypt - create a cipher context to do decryption 47 * based on the given bulk * encryption key and algorithm identifier (which may include an iv). 48 */ 49 extern NSSCMSCipherContext * 50 NSS_CMSCipherContext_StartDecrypt(PK11SymKey *key, SECAlgorithmID *algid); 51 52 /* 53 * NSS_CMSCipherContext_StartEncrypt - create a cipher object to do encryption, 54 * based on the given bulk encryption key and algorithm tag. Fill in the algorithm 55 * identifier (which may include an iv) appropriately. 56 */ 57 extern NSSCMSCipherContext * 58 NSS_CMSCipherContext_StartEncrypt(PLArenaPool *poolp, PK11SymKey *key, SECAlgorithmID *algid); 59 60 extern void 61 NSS_CMSCipherContext_Destroy(NSSCMSCipherContext *cc); 62 63 /* 64 * NSS_CMSCipherContext_DecryptLength - find the output length of the next call to decrypt. 65 * 66 * cc - the cipher context 67 * input_len - number of bytes used as input 68 * final - true if this is the final chunk of data 69 * 70 * Result can be used to perform memory allocations. Note that the amount 71 * is exactly accurate only when not doing a block cipher or when final 72 * is false, otherwise it is an upper bound on the amount because until 73 * we see the data we do not know how many padding bytes there are 74 * (always between 1 and bsize). 75 */ 76 extern unsigned int 77 NSS_CMSCipherContext_DecryptLength(NSSCMSCipherContext *cc, unsigned int input_len, PRBool final); 78 79 /* 80 * NSS_CMSCipherContext_EncryptLength - find the output length of the next call to encrypt. 81 * 82 * cc - the cipher context 83 * input_len - number of bytes used as input 84 * final - true if this is the final chunk of data 85 * 86 * Result can be used to perform memory allocations. 87 */ 88 extern unsigned int 89 NSS_CMSCipherContext_EncryptLength(NSSCMSCipherContext *cc, unsigned int input_len, PRBool final); 90 91 /* 92 * NSS_CMSCipherContext_Decrypt - do the decryption 93 * 94 * cc - the cipher context 95 * output - buffer for decrypted result bytes 96 * output_len_p - number of bytes in output 97 * max_output_len - upper bound on bytes to put into output 98 * input - pointer to input bytes 99 * input_len - number of input bytes 100 * final - true if this is the final chunk of data 101 * 102 * Decrypts a given length of input buffer (starting at "input" and 103 * containing "input_len" bytes), placing the decrypted bytes in 104 * "output" and storing the output length in "*output_len_p". 105 * "cc" is the return value from NSS_CMSCipher_StartDecrypt. 106 * When "final" is true, this is the last of the data to be decrypted. 107 */ 108 extern SECStatus 109 NSS_CMSCipherContext_Decrypt(NSSCMSCipherContext *cc, unsigned char *output, 110 unsigned int *output_len_p, unsigned int max_output_len, 111 const unsigned char *input, unsigned int input_len, 112 PRBool final); 113 114 /* 115 * NSS_CMSCipherContext_Encrypt - do the encryption 116 * 117 * cc - the cipher context 118 * output - buffer for decrypted result bytes 119 * output_len_p - number of bytes in output 120 * max_output_len - upper bound on bytes to put into output 121 * input - pointer to input bytes 122 * input_len - number of input bytes 123 * final - true if this is the final chunk of data 124 * 125 * Encrypts a given length of input buffer (starting at "input" and 126 * containing "input_len" bytes), placing the encrypted bytes in 127 * "output" and storing the output length in "*output_len_p". 128 * "cc" is the return value from NSS_CMSCipher_StartEncrypt. 129 * When "final" is true, this is the last of the data to be encrypted. 130 */ 131 extern SECStatus 132 NSS_CMSCipherContext_Encrypt(NSSCMSCipherContext *cc, unsigned char *output, 133 unsigned int *output_len_p, unsigned int max_output_len, 134 const unsigned char *input, unsigned int input_len, 135 PRBool final); 136 137 /************************************************************************ 138 * cmspubkey.c - public key operations 139 ************************************************************************/ 140 141 /* 142 * NSS_CMSUtil_EncryptSymKey_RSA - wrap a symmetric key with RSA 143 * 144 * this function takes a symmetric key and encrypts it using an RSA public key 145 * according to PKCS#1 and RFC2633 (S/MIME) 146 */ 147 extern SECStatus 148 NSS_CMSUtil_EncryptSymKey_RSA(PLArenaPool *poolp, CERTCertificate *cert, 149 PK11SymKey *key, 150 SECItem *encKey); 151 152 extern SECStatus 153 NSS_CMSUtil_EncryptSymKey_RSAPubKey(PLArenaPool *poolp, 154 SECKEYPublicKey *publickey, 155 PK11SymKey *bulkkey, SECItem *encKey); 156 157 /* 158 * NSS_CMSUtil_DecryptSymKey_RSA - unwrap a RSA-wrapped symmetric key 159 * 160 * this function takes an RSA-wrapped symmetric key and unwraps it, returning a symmetric 161 * key handle. Please note that the actual unwrapped key data may not be allowed to leave 162 * a hardware token... 163 */ 164 extern PK11SymKey * 165 NSS_CMSUtil_DecryptSymKey_RSA(SECKEYPrivateKey *privkey, SECItem *encKey, SECOidTag bulkalgtag); 166 167 /* 168 * NSS_CMSUtil_DecryptSymKey_RSA_OAEP is the same as NSS_CMSUtil_DecryptSymKey_RSA, except that 169 * it works with a symmetric key that was wrapped using RSA with OAEP padding rather than PKCS #1 170 * Version 1.5 padding. 171 */ 172 extern PK11SymKey * 173 NSS_CMSUtil_DecryptSymKey_RSA_OAEP(SECKEYPrivateKey *privkey, SECItem *parameters, SECItem *encKey, SECOidTag bulkalgtag); 174 175 extern SECStatus 176 NSS_CMSUtil_EncryptSymKey_ESECDH(PLArenaPool *poolp, CERTCertificate *cert, PK11SymKey *key, 177 SECItem *encKey, PRBool genUkm, SECItem *ukm, 178 SECAlgorithmID *keyEncAlg, SECItem *originatorPubKey, void *wincx); 179 180 PK11SymKey * 181 NSS_CMSUtil_DecryptSymKey_ECDH(SECKEYPrivateKey *privkey, SECItem *encKey, 182 SECAlgorithmID *keyEncAlg, SECOidTag bulkalgtag, 183 SECItem *ukm, NSSCMSOriginatorIdentifierOrKey *oiok, 184 void *wincx); 185 186 /************************************************************************ 187 * cmsreclist.c - recipient list stuff 188 ************************************************************************/ 189 extern NSSCMSRecipient **nss_cms_recipient_list_create(NSSCMSRecipientInfo **recipientinfos); 190 extern void nss_cms_recipient_list_destroy(NSSCMSRecipient **recipient_list); 191 extern NSSCMSRecipientEncryptedKey *NSS_CMSRecipientEncryptedKey_Create(PLArenaPool *poolp); 192 193 /************************************************************************ 194 * cmsarray.c - misc array functions 195 ************************************************************************/ 196 /* 197 * NSS_CMSArray_Alloc - allocate an array in an arena 198 */ 199 extern void ** 200 NSS_CMSArray_Alloc(PLArenaPool *poolp, int n); 201 202 /* 203 * NSS_CMSArray_Add - add an element to the end of an array 204 */ 205 extern SECStatus 206 NSS_CMSArray_Add(PLArenaPool *poolp, void ***array, void *obj); 207 208 /* 209 * NSS_CMSArray_IsEmpty - check if array is empty 210 */ 211 extern PRBool 212 NSS_CMSArray_IsEmpty(void **array); 213 214 /* 215 * NSS_CMSArray_Count - count number of elements in array 216 */ 217 extern int 218 NSS_CMSArray_Count(void **array); 219 220 /* 221 * NSS_CMSArray_Sort - sort an array ascending, in place 222 * 223 * If "secondary" is not NULL, the same reordering gets applied to it. 224 * If "tertiary" is not NULL, the same reordering gets applied to it. 225 * "compare" is a function that returns 226 * < 0 when the first element is less than the second 227 * = 0 when the first element is equal to the second 228 * > 0 when the first element is greater than the second 229 */ 230 extern void 231 NSS_CMSArray_Sort(void **primary, int (*compare)(void *, void *), void **secondary, void **tertiary); 232 233 /************************************************************************ 234 * cmsattr.c - misc attribute functions 235 ************************************************************************/ 236 /* 237 * NSS_CMSAttribute_Create - create an attribute 238 * 239 * if value is NULL, the attribute won't have a value. It can be added later 240 * with NSS_CMSAttribute_AddValue. 241 */ 242 extern NSSCMSAttribute * 243 NSS_CMSAttribute_Create(PLArenaPool *poolp, SECOidTag oidtag, SECItem *value, PRBool encoded); 244 245 /* 246 * NSS_CMSAttribute_AddValue - add another value to an attribute 247 */ 248 extern SECStatus 249 NSS_CMSAttribute_AddValue(PLArenaPool *poolp, NSSCMSAttribute *attr, SECItem *value); 250 251 /* 252 * NSS_CMSAttribute_GetType - return the OID tag 253 */ 254 extern SECOidTag 255 NSS_CMSAttribute_GetType(NSSCMSAttribute *attr); 256 257 /* 258 * NSS_CMSAttribute_GetValue - return the first attribute value 259 * 260 * We do some sanity checking first: 261 * - Multiple values are *not* expected. 262 * - Empty values are *not* expected. 263 */ 264 extern SECItem * 265 NSS_CMSAttribute_GetValue(NSSCMSAttribute *attr); 266 267 /* 268 * NSS_CMSAttribute_CompareValue - compare the attribute's first value against data 269 */ 270 extern PRBool 271 NSS_CMSAttribute_CompareValue(NSSCMSAttribute *attr, SECItem *av); 272 273 /* 274 * NSS_CMSAttributeArray_Encode - encode an Attribute array as SET OF Attributes 275 * 276 * If you are wondering why this routine does not reorder the attributes 277 * first, and might be tempted to make it do so, see the comment by the 278 * call to ReorderAttributes in cmsencode.c. (Or, see who else calls this 279 * and think long and hard about the implications of making it always 280 * do the reordering.) 281 */ 282 extern SECItem * 283 NSS_CMSAttributeArray_Encode(PLArenaPool *poolp, NSSCMSAttribute ***attrs, SECItem *dest); 284 285 /* 286 * NSS_CMSAttributeArray_Reorder - sort attribute array by attribute's DER encoding 287 * 288 * make sure that the order of the attributes guarantees valid DER (which must be 289 * in lexigraphically ascending order for a SET OF); if reordering is necessary it 290 * will be done in place (in attrs). 291 */ 292 extern SECStatus 293 NSS_CMSAttributeArray_Reorder(NSSCMSAttribute **attrs); 294 295 /* 296 * NSS_CMSAttributeArray_FindAttrByOidTag - look through a set of attributes and 297 * find one that matches the specified object ID. 298 * 299 * If "only" is true, then make sure that there is not more than one attribute 300 * of the same type. Otherwise, just return the first one found. (XXX Does 301 * anybody really want that first-found behavior? It was like that when I found it...) 302 */ 303 extern NSSCMSAttribute * 304 NSS_CMSAttributeArray_FindAttrByOidTag(NSSCMSAttribute **attrs, SECOidTag oidtag, PRBool only); 305 306 /* 307 * NSS_CMSAttributeArray_AddAttr - add an attribute to an 308 * array of attributes. 309 */ 310 extern SECStatus 311 NSS_CMSAttributeArray_AddAttr(PLArenaPool *poolp, NSSCMSAttribute ***attrs, NSSCMSAttribute *attr); 312 313 /* 314 * NSS_CMSAttributeArray_SetAttr - set an attribute's value in a set of attributes 315 */ 316 extern SECStatus 317 NSS_CMSAttributeArray_SetAttr(PLArenaPool *poolp, NSSCMSAttribute ***attrs, 318 SECOidTag type, SECItem *value, PRBool encoded); 319 320 /* 321 * NSS_CMSSignedData_AddTempCertificate - add temporary certificate references. 322 * They may be needed for signature verification on the data, for example. 323 */ 324 extern SECStatus 325 NSS_CMSSignedData_AddTempCertificate(NSSCMSSignedData *sigd, CERTCertificate *cert); 326 327 /* 328 * local function to handle compatibility issues 329 * by mapping a signature algorithm back to a digest. 330 */ 331 SECOidTag NSS_CMSUtil_MapSignAlgs(SECOidTag signAlg); 332 333 /************************************************************************/ 334 335 /* 336 * local functions to handle user defined S/MIME content types 337 */ 338 339 PRBool NSS_CMSType_IsWrapper(SECOidTag type); 340 PRBool NSS_CMSType_IsData(SECOidTag type); 341 size_t NSS_CMSType_GetContentSize(SECOidTag type); 342 const SEC_ASN1Template *NSS_CMSType_GetTemplate(SECOidTag type); 343 344 void NSS_CMSGenericWrapperData_Destroy(SECOidTag type, 345 NSSCMSGenericWrapperData *gd); 346 SECStatus NSS_CMSGenericWrapperData_Decode_BeforeData(SECOidTag type, 347 NSSCMSGenericWrapperData *gd); 348 SECStatus NSS_CMSGenericWrapperData_Decode_AfterData(SECOidTag type, 349 NSSCMSGenericWrapperData *gd); 350 SECStatus NSS_CMSGenericWrapperData_Decode_AfterEnd(SECOidTag type, 351 NSSCMSGenericWrapperData *gd); 352 SECStatus NSS_CMSGenericWrapperData_Encode_BeforeStart(SECOidTag type, 353 NSSCMSGenericWrapperData *gd); 354 SECStatus NSS_CMSGenericWrapperData_Encode_BeforeData(SECOidTag type, 355 NSSCMSGenericWrapperData *gd); 356 SECStatus NSS_CMSGenericWrapperData_Encode_AfterData(SECOidTag type, 357 NSSCMSGenericWrapperData *gd); 358 359 SEC_END_PROTOS 360 361 #endif /* _CMSLOCAL_H_ */