![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to cryptlib.h CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Synchronet] / sbbs / include / cryptlib|
Return to cryptlib.h CVS log | Up to [Synchronet] / sbbs / include / cryptlib |
1.1 root 1: /****************************************************************************
2: * *
3: * cryptlib Interface *
1.1.1.2 ! root 4: * Copyright Peter Gutmann 1992-2007 *
1.1 root 5: * *
6: ****************************************************************************/
7:
8: #ifndef _CRYPTLIB_DEFINED
9:
10: #define _CRYPTLIB_DEFINED
11:
1.1.1.2 ! root 12: /* The current cryptlib version: 3.3.1.0 */
1.1 root 13:
1.1.1.2 ! root 14: #define CRYPTLIB_VERSION 3310
1.1 root 15:
16: /* Fixup for Windows support. We need to include windows.h for various types
17: and prototypes needed for DLL's. In addition wincrypt.h defines some
18: values with the same names as cryptlib ones, so we need to check for this
19: and issue a warning not to mix cryptlib with CryptoAPI (that's like taking
20: a bank vault and making one side out of papier mache).
21:
22: A second, less likely condition can occur when wincrypt.h is included
23: after cryptlib.h, which shouldn't happen if developers follow the
24: convention of including local headers after system headers, but can occur
25: if they ignore this convention. The NOCRYPT doesn't fix this since
26: wincrypt.h can be pulled in indirectly and unconditionally, for example
27: via winldap.h -> schnlsp.h -> schannel.h -> wincrypt.h. To fix this, we
28: create a redundant define for CRYPT_MODE_ECB which produces a compile
29: error if wincrypt.h is included after cryptlib.h. Since thie will
30: conflict with the enum, we have to place it after the CRYPT_MODE_xxx
31: enums */
32:
33: #if ( defined( _WINDOWS ) || defined( WIN32 ) || defined( _WIN32 ) || \
34: defined( __WIN32__ ) || defined( _WIN32_WCE ) ) && \
35: !defined( _SCCTK ) && !defined( _CVI_ )
36: #define WIN32_LEAN_AND_MEAN /* Skip RPC, OLE, Multimedia, etc */
37: #define NOCRYPT /* Disable include of wincrypt.h */
38: #include <windows.h>
39:
40: /* Catch use of CryptoAPI and cryptlib at the same time */
41: #if defined( CRYPT_MODE_ECB )
42: #error "cryptlib.h and wincrypt.h can't both be used at the same time due to conflicting type names"
43: #endif /* Clash with wincrypt.h defines */
44: #endif /* Windows other than a cross-development environment */
45:
46: /* Machine-dependant types to allow use in special library types such as
47: DLL's. Under Win32 and BeOS we need to use the dllimport and dllexport
48: directives for the DLL/shared-lib version so we define the type used for
49: functions depending on whether we're being included via the cryptlib-
50: internal crypt.h or not */
51:
52: #if ( defined( WIN32 ) || defined( _WIN32 ) || defined( __WIN32__ ) || \
53: defined( _WIN32_WCE ) ) && !( defined( STATIC_LIB ) || defined( _SCCTK ) )
54: #define C_PTR * /* General pointer */
55: #if defined( _WIN32_WCE )
56: /* Rather than relying on _UNICODE being defined (which would cause
57: problems if cryptlib is built with char * but the calling app is built
58: with wchar_t *), we always use the default native char type, which is
59: ASCII (or at least 8-bit) under Win32 and Unicode under WinCE */
60: #define C_CHR wchar_t
61: #else
62: #define C_CHR char
63: #endif /* WinCE vs. Win32 */
64: #define C_STR C_CHR *
65: #if defined( __BORLANDC__ ) && ( __BORLANDC__ < 0x500 )
66: #ifdef _CRYPT_DEFINED
67: #define C_RET int _export _stdcall /* BC++ DLL export ret.val.*/
68: #else
69: #define C_RET int _import _stdcall /* BC++ DLL import ret.val.*/
70: #endif /* CRYPT_DEFINED */
71: #else
72: #ifdef _CRYPT_DEFINED
73: #define C_RET __declspec( dllexport ) int __stdcall /* DLL export ret.val.*/
74: #else
75: #define C_RET __declspec( dllimport ) int __stdcall /* DLL import ret.val.*/
76: #endif /* CRYPT_DEFINED */
77: #endif /* BC++ vs.VC++ DLL functions */
78: #elif defined( _WINDOWS ) && !defined( STATIC_LIB )
79: #define C_PTR FAR * /* DLL pointer */
80: #define C_CHR char
81: #define C_STR C_CHR FAR * /* DLL string pointer */
82: #define C_RET int FAR PASCAL _export /* DLL return value */
83: #elif defined( __BEOS__ )
84: /* #include <BeBuild.h> // _EXPORT/_IMPORT defines */
85: #define C_PTR *
86: #define C_CHR char
87: #define C_STR C_CHR *
88: #ifdef _STATIC_LINKING
89: #define C_RET int
90: #else
91: #ifdef _CRYPT_DEFINED
92: #define C_RET __declspec( dllexport ) int /* Shared lib export ret.val.*/
93: #else
94: #define C_RET __declspec( dllimport ) int /* Shared lib import ret.val.*/
95: #endif /* CRYPT_DEFINED */
96: #endif /* Static vs. shared lib */
97: #elif defined( __SYMBIAN__ )
98: #ifdef _CRYPT_DEFINED
99: #define C_RET EXPORT_C /* DLL export ret.val.*/
100: #else
101: #define C_RET IMPORT_C /* DLL import ret.val.*/
102: #endif /* CRYPT_DEFINED */
103: #else
104: #define C_PTR *
105: #define C_CHR char
106: #define C_STR C_CHR *
107: #define C_RET int
108: #endif /* Windows vs.everything else function types */
109:
110: /* Symbolic defines to make it clearer how the function parameters behave */
111:
112: #define C_IN const /* Input-only */
113: #define C_OUT /* Output-only */
114: #define C_INOUT /* Modified in-place */
115:
116: #ifdef _CRYPTLIB_DEFINED /* Disable use in non-C versions of header */
117:
118: /* Alongside the externally visible types, cryptlib also has various internal
119: types that are extended forms of the external types that are invisible
120: to the user (e.g. SignedPublicKeyAndChallenge == certRequest). These can
121: only be used internally and are blocked by the security kernel, so they
122: can never be accessed from outside cryptlib (in fact for good measure
123: they're blocked before they even get to the kernel by preliminary range
124: checks in the API wrapper functions). The only reason they're defined
125: here is because it's not possible to extend an enum outside the point
126: where it's originally defined */
127:
128: #endif /* _CRYPTLIB_DEFINED */
129:
130: /****************************************************************************
131: * *
132: * Algorithm and Object Types *
133: * *
134: ****************************************************************************/
135:
136: /* Algorithm and mode types */
137:
138: typedef enum { /* Algorithms */
139: /* No encryption */
140: CRYPT_ALGO_NONE, /* No encryption */
141:
142: /* Conventional encryption */
143: CRYPT_ALGO_DES, /* DES */
144: CRYPT_ALGO_3DES, /* Triple DES */
145: CRYPT_ALGO_IDEA, /* IDEA */
146: CRYPT_ALGO_CAST, /* CAST-128 */
147: CRYPT_ALGO_RC2, /* RC2 */
148: CRYPT_ALGO_RC4, /* RC4 */
149: CRYPT_ALGO_RC5, /* RC5 */
150: CRYPT_ALGO_AES, /* AES */
151: CRYPT_ALGO_BLOWFISH, /* Blowfish */
152: CRYPT_ALGO_SKIPJACK, /* Skipjack */
153:
154: /* Public-key encryption */
155: CRYPT_ALGO_DH = 100, /* Diffie-Hellman */
156: CRYPT_ALGO_RSA, /* RSA */
157: CRYPT_ALGO_DSA, /* DSA */
158: CRYPT_ALGO_ELGAMAL, /* ElGamal */
159: CRYPT_ALGO_KEA, /* KEA */
1.1.1.2 ! root 160: CRYPT_ALGO_ECDSA, /* ECDSA */
1.1 root 161:
162: /* Hash algorithms */
163: CRYPT_ALGO_MD2 = 200, /* MD2 */
164: CRYPT_ALGO_MD4, /* MD4 */
165: CRYPT_ALGO_MD5, /* MD5 */
166: CRYPT_ALGO_SHA, /* SHA/SHA1 */
167: CRYPT_ALGO_RIPEMD160, /* RIPE-MD 160 */
168: CRYPT_ALGO_SHA2, /* SHA2 (SHA-256/384/512)*/
169:
170: /* MAC's */
171: CRYPT_ALGO_HMAC_MD5 = 300, /* HMAC-MD5 */
172: CRYPT_ALGO_HMAC_SHA1, /* HMAC-SHA */
173: CRYPT_ALGO_HMAC_SHA = CRYPT_ALGO_HMAC_SHA1, /* Older form */
174: CRYPT_ALGO_HMAC_RIPEMD160, /* HMAC-RIPEMD-160 */
175:
176: /* Vendors may want to use their own algorithms that aren't part of the
177: general cryptlib suite. The following values are for vendor-defined
178: algorithms, and can be used just like the named algorithm types (it's
179: up to the vendor to keep track of what _VENDOR1 actually corresponds
180: to) */
181: #ifdef USE_VENDOR_ALGOS
182: CRYPT_ALGO_VENDOR1 = 10000, CRYPT_ALGO_VENDOR2, CRYPT_ALGO_VENDOR3,
183: #endif /* USE_VENDOR_ALGOS */
184:
185: CRYPT_ALGO_LAST, /* Last possible crypt algo value */
186:
187: /* In order that we can scan through a range of algorithms with
188: cryptQueryCapability(), we define the following boundary points for
189: each algorithm class */
190: CRYPT_ALGO_FIRST_CONVENTIONAL = CRYPT_ALGO_DES,
191: CRYPT_ALGO_LAST_CONVENTIONAL = CRYPT_ALGO_DH - 1,
192: CRYPT_ALGO_FIRST_PKC = CRYPT_ALGO_DH,
193: CRYPT_ALGO_LAST_PKC = CRYPT_ALGO_MD2 - 1,
194: CRYPT_ALGO_FIRST_HASH = CRYPT_ALGO_MD2,
195: CRYPT_ALGO_LAST_HASH = CRYPT_ALGO_HMAC_MD5 - 1,
196: CRYPT_ALGO_FIRST_MAC = CRYPT_ALGO_HMAC_MD5,
197: CRYPT_ALGO_LAST_MAC = CRYPT_ALGO_HMAC_MD5 + 99 /* End of mac algo.range */
198: } CRYPT_ALGO_TYPE;
199:
200: typedef enum { /* Block cipher modes */
201: CRYPT_MODE_NONE, /* No encryption mode */
202: CRYPT_MODE_ECB, /* ECB */
203: CRYPT_MODE_CBC, /* CBC */
204: CRYPT_MODE_CFB, /* CFB */
205: CRYPT_MODE_OFB, /* OFB */
206: CRYPT_MODE_LAST /* Last possible crypt mode value */
207: } CRYPT_MODE_TYPE;
208:
209: #if ( defined( _WINDOWS ) || defined( WIN32 ) || defined( _WIN32 ) || \
210: defined( __WIN32__ ) ) && !defined( _SCCTK )
211: /* Force an error if wincrypt.h is included after cryptlib.h, see note at
212: the start of the file */
213: #define CRYPT_MODE_ECB 1
214: #endif /* Windows other than a cross-development environment */
215:
216: /* Keyset subtypes */
217:
218: typedef enum { /* Keyset types */
219: CRYPT_KEYSET_NONE, /* No keyset type */
220: CRYPT_KEYSET_FILE, /* Generic flat file keyset */
221: CRYPT_KEYSET_HTTP, /* Web page containing cert/CRL */
222: CRYPT_KEYSET_LDAP, /* LDAP directory service */
223: CRYPT_KEYSET_ODBC, /* Generic ODBC interface */
224: CRYPT_KEYSET_DATABASE, /* Generic RDBMS interface */
225: CRYPT_KEYSET_PLUGIN, /* Generic database plugin */
226: CRYPT_KEYSET_ODBC_STORE, /* ODBC certificate store */
227: CRYPT_KEYSET_DATABASE_STORE, /* Database certificate store */
228: CRYPT_KEYSET_PLUGIN_STORE, /* Database plugin certificate store */
229: CRYPT_KEYSET_LAST /* Last possible keyset type */
230:
231: #ifdef _CRYPT_DEFINED
232: /* Useful defines used internally for range checking */
233: , CRYPT_FIRST_RDBMS = CRYPT_KEYSET_ODBC,
234: CRYPT_LAST_RDBMS = CRYPT_KEYSET_PLUGIN_STORE
235: #endif /* _CRYPT_DEFINED */
236: } CRYPT_KEYSET_TYPE;
237:
238: /* Device subtypes */
239:
240: typedef enum { /* Crypto device types */
241: CRYPT_DEVICE_NONE, /* No crypto device */
242: CRYPT_DEVICE_FORTEZZA, /* Fortezza card */
243: CRYPT_DEVICE_PKCS11, /* PKCS #11 crypto token */
244: CRYPT_DEVICE_CRYPTOAPI, /* Microsoft CryptoAPI */
245: CRYPT_DEVICE_LAST /* Last possible crypto device type */
246: } CRYPT_DEVICE_TYPE;
247:
248: /* Certificate subtypes */
249:
250: typedef enum { /* Certificate object types */
251: CRYPT_CERTTYPE_NONE, /* No certificate type */
252: CRYPT_CERTTYPE_CERTIFICATE, /* Certificate */
253: CRYPT_CERTTYPE_ATTRIBUTE_CERT, /* Attribute certificate */
254: CRYPT_CERTTYPE_CERTCHAIN, /* PKCS #7 certificate chain */
255: CRYPT_CERTTYPE_CERTREQUEST, /* PKCS #10 certification request */
256: CRYPT_CERTTYPE_REQUEST_CERT, /* CRMF certification request */
257: CRYPT_CERTTYPE_REQUEST_REVOCATION, /* CRMF revocation request */
258: CRYPT_CERTTYPE_CRL, /* CRL */
259: CRYPT_CERTTYPE_CMS_ATTRIBUTES, /* CMS attributes */
260: CRYPT_CERTTYPE_RTCS_REQUEST, /* RTCS request */
261: CRYPT_CERTTYPE_RTCS_RESPONSE, /* RTCS response */
262: CRYPT_CERTTYPE_OCSP_REQUEST, /* OCSP request */
263: CRYPT_CERTTYPE_OCSP_RESPONSE, /* OCSP response */
264: CRYPT_CERTTYPE_PKIUSER, /* PKI user information */
265: #ifdef _CRYPT_DEFINED
266: /* Alongside the usual types we can also wind up with various
267: certificate-bagging schemes such as cert chains and sequences that
268: can't be exported in this format and therefore aren't visible to the
269: user, but that need to be distinguished internally. The following
270: types are only visible internally */
271: CRYPT_ICERTTYPE_CMS_CERTSET, /* CMS SET OF Certificate = cert chain */
272: CRYPT_ICERTTYPE_SSL_CERTCHAIN, /* SSL certificate chain = cert chain */
1.1.1.2 ! root 273: CRYPT_ICERTTYPE_CTL, /* Cert.trust list (data-only cert chain) */
! 274: CRYPT_ICERTTYPE_REVINFO, /* Revocation info/single CRL entry */
! 275:
! 276: /* CRYPT_ICERTTYPE_DATAONLY is a special value that doesn't specifically
! 277: contain a data format hint but indicates that the certificate should
! 278: be instantiated without creating a corresponding context to contain
! 279: the associated public key. This value is used by certs associated
! 280: with private-key objects and by contained in cert chains for which
! 281: only the leaf cert actually needs to have a context instantiated.
! 282: Technically this is simply a modifier for CRYPT_CERTTYPE_CERTIFICATE,
! 283: but there's no easy way to pass this flag down, so we give it its own
! 284: pseudo-type instead */
! 285: CRYPT_ICERTTYPE_DATAONLY, /* Data-only cert */
1.1 root 286: #endif /* _CRYPT_DEFINED */
287: CRYPT_CERTTYPE_LAST /* Last possible cert.type */
288: #ifdef _CRYPT_DEFINED
289: , CRYPT_CERTTYPE_LAST_EXTERNAL = CRYPT_CERTTYPE_PKIUSER + 1
290: #endif /* _CRYPT_DEFINED */
291: } CRYPT_CERTTYPE_TYPE;
292:
293: /* Envelope/data format subtypes */
294:
295: typedef enum {
296: CRYPT_FORMAT_NONE, /* No format type */
297: CRYPT_FORMAT_AUTO, /* Deenv, auto-determine type */
298: CRYPT_FORMAT_CRYPTLIB, /* cryptlib native format */
299: CRYPT_FORMAT_CMS, /* PKCS #7 / CMS / S/MIME fmt.*/
300: CRYPT_FORMAT_PKCS7 = CRYPT_FORMAT_CMS,
301: CRYPT_FORMAT_SMIME, /* As CMS with MSG-style behaviour */
302: CRYPT_FORMAT_PGP, /* PGP format */
303: #ifdef _CRYPT_DEFINED
304: /* Alongside the usual types we can also wind up with various protocol-
305: specific format types such as SSL and SSH. The following types are
306: only visible internally */
307: CRYPT_IFORMAT_SSL, /* SSL format */
308: CRYPT_IFORMAT_SSH, /* SSH format */
309: #endif /* _CRYPT_DEFINED */
310: CRYPT_FORMAT_LAST /* Last possible format type */
311: #ifdef _CRYPT_DEFINED
312: , CRYPT_FORMAT_LAST_EXTERNAL = CRYPT_FORMAT_PGP + 1
313: #endif /* _CRYPT_DEFINED */
314: } CRYPT_FORMAT_TYPE;
315:
316: /* Session subtypes */
317:
318: typedef enum {
319: CRYPT_SESSION_NONE, /* No session type */
320: CRYPT_SESSION_SSH, /* SSH */
321: CRYPT_SESSION_SSH_SERVER, /* SSH server */
322: CRYPT_SESSION_SSL, /* SSL/TLS */
323: CRYPT_SESSION_SSL_SERVER, /* SSL/TLS server */
324: CRYPT_SESSION_RTCS, /* RTCS */
325: CRYPT_SESSION_RTCS_SERVER, /* RTCS server */
326: CRYPT_SESSION_OCSP, /* OCSP */
327: CRYPT_SESSION_OCSP_SERVER, /* OCSP server */
328: CRYPT_SESSION_TSP, /* TSP */
329: CRYPT_SESSION_TSP_SERVER, /* TSP server */
330: CRYPT_SESSION_CMP, /* CMP */
331: CRYPT_SESSION_CMP_SERVER, /* CMP server */
332: CRYPT_SESSION_SCEP, /* SCEP */
333: CRYPT_SESSION_SCEP_SERVER, /* SCEP server */
334: CRYPT_SESSION_CERTSTORE_SERVER, /* HTTP cert store interface */
335: CRYPT_SESSION_LAST /* Last possible session type */
336: } CRYPT_SESSION_TYPE;
337:
338: /* User subtypes */
339:
340: typedef enum {
341: CRYPT_USER_NONE, /* No user type */
342: CRYPT_USER_NORMAL, /* Normal user */
343: CRYPT_USER_SO, /* Security officer */
344: CRYPT_USER_CA, /* CA user */
345: CRYPT_USER_LAST /* Last possible user type */
346: } CRYPT_USER_TYPE;
347:
348: /****************************************************************************
349: * *
350: * Attribute Types *
351: * *
352: ****************************************************************************/
353:
354: /* Attribute types. These are arranged in the following order:
355:
356: PROPERTY - Object property
357: ATTRIBUTE - Generic attributes
358: OPTION - Global or object-specific config.option
359: CTXINFO - Context-specific attribute
360: CERTINFO - Certificate-specific attribute
361: KEYINFO - Keyset-specific attribute
362: DEVINFO - Device-specific attribute
363: ENVINFO - Envelope-specific attribute
364: SESSINFO - Session-specific attribute
365: USERINFO - User-specific attribute */
366:
367: typedef enum {
368: CRYPT_ATTRIBUTE_NONE, /* Non-value */
369:
370: /* Used internally */
371: CRYPT_PROPERTY_FIRST,
372:
373: /*********************/
374: /* Object attributes */
375: /*********************/
376:
377: /* Object properties */
378: CRYPT_PROPERTY_HIGHSECURITY, /* Owned+non-forwardcount+locked */
379: CRYPT_PROPERTY_OWNER, /* Object owner */
380: CRYPT_PROPERTY_FORWARDCOUNT, /* No.of times object can be forwarded */
381: CRYPT_PROPERTY_LOCKED, /* Whether properties can be chged/read */
382: CRYPT_PROPERTY_USAGECOUNT, /* Usage count before object expires */
383: CRYPT_PROPERTY_NONEXPORTABLE, /* Whether key is nonexp.from context */
384:
385: /* Used internally */
386: CRYPT_PROPERTY_LAST, CRYPT_GENERIC_FIRST,
387:
388: /* Extended error information */
389: CRYPT_ATTRIBUTE_ERRORTYPE, /* Type of last error */
390: CRYPT_ATTRIBUTE_ERRORLOCUS, /* Locus of last error */
391: CRYPT_ATTRIBUTE_INT_ERRORCODE, /* Low-level software-specific */
392: CRYPT_ATTRIBUTE_INT_ERRORMESSAGE, /* error code and message */
393:
394: /* Generic information */
395: CRYPT_ATTRIBUTE_CURRENT_GROUP, /* Cursor mgt: Group in attribute list */
396: CRYPT_ATTRIBUTE_CURRENT, /* Cursor mgt: Entry in attribute list */
397: CRYPT_ATTRIBUTE_CURRENT_INSTANCE, /* Cursor mgt: Instance in attribute list */
398: CRYPT_ATTRIBUTE_BUFFERSIZE, /* Internal data buffer size */
399:
400: /* User internally */
401: CRYPT_GENERIC_LAST, CRYPT_OPTION_FIRST = 100,
402:
403: /****************************/
404: /* Configuration attributes */
405: /****************************/
406:
407: /* cryptlib information (read-only) */
408: CRYPT_OPTION_INFO_DESCRIPTION, /* Text description */
409: CRYPT_OPTION_INFO_COPYRIGHT, /* Copyright notice */
410: CRYPT_OPTION_INFO_MAJORVERSION, /* Major release version */
411: CRYPT_OPTION_INFO_MINORVERSION, /* Minor release version */
412: CRYPT_OPTION_INFO_STEPPING, /* Release stepping */
413:
414: /* Encryption options */
415: CRYPT_OPTION_ENCR_ALGO, /* Encryption algorithm */
416: CRYPT_OPTION_ENCR_HASH, /* Hash algorithm */
417: CRYPT_OPTION_ENCR_MAC, /* MAC algorithm */
418:
419: /* PKC options */
420: CRYPT_OPTION_PKC_ALGO, /* Public-key encryption algorithm */
421: CRYPT_OPTION_PKC_KEYSIZE, /* Public-key encryption key size */
422:
423: /* Signature options */
424: CRYPT_OPTION_SIG_ALGO, /* Signature algorithm */
425: CRYPT_OPTION_SIG_KEYSIZE, /* Signature keysize */
426:
427: /* Keying options */
428: CRYPT_OPTION_KEYING_ALGO, /* Key processing algorithm */
429: CRYPT_OPTION_KEYING_ITERATIONS, /* Key processing iterations */
430:
431: /* Certificate options */
432: CRYPT_OPTION_CERT_SIGNUNRECOGNISEDATTRIBUTES, /* Whether to sign unrecog.attrs */
433: CRYPT_OPTION_CERT_VALIDITY, /* Certificate validity period */
434: CRYPT_OPTION_CERT_UPDATEINTERVAL, /* CRL update interval */
435: CRYPT_OPTION_CERT_COMPLIANCELEVEL, /* PKIX compliance level for cert chks.*/
436: CRYPT_OPTION_CERT_REQUIREPOLICY, /* Whether explicit policy req'd for certs */
437:
438: /* CMS/SMIME options */
439: CRYPT_OPTION_CMS_DEFAULTATTRIBUTES, /* Add default CMS attributes */
440: CRYPT_OPTION_SMIME_DEFAULTATTRIBUTES = CRYPT_OPTION_CMS_DEFAULTATTRIBUTES,
441:
442: /* LDAP keyset options */
443: CRYPT_OPTION_KEYS_LDAP_OBJECTCLASS, /* Object class */
444: CRYPT_OPTION_KEYS_LDAP_OBJECTTYPE, /* Object type to fetch */
445: CRYPT_OPTION_KEYS_LDAP_FILTER, /* Query filter */
446: CRYPT_OPTION_KEYS_LDAP_CACERTNAME, /* CA certificate attribute name */
447: CRYPT_OPTION_KEYS_LDAP_CERTNAME, /* Certificate attribute name */
448: CRYPT_OPTION_KEYS_LDAP_CRLNAME, /* CRL attribute name */
449: CRYPT_OPTION_KEYS_LDAP_EMAILNAME, /* Email attribute name */
450:
451: /* Crypto device options */
452: CRYPT_OPTION_DEVICE_PKCS11_DVR01, /* Name of first PKCS #11 driver */
453: CRYPT_OPTION_DEVICE_PKCS11_DVR02, /* Name of second PKCS #11 driver */
454: CRYPT_OPTION_DEVICE_PKCS11_DVR03, /* Name of third PKCS #11 driver */
455: CRYPT_OPTION_DEVICE_PKCS11_DVR04, /* Name of fourth PKCS #11 driver */
456: CRYPT_OPTION_DEVICE_PKCS11_DVR05, /* Name of fifth PKCS #11 driver */
457: CRYPT_OPTION_DEVICE_PKCS11_HARDWAREONLY,/* Use only hardware mechanisms */
458:
459: /* Network access options */
460: CRYPT_OPTION_NET_SOCKS_SERVER, /* Socks server name */
461: CRYPT_OPTION_NET_SOCKS_USERNAME, /* Socks user name */
462: CRYPT_OPTION_NET_HTTP_PROXY, /* Web proxy server */
463: CRYPT_OPTION_NET_CONNECTTIMEOUT, /* Timeout for network connection setup */
464: CRYPT_OPTION_NET_READTIMEOUT, /* Timeout for network reads */
465: CRYPT_OPTION_NET_WRITETIMEOUT, /* Timeout for network writes */
466:
467: /* Miscellaneous options */
468: CRYPT_OPTION_MISC_ASYNCINIT, /* Whether to init cryptlib async'ly */
469: CRYPT_OPTION_MISC_SIDECHANNELPROTECTION, /* Protect against side-channel attacks */
470:
471: /* cryptlib state information */
472: CRYPT_OPTION_CONFIGCHANGED, /* Whether in-mem.opts match on-disk ones */
473: CRYPT_OPTION_SELFTESTOK, /* Whether self-test was completed and OK */
474:
475: /* Used internally */
476: CRYPT_OPTION_LAST, CRYPT_CTXINFO_FIRST = 1000,
477:
478: /**********************/
479: /* Context attributes */
480: /**********************/
481:
482: /* Algorithm and mode information */
483: CRYPT_CTXINFO_ALGO, /* Algorithm */
484: CRYPT_CTXINFO_MODE, /* Mode */
485: CRYPT_CTXINFO_NAME_ALGO, /* Algorithm name */
486: CRYPT_CTXINFO_NAME_MODE, /* Mode name */
487: CRYPT_CTXINFO_KEYSIZE, /* Key size in bytes */
488: CRYPT_CTXINFO_BLOCKSIZE, /* Block size */
489: CRYPT_CTXINFO_IVSIZE, /* IV size */
490: CRYPT_CTXINFO_KEYING_ALGO, /* Key processing algorithm */
491: CRYPT_CTXINFO_KEYING_ITERATIONS,/* Key processing iterations */
492: CRYPT_CTXINFO_KEYING_SALT, /* Key processing salt */
493: CRYPT_CTXINFO_KEYING_VALUE, /* Value used to derive key */
494:
495: /* State information */
496: CRYPT_CTXINFO_KEY, /* Key */
497: CRYPT_CTXINFO_KEY_COMPONENTS, /* Public-key components */
498: CRYPT_CTXINFO_IV, /* IV */
499: CRYPT_CTXINFO_HASHVALUE, /* Hash value */
500:
501: /* Misc.information */
502: CRYPT_CTXINFO_LABEL, /* Label for private/secret key */
1.1.1.2 ! root 503: CRYPT_CTXINFO_PERSISTENT, /* Obj.is backed by device or keyset */
1.1 root 504:
505: /* Used internally */
506: CRYPT_CTXINFO_LAST, CRYPT_CERTINFO_FIRST = 2000,
507:
508: /**************************/
509: /* Certificate attributes */
510: /**************************/
511:
512: /* Because there are so many cert attributes, we break them down into
513: blocks to minimise the number of values that change if a new one is
514: added halfway through */
515:
516: /* Pseudo-information on a cert object or meta-information which is used
517: to control the way that a cert object is processed */
518: CRYPT_CERTINFO_SELFSIGNED, /* Cert is self-signed */
519: CRYPT_CERTINFO_IMMUTABLE, /* Cert is signed and immutable */
520: CRYPT_CERTINFO_XYZZY, /* Cert is a magic just-works cert */
521: CRYPT_CERTINFO_CERTTYPE, /* Certificate object type */
522: CRYPT_CERTINFO_FINGERPRINT, /* Certificate fingerprints */
523: CRYPT_CERTINFO_FINGERPRINT_MD5 = CRYPT_CERTINFO_FINGERPRINT,
524: CRYPT_CERTINFO_FINGERPRINT_SHA,
525: CRYPT_CERTINFO_CURRENT_CERTIFICATE,/* Cursor mgt: Rel.pos in chain/CRL/OCSP */
526: CRYPT_CERTINFO_TRUSTED_USAGE, /* Usage that cert is trusted for */
527: CRYPT_CERTINFO_TRUSTED_IMPLICIT,/* Whether cert is implicitly trusted */
528: CRYPT_CERTINFO_SIGNATURELEVEL, /* Amount of detail to include in sigs.*/
529:
530: /* General certificate object information */
531: CRYPT_CERTINFO_VERSION, /* Cert.format version */
532: CRYPT_CERTINFO_SERIALNUMBER, /* Serial number */
533: CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, /* Public key */
534: CRYPT_CERTINFO_CERTIFICATE, /* User certificate */
535: CRYPT_CERTINFO_USERCERTIFICATE = CRYPT_CERTINFO_CERTIFICATE,
536: CRYPT_CERTINFO_CACERTIFICATE, /* CA certificate */
537: CRYPT_CERTINFO_ISSUERNAME, /* Issuer DN */
538: CRYPT_CERTINFO_VALIDFROM, /* Cert valid-from time */
539: CRYPT_CERTINFO_VALIDTO, /* Cert valid-to time */
540: CRYPT_CERTINFO_SUBJECTNAME, /* Subject DN */
541: CRYPT_CERTINFO_ISSUERUNIQUEID, /* Issuer unique ID */
542: CRYPT_CERTINFO_SUBJECTUNIQUEID, /* Subject unique ID */
543: CRYPT_CERTINFO_CERTREQUEST, /* Cert.request (DN + public key) */
544: CRYPT_CERTINFO_THISUPDATE, /* CRL/OCSP current-update time */
545: CRYPT_CERTINFO_NEXTUPDATE, /* CRL/OCSP next-update time */
546: CRYPT_CERTINFO_REVOCATIONDATE, /* CRL/OCSP cert-revocation time */
547: CRYPT_CERTINFO_REVOCATIONSTATUS,/* OCSP revocation status */
548: CRYPT_CERTINFO_CERTSTATUS, /* RTCS certificate status */
549: CRYPT_CERTINFO_DN, /* Currently selected DN in string form */
550: CRYPT_CERTINFO_PKIUSER_ID, /* PKI user ID */
551: CRYPT_CERTINFO_PKIUSER_ISSUEPASSWORD, /* PKI user issue password */
552: CRYPT_CERTINFO_PKIUSER_REVPASSWORD, /* PKI user revocation password */
553:
554: /* X.520 Distinguished Name components. This is a composite field, the
555: DN to be manipulated is selected through the addition of a
556: pseudocomponent, and then one of the following is used to access the
557: DN components directly */
558: CRYPT_CERTINFO_COUNTRYNAME = CRYPT_CERTINFO_FIRST + 100, /* countryName */
559: CRYPT_CERTINFO_STATEORPROVINCENAME, /* stateOrProvinceName */
560: CRYPT_CERTINFO_LOCALITYNAME, /* localityName */
561: CRYPT_CERTINFO_ORGANIZATIONNAME, /* organizationName */
562: CRYPT_CERTINFO_ORGANISATIONNAME = CRYPT_CERTINFO_ORGANIZATIONNAME,
563: CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, /* organizationalUnitName */
564: CRYPT_CERTINFO_ORGANISATIONALUNITNAME = CRYPT_CERTINFO_ORGANIZATIONALUNITNAME,
565: CRYPT_CERTINFO_COMMONNAME, /* commonName */
566:
567: /* X.509 General Name components. These are handled in the same way as
568: the DN composite field, with the current GeneralName being selected by
569: a pseudo-component after which the individual components can be
570: modified through one of the following */
571: CRYPT_CERTINFO_OTHERNAME_TYPEID, /* otherName.typeID */
572: CRYPT_CERTINFO_OTHERNAME_VALUE, /* otherName.value */
573: CRYPT_CERTINFO_RFC822NAME, /* rfc822Name */
574: CRYPT_CERTINFO_EMAIL = CRYPT_CERTINFO_RFC822NAME,
575: CRYPT_CERTINFO_DNSNAME, /* dNSName */
576: #if 0 /* Not supported yet, these are never used in practice and have an
577: insane internal structure */
578: CRYPT_CERTINFO_X400ADDRESS, /* x400Address */
579: #endif /* 0 */
580: CRYPT_CERTINFO_DIRECTORYNAME, /* directoryName */
581: CRYPT_CERTINFO_EDIPARTYNAME_NAMEASSIGNER, /* ediPartyName.nameAssigner */
582: CRYPT_CERTINFO_EDIPARTYNAME_PARTYNAME, /* ediPartyName.partyName */
583: CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, /* uniformResourceIdentifier */
584: CRYPT_CERTINFO_IPADDRESS, /* iPAddress */
585: CRYPT_CERTINFO_REGISTEREDID, /* registeredID */
586:
587: /* X.509 certificate extensions. Although it would be nicer to use names
588: that match the extensions more closely (e.g.
589: CRYPT_CERTINFO_BASICCONSTRAINTS_PATHLENCONSTRAINT), these exceed the
590: 32-character ANSI minimum length for unique names, and get really
591: hairy once you get into the weird policy constraints extensions whose
592: names wrap around the screen about three times.
593:
594: The following values are defined in OID order, this isn't absolutely
595: necessary but saves an extra layer of processing when encoding them */
596:
597: /* 1 2 840 113549 1 9 7 challengePassword. This is here even though it's
598: a CMS attribute because SCEP stuffs it into PKCS #10 requests */
599: CRYPT_CERTINFO_CHALLENGEPASSWORD = CRYPT_CERTINFO_FIRST + 200,
600:
601: /* 1 3 6 1 4 1 3029 3 1 4 cRLExtReason */
602: CRYPT_CERTINFO_CRLEXTREASON,
603:
604: /* 1 3 6 1 4 1 3029 3 1 5 keyFeatures */
605: CRYPT_CERTINFO_KEYFEATURES,
606:
607: /* 1 3 6 1 5 5 7 1 1 authorityInfoAccess */
608: CRYPT_CERTINFO_AUTHORITYINFOACCESS,
609: CRYPT_CERTINFO_AUTHORITYINFO_RTCS, /* accessDescription.accessLocation */
610: CRYPT_CERTINFO_AUTHORITYINFO_OCSP, /* accessDescription.accessLocation */
611: CRYPT_CERTINFO_AUTHORITYINFO_CAISSUERS, /* accessDescription.accessLocation */
612: CRYPT_CERTINFO_AUTHORITYINFO_CERTSTORE, /* accessDescription.accessLocation */
613: CRYPT_CERTINFO_AUTHORITYINFO_CRLS, /* accessDescription.accessLocation */
614:
615: /* 1 3 6 1 5 5 7 1 2 biometricInfo */
616: CRYPT_CERTINFO_BIOMETRICINFO,
617: CRYPT_CERTINFO_BIOMETRICINFO_TYPE, /* biometricData.typeOfData */
618: CRYPT_CERTINFO_BIOMETRICINFO_HASHALGO, /* biometricData.hashAlgorithm */
619: CRYPT_CERTINFO_BIOMETRICINFO_HASH, /* biometricData.dataHash */
620: CRYPT_CERTINFO_BIOMETRICINFO_URL, /* biometricData.sourceDataUri */
621:
622: /* 1 3 6 1 5 5 7 1 3 qcStatements */
623: CRYPT_CERTINFO_QCSTATEMENT,
624: CRYPT_CERTINFO_QCSTATEMENT_SEMANTICS,
625: /* qcStatement.statementInfo.semanticsIdentifier */
626: CRYPT_CERTINFO_QCSTATEMENT_REGISTRATIONAUTHORITY,
627: /* qcStatement.statementInfo.nameRegistrationAuthorities */
628:
629: /* 1 3 6 1 5 5 7 48 1 2 ocspNonce */
630: CRYPT_CERTINFO_OCSP_NONCE, /* nonce */
631:
632: /* 1 3 6 1 5 5 7 48 1 4 ocspAcceptableResponses */
633: CRYPT_CERTINFO_OCSP_RESPONSE,
634: CRYPT_CERTINFO_OCSP_RESPONSE_OCSP, /* OCSP standard response */
635:
636: /* 1 3 6 1 5 5 7 48 1 5 ocspNoCheck */
637: CRYPT_CERTINFO_OCSP_NOCHECK,
638:
639: /* 1 3 6 1 5 5 7 48 1 6 ocspArchiveCutoff */
640: CRYPT_CERTINFO_OCSP_ARCHIVECUTOFF,
641:
642: /* 1 3 6 1 5 5 7 48 1 11 subjectInfoAccess */
643: CRYPT_CERTINFO_SUBJECTINFOACCESS,
644: CRYPT_CERTINFO_SUBJECTINFO_CAREPOSITORY,/* accessDescription.accessLocation */
645: CRYPT_CERTINFO_SUBJECTINFO_TIMESTAMPING,/* accessDescription.accessLocation */
646:
647: /* 1 3 36 8 3 1 siggDateOfCertGen */
648: CRYPT_CERTINFO_SIGG_DATEOFCERTGEN,
649:
650: /* 1 3 36 8 3 2 siggProcuration */
651: CRYPT_CERTINFO_SIGG_PROCURATION,
652: CRYPT_CERTINFO_SIGG_PROCURE_COUNTRY, /* country */
653: CRYPT_CERTINFO_SIGG_PROCURE_TYPEOFSUBSTITUTION, /* typeOfSubstitution */
654: CRYPT_CERTINFO_SIGG_PROCURE_SIGNINGFOR, /* signingFor.thirdPerson */
655:
656: /* 1 3 36 8 3 4 siggMonetaryLimit */
657: CRYPT_CERTINFO_SIGG_MONETARYLIMIT,
658: CRYPT_CERTINFO_SIGG_MONETARY_CURRENCY, /* currency */
659: CRYPT_CERTINFO_SIGG_MONETARY_AMOUNT, /* amount */
660: CRYPT_CERTINFO_SIGG_MONETARY_EXPONENT, /* exponent */
661:
662: /* 1 3 36 8 3 8 siggRestriction */
663: CRYPT_CERTINFO_SIGG_RESTRICTION,
664:
665: /* 1 3 101 1 4 1 strongExtranet */
666: CRYPT_CERTINFO_STRONGEXTRANET,
667: CRYPT_CERTINFO_STRONGEXTRANET_ZONE, /* sxNetIDList.sxNetID.zone */
668: CRYPT_CERTINFO_STRONGEXTRANET_ID, /* sxNetIDList.sxNetID.id */
669:
670: /* 2 5 29 9 subjectDirectoryAttributes */
671: CRYPT_CERTINFO_SUBJECTDIRECTORYATTRIBUTES,
672: CRYPT_CERTINFO_SUBJECTDIR_TYPE, /* attribute.type */
673: CRYPT_CERTINFO_SUBJECTDIR_VALUES, /* attribute.values */
674:
675: /* 2 5 29 14 subjectKeyIdentifier */
676: CRYPT_CERTINFO_SUBJECTKEYIDENTIFIER,
677:
678: /* 2 5 29 15 keyUsage */
679: CRYPT_CERTINFO_KEYUSAGE,
680:
681: /* 2 5 29 16 privateKeyUsagePeriod */
682: CRYPT_CERTINFO_PRIVATEKEYUSAGEPERIOD,
683: CRYPT_CERTINFO_PRIVATEKEY_NOTBEFORE, /* notBefore */
684: CRYPT_CERTINFO_PRIVATEKEY_NOTAFTER, /* notAfter */
685:
686: /* 2 5 29 17 subjectAltName */
687: CRYPT_CERTINFO_SUBJECTALTNAME,
688:
689: /* 2 5 29 18 issuerAltName */
690: CRYPT_CERTINFO_ISSUERALTNAME,
691:
692: /* 2 5 29 19 basicConstraints */
693: CRYPT_CERTINFO_BASICCONSTRAINTS,
694: CRYPT_CERTINFO_CA, /* cA */
695: CRYPT_CERTINFO_AUTHORITY = CRYPT_CERTINFO_CA,
696: CRYPT_CERTINFO_PATHLENCONSTRAINT, /* pathLenConstraint */
697:
698: /* 2 5 29 20 cRLNumber */
699: CRYPT_CERTINFO_CRLNUMBER,
700:
701: /* 2 5 29 21 cRLReason */
702: CRYPT_CERTINFO_CRLREASON,
703:
704: /* 2 5 29 23 holdInstructionCode */
705: CRYPT_CERTINFO_HOLDINSTRUCTIONCODE,
706:
707: /* 2 5 29 24 invalidityDate */
708: CRYPT_CERTINFO_INVALIDITYDATE,
709:
710: /* 2 5 29 27 deltaCRLIndicator */
711: CRYPT_CERTINFO_DELTACRLINDICATOR,
712:
713: /* 2 5 29 28 issuingDistributionPoint */
714: CRYPT_CERTINFO_ISSUINGDISTRIBUTIONPOINT,
715: CRYPT_CERTINFO_ISSUINGDIST_FULLNAME, /* distributionPointName.fullName */
716: CRYPT_CERTINFO_ISSUINGDIST_USERCERTSONLY, /* onlyContainsUserCerts */
717: CRYPT_CERTINFO_ISSUINGDIST_CACERTSONLY, /* onlyContainsCACerts */
718: CRYPT_CERTINFO_ISSUINGDIST_SOMEREASONSONLY, /* onlySomeReasons */
719: CRYPT_CERTINFO_ISSUINGDIST_INDIRECTCRL, /* indirectCRL */
720:
721: /* 2 5 29 29 certificateIssuer */
722: CRYPT_CERTINFO_CERTIFICATEISSUER,
723:
724: /* 2 5 29 30 nameConstraints */
725: CRYPT_CERTINFO_NAMECONSTRAINTS,
726: CRYPT_CERTINFO_PERMITTEDSUBTREES, /* permittedSubtrees */
727: CRYPT_CERTINFO_EXCLUDEDSUBTREES, /* excludedSubtrees */
728:
729: /* 2 5 29 31 cRLDistributionPoint */
730: CRYPT_CERTINFO_CRLDISTRIBUTIONPOINT,
731: CRYPT_CERTINFO_CRLDIST_FULLNAME, /* distributionPointName.fullName */
732: CRYPT_CERTINFO_CRLDIST_REASONS, /* reasons */
733: CRYPT_CERTINFO_CRLDIST_CRLISSUER, /* cRLIssuer */
734:
735: /* 2 5 29 32 certificatePolicies */
736: CRYPT_CERTINFO_CERTIFICATEPOLICIES,
737: CRYPT_CERTINFO_CERTPOLICYID, /* policyInformation.policyIdentifier */
738: CRYPT_CERTINFO_CERTPOLICY_CPSURI,
739: /* policyInformation.policyQualifiers.qualifier.cPSuri */
740: CRYPT_CERTINFO_CERTPOLICY_ORGANIZATION,
741: /* policyInformation.policyQualifiers.qualifier.userNotice.noticeRef.organization */
742: CRYPT_CERTINFO_CERTPOLICY_NOTICENUMBERS,
743: /* policyInformation.policyQualifiers.qualifier.userNotice.noticeRef.noticeNumbers */
744: CRYPT_CERTINFO_CERTPOLICY_EXPLICITTEXT,
745: /* policyInformation.policyQualifiers.qualifier.userNotice.explicitText */
746:
747: /* 2 5 29 33 policyMappings */
748: CRYPT_CERTINFO_POLICYMAPPINGS,
749: CRYPT_CERTINFO_ISSUERDOMAINPOLICY, /* policyMappings.issuerDomainPolicy */
750: CRYPT_CERTINFO_SUBJECTDOMAINPOLICY, /* policyMappings.subjectDomainPolicy */
751:
752: /* 2 5 29 35 authorityKeyIdentifier */
753: CRYPT_CERTINFO_AUTHORITYKEYIDENTIFIER,
754: CRYPT_CERTINFO_AUTHORITY_KEYIDENTIFIER, /* keyIdentifier */
755: CRYPT_CERTINFO_AUTHORITY_CERTISSUER, /* authorityCertIssuer */
756: CRYPT_CERTINFO_AUTHORITY_CERTSERIALNUMBER, /* authorityCertSerialNumber */
757:
758: /* 2 5 29 36 policyConstraints */
759: CRYPT_CERTINFO_POLICYCONSTRAINTS,
760: CRYPT_CERTINFO_REQUIREEXPLICITPOLICY, /* policyConstraints.requireExplicitPolicy */
761: CRYPT_CERTINFO_INHIBITPOLICYMAPPING, /* policyConstraints.inhibitPolicyMapping */
762:
763: /* 2 5 29 37 extKeyUsage */
764: CRYPT_CERTINFO_EXTKEYUSAGE,
765: CRYPT_CERTINFO_EXTKEY_MS_INDIVIDUALCODESIGNING, /* individualCodeSigning */
766: CRYPT_CERTINFO_EXTKEY_MS_COMMERCIALCODESIGNING, /* commercialCodeSigning */
767: CRYPT_CERTINFO_EXTKEY_MS_CERTTRUSTLISTSIGNING, /* certTrustListSigning */
768: CRYPT_CERTINFO_EXTKEY_MS_TIMESTAMPSIGNING, /* timeStampSigning */
769: CRYPT_CERTINFO_EXTKEY_MS_SERVERGATEDCRYPTO, /* serverGatedCrypto */
770: CRYPT_CERTINFO_EXTKEY_MS_ENCRYPTEDFILESYSTEM, /* encrypedFileSystem */
771: CRYPT_CERTINFO_EXTKEY_SERVERAUTH, /* serverAuth */
772: CRYPT_CERTINFO_EXTKEY_CLIENTAUTH, /* clientAuth */
773: CRYPT_CERTINFO_EXTKEY_CODESIGNING, /* codeSigning */
774: CRYPT_CERTINFO_EXTKEY_EMAILPROTECTION, /* emailProtection */
775: CRYPT_CERTINFO_EXTKEY_IPSECENDSYSTEM, /* ipsecEndSystem */
776: CRYPT_CERTINFO_EXTKEY_IPSECTUNNEL, /* ipsecTunnel */
777: CRYPT_CERTINFO_EXTKEY_IPSECUSER, /* ipsecUser */
778: CRYPT_CERTINFO_EXTKEY_TIMESTAMPING, /* timeStamping */
779: CRYPT_CERTINFO_EXTKEY_OCSPSIGNING, /* ocspSigning */
780: CRYPT_CERTINFO_EXTKEY_DIRECTORYSERVICE, /* directoryService */
781: CRYPT_CERTINFO_EXTKEY_ANYKEYUSAGE, /* anyExtendedKeyUsage */
782: CRYPT_CERTINFO_EXTKEY_NS_SERVERGATEDCRYPTO, /* serverGatedCrypto */
783: CRYPT_CERTINFO_EXTKEY_VS_SERVERGATEDCRYPTO_CA, /* serverGatedCrypto CA */
784:
785: /* 2 5 29 46 freshestCRL */
786: CRYPT_CERTINFO_FRESHESTCRL,
787: CRYPT_CERTINFO_FRESHESTCRL_FULLNAME, /* distributionPointName.fullName */
788: CRYPT_CERTINFO_FRESHESTCRL_REASONS, /* reasons */
789: CRYPT_CERTINFO_FRESHESTCRL_CRLISSUER, /* cRLIssuer */
790:
791: /* 2 5 29 54 inhibitAnyPolicy */
792: CRYPT_CERTINFO_INHIBITANYPOLICY,
793:
794: /* 2 16 840 1 113730 1 x Netscape extensions */
795: CRYPT_CERTINFO_NS_CERTTYPE, /* netscape-cert-type */
796: CRYPT_CERTINFO_NS_BASEURL, /* netscape-base-url */
797: CRYPT_CERTINFO_NS_REVOCATIONURL, /* netscape-revocation-url */
798: CRYPT_CERTINFO_NS_CAREVOCATIONURL, /* netscape-ca-revocation-url */
799: CRYPT_CERTINFO_NS_CERTRENEWALURL, /* netscape-cert-renewal-url */
800: CRYPT_CERTINFO_NS_CAPOLICYURL, /* netscape-ca-policy-url */
801: CRYPT_CERTINFO_NS_SSLSERVERNAME, /* netscape-ssl-server-name */
802: CRYPT_CERTINFO_NS_COMMENT, /* netscape-comment */
803:
804: /* 2 23 42 7 0 SET hashedRootKey */
805: CRYPT_CERTINFO_SET_HASHEDROOTKEY,
806: CRYPT_CERTINFO_SET_ROOTKEYTHUMBPRINT, /* rootKeyThumbPrint */
807:
808: /* 2 23 42 7 1 SET certificateType */
809: CRYPT_CERTINFO_SET_CERTIFICATETYPE,
810:
811: /* 2 23 42 7 2 SET merchantData */
812: CRYPT_CERTINFO_SET_MERCHANTDATA,
813: CRYPT_CERTINFO_SET_MERID, /* merID */
814: CRYPT_CERTINFO_SET_MERACQUIRERBIN, /* merAcquirerBIN */
815: CRYPT_CERTINFO_SET_MERCHANTLANGUAGE, /* merNames.language */
816: CRYPT_CERTINFO_SET_MERCHANTNAME, /* merNames.name */
817: CRYPT_CERTINFO_SET_MERCHANTCITY, /* merNames.city */
818: CRYPT_CERTINFO_SET_MERCHANTSTATEPROVINCE,/* merNames.stateProvince */
819: CRYPT_CERTINFO_SET_MERCHANTPOSTALCODE, /* merNames.postalCode */
820: CRYPT_CERTINFO_SET_MERCHANTCOUNTRYNAME, /* merNames.countryName */
821: CRYPT_CERTINFO_SET_MERCOUNTRY, /* merCountry */
822: CRYPT_CERTINFO_SET_MERAUTHFLAG, /* merAuthFlag */
823:
824: /* 2 23 42 7 3 SET certCardRequired */
825: CRYPT_CERTINFO_SET_CERTCARDREQUIRED,
826:
827: /* 2 23 42 7 4 SET tunneling */
828: CRYPT_CERTINFO_SET_TUNNELING,
829: CRYPT_CERTINFO_SET_TUNNELLING = CRYPT_CERTINFO_SET_TUNNELING,
830: CRYPT_CERTINFO_SET_TUNNELINGFLAG, /* tunneling */
831: CRYPT_CERTINFO_SET_TUNNELLINGFLAG = CRYPT_CERTINFO_SET_TUNNELINGFLAG,
832: CRYPT_CERTINFO_SET_TUNNELINGALGID, /* tunnelingAlgID */
833: CRYPT_CERTINFO_SET_TUNNELLINGALGID = CRYPT_CERTINFO_SET_TUNNELINGALGID,
834:
835: /* S/MIME attributes */
836:
837: /* 1 2 840 113549 1 9 3 contentType */
838: CRYPT_CERTINFO_CMS_CONTENTTYPE = CRYPT_CERTINFO_FIRST + 500,
839:
840: /* 1 2 840 113549 1 9 4 messageDigest */
841: CRYPT_CERTINFO_CMS_MESSAGEDIGEST,
842:
843: /* 1 2 840 113549 1 9 5 signingTime */
844: CRYPT_CERTINFO_CMS_SIGNINGTIME,
845:
846: /* 1 2 840 113549 1 9 6 counterSignature */
847: CRYPT_CERTINFO_CMS_COUNTERSIGNATURE, /* counterSignature */
848:
849: /* 1 2 840 113549 1 9 13 signingDescription */
850: CRYPT_CERTINFO_CMS_SIGNINGDESCRIPTION,
851:
852: /* 1 2 840 113549 1 9 15 sMIMECapabilities */
853: CRYPT_CERTINFO_CMS_SMIMECAPABILITIES,
854: CRYPT_CERTINFO_CMS_SMIMECAP_3DES, /* 3DES encryption */
855: CRYPT_CERTINFO_CMS_SMIMECAP_AES, /* AES encryption */
856: CRYPT_CERTINFO_CMS_SMIMECAP_CAST128, /* CAST-128 encryption */
857: CRYPT_CERTINFO_CMS_SMIMECAP_IDEA, /* IDEA encryption */
858: CRYPT_CERTINFO_CMS_SMIMECAP_RC2, /* RC2 encryption (w.128 key) */
859: CRYPT_CERTINFO_CMS_SMIMECAP_RC5, /* RC5 encryption (w.128 key) */
860: CRYPT_CERTINFO_CMS_SMIMECAP_SKIPJACK, /* Skipjack encryption */
861: CRYPT_CERTINFO_CMS_SMIMECAP_DES, /* DES encryption */
862: CRYPT_CERTINFO_CMS_SMIMECAP_PREFERSIGNEDDATA, /* preferSignedData */
863: CRYPT_CERTINFO_CMS_SMIMECAP_CANNOTDECRYPTANY, /* canNotDecryptAny */
864:
865: /* 1 2 840 113549 1 9 16 2 1 receiptRequest */
866: CRYPT_CERTINFO_CMS_RECEIPTREQUEST,
867: CRYPT_CERTINFO_CMS_RECEIPT_CONTENTIDENTIFIER, /* contentIdentifier */
868: CRYPT_CERTINFO_CMS_RECEIPT_FROM, /* receiptsFrom */
869: CRYPT_CERTINFO_CMS_RECEIPT_TO, /* receiptsTo */
870:
871: /* 1 2 840 113549 1 9 16 2 2 essSecurityLabel */
872: CRYPT_CERTINFO_CMS_SECURITYLABEL,
873: CRYPT_CERTINFO_CMS_SECLABEL_POLICY, /* securityPolicyIdentifier */
874: CRYPT_CERTINFO_CMS_SECLABEL_CLASSIFICATION, /* securityClassification */
875: CRYPT_CERTINFO_CMS_SECLABEL_PRIVACYMARK,/* privacyMark */
876: CRYPT_CERTINFO_CMS_SECLABEL_CATTYPE, /* securityCategories.securityCategory.type */
877: CRYPT_CERTINFO_CMS_SECLABEL_CATVALUE, /* securityCategories.securityCategory.value */
878:
879: /* 1 2 840 113549 1 9 16 2 3 mlExpansionHistory */
880: CRYPT_CERTINFO_CMS_MLEXPANSIONHISTORY,
881: CRYPT_CERTINFO_CMS_MLEXP_ENTITYIDENTIFIER, /* mlData.mailListIdentifier.issuerAndSerialNumber */
882: CRYPT_CERTINFO_CMS_MLEXP_TIME, /* mlData.expansionTime */
883: CRYPT_CERTINFO_CMS_MLEXP_NONE, /* mlData.mlReceiptPolicy.none */
884: CRYPT_CERTINFO_CMS_MLEXP_INSTEADOF, /* mlData.mlReceiptPolicy.insteadOf.generalNames.generalName */
885: CRYPT_CERTINFO_CMS_MLEXP_INADDITIONTO, /* mlData.mlReceiptPolicy.inAdditionTo.generalNames.generalName */
886:
887: /* 1 2 840 113549 1 9 16 2 4 contentHints */
888: CRYPT_CERTINFO_CMS_CONTENTHINTS,
889: CRYPT_CERTINFO_CMS_CONTENTHINT_DESCRIPTION, /* contentDescription */
890: CRYPT_CERTINFO_CMS_CONTENTHINT_TYPE, /* contentType */
891:
892: /* 1 2 840 113549 1 9 16 2 9 equivalentLabels */
893: CRYPT_CERTINFO_CMS_EQUIVALENTLABEL,
894: CRYPT_CERTINFO_CMS_EQVLABEL_POLICY, /* securityPolicyIdentifier */
895: CRYPT_CERTINFO_CMS_EQVLABEL_CLASSIFICATION, /* securityClassification */
896: CRYPT_CERTINFO_CMS_EQVLABEL_PRIVACYMARK,/* privacyMark */
897: CRYPT_CERTINFO_CMS_EQVLABEL_CATTYPE, /* securityCategories.securityCategory.type */
898: CRYPT_CERTINFO_CMS_EQVLABEL_CATVALUE, /* securityCategories.securityCategory.value */
899:
900: /* 1 2 840 113549 1 9 16 2 12 signingCertificate */
901: CRYPT_CERTINFO_CMS_SIGNINGCERTIFICATE,
902: CRYPT_CERTINFO_CMS_SIGNINGCERT_ESSCERTID, /* certs.essCertID */
903: CRYPT_CERTINFO_CMS_SIGNINGCERT_POLICIES,/* policies.policyInformation.policyIdentifier */
904:
905: /* 1 2 840 113549 1 9 16 2 15 signaturePolicyID */
906: CRYPT_CERTINFO_CMS_SIGNATUREPOLICYID,
907: CRYPT_CERTINFO_CMS_SIGPOLICYID, /* sigPolicyID */
908: CRYPT_CERTINFO_CMS_SIGPOLICYHASH, /* sigPolicyHash */
909: CRYPT_CERTINFO_CMS_SIGPOLICY_CPSURI, /* sigPolicyQualifiers.sigPolicyQualifier.cPSuri */
910: CRYPT_CERTINFO_CMS_SIGPOLICY_ORGANIZATION,
911: /* sigPolicyQualifiers.sigPolicyQualifier.userNotice.noticeRef.organization */
912: CRYPT_CERTINFO_CMS_SIGPOLICY_NOTICENUMBERS,
913: /* sigPolicyQualifiers.sigPolicyQualifier.userNotice.noticeRef.noticeNumbers */
914: CRYPT_CERTINFO_CMS_SIGPOLICY_EXPLICITTEXT,
915: /* sigPolicyQualifiers.sigPolicyQualifier.userNotice.explicitText */
916:
917: /* 1 2 840 113549 1 9 16 9 signatureTypeIdentifier */
918: CRYPT_CERTINFO_CMS_SIGTYPEIDENTIFIER,
919: CRYPT_CERTINFO_CMS_SIGTYPEID_ORIGINATORSIG, /* originatorSig */
920: CRYPT_CERTINFO_CMS_SIGTYPEID_DOMAINSIG, /* domainSig */
921: CRYPT_CERTINFO_CMS_SIGTYPEID_ADDITIONALATTRIBUTES, /* additionalAttributesSig */
922: CRYPT_CERTINFO_CMS_SIGTYPEID_REVIEWSIG, /* reviewSig */
923:
924: /* 1 2 840 113549 1 9 25 3 randomNonce */
925: CRYPT_CERTINFO_CMS_NONCE, /* randomNonce */
926:
927: /* SCEP attributes:
928: 2 16 840 1 113733 1 9 2 messageType
929: 2 16 840 1 113733 1 9 3 pkiStatus
930: 2 16 840 1 113733 1 9 4 failInfo
931: 2 16 840 1 113733 1 9 5 senderNonce
932: 2 16 840 1 113733 1 9 6 recipientNonce
933: 2 16 840 1 113733 1 9 7 transID */
934: CRYPT_CERTINFO_SCEP_MESSAGETYPE, /* messageType */
935: CRYPT_CERTINFO_SCEP_PKISTATUS, /* pkiStatus */
936: CRYPT_CERTINFO_SCEP_FAILINFO, /* failInfo */
937: CRYPT_CERTINFO_SCEP_SENDERNONCE, /* senderNonce */
938: CRYPT_CERTINFO_SCEP_RECIPIENTNONCE, /* recipientNonce */
939: CRYPT_CERTINFO_SCEP_TRANSACTIONID, /* transID */
940:
941: /* 1 3 6 1 4 1 311 2 1 10 spcAgencyInfo */
942: CRYPT_CERTINFO_CMS_SPCAGENCYINFO,
943: CRYPT_CERTINFO_CMS_SPCAGENCYURL, /* spcAgencyInfo.url */
944:
945: /* 1 3 6 1 4 1 311 2 1 11 spcStatementType */
946: CRYPT_CERTINFO_CMS_SPCSTATEMENTTYPE,
947: CRYPT_CERTINFO_CMS_SPCSTMT_INDIVIDUALCODESIGNING, /* individualCodeSigning */
948: CRYPT_CERTINFO_CMS_SPCSTMT_COMMERCIALCODESIGNING, /* commercialCodeSigning */
949:
950: /* 1 3 6 1 4 1 311 2 1 12 spcOpusInfo */
951: CRYPT_CERTINFO_CMS_SPCOPUSINFO,
952: CRYPT_CERTINFO_CMS_SPCOPUSINFO_NAME, /* spcOpusInfo.name */
953: CRYPT_CERTINFO_CMS_SPCOPUSINFO_URL, /* spcOpusInfo.url */
954:
955: /* Used internally */
956: CRYPT_CERTINFO_LAST, CRYPT_KEYINFO_FIRST = 3000,
957:
958: /*********************/
959: /* Keyset attributes */
960: /*********************/
961:
962: CRYPT_KEYINFO_QUERY, /* Keyset query */
963: CRYPT_KEYINFO_QUERY_REQUESTS, /* Query of requests in cert store */
964:
965: /* Used internally */
966: CRYPT_KEYINFO_LAST, CRYPT_DEVINFO_FIRST = 4000,
967:
968: /*********************/
969: /* Device attributes */
970: /*********************/
971:
972: CRYPT_DEVINFO_INITIALISE, /* Initialise device for use */
973: CRYPT_DEVINFO_INITIALIZE = CRYPT_DEVINFO_INITIALISE,
974: CRYPT_DEVINFO_AUTHENT_USER, /* Authenticate user to device */
975: CRYPT_DEVINFO_AUTHENT_SUPERVISOR, /* Authenticate supervisor to dev.*/
976: CRYPT_DEVINFO_SET_AUTHENT_USER, /* Set user authent.value */
977: CRYPT_DEVINFO_SET_AUTHENT_SUPERVISOR, /* Set supervisor auth.val.*/
978: CRYPT_DEVINFO_ZEROISE, /* Zeroise device */
979: CRYPT_DEVINFO_ZEROIZE = CRYPT_DEVINFO_ZEROISE,
980: CRYPT_DEVINFO_LOGGEDIN, /* Whether user is logged in */
981: CRYPT_DEVINFO_LABEL, /* Device/token label */
982:
983: /* Used internally */
984: CRYPT_DEVINFO_LAST, CRYPT_ENVINFO_FIRST = 5000,
985:
986: /***********************/
987: /* Envelope attributes */
988: /***********************/
989:
990: /* Pseudo-information on an envelope or meta-information which is used to
991: control the way that data in an envelope is processed */
992: CRYPT_ENVINFO_DATASIZE, /* Data size information */
993: CRYPT_ENVINFO_COMPRESSION, /* Compression information */
994: CRYPT_ENVINFO_CONTENTTYPE, /* Inner CMS content type */
995: CRYPT_ENVINFO_DETACHEDSIGNATURE,/* Generate CMS detached signature */
996: CRYPT_ENVINFO_SIGNATURE_RESULT, /* Signature check result */
997: CRYPT_ENVINFO_MAC, /* Use MAC instead of encrypting */
998:
999: /* Resources required for enveloping/deenveloping */
1000: CRYPT_ENVINFO_PASSWORD, /* User password */
1001: CRYPT_ENVINFO_KEY, /* Conventional encryption key */
1002: CRYPT_ENVINFO_SIGNATURE, /* Signature/signature check key */
1003: CRYPT_ENVINFO_SIGNATURE_EXTRADATA, /* Extra information added to CMS sigs */
1004: CRYPT_ENVINFO_RECIPIENT, /* Recipient email address */
1005: CRYPT_ENVINFO_PUBLICKEY, /* PKC encryption key */
1006: CRYPT_ENVINFO_PRIVATEKEY, /* PKC decryption key */
1007: CRYPT_ENVINFO_PRIVATEKEY_LABEL, /* Label of PKC decryption key */
1008: CRYPT_ENVINFO_ORIGINATOR, /* Originator info/key */
1009: CRYPT_ENVINFO_SESSIONKEY, /* Session key */
1010: CRYPT_ENVINFO_HASH, /* Hash value */
1011: CRYPT_ENVINFO_TIMESTAMP, /* Timestamp information */
1012:
1013: /* Keysets used to retrieve keys needed for enveloping/deenveloping */
1014: CRYPT_ENVINFO_KEYSET_SIGCHECK, /* Signature check keyset */
1015: CRYPT_ENVINFO_KEYSET_ENCRYPT, /* PKC encryption keyset */
1016: CRYPT_ENVINFO_KEYSET_DECRYPT, /* PKC decryption keyset */
1017:
1018: /* Used internally */
1019: CRYPT_ENVINFO_LAST, CRYPT_SESSINFO_FIRST = 6000,
1020:
1021: /**********************/
1022: /* Session attributes */
1023: /**********************/
1024:
1025: /* Pseudo-information about the session */
1026: CRYPT_SESSINFO_ACTIVE, /* Whether session is active */
1027: CRYPT_SESSINFO_CONNECTIONACTIVE,/* Whether network connection is active */
1028:
1029: /* Security-related information */
1030: CRYPT_SESSINFO_USERNAME, /* User name */
1031: CRYPT_SESSINFO_PASSWORD, /* Password */
1032: CRYPT_SESSINFO_PRIVATEKEY, /* Server/client private key */
1033: CRYPT_SESSINFO_KEYSET, /* Certificate store */
1034: CRYPT_SESSINFO_AUTHRESPONSE, /* Session authorisation OK */
1035:
1036: /* Client/server information */
1037: CRYPT_SESSINFO_SERVER_NAME, /* Server name */
1038: CRYPT_SESSINFO_SERVER_PORT, /* Server port number */
1039: CRYPT_SESSINFO_SERVER_FINGERPRINT,/* Server key fingerprint */
1040: CRYPT_SESSINFO_CLIENT_NAME, /* Client name */
1041: CRYPT_SESSINFO_CLIENT_PORT, /* Client port number */
1042: CRYPT_SESSINFO_SESSION, /* Transport mechanism */
1043: CRYPT_SESSINFO_NETWORKSOCKET, /* User-supplied network socket */
1044:
1045: /* Generic protocol-related information */
1046: CRYPT_SESSINFO_VERSION, /* Protocol version */
1047: CRYPT_SESSINFO_REQUEST, /* Cert.request object */
1048: CRYPT_SESSINFO_RESPONSE, /* Cert.response object */
1049: CRYPT_SESSINFO_CACERTIFICATE, /* Issuing CA certificate */
1050:
1051: /* Protocol-specific information */
1052: CRYPT_SESSINFO_TSP_MSGIMPRINT, /* TSP message imprint */
1053: CRYPT_SESSINFO_CMP_REQUESTTYPE, /* Request type */
1054: CRYPT_SESSINFO_CMP_PKIBOOT, /* Enable PKIBoot facility */
1055: CRYPT_SESSINFO_CMP_PRIVKEYSET, /* Private-key keyset */
1056: CRYPT_SESSINFO_SSH_CHANNEL, /* SSH current channel */
1057: CRYPT_SESSINFO_SSH_CHANNEL_TYPE,/* SSH channel type */
1058: CRYPT_SESSINFO_SSH_CHANNEL_ARG1,/* SSH channel argument 1 */
1059: CRYPT_SESSINFO_SSH_CHANNEL_ARG2,/* SSH channel argument 2 */
1060: CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE,/* SSH channel active */
1061:
1062: /* Used internally */
1063: CRYPT_SESSINFO_LAST, CRYPT_USERINFO_FIRST = 7000,
1064:
1065: /**********************/
1066: /* User attributes */
1067: /**********************/
1068:
1069: /* Security-related information */
1070: CRYPT_USERINFO_PASSWORD, /* Password */
1071:
1072: /* User role-related information */
1073: CRYPT_USERINFO_CAKEY_CERTSIGN, /* CA cert signing key */
1074: CRYPT_USERINFO_CAKEY_CRLSIGN, /* CA CRL signing key */
1075: CRYPT_USERINFO_CAKEY_RTCSSIGN, /* CA RTCS signing key */
1076: CRYPT_USERINFO_CAKEY_OCSPSIGN, /* CA OCSP signing key */
1077:
1078: /* Used internally for range checking */
1079: CRYPT_USERINFO_LAST, CRYPT_ATTRIBUTE_LAST = CRYPT_USERINFO_LAST
1080:
1081: #ifdef _CRYPT_DEFINED
1082: /***********************/
1083: /* Internal attributes */
1084: /***********************/
1085:
1086: /* The following attributes are only visible internally and are protected
1087: from any external access by the kernel (and for good measure by checks
1088: in other places as well). The two attributes CRYPT_IATTRIBUTE_KEY_SPKI
1089: and CRYPT_IATTRIBUTE_SPKI are actually the same thing, the difference
1090: is that the former is write-only for contexts and the latter is read-
1091: only for certificates (the former is used when loading a context from
1092: a key contained in a device, where the actual key components aren't
1093: directly available in the context but may be needed in the future for
1094: things like cert requests). Because a single object can act as both a
1095: context and a cert, having two explicitly different attribute names
1096: makes things less confusing. In addition, some public-key attributes
1097: have _PARTIAL variants that load the public-key components but don't
1098: initialise the key/move the context into the high state. This is
1099: used for formats in which public and private-key components are loaded
1100: separately */
1101: , CRYPT_IATTRIBUTE_FIRST = 8000,
1102: CRYPT_IATTRIBUTE_TYPE, /* Object type */
1103: CRYPT_IATTRIBUTE_SUBTYPE, /* Object subtype */
1104: CRYPT_IATTRIBUTE_STATUS, /* Object status */
1105: CRYPT_IATTRIBUTE_INTERNAL, /* Object internal flag */
1106: CRYPT_IATTRIBUTE_ACTIONPERMS, /* Object action permissions */
1107: CRYPT_IATTRIBUTE_LOCKED, /* Object locked for exclusive use */
1108: CRYPT_IATTRIBUTE_INITIALISED, /* Object inited (in high state) */
1.1.1.2 ! root 1109:
! 1110: /* Context internal attributes */
! 1111: CRYPT_IATTRIBUTE_KEYSIZE, /* Key size (written to non-native ctxs) */
! 1112: CRYPT_IATTRIBUTE_KEYFEATURES, /* Key feature info */
! 1113: CRYPT_IATTRIBUTE_KEYID, /* Key ID */
! 1114: CRYPT_IATTRIBUTE_KEYID_PGP, /* PGP key ID */
! 1115: CRYPT_IATTRIBUTE_KEYID_OPENPGP, /* OpenPGP key ID */
! 1116: CRYPT_IATTRIBUTE_KEY_KEADOMAINPARAMS,/* Key agreement domain parameters */
! 1117: CRYPT_IATTRIBUTE_KEY_KEAPUBLICVALUE,/* Key agreement public value */
! 1118: CRYPT_IATTRIBUTE_KEY_SPKI, /* SubjectPublicKeyInfo */
! 1119: CRYPT_IATTRIBUTE_KEY_PGP, /* PGP-format public key */
! 1120: CRYPT_IATTRIBUTE_KEY_SSH, /* SSH-format public key */
! 1121: CRYPT_IATTRIBUTE_KEY_SSH1, /* SSHv1-format public key */
! 1122: CRYPT_IATTRIBUTE_KEY_SSL, /* SSL-format public key */
! 1123: CRYPT_IATTRIBUTE_KEY_SPKI_PARTIAL,/* SubjectPublicKeyInfo w/o trigger */
! 1124: CRYPT_IATTRIBUTE_KEY_PGP_PARTIAL,/* PGP public key w/o trigger */
! 1125: CRYPT_IATTRIBUTE_PGPVALIDITY, /* PGP key validity */
! 1126: CRYPT_IATTRIBUTE_DEVICEOBJECT, /* Device object handle */
! 1127: CRYPT_IATTRIBUTE_EXISTINGLABEL, /* Existing label for object in device */
! 1128:
! 1129: /* Certificate internal attributes */
! 1130: CRYPT_IATTRIBUTE_SUBJECT, /* SubjectName */
! 1131: CRYPT_IATTRIBUTE_ISSUER, /* IssuerName */
! 1132: CRYPT_IATTRIBUTE_ISSUERANDSERIALNUMBER, /* IssuerAndSerial */
! 1133: CRYPT_IATTRIBUTE_HOLDERNAME, /* Best approximation to cert.owner name */
! 1134: CRYPT_IATTRIBUTE_HOLDERURI, /* Best approximation to cert.owner URI */
! 1135: CRYPT_IATTRIBUTE_SPKI, /* Encoded SubjectPublicKeyInfo */
! 1136: CRYPT_IATTRIBUTE_CERTHASHALGO, /* Hash algo.used for cert */
! 1137: CRYPT_IATTRIBUTE_CERTCOLLECTION,/* Certs added to cert chain */
! 1138: CRYPT_IATTRIBUTE_CRLENTRY, /* Individual entry from CRL */
! 1139: CRYPT_IATTRIBUTE_RESPONDERURL, /* RTCS/OCSP responder name */
! 1140: CRYPT_IATTRIBUTE_RTCSREQUEST, /* RTCS req.info added to RTCS resp.*/
! 1141: CRYPT_IATTRIBUTE_OCSPREQUEST, /* OCSP req.info added to OCSP resp.*/
! 1142: CRYPT_IATTRIBUTE_REVREQUEST, /* CRMF rev.request added to CRL */
! 1143: CRYPT_IATTRIBUTE_PKIUSERINFO, /* Additional user info added to cert.req.*/
! 1144: CRYPT_IATTRIBUTE_BLOCKEDATTRS, /* Template of disallowed attrs.in cert */
! 1145: CRYPT_IATTRIBUTE_AUTHCERTID, /* Authorising cert ID for a cert/rev.req.*/
! 1146: CRYPT_IATTRIBUTE_ESSCERTID, /* ESSCertID */
! 1147: CRYPT_IATTRIBUTE_CERTCOPY, /* Copy of cert object */
! 1148: CRYPT_IATTRIBUTE_CERTCOPY_DATAONLY, /* Copy of cert object as data-only cert */
! 1149:
! 1150: /* Device internal attributes */
! 1151: CRYPT_IATTRIBUTE_ENTROPY, /* Polled entropy data */
! 1152: CRYPT_IATTRIBUTE_ENTROPY_QUALITY,/* Quality of entropy data */
! 1153: CRYPT_IATTRIBUTE_RANDOM_LOPICKET,/* Low picket for random data attrs.*/
! 1154: CRYPT_IATTRIBUTE_RANDOM, /* Random data */
! 1155: CRYPT_IATTRIBUTE_RANDOM_NZ, /* Nonzero random data */
! 1156: CRYPT_IATTRIBUTE_RANDOM_HIPICKET,/* High picket for random data attrs.*/
! 1157: CRYPT_IATTRIBUTE_RANDOM_NONCE, /* Basic nonce */
! 1158: CRYPT_IATTRIBUTE_SELFTEST, /* Perform self-test */
! 1159: CRYPT_IATTRIBUTE_TIME, /* Reliable (hardware-based) time value */
! 1160:
! 1161: /* Envelope internal attributes */
! 1162: CRYPT_IATTRIBUTE_INCLUDESIGCERT,/* Whether to include signing cert(s) */
! 1163: CRYPT_IATTRIBUTE_ATTRONLY, /* Signed data contains only CMS attrs.*/
! 1164:
! 1165: /* Keyset internal attributes */
! 1166: CRYPT_IATTRIBUTE_CONFIGDATA, /* Config information */
! 1167: CRYPT_IATTRIBUTE_USERINDEX, /* Index of users */
! 1168: CRYPT_IATTRIBUTE_USERID, /* User ID */
! 1169: CRYPT_IATTRIBUTE_USERINFO, /* User information */
! 1170: CRYPT_IATTRIBUTE_TRUSTEDCERT, /* First trusted cert */
! 1171: CRYPT_IATTRIBUTE_TRUSTEDCERT_NEXT, /* Successive trusted certs */
! 1172:
! 1173: /* Session internal attributes */
! 1174: CRYPT_IATTRIBUTE_ENC_TIMESTAMP, /* Encoded TSA timestamp */
! 1175:
! 1176: /* User internal attributes */
! 1177: CRYPT_IATTRUBUTE_CERTKEYSET, /* Keyset to send trusted certs to */
! 1178: CRYPT_IATTRIBUTE_CTL, /* Cert.trust list */
! 1179: CRYPT_IATTRIBUTE_CERT_TRUSTED, /* Set trusted cert */
! 1180: CRYPT_IATTRIBUTE_CERT_UNTRUSTED,/* Unset trusted cert */
! 1181: CRYPT_IATTRIBUTE_CERT_CHECKTRUST,/* Check trust status of cert */
! 1182: CRYPT_IATTRIBUTE_CERT_TRUSTEDISSUER,/* Get trusted issuer of cert */
1.1 root 1183: CRYPT_IATTRIBUTE_LAST,
1184:
1185: /* Subrange values used internally for range checking */
1186: CRYPT_CERTINFO_FIRST_CERTINFO = CRYPT_CERTINFO_FIRST + 1,
1187: CRYPT_CERTINFO_LAST_CERTINFO = CRYPT_CERTINFO_PKIUSER_REVPASSWORD,
1188: CRYPT_CERTINFO_FIRST_PSEUDOINFO = CRYPT_CERTINFO_SELFSIGNED,
1189: CRYPT_CERTINFO_LAST_PSEUDOINFO = CRYPT_CERTINFO_SIGNATURELEVEL,
1190: CRYPT_CERTINFO_FIRST_NAME = CRYPT_CERTINFO_COUNTRYNAME,
1191: CRYPT_CERTINFO_LAST_NAME = CRYPT_CERTINFO_REGISTEREDID,
1192: CRYPT_CERTINFO_FIRST_DN = CRYPT_CERTINFO_COUNTRYNAME,
1193: CRYPT_CERTINFO_LAST_DN = CRYPT_CERTINFO_COMMONNAME,
1194: CRYPT_CERTINFO_FIRST_GENERALNAME = CRYPT_CERTINFO_OTHERNAME_TYPEID,
1195: CRYPT_CERTINFO_LAST_GENERALNAME = CRYPT_CERTINFO_REGISTEREDID,
1196: CRYPT_CERTINFO_FIRST_EXTENSION = CRYPT_CERTINFO_CHALLENGEPASSWORD,
1197: CRYPT_CERTINFO_LAST_EXTENSION = CRYPT_CERTINFO_SET_TUNNELINGALGID,
1198: CRYPT_CERTINFO_FIRST_CMS = CRYPT_CERTINFO_CMS_CONTENTTYPE,
1199: CRYPT_CERTINFO_LAST_CMS = CRYPT_CERTINFO_LAST - 1,
1200: CRYPT_SESSINFO_FIRST_SPECIFIC = CRYPT_SESSINFO_REQUEST,
1201: CRYPT_SESSINFO_LAST_SPECIFIC = CRYPT_SESSINFO_SSH_CHANNEL_ACTIVE
1202: #endif /* _CRYPT_DEFINED */
1203: } CRYPT_ATTRIBUTE_TYPE;
1204:
1205: /****************************************************************************
1206: * *
1207: * Attribute Subtypes and Related Values *
1208: * *
1209: ****************************************************************************/
1210:
1211: /* Flags for the X.509 keyUsage extension */
1212:
1213: #define CRYPT_KEYUSAGE_NONE 0x000
1214: #define CRYPT_KEYUSAGE_DIGITALSIGNATURE 0x001
1215: #define CRYPT_KEYUSAGE_NONREPUDIATION 0x002
1216: #define CRYPT_KEYUSAGE_KEYENCIPHERMENT 0x004
1217: #define CRYPT_KEYUSAGE_DATAENCIPHERMENT 0x008
1218: #define CRYPT_KEYUSAGE_KEYAGREEMENT 0x010
1219: #define CRYPT_KEYUSAGE_KEYCERTSIGN 0x020
1220: #define CRYPT_KEYUSAGE_CRLSIGN 0x040
1221: #define CRYPT_KEYUSAGE_ENCIPHERONLY 0x080
1222: #define CRYPT_KEYUSAGE_DECIPHERONLY 0x100
1223: #define CRYPT_KEYUSAGE_LAST 0x200 /* Last possible value */
1224:
1225: /* X.509 cRLReason and cryptlib cRLExtReason codes */
1226:
1227: enum { CRYPT_CRLREASON_UNSPECIFIED, CRYPT_CRLREASON_KEYCOMPROMISE,
1228: CRYPT_CRLREASON_CACOMPROMISE, CRYPT_CRLREASON_AFFILIATIONCHANGED,
1229: CRYPT_CRLREASON_SUPERSEDED, CRYPT_CRLREASON_CESSATIONOFOPERATION,
1230: CRYPT_CRLREASON_CERTIFICATEHOLD, CRYPT_CRLREASON_REMOVEFROMCRL = 8,
1231: CRYPT_CRLREASON_PRIVILEGEWITHDRAWN, CRYPT_CRLREASON_AACOMPROMISE,
1232: CRYPT_CRLREASON_LAST, /* End of standard CRL reasons */
1233: CRYPT_CRLREASON_NEVERVALID = 20, CRYPT_CRLEXTREASON_LAST };
1234:
1235: /* X.509 CRL reason flags. These identify the same thing as the cRLReason
1236: codes but allow for multiple reasons to be specified. Note that these
1237: don't follow the X.509 naming since in that scheme the enumerated types
1238: and bitflags have the same names */
1239:
1240: #define CRYPT_CRLREASONFLAG_UNUSED 0x001
1241: #define CRYPT_CRLREASONFLAG_KEYCOMPROMISE 0x002
1242: #define CRYPT_CRLREASONFLAG_CACOMPROMISE 0x004
1243: #define CRYPT_CRLREASONFLAG_AFFILIATIONCHANGED 0x008
1244: #define CRYPT_CRLREASONFLAG_SUPERSEDED 0x010
1245: #define CRYPT_CRLREASONFLAG_CESSATIONOFOPERATION 0x020
1246: #define CRYPT_CRLREASONFLAG_CERTIFICATEHOLD 0x040
1247: #define CRYPT_CRLREASONFLAG_LAST 0x080 /* Last poss.value */
1248:
1249: /* X.509 CRL holdInstruction codes */
1250:
1251: enum { CRYPT_HOLDINSTRUCTION_NONE, CRYPT_HOLDINSTRUCTION_CALLISSUER,
1252: CRYPT_HOLDINSTRUCTION_REJECT, CRYPT_HOLDINSTRUCTION_PICKUPTOKEN,
1253: CRYPT_HOLDINSTRUCTION_LAST };
1254:
1255: /* Certificate checking compliance levels */
1256:
1257: enum { CRYPT_COMPLIANCELEVEL_OBLIVIOUS, CRYPT_COMPLIANCELEVEL_REDUCED,
1258: CRYPT_COMPLIANCELEVEL_STANDARD, CRYPT_COMPLIANCELEVEL_PKIX_PARTIAL,
1259: CRYPT_COMPLIANCELEVEL_PKIX_FULL, CRYPT_COMPLIANCELEVEL_LAST };
1260:
1261: /* Flags for the Netscape netscape-cert-type extension */
1262:
1263: #define CRYPT_NS_CERTTYPE_SSLCLIENT 0x001
1264: #define CRYPT_NS_CERTTYPE_SSLSERVER 0x002
1265: #define CRYPT_NS_CERTTYPE_SMIME 0x004
1266: #define CRYPT_NS_CERTTYPE_OBJECTSIGNING 0x008
1267: #define CRYPT_NS_CERTTYPE_RESERVED 0x010
1268: #define CRYPT_NS_CERTTYPE_SSLCA 0x020
1269: #define CRYPT_NS_CERTTYPE_SMIMECA 0x040
1270: #define CRYPT_NS_CERTTYPE_OBJECTSIGNINGCA 0x080
1271: #define CRYPT_NS_CERTTYPE_LAST 0x100 /* Last possible value */
1272:
1273: /* Flags for the SET certificate-type extension */
1274:
1275: #define CRYPT_SET_CERTTYPE_CARD 0x001
1276: #define CRYPT_SET_CERTTYPE_MER 0x002
1277: #define CRYPT_SET_CERTTYPE_PGWY 0x004
1278: #define CRYPT_SET_CERTTYPE_CCA 0x008
1279: #define CRYPT_SET_CERTTYPE_MCA 0x010
1280: #define CRYPT_SET_CERTTYPE_PCA 0x020
1281: #define CRYPT_SET_CERTTYPE_GCA 0x040
1282: #define CRYPT_SET_CERTTYPE_BCA 0x080
1283: #define CRYPT_SET_CERTTYPE_RCA 0x100
1284: #define CRYPT_SET_CERTTYPE_ACQ 0x200
1285: #define CRYPT_SET_CERTTYPE_LAST 0x400 /* Last possible value */
1286:
1287: /* CMS contentType values */
1288:
1289: typedef enum { CRYPT_CONTENT_NONE, CRYPT_CONTENT_DATA,
1290: CRYPT_CONTENT_SIGNEDDATA, CRYPT_CONTENT_ENVELOPEDDATA,
1291: CRYPT_CONTENT_SIGNEDANDENVELOPEDDATA,
1292: CRYPT_CONTENT_DIGESTEDDATA, CRYPT_CONTENT_ENCRYPTEDDATA,
1293: CRYPT_CONTENT_COMPRESSEDDATA, CRYPT_CONTENT_TSTINFO,
1294: CRYPT_CONTENT_SPCINDIRECTDATACONTEXT,
1295: CRYPT_CONTENT_RTCSREQUEST, CRYPT_CONTENT_RTCSRESPONSE,
1296: CRYPT_CONTENT_RTCSRESPONSE_EXT, CRYPT_CONTENT_LAST
1297: } CRYPT_CONTENT_TYPE;
1298:
1299: /* ESS securityClassification codes */
1300:
1301: enum { CRYPT_CLASSIFICATION_UNMARKED, CRYPT_CLASSIFICATION_UNCLASSIFIED,
1302: CRYPT_CLASSIFICATION_RESTRICTED, CRYPT_CLASSIFICATION_CONFIDENTIAL,
1303: CRYPT_CLASSIFICATION_SECRET, CRYPT_CLASSIFICATION_TOP_SECRET,
1304: CRYPT_CLASSIFICATION_LAST = 255 };
1305:
1306: /* RTCS certificate status */
1307:
1308: enum { CRYPT_CERTSTATUS_VALID, CRYPT_CERTSTATUS_NOTVALID,
1309: CRYPT_CERTSTATUS_NONAUTHORITATIVE, CRYPT_CERTSTATUS_UNKNOWN };
1310:
1311: /* OCSP revocation status */
1312:
1313: enum { CRYPT_OCSPSTATUS_NOTREVOKED, CRYPT_OCSPSTATUS_REVOKED,
1314: CRYPT_OCSPSTATUS_UNKNOWN };
1315:
1316: /* The amount of detail to include in signatures when signing certificate
1317: objects */
1318:
1319: typedef enum {
1320: CRYPT_SIGNATURELEVEL_NONE, /* Include only signature */
1321: CRYPT_SIGNATURELEVEL_SIGNERCERT,/* Include signer cert */
1322: CRYPT_SIGNATURELEVEL_ALL, /* Include all relevant info */
1323: CRYPT_SIGNATURELEVEL_LAST /* Last possible sig.level type */
1324: } CRYPT_SIGNATURELEVEL_TYPE;
1325:
1326: /* The certificate export format type, which defines the format in which a
1327: certificate object is exported */
1328:
1329: typedef enum {
1330: CRYPT_CERTFORMAT_NONE, /* No certificate format */
1331: CRYPT_CERTFORMAT_CERTIFICATE, /* DER-encoded certificate */
1332: CRYPT_CERTFORMAT_CERTCHAIN, /* PKCS #7 certificate chain */
1333: CRYPT_CERTFORMAT_TEXT_CERTIFICATE, /* base-64 wrapped cert */
1334: CRYPT_CERTFORMAT_TEXT_CERTCHAIN, /* base-64 wrapped cert chain */
1335: CRYPT_CERTFORMAT_XML_CERTIFICATE, /* XML wrapped cert */
1336: CRYPT_CERTFORMAT_XML_CERTCHAIN, /* XML wrapped cert chain */
1337: #ifdef _CRYPT_DEFINED
1338: CRYPT_ICERTFORMAT_CERTSET, /* SET OF Certificate */
1339: CRYPT_ICERTFORMAT_CERTSEQUENCE, /* SEQUENCE OF Certificate */
1340: CRYPT_ICERTFORMAT_SSL_CERTCHAIN,/* SSL certificate chain */
1341: CRYPT_ICERTFORMAT_DATA, /* Non-signed object data */
1342: #endif /* CRYPT_DEFINED */
1343: CRYPT_CERTFORMAT_LAST /* Last possible cert.format type */
1344: #ifdef _CRYPT_DEFINED
1345: /* The following is used as an internal format specifier when the format
1346: is autodetected, to tell the base64 decoding code to strip MIME
1347: headers before the base64 data */
1348: , CRYPT_ICERTFORMAT_SMIME_CERTIFICATE,/* S/MIME cert.request or cert chain */
1349: CRYPT_CERTFORMAT_LAST_EXTERNAL = CRYPT_CERTFORMAT_XML_CERTCHAIN + 1
1350: #endif /* _CRYPT_DEFINED */
1351: } CRYPT_CERTFORMAT_TYPE;
1352:
1353: /* CMP request types */
1354:
1355: typedef enum {
1356: CRYPT_REQUESTTYPE_NONE, /* No request type */
1357: CRYPT_REQUESTTYPE_INITIALISATION, /* Initialisation request */
1358: CRYPT_REQUESTTYPE_INITIALIZATION = CRYPT_REQUESTTYPE_INITIALISATION,
1359: CRYPT_REQUESTTYPE_CERTIFICATE, /* Certification request */
1360: CRYPT_REQUESTTYPE_KEYUPDATE, /* Key update request */
1361: CRYPT_REQUESTTYPE_REVOCATION, /* Cert revocation request */
1362: CRYPT_REQUESTTYPE_PKIBOOT, /* PKIBoot request */
1363: CRYPT_REQUESTTYPE_LAST /* Last possible request type */
1364: } CRYPT_REQUESTTYPE_TYPE;
1365:
1366: /* Key ID types */
1367:
1368: typedef enum {
1369: CRYPT_KEYID_NONE, /* No key ID type */
1370: CRYPT_KEYID_NAME, /* Key owner name */
1371: CRYPT_KEYID_URI, /* Key owner URI */
1372: CRYPT_KEYID_EMAIL = CRYPT_KEYID_URI, /* Synonym: owner email addr.*/
1373: #ifdef _CRYPT_DEFINED
1374: /* Internal key ID types */
1375: CRYPT_IKEYID_KEYID, /* SubjectKeyIdentifier/internal ID */
1376: CRYPT_IKEYID_PGPKEYID, /* PGP/OpenPGP key ID */
1377: CRYPT_IKEYID_CERTID, /* Certificate hash */
1378: CRYPT_IKEYID_ISSUERID, /* Hashed issuerAndSerialNumber */
1379: CRYPT_IKEYID_ISSUERANDSERIALNUMBER, /* issuerAndSerialNumber */
1380: #endif /* _CRYPT_DEFINED */
1381: CRYPT_KEYID_LAST /* Last possible key ID type */
1382: #ifdef _CRYPT_DEFINED
1383: , CRYPT_KEYID_LAST_EXTERNAL = CRYPT_KEYID_URI + 1/* Last external key ID */
1384: #endif /* _CRYPT_DEFINED */
1385: } CRYPT_KEYID_TYPE;
1386:
1387: /* The encryption object types */
1388:
1389: typedef enum {
1390: CRYPT_OBJECT_NONE, /* No object type */
1391: CRYPT_OBJECT_ENCRYPTED_KEY, /* Conventionally encrypted key */
1392: CRYPT_OBJECT_PKCENCRYPTED_KEY, /* PKC-encrypted key */
1393: CRYPT_OBJECT_KEYAGREEMENT, /* Key agreement information */
1394: CRYPT_OBJECT_SIGNATURE, /* Signature */
1395: CRYPT_OBJECT_LAST /* Last possible object type */
1396: } CRYPT_OBJECT_TYPE;
1397:
1398: /* Object/attribute error type information */
1399:
1400: typedef enum {
1401: CRYPT_ERRTYPE_NONE, /* No error information */
1402: CRYPT_ERRTYPE_ATTR_SIZE, /* Attribute data too small or large */
1403: CRYPT_ERRTYPE_ATTR_VALUE, /* Attribute value is invalid */
1404: CRYPT_ERRTYPE_ATTR_ABSENT, /* Required attribute missing */
1405: CRYPT_ERRTYPE_ATTR_PRESENT, /* Non-allowed attribute present */
1406: CRYPT_ERRTYPE_CONSTRAINT, /* Cert: Constraint violation in object */
1407: CRYPT_ERRTYPE_ISSUERCONSTRAINT, /* Cert: Constraint viol.in issuing cert */
1408: CRYPT_ERRTYPE_LAST /* Last possible error info type */
1409: } CRYPT_ERRTYPE_TYPE;
1410:
1411: /* Cert store management action type */
1412:
1413: typedef enum {
1414: CRYPT_CERTACTION_NONE, /* No cert management action */
1415: CRYPT_CERTACTION_CREATE, /* Create cert store */
1416: CRYPT_CERTACTION_CONNECT, /* Connect to cert store */
1417: CRYPT_CERTACTION_DISCONNECT, /* Disconnect from cert store */
1418: CRYPT_CERTACTION_ERROR, /* Error information */
1419: CRYPT_CERTACTION_ADDUSER, /* Add PKI user */
1420: CRYPT_CERTACTION_DELETEUSER, /* Delete PKI user */
1421: CRYPT_CERTACTION_REQUEST_CERT, /* Cert request */
1422: CRYPT_CERTACTION_REQUEST_RENEWAL,/* Cert renewal request */
1423: CRYPT_CERTACTION_REQUEST_REVOCATION,/* Cert revocation request */
1424: CRYPT_CERTACTION_CERT_CREATION, /* Cert creation */
1425: CRYPT_CERTACTION_CERT_CREATION_COMPLETE,/* Confirmation of cert creation */
1426: CRYPT_CERTACTION_CERT_CREATION_DROP, /* Cancellation of cert creation */
1427: CRYPT_CERTACTION_CERT_CREATION_REVERSE, /* Cancel of creation w.revocation */
1428: CRYPT_CERTACTION_RESTART_CLEANUP, /* Delete reqs after restart */
1429: CRYPT_CERTACTION_RESTART_REVOKE_CERT, /* Complete revocation after restart */
1430: CRYPT_CERTACTION_ISSUE_CERT, /* Cert issue */
1431: CRYPT_CERTACTION_ISSUE_CRL, /* CRL issue */
1432: CRYPT_CERTACTION_REVOKE_CERT, /* Cert revocation */
1433: CRYPT_CERTACTION_EXPIRE_CERT, /* Cert expiry */
1434: CRYPT_CERTACTION_CLEANUP, /* Clean up on restart */
1435: CRYPT_CERTACTION_LAST /* Last possible cert store log action */
1436: #ifdef _CRYPT_DEFINED
1437: /* User-settable action types for cert mgmt.actions */
1438: , CRYPT_CERTACTION_FIRST_USER = CRYPT_CERTACTION_ISSUE_CERT,
1439: CRYPT_CERTACTION_LAST_USER = CRYPT_CERTACTION_CLEANUP
1440: #endif /* _CRYPT_DEFINED */
1441: } CRYPT_CERTACTION_TYPE;
1442:
1443: /****************************************************************************
1444: * *
1445: * General Constants *
1446: * *
1447: ****************************************************************************/
1448:
1449: /* The maximum user key size - 2048 bits */
1450:
1451: #define CRYPT_MAX_KEYSIZE 256
1452:
1453: /* The maximum IV size - 256 bits */
1454:
1455: #define CRYPT_MAX_IVSIZE 32
1456:
1.1.1.2 ! root 1457: /* The maximum public-key component size - 4096 bits, and maximum component
! 1458: size for ECCs - 256 bits */
1.1 root 1459:
1460: #define CRYPT_MAX_PKCSIZE 512
1.1.1.2 ! root 1461: #define CRYPT_MAX_PKCSIZE_ECC 32
1.1 root 1462:
1463: /* The maximum hash size - 256 bits */
1464:
1465: #define CRYPT_MAX_HASHSIZE 32
1466:
1467: /* The maximum size of a text string (e.g.key owner name) */
1468:
1469: #define CRYPT_MAX_TEXTSIZE 64
1470:
1471: /* A magic value indicating that the default setting for this parameter
1472: should be used */
1473:
1474: #define CRYPT_USE_DEFAULT -100
1475:
1476: /* A magic value for unused parameters */
1477:
1478: #define CRYPT_UNUSED -101
1479:
1480: /* Cursor positioning codes for certificate/CRL extensions */
1481:
1482: #define CRYPT_CURSOR_FIRST -200
1483: #define CRYPT_CURSOR_PREVIOUS -201
1484: #define CRYPT_CURSOR_NEXT -202
1485: #define CRYPT_CURSOR_LAST -203
1486:
1487: /* The type of information polling to perform to get random seed
1488: information. These values have to be negative because they're used
1489: as magic length values for cryptAddRandom() */
1490:
1491: #define CRYPT_RANDOM_FASTPOLL -300
1492: #define CRYPT_RANDOM_SLOWPOLL -301
1493:
1494: /* Whether the PKC key is a public or private key */
1495:
1496: #define CRYPT_KEYTYPE_PRIVATE 0
1497: #define CRYPT_KEYTYPE_PUBLIC 1
1498:
1499: /* Keyset open options */
1500:
1501: typedef enum {
1502: CRYPT_KEYOPT_NONE, /* No options */
1503: CRYPT_KEYOPT_READONLY, /* Open keyset in read-only mode */
1504: CRYPT_KEYOPT_CREATE, /* Create a new keyset */
1505: #ifdef _CRYPT_DEFINED
1506: /* Internal keyset options */
1507: CRYPT_IKEYOPT_EXCLUSIVEACCESS, /* As _NONE but open for exclusive access */
1508: #endif /* _CRYPT_DEFINED */
1509: CRYPT_KEYOPT_LAST /* Last possible key option type */
1510: #ifdef _CRYPT_DEFINED
1511: , CRYPT_KEYOPT_LAST_EXTERNAL = CRYPT_KEYOPT_CREATE + 1
1512: /* Last external keyset option */
1513: #endif /* _CRYPT_DEFINED */
1514: } CRYPT_KEYOPT_TYPE;
1515:
1516: /* The various cryptlib objects - these are just integer handles */
1517:
1518: typedef int CRYPT_CERTIFICATE;
1519: typedef int CRYPT_CONTEXT;
1520: typedef int CRYPT_DEVICE;
1521: typedef int CRYPT_ENVELOPE;
1522: typedef int CRYPT_KEYSET;
1523: typedef int CRYPT_SESSION;
1524: typedef int CRYPT_USER;
1525:
1526: /* Sometimes we don't know the exact type of a cryptlib object, so we use a
1527: generic handle type to identify it */
1528:
1529: typedef int CRYPT_HANDLE;
1530:
1531: /****************************************************************************
1532: * *
1533: * Encryption Data Structures *
1534: * *
1535: ****************************************************************************/
1536:
1537: /* Results returned from the capability query */
1538:
1539: typedef struct {
1540: /* Algorithm information */
1541: C_CHR algoName[ CRYPT_MAX_TEXTSIZE ];/* Algorithm name */
1542: int blockSize; /* Block size of the algorithm */
1543: int minKeySize; /* Minimum key size in bytes */
1544: int keySize; /* Recommended key size in bytes */
1545: int maxKeySize; /* Maximum key size in bytes */
1546: } CRYPT_QUERY_INFO;
1547:
1548: /* Results returned from the encoded object query. These provide
1549: information on the objects created by cryptExportKey()/
1550: cryptCreateSignature() */
1551:
1552: typedef struct {
1553: /* The object type */
1554: CRYPT_OBJECT_TYPE objectType;
1555:
1556: /* The encryption algorithm and mode */
1557: CRYPT_ALGO_TYPE cryptAlgo;
1558: CRYPT_MODE_TYPE cryptMode;
1559:
1560: /* The hash algorithm for Signature objects */
1561: CRYPT_ALGO_TYPE hashAlgo;
1562:
1563: /* The salt for derived keys */
1564: unsigned char salt[ CRYPT_MAX_HASHSIZE ];
1565: int saltSize;
1566: } CRYPT_OBJECT_INFO;
1567:
1568: /* Key information for the public-key encryption algorithms. These fields
1569: are not accessed directly, but can be manipulated with the init/set/
1570: destroyComponents() macros */
1571:
1572: typedef struct {
1573: /* Status information */
1574: int isPublicKey; /* Whether this is a public or private key */
1575:
1576: /* Public components */
1577: unsigned char n[ CRYPT_MAX_PKCSIZE ]; /* Modulus */
1578: int nLen; /* Length of modulus in bits */
1579: unsigned char e[ CRYPT_MAX_PKCSIZE ]; /* Public exponent */
1580: int eLen; /* Length of public exponent in bits */
1581:
1582: /* Private components */
1583: unsigned char d[ CRYPT_MAX_PKCSIZE ]; /* Private exponent */
1584: int dLen; /* Length of private exponent in bits */
1585: unsigned char p[ CRYPT_MAX_PKCSIZE ]; /* Prime factor 1 */
1586: int pLen; /* Length of prime factor 1 in bits */
1587: unsigned char q[ CRYPT_MAX_PKCSIZE ]; /* Prime factor 2 */
1588: int qLen; /* Length of prime factor 2 in bits */
1589: unsigned char u[ CRYPT_MAX_PKCSIZE ]; /* Mult.inverse of q, mod p */
1590: int uLen; /* Length of private exponent in bits */
1591: unsigned char e1[ CRYPT_MAX_PKCSIZE ]; /* Private exponent 1 (PKCS) */
1592: int e1Len; /* Length of private exponent in bits */
1593: unsigned char e2[ CRYPT_MAX_PKCSIZE ]; /* Private exponent 2 (PKCS) */
1594: int e2Len; /* Length of private exponent in bits */
1595: } CRYPT_PKCINFO_RSA;
1596:
1597: typedef struct {
1598: /* Status information */
1599: int isPublicKey; /* Whether this is a public or private key */
1600:
1601: /* Public components */
1602: unsigned char p[ CRYPT_MAX_PKCSIZE ]; /* Prime modulus */
1603: int pLen; /* Length of prime modulus in bits */
1604: unsigned char q[ CRYPT_MAX_PKCSIZE ]; /* Prime divisor */
1605: int qLen; /* Length of prime divisor in bits */
1606: unsigned char g[ CRYPT_MAX_PKCSIZE ]; /* h^( ( p - 1 ) / q ) mod p */
1607: int gLen; /* Length of g in bits */
1608: unsigned char y[ CRYPT_MAX_PKCSIZE ]; /* Public random integer */
1609: int yLen; /* Length of public integer in bits */
1610:
1611: /* Private components */
1612: unsigned char x[ CRYPT_MAX_PKCSIZE ]; /* Private random integer */
1613: int xLen; /* Length of private integer in bits */
1614: } CRYPT_PKCINFO_DLP;
1615:
1.1.1.2 ! root 1616: typedef struct {
! 1617: /* Status information */
! 1618: int isPublicKey; /* Whether this is a public or private key */
! 1619:
! 1620: /* Curve */
! 1621: unsigned char p[ CRYPT_MAX_PKCSIZE_ECC ];/* Prime defining Fq */
! 1622: int pLen; /* Length of prime in bits */
! 1623: unsigned char a[ CRYPT_MAX_PKCSIZE_ECC ];/* Element in Fq defining curve */
! 1624: int aLen; /* Length of element a in bits */
! 1625: unsigned char b[ CRYPT_MAX_PKCSIZE_ECC ];/* Element in Fq defining curve */
! 1626: int bLen; /* Length of element b in bits */
! 1627:
! 1628: /* Generator */
! 1629: unsigned char gx[ CRYPT_MAX_PKCSIZE_ECC ];/* Element in Fq defining point */
! 1630: int gxLen; /* Length of element gx in bits */
! 1631: unsigned char gy[ CRYPT_MAX_PKCSIZE_ECC ];/* Element in Fq defining point */
! 1632: int gyLen; /* Length of element gy in bits */
! 1633: unsigned char r[ CRYPT_MAX_PKCSIZE_ECC ];/* Order of point */
! 1634: int rLen; /* Length of order in bits */
! 1635: unsigned char h[ CRYPT_MAX_PKCSIZE_ECC ];/* Optional cofactor */
! 1636: int hLen; /* Length of cofactor in bits */
! 1637:
! 1638: /* Public components */
! 1639: unsigned char qx[ CRYPT_MAX_PKCSIZE_ECC ];/* Point Q on the curve */
! 1640: int qxLen; /* Length of point xq in bits */
! 1641: unsigned char qy[ CRYPT_MAX_PKCSIZE_ECC ];/* Point Q on the curve */
! 1642: int qyLen; /* Length of point xy in bits */
! 1643:
! 1644: /* Private components */
! 1645: unsigned char d[ CRYPT_MAX_PKCSIZE_ECC ];/* Random integer */
! 1646: int dLen; /* Length of integer in bits */
! 1647: } CRYPT_PKCINFO_ECC;
! 1648:
1.1 root 1649: /* Macros to initialise and destroy the structure that stores the components
1650: of a public key */
1651:
1652: #define cryptInitComponents( componentInfo, componentKeyType ) \
1653: { memset( ( componentInfo ), 0, sizeof( *componentInfo ) ); \
1654: ( componentInfo )->isPublicKey = ( ( componentKeyType ) ? 1 : 0 ); }
1655:
1656: #define cryptDestroyComponents( componentInfo ) \
1657: memset( ( componentInfo ), 0, sizeof( *componentInfo ) )
1658:
1659: /* Macros to set a component of a public key */
1660:
1661: #define cryptSetComponent( destination, source, length ) \
1662: { memcpy( ( destination ), ( source ), ( ( length ) + 7 ) >> 3 ); \
1663: ( destination##Len ) = length; }
1664:
1665: /****************************************************************************
1666: * *
1667: * Status Codes *
1668: * *
1669: ****************************************************************************/
1670:
1671: /* No error in function call */
1672:
1673: #define CRYPT_OK 0 /* No error */
1674:
1675: /* Error in parameters passed to function */
1676:
1677: #define CRYPT_ERROR_PARAM1 -1 /* Bad argument, parameter 1 */
1678: #define CRYPT_ERROR_PARAM2 -2 /* Bad argument, parameter 2 */
1679: #define CRYPT_ERROR_PARAM3 -3 /* Bad argument, parameter 3 */
1680: #define CRYPT_ERROR_PARAM4 -4 /* Bad argument, parameter 4 */
1681: #define CRYPT_ERROR_PARAM5 -5 /* Bad argument, parameter 5 */
1682: #define CRYPT_ERROR_PARAM6 -6 /* Bad argument, parameter 6 */
1683: #define CRYPT_ERROR_PARAM7 -7 /* Bad argument, parameter 7 */
1684:
1685: /* Errors due to insufficient resources */
1686:
1687: #define CRYPT_ERROR_MEMORY -10 /* Out of memory */
1688: #define CRYPT_ERROR_NOTINITED -11 /* Data has not been initialised */
1689: #define CRYPT_ERROR_INITED -12 /* Data has already been init'd */
1690: #define CRYPT_ERROR_NOSECURE -13 /* Opn.not avail.at requested sec.level */
1691: #define CRYPT_ERROR_RANDOM -14 /* No reliable random data available */
1692: #define CRYPT_ERROR_FAILED -15 /* Operation failed */
1693: #define CRYPT_ERROR_INTERNAL -16 /* Internal consistency check failed */
1694:
1695: /* Security violations */
1696:
1697: #define CRYPT_ERROR_NOTAVAIL -20 /* This type of opn.not available */
1698: #define CRYPT_ERROR_PERMISSION -21 /* No permiss.to perform this operation */
1699: #define CRYPT_ERROR_WRONGKEY -22 /* Incorrect key used to decrypt data */
1700: #define CRYPT_ERROR_INCOMPLETE -23 /* Operation incomplete/still in progress */
1701: #define CRYPT_ERROR_COMPLETE -24 /* Operation complete/can't continue */
1702: #define CRYPT_ERROR_TIMEOUT -25 /* Operation timed out before completion */
1703: #define CRYPT_ERROR_INVALID -26 /* Invalid/inconsistent information */
1704: #define CRYPT_ERROR_SIGNALLED -27 /* Resource destroyed by extnl.event */
1705:
1706: /* High-level function errors */
1707:
1708: #define CRYPT_ERROR_OVERFLOW -30 /* Resources/space exhausted */
1709: #define CRYPT_ERROR_UNDERFLOW -31 /* Not enough data available */
1710: #define CRYPT_ERROR_BADDATA -32 /* Bad/unrecognised data format */
1711: #define CRYPT_ERROR_SIGNATURE -33 /* Signature/integrity check failed */
1712:
1713: /* Data access function errors */
1714:
1715: #define CRYPT_ERROR_OPEN -40 /* Cannot open object */
1716: #define CRYPT_ERROR_READ -41 /* Cannot read item from object */
1717: #define CRYPT_ERROR_WRITE -42 /* Cannot write item to object */
1718: #define CRYPT_ERROR_NOTFOUND -43 /* Requested item not found in object */
1719: #define CRYPT_ERROR_DUPLICATE -44 /* Item already present in object */
1720:
1721: /* Data enveloping errors */
1722:
1723: #define CRYPT_ENVELOPE_RESOURCE -50 /* Need resource to proceed */
1724:
1725: /* Macros to examine return values */
1726:
1727: #define cryptStatusError( status ) ( ( status ) < CRYPT_OK )
1728: #define cryptStatusOK( status ) ( ( status ) == CRYPT_OK )
1729:
1730: /****************************************************************************
1731: * *
1732: * General Functions *
1733: * *
1734: ****************************************************************************/
1735:
1736: /* The following is necessary to stop C++ name mangling */
1737:
1738: #ifdef __cplusplus
1739: extern "C" {
1740: #endif /* __cplusplus */
1741:
1742: /* Initialise and shut down cryptlib */
1743:
1744: C_RET cryptInit( void );
1745: C_RET cryptEnd( void );
1746:
1747: /* Query cryptlibs capabilities */
1748:
1749: C_RET cryptQueryCapability( C_IN CRYPT_ALGO_TYPE cryptAlgo,
1750: C_OUT CRYPT_QUERY_INFO C_PTR cryptQueryInfo );
1751:
1752: /* Create and destroy an encryption context */
1753:
1754: C_RET cryptCreateContext( C_OUT CRYPT_CONTEXT C_PTR cryptContext,
1755: C_IN CRYPT_USER cryptUser,
1756: C_IN CRYPT_ALGO_TYPE cryptAlgo );
1757: C_RET cryptDestroyContext( C_IN CRYPT_CONTEXT cryptContext );
1758:
1759: /* Generic "destroy an object" function */
1760:
1761: C_RET cryptDestroyObject( C_IN CRYPT_HANDLE cryptObject );
1762:
1763: /* Generate a key into a context */
1764:
1765: C_RET cryptGenerateKey( C_IN CRYPT_CONTEXT cryptContext );
1766: C_RET cryptGenerateKeyAsync( C_IN CRYPT_CONTEXT cryptContext );
1767: C_RET cryptAsyncQuery( C_IN CRYPT_HANDLE cryptObject );
1768: C_RET cryptAsyncCancel( C_IN CRYPT_HANDLE cryptObject );
1769:
1770: /* Encrypt/decrypt/hash a block of memory */
1771:
1772: C_RET cryptEncrypt( C_IN CRYPT_CONTEXT cryptContext, C_INOUT void C_PTR buffer,
1773: C_IN int length );
1774: C_RET cryptDecrypt( C_IN CRYPT_CONTEXT cryptContext, C_INOUT void C_PTR buffer,
1775: C_IN int length );
1776:
1777: /* Get/set/delete attribute functions */
1778:
1779: C_RET cryptSetAttribute( C_IN CRYPT_HANDLE cryptHandle,
1780: C_IN CRYPT_ATTRIBUTE_TYPE attributeType,
1781: C_IN int value );
1782: C_RET cryptSetAttributeString( C_IN CRYPT_HANDLE cryptHandle,
1783: C_IN CRYPT_ATTRIBUTE_TYPE attributeType,
1784: C_IN void C_PTR value, C_IN int valueLength );
1785: C_RET cryptGetAttribute( C_IN CRYPT_HANDLE cryptHandle,
1786: C_IN CRYPT_ATTRIBUTE_TYPE attributeType,
1787: C_OUT int C_PTR value );
1788: C_RET cryptGetAttributeString( C_IN CRYPT_HANDLE cryptHandle,
1789: C_IN CRYPT_ATTRIBUTE_TYPE attributeType,
1790: C_OUT void C_PTR value,
1791: C_OUT int C_PTR valueLength );
1792: C_RET cryptDeleteAttribute( C_IN CRYPT_HANDLE cryptHandle,
1793: C_IN CRYPT_ATTRIBUTE_TYPE attributeType );
1794:
1795: /* Oddball functions: Add random data to the pool, query an encoded signature
1796: or key data. These are due to be replaced once a suitable alternative can
1797: be found */
1798:
1799: C_RET cryptAddRandom( C_IN void C_PTR randomData, C_IN int randomDataLength );
1800: C_RET cryptQueryObject( C_IN void C_PTR objectData,
1801: C_IN int objectDataLength,
1802: C_OUT CRYPT_OBJECT_INFO C_PTR cryptObjectInfo );
1803:
1804: /****************************************************************************
1805: * *
1806: * Mid-level Encryption Functions *
1807: * *
1808: ****************************************************************************/
1809:
1810: /* Export and import an encrypted session key */
1811:
1812: C_RET cryptExportKey( C_OUT void C_PTR encryptedKey,
1813: C_IN int encryptedKeyMaxLength,
1814: C_OUT int C_PTR encryptedKeyLength,
1815: C_IN CRYPT_HANDLE exportKey,
1816: C_IN CRYPT_CONTEXT sessionKeyContext );
1817: C_RET cryptExportKeyEx( C_OUT void C_PTR encryptedKey,
1818: C_IN int encryptedKeyMaxLength,
1819: C_OUT int C_PTR encryptedKeyLength,
1820: C_IN CRYPT_FORMAT_TYPE formatType,
1821: C_IN CRYPT_HANDLE exportKey,
1822: C_IN CRYPT_CONTEXT sessionKeyContext );
1823: C_RET cryptImportKey( C_IN void C_PTR encryptedKey,
1824: C_IN int encryptedKeyLength,
1825: C_IN CRYPT_CONTEXT importKey,
1826: C_IN CRYPT_CONTEXT sessionKeyContext );
1827: C_RET cryptImportKeyEx( C_IN void C_PTR encryptedKey,
1828: C_IN int encryptedKeyLength,
1829: C_IN CRYPT_CONTEXT importKey,
1830: C_IN CRYPT_CONTEXT sessionKeyContext,
1831: C_OUT CRYPT_CONTEXT C_PTR returnedContext );
1832:
1833: /* Create and check a digital signature */
1834:
1835: C_RET cryptCreateSignature( C_OUT void C_PTR signature,
1836: C_IN int signatureMaxLength,
1837: C_OUT int C_PTR signatureLength,
1838: C_IN CRYPT_CONTEXT signContext,
1839: C_IN CRYPT_CONTEXT hashContext );
1840: C_RET cryptCreateSignatureEx( C_OUT void C_PTR signature,
1841: C_IN int signatureMaxLength,
1842: C_OUT int C_PTR signatureLength,
1843: C_IN CRYPT_FORMAT_TYPE formatType,
1844: C_IN CRYPT_CONTEXT signContext,
1845: C_IN CRYPT_CONTEXT hashContext,
1846: C_IN CRYPT_CERTIFICATE extraData );
1847: C_RET cryptCheckSignature( C_IN void C_PTR signature,
1848: C_IN int signatureLength,
1849: C_IN CRYPT_HANDLE sigCheckKey,
1850: C_IN CRYPT_CONTEXT hashContext );
1851: C_RET cryptCheckSignatureEx( C_IN void C_PTR signature,
1852: C_IN int signatureLength,
1853: C_IN CRYPT_HANDLE sigCheckKey,
1854: C_IN CRYPT_CONTEXT hashContext,
1855: C_OUT CRYPT_HANDLE C_PTR extraData );
1856:
1857: /****************************************************************************
1858: * *
1859: * Keyset Functions *
1860: * *
1861: ****************************************************************************/
1862:
1863: /* Open and close a keyset */
1864:
1865: C_RET cryptKeysetOpen( C_OUT CRYPT_KEYSET C_PTR keyset,
1866: C_IN CRYPT_USER cryptUser,
1867: C_IN CRYPT_KEYSET_TYPE keysetType,
1868: C_IN C_STR name, C_IN CRYPT_KEYOPT_TYPE options );
1869: C_RET cryptKeysetClose( C_IN CRYPT_KEYSET keyset );
1870:
1.1.1.2 ! root 1871: /* Get a key from a keyset or device */
1.1 root 1872:
1873: C_RET cryptGetPublicKey( C_IN CRYPT_KEYSET keyset,
1874: C_OUT CRYPT_CONTEXT C_PTR cryptContext,
1875: C_IN CRYPT_KEYID_TYPE keyIDtype,
1876: C_IN C_STR keyID );
1877: C_RET cryptGetPrivateKey( C_IN CRYPT_KEYSET keyset,
1878: C_OUT CRYPT_CONTEXT C_PTR cryptContext,
1879: C_IN CRYPT_KEYID_TYPE keyIDtype,
1880: C_IN C_STR keyID, C_IN C_STR password );
1.1.1.2 ! root 1881: C_RET cryptGetKey( C_IN CRYPT_KEYSET keyset,
! 1882: C_OUT CRYPT_CONTEXT C_PTR cryptContext,
! 1883: C_IN CRYPT_KEYID_TYPE keyIDtype, C_IN C_STR keyID,
! 1884: C_IN C_STR password );
1.1 root 1885:
1.1.1.2 ! root 1886: /* Add/delete a key to/from a keyset or device */
1.1 root 1887:
1888: C_RET cryptAddPublicKey( C_IN CRYPT_KEYSET keyset,
1889: C_IN CRYPT_CERTIFICATE certificate );
1890: C_RET cryptAddPrivateKey( C_IN CRYPT_KEYSET keyset,
1891: C_IN CRYPT_HANDLE cryptKey,
1892: C_IN C_STR password );
1893: C_RET cryptDeleteKey( C_IN CRYPT_KEYSET keyset,
1894: C_IN CRYPT_KEYID_TYPE keyIDtype,
1895: C_IN C_STR keyID );
1896:
1897: /****************************************************************************
1898: * *
1899: * Certificate Functions *
1900: * *
1901: ****************************************************************************/
1902:
1903: /* Create/destroy a certificate */
1904:
1905: C_RET cryptCreateCert( C_OUT CRYPT_CERTIFICATE C_PTR certificate,
1906: C_IN CRYPT_USER cryptUser,
1907: C_IN CRYPT_CERTTYPE_TYPE certType );
1908: C_RET cryptDestroyCert( C_IN CRYPT_CERTIFICATE certificate );
1909:
1910: /* Get/add/delete certificate extensions. These are direct data insertion
1911: functions whose use is discouraged, so they fix the string at char *
1912: rather than C_STR */
1913:
1914: C_RET cryptGetCertExtension( C_IN CRYPT_CERTIFICATE certificate,
1915: C_IN char C_PTR oid,
1916: C_OUT int C_PTR criticalFlag,
1917: C_OUT void C_PTR extension,
1918: C_IN int extensionMaxLength,
1919: C_OUT int C_PTR extensionLength );
1920: C_RET cryptAddCertExtension( C_IN CRYPT_CERTIFICATE certificate,
1921: C_IN char C_PTR oid, C_IN int criticalFlag,
1922: C_IN void C_PTR extension,
1923: C_IN int extensionLength );
1924: C_RET cryptDeleteCertExtension( C_IN CRYPT_CERTIFICATE certificate,
1925: C_IN char C_PTR oid );
1926:
1927: /* Sign/sig.check a certificate/certification request */
1928:
1929: C_RET cryptSignCert( C_IN CRYPT_CERTIFICATE certificate,
1930: C_IN CRYPT_CONTEXT signContext );
1931: C_RET cryptCheckCert( C_IN CRYPT_CERTIFICATE certificate,
1932: C_IN CRYPT_HANDLE sigCheckKey );
1933:
1934: /* Import/export a certificate/certification request */
1935:
1936: C_RET cryptImportCert( C_IN void C_PTR certObject,
1937: C_IN int certObjectLength,
1938: C_IN CRYPT_USER cryptUser,
1939: C_OUT CRYPT_CERTIFICATE C_PTR certificate );
1940: C_RET cryptExportCert( C_OUT void C_PTR certObject,
1941: C_IN int certObjectMaxLength,
1942: C_OUT int C_PTR certObjectLength,
1943: C_IN CRYPT_CERTFORMAT_TYPE certFormatType,
1944: C_IN CRYPT_CERTIFICATE certificate );
1945:
1946: /* CA management functions */
1947:
1948: C_RET cryptCAAddItem( C_IN CRYPT_KEYSET keyset,
1949: C_IN CRYPT_CERTIFICATE certificate );
1950: C_RET cryptCAGetItem( C_IN CRYPT_KEYSET keyset,
1951: C_OUT CRYPT_CERTIFICATE C_PTR certificate,
1952: C_IN CRYPT_CERTTYPE_TYPE certType,
1953: C_IN CRYPT_KEYID_TYPE keyIDtype,
1954: C_IN C_STR keyID );
1955: C_RET cryptCADeleteItem( C_IN CRYPT_KEYSET keyset,
1956: C_IN CRYPT_CERTTYPE_TYPE certType,
1957: C_IN CRYPT_KEYID_TYPE keyIDtype,
1958: C_IN C_STR keyID );
1959: C_RET cryptCACertManagement( C_OUT CRYPT_CERTIFICATE C_PTR certificate,
1960: C_IN CRYPT_CERTACTION_TYPE action,
1961: C_IN CRYPT_KEYSET keyset,
1962: C_IN CRYPT_CONTEXT caKey,
1963: C_IN CRYPT_CERTIFICATE certRequest );
1964:
1965: /****************************************************************************
1966: * *
1967: * Envelope and Session Functions *
1968: * *
1969: ****************************************************************************/
1970:
1971: /* Create/destroy an envelope */
1972:
1973: C_RET cryptCreateEnvelope( C_OUT CRYPT_ENVELOPE C_PTR envelope,
1974: C_IN CRYPT_USER cryptUser,
1975: C_IN CRYPT_FORMAT_TYPE formatType );
1976: C_RET cryptDestroyEnvelope( C_IN CRYPT_ENVELOPE envelope );
1977:
1978: /* Create/destroy a session */
1979:
1980: C_RET cryptCreateSession( C_OUT CRYPT_SESSION C_PTR session,
1981: C_IN CRYPT_USER cryptUser,
1982: C_IN CRYPT_SESSION_TYPE formatType );
1983: C_RET cryptDestroySession( C_IN CRYPT_SESSION session );
1984:
1985: /* Add/remove data to/from and envelope or session */
1986:
1987: C_RET cryptPushData( C_IN CRYPT_HANDLE envelope, C_IN void C_PTR buffer,
1988: C_IN int length, C_OUT int C_PTR bytesCopied );
1989: C_RET cryptFlushData( C_IN CRYPT_HANDLE envelope );
1990: C_RET cryptPopData( C_IN CRYPT_HANDLE envelope, C_OUT void C_PTR buffer,
1991: C_IN int length, C_OUT int C_PTR bytesCopied );
1992:
1993: /****************************************************************************
1994: * *
1995: * Device Functions *
1996: * *
1997: ****************************************************************************/
1998:
1999: /* Open and close a device */
2000:
2001: C_RET cryptDeviceOpen( C_OUT CRYPT_DEVICE C_PTR device,
2002: C_IN CRYPT_USER cryptUser,
2003: C_IN CRYPT_DEVICE_TYPE deviceType,
2004: C_IN C_STR name );
2005: C_RET cryptDeviceClose( C_IN CRYPT_DEVICE device );
2006:
2007: /* Query a devices capabilities */
2008:
2009: C_RET cryptDeviceQueryCapability( C_IN CRYPT_DEVICE device,
2010: C_IN CRYPT_ALGO_TYPE cryptAlgo,
2011: C_OUT CRYPT_QUERY_INFO C_PTR cryptQueryInfo );
2012:
2013: /* Create an encryption context via the device */
2014:
2015: C_RET cryptDeviceCreateContext( C_IN CRYPT_DEVICE device,
2016: C_OUT CRYPT_CONTEXT C_PTR cryptContext,
2017: C_IN CRYPT_ALGO_TYPE cryptAlgo );
2018:
2019: /****************************************************************************
2020: * *
2021: * User Management Functions *
2022: * *
2023: ****************************************************************************/
2024:
2025: /* Log on and off (create/destroy a user object) */
2026:
2027: C_RET cryptLogin( C_OUT CRYPT_USER C_PTR user,
2028: C_IN C_STR name, C_IN C_STR password );
2029: C_RET cryptLogout( C_IN CRYPT_USER user );
2030:
2031: #if ( defined( WIN32 ) || defined( _WIN32 ) || defined( __WIN32__ ) ) && \
2032: !( defined( _SCCTK ) || defined( _CVI_ ) )
2033:
2034: /****************************************************************************
2035: * *
2036: * User Interface Functions *
2037: * *
2038: ****************************************************************************/
2039:
2040: /* User interface functions, only available under Win32 */
2041:
2042: C_RET cryptUIGenerateKey( C_IN CRYPT_DEVICE cryptDevice,
2043: C_OUT CRYPT_CONTEXT C_PTR cryptContext,
2044: C_IN CRYPT_CERTIFICATE cryptCert,
2045: C_OUT char C_PTR password, C_IN HWND hWnd );
2046: C_RET cryptUIDisplayCert( C_IN CRYPT_CERTIFICATE cryptCert,
2047: C_IN HWND hWnd );
2048:
2049: #endif /* Win32 */
2050:
2051: #ifdef __cplusplus
2052: }
2053: #endif /* __cplusplus */
2054:
2055: #endif /* _CRYPTLIB_DEFINED */
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.