1  /*
   2   * Copyright (c) 2000-2001,2011-2012,2014 Apple Inc. All Rights Reserved.
   3   * 
   4   * The contents of this file constitute Original Code as defined in and are
   5   * subject to the Apple Public Source License Version 1.2 (the 'License').
   6   * You may not use this file except in compliance with the License. Please obtain
   7   * a copy of the License at http://www.apple.com/publicsource and read it before
   8   * using this file.
   9   * 
  10   * This Original Code and all software distributed under the License are
  11   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12   * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13   * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14   * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15   * specific language governing rights and limitations under the License.
  16   */
  17  
  18  
  19  /*
  20   * CryptKitDER.h - snacc-based routines to create and parse DER-encoded FEE 
  21   *				   keys and signatures
  22   *
  23   */
  24  
  25  #include "ckconfig.h"
  26  
  27  
  28  #include <security_cryptkit/CryptKitDER.h>
  29  #include <security_cryptkit/falloc.h>
  30  #include <security_cryptkit/feeDebug.h>
  31  #include <security_cryptkit/feeFunctions.h>
  32  #include <security_cryptkit/ckutilities.h>
  33  #include "CryptKitAsn1.h"
  34  #include <security_asn1/SecNssCoder.h>
  35  #include <security_asn1/nssUtils.h>
  36  #include <Security/keyTemplates.h>
  37  #include <Security/oidsalg.h>
  38  #include <Security/oidsattr.h>
  39  #include <Security/x509defs.h>
  40  
  41  #define PRINT_SIG_GIANTS		0
  42  #define PRINT_CURVE_PARAMS		0
  43  #define PRINT_SIZES				0
  44  #if		PRINT_SIZES
  45  #define szprint(s)				printf s
  46  #else
  47  #define szprint(s)
  48  #endif
  49  
  50  /*
  51   * Trivial exception class associated with a feeReturn.
  52   */
  53  class feeException
  54  {
  55  protected:
  56  	feeException(feeReturn frtn, const char *op); 	
  57  public:
  58  	~feeException() _NOEXCEPT {}
  59  	feeReturn frtn() const _NOEXCEPT { return mFrtn; }
  60      static void throwMe(feeReturn frtn, const char *op = NULL) __attribute__((noreturn));
  61  private:
  62  	feeReturn mFrtn;
  63  };
  64  
  65  feeException::feeException(
  66  	feeReturn frtn, 
  67  	const char *op)
  68  		: mFrtn(frtn)
  69  { 
  70  	if(op) {
  71  		dbgLog(("%s: %s\n", op, feeReturnString(frtn)));
  72  	}
  73  }
  74  
  75  void feeException::throwMe(feeReturn frtn, const char *op /*= NULL*/) { throw feeException(frtn, op); }
  76  
  77  /*
  78   * ASN1 encoding rules specify that an integer's sign is indicated by the MSB
  79   * of the first (MS) content byte. For a non-negative number, if the MSB of 
  80   * the MS byte (of the unencoded number) is one, then the encoding starts with
  81   * a byte of zeroes to indicate positive sign. For a negative number, the first
  82   * nine bits can not be all 1 - if they are (in the undecoded number), leading 
  83   * bytes of 0xff are trimmed off until the first nine bits are something other
  84   * than one. Also, the first nine bits of the encoded number can not all be 
  85   * zero. 
  86   *
  87   * CryptKit giants express their sign as part of the giantstruct.sign field. 
  88   * The giantDigit array (giantstruct.n[]) is stored l.s. digit first. 
  89   *
  90   * These routines are independent of platform, endianness, and giatn digit size. 
  91   */
  92  
  93  /* routines to guess maximum size of DER-encoded objects */ 
  94  static unsigned feeSizeOfSnaccGiant(
  95  	giant g)
  96  {
  97  	unsigned rtn = abs(g->sign) * GIANT_BYTES_PER_DIGIT;
  98  	szprint(("feeSizeOfSnaccGiant: sign %d size %d\n", g->sign, rtn + 4));
  99  	return rtn + 4;
 100  }
 101  
 102  /* PUBLIC... */
 103  unsigned feeSizeOfDERSig(
 104  	giant g1,
 105  	giant g2)
 106  {
 107  	unsigned rtn = feeSizeOfSnaccGiant(g1);
 108  	rtn += feeSizeOfSnaccGiant(g2);
 109  	szprint(("feeSizeOfDERSig: size %d\n", rtn + 4));
 110  	return rtn + 4;
 111  }
 112  
 113  /* perform 2's complement of byte array, expressed MS byte first */
 114  static void twosComplement(
 115  	unsigned char *bytePtr,		// points to MS byte
 116  	unsigned numBytes)
 117  {
 118  	unsigned char *outp = bytePtr + numBytes - 1;
 119  	unsigned char carry = 1;	// first time thru, carry = 1 to add one to 1's comp
 120  	for(unsigned byteDex=0; byteDex<numBytes; byteDex++) {
 121  		/* first complement, then add carry */
 122  		*outp = ~*outp + carry;
 123  		if(carry && (*outp == 0)) {
 124  			/* overflow/carry */
 125  			carry = 1;
 126  		}
 127  		else {
 128  			carry = 0;
 129  		}
 130  		outp--;
 131  	}
 132  }
 133  
 134  /*
 135   * CSSM_DATA --> unsigned int
 136   */
 137  static unsigned cssmDataToInt(
 138  	const CSSM_DATA &cdata)
 139  {
 140  	if((cdata.Length == 0) || (cdata.Data == NULL)) {
 141  		return 0;
 142  	}
 143  	unsigned len = (unsigned)cdata.Length;
 144  	if(len > sizeof(int)) {
 145  		feeException::throwMe(FR_BadKeyBlob, "cssmDataToInt");
 146  	}
 147  	
 148  	unsigned rtn = 0;
 149  	uint8 *cp = cdata.Data;
 150  	for(unsigned i=0; i<len; i++) {
 151  		rtn = (rtn << 8) | *cp++;
 152  	}
 153  	return rtn;
 154  }
 155  
 156  /*
 157   * unsigned int --> CSSM_DATA, mallocing from an SecNssCoder 
 158   */
 159  static void intToCssmData(
 160  	unsigned num,
 161  	CSSM_DATA &cdata,
 162  	SecNssCoder &coder)
 163  {
 164  	unsigned len = 0;
 165  	
 166  	if(num < 0x100) {
 167  		len = 1;
 168  	}
 169  	else if(num < 0x10000) {
 170  		len = 2;
 171  	}
 172  	else if(num < 0x1000000) {
 173  		len = 3;
 174  	}
 175  	else {
 176  		len = 4;
 177  	}
 178  	cdata.Data = (uint8 *)coder.malloc(len);
 179  	cdata.Length = len;
 180  	uint8 *cp = &cdata.Data[len - 1];
 181  	for(unsigned i=0; i<len; i++) {
 182  		*cp-- = num & 0xff;
 183  		num >>= 8;
 184  	}
 185  }
 186  
 187  /*
 188   * Convert a decoded ASN integer, as a CSSM_DATA, to a (mallocd) giant. 
 189   * Only known exception is a feeException.
 190   */
 191  static giant cssmDataToGiant(
 192  	const CSSM_DATA 	&cdata)
 193  {
 194  	char *rawOcts = (char *)cdata.Data;
 195  	unsigned numBytes = (unsigned)cdata.Length;
 196  	unsigned numGiantDigits;
 197  	int sign = 1;
 198  	giant grtn;
 199  	feeReturn frtn = FR_Success;
 200  	unsigned char *inp = NULL;
 201  	unsigned digitDex;			// index into g->giantDigit[]
 202  	
 203  	/* handle degenerate case (value of zero) */
 204  	if((numBytes == 0) || ((numBytes == 1) && rawOcts[0] == 0)) {
 205  		grtn = newGiant(1);
 206  		if(grtn == NULL) {
 207  			feeException::throwMe(FR_Memory, "newGiant(1)");
 208  		}
 209  		int_to_giant(0, grtn);
 210  		return grtn;
 211  	}
 212  	
 213  	/* make a copy of raw octets if we have to do two's complement */
 214  	unsigned char *byteArray = NULL;
 215  	bool didMalloc = false;
 216  	if(rawOcts[0] & 0x80) {
 217  		sign = -1;
 218  		numBytes++;
 219  		byteArray = (unsigned char *)fmalloc(numBytes);
 220  		didMalloc = true;
 221  		byteArray[0] = 0xff;
 222  		memmove(byteArray + 1, rawOcts, numBytes-1);
 223  		twosComplement(byteArray, numBytes);
 224  	}
 225  	else {
 226  		/* no copy */
 227  		char *foo = rawOcts;
 228  		byteArray = (unsigned char *)foo;
 229  	}
 230  	
 231  	/* cook up a new giant */
 232  	numGiantDigits = (numBytes + GIANT_BYTES_PER_DIGIT - 1) /
 233  			GIANT_BYTES_PER_DIGIT;
 234  	grtn = newGiant(numGiantDigits);
 235  	if(grtn == NULL) {
 236  		frtn = FR_Memory;
 237  		goto abort;
 238  	}
 239  
 240  	/* 
 241  	 * Convert byteArray to array of giantDigits
 242  	 * inp - raw input bytes, LSB last
 243  	 * grtn->n[] - output array of giantDigits, LSD first
 244  	 * Start at LS byte and LD digit
 245  	 */
 246  	digitDex = 0;					// index into g->giantDigit[]
 247  	giantDigit thisDigit;
 248  	inp = byteArray + numBytes - 1;	
 249  	unsigned dex;					// total byte counter
 250  	unsigned byteDex;				// index into one giantDigit
 251  	unsigned shiftCount;
 252  	for(dex=0; dex<numBytes; ) {	// increment dex inside
 253  		thisDigit = 0;
 254  		shiftCount = 0;
 255  		for(byteDex=0; byteDex<GIANT_BYTES_PER_DIGIT; byteDex++) {
 256  			thisDigit |= ((giantDigit)(*inp--) << shiftCount);
 257  			shiftCount += 8;
 258  			if(++dex == numBytes) {
 259  				/* must be partial giantDigit */
 260  				break;
 261  			}
 262  		}
 263  		CKASSERT(digitDex < numGiantDigits);
 264  		grtn->n[digitDex++] = thisDigit;
 265  	}
 266  	grtn->sign = (int)numGiantDigits * sign;
 267  	
 268  	/* trim leading (MS) zeroes */
 269  	gtrimSign(grtn);
 270  abort:
 271  	if(didMalloc) {
 272  		ffree(byteArray);
 273  	}
 274  	if(frtn) {
 275  		feeException::throwMe(frtn, "bigIntStrToGiant");
 276  	}
 277  	return grtn;
 278  }
 279  
 280  /*
 281   * Convert a giant to an CSSM_DATA, mallocing using specified coder. 
 282   * Only known exception is a feeException.
 283   */
 284   static void giantToCssmData(
 285  	giant 		g,
 286  	CSSM_DATA 	&cdata,
 287  	SecNssCoder	&coder)
 288  {
 289  	unsigned char doPrepend = 0;	
 290  	unsigned numGiantDigits = abs(g->sign);
 291  	unsigned numBytes = numGiantDigits * GIANT_BYTES_PER_DIGIT;
 292  	giantDigit msGiantBit = 0;
 293  	if(isZero(g)) {
 294  		/* special degenerate case */
 295  		intToCssmData(0, cdata, coder);
 296  		return;
 297  	}
 298  	else {
 299  		msGiantBit = g->n[numGiantDigits - 1] >> (GIANT_BITS_PER_DIGIT - 1);
 300  	}
 301  	
 302  	/* prepend a byte of zero if necessary */
 303  	if((g->sign < 0) ||					// negative - to handle 2's complement 
 304  	   ((g->sign > 0) && msGiantBit)) {	// ensure MS byte is zero
 305  			doPrepend = 1;
 306  			numBytes++;
 307  	}
 308  	
 309  	unsigned char *rawBytes = (unsigned char *)fmalloc(numBytes);
 310  	if(rawBytes == NULL) {
 311  		feeException::throwMe(FR_Memory, "giantToCssmData fmalloc(rawBytes)");
 312  	}
 313  	unsigned char *outp = rawBytes;
 314  	if(doPrepend) {
 315  		*outp++ = 0;
 316  	}
 317  	
 318  	/* 
 319  	 * Convert array of giantDigits to bytes. 
 320  	 * outp point to MS output byte.
 321  	 */
 322  	int digitDex;			// index into g->giantDigit[]
 323  	unsigned byteDex;		// byte index into a giantDigit
 324  	for(digitDex=numGiantDigits-1; digitDex>=0; digitDex--) {
 325  		/* one loop per giantDigit, starting at MS end */
 326  		giantDigit thisDigit = g->n[digitDex];
 327  		unsigned char *bp = outp + GIANT_BYTES_PER_DIGIT - 1;
 328  		for(byteDex=0; byteDex<GIANT_BYTES_PER_DIGIT; byteDex++) {
 329  			/* one loop per byte within the digit, starting at LS end */
 330  			*bp-- = (unsigned char)(thisDigit) & 0xff;
 331  			thisDigit >>= 8;
 332  		}
 333  		outp += GIANT_BYTES_PER_DIGIT;
 334  	}
 335  	
 336  	/* do two's complement for negative giants */
 337  	if(g->sign < 0) {
 338  		twosComplement(rawBytes, numBytes);
 339  	}
 340  	
 341  	/* strip off redundant leading bits (nine zeroes or nine ones) */
 342  	outp = rawBytes;
 343  	unsigned char *endp = outp + numBytes - 1;
 344  	while((*outp == 0) &&			// m.s. byte zero
 345  	      (outp < endp) &&			// more bytes exist
 346  		  (!(outp[1] & 0x80))) {	// 9th bit is 0
 347  		outp++;
 348  		numBytes--;
 349  	}
 350  	while((*outp == 0xff) &&		// m.s. byte all ones
 351  	      (outp < endp) &&			// more bytes exist
 352  		  (outp[1] & 0x80)) {		// 9th bit is 1
 353  		outp++;
 354  		numBytes--;
 355  	}
 356  	cdata.Data = (uint8 *)coder.malloc(numBytes);
 357  	memmove(cdata.Data, outp, numBytes);
 358  	cdata.Length = numBytes;
 359  	ffree(rawBytes);
 360  	return;
 361  }
 362  
 363  /* curveParams : CryptKit <--> FEECurveParametersASN1 */
 364  /* Only known exception is a feeException */
 365  static void feeCurveParamsToASN1(
 366  	const curveParams *cp,
 367  	FEECurveParametersASN1 &asnCp,
 368  	SecNssCoder &coder)
 369  {
 370  	#if 	PRINT_CURVE_PARAMS
 371  	printf("===encoding curveParams; cp:\n"); printCurveParams(cp);
 372  	#endif
 373  	memset(&asnCp, 0, sizeof(asnCp));
 374  	try {
 375  		intToCssmData(cp->primeType, asnCp.primeType, coder);
 376  		intToCssmData(cp->curveType, asnCp.curveType, coder);
 377  		intToCssmData(cp->q, asnCp.q, coder);
 378  		intToCssmData(cp->k, asnCp.k, coder);
 379  		intToCssmData(cp->m, asnCp.m, coder);
 380  		giantToCssmData(cp->a, asnCp.a, coder);
 381  		giantToCssmData(cp->b, asnCp.b_, coder);
 382  		giantToCssmData(cp->c, asnCp.c, coder);
 383  		giantToCssmData(cp->x1Plus, asnCp.x1Plus, coder);
 384  		giantToCssmData(cp->x1Minus, asnCp.x1Minus, coder);
 385  		giantToCssmData(cp->cOrderPlus, asnCp.cOrderPlus, coder);
 386  		giantToCssmData(cp->cOrderMinus, asnCp.cOrderMinus, coder);
 387  		giantToCssmData(cp->x1OrderPlus, asnCp.x1OrderPlus, coder);
 388  		giantToCssmData(cp->x1OrderMinus, asnCp.x1OrderMinus, coder);
 389  		if(cp->primeType == FPT_General) {
 390  			giantToCssmData(cp->basePrime, asnCp.basePrime, coder);
 391  		}
 392  	}
 393  	catch(const feeException &ferr) {
 394  		throw;
 395  	}
 396  	catch(...) {
 397  		feeException::throwMe(FR_Memory, "feeCurveParamsToSnacc catchall");	// ???
 398  	}
 399  }
 400  
 401  static curveParams *feeCurveParamsFromAsn1(
 402  	const FEECurveParametersASN1 &asnCp)
 403  {
 404  	curveParams *cp = newCurveParams();
 405  	if(cp == NULL) {
 406  		feeException::throwMe(FR_Memory, "feeCurveParamsFromSnacc alloc cp");
 407  	}
 408  	cp->primeType = (feePrimeType)cssmDataToInt(asnCp.primeType);
 409  	cp->curveType = (feeCurveType)cssmDataToInt(asnCp.curveType);
 410  	cp->q 			   = cssmDataToInt(asnCp.q);
 411  	cp->k 			   = cssmDataToInt(asnCp.k);
 412  	cp->m 			   = cssmDataToInt(asnCp.m);
 413  	cp->a 			   = cssmDataToGiant(asnCp.a);
 414  	cp->b 			   = cssmDataToGiant(asnCp.b_);
 415  	cp->c              = cssmDataToGiant(asnCp.c);
 416  	cp->x1Plus         = cssmDataToGiant(asnCp.x1Plus);
 417  	cp->x1Minus        = cssmDataToGiant(asnCp.x1Minus);
 418  	cp->cOrderPlus     = cssmDataToGiant(asnCp.cOrderPlus);
 419  	cp->cOrderMinus    = cssmDataToGiant(asnCp.cOrderMinus);
 420  	cp->x1OrderPlus    = cssmDataToGiant(asnCp.x1OrderPlus);
 421  	cp->x1OrderMinus   = cssmDataToGiant(asnCp.x1OrderMinus);
 422  	if(asnCp.basePrime.Data != NULL) {
 423  		cp->basePrime  = cssmDataToGiant(asnCp.basePrime);
 424  	}
 425  	
 426  	/* remaining fields inferred */
 427  	curveParamsInferFields(cp);
 428  	allocRecipGiants(cp);
 429  	#if 	PRINT_CURVE_PARAMS
 430  	printf("===decoding curveParams; cp:\n"); printCurveParams(cp);
 431  	#endif
 432  	return cp;
 433  }
 434  
 435  /***
 436   *** Public routines. These are usable from C code; they never throw.
 437   ***/
 438   
 439  /*
 440   * Encode/decode the two FEE signature types. We malloc returned data via
 441   * fmalloc(); caller must free via ffree().
 442   */
 443  feeReturn feeDEREncodeElGamalSignature(
 444  	giant			u,
 445  	giant			PmX,
 446  	unsigned char	**encodedSig,		// fmallocd and RETURNED
 447  	unsigned		*encodedSigLen)		// RETURNED
 448  {
 449  	/* convert to FEEElGamalSignatureASN1 */
 450  	FEEElGamalSignatureASN1 asnSig;
 451  	SecNssCoder coder;
 452  	
 453  	try {
 454  		giantToCssmData(u, asnSig.u, coder);
 455  		giantToCssmData(PmX, asnSig.pmX, coder);
 456  	} 
 457  	catch(const feeException &ferr) {
 458  		return ferr.frtn();
 459  	}
 460  	
 461  	/* DER encode */
 462  	PRErrorCode perr;
 463  	CSSM_DATA encBlob;			// mallocd by coder
 464  	perr = coder.encodeItem(&asnSig, FEEElGamalSignatureASN1Template, encBlob);
 465  	if(perr) {
 466  		return FR_Memory;
 467  	}
 468  
 469  	/* copy out  to caller */
 470  	*encodedSig = (unsigned char *)fmalloc((unsigned)encBlob.Length);
 471  	*encodedSigLen = (unsigned)encBlob.Length;
 472  	memmove(*encodedSig, encBlob.Data, encBlob.Length); 
 473  	
 474  	#if	PRINT_SIG_GIANTS
 475  	printf("feeEncodeElGamalSignature:\n");
 476  	printf("   u   : "); printGiantHex(u);
 477  	printf("   PmX : "); printGiantHex(PmX);
 478  	#endif
 479  	
 480  	return FR_Success;
 481  }
 482  
 483  /*
 484   * Encode a DER formatted ECDSA signature
 485   */
 486  feeReturn feeDEREncodeECDSASignature(
 487  	giant			c,
 488  	giant			d,
 489  	unsigned char	**encodedSig,		// fmallocd and RETURNED
 490  	unsigned		*encodedSigLen)		// RETURNED
 491  {
 492  	/* convert to FEEECDSASignatureASN1 */
 493  	FEEECDSASignatureASN1 asnSig;
 494  	SecNssCoder coder;
 495  	
 496  	try {
 497  		giantToCssmData(c, asnSig.c, coder);
 498  		giantToCssmData(d, asnSig.d, coder);
 499  	} 
 500  	catch(const feeException &ferr) {
 501  		return ferr.frtn();
 502  	}
 503  	
 504  	/* DER encode */
 505  	PRErrorCode perr;
 506  	CSSM_DATA encBlob;			// mallocd by coder
 507  	perr = coder.encodeItem(&asnSig, FEEECDSASignatureASN1Template, encBlob);
 508  	if(perr) {
 509  		return FR_Memory;
 510  	}
 511  
 512  	/* copy out  to caller */
 513  	*encodedSig = (unsigned char *)fmalloc((unsigned)encBlob.Length);
 514  	*encodedSigLen = (unsigned)encBlob.Length;
 515  	memmove(*encodedSig, encBlob.Data, encBlob.Length); 
 516  	
 517  	#if	PRINT_SIG_GIANTS
 518  	printf("feeDEREncodeECDSASignature:\n");
 519  	printf("   c   : "); printGiantHex(c);
 520  	printf("   d   : "); printGiantHex(d);
 521  	#endif
 522  	return FR_Success;
 523  
 524  }
 525  
 526  #if PRINT_SIG_GIANTS
 527  static void printHex(
 528                const unsigned char *buf,
 529                unsigned len,
 530                unsigned maxLen)
 531  {
 532      bool doEllipsis = false;
 533      unsigned dex;
 534      if(len > maxLen) {
 535          len = maxLen;
 536          doEllipsis = true;
 537      }
 538      for(dex=0; dex<len; dex++) {
 539          printf("%02X ", *buf++);
 540      }
 541      if(doEllipsis) {
 542          printf("...etc.");
 543      }
 544  }
 545  #endif
 546  
 547  /*
 548   * Encode a RAW formatted ECDSA signature
 549   */
 550  feeReturn feeRAWEncodeECDSASignature(unsigned       groupBytesLen,
 551                                       giant			c,
 552                                       giant			d,
 553                                       unsigned char	**encodedSig,		// fmallocd and RETURNED
 554                                       unsigned		*encodedSigLen)		// RETURNED
 555  {
 556      /* copy out  to caller */
 557      *encodedSig = (unsigned char *)fmalloc(2*groupBytesLen);
 558      *encodedSigLen = (unsigned)2*groupBytesLen;
 559  
 560      /* convert to FEEECDSASignatureASN1 */
 561      try {
 562          serializeGiant(c, *encodedSig, groupBytesLen);
 563          serializeGiant(d, *encodedSig+groupBytesLen, groupBytesLen);
 564      }
 565      catch(const feeException &ferr) {
 566          return ferr.frtn();
 567      }
 568  
 569  #if	PRINT_SIG_GIANTS
 570      printf("feeRAWEncodeECDSASignature:\n");
 571      printf("   c   : "); printGiantHex(c);
 572      printf("   d   : "); printGiantHex(d);
 573      printf("   sig : "); printHex(*encodedSig,*encodedSigLen,512);
 574  #endif
 575      return FR_Success;
 576      
 577  }
 578  
 579  feeReturn feeDERDecodeElGamalSignature(
 580  	const unsigned char	*encodedSig,
 581  	size_t				encodedSigLen,
 582  	giant				*u,				// newGiant'd and RETURNED
 583  	giant				*PmX)			// newGiant'd and RETURNED
 584  {
 585  	FEEElGamalSignatureASN1 asnSig;
 586  	SecNssCoder coder;
 587  	
 588  	memset(&asnSig, 0, sizeof(asnSig));
 589  	PRErrorCode perr = coder.decode(encodedSig, encodedSigLen, 
 590  		FEEElGamalSignatureASN1Template, &asnSig);
 591  	if(perr) {
 592  		return FR_BadSignatureFormat;
 593  	}
 594  
 595  	try {
 596  		*u   = cssmDataToGiant(asnSig.u);
 597  		*PmX = cssmDataToGiant(asnSig.pmX);
 598  	}
 599  	catch(const feeException &ferr) {
 600  		return ferr.frtn();
 601  	}
 602  	catch(...) {
 603  		/* FIXME - bad sig? memory? */
 604  		return FR_Memory;
 605  	}
 606  	#if	PRINT_SIG_GIANTS
 607  	printf("feeDecodeElGamalSignature:\n");
 608  	printf("   u   : "); printGiantHex(*u);
 609  	printf("   PmX : "); printGiantHex(*PmX);
 610  	#endif
 611  	return FR_Success;
 612  }
 613  
 614  /*
 615   * Decode a DER formatted ECDSA signature
 616   */
 617  feeReturn feeDERDecodeECDSASignature(
 618  	const unsigned char	*encodedSig,
 619  	size_t				encodedSigLen,
 620  	giant				*c,				// newGiant'd and RETURNED
 621  	giant				*d)				// newGiant'd and RETURNED
 622  {
 623  	FEEECDSASignatureASN1 asnSig;
 624  	SecNssCoder coder;
 625  	
 626  	memset(&asnSig, 0, sizeof(asnSig));
 627  	PRErrorCode perr = coder.decode(encodedSig, encodedSigLen, 
 628  		FEEECDSASignatureASN1Template, &asnSig);
 629  	if(perr) {
 630  		return FR_BadSignatureFormat;
 631  	}
 632  
 633  	try {
 634  		*c = cssmDataToGiant(asnSig.c);
 635  		*d = cssmDataToGiant(asnSig.d);
 636  	}
 637  	catch(const feeException &ferr) {
 638  		return ferr.frtn();
 639  	}
 640  	catch(...) {
 641  		/* FIXME - bad sig? memory? */
 642  		return FR_Memory;
 643  	}
 644  #if	PRINT_SIG_GIANTS
 645  	printf("feeDERDecodeECDSASignature:\n");
 646      printf("   c   : "); printGiantHex(*c);
 647      printf("   d   : "); printGiantHex(*d);
 648  #endif
 649  	return FR_Success;
 650  }
 651  
 652  /*
 653   * Decode a RAW formatted ECDSA signature
 654   */
 655  feeReturn feeRAWDecodeECDSASignature(unsigned groupBytesLen,
 656                                       const unsigned char	*encodedSig,
 657                                       size_t				encodedSigLen,
 658                                       giant				*c,				// newGiant'd and RETURNED
 659                                       giant				*d)				// newGiant'd and RETURNED
 660  {
 661  
 662      // Size must be even
 663      if (((encodedSigLen & 1) == 1) || (groupBytesLen != (encodedSigLen>>1))) {
 664          return FR_BadSignatureFormat;
 665      }
 666  
 667      try {
 668          *c = giant_with_data((uint8_t*)encodedSig,(int)groupBytesLen);
 669          *d = giant_with_data((uint8_t*)encodedSig+groupBytesLen, (int)groupBytesLen);
 670      }
 671      catch(const feeException &ferr) {
 672          return ferr.frtn();
 673      }
 674      catch(...) {
 675          /* FIXME - bad sig? memory? */
 676          return FR_Memory;
 677      }
 678  #if	PRINT_SIG_GIANTS
 679      printf("feeRAWDecodeECDSASignature:\n");
 680      printf("   c   : "); printGiantHex(*c);
 681      printf("   d   : "); printGiantHex(*d);
 682  #endif
 683      return FR_Success;
 684  }
 685  
 686  /*
 687   * Encode/decode the FEE private and public keys. We malloc returned data via
 688   * falloc(); caller must free via ffree(). Public C functions which never throw. 
 689   */
 690  feeReturn feeDEREncodePublicKey(
 691  	int					version,
 692  	const curveParams	*cp,
 693  	giant				plusX,
 694  	giant				minusX,
 695  	giant				plusY,				// may be NULL
 696  	unsigned char		**keyBlob,			// fmallocd and RETURNED
 697  	unsigned			*keyBlobLen)		// RETURNED
 698  {
 699  	FEEPublicKeyASN1 asnKey;
 700  	SecNssCoder coder;
 701  	
 702  	memset(&asnKey, 0, sizeof(asnKey));
 703  	intToCssmData(version, asnKey.version, coder);
 704  	
 705  	try {
 706  		feeCurveParamsToASN1(cp, asnKey.curveParams, coder);
 707  		giantToCssmData(plusX, asnKey.plusX, coder);
 708  		giantToCssmData(minusX, asnKey.minusX, coder);
 709  		if(plusY != NULL) {
 710  			giantToCssmData(plusY, asnKey.plusY, coder);
 711  		}
 712  	}
 713  	catch(const feeException &ferr) {
 714  		return ferr.frtn();
 715  	}
 716  	
 717  	/* DER encode */
 718  	PRErrorCode perr;
 719  	CSSM_DATA encBlob;			// mallocd by coder
 720  	perr = coder.encodeItem(&asnKey, FEEPublicKeyASN1Template, encBlob);
 721  	if(perr) {
 722  		return FR_Memory;
 723  	}
 724  
 725  	/* copy out */
 726  	*keyBlob = (unsigned char *)fmalloc((unsigned)encBlob.Length);
 727  	*keyBlobLen = (unsigned)encBlob.Length;
 728  	memmove(*keyBlob, encBlob.Data, encBlob.Length); 
 729  	return FR_Success;
 730  }
 731  
 732  feeReturn feeDEREncodePrivateKey(
 733  	int					version,
 734  	const curveParams	*cp,
 735  	const giant			privData,
 736  	unsigned char		**keyBlob,			// fmallocd and RETURNED
 737  	unsigned			*keyBlobLen)		// RETURNED
 738  {
 739  	FEEPrivateKeyASN1 asnKey;
 740  	SecNssCoder coder;
 741  	
 742  	memset(&asnKey, 0, sizeof(asnKey));
 743  	intToCssmData(version, asnKey.version, coder);
 744  	
 745  	try {
 746  		feeCurveParamsToASN1(cp, asnKey.curveParams, coder);
 747  		giantToCssmData(privData, asnKey.privData, coder);
 748  	}
 749  	catch(const feeException &ferr) {
 750  		return ferr.frtn();
 751  	}
 752  	
 753  	/* DER encode */
 754  	PRErrorCode perr;
 755  	CSSM_DATA encBlob;			// mallocd by coder
 756  	perr = coder.encodeItem(&asnKey, FEEPrivateKeyASN1Template, encBlob);
 757  	if(perr) {
 758  		return FR_Memory;
 759  	}
 760  
 761  	/* copy out */
 762  	*keyBlob = (unsigned char *)fmalloc((unsigned)encBlob.Length);
 763  	*keyBlobLen = (unsigned)encBlob.Length;
 764  	memmove(*keyBlob, encBlob.Data, encBlob.Length); 
 765  	return FR_Success;
 766  }
 767  
 768  feeReturn feeDERDecodePublicKey(
 769  	const unsigned char	*keyBlob,
 770  	unsigned			keyBlobLen,
 771  	int					*version,			// this and remainder RETURNED
 772  	curveParams			**cp,
 773  	giant				*plusX,
 774  	giant				*minusX,
 775  	giant				*plusY)				// may be NULL
 776  {
 777  	FEEPublicKeyASN1 asnKey;
 778  	SecNssCoder coder;
 779  	
 780  	memset(&asnKey, 0, sizeof(asnKey));
 781  	PRErrorCode perr = coder.decode(keyBlob, keyBlobLen, 
 782  		FEEPublicKeyASN1Template, &asnKey);
 783  	if(perr) {
 784  		return FR_BadKeyBlob;
 785  	}
 786  
 787  	try {
 788  		*version = cssmDataToInt(asnKey.version);
 789  		*cp     = feeCurveParamsFromAsn1(asnKey.curveParams);
 790  		*plusX  = cssmDataToGiant(asnKey.plusX);
 791  		*minusX = cssmDataToGiant(asnKey.minusX);
 792  		if(asnKey.plusY.Data != NULL) {
 793  			/* optional */
 794  			*plusY = cssmDataToGiant(asnKey.plusY);
 795  		}
 796  		else {
 797  			*plusY = newGiant(1);
 798  			int_to_giant(0, *plusY);
 799  		}
 800  	}
 801  	catch(const feeException &ferr) {
 802  		return ferr.frtn();
 803  	}
 804  	catch(...) {
 805  		/* FIXME - bad sig? memory? */
 806  		return FR_Memory;
 807  	}
 808  	return FR_Success;
 809  }
 810  	
 811  feeReturn feeDERDecodePrivateKey(
 812  	const unsigned char	*keyBlob,
 813  	unsigned			keyBlobLen,
 814  	int					*version,			// this and remainder RETURNED
 815  	curveParams			**cp,
 816  	giant				*privData)			// RETURNED
 817  {
 818  	FEEPrivateKeyASN1 asnKey;
 819  	SecNssCoder coder;
 820  	
 821  	memset(&asnKey, 0, sizeof(asnKey));
 822  	PRErrorCode perr = coder.decode(keyBlob, keyBlobLen, 
 823  		FEEPrivateKeyASN1Template, &asnKey);
 824  	if(perr) {
 825  		return FR_BadKeyBlob;
 826  	}
 827  
 828  	try {
 829  		*version = cssmDataToInt(asnKey.version);
 830  		*cp     = feeCurveParamsFromAsn1(asnKey.curveParams);
 831  		*privData  = cssmDataToGiant(asnKey.privData);
 832  	}
 833  	catch(const feeException &ferr) {
 834  		return ferr.frtn();
 835  	}
 836  	catch(...) {
 837  		/* FIXME - bad sig? memory? */
 838  		return FR_Memory;
 839  	}
 840  	return FR_Success;
 841  }
 842  
 843  #pragma mark --- ECDSA support ---
 844  
 845  /* convert between feeDepth and curve OIDs */
 846  static const CSSM_OID *depthToOid(
 847  	feeDepth depth)
 848  {
 849  	switch(depth) {
 850  		case FEE_DEPTH_secp192r1:
 851  			return &CSSMOID_secp192r1;
 852  		case FEE_DEPTH_secp256r1:
 853  			return &CSSMOID_secp256r1;
 854  		case FEE_DEPTH_secp384r1:
 855  			return &CSSMOID_secp384r1;
 856  		case FEE_DEPTH_secp521r1:
 857  			return &CSSMOID_secp521r1;
 858  		default:
 859  			dbgLog(("depthToOid needs work\n"));
 860  			return NULL;
 861  	}
 862  }
 863  
 864  static feeReturn curveOidToFeeDepth(
 865  	const CSSM_OID *curveOid, 
 866  	feeDepth *depth)			/* RETURNED */
 867  {
 868  	if(nssCompareCssmData(curveOid, &CSSMOID_secp192r1)) {
 869  		*depth = FEE_DEPTH_secp192r1;
 870  	}
 871  	else if(nssCompareCssmData(curveOid, &CSSMOID_secp256r1)) {
 872  		*depth = FEE_DEPTH_secp256r1;
 873  	}
 874  	else if(nssCompareCssmData(curveOid, &CSSMOID_secp384r1)) {
 875  		*depth = FEE_DEPTH_secp384r1;
 876  	}
 877  	else if(nssCompareCssmData(curveOid, &CSSMOID_secp521r1)) {
 878  		*depth = FEE_DEPTH_secp521r1;
 879  	}
 880  	else {
 881  		dbgLog(("curveOidToFeeDepth: unknown curve OID\n"));
 882  		return FR_BadKeyBlob;
 883  	}
 884  	return FR_Success;
 885  }
 886  
 887  
 888  /* 
 889   * Validate a decoded CSSM_X509_ALGORITHM_IDENTIFIER and infer
 890   * depth from its algorith.parameter
 891   */
 892  static feeReturn feeAlgIdToDepth(
 893  	const CSSM_X509_ALGORITHM_IDENTIFIER *algId,
 894  	feeDepth *depth)
 895  {
 896  	const CSSM_OID *oid = &algId->algorithm;
 897  	/* FIXME what's the value here for a private key!? */
 898  	if(!nssCompareCssmData(oid, &CSSMOID_ecPublicKey)) {
 899  		dbgLog(("feeAlgIdToDepth: bad OID"));
 900  		return FR_BadKeyBlob;
 901  	}
 902  	
 903  	/* 
 904  	 * AlgId.params is curve OID, still encoded since it's an ASN_ANY.
 905  	 * First two bytes of encoded OID are (06, length) 
 906  	 */
 907  	const CSSM_DATA *param = &algId->parameters;
 908  	if((param->Length <= 2) || (param->Data[0] != BER_TAG_OID)) {
 909  		dbgLog(("feeAlgIdToDepth: no curve params\n"));
 910  		return FR_BadKeyBlob;
 911  	}
 912  	
 913  	CSSM_OID decOid = {param->Length-2, algId->parameters.Data+2};
 914  	return curveOidToFeeDepth(&decOid, depth);
 915  }
 916  
 917  /*
 918   * Prepare an CSSM_X509_ALGORITHM_IDENTIFIER for encoding.
 919   */
 920  static feeReturn feeSetupAlgId(
 921  	feeDepth depth,
 922  	SecNssCoder &coder,
 923  	CSSM_X509_ALGORITHM_IDENTIFIER &algId)
 924  {
 925  	algId.algorithm = CSSMOID_ecPublicKey;
 926  	const CSSM_OID *curveOid = depthToOid(depth);
 927  	if(curveOid == NULL) {
 928  		return FR_IllegalDepth;
 929  	}
 930  	
 931  	/* quick & dirty encode of the parameter OID; it's an ASN_ANY in the template */
 932  	coder.allocItem(algId.parameters, curveOid->Length + 2);
 933  	algId.parameters.Data[0] = BER_TAG_OID;
 934  	algId.parameters.Data[1] = curveOid->Length;
 935  	memmove(algId.parameters.Data+2, curveOid->Data, curveOid->Length);
 936  	return FR_Success;
 937  }
 938  
 939  #pragma mark --- ECDSA public key, X.509 format ---
 940  
 941  /* 
 942   * Encode/decode public key in X.509 format.
 943   */
 944  feeReturn feeDEREncodeX509PublicKey(
 945  	const unsigned char	*pubBlob,		/* x and y octet string */
 946  	unsigned			pubBlobLen,
 947  	curveParams			*cp,
 948  	unsigned char		**x509Blob,		/* fmallocd and RETURNED */
 949  	unsigned			*x509BlobLen)	/* RETURNED */
 950  {
 951  	SecNssCoder coder;
 952  	CSSM_X509_SUBJECT_PUBLIC_KEY_INFO nssPubKeyInfo;
 953  	
 954  	memset(&nssPubKeyInfo, 0, sizeof(nssPubKeyInfo));
 955  	
 956  	/* The x/y string, to be encoded in a bit string */
 957  	nssPubKeyInfo.subjectPublicKey.Data = (uint8 *)pubBlob;
 958  	nssPubKeyInfo.subjectPublicKey.Length = pubBlobLen * 8;
 959  	
 960  	feeDepth depth;
 961  	feeReturn frtn = curveParamsDepth(cp, &depth);
 962  	if(frtn) {
 963  		dbgLog(("feeDEREncodePKCS8PrivateKey: curveParamsDepth error\n"));
 964  		return frtn;
 965  	}
 966  
 967  	CSSM_X509_ALGORITHM_IDENTIFIER &algId = nssPubKeyInfo.algorithm;
 968  	frtn = feeSetupAlgId(depth, coder, algId);
 969  	if(frtn) {
 970  		return frtn;
 971  	}
 972  	
 973  	/* DER encode */
 974  	CSSM_DATA encBlob;			// mallocd by coder
 975  	PRErrorCode perr = coder.encodeItem(&nssPubKeyInfo, kSecAsn1SubjectPublicKeyInfoTemplate, encBlob);
 976  	if(perr) {
 977  		return FR_Memory;
 978  	}
 979  
 980  	/* copy out */
 981  	*x509Blob = (unsigned char *)fmalloc((unsigned)encBlob.Length);
 982  	*x509BlobLen = (unsigned)encBlob.Length;
 983  	memmove(*x509Blob, encBlob.Data, encBlob.Length); 
 984  	return FR_Success;
 985  }
 986  
 987  feeReturn feeDERDecodeX509PublicKey(
 988  	const unsigned char	*x509Blob,
 989  	unsigned			x509BlobLen,
 990  	feeDepth			*depth,			/* RETURNED */
 991  	unsigned char		**pubBlob,		/* x and y octet string RETURNED */
 992  	unsigned			*pubBlobLen)	/* RETURNED */
 993  {
 994  	SecNssCoder coder;
 995  	CSSM_X509_SUBJECT_PUBLIC_KEY_INFO nssPubKeyInfo;
 996  	PRErrorCode perr;
 997  	
 998  	memset(&nssPubKeyInfo, 0, sizeof(nssPubKeyInfo));
 999  	perr = coder.decode(x509Blob, x509BlobLen, kSecAsn1SubjectPublicKeyInfoTemplate, 
1000  		&nssPubKeyInfo);
1001  	if(perr) {
1002  		dbgLog(("decode(SubjectPublicKeyInfo) error"));
1003  		return FR_BadKeyBlob;
1004  	}
1005  
1006  	/* verify alg identifier & depth */
1007  	feeReturn frtn = feeAlgIdToDepth(&nssPubKeyInfo.algorithm, depth);
1008  	if(frtn) {
1009  		return frtn;
1010  	}
1011  	
1012  	/* copy public key string - it's in bits here */
1013  	CSSM_DATA *pubKey = &nssPubKeyInfo.subjectPublicKey;
1014  	unsigned keyLen =(unsigned) (pubKey->Length + 7) / 8;
1015  	*pubBlob = (unsigned char *)fmalloc(keyLen);
1016  	if(*pubBlob == NULL) {
1017  		return FR_Memory;
1018  	}
1019  	memmove(*pubBlob, pubKey->Data, keyLen);
1020  	*pubBlobLen = keyLen;
1021  	return FR_Success;
1022  }
1023  
1024  #pragma mark --- ECDSA keys, OpenSSL format ---
1025  
1026  /* 
1027   * Encode private, and decode private or public key, in unencrypted OpenSSL format.
1028   */
1029  feeReturn feeDEREncodeOpenSSLPrivateKey(
1030  	const unsigned char	*privBlob,		/* private data octet string */
1031  	unsigned			privBlobLen,
1032  	const unsigned char *pubBlob,		/* public key, optional */
1033  	unsigned			pubBlobLen,
1034  	curveParams			*cp,
1035  	unsigned char		**openBlob,		/* fmallocd and RETURNED */
1036  	unsigned			*openBlobLen)	/* RETURNED */
1037  {
1038  	feeDepth depth;
1039  	const CSSM_OID *curveOid;
1040  	SecNssCoder coder;
1041  	
1042  	NSS_ECDSA_PrivateKey ecdsaPrivKey;
1043  	memset(&ecdsaPrivKey, 0, sizeof(ecdsaPrivKey));
1044  	uint8 vers = 1;
1045  	ecdsaPrivKey.version.Data = &vers;
1046  	ecdsaPrivKey.version.Length = 1;
1047  	ecdsaPrivKey.privateKey.Data = (uint8 *)privBlob;
1048  	ecdsaPrivKey.privateKey.Length = privBlobLen;
1049  	
1050  	/* Params - ASN_ANY - actually the curve OID */
1051  	if(curveParamsDepth(cp, &depth)) {
1052  		dbgLog(("feeDEREncodeOpenSSLPrivateKey: bad depth"));
1053  		return FR_BadKeyBlob;
1054  	}
1055  	curveOid = depthToOid(depth);
1056  	if(curveOid == NULL) {
1057  		return FR_BadKeyBlob;
1058  	}
1059  	
1060  	/* quickie DER-encode of the curve OID */
1061  	try {
1062  		coder.allocItem(ecdsaPrivKey.params, curveOid->Length + 2);
1063  	}
1064  	catch(...) {
1065  		return FR_Memory;
1066  	}
1067  	ecdsaPrivKey.params.Data[0] = BER_TAG_OID;
1068  	ecdsaPrivKey.params.Data[1] = curveOid->Length;
1069  	memmove(ecdsaPrivKey.params.Data+2, curveOid->Data, curveOid->Length);
1070  	
1071  	/* public key - optional - bit string, length in bits */
1072  	if(pubBlob) {
1073  		ecdsaPrivKey.pubKey.Data = (uint8 *)pubBlob;
1074  		ecdsaPrivKey.pubKey.Length = pubBlobLen * 8;
1075  	}
1076  	
1077  	CSSM_DATA encPriv = {0, NULL};
1078  	PRErrorCode perr = coder.encodeItem(&ecdsaPrivKey, kSecAsn1ECDSAPrivateKeyInfoTemplate, encPriv);
1079  	if(perr) {
1080  		return FR_Memory;
1081  	}
1082  
1083  	/* copy out */
1084  	*openBlob = (unsigned char *)fmalloc((unsigned)encPriv.Length);
1085  	*openBlobLen = (unsigned)encPriv.Length;
1086  	memmove(*openBlob, encPriv.Data, encPriv.Length); 
1087  	return FR_Success;
1088  }
1089  
1090  feeReturn feeDERDecodeOpenSSLKey(
1091  	const unsigned char	*osBlob,
1092  	unsigned			osBlobLen,
1093  	feeDepth			*depth,			/* RETURNED */
1094  	unsigned char		**privBlob,		/* private data octet string RETURNED */
1095  	unsigned			*privBlobLen,	/* RETURNED */
1096  	unsigned char		**pubBlob,		/* public data octet string optionally RETURNED */
1097  	unsigned			*pubBlobLen)
1098  {
1099  	SecNssCoder coder;
1100  	NSS_ECDSA_PrivateKey ecdsaPrivKey;
1101  	memset(&ecdsaPrivKey, 0, sizeof(ecdsaPrivKey));
1102  	if(coder.decode(osBlob, osBlobLen,
1103  			kSecAsn1ECDSAPrivateKeyInfoTemplate, &ecdsaPrivKey)) {
1104  		dbgLog(("Error decoding openssl priv key\n"));
1105  		return FR_BadKeyBlob;
1106  	}
1107  	
1108  	unsigned keyLen = (unsigned)ecdsaPrivKey.privateKey.Length;
1109  	if(keyLen == 0) {
1110  		dbgLog(("NULL priv key data in PKCS8\n"));
1111  	}
1112  	*privBlob = (unsigned char *)fmalloc(keyLen);
1113  	if(*privBlob == NULL) {
1114  		return FR_Memory;
1115  	}
1116  	*privBlobLen = keyLen;
1117  	memmove(*privBlob, ecdsaPrivKey.privateKey.Data, keyLen);
1118  	
1119  	/* curve OID --> depth */
1120  	if(ecdsaPrivKey.params.Data != NULL) {
1121  		/* quickie decode */
1122  		const CSSM_DATA *param = &ecdsaPrivKey.params;
1123  		if((param->Data[0] != BER_TAG_OID) || (param->Length <= 2)) {
1124  			dbgLog(("feeDERDecodeOpenSSLKey: bad curve params\n"));
1125  			return FR_BadKeyBlob;
1126  		}
1127  		CSSM_OID decOid = {param->Length-2, param->Data+2};
1128  		if(curveOidToFeeDepth(&decOid, depth)) {
1129  			return FR_BadKeyBlob;
1130  		}
1131  	}
1132  
1133  	/* Public key, if it's there and caller wants it */
1134  	if((ecdsaPrivKey.pubKey.Length != 0) && (pubBlob != NULL)) {
1135  		*pubBlobLen = (unsigned)(ecdsaPrivKey.pubKey.Length + 7) / 8;
1136  		*pubBlob = (unsigned char *)fmalloc(*pubBlobLen);
1137  		memmove(*pubBlob, ecdsaPrivKey.pubKey.Data, *pubBlobLen);
1138  	}
1139  	return FR_Success;
1140  }
1141  
1142  #pragma mark --- ECDSA public key, PKCS8 format ---
1143  
1144  /* 
1145   * Encode/decode private key in unencrypted PKCS8 format.
1146   */
1147  feeReturn feeDEREncodePKCS8PrivateKey(
1148  	const unsigned char	*privBlob,		/* private data octet string */
1149  	unsigned			privBlobLen,
1150  	const unsigned char	*pubBlob,		/* public blob, optional */
1151  	unsigned			pubBlobLen,
1152  	curveParams			*cp,
1153  	unsigned char		**pkcs8Blob,	/* fmallocd and RETURNED */
1154  	unsigned			*pkcs8BlobLen)	/* RETURNED */
1155  {
1156  	/* First encode a NSS_ECDSA_PrivateKey */
1157  	unsigned char *encPriv = NULL;
1158  	unsigned encPrivLen = 0;
1159  	feeReturn frtn = feeDEREncodeOpenSSLPrivateKey(privBlob, privBlobLen,
1160  		pubBlob, pubBlobLen, cp, &encPriv, &encPrivLen);
1161  	if(frtn) {
1162  		return frtn;
1163  	}
1164  	
1165  	/* That encoding goes into NSS_PrivateKeyInfo.private key */
1166  	SecNssCoder coder;
1167  	NSS_PrivateKeyInfo nssPrivKeyInfo;
1168  	CSSM_X509_ALGORITHM_IDENTIFIER &algId = nssPrivKeyInfo.algorithm;
1169  	memset(&nssPrivKeyInfo, 0, sizeof(nssPrivKeyInfo));
1170  	nssPrivKeyInfo.privateKey.Data = (uint8 *)encPriv;
1171  	nssPrivKeyInfo.privateKey.Length = encPrivLen;
1172  	uint8 vers = 0;
1173  	
1174  	feeDepth depth;
1175  	frtn = curveParamsDepth(cp, &depth);
1176  	if(frtn) {
1177  		dbgLog(("feeDEREncodePKCS8PrivateKey: curveParamsDepth error\n"));
1178  		goto errOut;
1179  	}
1180  	frtn = feeSetupAlgId(depth, coder, algId);
1181  	if(frtn) {
1182  		goto errOut;
1183  	}
1184  	
1185  	nssPrivKeyInfo.version.Data = &vers;
1186  	nssPrivKeyInfo.version.Length = 1;
1187  	
1188  	/* DER encode */
1189  	CSSM_DATA encPrivInfo;			// mallocd by coder
1190  	if(coder.encodeItem(&nssPrivKeyInfo, kSecAsn1PrivateKeyInfoTemplate, encPrivInfo)) {
1191  		frtn = FR_Memory;
1192  		goto errOut;
1193  	}
1194  
1195  	/* copy out */
1196  	*pkcs8Blob = (unsigned char *)fmalloc((unsigned)encPrivInfo.Length);
1197  	*pkcs8BlobLen = (unsigned)encPrivInfo.Length;
1198  	memmove(*pkcs8Blob, encPrivInfo.Data, encPrivInfo.Length); 
1199  errOut:
1200  	if(encPriv) {
1201  		ffree(encPriv);
1202  	}
1203  	return frtn;
1204  }
1205  
1206  feeReturn feeDERDecodePKCS8PrivateKey(
1207  	const unsigned char	*pkcs8Blob,
1208  	unsigned			pkcs8BlobLen,
1209  	feeDepth			*depth,			/* RETURNED */
1210  	unsigned char		**privBlob,		/* private data octet string RETURNED */
1211  	unsigned			*privBlobLen,	/* RETURNED */
1212  	unsigned char		**pubBlob,		/* optionally returned, if it's there */
1213  	unsigned			*pubBlobLen)
1214  {
1215  	NSS_PrivateKeyInfo nssPrivKeyInfo;
1216  	PRErrorCode perr;
1217  	SecNssCoder coder;
1218  	
1219  	memset(&nssPrivKeyInfo, 0, sizeof(nssPrivKeyInfo));
1220  	perr = coder.decode(pkcs8Blob, pkcs8BlobLen, kSecAsn1PrivateKeyInfoTemplate, &nssPrivKeyInfo);
1221  	if(perr) {
1222  		dbgLog(("Error decoding top level PKCS8\n"));
1223  		return FR_BadKeyBlob;
1224  	}
1225  	
1226  	/* verify alg identifier & depth */
1227  	feeReturn frtn = feeAlgIdToDepth(&nssPrivKeyInfo.algorithm, depth);
1228  	if(frtn) {
1229  		return frtn;
1230  	}
1231  	
1232  	/* 
1233  	 * nssPrivKeyInfo.privateKey is an octet string containing an encoded 
1234  	 * NSS_ECDSA_PrivateKey. 
1235  	 */
1236  	frtn = feeDERDecodeOpenSSLKey((const unsigned char *)nssPrivKeyInfo.privateKey.Data,
1237  		(unsigned)nssPrivKeyInfo.privateKey.Length, depth, 
1238  		privBlob, privBlobLen,
1239  		pubBlob, pubBlobLen);
1240  		
1241  	return frtn;
1242  }
1243