include/gnutls/abstract.h

0001 /*
0002  * Copyright (C) 2010-2012 Free Software Foundation, Inc.
0003  * Copyright (C) 2015-2017 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 #ifndef GNUTLS_ABSTRACT_H
0025 #define GNUTLS_ABSTRACT_H
0026
0027 #include <gnutls/gnutls.h>
0028 #include <gnutls/x509.h>
0029 #include <gnutls/pkcs11.h>
0030 #include <gnutls/openpgp.h>
0031 #include <gnutls/tpm.h>
0032
0033 #ifdef __cplusplus
0034 extern "C" {
0035 #endif
0036
0037 /* Public key operations */
0038
0039 #define GNUTLS_PUBKEY_VERIFY_FLAG_TLS_RSA GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA
0040 /**
0041  * gnutls_pubkey_flags:
0042  * @GNUTLS_PUBKEY_DISABLE_CALLBACKS: The following flag disables call to PIN callbacks. Only
0043  *   relevant to TPM keys.
0044  * @GNUTLS_PUBKEY_GET_OPENPGP_FINGERPRINT: request an OPENPGP fingerprint instead of the default.
0045  *
0046  * Enumeration of different certificate import flags.
0047  */
0048 typedef enum gnutls_pubkey_flags {
0049     GNUTLS_PUBKEY_DISABLE_CALLBACKS = 1 << 2,
0050     GNUTLS_PUBKEY_GET_OPENPGP_FINGERPRINT = 1 << 3
0051 } gnutls_pubkey_flags_t;
0052
0053 /**
0054  * gnutls_abstract_export_flags:
0055  * @GNUTLS_EXPORT_FLAG_NO_LZ: do not prepend a leading zero to exported values
0056  *
0057  * Enumeration of different certificate import flags.
0058  */
0059 typedef enum gnutls_abstract_export_flags {
0060     GNUTLS_EXPORT_FLAG_NO_LZ = 1
0061 } gnutls_abstract_export_flags_t;
0062
0063 #define GNUTLS_PUBKEY_VERIFY_FLAG_TLS1_RSA GNUTLS_VERIFY_USE_TLS1_RSA
0064
0065 typedef int (*gnutls_privkey_sign_func)(gnutls_privkey_t key, void *userdata,
0066                     const gnutls_datum_t *raw_data,
0067                     gnutls_datum_t *signature);
0068
0069 typedef int (*gnutls_privkey_decrypt_func)(gnutls_privkey_t key, void *userdata,
0070                        const gnutls_datum_t *ciphertext,
0071                        gnutls_datum_t *plaintext);
0072
0073 typedef int (*gnutls_privkey_decrypt_func2)(gnutls_privkey_t key,
0074                         void *userdata,
0075                         const gnutls_datum_t *ciphertext,
0076                         unsigned char *plaintext,
0077                         size_t plaintext_size);
0078
0079 /* to be called to sign pre-hashed data. The input will be
0080  * the output of the hash (such as SHA256) corresponding to
0081  * the signature algorithm. The algorithm GNUTLS_SIGN_RSA_RAW
0082  * will be provided when RSA PKCS#1 DigestInfo structure is provided
0083  * as data (when this is called from a TLS 1.0 or 1.1 session).
0084  */
0085 typedef int (*gnutls_privkey_sign_hash_func)(gnutls_privkey_t key,
0086                          gnutls_sign_algorithm_t algo,
0087                          void *userdata, unsigned int flags,
0088                          const gnutls_datum_t *hash,
0089                          gnutls_datum_t *signature);
0090
0091 /* to be called to sign data. The input data will be
0092  * the data to be signed (and hashed), with the provided
0093  * signature algorithm. This function is used for algorithms
0094  * like ed25519 which cannot take pre-hashed data as input.
0095  */
0096 typedef int (*gnutls_privkey_sign_data_func)(gnutls_privkey_t key,
0097                          gnutls_sign_algorithm_t algo,
0098                          void *userdata, unsigned int flags,
0099                          const gnutls_datum_t *data,
0100                          gnutls_datum_t *signature);
0101
0102 typedef void (*gnutls_privkey_deinit_func)(gnutls_privkey_t key,
0103                        void *userdata);
0104
0105 #define GNUTLS_SIGN_ALGO_TO_FLAGS(sig) (unsigned int)((sig) << 20)
0106 #define GNUTLS_FLAGS_TO_SIGN_ALGO(flags) (unsigned int)((flags) >> 20)
0107
0108 /* Should return the public key algorithm (gnutls_pk_algorithm_t) */
0109 #define GNUTLS_PRIVKEY_INFO_PK_ALGO 1
0110 /* Should return the preferred signature algorithm (gnutls_sign_algorithm_t) or 0. */
0111 #define GNUTLS_PRIVKEY_INFO_SIGN_ALGO (1 << 1)
0112 /* Should return true (1) or false (0) if the provided sign algorithm
0113  * (obtained with GNUTLS_FLAGS_TO_SIGN_ALGO) is supported.
0114  */
0115 #define GNUTLS_PRIVKEY_INFO_HAVE_SIGN_ALGO (1 << 2)
0116 /* Should return the number of bits of the public key algorithm (required for RSA-PSS)
0117  * It is the value that should be returned by gnutls_pubkey_get_pk_algorithm() */
0118 #define GNUTLS_PRIVKEY_INFO_PK_ALGO_BITS (1 << 3)
0119
0120 /* returns information on the public key associated with userdata */
0121 typedef int (*gnutls_privkey_info_func)(gnutls_privkey_t key,
0122                     unsigned int flags, void *userdata);
0123
0124 int gnutls_pubkey_init(gnutls_pubkey_t *key);
0125 void gnutls_pubkey_deinit(gnutls_pubkey_t key);
0126
0127 int gnutls_pubkey_verify_params(gnutls_pubkey_t key);
0128
0129 void gnutls_pubkey_set_pin_function(gnutls_pubkey_t key,
0130                     gnutls_pin_callback_t fn, void *userdata);
0131
0132 int gnutls_pubkey_get_pk_algorithm(gnutls_pubkey_t key, unsigned int *bits);
0133
0134 int gnutls_pubkey_set_spki(gnutls_pubkey_t key, const gnutls_x509_spki_t spki,
0135                unsigned int flags);
0136
0137 int gnutls_pubkey_get_spki(gnutls_pubkey_t key, const gnutls_x509_spki_t spki,
0138                unsigned int flags);
0139
0140 int gnutls_pubkey_import_x509(gnutls_pubkey_t key, gnutls_x509_crt_t crt,
0141                   unsigned int flags);
0142 int gnutls_pubkey_import_x509_crq(gnutls_pubkey_t key, gnutls_x509_crq_t crq,
0143                   unsigned int flags);
0144 int gnutls_pubkey_import_pkcs11(gnutls_pubkey_t key, gnutls_pkcs11_obj_t obj,
0145                 unsigned int flags);
0146 int gnutls_pubkey_import_openpgp(gnutls_pubkey_t key, gnutls_openpgp_crt_t crt,
0147                  unsigned int flags);
0148
0149 int gnutls_pubkey_import_openpgp_raw(gnutls_pubkey_t pkey,
0150                      const gnutls_datum_t *data,
0151                      gnutls_openpgp_crt_fmt_t format,
0152                      const gnutls_openpgp_keyid_t keyid,
0153                      unsigned int flags);
0154 int gnutls_pubkey_import_x509_raw(gnutls_pubkey_t pkey,
0155                   const gnutls_datum_t *data,
0156                   gnutls_x509_crt_fmt_t format,
0157                   unsigned int flags);
0158
0159 int gnutls_pubkey_import_privkey(gnutls_pubkey_t key, gnutls_privkey_t pkey,
0160                  unsigned int usage, unsigned int flags);
0161
0162 int gnutls_pubkey_import_tpm_url(gnutls_pubkey_t pkey, const char *url,
0163                  const char *srk_password, unsigned int flags);
0164
0165 int gnutls_pubkey_import_url(gnutls_pubkey_t key, const char *url,
0166                  unsigned int flags);
0167
0168 int gnutls_pubkey_import_tpm_raw(gnutls_pubkey_t pkey,
0169                  const gnutls_datum_t *fdata,
0170                  gnutls_tpmkey_fmt_t format,
0171                  const char *srk_password, unsigned int flags);
0172
0173 int gnutls_pubkey_get_preferred_hash_algorithm(gnutls_pubkey_t key,
0174                            gnutls_digest_algorithm_t *hash,
0175                            unsigned int *mand);
0176
0177 #define gnutls_pubkey_get_pk_rsa_raw gnutls_pubkey_export_rsa_raw
0178 int gnutls_pubkey_export_rsa_raw(gnutls_pubkey_t key, gnutls_datum_t *m,
0179                  gnutls_datum_t *e);
0180
0181 int gnutls_pubkey_export_rsa_raw2(gnutls_pubkey_t key, gnutls_datum_t *m,
0182                   gnutls_datum_t *e, unsigned flags);
0183
0184 #define gnutls_pubkey_get_pk_dsa_raw gnutls_pubkey_export_dsa_raw
0185 int gnutls_pubkey_export_dsa_raw(gnutls_pubkey_t key, gnutls_datum_t *p,
0186                  gnutls_datum_t *q, gnutls_datum_t *g,
0187                  gnutls_datum_t *y);
0188
0189 int gnutls_pubkey_export_dsa_raw2(gnutls_pubkey_t key, gnutls_datum_t *p,
0190                   gnutls_datum_t *q, gnutls_datum_t *g,
0191                   gnutls_datum_t *y, unsigned flags);
0192
0193 int gnutls_pubkey_export_dh_raw(gnutls_pubkey_t key, gnutls_dh_params_t params,
0194                 gnutls_datum_t *y, unsigned flags);
0195
0196 int gnutls_pubkey_export_ecc_raw2(gnutls_pubkey_t key,
0197                   gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0198                   gnutls_datum_t *y, unsigned flags);
0199
0200 int gnutls_pubkey_export_gost_raw2(gnutls_pubkey_t key,
0201                    gnutls_ecc_curve_t *curve,
0202                    gnutls_digest_algorithm_t *digest,
0203                    gnutls_gost_paramset_t *paramset,
0204                    gnutls_datum_t *x, gnutls_datum_t *y,
0205                    unsigned int flags);
0206
0207 #define gnutls_pubkey_get_pk_ecc_raw gnutls_pubkey_export_ecc_raw
0208 int gnutls_pubkey_export_ecc_raw(gnutls_pubkey_t key, gnutls_ecc_curve_t *curve,
0209                  gnutls_datum_t *x, gnutls_datum_t *y);
0210
0211 #define gnutls_pubkey_get_pk_ecc_x962 gnutls_pubkey_export_ecc_x962
0212 int gnutls_pubkey_export_ecc_x962(gnutls_pubkey_t key,
0213                   gnutls_datum_t *parameters,
0214                   gnutls_datum_t *ecpoint);
0215
0216 int gnutls_pubkey_export(gnutls_pubkey_t key, gnutls_x509_crt_fmt_t format,
0217              void *output_data, size_t *output_data_size);
0218
0219 int gnutls_pubkey_export2(gnutls_pubkey_t key, gnutls_x509_crt_fmt_t format,
0220               gnutls_datum_t *out);
0221
0222 int gnutls_pubkey_get_key_id(gnutls_pubkey_t key, unsigned int flags,
0223                  unsigned char *output_data,
0224                  size_t *output_data_size);
0225
0226 int gnutls_pubkey_get_openpgp_key_id(gnutls_pubkey_t key, unsigned int flags,
0227                      unsigned char *output_data,
0228                      size_t *output_data_size,
0229                      unsigned int *subkey);
0230
0231 int gnutls_pubkey_get_key_usage(gnutls_pubkey_t key, unsigned int *usage);
0232 int gnutls_pubkey_set_key_usage(gnutls_pubkey_t key, unsigned int usage);
0233
0234 int gnutls_pubkey_import(gnutls_pubkey_t key, const gnutls_datum_t *data,
0235              gnutls_x509_crt_fmt_t format);
0236
0237 #define gnutls_pubkey_import_pkcs11_url(key, url, flags) \
0238     gnutls_pubkey_import_url(key, url, flags)
0239
0240 int gnutls_pubkey_import_dsa_raw(gnutls_pubkey_t key, const gnutls_datum_t *p,
0241                  const gnutls_datum_t *q,
0242                  const gnutls_datum_t *g,
0243                  const gnutls_datum_t *y);
0244 int gnutls_pubkey_import_dh_raw(gnutls_pubkey_t key,
0245                 const gnutls_dh_params_t params,
0246                 const gnutls_datum_t *y);
0247 int gnutls_pubkey_import_rsa_raw(gnutls_pubkey_t key, const gnutls_datum_t *m,
0248                  const gnutls_datum_t *e);
0249
0250 int gnutls_pubkey_import_ecc_x962(gnutls_pubkey_t key,
0251                   const gnutls_datum_t *parameters,
0252                   const gnutls_datum_t *ecpoint);
0253
0254 int gnutls_pubkey_import_ecc_raw(gnutls_pubkey_t key, gnutls_ecc_curve_t curve,
0255                  const gnutls_datum_t *x,
0256                  const gnutls_datum_t *y);
0257
0258 int gnutls_pubkey_import_gost_raw(gnutls_pubkey_t key, gnutls_ecc_curve_t curve,
0259                   gnutls_digest_algorithm_t digest,
0260                   gnutls_gost_paramset_t paramset,
0261                   const gnutls_datum_t *x,
0262                   const gnutls_datum_t *y);
0263
0264 int gnutls_pubkey_encrypt_data(gnutls_pubkey_t key, unsigned int flags,
0265                    const gnutls_datum_t *plaintext,
0266                    gnutls_datum_t *ciphertext);
0267
0268 int gnutls_x509_crt_set_pubkey(gnutls_x509_crt_t crt, gnutls_pubkey_t key);
0269
0270 int gnutls_x509_crq_set_pubkey(gnutls_x509_crq_t crq, gnutls_pubkey_t key);
0271
0272 int gnutls_pubkey_verify_hash2(gnutls_pubkey_t key,
0273                    gnutls_sign_algorithm_t algo, unsigned int flags,
0274                    const gnutls_datum_t *hash,
0275                    const gnutls_datum_t *signature);
0276
0277 int gnutls_pubkey_verify_data2(gnutls_pubkey_t pubkey,
0278                    gnutls_sign_algorithm_t algo, unsigned int flags,
0279                    const gnutls_datum_t *data,
0280                    const gnutls_datum_t *signature);
0281
0282 /* Private key operations */
0283
0284 int gnutls_privkey_init(gnutls_privkey_t *key);
0285 void gnutls_privkey_deinit(gnutls_privkey_t key);
0286
0287 /* macros to allow specifying a subgroup and group size in gnutls_privkey_generate()
0288  * and gnutls_x509_privkey_generate() */
0289 #define GNUTLS_SUBGROUP_TO_BITS(group, subgroup) \
0290     (unsigned int)((subgroup << 16) | (group))
0291 #define GNUTLS_BITS_TO_SUBGROUP(bits) ((bits >> 16) & 0xFFFF)
0292 #define GNUTLS_BITS_TO_GROUP(bits) (bits & 0xFFFF)
0293 #define GNUTLS_BITS_HAVE_SUBGROUP(bits) ((bits)&0xFFFF0000)
0294
0295 int gnutls_privkey_generate(gnutls_privkey_t key, gnutls_pk_algorithm_t algo,
0296                 unsigned int bits, unsigned int flags);
0297 int gnutls_privkey_generate2(gnutls_privkey_t pkey, gnutls_pk_algorithm_t algo,
0298                  unsigned int bits, unsigned int flags,
0299                  const gnutls_keygen_data_st *data,
0300                  unsigned data_size);
0301
0302 int gnutls_privkey_set_spki(gnutls_privkey_t key, const gnutls_x509_spki_t spki,
0303                 unsigned int flags);
0304
0305 int gnutls_privkey_get_spki(gnutls_privkey_t key, const gnutls_x509_spki_t spki,
0306                 unsigned int flags);
0307
0308 int gnutls_privkey_verify_seed(gnutls_privkey_t key, gnutls_digest_algorithm_t,
0309                    const void *seed, size_t seed_size);
0310 int gnutls_privkey_get_seed(gnutls_privkey_t key, gnutls_digest_algorithm_t *,
0311                 void *seed, size_t *seed_size);
0312
0313 int gnutls_privkey_verify_params(gnutls_privkey_t key);
0314
0315 void gnutls_privkey_set_flags(gnutls_privkey_t key, unsigned int flags);
0316
0317 void gnutls_privkey_set_pin_function(gnutls_privkey_t key,
0318                      gnutls_pin_callback_t fn, void *userdata);
0319
0320 int gnutls_privkey_get_pk_algorithm(gnutls_privkey_t key, unsigned int *bits);
0321 gnutls_privkey_type_t gnutls_privkey_get_type(gnutls_privkey_t key);
0322 int gnutls_privkey_status(gnutls_privkey_t key);
0323
0324 /**
0325  * gnutls_privkey_flags:
0326  * @GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA: Make an RSA signature on the hashed data as in the TLS protocol.
0327  * @GNUTLS_PRIVKEY_SIGN_FLAG_RSA_PSS: Make an RSA signature on the hashed data with the PSS padding.
0328  * @GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE: Make a signature on the hashed data with reproducible parameters.
0329  *   For RSA-PSS, that means to use empty salt instead of random value. To
0330  *   verify a signature created using this flag, the corresponding SPKI needs
0331  *   to be set on the public key. Use gnutls_pubkey_set_spki() for that.
0332  *   For ECDSA/DSA, it uses the deterministic construction of random parameter
0333  *   according to RFC 6979. Note that this only supports the NIST curves and DSA
0334  *   subgroup bits up to 512.
0335  * @GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE: When importing a private key, automatically
0336  *   release it when the structure it was imported is released.
0337  * @GNUTLS_PRIVKEY_IMPORT_COPY: Copy required values during import.
0338  * @GNUTLS_PRIVKEY_DISABLE_CALLBACKS: The following flag disables call to PIN callbacks etc.
0339  *   Only relevant to TPM keys.
0340  * @GNUTLS_PRIVKEY_FLAG_PROVABLE: When generating a key involving prime numbers, use provable primes; a seed may be required.
0341  * @GNUTLS_PRIVKEY_FLAG_CA: The generated private key is going to be used as a CA (relevant for RSA-PSS keys).
0342  * @GNUTLS_PRIVKEY_FLAG_EXPORT_COMPAT: Keys generated or imported as provable require an extended format which cannot be read by previous versions
0343  *   of gnutls or other applications. By setting this flag the key will be exported in a backwards compatible way,
0344  *   even if the information about the seed used will be lost.
0345  * @GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH: When making an RSA-PSS
0346  *   signature, use the salt whose length is equal to the digest length, as
0347  *   mandated in RFC 8446 4.2.3.
0348  *
0349  * Enumeration of different certificate import flags.
0350  */
0351 typedef enum gnutls_privkey_flags {
0352     GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE = 1,
0353     GNUTLS_PRIVKEY_IMPORT_COPY = 1 << 1,
0354     GNUTLS_PRIVKEY_DISABLE_CALLBACKS = 1 << 2,
0355     GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA = 1 << 4,
0356     GNUTLS_PRIVKEY_FLAG_PROVABLE = 1 << 5,
0357     GNUTLS_PRIVKEY_FLAG_EXPORT_COMPAT = 1 << 6,
0358     GNUTLS_PRIVKEY_SIGN_FLAG_RSA_PSS = 1 << 7,
0359     GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE = 1 << 8,
0360     GNUTLS_PRIVKEY_FLAG_CA = 1 << 9,
0361     GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH = 1 << 10
0362 } gnutls_privkey_flags_t;
0363
0364 int gnutls_privkey_import_pkcs11(gnutls_privkey_t pkey,
0365                  gnutls_pkcs11_privkey_t key,
0366                  unsigned int flags);
0367 int gnutls_privkey_import_x509(gnutls_privkey_t pkey, gnutls_x509_privkey_t key,
0368                    unsigned int flags);
0369 int gnutls_privkey_import_openpgp(gnutls_privkey_t pkey,
0370                   gnutls_openpgp_privkey_t key,
0371                   unsigned int flags);
0372
0373 int gnutls_privkey_export_x509(gnutls_privkey_t pkey,
0374                    gnutls_x509_privkey_t *key);
0375 int gnutls_privkey_export_openpgp(gnutls_privkey_t pkey,
0376                   gnutls_openpgp_privkey_t *key);
0377 int gnutls_privkey_export_pkcs11(gnutls_privkey_t pkey,
0378                  gnutls_pkcs11_privkey_t *key);
0379
0380 int gnutls_privkey_import_openpgp_raw(gnutls_privkey_t pkey,
0381                       const gnutls_datum_t *data,
0382                       gnutls_openpgp_crt_fmt_t format,
0383                       const gnutls_openpgp_keyid_t keyid,
0384                       const char *password);
0385
0386 int gnutls_privkey_import_x509_raw(gnutls_privkey_t pkey,
0387                    const gnutls_datum_t *data,
0388                    gnutls_x509_crt_fmt_t format,
0389                    const char *password, unsigned int flags);
0390
0391 int gnutls_privkey_import_tpm_raw(gnutls_privkey_t pkey,
0392                   const gnutls_datum_t *fdata,
0393                   gnutls_tpmkey_fmt_t format,
0394                   const char *srk_password,
0395                   const char *key_password, unsigned int flags);
0396
0397 int gnutls_privkey_import_tpm_url(gnutls_privkey_t pkey, const char *url,
0398                   const char *srk_password,
0399                   const char *key_password, unsigned int flags);
0400
0401 int gnutls_privkey_import_url(gnutls_privkey_t key, const char *url,
0402                   unsigned int flags);
0403
0404 #if 0
0405 /* for documentation purposes */
0406 int gnutls_privkey_import_pkcs11_url(gnutls_privkey_t key, const char *url);
0407 #endif
0408
0409 #define gnutls_privkey_import_pkcs11_url(key, url) \
0410     gnutls_privkey_import_url(key, url, 0)
0411
0412 int gnutls_privkey_import_ext(gnutls_privkey_t pkey, gnutls_pk_algorithm_t pk,
0413                   void *userdata,
0414                   gnutls_privkey_sign_func sign_func,
0415                   gnutls_privkey_decrypt_func decrypt_func,
0416                   unsigned int flags);
0417
0418 int gnutls_privkey_import_ext2(gnutls_privkey_t pkey, gnutls_pk_algorithm_t pk,
0419                    void *userdata,
0420                    gnutls_privkey_sign_func sign_func,
0421                    gnutls_privkey_decrypt_func decrypt_func,
0422                    gnutls_privkey_deinit_func deinit_func,
0423                    unsigned int flags);
0424
0425 int gnutls_privkey_import_ext3(gnutls_privkey_t pkey, void *userdata,
0426                    gnutls_privkey_sign_func sign_func,
0427                    gnutls_privkey_decrypt_func decrypt_func,
0428                    gnutls_privkey_deinit_func deinit_func,
0429                    gnutls_privkey_info_func info_func,
0430                    unsigned int flags);
0431
0432 int gnutls_privkey_import_ext4(gnutls_privkey_t pkey, void *userdata,
0433                    gnutls_privkey_sign_data_func sign_data_func,
0434                    gnutls_privkey_sign_hash_func sign_hash_func,
0435                    gnutls_privkey_decrypt_func decrypt_func,
0436                    gnutls_privkey_deinit_func deinit_func,
0437                    gnutls_privkey_info_func info_func,
0438                    unsigned int flags);
0439
0440 int gnutls_privkey_import_dsa_raw(gnutls_privkey_t key, const gnutls_datum_t *p,
0441                   const gnutls_datum_t *q,
0442                   const gnutls_datum_t *g,
0443                   const gnutls_datum_t *y,
0444                   const gnutls_datum_t *x);
0445
0446 int gnutls_privkey_import_dh_raw(gnutls_privkey_t key,
0447                  const gnutls_dh_params_t params,
0448                  const gnutls_datum_t *y,
0449                  const gnutls_datum_t *x);
0450
0451 int gnutls_privkey_import_rsa_raw(
0452     gnutls_privkey_t key, const gnutls_datum_t *m, const gnutls_datum_t *e,
0453     const gnutls_datum_t *d, const gnutls_datum_t *p,
0454     const gnutls_datum_t *q, const gnutls_datum_t *u,
0455     const gnutls_datum_t *e1, const gnutls_datum_t *e2);
0456 int gnutls_privkey_import_ecc_raw(gnutls_privkey_t key,
0457                   gnutls_ecc_curve_t curve,
0458                   const gnutls_datum_t *x,
0459                   const gnutls_datum_t *y,
0460                   const gnutls_datum_t *k);
0461
0462 int gnutls_privkey_import_gost_raw(gnutls_privkey_t key,
0463                    gnutls_ecc_curve_t curve,
0464                    gnutls_digest_algorithm_t digest,
0465                    gnutls_gost_paramset_t paramset,
0466                    const gnutls_datum_t *x,
0467                    const gnutls_datum_t *y,
0468                    const gnutls_datum_t *k);
0469
0470 int gnutls_privkey_sign_data(gnutls_privkey_t signer,
0471                  gnutls_digest_algorithm_t hash, unsigned int flags,
0472                  const gnutls_datum_t *data,
0473                  gnutls_datum_t *signature);
0474
0475 int gnutls_privkey_sign_data2(gnutls_privkey_t signer,
0476                   gnutls_sign_algorithm_t algo, unsigned int flags,
0477                   const gnutls_datum_t *data,
0478                   gnutls_datum_t *signature);
0479
0480 #define gnutls_privkey_sign_raw_data(key, flags, data, sig)                 \
0481     gnutls_privkey_sign_hash(key, 0, GNUTLS_PRIVKEY_SIGN_FLAG_TLS1_RSA, \
0482                  data, sig)
0483
0484 int gnutls_privkey_sign_hash(gnutls_privkey_t signer,
0485                  gnutls_digest_algorithm_t hash_algo,
0486                  unsigned int flags,
0487                  const gnutls_datum_t *hash_data,
0488                  gnutls_datum_t *signature);
0489
0490 int gnutls_privkey_sign_hash2(gnutls_privkey_t signer,
0491                   gnutls_sign_algorithm_t algo, unsigned int flags,
0492                   const gnutls_datum_t *hash_data,
0493                   gnutls_datum_t *signature);
0494
0495 int gnutls_privkey_decrypt_data(gnutls_privkey_t key, unsigned int flags,
0496                 const gnutls_datum_t *ciphertext,
0497                 gnutls_datum_t *plaintext);
0498
0499 int gnutls_privkey_decrypt_data2(gnutls_privkey_t key, unsigned int flags,
0500                  const gnutls_datum_t *ciphertext,
0501                  unsigned char *plaintext,
0502                  size_t plaintext_size);
0503
0504 int gnutls_privkey_export_rsa_raw(gnutls_privkey_t key, gnutls_datum_t *m,
0505                   gnutls_datum_t *e, gnutls_datum_t *d,
0506                   gnutls_datum_t *p, gnutls_datum_t *q,
0507                   gnutls_datum_t *u, gnutls_datum_t *e1,
0508                   gnutls_datum_t *e2);
0509
0510 int gnutls_privkey_export_rsa_raw2(gnutls_privkey_t key, gnutls_datum_t *m,
0511                    gnutls_datum_t *e, gnutls_datum_t *d,
0512                    gnutls_datum_t *p, gnutls_datum_t *q,
0513                    gnutls_datum_t *u, gnutls_datum_t *e1,
0514                    gnutls_datum_t *e2, unsigned flags);
0515
0516 int gnutls_privkey_export_dsa_raw(gnutls_privkey_t key, gnutls_datum_t *p,
0517                   gnutls_datum_t *q, gnutls_datum_t *g,
0518                   gnutls_datum_t *y, gnutls_datum_t *x);
0519
0520 int gnutls_privkey_export_dsa_raw2(gnutls_privkey_t key, gnutls_datum_t *p,
0521                    gnutls_datum_t *q, gnutls_datum_t *g,
0522                    gnutls_datum_t *y, gnutls_datum_t *x,
0523                    unsigned flags);
0524
0525 int gnutls_privkey_export_dh_raw(gnutls_privkey_t key,
0526                  gnutls_dh_params_t params, gnutls_datum_t *y,
0527                  gnutls_datum_t *x, unsigned int flags);
0528
0529 int gnutls_privkey_export_ecc_raw(gnutls_privkey_t key,
0530                   gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0531                   gnutls_datum_t *y, gnutls_datum_t *k);
0532
0533 int gnutls_privkey_export_ecc_raw2(gnutls_privkey_t key,
0534                    gnutls_ecc_curve_t *curve, gnutls_datum_t *x,
0535                    gnutls_datum_t *y, gnutls_datum_t *k,
0536                    unsigned flags);
0537
0538 int gnutls_privkey_export_gost_raw2(gnutls_privkey_t key,
0539                     gnutls_ecc_curve_t *curve,
0540                     gnutls_digest_algorithm_t *digest,
0541                     gnutls_gost_paramset_t *paramset,
0542                     gnutls_datum_t *x, gnutls_datum_t *y,
0543                     gnutls_datum_t *k, unsigned flags);
0544 int gnutls_privkey_derive_secret(gnutls_privkey_t privkey,
0545                  gnutls_pubkey_t pubkey,
0546                  const gnutls_datum_t *nonce,
0547                  gnutls_datum_t *secret, unsigned int flags);
0548
0549 int gnutls_x509_crt_privkey_sign(gnutls_x509_crt_t crt,
0550                  gnutls_x509_crt_t issuer,
0551                  gnutls_privkey_t issuer_key,
0552                  gnutls_digest_algorithm_t dig,
0553                  unsigned int flags);
0554
0555 int gnutls_x509_crl_privkey_sign(gnutls_x509_crl_t crl,
0556                  gnutls_x509_crt_t issuer,
0557                  gnutls_privkey_t issuer_key,
0558                  gnutls_digest_algorithm_t dig,
0559                  unsigned int flags);
0560
0561 int gnutls_x509_crq_privkey_sign(gnutls_x509_crq_t crq, gnutls_privkey_t key,
0562                  gnutls_digest_algorithm_t dig,
0563                  unsigned int flags);
0564
0565 /**
0566  * gnutls_pcert_st:
0567  * @pubkey: public key of parsed certificate.
0568  * @cert: certificate itself of parsed certificate
0569  * @type: type of certificate, a #gnutls_certificate_type_t type.
0570  *
0571  * A parsed certificate.
0572  */
0573 typedef struct gnutls_pcert_st {
0574     gnutls_pubkey_t pubkey;
0575     gnutls_datum_t cert;
0576     gnutls_certificate_type_t type;
0577 } gnutls_pcert_st;
0578
0579 /* This flag is unused/ignored */
0580 #define GNUTLS_PCERT_NO_CERT 1
0581
0582 int gnutls_pcert_import_x509(gnutls_pcert_st *pcert, gnutls_x509_crt_t crt,
0583                  unsigned int flags);
0584
0585 int gnutls_pcert_import_x509_list(gnutls_pcert_st *pcert,
0586                   gnutls_x509_crt_t *crt, unsigned *ncrt,
0587                   unsigned int flags);
0588
0589 int gnutls_pcert_export_x509(gnutls_pcert_st *pcert, gnutls_x509_crt_t *crt);
0590
0591 int gnutls_pcert_list_import_x509_raw(gnutls_pcert_st *pcerts,
0592                       unsigned int *pcert_max,
0593                       const gnutls_datum_t *data,
0594                       gnutls_x509_crt_fmt_t format,
0595                       unsigned int flags);
0596
0597 int gnutls_pcert_list_import_x509_file(gnutls_pcert_st *pcert_list,
0598                        unsigned *pcert_list_size,
0599                        const char *file,
0600                        gnutls_x509_crt_fmt_t format,
0601                        gnutls_pin_callback_t pin_fn,
0602                        void *pin_fn_userdata,
0603                        unsigned int flags);
0604
0605 int gnutls_pcert_import_x509_raw(gnutls_pcert_st *pcert,
0606                  const gnutls_datum_t *cert,
0607                  gnutls_x509_crt_fmt_t format,
0608                  unsigned int flags);
0609
0610 int gnutls_pcert_import_openpgp_raw(gnutls_pcert_st *pcert,
0611                     const gnutls_datum_t *cert,
0612                     gnutls_openpgp_crt_fmt_t format,
0613                     gnutls_openpgp_keyid_t keyid,
0614                     unsigned int flags);
0615
0616 int gnutls_pcert_import_openpgp(gnutls_pcert_st *pcert,
0617                 gnutls_openpgp_crt_t crt, unsigned int flags);
0618
0619 int gnutls_pcert_export_openpgp(gnutls_pcert_st *pcert,
0620                 gnutls_openpgp_crt_t *crt);
0621
0622 void gnutls_pcert_deinit(gnutls_pcert_st *pcert);
0623
0624 int gnutls_pcert_import_rawpk(gnutls_pcert_st *pcert, gnutls_pubkey_t key,
0625                   unsigned int flags);
0626
0627 int gnutls_pcert_import_rawpk_raw(gnutls_pcert_st *pcert,
0628                   const gnutls_datum_t *rawpubkey,
0629                   gnutls_x509_crt_fmt_t format,
0630                   unsigned int key_usage, unsigned int flags);
0631
0632 /* For certificate credentials */
0633 /* This is the same as gnutls_certificate_retrieve_function()
0634      * but retrieves a gnutls_pcert_st which requires much less processing
0635      * within the library.
0636      */
0637 typedef int gnutls_certificate_retrieve_function2(
0638     gnutls_session_t, const gnutls_datum_t *req_ca_rdn, int nreqs,
0639     const gnutls_pk_algorithm_t *pk_algos, int pk_algos_length,
0640     gnutls_pcert_st **, unsigned int *pcert_length,
0641     gnutls_privkey_t *privkey);
0642
0643 void gnutls_certificate_set_retrieve_function2(
0644     gnutls_certificate_credentials_t cred,
0645     gnutls_certificate_retrieve_function2 *func);
0646
0647 struct gnutls_cert_retr_st {
0648     unsigned version; /* set to 1 */
0649     gnutls_certificate_credentials_t cred;
0650     const gnutls_datum_t *req_ca_rdn;
0651     unsigned nreqs;
0652     const gnutls_pk_algorithm_t *pk_algos;
0653     unsigned pk_algos_length;
0654
0655     /* other fields may be added if version is > 1 */
0656     unsigned char padding[64];
0657 };
0658
0659 /* When the callback sets this value, gnutls will deinitialize the given
0660  * values after use */
0661 #define GNUTLS_CERT_RETR_DEINIT_ALL 1
0662
0663 typedef int gnutls_certificate_retrieve_function3(
0664     gnutls_session_t, const struct gnutls_cert_retr_st *info,
0665     gnutls_pcert_st **certs, unsigned int *certs_length,
0666     gnutls_ocsp_data_st **ocsp, unsigned int *ocsp_length,
0667     gnutls_privkey_t *privkey, unsigned int *flags);
0668
0669 void gnutls_certificate_set_retrieve_function3(
0670     gnutls_certificate_credentials_t cred,
0671     gnutls_certificate_retrieve_function3 *func);
0672
0673 int gnutls_certificate_set_key(gnutls_certificate_credentials_t res,
0674                    const char **names, int names_size,
0675                    gnutls_pcert_st *pcert_list, int pcert_list_size,
0676                    gnutls_privkey_t key);
0677
0678 int gnutls_pubkey_print(gnutls_pubkey_t pubkey,
0679             gnutls_certificate_print_formats_t format,
0680             gnutls_datum_t *out);
0681
0682 #ifdef __cplusplus
0683 }
0684 #endif
0685
0686 #endif /* GNUTLS_ABSTRACT_H */