/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*

 * This file implements the Symkey wrapper and the PKCS context

 * Interfaces.

 */

#include "seccomon.h"

#include "secmod.h"

#include "nssilock.h"

#include "secmodi.h"

#include "secmodti.h"

#include "pkcs11.h"

#include "pk11func.h"

#include "secitem.h"

#include "secoid.h"

#include "secerr.h"

#include "hasht.h"

static void

pk11_EnterKeyMonitor(PK11SymKey *symKey) {

    if (!symKey->sessionOwner || !(symKey->slot->isThreadSafe)) 

	PK11_EnterSlotMonitor(symKey->slot);

}

static void

pk11_ExitKeyMonitor(PK11SymKey *symKey) {

    if (!symKey->sessionOwner || !(symKey->slot->isThreadSafe)) 

    	PK11_ExitSlotMonitor(symKey->slot);

}

/*

 * pk11_getKeyFromList returns a symKey that has a session (if needSession

 * was specified), or explicitly does not have a session (if needSession

 * was not specified).

 */

static PK11SymKey *

pk11_getKeyFromList(PK11SlotInfo *slot, PRBool needSession) {

    PK11SymKey *symKey = NULL;

    PZ_Lock(slot->freeListLock);

    /* own session list are symkeys with sessions that the symkey owns.

     * 'most' symkeys will own their own session. */

    if (needSession) {

	if (slot->freeSymKeysWithSessionHead) {

    	    symKey = slot->freeSymKeysWithSessionHead;

	    slot->freeSymKeysWithSessionHead = symKey->next;

	    slot->keyCount--;

	}

    }

    /* if we don't need a symkey with its own session, or we couldn't find

     * one on the owner list, get one from the non-owner free list. */

    if (!symKey) {

	if (slot->freeSymKeysHead) {

    	    symKey = slot->freeSymKeysHead;

	    slot->freeSymKeysHead = symKey->next;

	    slot->keyCount--;

	}

    }

    PZ_Unlock(slot->freeListLock);

    if (symKey) {

	symKey->next = NULL;

	if (!needSession) {

	    return symKey;

	}

	/* if we are getting an owner key, make sure we have a valid session.

         * session could be invalid if the token has been removed or because

         * we got it from the non-owner free list */

	if ((symKey->series != slot->series) || 

			 (symKey->session == CK_INVALID_SESSION)) {

	    symKey->session = pk11_GetNewSession(slot, &symKey->sessionOwner);

	}

	PORT_Assert(symKey->session != CK_INVALID_SESSION);

	if (symKey->session != CK_INVALID_SESSION)

	    return symKey;

	PK11_FreeSymKey(symKey);

	/* if we are here, we need a session, but couldn't get one, it's 

	 * unlikely we pk11_GetNewSession will succeed if we call it a second

	 * time. */

	return NULL;

    }

    symKey = PORT_New(PK11SymKey);

    if (symKey == NULL) {

	return NULL;

    }

    symKey->next = NULL;

    if (needSession) {

	symKey->session = pk11_GetNewSession(slot,&symKey->sessionOwner);

	PORT_Assert(symKey->session != CK_INVALID_SESSION);

        if (symKey->session == CK_INVALID_SESSION) {

	    PK11_FreeSymKey(symKey);

	    symKey = NULL;

	}

    } else {

	symKey->session = CK_INVALID_SESSION;

    }

    return symKey;

}

/* Caller MUST hold slot->freeListLock (or ref count == 0?) !! */

void

PK11_CleanKeyList(PK11SlotInfo *slot)

{

    PK11SymKey *symKey = NULL;

    while (slot->freeSymKeysWithSessionHead) {

    	symKey = slot->freeSymKeysWithSessionHead;

	slot->freeSymKeysWithSessionHead = symKey->next;

	pk11_CloseSession(slot, symKey->session, symKey->sessionOwner);

	PORT_Free(symKey);

    }

    while (slot->freeSymKeysHead) {

    	symKey = slot->freeSymKeysHead;

	slot->freeSymKeysHead = symKey->next;

	pk11_CloseSession(slot, symKey->session, symKey->sessionOwner);

	PORT_Free(symKey);

    }

    return;

}

/*

 * create a symetric key:

 *      Slot is the slot to create the key in.

 *      type is the mechanism type 

 *      owner is does this symKey structure own it's object handle (rare

 *        that this is false).

 *      needSession means the returned symKey will return with a valid session

 *        allocated already.

 */

static PK11SymKey *

pk11_CreateSymKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, 

		  PRBool owner, PRBool needSession, void *wincx)

{

    PK11SymKey *symKey = pk11_getKeyFromList(slot, needSession);

    if (symKey == NULL) {

	return NULL;

    }

    /* if needSession was specified, make sure we have a valid session.

     * callers which specify needSession as false should do their own

     * check of the session before returning the symKey */

    if (needSession && symKey->session == CK_INVALID_SESSION) {

    	PK11_FreeSymKey(symKey);

	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

	return NULL;

    }

    symKey->type = type;

    symKey->data.type = siBuffer;

    symKey->data.data = NULL;

    symKey->data.len = 0;

    symKey->owner = owner;

    symKey->objectID = CK_INVALID_HANDLE;

    symKey->slot = slot;

    symKey->series = slot->series;

    symKey->cx = wincx;

    symKey->size = 0;

    symKey->refCount = 1;

    symKey->origin = PK11_OriginNULL;

    symKey->parent = NULL;

    symKey->freeFunc = NULL;

    symKey->userData = NULL;

    PK11_ReferenceSlot(slot);

    return symKey;

}

/*

 * destroy a symetric key

 */

void

PK11_FreeSymKey(PK11SymKey *symKey)

{

    PK11SlotInfo *slot;

    PRBool freeit = PR_TRUE;

    if (PR_ATOMIC_DECREMENT(&symKey->refCount) == 0) {

	PK11SymKey *parent = symKey->parent;

	symKey->parent = NULL;

	if ((symKey->owner) && symKey->objectID != CK_INVALID_HANDLE) {

	    pk11_EnterKeyMonitor(symKey);

	    (void) PK11_GETTAB(symKey->slot)->

		C_DestroyObject(symKey->session, symKey->objectID);

	    pk11_ExitKeyMonitor(symKey);

	}

	if (symKey->data.data) {

	    PORT_Memset(symKey->data.data, 0, symKey->data.len);

	    PORT_Free(symKey->data.data);

	}

	/* free any existing data */

	if (symKey->userData && symKey->freeFunc) {

	    (*symKey->freeFunc)(symKey->userData);

	}

        slot = symKey->slot;

        PZ_Lock(slot->freeListLock);

	if (slot->keyCount < slot->maxKeyCount) {

	    /* 

             * freeSymkeysWithSessionHead contain a list of reusable

	     *  SymKey structures with valid sessions.

	     *    sessionOwner must be true.

             *    session must be valid.

             * freeSymKeysHead contain a list of SymKey structures without

             *  valid session.

             *    session must be CK_INVALID_SESSION.

	     *    though sessionOwner is false, callers should not depend on

	     *    this fact.

	     */

	    if (symKey->sessionOwner) {

		PORT_Assert (symKey->session != CK_INVALID_SESSION);

		symKey->next = slot->freeSymKeysWithSessionHead;

		slot->freeSymKeysWithSessionHead = symKey;

	    } else {

		symKey->session = CK_INVALID_SESSION;

		symKey->next = slot->freeSymKeysHead;

		slot->freeSymKeysHead = symKey;

	    }

	    slot->keyCount++;

	    symKey->slot = NULL;

	    freeit = PR_FALSE;

        }

	PZ_Unlock(slot->freeListLock);

        if (freeit) {

	    pk11_CloseSession(symKey->slot, symKey->session,

							symKey->sessionOwner);

	    PORT_Free(symKey);

	}

	PK11_FreeSlot(slot);

	if (parent) {

	    PK11_FreeSymKey(parent);

	}

    }

}

PK11SymKey *

PK11_ReferenceSymKey(PK11SymKey *symKey)

{

    PR_ATOMIC_INCREMENT(&symKey->refCount);

    return symKey;

}

/*

 * Accessors

 */

CK_MECHANISM_TYPE

PK11_GetMechanism(PK11SymKey *symKey)

{

    return symKey->type;

}

/*

 * return the slot associated with a symetric key

 */

PK11SlotInfo *

PK11_GetSlotFromKey(PK11SymKey *symKey)

{

    return PK11_ReferenceSlot(symKey->slot);

}

CK_KEY_TYPE PK11_GetSymKeyType(PK11SymKey *symKey)

{

    return PK11_GetKeyType(symKey->type,symKey->size);

}

PK11SymKey *

PK11_GetNextSymKey(PK11SymKey *symKey)

{

    return symKey ? symKey->next : NULL;

}

char *

PK11_GetSymKeyNickname(PK11SymKey *symKey)

{

    return PK11_GetObjectNickname(symKey->slot,symKey->objectID);

}

SECStatus

PK11_SetSymKeyNickname(PK11SymKey *symKey, const char *nickname)

{

    return PK11_SetObjectNickname(symKey->slot,symKey->objectID,nickname);

}

void *

PK11_GetSymKeyUserData(PK11SymKey *symKey)

{

    return symKey->userData;

}

void

PK11_SetSymKeyUserData(PK11SymKey *symKey, void *userData, 

                                              PK11FreeDataFunc freeFunc)

{

    /* free any existing data */

    if (symKey->userData && symKey->freeFunc) {

	(*symKey->freeFunc)(symKey->userData);

    }

    symKey->userData = userData;

    symKey->freeFunc = freeFunc;

    return;

}

/*

 * turn key handle into an appropriate key object

 */

PK11SymKey *

PK11_SymKeyFromHandle(PK11SlotInfo *slot, PK11SymKey *parent, PK11Origin origin,

    CK_MECHANISM_TYPE type, CK_OBJECT_HANDLE keyID, PRBool owner, void *wincx)

{

    PK11SymKey *symKey;

    PRBool needSession = !(owner && parent);

    if (keyID == CK_INVALID_HANDLE) {

	return NULL;

    }

    symKey = pk11_CreateSymKey(slot, type, owner, needSession, wincx);

    if (symKey == NULL) {

	return NULL;

    }

    symKey->objectID = keyID;

    symKey->origin = origin;

    /* adopt the parent's session */

    /* This is only used by SSL. What we really want here is a session

     * structure with a ref count so  the session goes away only after all the

     * keys do. */

    if (!needSession) {

	symKey->sessionOwner = PR_FALSE;

	symKey->session = parent->session;

	symKey->parent = PK11_ReferenceSymKey(parent);

        /* This is the only case where pk11_CreateSymKey does not explicitly

	 * check symKey->session. We need to assert here to make sure.

	 * the session isn't invalid. */

	PORT_Assert(parent->session != CK_INVALID_SESSION);

	if (parent->session == CK_INVALID_SESSION) {

	    PK11_FreeSymKey(symKey);

	    PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

	    return NULL;

	}

    }

    return symKey;

}

/*

 * turn key handle into an appropriate key object

 */

PK11SymKey *

PK11_GetWrapKey(PK11SlotInfo *slot, int wrap, CK_MECHANISM_TYPE type,

						    int series, void *wincx)

{

    PK11SymKey *symKey = NULL;

    if (slot->series != series) return NULL;

    if (slot->refKeys[wrap] == CK_INVALID_HANDLE) return NULL;

    if (type == CKM_INVALID_MECHANISM) type = slot->wrapMechanism;

    symKey = PK11_SymKeyFromHandle(slot, NULL, PK11_OriginDerive,

		 slot->wrapMechanism, slot->refKeys[wrap], PR_FALSE, wincx);

    return symKey;

}

/*

 * This function is not thread-safe because it sets wrapKey->sessionOwner

 * without using a lock or atomic routine.  It can only be called when

 * only one thread has a reference to wrapKey.

 */

void

PK11_SetWrapKey(PK11SlotInfo *slot, int wrap, PK11SymKey *wrapKey)

{

    /* save the handle and mechanism for the wrapping key */

    /* mark the key and session as not owned by us to they don't get freed

     * when the key goes way... that lets us reuse the key later */

    slot->refKeys[wrap] = wrapKey->objectID;

    wrapKey->owner = PR_FALSE;

    wrapKey->sessionOwner = PR_FALSE;

    slot->wrapMechanism = wrapKey->type;

}

/*

 * figure out if a key is still valid or if it is stale.

 */

PRBool

PK11_VerifyKeyOK(PK11SymKey *key) {

    if (!PK11_IsPresent(key->slot)) {

	return PR_FALSE;

    }

    return (PRBool)(key->series == key->slot->series);

}

static PK11SymKey *

pk11_ImportSymKeyWithTempl(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,

                  PK11Origin origin, PRBool isToken, CK_ATTRIBUTE *keyTemplate,

		  unsigned int templateCount, SECItem *key, void *wincx)

{

    PK11SymKey *    symKey;

    SECStatus	    rv;

    symKey = pk11_CreateSymKey(slot, type, !isToken, PR_TRUE, wincx);

    if (symKey == NULL) {

	return NULL;

    }

    symKey->size = key->len;

    PK11_SETATTRS(&keyTemplate[templateCount], CKA_VALUE, key->data, key->len);

    templateCount++;

    if (SECITEM_CopyItem(NULL,&symKey->data,key) != SECSuccess) {

	PK11_FreeSymKey(symKey);

	return NULL;

    }

    symKey->origin = origin;

    /* import the keys */

    rv = PK11_CreateNewObject(slot, symKey->session, keyTemplate,

		 	templateCount, isToken, &symKey->objectID);

    if ( rv != SECSuccess) {

	PK11_FreeSymKey(symKey);

	return NULL;

    }

    return symKey;

}

/*

 * turn key bits into an appropriate key object

 */

PK11SymKey *

PK11_ImportSymKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,

     PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key,void *wincx)

{

    PK11SymKey *    symKey;

    unsigned int    templateCount = 0;

    CK_OBJECT_CLASS keyClass 	= CKO_SECRET_KEY;

    CK_KEY_TYPE     keyType 	= CKK_GENERIC_SECRET;

    CK_BBOOL        cktrue 	= CK_TRUE; /* sigh */

    CK_ATTRIBUTE    keyTemplate[5];

    CK_ATTRIBUTE *  attrs 	= keyTemplate;

    PK11_SETATTRS(attrs, CKA_CLASS, &keyClass, sizeof(keyClass) ); attrs++;

    PK11_SETATTRS(attrs, CKA_KEY_TYPE, &keyType, sizeof(keyType) ); attrs++;

    PK11_SETATTRS(attrs, operation, &cktrue, 1); attrs++;

    templateCount = attrs - keyTemplate;

    PR_ASSERT(templateCount+1 <= sizeof(keyTemplate)/sizeof(CK_ATTRIBUTE));

    keyType = PK11_GetKeyType(type,key->len);

    symKey = pk11_ImportSymKeyWithTempl(slot, type, origin, PR_FALSE, 

				keyTemplate, templateCount, key, wincx);

    return symKey;

}

/*

 * turn key bits into an appropriate key object

 */

PK11SymKey *

PK11_ImportSymKeyWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,

     PK11Origin origin, CK_ATTRIBUTE_TYPE operation, SECItem *key,

     CK_FLAGS flags, PRBool isPerm, void *wincx)

{

    PK11SymKey *    symKey;

    unsigned int    templateCount = 0;

    CK_OBJECT_CLASS keyClass 	= CKO_SECRET_KEY;

    CK_KEY_TYPE     keyType 	= CKK_GENERIC_SECRET;

    CK_BBOOL        cktrue 	= CK_TRUE; /* sigh */

    CK_ATTRIBUTE    keyTemplate[MAX_TEMPL_ATTRS];

    CK_ATTRIBUTE *  attrs 	= keyTemplate;

    PK11_SETATTRS(attrs, CKA_CLASS, &keyClass, sizeof(keyClass) ); attrs++;

    PK11_SETATTRS(attrs, CKA_KEY_TYPE, &keyType, sizeof(keyType) ); attrs++;

    if (isPerm) {

	PK11_SETATTRS(attrs, CKA_TOKEN, &cktrue, sizeof(cktrue) ); attrs++;

	/* sigh some tokens think CKA_PRIVATE = false is a reasonable 

	 * default for secret keys */

	PK11_SETATTRS(attrs, CKA_PRIVATE, &cktrue, sizeof(cktrue) ); attrs++;

    }

    attrs += pk11_OpFlagsToAttributes(flags, attrs, &cktrue);

    if ((operation != CKA_FLAGS_ONLY) &&

    	 !pk11_FindAttrInTemplate(keyTemplate, attrs-keyTemplate, operation)) {

        PK11_SETATTRS(attrs, operation, &cktrue, sizeof(cktrue)); attrs++;

    }

    templateCount = attrs - keyTemplate;

    PR_ASSERT(templateCount+1 <= sizeof(keyTemplate)/sizeof(CK_ATTRIBUTE));

    keyType = PK11_GetKeyType(type,key->len);

    symKey = pk11_ImportSymKeyWithTempl(slot, type, origin, isPerm,

				 keyTemplate, templateCount, key, wincx);

    if (symKey && isPerm) {

	symKey->owner = PR_FALSE;

    }

    return symKey;

}

PK11SymKey *

PK11_FindFixedKey(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *keyID,

								void *wincx)

{

    CK_ATTRIBUTE findTemp[4];

    CK_ATTRIBUTE *attrs;

    CK_BBOOL ckTrue = CK_TRUE;

    CK_OBJECT_CLASS keyclass = CKO_SECRET_KEY;

    int tsize = 0;

    CK_OBJECT_HANDLE key_id;

    attrs = findTemp;

    PK11_SETATTRS(attrs, CKA_CLASS, &keyclass, sizeof(keyclass)); attrs++;

    PK11_SETATTRS(attrs, CKA_TOKEN, &ckTrue, sizeof(ckTrue)); attrs++;

    if (keyID) {

        PK11_SETATTRS(attrs, CKA_ID, keyID->data, keyID->len); attrs++;

    }

    tsize = attrs - findTemp;

    PORT_Assert(tsize <= sizeof(findTemp)/sizeof(CK_ATTRIBUTE));

    key_id = pk11_FindObjectByTemplate(slot,findTemp,tsize);

    if (key_id == CK_INVALID_HANDLE) {

	return NULL;

    }

    return PK11_SymKeyFromHandle(slot, NULL, PK11_OriginDerive, type, key_id,

		 				PR_FALSE, wincx);

}

PK11SymKey *

PK11_ListFixedKeysInSlot(PK11SlotInfo *slot, char *nickname, void *wincx)

{

    CK_ATTRIBUTE findTemp[4];

    CK_ATTRIBUTE *attrs;

    CK_BBOOL ckTrue = CK_TRUE;

    CK_OBJECT_CLASS keyclass = CKO_SECRET_KEY;

    int tsize = 0;

    int objCount = 0;

    CK_OBJECT_HANDLE *key_ids;

    PK11SymKey *nextKey = NULL;

    PK11SymKey *topKey = NULL;

    int i,len;

    attrs = findTemp;

    PK11_SETATTRS(attrs, CKA_CLASS, &keyclass, sizeof(keyclass)); attrs++;

    PK11_SETATTRS(attrs, CKA_TOKEN, &ckTrue, sizeof(ckTrue)); attrs++;

    if (nickname) {

	len = PORT_Strlen(nickname);

	PK11_SETATTRS(attrs, CKA_LABEL, nickname, len); attrs++;

    }

    tsize = attrs - findTemp;

    PORT_Assert(tsize <= sizeof(findTemp)/sizeof(CK_ATTRIBUTE));

    key_ids = pk11_FindObjectsByTemplate(slot,findTemp,tsize,&objCount);

    if (key_ids == NULL) {

	return NULL;

    }

    for (i=0; i < objCount ; i++) {

	SECItem typeData;

	CK_KEY_TYPE type = CKK_GENERIC_SECRET;

        SECStatus rv = PK11_ReadAttribute(slot, key_ids[i], 

						CKA_KEY_TYPE, NULL, &typeData);

	if (rv == SECSuccess) {

	    if (typeData.len == sizeof(CK_KEY_TYPE)) {

	    	type = *(CK_KEY_TYPE *)typeData.data;

	    }

	    PORT_Free(typeData.data);

	}

	nextKey = PK11_SymKeyFromHandle(slot, NULL, PK11_OriginDerive, 

		PK11_GetKeyMechanism(type), key_ids[i], PR_FALSE, wincx);

	if (nextKey) {

	    nextKey->next = topKey;

	    topKey = nextKey;

	}

   }

   PORT_Free(key_ids);

   return topKey;

}

void *

PK11_GetWindow(PK11SymKey *key)

{

   return key->cx;

}

/*

 * extract a symetric key value. NOTE: if the key is sensitive, we will

 * not be able to do this operation. This function is used to move

 * keys from one token to another */

SECStatus

PK11_ExtractKeyValue(PK11SymKey *symKey)

{

    SECStatus rv;

    if (symKey->data.data != NULL) {

	if (symKey->size == 0) {

	   symKey->size = symKey->data.len;

	}

	return SECSuccess;

    }

    if (symKey->slot == NULL) {

	PORT_SetError( SEC_ERROR_INVALID_KEY );

	return SECFailure;

    }

    rv = PK11_ReadAttribute(symKey->slot,symKey->objectID,CKA_VALUE,NULL,

				&symKey->data);

    if (rv == SECSuccess) {

	symKey->size = symKey->data.len;

    }

    return rv;

}

SECStatus

PK11_DeleteTokenSymKey(PK11SymKey *symKey)

{

    if (!PK11_IsPermObject(symKey->slot, symKey->objectID)) {

	return SECFailure;

    }

    PK11_DestroyTokenObject(symKey->slot,symKey->objectID);

    symKey->objectID = CK_INVALID_HANDLE;

    return SECSuccess;

}

SECItem *

PK11_GetKeyData(PK11SymKey *symKey)

{

    return &symKey->data;

}

/* This symbol is exported for backward compatibility. */

SECItem *

__PK11_GetKeyData(PK11SymKey *symKey)

{

    return PK11_GetKeyData(symKey);

}

/*

 * PKCS #11 key Types with predefined length

 */

unsigned int

pk11_GetPredefinedKeyLength(CK_KEY_TYPE keyType)

{

    int length = 0;

    switch (keyType) {

      case CKK_DES: length = 8; break;

      case CKK_DES2: length = 16; break;

      case CKK_DES3: length = 24; break;

      case CKK_SKIPJACK: length = 10; break;

      case CKK_BATON: length = 20; break;

      case CKK_JUNIPER: length = 20; break;

      default: break;

    }

    return length;

}

/* return the keylength if possible.  '0' if not */

unsigned int

PK11_GetKeyLength(PK11SymKey *key)

{

    CK_KEY_TYPE keyType;

    if (key->size != 0) return key->size;

    /* First try to figure out the key length from its type */

    keyType = PK11_ReadULongAttribute(key->slot,key->objectID,CKA_KEY_TYPE);

    key->size = pk11_GetPredefinedKeyLength(keyType);

    if ((keyType == CKK_GENERIC_SECRET) &&

	(key->type == CKM_SSL3_PRE_MASTER_KEY_GEN))  {

	key->size=48;

    }

   if( key->size != 0 ) return key->size;

   if (key->data.data == NULL) {

	PK11_ExtractKeyValue(key);

   }

   /* key is probably secret. Look up its length */

   /*  this is new PKCS #11 version 2.0 functionality. */

   if (key->size == 0) {

	CK_ULONG keyLength;

	keyLength = PK11_ReadULongAttribute(key->slot,key->objectID,CKA_VALUE_LEN);

	if (keyLength != CK_UNAVAILABLE_INFORMATION) {

	    key->size = (unsigned int)keyLength;

	}

    }

   return key->size;

}

/* return the strength of a key. This is different from length in that

 * 1) it returns the size in bits, and 2) it returns only the secret portions

 * of the key minus any checksums or parity.

 */

unsigned int

PK11_GetKeyStrength(PK11SymKey *key, SECAlgorithmID *algid) 

{

     int size=0;

     CK_MECHANISM_TYPE mechanism= CKM_INVALID_MECHANISM; /* RC2 only */

     SECItem *param = NULL; /* RC2 only */

     CK_RC2_CBC_PARAMS *rc2_params = NULL; /* RC2 ONLY */

     unsigned int effectiveBits = 0; /* RC2 ONLY */

     switch (PK11_GetKeyType(key->type,0)) {

     case CKK_CDMF:

	return 40;

     case CKK_DES:

	return 56;

     case CKK_DES3:

     case CKK_DES2:

	size = PK11_GetKeyLength(key);

	if (size == 16) {

	   /* double des */

	   return 112; /* 16*7 */

	}

	return 168;

    /*

     * RC2 has is different than other ciphers in that it allows the user

     * to deprecating keysize while still requiring all the bits for the 

     * original key. The info

     * on what the effective key strength is in the parameter for the key.

     * In S/MIME this parameter is stored in the DER encoded algid. In Our 

     * other uses of RC2, effectiveBits == keyBits, so this code functions

     * correctly without an algid.

     */

    case CKK_RC2:

	/* if no algid was provided, fall through to default */

        if (!algid) {

	    break; 

	}

	/* verify that the algid is for RC2 */

	mechanism = PK11_AlgtagToMechanism(SECOID_GetAlgorithmTag(algid));

	if ((mechanism != CKM_RC2_CBC) && (mechanism != CKM_RC2_ECB)) {

	    break;

	}

	/* now get effective bits from the algorithm ID. */

	param = PK11_ParamFromAlgid(algid);

	/* if we couldn't get memory just use key length */

	if (param == NULL) {

	    break;

	}

	rc2_params = (CK_RC2_CBC_PARAMS *) param->data;

	/* paranoia... shouldn't happen */

	PORT_Assert(param->data != NULL);

	if (param->data == NULL) {

	    SECITEM_FreeItem(param,PR_TRUE);

	    break;

	}

	effectiveBits = (unsigned int)rc2_params->ulEffectiveBits;

	SECITEM_FreeItem(param,PR_TRUE);

	param = NULL; rc2_params=NULL; /* paranoia */

	/* we have effective bits, is and allocated memory is free, now

	 * we need to return the smaller of effective bits and keysize */

	size = PK11_GetKeyLength(key);

	if ((unsigned int)size*8 > effectiveBits) {

	    return effectiveBits;

	}

	return size*8; /* the actual key is smaller, the strength can't be

			* greater than the actual key size */

    default:

	break;

    }

    return PK11_GetKeyLength(key) * 8;

}

/*

 * The next three utilities are to deal with the fact that a given operation

 * may be a multi-slot affair. This creates a new key object that is copied

 * into the new slot.

 */

PK11SymKey *

pk11_CopyToSlotPerm(PK11SlotInfo *slot,CK_MECHANISM_TYPE type, 

	 	CK_ATTRIBUTE_TYPE operation, CK_FLAGS flags, 

		PRBool isPerm, PK11SymKey *symKey)

{

    SECStatus rv;

    PK11SymKey *newKey = NULL;

    /* Extract the raw key data if possible */

    if (symKey->data.data == NULL) {

	rv = PK11_ExtractKeyValue(symKey);

	/* KEY is sensitive, we're try key exchanging it. */

	if (rv != SECSuccess) {

	    return pk11_KeyExchange(slot, type, operation, 

						flags, isPerm, symKey);

	}

    }

    newKey = PK11_ImportSymKeyWithFlags(slot,  type, symKey->origin,

	operation, &symKey->data, flags, isPerm, symKey->cx);

    if (newKey == NULL) {

	newKey = pk11_KeyExchange(slot, type, operation, flags, isPerm, symKey);

    }

    return newKey;

}

PK11SymKey *

pk11_CopyToSlot(PK11SlotInfo *slot,CK_MECHANISM_TYPE type,

	CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey)

{

   return pk11_CopyToSlotPerm(slot, type, operation, 0, PR_FALSE, symKey);

}

/*

 * Make sure the slot we are in is the correct slot for the operation

 * by verifying that it supports all of the specified mechanism types.

 */

PK11SymKey *

pk11_ForceSlotMultiple(PK11SymKey *symKey, CK_MECHANISM_TYPE *type,

			int mechCount, CK_ATTRIBUTE_TYPE operation)

{

    PK11SlotInfo *slot = symKey->slot;

    PK11SymKey *newKey = NULL;

    PRBool needToCopy = PR_FALSE;

    int i;

    if (slot == NULL) {

	needToCopy = PR_TRUE;

    } else {

	i = 0;

	while ((i < mechCount) && (needToCopy == PR_FALSE)) {

	    if (!PK11_DoesMechanism(slot,type[i])) {

		needToCopy = PR_TRUE;

	    }

	    i++;

	}

    }

    if (needToCopy == PR_TRUE) {

	slot = PK11_GetBestSlotMultiple(type,mechCount,symKey->cx);

	if (slot == NULL) {

	    PORT_SetError( SEC_ERROR_NO_MODULE );

	    return NULL;

	}

	newKey = pk11_CopyToSlot(slot, type[0], operation, symKey);

	PK11_FreeSlot(slot);

    }

    return newKey;

}

/*

 * Make sure the slot we are in is the correct slot for the operation

 */

PK11SymKey *

pk11_ForceSlot(PK11SymKey *symKey,CK_MECHANISM_TYPE type,

						CK_ATTRIBUTE_TYPE operation)

{

    return pk11_ForceSlotMultiple(symKey, &type, 1, operation);

}

PK11SymKey *

PK11_MoveSymKey(PK11SlotInfo *slot, CK_ATTRIBUTE_TYPE operation, 

			CK_FLAGS flags, PRBool  perm, PK11SymKey *symKey)

{

    if (symKey->slot == slot) {

	if (perm) {

	   return PK11_ConvertSessionSymKeyToTokenSymKey(symKey,symKey->cx);

	} else {

	   return PK11_ReferenceSymKey(symKey);

	}

    }

    return pk11_CopyToSlotPerm(slot, symKey->type, 

					operation, flags, perm, symKey);

}

/*

 * Use the token to generate a key.