CACCAPIRaw.cpp

Go to the documentation of this file.

#include "PKIFCAPIRaw.h"
#include "PKIFCAPICryptContext2.h"
#include "PKIFCAPIHashContext.h"
#include "CAPIUtils.h"

#include "PKIFCryptoException.h"
#include "PKIFKeyMaterial.h"
#include "PKIFCryptoErrors.h"
#include "PKIFCAPIErrors.h"
#include "CAPIRawCryptContext.h"
#include "PKIFAlgorithm.h"

#include "AlgorithmIdentifier.h"
#include "Buffer.h"
#include "Certificate.h"
#include "ToolkitUtils.h"
#include "components.h"
#include "PKIFException.h"

#include "SubjectPublicKeyInfo.h"

#include "ASN1Helper.h"
#include "PKIX1Algorithms88.h"

#include <iostream>
#include <sstream>
using namespace std;

#if !defined(ALG_SID_SHA_256)
#define ALG_SID_SHA_256 12 
#define ALG_SID_SHA_384 13 
#define ALG_SID_SHA_512 14 
 
#define CALG_SHA_256 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_256) 
#define CALG_SHA_384 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_384) 
#define CALG_SHA_512 (ALG_CLASS_HASH | ALG_TYPE_ANY | ALG_SID_SHA_512) 
#endif 

CAC_API char g_defCACCAPITrustStore[] = "Root";

struct CPKIFCAPIRawImpl
{

    CPKIFCAPIRaw* m_parent;
    char * m_provName;
    int m_provType;
    CPKIFCAPIRawImpl ()
    {
        m_parent = NULL;
    }
    CPKIFCAPIRawImpl (CPKIFCAPIRaw  *p) 
    {
        m_parent = p;
    }
    HCRYPTPROV m_hProv;
    HCRYPTKEY m_hPubPrivKey;

    template<bool _CryptDirection>
    void Crypt(const CPKIFKeyMaterial& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool pad = true);

    template <bool _CryptDirection>
    void CryptFunc(IPKIFRawCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final);

};

CPKIFCAPIRaw::CPKIFCAPIRaw(void)
    :m_impl (new CPKIFCAPIRawImpl)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::CPKIFCAPIRaw(void)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);
    InitImpl();
}

CPKIFCAPIRaw::CPKIFCAPIRaw(
             const char* provider,
             int provType)
     :m_impl (new CPKIFCAPIRawImpl)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::CPKIFCAPIRaw(provider,provType)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);
    InitImpl(provider,provType);
}
CPKIFCAPIRaw::~CPKIFCAPIRaw(void)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::~CPKIFCAPIRaw(void)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    if(NULL != m_impl->m_hPubPrivKey)
    {
        BOOL succ = CryptDestroyKey(m_impl->m_hPubPrivKey);
        m_impl->m_hPubPrivKey = NULL;
    }
    if(NULL != m_impl->m_hProv)
    {
        BOOL succ = CryptReleaseContext(m_impl->m_hProv, 0);
        m_impl->m_hProv = NULL;
    }
    if(NULL != m_impl->m_provName) {
        free(m_impl->m_provName);
    }
    delete m_impl;
    m_impl = NULL;
}
void CPKIFCAPIRaw::Initialize()
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::Initialize()", TOOLKIT_CRYPTO_CAPIRAW, 0, this);
}


void CPKIFCAPIRaw::InitImpl(const char * provider, int provType)
{
    m_impl->m_parent = this;
    m_impl->m_hProv = NULL;
    m_impl->m_hPubPrivKey = NULL;
    if(provider) {
        m_impl->m_provName = _strdup(provider);
    } else {
        m_impl->m_provName = NULL;
    }
    m_impl->m_provType = provType;
}

ALG_ID GetSymAlgorithm(
    const CPKIFKeyMaterial& key)
{
    switch(key.GetSymmetricKeyAlgorithm())
    {
    case PKIFCRYPTO::DES:
        return CALG_DES;
    case PKIFCRYPTO::TDES:
        return CALG_3DES;
    //PKIF Only supports AES through NSS 
    //case AES:
    //case AES128:
    //  return CALG_AES_128;
    //case AES192:
    //  return CALG_AES_192;
    //case AES256:
    //  return CALG_AES_256;
    default:
        RAISE_CRYPTO_EXCEPTION("", TOOLKIT_CRYPTO, CRYPTO_ALG_NOT_SUPPORTED, NULL)
    }
}
DWORD GetProvType(
    PCCERT_CONTEXT cert)
{
    //inspect the subject public key algorithm to determine the type of provider to create
    if(0 == strcmp(szOID_X957_DSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
        0 == strcmp(szOID_X957_SHA1DSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId))
        return PROV_DSS;
    else if(0 == strcmp(szOID_RSA_RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
        0 == strcmp(szOID_RSA_MD5RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
        0 == strcmp(szOID_RSA_SHA1RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId)) 
        return PROV_RSA_FULL;
    else
        RAISE_CRYPTO_EXCEPTION(cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId, TOOLKIT_CRYPTO_CAPIRAW, CRYPTO_ALG_NOT_SUPPORTED, NULL)
}
DWORD GetProvType(
    const char* oidString)
{
    //inspect the subject public key algorithm to determine the type of provider to create
    if(0 == strcmp(szOID_X957_DSA, oidString) ||
        0 == strcmp(szOID_X957_SHA1DSA, oidString))
        return PROV_DSS;
    else if(0 == strcmp(szOID_RSA_RSA, oidString) ||
        0 == strcmp(szOID_RSA_MD5RSA, oidString) ||
        0 == strcmp(szOID_RSA_SHA1RSA, oidString)) 
        return PROV_RSA_FULL;
    else
        RAISE_CRYPTO_EXCEPTION(oidString, TOOLKIT_CRYPTO_CAPIRAW, CRYPTO_ALG_NOT_SUPPORTED, NULL)
}
bool CPKIFCAPIRaw::SupportsAlgorithm(
    const CPKIFKeyMaterial& key)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::SupportsAlgorithm(const CPKIFKeyMaterial& key)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    if(key.ContainsSymmetricKeyMaterial())
    {   
        try
        {
            GetSymAlgorithm(key);
            return true;
        }
        catch(CPKIFCryptoException& e)
        {
            if(CRYPTO_ALG_NOT_SUPPORTED == e.GetErrorCode())
            {
                //EXCEPTION DELETION
                //The GetSymAlgorithm function throws upon failure but
                //this function should return false.
                //delete e;
                return false;
            }
            else
                throw e; //should never happen
        }
    }
    else if(key.ContainsCertificate())
    {
        PCCERT_CONTEXT cert = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
            key.GetCertificate(), key.GetCertificateLength());
        if(NULL == cert)
        {
            std::ostringstream os;
            os << "CertCreateCertificateContext failed: " << GetLastError();
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_CREATE_CERT_FAILED, this)
        }

        try
        {
            GetProvType(cert);
            if (NULL != cert)  
            {   CertFreeCertificateContext(cert); cert = NULL; }  
            return true;
        }
        catch(CPKIFException& e)
        {
            if (NULL != cert)  
            {   CertFreeCertificateContext(cert); cert = NULL; }  

            if(CRYPTO_ALG_NOT_SUPPORTED == e.GetErrorCode())
            {
                //EXCEPTION DELETION
                //The GetSymAlgorithm function throws upon failure but
                //this function should return false.
                //delete e;
                return false;
            }
            else
                throw e; //should never happen
        }
    }
    else
    {
        RAISE_CRYPTO_EXCEPTION("key parameter contents not recognized.", thisComponent, COMMON_INVALID_INPUT, this);
    }
}
void CPKIFCAPIRaw::Sign(
    const CPKIFKeyMaterial& key,
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int* nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::Sign(const CPKIFKeyMaterial& key,...)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    //skip raw signature generation for now
    RAISE_CRYPTO_EXCEPTION("Signing operations are not implemented for raw key material.", thisComponent, COMMON_NOT_IMPLEMENTED, this);
}

//support RSA and 3DES (DES, AES)
template <bool _CryptDirection>
void CPKIFCAPIRawImpl::Crypt(
    const CPKIFKeyMaterial& key,
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult, 
    int* pnResultLen, 
    bool pad)
{
#undef CLEANUP
#define CLEANUP \
{ \
    if (NULL != hSessionKey)  \
    {   BOOL succ = CryptDestroyKey(hSessionKey); hSessionKey = NULL;}  \
    if (NULL != hTmpProv)  \
    {   CryptReleaseContext(hTmpProv, 0); hTmpProv = NULL; }  \
    if (NULL != cert)  \
    {   CertFreeCertificateContext(cert); cert = NULL; }  \
} 

    LOG_STRING_DEBUG("CPKIFCAPIRaw::Crypt(const CPKIFKeyMaterial& key, ...)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    HCRYPTKEY hSessionKey = 0;
    BOOL succ = FALSE;
    HCRYPTPROV hTmpProv = NULL;
    PCCERT_CONTEXT cert = NULL;

    if(key.ContainsSymmetricKeyMaterial())
    {
        if(NULL == m_hProv)
        {
            // Create Exponent of One private key
            succ = CreatePrivateExponentOneKey(MS_ENHANCED_PROV, PROV_RSA_FULL,
                                                "__PKIFTEMPCONTAINER", AT_KEYEXCHANGE, &m_hProv, &m_hPubPrivKey);
            if (!succ)
            {
                if(NULL != m_hPubPrivKey)
                {
                    CryptDestroyKey(m_hPubPrivKey); m_hPubPrivKey = NULL;
                }
                if(NULL != m_hProv)
                {
                    CryptReleaseContext(m_hProv, 0); m_hProv = NULL;
                }
                std::ostringstream os;
                os << "CreatePrivateExponentOneKey failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_SESSION_KEY_ENCRYPT_FAILED, this);
            }
        }

        ALG_ID tmpAlgID = GetSymAlgorithm(key);
        if (!ImportPlainSessionBlob(m_hProv, m_hPubPrivKey, tmpAlgID, (unsigned char*)key.GetSymmetricKey(), key.GetSymmetricKeyLength(), &hSessionKey))
        {
            CLEANUP;
            std::ostringstream os;
            os << "ImportPlainSessionBlob failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_KEY_IMPORT_FAILED, this);
        }

        DWORD tmpMode = 0;
        switch(key.GetMode())
        {
        case PKIFCRYPTO::ECB:
            tmpMode = CRYPT_MODE_ECB;
            break;
        case PKIFCRYPTO::CBC:
            tmpMode = CRYPT_MODE_CBC;
            if(NULL == key.GetIV())
                throw CPKIFCryptoException(m_parent->thisComponent, CRYPTO_MISSING_IV);
            break;
        default:
            throw CPKIFCryptoException(m_parent->thisComponent, CRYPTO_MODE_NOT_SUPPORTED);
        }

        DWORD paddingType = PKCS5_PADDING;
        if(pad) 
        {
            if(!CryptSetKeyParam(hSessionKey, KP_PADDING, (BYTE*)&paddingType, 0))
            {
                CLEANUP;
                std::ostringstream os;
                os << "CryptSetKeyParam failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_SET_MODE_FAILED, this);
            }
        }

        if(!CryptSetKeyParam(hSessionKey, KP_MODE, (BYTE*)&tmpMode, 0))
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptSetKeyParam failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_SET_MODE_FAILED, this);
        }

        if(NULL != key.GetIV() && PKIFCRYPTO::CBC == key.GetMode())
        {
            if(!CryptSetKeyParam(hSessionKey, KP_IV, (BYTE*)key.GetIV(), 0))
            {
                CLEANUP;
                std::ostringstream os;
                os << "CryptSetKeyParam failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_SET_IV_FAILED, this);
            }
        }
    }
    else if(key.ContainsCertificate())
    {
        //create a certificate context from the cert in key
        cert = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
            key.GetCertificate(), key.GetCertificateLength());
        if(NULL == cert)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CertCreateCertificateContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_CREATE_CERT_FAILED, this);
        }

        DWORD provType = 0;
        //inspect the subject public key algorithm to determine the type of provider to create
        if(0 == strcmp(szOID_RSA_RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_MD5RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_SHA1RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId)) 
            provType = PROV_RSA_FULL;
        else
        {
            CLEANUP;
            throw CPKIFCryptoException(m_parent->thisComponent, CRYPTO_ALG_NOT_SUPPORTED, "Unsupported encryption algorithm identified in certificate.");
        }

        //create a temporary verification context into which the key will be imported
        succ = CryptAcquireContext(&hTmpProv, NULL, NULL, provType, CRYPT_VERIFYCONTEXT);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptAcquireContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, this);
        }

        //import the key
        succ = CryptImportPublicKeyInfo(hTmpProv, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &cert->pCertInfo->SubjectPublicKeyInfo, &hSessionKey);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptImportPublicKeyInfo failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, PKIFCAPI_KEY_IMPORT_FAILED, this);
        }
    }
    else
    {
        throw CPKIFCryptoException(m_parent->thisComponent, COMMON_INVALID_INPUT, "Key parameter contents not recognized.");
    }

    int maxOut = *pnResultLen;
    *pnResultLen = nDataLen;
    int err = 0;
    memcpy(pResult, pData, nDataLen);
    if(_CryptDirection)
    {
        BOOL last = TRUE;
        DWORD resLen = *pnResultLen;
        if(!CryptEncrypt(hSessionKey, NULL, last, 0, pResult, &resLen, maxOut))
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptEncrypt failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_ENCRYPT_FAILED, this);
        }

        *pnResultLen = resLen;

        if(key.ContainsCertificate())
        {
            //when doing public key encryption we need to byte reverse the result for some reason
            ReverseBytes(pResult, *pnResultLen);
        }
    }
    else
    {
        if(!CryptDecrypt(hSessionKey, NULL, TRUE, 0, pResult, (DWORD*)pnResultLen))
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptDecrypt failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_DECRYPT_FAILED, this);
        }
    }

    CLEANUP;
}
void CPKIFCAPIRaw::Decrypt(
    const CPKIFKeyMaterial& key, 
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult,
    int* pnResultLen, 
    bool pad)
{
    m_impl->Crypt<false>(key, pData, nDataLen, pResult, pnResultLen, pad);
}
void CPKIFCAPIRaw::Encrypt(
    const CPKIFKeyMaterial& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool pad)
{
    m_impl->Crypt<true>(key, pData, nDataLen, pResult, pnResultLen, pad);
}
HCRYPTHASH CreateHashObjectFromData(
    HCRYPTPROV hProv,
    unsigned char* pHashData,
    int nHashDataLen)
{
#undef CLEANUP
#define CLEANUP \
{ \
    if (NULL != hHash)  \
    {   CryptDestroyHash(hHash); hHash = NULL; }  \
} 

    LOG_STRING_DEBUG("CreateHashObjectFromData(HCRYPTPROV hProv, unsigned char* pHashData, int nHashDataLen)", TOOLKIT_CRYPTO_CAPIRAW, 0, NULL);

    HCRYPTHASH hHash = NULL;

    //determine the hash algorithm from the length of the data (this function can throw)
    ALG_ID HashAlg = GetHashAlg((PKIFCRYPTO::HASH_ALG)nHashDataLen);

    //create the hash
    if(!CryptCreateHash(hProv, HashAlg, NULL, 0, &hHash))
    {
        CLEANUP;

        std::ostringstream os;
        os << "CryptCreateHash failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_CREATE_HASH_FAILED, NULL);
    }

    DWORD hSize = 0;
    DWORD hSizeSize = sizeof(hSize);

    //do a sanity check on the length expected vs. the length we intend to pass
    if(!CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE*)&hSize, &hSizeSize, 0))
    {
        CLEANUP;
        std::ostringstream os;
        os << "CryptGetHashParam failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_MISC_HASH_CALL_FAILED, NULL);
    }
    if(nHashDataLen != hSize)
    {
        CLEANUP;
        RAISE_CRYPTO_EXCEPTION("Hash sizes do not match.  Could not set hash object for signing.", TOOLKIT_CRYPTO, PKIFCAPI_MISC_HASH_CALL_FAILED, NULL);
    }

    //set the hash value on the hash object
    if(!CryptSetHashParam(hHash, HP_HASHVAL, pHashData, 0))
    {
        CLEANUP;
        std::ostringstream os;
        os << "CryptSetHashParam failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_MISC_HASH_CALL_FAILED, NULL);
    }

    //return the hash
    return hHash;
}
bool _Verify(
    const CPKIFKeyMaterial& key,
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int nSignatureLen)
{
#undef CLEANUP
#define CLEANUP \
{ \
    if (capiSpki.Algorithm.Parameters.cbData)  \
    {   delete[] capiSpki.Algorithm.Parameters.pbData; capiSpki.Algorithm.Parameters.pbData = NULL; capiSpki.Algorithm.Parameters.cbData = 0;}  \
    if (clearParams)  \
    {   delete[] cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData; cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData = NULL; cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.cbData = 0;}  \
    if (NULL != cert)  \
    {   CertFreeCertificateContext(cert); cert = NULL; }  \
    if (NULL != hHash)  \
    {   CryptDestroyHash(hHash); hHash = NULL; }  \
    if (NULL != hKey)  \
    {   CryptDestroyKey(hKey); hKey = NULL; }  \
    if (NULL != hProv)  \
    {   CryptReleaseContext(hProv, 0); hProv = NULL; }  \
} 

    LOG_STRING_DEBUG("_Verify(const CPKIFKeyMaterial& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int nSignatureLen)", TOOLKIT_CRYPTO_CAPIRAW, 0, NULL);

    BOOL succ = FALSE;
    HCRYPTPROV hProv = NULL;
    HCRYPTKEY hKey = NULL;
    HCRYPTHASH hHash = NULL;
    PCCERT_CONTEXT cert = NULL;
    DWORD provType = 0;
    bool clearParams = false;

    ALG_ID alg;
    CERT_PUBLIC_KEY_INFO capiSpki;
    memset(&capiSpki, 0, sizeof(CERT_PUBLIC_KEY_INFO));

    //get the key needed for verification
    if(key.ContainsCertificate())
    {
        //create a certificate context from the cert in key
        cert = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
            key.GetCertificate(), key.GetCertificateLength());
        if(NULL == cert)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CertCreateCertificateContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_CREATE_CERT_FAILED, NULL);
        }


        if(0 == strcmp(szOID_RSA_RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_MD5RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_SHA1RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId)) 
            alg = CALG_RSA_SIGN;
        else
            alg = CALG_DSS_SIGN;
        provType = GetProvType(cert);

        //create a temporary verification context into which the key will be imported
        succ = CryptAcquireContext(&hProv, NULL, NULL, provType, CRYPT_VERIFYCONTEXT);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptAcquireContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, NULL);
        }

        if(CALG_DSS_SIGN == alg)
        {
            CPKIFAlgorithmIdentifierPtr workingParams = key.GetWorkingParameters();
            if(0 == cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.cbData &&
                workingParams != (CPKIFAlgorithmIdentifier*)NULL)
            {
                CPKIFBufferPtr params = workingParams->parameters();
                cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.cbData = params->GetLength();
                cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData = new unsigned char[params->GetLength()];
                memcpy(cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData, (BYTE*)params->GetBuffer(), params->GetLength());
                //ReverseBytes(cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.cbData);
                clearParams = true;
            }
        }

        //import the key
        succ = CryptImportPublicKeyInfo(hProv, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &cert->pCertInfo->SubjectPublicKeyInfo, &hKey);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptImportPublicKeyInfo failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_KEY_IMPORT_FAILED, NULL);
        }
    }
    else if(key.ContainsPublicKeyMaterial())
    {
        CPKIFSubjectPublicKeyInfoPtr spki = key.GetSubjectPublicKeyInfo();
        CPKIFAlgorithmIdentifierPtr spkiAlg = spki->alg();
        CPKIFOIDPtr spkiAlgOid = spkiAlg->oid();
        const char* spkifAlgOidString = spkiAlgOid->ToString();

        capiSpki.Algorithm.Parameters.cbData = 0;

        if(0 == strcmp(szOID_RSA_RSA, spkifAlgOidString))
        {
            capiSpki.Algorithm.pszObjId = szOID_RSA_RSA;
            alg = CALG_RSA_SIGN;
        }
        else if(0 == strcmp(szOID_RSA_MD5RSA, spkifAlgOidString))
        {
            capiSpki.Algorithm.pszObjId = szOID_RSA_MD5RSA;
            alg = CALG_RSA_SIGN;
        }
        else if(0 == strcmp(szOID_RSA_SHA1RSA, spkifAlgOidString)) 
        {
            capiSpki.Algorithm.pszObjId = szOID_RSA_SHA1RSA;
            alg = CALG_RSA_SIGN;
        }
        else
        {
            capiSpki.Algorithm.pszObjId = szOID_X957_DSA;
            alg = CALG_DSS_SIGN;
        }

        provType = GetProvType(spkifAlgOidString);

        CPKIFBufferPtr keyBuf = spki->rawKey();
        capiSpki.PublicKey.cbData = keyBuf->GetLength();
        capiSpki.PublicKey.pbData = (BYTE*)keyBuf->GetBuffer();

        //create a temporary verification context into which the key will be imported
        succ = CryptAcquireContext(&hProv, NULL, NULL, provType, CRYPT_VERIFYCONTEXT);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptAcquireContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, NULL);
        }

        if(CALG_DSS_SIGN == alg)
        {
            CPKIFAlgorithmIdentifierPtr workingParams = key.GetWorkingParameters();
            if(0 == capiSpki.Algorithm.Parameters.cbData &&
                workingParams != (CPKIFAlgorithmIdentifier*)NULL)
            {
                CPKIFBufferPtr params = workingParams->parameters();
                capiSpki.Algorithm.Parameters.cbData = params->GetLength();
                capiSpki.Algorithm.Parameters.pbData = new unsigned char[params->GetLength()];
                memcpy(capiSpki.Algorithm.Parameters.pbData, (BYTE*)params->GetBuffer(), params->GetLength());
                //ReverseBytes(cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.pbData, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.Parameters.cbData);
                clearParams = false;
            }
        }

        //import the key
        succ = CryptImportPublicKeyInfo(hProv, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &capiSpki, &hKey);
        if(!succ)
        {
            CLEANUP;
            std::ostringstream os;
            os << "CryptImportPublicKeyInfo failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), TOOLKIT_CRYPTO, PKIFCAPI_KEY_IMPORT_FAILED, NULL);
        }
    }
    else
    {
        CLEANUP;
        RAISE_CRYPTO_EXCEPTION("CPKIFCAPIRaw::Verify only supports certificate-based key material", TOOLKIT_CRYPTO, PKIFCAPI_KEY_MATERIAL_NOT_SUPPORTED, NULL);
    }

    //at this point we must have a valid hProv and hKey - now we need a hash object 
    //that contains the hashed data passed in (this function throws upon failure
    try
    {
        hHash = CreateHashObjectFromData(hProv, pHashData, nHashDataLen);
    }
    catch(CPKIFException& e)
    {
        CLEANUP;
        throw e;
    }

    unsigned char revSig[513];
    if(CALG_RSA_SIGN == alg)
    {
        for(int ii = nSignatureLen-1, jj = 0; ii >= 0; --ii, ++jj)
            revSig[ii] = pSignature[jj];
    }
    else
    {
        unsigned char pRevSig[(MAXHASH*2)+5];
        const int maxRorS = nHashDataLen;
        bool skipRevStuff = false;
        int rlen = maxRorS, slen = maxRorS;
        try
        {
            //try to parse DSS signature
            CACASNWRAPPER_CREATE(Dss_Sig_Value, tmpPDU);
            ASN1OpenType asnOpenType;
            asnOpenType.data = pSignature;
            asnOpenType.numocts = nSignatureLen;
            Dss_Sig_Value* tmpAttr = tmpPDU.Decode(asnOpenType);
    
            atob((char*)pRevSig, (char*)tmpAttr->r + 2, (unsigned int*)&rlen);
            ReverseBytes(pRevSig, rlen);
            unsigned char* p = pRevSig + rlen; //point to end of buf
            if(rlen >= nHashDataLen)
            {
                int diff = rlen - nHashDataLen;
                while(diff > 0)
                {
                    --p; --diff;
                }
            }
            else
            {
                int diff = nHashDataLen - rlen;
                while(diff > 0)
                {
                    *p = 0x00; ++p;
                    --diff;
                }
            }

            //changed from +20 to +rLen
            atob((char*)p, (char*)tmpAttr->s + 2, (unsigned int*)&slen);
            ReverseBytes(p, slen);
            p = p + slen; //point to end of buf
            if(slen >= nHashDataLen)
            {
                int diff = slen - nHashDataLen;
                while(diff > 0)
                {
                    --p; --diff;
                }
            }
            else
            {
                int diff = nHashDataLen - slen;
                while(diff > 0)
                {
                    *p = 0x00; ++p;
                    --diff;
                }
            }
            nSignatureLen = nHashDataLen*2;
            memcpy(revSig, pRevSig, nSignatureLen);
            skipRevStuff = true;
        }
        catch(CPKIFException& e)
        {
            //if that fails assume it's  simply r and s concatenated
            if(nSignatureLen > MAXHASH)
                throw e;

            //EXCEPTION DELETION
            //This is deleted on the chance that the signature is not DER encoded but simply is a concatenated
            //r and s - we'll try it that way and fail below if it doesn't work out
            //delete e;

            memcpy(revSig, pSignature, nSignatureLen);
            ReverseBytes(revSig, nSignatureLen/2);
            ReverseBytes(revSig + nSignatureLen/2, nSignatureLen/2);
            skipRevStuff = true;
        }
        /*
        if(!skipRevStuff)
        {
            //at this point either r or s may be in need leading zeroes removed (i.e. those added by DER)
            //or may need trailing (because it's byte reversed) zeroes added (i.e. if the actual integer had
            //leading zeroes that were removed by DER)
            //in boh cases the bytes are being reversed from pRevSig (which despite its name has the bytes 
            //in forward order) into revSig

            //added num leading zeroes garbage - 11/6
            unsigned int numLeadingZeroes = 0;
            for(unsigned int zz = 0; zz < rlen && rlen > maxRorS; ++zz)
            {
                if(0 == pRevSig[zz])
                    numLeadingZeroes++;
                else
                    break;
            }

            int padding = rlen < maxRorS ? maxRorS - rlen : 0;

            //set ii to the end of r (rlen - 1 (due to zero based indexing) - number of leading zeroes)
            //set jj = to the number of leading zeroes (thus indexing beyond the leading zeroes)
            for(int ii = maxRorS-1-numLeadingZeroes-padding, jj = numLeadingZeroes; ii >= 0; --ii, ++jj)
                revSig[ii] = pRevSig[jj]; 

            //set ii = to the number of bytes copied into revSig from pRevSig
            for(int ii = rlen-numLeadingZeroes; ii < maxRorS; ++ii)
                revSig[ii] = 0x00;

            //added num leading zeroes garbage - 11/6
            unsigned int numLeadingZeroes2 = 0;
            for(unsigned int zz = (rlen); zz < (slen+rlen) && slen > maxRorS; ++zz)
            {
                if(0 == pRevSig[zz])
                    numLeadingZeroes2++;
                else
                    break;
            }

            nSignatureLen = nHashDataLen*2;

            padding = slen < maxRorS ? maxRorS - slen : 0;
            for(int ii = nSignatureLen-1-numLeadingZeroes2-padding, jj = rlen+numLeadingZeroes2; jj < (rlen+slen) && ii >= maxRorS; --ii, ++jj)
                revSig[ii] = pRevSig[jj];

            for(int ii = padding; ii > 0; --ii)
                revSig[nSignatureLen - ii] = 0x00;
        }
        */
    }

    //given hHash and hKey verify the signature
    succ = CryptVerifySignature(hHash, revSig, nSignatureLen, hKey, NULL, 0);
    if(!succ)
    {
        CLEANUP;
        int errcode = GetLastError();

        return false;
    }

    CLEANUP;
    return true;
}
bool CPKIFCAPIRaw::VerifyCertificate(
    const CPKIFCertificate& issCert,
    const CPKIFCertificate& subCert)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::VerifyCertificate(const CPKIFCertificate& issCert, const CPKIFCertificate& subCert)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    CPKIFBufferPtr issBuf = issCert.Encoded();
    CPKIFBufferPtr subBuf = subCert.Encoded();

    PCCERT_CONTEXT issCtx = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
        issBuf->GetBuffer(), issBuf->GetLength());
//  PCCERT_CONTEXT subCtx = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
//      subBuf->GetBuffer(), subBuf->GetLength());

    if(!issCtx)
    {
        return false;
    }

    int err = 0;
    BOOL b = CryptVerifyCertificateSignature(NULL,X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
        subBuf->GetBuffer(), subBuf->GetLength(), &issCtx->pCertInfo->SubjectPublicKeyInfo);
    if(!b)
    {
        err = GetLastError();
    }

    CertFreeCertificateContext(issCtx);
//  CertFreeCertificateContext(subCtx);

    return TRUE == b;
}

//support RSA w/ SHA1 (DSS and MD5)
bool CPKIFCAPIRaw::Verify(
    const CPKIFKeyMaterial& key,
    unsigned char* pHashData, 
    int nHashDataLen,
    unsigned char* pSignature,
    int nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    //no state 
    return _Verify(key, pHashData, nHashDataLen, pSignature, nSignatureLen);
}
void CPKIFCAPIRaw::GenRandom(
    unsigned char* buf, 
    int len)
{
    //This function will use the context in m_hProv if present, otherwise a temp context is created.
    //CryptGenRandom is called to retrieve the specified number of bytes.  The buf param is assumed
    //to be at least len bytes in size.

    LOG_STRING_DEBUG("CPKIFCAPIRaw::GenRandom(unsigned char* buf, int len)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    if(NULL == buf || 0 == len)
        return; //no need to raise an exception.  the caller asks for nothing and received nothing.

    HCRYPTPROV hProv = NULL;

    //get a pointer to existing context or create a temp
    if(NULL != m_impl->m_hProv)
        hProv = m_impl->m_hProv;
    else
    {
        if(!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
        {
            std::ostringstream os;
            os << "CryptAcquireContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, NULL);
        }
    }

    //use the context to get requested amount of random data
    if(!CryptGenRandom(hProv, len, buf))
    {
        std::ostringstream os;
        os << "CryptGenRandom failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_GEN_RANDOM_FAILED, NULL);
    }

    //release the context only if necessary
    if(NULL == m_impl->m_hProv)
        CryptReleaseContext(hProv, 0);
}
IPKIFHashContext* CPKIFCAPIRaw::HashInit(
    PKIFCRYPTO::HASH_ALG alg)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HashInit(HASH_ALG alg)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    //support SHA1 (MD5)
    ALG_ID hashAlg;
    switch(alg)
    {
    case PKIFCRYPTO::SHA1:
        hashAlg = CALG_SHA1;
        break;
#ifndef FIPS_MODE
    case PKIFCRYPTO::MD5:
        hashAlg = CALG_MD5;
        break;
#endif
        // XXX *** NO CAPI CONSTANT FOR SHA224
    case PKIFCRYPTO::SHA256:
        hashAlg = CALG_SHA_256;
        break;
    case PKIFCRYPTO::SHA384:
        hashAlg = CALG_SHA_384;
        break;
    case PKIFCRYPTO::SHA512:
        hashAlg = CALG_SHA_512;
        break;
    default:
        std::ostringstream os;
        os << "Unsupported hash algorithm encountered: " << alg;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, CRYPTO_ALG_NOT_SUPPORTED, NULL);
    }

    //create a hash context object and populate it with context and hash objects
    //throw bad_alloc; nothing to clean up in this function
    CPKIFCAPIHashContext* hashCtx = new CPKIFCAPIHashContext();
    if(!CryptAcquireContext(&hashCtx->m_hashContext, NULL, m_impl->m_provName, 
        m_impl->m_provType ? m_impl->m_provType : PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
    {
        delete hashCtx;

        std::ostringstream os;
        os << "CryptAcquireContext failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, NULL);
    }

    if(!CryptCreateHash(hashCtx->m_hashContext, hashAlg, NULL, 0, &hashCtx->m_hash))
    {
        delete hashCtx;

        std::ostringstream os;
        os << "CryptCreateHash failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_CREATE_HASH_FAILED, NULL);
    }

    return hashCtx;
}
void CPKIFCAPIRaw::HashUpdate(
    IPKIFHashContext* hash, 
    unsigned char* pData, 
    int nDataLen)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HashUpdate(IPKIFHashContext* hash, unsigned char* pData, int nDataLen)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    //sanity check the inputs: 
    //  hash must not be NULL, must be of a type this class supports and must not be empty
    //  pData MAY be NULL (if not it is assumed to be at least nDataLen bytes)
    //  nDataLen must not be less than zero
    if(NULL == hash/* || NULL == pData || 0 >= nDataLen*/ || 0 > nDataLen)
        throw CPKIFCryptoException(thisComponent, COMMON_INVALID_INPUT, "NULL input passed to HashUpdate.");

    //cast the hash context to the type this class handles.  if the cast fails
    //then the context is not the correct type.
    CPKIFCAPIHashContext* hashCtx = dynamic_cast<CPKIFCAPIHashContext*>(hash);
    if(NULL == hashCtx)
        throw CPKIFCryptoException(thisComponent, PKIFCAPI_INCORRECT_HASH_CONTEXT, "Incorrect hash context passed to HashUpdate.");

    if(NULL == hashCtx->m_hashContext || NULL == hashCtx->m_hash)
        throw CPKIFCryptoException(thisComponent, PKIFCAPI_EMPTY_HASH_CONTEXT, "Empty hash context passed to HashUpdate.");

    if(!CryptHashData(hashCtx->m_hash, pData, nDataLen, 0))
    {
        std::ostringstream os;
        os << "CryptHashData failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_MISC_HASH_CALL_FAILED, NULL);
    }
}
void CPKIFCAPIRaw::HashFinal(
    IPKIFHashContext* hash,
    unsigned char* pResult, 
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HashFinal(IPKIFHashContext* hash, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    //sanity check the inputs: 
    //  hash must not be NULL, must be of a type this class supports and must not be empty
    //  result must not be NULL (it is assumed to be at least *pnResultLen bytes)
    //  pnResultLen must not be NULL and *pnResultLen must not be less than or equal to zero
    if(NULL == hash || NULL == pResult || NULL == pnResultLen || 0 >= *pnResultLen)
        throw CPKIFCryptoException(thisComponent, COMMON_INVALID_INPUT, "NULL input passed to HashFinal.");

    CPKIFCAPIHashContext* hashCtx = dynamic_cast<CPKIFCAPIHashContext*>(hash);
    if(NULL == hashCtx)
        throw CPKIFCryptoException(thisComponent, PKIFCAPI_INCORRECT_HASH_CONTEXT, "Incorrect hash context passed to HashFinal.");

    if(NULL == hashCtx->m_hashContext || NULL == hashCtx->m_hash)
        throw CPKIFCryptoException(thisComponent, PKIFCAPI_EMPTY_HASH_CONTEXT, "Empty hash context passed to HashUpdate.");

    //terminate the hash and retrieve the hash value
    if(!CryptGetHashParam(hashCtx->m_hash, HP_HASHVAL, pResult, (DWORD*)pnResultLen, 0)) 
    {
        std::ostringstream os;
        os << "CryptGetHashParam failed: " << GetLastError();;
        RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_MISC_HASH_CALL_FAILED, NULL);
    }
}
IPKIFRawCryptContext* CPKIFCAPIRaw::CryptInit(
    const CPKIFKeyMaterial& key,
    bool pad)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::CryptInit(const CPKIFKeyMaterial& key)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    //throw bad_alloc; nothing to clean up in this function
    CPKIFCAPIRawCryptContext* cryptContext = new CPKIFCAPIRawCryptContext;

    BOOL succ = FALSE;
    PCCERT_CONTEXT cert = NULL;

    if(key.ContainsSymmetricKeyMaterial())
    {
        if(NULL == m_impl->m_hProv)
        {
            // Create Exponent of One private key
            succ = CreatePrivateExponentOneKey(MS_ENHANCED_PROV, PROV_RSA_FULL,
                                                "__PKIFTEMPCONTAINER", AT_KEYEXCHANGE, &m_impl->m_hProv, &m_impl->m_hPubPrivKey);
            if (!succ)
            {
                if(NULL != m_impl->m_hPubPrivKey)
                {
                    CryptDestroyKey(m_impl->m_hPubPrivKey); m_impl->m_hPubPrivKey = NULL;
                }
                if(NULL != m_impl->m_hProv)
                {
                    CryptReleaseContext(m_impl->m_hProv, 0); m_impl->m_hProv = NULL;
                }
                std::ostringstream os;
                os << "CreatePrivateExponentOneKey failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_SESSION_KEY_ENCRYPT_FAILED, NULL);
            }
        }

        ALG_ID tmpAlgID = GetSymAlgorithm(key);
        if (!ImportPlainSessionBlob(m_impl->m_hProv, m_impl->m_hPubPrivKey, tmpAlgID, (unsigned char*)key.GetSymmetricKey(), key.GetSymmetricKeyLength(), &cryptContext->m_sessionKey))
        {
            delete cryptContext;
            std::ostringstream os;
            os << "ImportPlainSessionBlob failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_KEY_IMPORT_FAILED, NULL);
        }

        DWORD tmpMode = 0;
        switch(key.GetMode())
        {
        case PKIFCRYPTO::ECB:
            tmpMode = CRYPT_MODE_ECB;
            break;
        case PKIFCRYPTO::CBC:
            tmpMode = CRYPT_MODE_CBC;
            if(NULL == key.GetIV())
                throw CPKIFCryptoException(thisComponent, CRYPTO_MISSING_IV);
            break;
        default:
            throw CPKIFCryptoException(thisComponent, CRYPTO_MODE_NOT_SUPPORTED);
        }

        if(!CryptSetKeyParam(cryptContext->m_sessionKey, KP_MODE, (BYTE*)&tmpMode, 0))
        {
            delete cryptContext;
            std::ostringstream os;
            os << "CryptSetKeyParam failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_SET_MODE_FAILED, NULL);
        }

        if(NULL != key.GetIV() && PKIFCRYPTO::CBC == key.GetMode())
        {
            if(!CryptSetKeyParam(cryptContext->m_sessionKey, KP_IV, (BYTE*)key.GetIV(), 0))
            {
                delete cryptContext;
                std::ostringstream os;
                os << "CryptSetKeyParam failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_SET_IV_FAILED, NULL);
            }
        }

        CPKIFAlgorithm* a = CPKIFAlgorithm::GetAlg(key.GetSymmetricKeyAlgorithm(), key.GetMode());
        cryptContext->m_blockLen = a->BlockSize();
        cryptContext->m_padbuf = new unsigned char[cryptContext->m_blockLen];
        memset(cryptContext->m_padbuf,0x00,cryptContext->m_blockLen);

        cryptContext->m_bNeedsPad = pad;
    }
    else if(key.ContainsCertificate())
    {
        //create a certificate context from the cert in key
        cert = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
            key.GetCertificate(), key.GetCertificateLength());
        if(NULL == cert)
        {
            delete cryptContext;
            std::ostringstream os;
            os << "CertCreateCertificateContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_CREATE_CERT_FAILED, NULL);
        }

        DWORD provType = 0;
        //inspect the subject public key algorithm to determine the type of provider to create
        if(0 == strcmp(szOID_RSA_RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_MD5RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId) ||
            0 == strcmp(szOID_RSA_SHA1RSA, cert->pCertInfo->SubjectPublicKeyInfo.Algorithm.pszObjId)) 
            provType = PROV_RSA_FULL;
        else
        {
            delete cryptContext;
            CertFreeCertificateContext(cert);
            RAISE_CRYPTO_EXCEPTION("Unsupported encryption algorithm identified in certificate.", thisComponent, CRYPTO_ALG_NOT_SUPPORTED, NULL);
        }

        //create a temporary verification context into which the key will be imported
        succ = CryptAcquireContext(&cryptContext->m_cryptContext, NULL, NULL, provType, CRYPT_VERIFYCONTEXT);
        if(!succ)
        {
            delete cryptContext;
            CertFreeCertificateContext(cert);
            std::ostringstream os;
            os << "CryptAcquireContext failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_ACQUIRE_CONTEXT_FAILED, NULL);
        }

        //import the key
        succ = CryptImportPublicKeyInfo(cryptContext->m_cryptContext, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &cert->pCertInfo->SubjectPublicKeyInfo, &cryptContext->m_sessionKey);
        if(!succ)
        {
            delete cryptContext;
            CertFreeCertificateContext(cert);
            std::ostringstream os;
            os << "CryptImportPublicKeyInfo failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), thisComponent, PKIFCAPI_KEY_IMPORT_FAILED, NULL);
        }

        cryptContext->m_bFromCert = true;
        CertFreeCertificateContext(cert);
    }
    else
    {
        delete cryptContext;
        throw CPKIFCryptoException(thisComponent, COMMON_INVALID_INPUT, "Key parameter contents not recognized.");
    }

    return cryptContext;
}
void CPKIFCAPIRaw::Decrypt(
    IPKIFRawCryptContext* cryptContext, 
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult, 
    int* pnResultLen, 
    bool final)
{
    m_impl->CryptFunc<false>(cryptContext, pData, nDataLen, pResult, pnResultLen, final);
}
void CPKIFCAPIRaw::Encrypt(
    IPKIFRawCryptContext* cryptContext, 
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult, 
    int* pnResultLen, 
    bool final)
{
    m_impl->CryptFunc<true>(cryptContext, pData, nDataLen, pResult, pnResultLen, final);
}

template <bool _CryptDirection>
void CPKIFCAPIRawImpl::CryptFunc(
    IPKIFRawCryptContext* cryptContext,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool final)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::CryptFunc(IPKIFRawCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)", TOOLKIT_CRYPTO_CAPIRAW, 0, this);

    CPKIFCAPIRawCryptContext* icc = dynamic_cast<CPKIFCAPIRawCryptContext*>(cryptContext);
    // If it's an asymmetric operation or the caller is handling the padding on its own, just call through straight
    // to the CAPI function
    if(icc->m_bFromCert || !icc->m_bNeedsPad)
    {
        int maxOut = *pnResultLen;
        *pnResultLen = nDataLen;
        int err = 0;
        memcpy(pResult, pData, nDataLen);
        if(_CryptDirection)
        {
            DWORD resLen = *pnResultLen;
            if(!CryptEncrypt(icc->m_sessionKey, NULL, final, 0, pResult, &resLen, maxOut))
            {
                std::ostringstream os;
                os << "CryptEncrypt failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_ENCRYPT_FAILED, NULL);
            }

            *pnResultLen = resLen;

            if(icc->m_bFromCert)
            {
                //when doing public key encryption we need to byte reverse the result for some reason
                ReverseBytes(pResult, *pnResultLen);
            }
        }
        else
        {
            if(!CryptDecrypt(icc->m_sessionKey, NULL, final, 0, pResult, (DWORD*)pnResultLen))
            {
                std::ostringstream os;
                os << "CryptDecrypt failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_DECRYPT_FAILED, NULL);
            }
        }
        return;
    }
    
    
    int maxOut = *pnResultLen;
    int inLen = nDataLen;
    unsigned char * start = pData;
    unsigned char * outBuf = pResult;

    DWORD updateLen = 0;
    DWORD padUpdateLen = 0;
    *pnResultLen = 0;
    unsigned int finalLen = 0;

    *pnResultLen = 0;
    int err = 0;
    if(_CryptDirection)
    {
        DWORD resLen = *pnResultLen;
        if(final)
        {
            // XXX *** assert maxout >= padlen + inlen + blocksize
            if(icc->m_padlen) {
                memcpy(outBuf,icc->m_padbuf,icc->m_padlen);
            }
            if(start && inLen) memcpy(outBuf + icc->m_padlen,start,inLen);
            updateLen = inLen + icc->m_padlen;
            icc->m_padlen = 0;
            if(!CryptEncrypt(icc->m_sessionKey, NULL, final, 0, outBuf, &updateLen, maxOut))
            {
                std::ostringstream os;
                os << "CryptEncrypt failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_ENCRYPT_FAILED, NULL);
            }
            *pnResultLen = updateLen;
            return;
        }

        // if it's not final, we need to have input
        if(!start || !inLen) return;
        int leftInBlock = icc->m_blockLen - icc->m_padlen;


        // if there's not enough to exceed the pad buffer, fill the pad buffer and bail
        if(leftInBlock >= inLen) {
            memcpy(icc->m_padbuf,start,inLen);
            icc->m_padlen += inLen;
            *pnResultLen = 0;
            return;
        }

        // if we're here, we got more than a cipherblock
        // 1. Empty the pad buffer
        memcpy(outBuf,icc->m_padbuf,icc->m_padlen);
        updateLen = icc->m_padlen;
        icc->m_padlen = 0;
        
        // 2. calculate how many bytes go into the pad buffer
        int trailing = (inLen + updateLen) % icc->m_blockLen ? 
            (inLen + updateLen) % icc->m_blockLen : icc->m_blockLen;

        // 3. empty the input buffer
        int copied = inLen - trailing;
        memcpy(outBuf+updateLen,start,copied);
        start += copied;
        updateLen += copied;

        // 4. encrypt
        if(!CryptEncrypt(icc->m_sessionKey, NULL, final, 0, outBuf, &updateLen, maxOut))
        {
            std::ostringstream os;
            os << "CryptEncrypt failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_ENCRYPT_FAILED, NULL);
        }

        // 5. copy off the trailing bytes for next time
        memcpy(icc->m_padbuf,start,trailing);
        icc->m_padlen += trailing;
        *pnResultLen = updateLen;
    }
    else
    {
        if(final) {
            // check this here since CAPI can't
            if(maxOut < icc->m_padlen) {
                RAISE_CRYPTO_EXCEPTION("Decrypt() called with insufficient buffer available", m_parent->thisComponent, COMMON_INVALID_INPUT, NULL);
            }
            if(icc->m_padlen) {
                memcpy(outBuf,icc->m_padbuf,icc->m_padlen);
            }
            if(start && inLen) memcpy(outBuf + icc->m_padlen,start,inLen);
            updateLen = inLen + icc->m_padlen;
            icc->m_padlen = 0;
            if(!CryptDecrypt(icc->m_sessionKey, NULL, final, 0, outBuf, &updateLen))
            {
                std::ostringstream os;
                os << "CryptDecrypt failed: " << GetLastError();;
                RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_DECRYPT_FAILED, NULL);
            }
            *pnResultLen = updateLen;
            return;
        }

        // if it's not final, we need to have input
        if(!start || !inLen) return;
        int leftInBlock = icc->m_blockLen - icc->m_padlen;
        // if there's not enough to exceed the pad buffer, fill the pad buffer and bail
        if(leftInBlock >= inLen) {
            memcpy(icc->m_padbuf,start,inLen);
            icc->m_padlen += inLen;
            *pnResultLen = 0;
            return;
        }

        // if we're here, we got more than a cipherblock
        // 1. Empty the pad buffer
        memcpy(outBuf,icc->m_padbuf,icc->m_padlen);
        updateLen = icc->m_padlen;
        icc->m_padlen = 0;
        
        // 2. calculate how many bytes go into the pad buffer
        int trailing = (inLen + updateLen) % icc->m_blockLen ? 
            (inLen + updateLen) % icc->m_blockLen : icc->m_blockLen;

        // 3. empty the input buffer
        int copied = inLen - trailing;
        memcpy(outBuf+updateLen,start,copied);
        start += copied;
        updateLen += copied;

        // 4. decrypt
        if(!CryptDecrypt(icc->m_sessionKey, NULL, final, 0, outBuf, &updateLen))
        {
            std::ostringstream os;
            os << "CryptDecrypt failed: " << GetLastError();;
            RAISE_CRYPTO_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CRYPTO_DECRYPT_FAILED, NULL);
        }

        // 5. copy off the trailing bytes for next time
        memcpy(icc->m_padbuf,start,trailing);
        icc->m_padlen += trailing;
        *pnResultLen = updateLen;
    }
}


IPKIFRawCryptContext* CPKIFCAPIRaw::HMACInit(const CPKIFKeyMaterial &key, PKIFCRYPTO::HASH_ALG ha)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HMACInit(const CPKIFKeyMaterial& key, HASH_ALG ha)", thisComponent, 0, this);
    RAISE_CRYPTO_EXCEPTION("HMAC operations are not implemented for CAPI.", thisComponent, COMMON_NOT_IMPLEMENTED, this);   
    return 0;
}

void CPKIFCAPIRaw::HMACUpdate(IPKIFRawCryptContext* ctx, unsigned char* pData, int nDataLen)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HMACUpdate(IPKIFRawCryptContext* ctx, unsigned char* pData, int nDataLen)", thisComponent, 0, this);
    RAISE_CRYPTO_EXCEPTION("HMAC operations are not implemented for CAPI.", thisComponent, COMMON_NOT_IMPLEMENTED, this);   
}

void CPKIFCAPIRaw::HMACFinal(IPKIFRawCryptContext* ctx, unsigned char* pResult, int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCAPIRaw::HMACFinal(IPKIFRawCryptContext* ctx, unsigned char* pResult, int* pnResultLen)", thisComponent, 0, this);
    RAISE_CRYPTO_EXCEPTION("HMAC operations are not implemented for CAPI.", thisComponent, COMMON_NOT_IMPLEMENTED, this);   
}