CPKIFCryptoMediator2.cpp

Go to the documentation of this file.

#include "CPKIFCryptoMediator2.h"
#include "IPKIFCryptoKeyID.h"
#include "IPKIFCryptoRaw.h"
#include "IPKIFCryptContext.h"
#include "IPKIFKeyAgreeContext.h"

#include "ScopeGuard.h"

#include "PKIFCryptUtils.h"
#include "ToolkitUtils.h"
#include "PKIFLog.h"

#include "PKIFException.h"
#include "PKIFErrors.h"
#include "PKIFCryptoErrors.h"
#include "PKIFCryptoException.h"
#include "KeyUsage.h"

#include "boost/thread/recursive_mutex.hpp"

#ifdef _WIN32
#ifdef _DEBUG
#include "crtdbg.h"
#endif //_DEBUG
#endif //_WIN32

using namespace std;
using namespace boost;

struct CPKIFCryptoMediator2Impl
{   
    CPKIFCryptoMediator2* m_parent;
    CPKIFCryptoMediator2Impl ():m_me() 
    {
        m_parent = NULL;
    }
    CPKIFCryptoMediator2Impl (CPKIFCryptoMediator2  *p) 
    {
        m_parent = p;
    }
    //CACMonitorDataPtr m_md;
    boost::recursive_mutex m_me;

    std::vector<IPKIFColleaguePtr> m_vModules;
    //std::vector<IPKIFColleague*> m_vModulesToDelete;

    std::vector<IPKIFCryptoKeyIDPtr> m_vCryptoKeyIDModules;
    std::vector<IPKIFCryptoRawPtr> m_vCryptoRawModules;
    std::vector<IPKIFCryptoMiscPtr> m_vCryptoMiscModules;
    std::vector<IPKIFCryptoKeyAgreePtr> m_vCryptoKeyAgreeModules;

    CPKIFCredentialPtr m_defKeys[PKIFCRYPTO::NUMDEFTYPES];
    void FreeDefaultKey(PKIFCRYPTO::DefaultKeyType op);

    bool m_addDefaultColleagues;
};


CPKIFCryptoMediator2::CPKIFCryptoMediator2(
    bool addDefaultColleagues)
    :m_impl (new CPKIFCryptoMediator2Impl)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::CPKIFCryptoMediator2(void)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    m_impl->m_parent = this;
    m_impl->m_addDefaultColleagues = addDefaultColleagues;
    //set all default key pointers to NULL
    CPKIFCredentialPtr tmp;
    for(int ii = PKIFCRYPTO::SIGNATURE; ii < PKIFCRYPTO::NUMDEFTYPES; ++ii)
        m_impl->m_defKeys[ii] = tmp;
}

CPKIFCryptoMediator2::~CPKIFCryptoMediator2(void)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::~CPKIFCryptoMediator2(void)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    Terminate();

    delete m_impl;
    m_impl = NULL;
}

void CPKIFCryptoMediator2::Terminate()
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Terminate()", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    try
    {
        //inform our children that we are dying
        RemoveParentRelationships(m_impl->m_vModules, this);

        RemoveMediatorAssociations();

        //clean up any modules that were added using AddColleague
//      FreeAdditionalModules(m_impl->m_vModulesToDelete, this);

        //added 7/17/2004
        IPKIFMediator::Terminate();

        m_impl->m_vModules.clear();
        m_impl->m_vCryptoKeyIDModules.clear();
        m_impl->m_vCryptoRawModules.clear();
        m_impl->m_vCryptoMiscModules.clear();
        m_impl->m_vCryptoKeyAgreeModules.clear();
    }
    catch(CPKIFException& )
    {
        //EXCEPTION DELETION
        //no purpose is served by passing on this exception - log it and forget it
        LOG_STRING_ERROR("CPKIFException encountered during CPKIFCryptoMediator2 mediator termination", thisComponent, COMMON_TERMINATION_ERROR, this);
        //delete e;
        _ASSERT(false);
    }
    catch(...)
    {
        LOG_STRING_FATAL("Unknown exception encountered during CPKIFCryptoMediator2 mediator termination", thisComponent, COMMON_TERMINATION_ERROR, this);
        _ASSERT(false);
    }}

void CPKIFCryptoMediator2Impl::FreeDefaultKey(
    PKIFCRYPTO::DefaultKeyType op)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::FreeDefaultKey(DefaultKeyType op)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_md);
    boost::recursive_mutex::scoped_lock lock(m_me);
    if(op >= PKIFCRYPTO::NUMDEFTYPES)
        throw CPKIFCryptoException(m_parent->thisComponent, CRYPTO_DEFAULT_KEY_TYPE_UNKNOWN, "Unknown default key type.");

    try
    {
        CPKIFCredentialPtr tmp;
        m_defKeys[op] = tmp;
    }
    catch(...)
    {
        _ASSERT(false);
    }
}

void CPKIFCryptoMediator2::Initialize()
{
    InitializeMediator(NULL);
}

void CPKIFCryptoMediator2::InitializeMediator(
    std::vector<CPKIFException*>* errorInfo)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::InitializeMediator(std::vector<CPKIFException*>* errorInfo)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    LOG_STRING_DEBUG("Initializing CPKIFCryptoMediator2 mediator", thisComponent, 0, this);
//  if(!m_vModules.empty())
    if(!m_impl->m_vModules.empty())
        throw CPKIFCryptoException(thisComponent, COMMON_ALREADY_INITIALIZED, "This instance has already been initialized.  Call Terminate prior to re-initializing.");

    if(m_impl->m_addDefaultColleagues)
    {
//#if 0
        IPKIFColleaguePtr x1 = MakeDefaultKeyIDColleague();
        IPKIFColleaguePtr x2 = MakeDefaultRawColleague();
        AddColleague(x1);
        AddColleague(x2);
//#endif
    }
}

void CPKIFCryptoMediator2::AddColleague(
    IPKIFColleaguePtr& module)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::AddColleague(IPKIFColleague* module, bool transferOwnership)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex l_mutex;
    boost::recursive_mutex::scoped_lock lock(l_mutex);
    if(!module)
        return;

    //if the module throws an exception let the caller catch it
    module->Initialize();
    module->AddParent(this);//added 3/12/2003 CRW

    try
    {
        //set upa n array of pointers that we will need to delete
        //if(transferOwnership)
        //  m_impl->m_vModulesToDelete.push_back(module);

        //create a guard on the vector so if the push onto the primary vector fails we can
        //pop the one off of m_vModulesToDelete
//      ScopeGuard guard = MakeObjGuard(m_impl->m_vModulesToDelete, &vector<IPKIFColleague*>::pop_back);
        m_impl->m_vModules.push_back(module);
        if(dynamic_pointer_cast<IPKIFCryptoKeyID, IPKIFColleague>(module))
            m_impl->m_vCryptoKeyIDModules.push_back(dynamic_pointer_cast<IPKIFCryptoKeyID, IPKIFColleague>(module));
        if(dynamic_pointer_cast<IPKIFCryptoRaw, IPKIFColleague>(module))
            m_impl->m_vCryptoRawModules.push_back(dynamic_pointer_cast<IPKIFCryptoRaw, IPKIFColleague>(module));
        if(dynamic_pointer_cast<IPKIFCryptoMisc, IPKIFColleague>(module))
            m_impl->m_vCryptoMiscModules.push_back(dynamic_pointer_cast<IPKIFCryptoMisc, IPKIFColleague>(module));
        if(dynamic_pointer_cast<IPKIFCryptoKeyAgree, IPKIFColleague>(module))
            m_impl->m_vCryptoKeyAgreeModules.push_back(dynamic_pointer_cast<IPKIFCryptoKeyAgree, IPKIFColleague>(module));
//      guard.Dismiss();
    }
    catch(...)
    {
        throw;
    }
}

//This function unsets any previously set default for the given type of key, then sets the default to a newly created
//key *if possible*.  Thus, all calls unset defaults but not all actually set a default.  When the set fails NULL is returned.
//Otherwise, a pointer to the default is returned.  The pointer should NOT be freed by the caller.
const CPKIFCredentialPtr CPKIFCryptoMediator2::SetDefaultKey(
    const std::string& asciiHexKeyID,
    PKIFCRYPTO::DefaultKeyType op)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SetDefaultKey(const std::string& asciiHexKeyID, DefaultKeyType op)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    //if the op is unknown the following call will throw an exception
    m_impl->FreeDefaultKey(op);

    IPKIFCryptoKeyID* crypto = NULL;
    CPKIFCredentialPtr newKeyID;

    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {   
            //MakeKeyID should return NULL if key is not associated with the
            //module and throw an exception if the key is associated with the
            //module but cannot be created for some reason.
            newKeyID = (*pos)->MakeKeyID(asciiHexKeyID);
            if(newKeyID != (CPKIFCredential*)NULL)
                break;
    }

    m_impl->m_defKeys[op] = newKeyID;
    std::string auditStr = "A new default key with an identifier equal to ";
    if(newKeyID != (CPKIFCredential*)NULL)
        auditStr.append(newKeyID->ID());
    else
        auditStr.append("NULL");
    auditStr.append(" has been defined for ");
    if(PKIFCRYPTO::SIGNATURE == op)
        auditStr.append("signature operations.");
    else
        auditStr.append("decryption operations.");
    AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_DEFAULT_KEY_DESIGNATION, auditStr.c_str(), thisComponent, 0, 0);

    return newKeyID;
}

CPKIFCredentialPtr CPKIFCryptoMediator2::GetDefaultKey(
    PKIFCRYPTO::DefaultKeyType op)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::GetDefaultKey(DefaultKeyType op)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    if(PKIFCRYPTO::SIGNATURE == op || PKIFCRYPTO::DECRYPTION == op)
        return m_impl->m_defKeys[op];
    else
    {
        CPKIFCredentialPtr tmp;
        return tmp;
    }
}

//GENERAL PHILOSOPHY OF FOLLOWING FUNCTIONS
//  This mediator does not catch all exceptions that emanate from lower-level PKIF objects.  Unlike
//other mediators this one does not iterate over all colleagues in search of one that can perform
//an operation after a colleague has tried and failed.  It searches for the colleague that should be
//able to perform the operation then invokes it propagating any exceptions back to the caller.  If
//no colleague is found that can perform the operation and exception is thrown indicating that fact.

void CPKIFCryptoMediator2::GenRandom(unsigned char* buf, int len)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::GenRandom(unsigned char* buf, int len)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoMiscPtr>::iterator pos;
    vector<IPKIFCryptoMiscPtr>::iterator end = m_impl->m_vCryptoMiscModules.end();
    for(pos = m_impl->m_vCryptoMiscModules.begin(); pos != end; ++pos)
    {
            (*pos)->GenRandom(buf, len);
            return;
        
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

IPKIFHashContext* CPKIFCryptoMediator2::HashInit(
    PKIFCRYPTO::HASH_ALG alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HashInit(HASH_ALG alg)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoMiscPtr>::iterator pos;
    vector<IPKIFCryptoMiscPtr>::iterator end = m_impl->m_vCryptoMiscModules.end();
    for(pos = m_impl->m_vCryptoMiscModules.begin(); pos != end; ++pos)
    {
        try
        {
            IPKIFHashContext* hc = (*pos)->HashInit(alg);
            if(hc) return hc;
        }
        catch(...)
        {
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::HashUpdate(
    IPKIFHashContext* hash,
    unsigned char* pData,
    int nDataLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HashUpdate(IPKIFHashContext* hash, unsigned char* pData, int nDataLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoMiscPtr>::iterator pos;
    vector<IPKIFCryptoMiscPtr>::iterator end = m_impl->m_vCryptoMiscModules.end();
    for(pos = m_impl->m_vCryptoMiscModules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->HashUpdate(hash, pData, nDataLen);
            return;
        }
        catch(...)
        {
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::HashFinal(
    IPKIFHashContext* hash,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HashFinal(IPKIFHashContext* hash, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoMiscPtr>::iterator pos;
    vector<IPKIFCryptoMiscPtr>::iterator end = m_impl->m_vCryptoMiscModules.end();
    for(pos = m_impl->m_vCryptoMiscModules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->HashFinal(hash, pResult, pnResultLen);
            return;
        }
        catch(...)
        {
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

IPKIFRawCryptContext* CPKIFCryptoMediator2::HMACInit(
    const CPKIFKeyMaterial &key,
    PKIFCRYPTO::HASH_ALG ha)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HMACInit(const CPKIFKeyMaterial& key, HASH_ALG ha)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
            return (*pos)->HMACInit(key,ha);
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::HMACUpdate(
    IPKIFRawCryptContext* ctx,
    unsigned char* pData,
    int nDataLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HMACUpdate(IPKIFRawCryptContext* ctx, unsigned char* pData, int nDataLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
            return (*pos)->HMACUpdate(ctx,pData,nDataLen);
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::HMACFinal(
    IPKIFRawCryptContext* ctx,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::HMACFinal(IPKIFRawCryptContext* ctx, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
            return (*pos)->HMACFinal(ctx,pResult,pnResultLen);
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::Sign(
    const CPKIFCredentialPtr& key, 
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int* nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Sign(const CPKIFCredentialPtr& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int* nSignatureLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    if(key != (CPKIFCredential*)NULL)
    {
        Sign(*key, pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
    }
    else if(m_impl->m_defKeys[PKIFCRYPTO::SIGNATURE] != (CPKIFCredential*)NULL)
    {
        Sign(*m_impl->m_defKeys[PKIFCRYPTO::SIGNATURE], pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
    }
    else
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_MEDIATOR, COMMON_INVALID_INPUT, "No credential provided and no default credential set.");
}

void CPKIFCryptoMediator2::Sign(
    const CPKIFCredential& key, 
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int* nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Sign(const CPKIFCredential& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int* nSignatureLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(key))
            {
                try
                {
                    (*pos)->Sign(key, pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
#ifdef FULL_AUDIT
                    std::string auditStr = "A signature was successfully generated using the private key with the following identifier: ";
                    auditStr.append(key.ID());
                    auditStr.append(".");
                    AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_PRIVATE_KEY_OPERATION_PERFORMED, auditStr.c_str(), thisComponent);
#endif
                }
                catch(CPKIFException& e)
                {
                    std::string auditStr = "A signature could not be generated using the private key with the following identifier: ";
                    auditStr.append(key.ID());
                    auditStr.append(".  ");
                    auditStr.append(*e.print());
                    AuditString(EVENTLOG_ERROR_TYPE, CAT_PKIF_CRYPTO, PKIF_PRIVATE_KEY_OPERATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_SIGN_FAILED, this);
                    
                    if(pos+1 == end)
                        throw e;
                }
                return;
            }
        
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
IPKIFCryptContext* CPKIFCryptoMediator2::CryptInit(
    CPKIFCredentialPtr& key,
    bool pad)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::CryptInit(CPKIFCredentialPtr& key)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    CPKIFCredentialPtr keyToUse = key;
    if(keyToUse == (CPKIFCredential*)NULL)
        keyToUse = m_impl->m_defKeys[PKIFCRYPTO::DECRYPTION];
    if(keyToUse == (CPKIFCredential*)NULL)
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_MEDIATOR, COMMON_INVALID_INPUT, "No credential provided and no default credential set.");

    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(*keyToUse))
            {
                return (*pos)->CryptInit(keyToUse);
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
void CPKIFCryptoMediator2::Decrypt(
    IPKIFCryptContext* cryptContext,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool final)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Decrypt(IPKIFCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    if(NULL == cryptContext)
        throw CPKIFCryptoException(thisComponent, COMMON_INVALID_INPUT, "NULL or invalid credential passed to CPKIFCryptoMediator2::Decrypt.");

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(*cryptContext->GetCredential()))
            {
                try
                {
                    (*pos)->Decrypt(cryptContext, pData, nDataLen, pResult, pnResultLen, final);
#ifdef FULL_AUDIT
                    std::string auditStr = "A decryption operation was successfully performed using the private key with the following identifier: ";
                    auditStr.append(cryptContext->GetCredential()->ID());
                    auditStr.append(".");
                    AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_PRIVATE_KEY_OPERATION_PERFORMED, auditStr.c_str(), thisComponent);
#endif
                    return;
                }
                catch(CPKIFException& e)
                {
                    std::string auditStr = "A decryption operation failed using the private key with the following identifier: ";
                    auditStr.append(cryptContext->GetCredential()->ID());
                    auditStr.append(".");
                    AuditString(EVENTLOG_ERROR_TYPE, CAT_PKIF_CRYPTO, PKIF_PRIVATE_KEY_OPERATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_DECRYPT_FAILED, this);

                    if(pos+1 == end)
                        throw e;
                }
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
void CPKIFCryptoMediator2::Encrypt(
    IPKIFCryptContext* cryptContext,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool final)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Encrypt(IPKIFCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    if(NULL == cryptContext)
        throw CPKIFCryptoException(thisComponent, COMMON_INVALID_INPUT, "NULL or invalid credential passed to CPKIFCryptoMediator2::Encrypt.");

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(*cryptContext->GetCredential()))
            {
                (*pos)->Encrypt(cryptContext, pData, nDataLen, pResult, pnResultLen, final);
                return;
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::Decrypt(
    const CPKIFCredentialPtr& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Decrypt(const CPKIFCredentialPtr& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    if(key != (CPKIFCredential*)NULL)
    {
        //* operator added 03/02/2005 Armen 
        Decrypt(*key, pData, nDataLen, pResult, pnResultLen);
    }
    else if(m_impl->m_defKeys[PKIFCRYPTO::DECRYPTION] != (CPKIFCredential*)NULL)
    {
        Decrypt(m_impl->m_defKeys[PKIFCRYPTO::DECRYPTION], pData, nDataLen, pResult, pnResultLen);
    }
    else
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_MEDIATOR, COMMON_INVALID_INPUT, "No credential provided and no default credential set.");
}

void CPKIFCryptoMediator2::Decrypt(
    const CPKIFCredential& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Decrypt(const CPKIFCredential& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(key))
            {
                (*pos)->Decrypt(key, pData, nDataLen, pResult, pnResultLen);
                return;
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
void CPKIFCryptoMediator2::Encrypt(
    const CPKIFCredentialPtr& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Encrypt(const CPKIFCredentialPtr& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    if(key == (CPKIFCredential*)NULL)
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_MEDIATOR, COMMON_INVALID_INPUT, "No key provided.");
    Encrypt(*key, pData, nDataLen, pResult, pnResultLen);
}

void CPKIFCryptoMediator2::Encrypt(
    const CPKIFCredential& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Encrypt(const CPKIFCredential& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(key))
            {
                (*pos)->Encrypt(key, pData, nDataLen, pResult, pnResultLen);
                return;
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

bool CPKIFCryptoMediator2::Verify(
    const CPKIFCredentialPtr& key,
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Verify(const CPKIFCredentialPtr& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int nSignatureLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    if(key == (CPKIFCredential*)NULL)
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_MEDIATOR, COMMON_INVALID_INPUT, "No key provided.");
    
    return Verify(*key, pHashData, nHashDataLen, pSignature, nSignatureLen,hashAlg);
}
bool CPKIFCryptoMediator2::Verify(
    const CPKIFCredential& key,
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Verify(const CPKIFCredential& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int nSignatureLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
            if((*pos)->OwnsKey(key))
            {
                try
                {
                    bool b = (*pos)->Verify(key, pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
                    if(b)
                    {
#ifdef FULL_AUDIT
                        std::string auditStr = "A signature verification was successfully performed using the key with the following identifier: ";
                        auditStr.append(key.ID());
                        auditStr.append(".");
                        AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_SUCCEEDED, auditStr.c_str(), thisComponent);
#endif
                    }
                    else
                    {
                        std::string auditStr = "A signature verification failed using the key with the following identifier: ";
                        auditStr.append(key.ID());
                        auditStr.append(".");
                        AuditString(EVENTLOG_ERROR_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_VERIFY_FAILED, this);
                    }
                    return b;
                }
                catch(CPKIFException& e)
                {
                    std::string auditStr = "An exception was thrown during a signature verification operation using the key with the following identifier: ";
                    auditStr.append(key.ID());
                    auditStr.append(".  ");
                    auditStr.append(*e.print());
                    AuditString(EVENTLOG_ERROR_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_VERIFY_FAILED, this);
                    if(pos+1 == end)
                        throw e;
                }
            }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

bool CPKIFCryptoMediator2::VerifyCertificate(
    const CPKIFCertificate& issCert,
    const CPKIFCertificate& subCert)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::VerifyCertificate(const CPKIFCertificate& issCert, const CPKIFCertificate& subCert)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
            return (*pos)->VerifyCertificate(issCert, subCert);
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::Sign(
    const CPKIFKeyMaterial& key, 
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int* nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Sign(const CPKIFKeyMaterial& key, unsigned char* pHashData, int nHashDataLen, unsigned char* pSignature, int* nSignatureLen)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
            (*pos)->Sign(key, pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
            return;
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
void CPKIFCryptoMediator2::Encrypt(
    const CPKIFKeyMaterial& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool pad)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Encrypt(const CPKIFKeyMaterial& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, PADDING padding)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        if((*pos)->SupportsAlgorithm(key))
        {
            (*pos)->Encrypt(key, pData, nDataLen, pResult, pnResultLen,pad);
            return;
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::Decrypt(
    const CPKIFKeyMaterial& key,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool pad)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Decrypt(const CPKIFKeyMaterial& key, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, PADDING padding)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        if((*pos)->SupportsAlgorithm(key))
        {
            (*pos)->Decrypt(key, pData, nDataLen, pResult, pnResultLen,pad);
            return;
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

IPKIFRawCryptContext* CPKIFCryptoMediator2::CryptInit(
    const CPKIFKeyMaterial& key,
    bool pad)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::CryptInit(const CPKIFKeyMaterial& key)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        if((*pos)->SupportsAlgorithm(key))
        {
            return (*pos)->CryptInit(key,pad);
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}
void CPKIFCryptoMediator2::Decrypt(
    IPKIFRawCryptContext* cryptContext,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool final)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Decrypt(IPKIFRawCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->Decrypt(cryptContext,pData,nDataLen,pResult,pnResultLen,final);
            return;
        }
        catch(...)
        {
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::Encrypt(
    IPKIFRawCryptContext* cryptContext,
    unsigned char* pData,
    int nDataLen,
    unsigned char* pResult,
    int* pnResultLen,
    bool final)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Encrypt(IPKIFRawCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->Encrypt(cryptContext,pData,nDataLen,pResult,pnResultLen,final);
            return;
        }
        catch(...)
        {
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

bool CPKIFCryptoMediator2::Verify(
    const CPKIFKeyMaterial& key,
    unsigned char* pHashData,
    int nHashDataLen,
    unsigned char* pSignature,
    int nSignatureLen,
    PKIFCRYPTO::HASH_ALG hashAlg
    )
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::Verify", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        bool supportsAlg = false;
        try
        {
            supportsAlg = (*pos)->SupportsAlgorithm(key);
        }
        catch(CPKIFException &){} // just try another mediator
        if(supportsAlg)
        {
            try
            {
                bool b = (*pos)->Verify(key, pHashData, nHashDataLen, pSignature, nSignatureLen, hashAlg);
                if(b)
                {
                    std::string auditStr = "A signature verification was successfully performed.";
#ifdef FULL_AUDIT
                    AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_SUCCEEDED, auditStr.c_str(), thisComponent);
#endif
                }
                else
                {
                    std::string auditStr = "A signature verification operation failed.";
                    AuditString(EVENTLOG_ERROR_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_VERIFY_FAILED, this);
                }
                return b;
            }
            catch(CPKIFException& e)
            {
                std::string auditStr = "An exception was thrown performing a signature verification.";
                AuditString(EVENTLOG_INFORMATION_TYPE, CAT_PKIF_CRYPTO, PKIF_SIGNATURE_VERIFICATION_FAILED, auditStr.c_str(), thisComponent, CRYPTO_VERIFY_FAILED, this);
                
                //if we are not at the end of the list, try again
                if(pos+1 == end)
                    throw e;
            }
        }
    }

    throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
}

void CPKIFCryptoMediator2::GetKeyList(
    CPKIFCredentialList& v,
    CPKIFKeyUsagePtr& ku)
{   
    bitset<9> tmp = ku->GetKeyUsage();
    GetKeyList(v, &tmp);
}

void CPKIFCryptoMediator2::GetKeyList(
    CPKIFCredentialList& v,
    bitset<9>*  ku)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::GetKeyList", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyIDPtr>::iterator pos;
    vector<IPKIFCryptoKeyIDPtr>::iterator end = m_impl->m_vCryptoKeyIDModules.end();
    bool opAttempted = false, opSucceeded = false;
    for(pos = m_impl->m_vCryptoKeyIDModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            (*pos)->GetKeyList(v, ku);
            opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);
}
void CPKIFCryptoMediator2::GetColleagues(
    std::vector<IPKIFColleaguePtr>& v) const
{
    copy(m_impl->m_vModules.begin(),m_impl->m_vModules.end(), back_inserter(v));
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, theirCert, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);
    return ctx;
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, theirPublicKey, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);

    return ctx;
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        CPKIFCredentialPtr & ephemeralKeyPair,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, ephemeralKeyPair, theirCert, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);

    return ctx;
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        CPKIFCredentialPtr & ephemeralKeyPair,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, ephemeralKeyPair, theirPublicKey, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);

    return ctx;
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& ephemeralPublicKey,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, ephemeralPublicKey, theirCert, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);

    return ctx;
}

IPKIFKeyAgreeContextPtr CPKIFCryptoMediator2::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& ephemeralPublicKey,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SecretAgree", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoKeyAgreePtr>::iterator pos;
    vector<IPKIFCryptoKeyAgreePtr>::iterator end = m_impl->m_vCryptoKeyAgreeModules.end();
    bool opAttempted = false, opSucceeded = false;
    IPKIFKeyAgreeContextPtr ctx;
    for(pos = m_impl->m_vCryptoKeyAgreeModules.begin(); pos != end; ++pos)
    {
        try
        {
            opAttempted = true;
            ctx = (*pos)->SecretAgree(myPrivateKey, ephemeralPublicKey, theirPublicKey, alg);
            if(ctx) opSucceeded = true;
        }
        catch(CPKIFException& e)
        {
            //EXCEPTION DELETION
            //mediators eat exceptions and throw an "op not handled" exception
            //if no colleagues are able to successfully complete an operation
            std::string reason = "A crypto-related exception was thrown.  ";
            reason.append(*e.print());
            AuditString(EVENTLOG_WARNING_TYPE, CAT_PKIF_CRYPTO, PKIF_UNEXPECTED_EXCEPTION, reason.c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    if(!opAttempted)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    if(!opSucceeded)
        throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);

    return ctx;
}

CPKIFKeyMaterialPtr CPKIFCryptoMediator2::DeriveKey(
                                                    const IPKIFKeyAgreeContextPtr & context,
                                                    unsigned long keyLen
                                                    )
{
    IPKIFCryptoKeyAgree * owner = context->GetOwner();
    if(!owner) throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_HANDLED);
    CPKIFKeyMaterialPtr key = owner->DeriveKey(context,keyLen);
    if(!key) throw CPKIFCacheException(thisComponent, COMMON_OPERATION_NOT_SUCCESSFUL);
    return key;
}

bool CPKIFCryptoMediator2::SupportsAlgorithm(
                                const CPKIFKeyMaterial& key)
{
    LOG_STRING_DEBUG("CPKIFCryptoMediator2::SupportsAlgorithm(const CPKIFKeyMaterial& key)", TOOLKIT_CRYPTO_MEDIATOR, 0, this);

    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    vector<IPKIFCryptoRawPtr>::iterator pos;
    vector<IPKIFCryptoRawPtr>::iterator end = m_impl->m_vCryptoRawModules.end();
    bool handled = false;
    for(pos = m_impl->m_vCryptoRawModules.begin(); pos != end; ++pos)
    {
        handled = true;
        if((*pos)->SupportsAlgorithm(key)) return true;
    }

    if(!handled) throw CPKIFCryptoException(thisComponent, COMMON_OPERATION_NOT_HANDLED);

    return false;
}