EncryptedData.cpp

Go to the documentation of this file.

#include "EncryptedData.h"

#include "Attribute.h"
#include "Buffer.h"
#include "EncryptedContentInfo.h"
#include "OID.h"
#include "AlgorithmIdentifier.h"
#include "PKIFBase64.h"
#include "PKIFAlgorithm.h"

#include "ToolkitUtils.h"
#include "PKIFMessageException.h"
#include "PKIFCMSMessageMemoryHelper.h"
#include "ASN1Helper.h"

#include "IPKIFCryptoRawOperations.h"
#include "IPKIFCryptoMisc.h"

#include "PKIFCMSAttributeMediator2.h"

#include "CryptographicMessageSyntax2004.h"

#include <iterator>

//EncodeIVAsOctetString is implemented in EnvelopedData.cpp
void EncodeIVAsOctetString(unsigned char* iv, int ivLen, unsigned char** encodedIV, int* encodedIVLen);

//declare utility function that's defined in CACCMSUtils.h
void SetupAttributesInObjectiveStructure(CPKIFAttributeList& attrs, DList& objAttrs);

struct CPKIFEncryptedDataImpl
{
    
    CPKIFEncryptedData *m_parent;

    CPKIFEncryptedDataImpl () 
    {
        m_parent = NULL;
    }
    CPKIFEncryptedDataImpl (CPKIFEncryptedData  *p) 
    {
        m_parent = p;
    }

    CPKIFEncryptedData::CMSVersion m_version;
    CPKIFEncryptedContentInfoPtr m_dataToEncrypt;
    CPKIFAttributeList m_unprotectedAttributes;

    CPKIFKeyMaterialPtr m_key;

    CPKIFBufferPtr m_decodeBuf; //added 10/20/03

    CPKIFASNWrapper<CACCMSEncryptedData>* m_encryptedData;

    //functions called by encode
    void PrepareEncryptedContent(CACCMSEncryptedData* pEnvelopedData);

    IPKIFMediatorPtr m_med;

    //function called by decode
    void populateUnsignedAttributesVector(const CACCMSUnsignedAttributes& ua);

    void MakeEncryptedData();
    void FreeEncryptedData();
};


//*****************************************************************************
//  constructors, destructors, makzenfriez
//*****************************************************************************
CPKIFEncryptedData::CPKIFEncryptedData()
    :m_impl (new CPKIFEncryptedDataImpl)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::CPKIFEncryptedData()", TOOLKIT_CRYPTO_MISC, 0, this);

    m_impl->m_parent = this;
    m_impl->m_version = CMSv0;
    m_impl->m_encryptedData = NULL;

    m_impl->MakeEncryptedData();

    SetContentType(g_encryptedData);
}
CPKIFEncryptedData::~CPKIFEncryptedData()
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::~CPKIFEncryptedData()", TOOLKIT_CRYPTO_MISC, 0, this);

    m_impl->FreeEncryptedData();
    //RemoveMediatorAssociations();
        
    delete m_impl;
    m_impl = NULL;

}

void CPKIFEncryptedData::AddMediator(
    IPKIFMediatorPtr& m)
{
    m_impl->m_med = m;
}
IPKIFMediatorPtr CPKIFEncryptedData::GetMediator()
{
    return m_impl->m_med;
}
void CPKIFEncryptedDataImpl::MakeEncryptedData()
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::MakeEncryptedData()", TOOLKIT_CRYPTO_MISC, 0, this);

    FreeEncryptedData();

    //throw bad_alloc (this function is invoked from the constructor and ClearContent)
    m_encryptedData = new CPKIFASNWrapper<CACCMSEncryptedData>( BEREncCACCMSEncryptedData, BERDecCACCMSEncryptedData );
}
void CPKIFEncryptedDataImpl::FreeEncryptedData()
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::FreeEncryptedData()", TOOLKIT_CRYPTO_MISC, 0, this);

    if(NULL != m_encryptedData)
        delete m_encryptedData;
    m_encryptedData = NULL;

    CPKIFBufferPtr emptyBP;
    m_decodeBuf = emptyBP;
}

//*****************************************************************************
//  field manipulation functions
//*****************************************************************************
void CPKIFEncryptedData::SetKeyMaterial(
    CPKIFKeyMaterialPtr& key)
{
    m_impl->m_key = key;
}
CPKIFEncryptedData::CMSVersion CPKIFEncryptedData::GetVersion() const
{
    return m_impl->m_version;
}
void CPKIFEncryptedData::SetDataToEncrypt(
    CPKIFEncryptedContentInfoPtr& buf)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::SetDataToEncrypt(CPKIFEncryptedContentInfoPtr& buf)", TOOLKIT_CRYPTO_MISC, 0, this);

    //This function can be used to set the data to encrypt to NULL.  It cannot
    //be used to set an incomplete data to encrypt structure.
    if(buf != (CPKIFEncryptedContentInfo*)NULL)
    {
        //this object MUST feature a content type oid and some content.
        //the alg id will be prepared automatically based on the key material.
        CPKIFOIDPtr tmpOID = buf->GetOID();
        CPKIFBufferPtr tmpBuf = buf->GetContent();
        if(tmpOID == (CPKIFOID*)NULL || tmpBuf == (CPKIFBuffer*)NULL)
            throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT);
    }

    m_impl->m_dataToEncrypt = buf;
}
void CPKIFEncryptedData::AddUnprotectedAttribute(
    CPKIFAttributePtr& attr)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::AddUnprotectedAttribute(CPKIFAttributePtr& attr)", TOOLKIT_CRYPTO_MISC, 0, this);

    //accept no NULLs
    if(attr == (CPKIFAttribute*)NULL)
        throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT);

    //If we're adding following a call to decode, then we should first read the attributes
    //that were decoded prior to pushing the new attribute into the list.
    if(m_impl->m_unprotectedAttributes.empty())
    {
        CPKIFAttributeList ual;
        GetUnprotectedAttributes(ual);
    }

    //Push the new attribute into the list.
    m_impl->m_unprotectedAttributes.push_back(attr);
}
void CPKIFEncryptedData::GetUnprotectedAttributes(
    CPKIFAttributeList& ual)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::GetUnprotectedAttributes(CPKIFAttributeList& ual)", TOOLKIT_CRYPTO_MISC, 0, this);

    ual.clear();

    //If m_unprotectedAttributes is not empty then we've already populated it and need not do so again.
    //If it's not empty, then we need to have a decoded object from which attributes will be read.
    if(m_impl->m_unprotectedAttributes.empty() && NULL != m_impl->m_encryptedData && NULL != m_impl->m_encryptedData->data() && (*m_impl->m_encryptedData)->m.unprotectedAttrsPresent)
        m_impl->populateUnsignedAttributesVector((*m_impl->m_encryptedData)->unprotectedAttrs);

    copy(m_impl->m_unprotectedAttributes.begin(),m_impl->m_unprotectedAttributes.end(), back_inserter(ual));
}
void CPKIFEncryptedData::ClearContent(
    bool removeMediatorAssociations)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::ClearContent(bool removeMediatorAssociations)", TOOLKIT_CRYPTO_MISC, 0, this);

    //free and make
    m_impl->FreeEncryptedData();
    m_impl->MakeEncryptedData();

    //zero the version
    m_impl->m_version = CMSv0;

    //create and assign empty smart pointers
    CPKIFEncryptedContentInfoPtr tmp;
    m_impl->m_dataToEncrypt = tmp;

    m_impl->m_unprotectedAttributes.clear();

    CPKIFKeyMaterialPtr emptyKey;
    m_impl->m_key = emptyKey;

    IPKIFMediatorPtr tmp2;
    m_impl->m_med = tmp2;

    //added 10/17/2003
    //if(removeMediatorAssociations)
    //  RemoveMediatorAssociations();
}

//*****************************************************************************
//  encode and decode functions
//*****************************************************************************
CPKIFBufferPtr CPKIFEncryptedData::Encode()
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::Encode()", TOOLKIT_CRYPTO_MISC, 0, this);

    //All memory allocations in this function are decoration of PKIFCMSMessageMemoryHelper.  If an
    //allocation fails we let the caller catch bad_alloc.  The destructor for PKIFCMSMessageMemoryHelper
    //will handle all cleanup.

    //create a memory helper object containing an Encrypted data structure - throw bad_alloc
    PKIFCMSMessageMemoryHelper mhEncryptedData;
    mhEncryptedData.pEncryptedData = new CACCMSEncryptedData;
    memset(mhEncryptedData.pEncryptedData, 0, sizeof(CACCMSEncryptedData));

    //initialize this to 0 - it will be updated as necessary by one or more of the following calls
    //initialization unnecessary thanks to memset above but for clarity...
    mhEncryptedData.pEncryptedData->version = CACCMSv0;

    //prepare the encrypted content  
    if(m_impl->m_dataToEncrypt != (CPKIFEncryptedContentInfo*)NULL)
    {
        //if data to encrypt is specified then encrypt it using the specified key
        //and create the necessary pieces of EncryptedData
        m_impl->PrepareEncryptedContent(mhEncryptedData.pEncryptedData);
    }
    else
    {
        //if data to encrypt is not specified then see if there's a copy of decoded encrypted content
        //to use (i.e. we're re-encoding after adding an unprotected attribute to an object for which 
        //we may not even possess the decryption key).
        if(NULL == m_impl->m_encryptedData || NULL == m_impl->m_encryptedData->data() ||
            0 == (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts)
            throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT, "No data to encrypt available.");

        CopyOID(&mhEncryptedData.pEncryptedData->encryptedContentInfo.contentType, &(*m_impl->m_encryptedData)->encryptedContentInfo.contentType);
        CopyOID(&mhEncryptedData.pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.algorithm, &(*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.algorithm);
        mhEncryptedData.pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent = (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent;
        if((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent)
        {
            mhEncryptedData.pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data = new unsigned char[(*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts];
            memcpy((void*)mhEncryptedData.pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts);
            mhEncryptedData.pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts = (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts;
        }
        
        mhEncryptedData.pEncryptedData->encryptedContentInfo.m.encryptedContentPresent = 1;
        mhEncryptedData.pEncryptedData->encryptedContentInfo.encryptedContent.data = new unsigned char[(*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts];
        memcpy((void*)mhEncryptedData.pEncryptedData->encryptedContentInfo.encryptedContent.data, (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.data, (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts);
        mhEncryptedData.pEncryptedData->encryptedContentInfo.encryptedContent.numocts = (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts;
    }
    
    mhEncryptedData.pEncryptedData->m.unprotectedAttrsPresent = 0;
    {//begin unsigned attribute block

        //get all attributes (either by parsing a decoded object or by accessing a previously constructed list)
        CPKIFAttributeList sas;
        GetUnprotectedAttributes(sas);

        if(!sas.empty())
        {
            //create Objective representations of each attribute...
            SetupAttributesInObjectiveStructure(sas, mhEncryptedData.pEncryptedData->unprotectedAttrs);
    
            //then set the flag indicating attributes are present and set the version number
            mhEncryptedData.pEncryptedData->m.unprotectedAttrsPresent = 1;
            mhEncryptedData.pEncryptedData->version = CACCMSv2;
        }
    }//end unsigned attribute block

    //prepare an ASN 1 object then produce the encoded result
    CACASNWRAPPER_CREATE(CACCMSEncryptedData, objPDU);
    ASN1OpenType* data1 = objPDU.Encode(mhEncryptedData.pEncryptedData);

    try
    {
        //copy the buffer info a buffer ptr to be returned to the caller
        CPKIFBufferPtr tmp(new CPKIFBuffer((unsigned char*)data1->data, data1->numocts));
        delete data1; data1 = NULL;
        return tmp;
    }
    catch(std::bad_alloc& ba)
    {
        if(data1)
            delete data1;
        throw ba;
    }
}
void CPKIFEncryptedData::Decode(
    CPKIFBufferPtr& buf)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::Decode(CPKIFBufferPtr& buf)", TOOLKIT_CRYPTO_MISC, 0, this);

    //if the input is empty - fail now
    if(buf == (CPKIFBuffer*)NULL)
        throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT);

    try
    {
        //otherwise attempt to decode the buffer into the member Encrypted data structure
        (*m_impl->m_encryptedData).Decode(buf->GetBuffer(), buf->GetLength());

        m_impl->m_decodeBuf = buf;

        if(CACCMSv2 == (*m_impl->m_encryptedData)->version)
            m_impl->m_version = CPKIFEncryptedData::CMSv2;
        else
            m_impl->m_version = CPKIFEncryptedData::CMSv0;
    }
    catch(CPKIFException& e)
    {
        unsigned char * decoded = NULL;
        unsigned long decodedLen;
        bool b = PEMDecode((char *)buf->GetBuffer(), &decoded, &decodedLen);
        if(b)
        {
            try
            {
                (*m_impl->m_encryptedData).InitContext();
                (*m_impl->m_encryptedData).Decode(decoded, decodedLen);

                CPKIFBufferPtr tmp(new CPKIFBuffer(decoded, decodedLen));
                m_impl->m_decodeBuf = tmp;

                if(CACCMSv2 == (*m_impl->m_encryptedData)->version)
                    m_impl->m_version = CPKIFEncryptedData::CMSv2;
                else
                    m_impl->m_version = CPKIFEncryptedData::CMSv0;

                if(NULL != decoded)
                    delete decoded;

            }catch(CPKIFException& e)
            {
                if(NULL != decoded)
                    delete decoded;

                CPKIFMessageException me(thisComponent, MSG_DECODE_FAILED);
                me.push_info(e);
                //delete e;
                throw me;
            }
        }
        else
        {
            if(NULL != decoded)
                delete decoded;
            CPKIFMessageException me(thisComponent, MSG_DECODE_FAILED);
            me.push_info(e);
            throw me;
        }
    }
}

//*****************************************************************************
//  miscellaneous functions
//*****************************************************************************
CPKIFBufferPtr CPKIFEncryptedData::Decrypt()
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::Decrypt()", TOOLKIT_CRYPTO_MISC, 0, this);

    //*****************************************************************
    //  sanity check the inputs
    //      - need to have data to decrypt, a key and an available 
    //  IPKIFCryptoRawOperations interface.
    //*****************************************************************
    if(NULL == GetMediator())
        throw CPKIFMessageException(thisComponent, COMMON_MEDIATOR_MISSING, "Mediator is not available.");

    IPKIFCryptoRawOperations* cRaw = GetMediator()->GetMediator<IPKIFCryptoRawOperations>();
    if(NULL == cRaw)
        throw CPKIFMessageException(thisComponent, COMMON_MEDIATOR_MISSING, "IPKIFCryptoRawOperations interface is not available.");

    if(m_impl->m_key == (CPKIFKeyMaterial*)NULL)
        throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT, "No key material available in CPKIFEncryptedData::Decrypt.  Call SetKeyMaterial before calling Decrypt.");

    if(NULL == m_impl->m_encryptedData || NULL == m_impl->m_encryptedData->data())
        throw CPKIFMessageException(thisComponent, COMMON_INVALID_INPUT, "No data to decrypt available.");

    //*****************************************************************
    //  prepare the decrypted content info output
    //*****************************************************************
    //see if we need to crack an IV out of the alg params
    if(ModeRequiresIV(m_impl->m_key->GetMode()))
    {
        //understanding that we need an IV, see if one is actually present
        if(!(*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent)
        {
            throw CPKIFMessageException(thisComponent, MSG_MISSING_PARAMS, "Content encryption mode requires an IV and no IV is present in the data to decrypt.");
        }
        else
        {
            //understanding that we need an IV and that one is present, decode the octet string that contains the IV
            OOCTXT ctxt;
            initContext (&ctxt);
            setBERDecBufPtr(&ctxt, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts, NULL, NULL);

            unsigned char* iv = NULL;
            unsigned int ivLen = (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts;

            int stat = decodeDynOctStr (&ctxt, (const OSOCTET* *)&iv, (OSUINT32 *)&ivLen, ASN1EXPL, ivLen);
            if (stat != ASN_OK)
            {
                //clean up the context
                //freeEncodeBuffer(&ctxt);
                //memFreeAll(&ctxt);
                freeContext(&ctxt);

                throw CPKIFMessageException(TOOLKIT_MESSAGE_ASN, ASN1_DECODE_ERROR, "Failed to decode IV value");
            }

            m_impl->m_key->SetIV(iv, ivLen);

            //clean up the context
            //freeEncodeBuffer(&ctxt);
            //memFreeAll(&ctxt);
            freeContext(&ctxt);
        }
    }

    //allocate a buffer to receive the decrypted content - throw bad_alloc
    int nResultLen = (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts;
    unsigned char* pResult = new unsigned char[nResultLen];

    try
    {
        cRaw->Decrypt(*m_impl->m_key, (unsigned char*)(*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.data, (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts, pResult, &nResultLen);
    }
    catch(...)
    {
        //throw any exception - but first clean up pResult
        if(pResult)
            delete[] pResult;

        throw;
    }

    CPKIFBuffer* pTmpBP = NULL;
    try
    {
        pTmpBP = new CPKIFBuffer(true, pResult, nResultLen);
    }
    catch(std::bad_alloc& ba)
    {
        if(pResult)
            delete[] pResult;

        throw ba;
    }

    CPKIFBufferPtr tmpBP(pTmpBP);

    //having decrypted the content, prepare the pieces of an encrypted content info object and
    //store the results in m_dataToEncrypt
    CPKIFEncryptedContentInfoPtr tmpECIP(new CPKIFEncryptedContentInfo);
    CPKIFOIDPtr tmpECIP_OID(new CPKIFOID((*m_impl->m_encryptedData)->encryptedContentInfo.contentType.subid, 
                (*m_impl->m_encryptedData)->encryptedContentInfo.contentType.numids));
    tmpECIP->SetOID(tmpECIP_OID);

    //CPKIFAlgorithmIdentifier creation
    CPKIFOIDPtr algOID(new CPKIFOID((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.algorithm.subid,
                        (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.algorithm.numids));
    CPKIFBufferPtr paramBuf;
    if((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent)
    {
        paramBuf = CPKIFBufferPtr(new CPKIFBuffer((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data,
                    (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts));
    
    
    }
    
    CPKIFAlgorithmIdentifierPtr tmpECIP_AlgID(new CPKIFAlgorithmIdentifier(algOID, paramBuf)); 
    //CPKIFAlgorithmIdentifierPtr tmpECIP_AlgID(new CPKIFAlgorithmIdentifier(*((CACX509V3AlgorithmIdentifier*)&(*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm)));
    tmpECIP->SetAlgorithmIdentifier(tmpECIP_AlgID);

    tmpECIP->SetContent(tmpBP);
    m_impl->m_dataToEncrypt = tmpECIP;

    return tmpBP;
}

//*****************************************************************************
//  miscellaneous functions
//*****************************************************************************
void CPKIFEncryptedDataImpl::PrepareEncryptedContent(
    CACCMSEncryptedData* pEncryptedData)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::PrepareEncryptedContent(CACCMSEncryptedData* pEncryptedData)", TOOLKIT_CRYPTO_MISC, 0, this);

    //This function is only called from CPKIFEncryptedData::Encode.  All memory allocated by this
    //function is allocated into objects that will be cleaned up automatically if an exception is
    //generated.  Thus, no catch statements are necessary here.

    //*****************************************************************
    //  sanity check the inputs
    //      - need to have data to encrypt, a key, a pointer
    //  to outbound structure and an available IPKIFCryptoRawOperations 
    //  interface.
    //*****************************************************************
    if(NULL == pEncryptedData)
        throw CPKIFMessageException(m_parent->thisComponent, COMMON_INVALID_INPUT, "");

    if(m_key == (CPKIFKeyMaterial*)NULL)
        throw CPKIFMessageException(m_parent->thisComponent, COMMON_INVALID_INPUT, "No key material has been set via a call to SetKeyMaterial.");

    if(m_dataToEncrypt == (CPKIFEncryptedContentInfo*)NULL)
        throw CPKIFMessageException(m_parent->thisComponent, COMMON_INVALID_INPUT, "No data to encrypt is available.");

    if(NULL == m_med)
        throw CPKIFMessageException(m_parent->thisComponent, COMMON_MEDIATOR_MISSING, "Mediator is not available.");

    IPKIFCryptoRawOperations* cRaw = m_med->GetMediator<IPKIFCryptoRawOperations>();
    if(NULL == cRaw)
        throw CPKIFMessageException(m_parent->thisComponent, COMMON_MEDIATOR_MISSING, "IPKIFCryptoRawOperations interface is not available.");

    //*****************************************************************
    //  prepare the encrypted content info output
    //  EncryptedContentInfo ::= SEQUENCE 
    //  {
    //      contentType ContentType,
    //      contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
    //      encryptedContent [0] IMPLICIT EncryptedContent OPTIONAL 
    //  }
    //*****************************************************************
    CPKIFStringPtr str(new std::string(m_dataToEncrypt->GetOID()->ToString()));
    ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
    CopyOID(&pEncryptedData->encryptedContentInfo.contentType, tmpOid);
    if(tmpOid)
        delete tmpOid;
    //CopyOID(&pEncryptedData->encryptedContentInfo.contentType, m_dataToEncrypt->GetOID()->raw());
    CPKIFAlgorithm * algInfo = CPKIFAlgorithm::GetAlg(m_key->GetSymmetricKeyAlgorithm()
        ,m_key->GetMode());
    CPKIFOIDPtr activeAlg = algInfo->OID();
    int keySize = algInfo->KeySize();
    int ivSize = algInfo->BlockSize();
    bool needIV = algInfo->NeedsIV();
    if(!activeAlg) throw CPKIFMessageException(m_parent->thisComponent, COMMON_UNSUPPORTED_ALG);
    
    CPKIFStringPtr secondStr(new std::string(activeAlg->ToString()));
    ASN1OBJID* secondTmpOid = ConvertStringToASN1OBJID(secondStr);
    CopyOID(&pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.algorithm, secondTmpOid);
    if(secondTmpOid)
        delete secondTmpOid;
    //CopyOID(&pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.algorithm, activeAlg->raw());

    const int maxBlock = (MAXBLOCK/8) + 1;
    if(needIV)
    {
        //if we need an IV access the IPKIFCryptoMisc interface
        IPKIFCryptoMisc* cMisc = m_med->GetMediator<IPKIFCryptoMisc>();
        if(NULL == cMisc)
            throw CPKIFMessageException(m_parent->thisComponent, COMMON_MEDIATOR_MISSING, "IPKIFCryptoMisc interface is not available.");

        //generate a random IV
        unsigned char iv[maxBlock];
        cMisc->GenRandom(iv, ivSize);
        m_key->SetIV(iv, ivSize);

        //encode the IV as an octet string the the content enc alg parameters
        pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent = 1;
        EncodeIVAsOctetString(iv, ivSize, 
            (unsigned char**)&pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data, 
            (int*)&pEncryptedData->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts);
    }

    //grab a pointer to the content to be encrypted
    CPKIFBufferPtr dataToEnc = m_dataToEncrypt->GetContent();

    //overallocate a buffer (the length will be adjusted down by the call to Encrypt)
    pEncryptedData->encryptedContentInfo.encryptedContent.numocts = dataToEnc->GetLength() + maxBlock;
    pEncryptedData->encryptedContentInfo.encryptedContent.data = new unsigned char[pEncryptedData->encryptedContentInfo.encryptedContent.numocts];

    cRaw->Encrypt(*m_key, (unsigned char*)dataToEnc->GetBuffer(), dataToEnc->GetLength(), 
        (unsigned char*)pEncryptedData->encryptedContentInfo.encryptedContent.data, (int*)&pEncryptedData->encryptedContentInfo.encryptedContent.numocts);

    pEncryptedData->encryptedContentInfo.m.encryptedContentPresent = 1;
}
void CPKIFEncryptedDataImpl::populateUnsignedAttributesVector(
    const CACCMSUnsignedAttributes& ua)
{
    LOG_STRING_DEBUG("CPKIFEncryptedData::populateUnsignedAttributesVector", TOOLKIT_CRYPTO_MISC, 0, this);

    //if we've already populated the extensions vector then return
    if(!m_unprotectedAttributes.empty())
        return;

    //if there are no extensions then return
    if(0 == ua.count)
    {
        m_unprotectedAttributes.clear();
        return;
    }

    //create an attributes mediator using the default attribute colleagues and initialize it
    CPKIFCMSAttributeMediator2* mediator = CPKIFCMSAttributeMediator2::GetInstance();

    //iterate over the list of extensions and populate the extensions vector
    DListNode* cur = ua.head;
    for(unsigned int ii = 0; ii < ua.count; ++ii)
    {
        CACCMSAttribute* attr = (CACCMSAttribute*) cur->data;
        CPKIFOIDPtr oid(new CPKIFOID(attr->attrType.subid,attr->attrType.numids));
        CPKIFBufferPtr buf(new CPKIFBuffer(attr->attrValues.data, attr->attrValues.numocts));

        m_unprotectedAttributes.push_back(mediator->getAttribute(oid, buf));
        //m_unprotectedAttributes.push_back(mediator.getAttribute(*((CACCMSAttribute*)cur->data)));
        cur = cur->next;
    }
}

void CPKIFEncryptedData::GetEncodedUnprotectedAttributes (
    CPKIFBufferPtr& buf) {
  try
  {
    if (NULL != m_impl->m_encryptedData && NULL != m_impl->m_encryptedData->data() 
      && (*m_impl->m_encryptedData)->m.unprotectedAttrsPresent)
    {
      CACASNWRAPPER_CREATE(CACCMSUnprotectedAttributes, attrWrapper);
      ASN1OpenType *data = attrWrapper.Encode (&(*m_impl->m_encryptedData)->unprotectedAttrs);
      CPKIFBufferPtr tmp(new CPKIFBuffer(data->data, data->numocts));
      buf = tmp;
      delete data;
      return;
    }
  } 
  catch (...)
  {
  }

  CPKIFBufferPtr nullExt;
  buf = nullExt;
}
void CPKIFEncryptedData::_GetUnprotectedAttributes(
    std::vector<CPKIFAttributePtr> attrVector)
{
    CPKIFCMSAttributeMediator2* mediator = CPKIFCMSAttributeMediator2::GetInstance();
    this->IPKIFHasAttributes::GetUnprotectedAttributes(mediator, attrVector);
}
void CPKIFEncryptedData::GetAddedUnprotectedAttributes(
    std::vector<CPKIFAttributePtr>& attr)
{
  /*std::vector<CPKIFAttributePtr>*/CPKIFAttributeList::iterator pos;
  /*std::vector<CPKIFAttributePtr>*/CPKIFAttributeList::iterator end = m_impl->m_unprotectedAttributes.end();
  for (pos = m_impl->m_unprotectedAttributes.begin(); pos != end; pos++)
  {
    attr.push_back (*pos);
  }
}
CPKIFEncryptedContentInfoPtr CPKIFEncryptedData::GetEncryptedData() const
{
    if(m_impl->m_dataToEncrypt == (CPKIFEncryptedContentInfo*)NULL)
    {
        CPKIFEncryptedContentInfoPtr tmpECIP(new CPKIFEncryptedContentInfo());

        //content type is required so if we get here then we have one (if there wasn't one we'd've failed in the parser)
        //throw bad_alloc or CPKIFException
        CPKIFOIDPtr tmpOID(new CPKIFOID((*m_impl->m_encryptedData)->encryptedContentInfo.contentType.subid, (*m_impl->m_encryptedData)->encryptedContentInfo.contentType.numids));
        tmpECIP->SetOID(tmpOID);

        //actual content is optional - add it to the object if it's there...
        if((*m_impl->m_encryptedData)->encryptedContentInfo.m.encryptedContentPresent)
        {
            //throw bad_alloc
            CPKIFBufferPtr tmpBuf(new CPKIFBuffer((*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.data, (*m_impl->m_encryptedData)->encryptedContentInfo.encryptedContent.numocts));
            tmpECIP->SetContent(tmpBuf);
        }

        CPKIFOIDPtr tmpContentAlgOID(new CPKIFOID((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.algorithm.subid, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.algorithm.numids));
        CPKIFBufferPtr tmpParams;
        if((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.m.parametersPresent)
        {
            CPKIFBufferPtr newBuf(new CPKIFBuffer((*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.data, (*m_impl->m_encryptedData)->encryptedContentInfo.contentEncryptionAlgorithm.parameters.numocts));
            tmpParams = newBuf;
        }
        
        CPKIFAlgorithmIdentifierPtr contentAlg(new CPKIFAlgorithmIdentifier(tmpContentAlgOID, tmpParams));
        tmpECIP->SetAlgorithmIdentifier(contentAlg);

        //save the new ecip
        CPKIFEncryptedData* nonConst = const_cast<CPKIFEncryptedData*>(this);
        nonConst->m_impl->m_dataToEncrypt = tmpECIP;
    }

    return m_impl->m_dataToEncrypt;
}