PKIFCryptoPP.cpp

Go to the documentation of this file.

#include "PKIFCryptoPP.h"
#include "PKIFCryptoPPCredential.h"
#include "PKIFCryptoPPKeyMaterial.h"
#include "PKIFCryptoPPExternalDigest.h"
#include "PKIFCryptoPPKAContext.h"

#include "ToolkitUtils.h"
#include "PKIFCryptoErrors.h"
#include "PKIFCryptoPPErrors.h"
#include "PKIFCryptoException.h"
#include "KeyUsage.h"
#include "PKIFAlgorithm.h"
#include "Buffer.h"
#include "SubjectPublicKeyInfo.h"
#include "Certificate.h"

#include "ASN1Helper.h"
#include "ECC-CMS.h"

#include "cryptlib.h"
#include "pubkey.h"
#include "sha.h"
#include "queue.h"
#include "osrng.h"
#include "rsa.h"
#include "dsa.h"
#include "eccrypto.h"
#include "asn.h"
#include "dsa.h"
#include "modes.h"
#include "aes.h"
#include "hmac.h"
#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
#include "md5.h"

#include <oids.h>


#include <boost/scoped_ptr.hpp>

using namespace CryptoPP;
using namespace std;
using namespace boost;

#include <sstream>

#include "boost/numeric/conversion/cast.hpp"

#if defined(WIN32) || defined(_WIN32)
    #include <Winsock2.h>
#endif

#if !defined(_WIN32)
#include <netinet/in.h>
#endif

using boost::numeric_cast;
using boost::bad_numeric_cast;

using namespace std;
using namespace CryptoPP;

struct CPKIFCryptoPPImpl
{
};

CPKIFCryptoPP::CPKIFCryptoPP()
:m_impl(new CPKIFCryptoPPImpl)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
}
CPKIFCryptoPP::~CPKIFCryptoPP()
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
    if(!m_impl) {
        delete m_impl;
        m_impl = 0;
    }
}

void CPKIFCryptoPP::Initialize()
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
}

void CPKIFCryptoPP::GetKeyList(
    CPKIFCredentialList& v,
    CPKIFKeyUsagePtr& ku)
{
    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_NOT_IMPLEMENTED, "The crypto++ colleague does not store keys.");
}

void CPKIFCryptoPP::GetKeyList(
    CPKIFCredentialList& v,
    std::bitset<9>* ku)
{
    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_NOT_IMPLEMENTED, "The crypto++ colleague does not store keys.");
}

bool CPKIFCryptoPP::OwnsKey(
    const CPKIFCredential& keyID) const
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
    // Since the CPKIFCryptoPPCredential object carries all the key material it needs, if we can cast it we own it
    const CPKIFCryptoPPCredential * cryptoppkey = dynamic_cast<const CPKIFCryptoPPCredential *>(&keyID);
    return (0 != cryptoppkey);
}
CPKIFCredentialPtr CPKIFCryptoPP::MakeKeyID(
    const std::string& asciiHexKeyID)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_NOT_IMPLEMENTED, "The crypto++ colleague does not store keys.");
}
void CPKIFCryptoPP::Sign(
    const CPKIFCredential& key, 
    unsigned char* pHashData, 
    int nHashDataLen, 
    unsigned char* pSignature, 
    int* nSignatureLen,
    PKIFCRYPTO::HASH_ALG ha
    )

{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
    CPKIFCryptoPPCredential * cryptoppkey = const_cast<CPKIFCryptoPPCredential *>(dynamic_cast<const CPKIFCryptoPPCredential *>(&key));
    if(!cryptoppkey) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }
    CPKIFAlgorithm * keyAlg = cryptoppkey->GetAlgorithm();
    if(!keyAlg) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ credential has not been properly populated",thisComponent,COMMON_INVALID_INPUT,this);
    }
    bool isDSA = false;
    PK_Signer * signer = 0;
    ByteQueue keyReader;
    keyReader.Put(cryptoppkey->m_keyBuf->GetBuffer(),cryptoppkey->m_keyBuf->GetLength());
    switch(keyAlg->AsymkeyAlg()) {
        case PKIFCRYPTO::RSA:
            switch(ha) {
                case PKIFCRYPTO::MD5:
                    signer = new RSASS<PKCS1v15,CryptoPP::Weak::MD5>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA1:
                    signer = new RSASS<PKCS1v15,CryptoPP::SHA1>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA256:
                    signer = new RSASS<PKCS1v15,CryptoPP::SHA256>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA384:
                    signer = new RSASS<PKCS1v15,CryptoPP::SHA384>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA512:
                    signer = new RSASS<PKCS1v15,CryptoPP::SHA512>::Signer(keyReader);
                    break;
                default:
                    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, PKIF_CRYPTOPP_UNSUPPORTED_ALG);
                    break;
            }
            break;
        case PKIFCRYPTO::ECC:
            isDSA = true;
            switch(ha) {
                case PKIFCRYPTO::SHA1:
                    signer = new ECDSA<ECP,CryptoPP::SHA1>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA256:
                    signer = new ECDSA<ECP,CryptoPP::SHA256>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA384:
                    signer = new ECDSA<ECP,CryptoPP::SHA384>::Signer(keyReader);
                    break;
                case PKIFCRYPTO::SHA512:
                    signer = new ECDSA<ECP,CryptoPP::SHA512>::Signer(keyReader);
                    break;
                default:
                    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, PKIF_CRYPTOPP_UNSUPPORTED_ALG);
                    break;
            }
            break;
        case PKIFCRYPTO::DSS:
            isDSA = true;
            switch(ha) {
                case PKIFCRYPTO::SHA1:
                    signer = new DSA::Signer(keyReader);
                    break;
                default:
                    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, PKIF_CRYPTOPP_UNSUPPORTED_ALG);
                    break;
            }
            break;
        default:
            throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, PKIF_CRYPTOPP_UNSUPPORTED_ALG);
            break;
    }
    int expectedLen = static_cast<int>(signer->SignatureLength());
    if(*nSignatureLen < expectedLen) {
        delete signer;
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_INVALID_INPUT, "Signature buffer too short");
    }
    
    PKIFCryptoPPExternalDigestAccumulator * ed = NewEDAccumulator(pHashData,nHashDataLen);
    static RandomPool rng;
    
    
    // crypto++ does DSA in the IEEE format. Since this is PKIF, all signatures will be expected to be DER.
    if(!isDSA) {
        signer->Sign(rng,ed,pSignature);
        *nSignatureLen = expectedLen;
    } else {
        unsigned char * rawSig = new unsigned char[expectedLen];
        // DSA does some funky stuff with the message accumulator in the initializer that
        // our external digest accumulator doesn't handle.
        // let the signer make one then copy the initialization into ours.
        
        //Removed the signature formatting to be consistent with NSS
        PK_MessageAccumulatorBase * acc = dynamic_cast<PK_MessageAccumulatorBase *>(signer->NewSignatureAccumulator(rng));
        ed->m_presignature = acc->m_presignature;
        ed->m_k = acc->m_k;
        //signer->Sign(rng,ed,rawSig);
        signer->Sign(rng,ed,pSignature);
        *nSignatureLen = expectedLen;
        //size_t outLen = DSAConvertSignatureFormat(pSignature,*nSignatureLen,DSA_DER,rawSig,expectedLen,DSA_P1363);
        //*nSignatureLen = static_cast<int>(outLen);
    }
}

void CPKIFCryptoPP::Decrypt(
    const CPKIFCredential& key,
    unsigned char* pData,
    int nDataLen, 
    unsigned char* pResult,
    int* pnResultLen)
{
    LOG_STRING_DEBUG(__FUNCTION__,TOOLKIT_CRYPTO_CRYPTOPP,0,this);
    const CPKIFCryptoPPCredential * cryptoppkey = dynamic_cast<const CPKIFCryptoPPCredential *>(&key);
    if(!cryptoppkey) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-Crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }
    
    throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_NOT_IMPLEMENTED, "The crypto++ colleague does not store keys.");
}

void CPKIFCryptoPP::Encrypt(
    const CPKIFCredential& key,
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult, 
    int* pnResultLen)
{
    RAISE_CRYPTO_EXCEPTION("Encryption is unimplemented for stored key material.",thisComponent,COMMON_NOT_IMPLEMENTED,this);
}
bool CPKIFCryptoPP::Verify(
    const CPKIFCredential& key,
    unsigned char* pHashData, 
    int nHashDataLen, 
    unsigned char* pSignature, 
    int nSignatureLen,
    PKIFCRYPTO::HASH_ALG ha
    )
{
    RAISE_CRYPTO_EXCEPTION("Verification is unimplemented for stored key material.",thisComponent,COMMON_NOT_IMPLEMENTED,this);
    return false;
}
IPKIFCryptContext* CPKIFCryptoPP::CryptInit(
    CPKIFCredentialPtr& key,
    bool pad)
{
    RAISE_CRYPTO_EXCEPTION("Context-based operations are unimplemented for Crypto++ stored key material.",thisComponent,COMMON_NOT_IMPLEMENTED,this);
    return 0;
}
void CPKIFCryptoPP::Decrypt(
    IPKIFCryptContext* cryptContext, 
    unsigned char* pData, 
    int nDataLen, 
    unsigned char* pResult, 
    int* pnResultLen, 
    bool final)
{
    RAISE_CRYPTO_EXCEPTION("Context-based decryption is unimplemented for stored key material.",thisComponent,COMMON_NOT_IMPLEMENTED,this);
}
void CPKIFCryptoPP::Encrypt(IPKIFCryptContext* cryptContext, unsigned char* pData, int nDataLen, unsigned char* pResult, int* pnResultLen, bool final)
{
    RAISE_CRYPTO_EXCEPTION("Encryption is unimplemented for stored key material.",thisComponent,COMMON_NOT_IMPLEMENTED,this);
}

void GetPrivateExponent(CryptoPP::SecByteBlock & exp, CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> & key)
{
    exp.New(key.GetPrivateExponent().ByteCount());
    key.GetPrivateExponent().Encode(exp,exp.m_size);
}

void GetEncodedPublicKey(CryptoPP::SecByteBlock & enc, CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> & key)
{
    CryptoPP::ByteQueue bq;
    key.DEREncodePublicKey(bq);
    
    size_t len;
    try {
        len = boost::numeric_cast<size_t,CryptoPP::lword>(bq.MaxRetrievable());
    }catch(boost::numeric::bad_numeric_cast &){
        throw CPKIFCryptoException(TOOLKIT_CRYPTO_CRYPTOPP, COMMON_INVALID_INPUT, "Failed to decode public key");
    }
    enc.New(len);
    bq.Get(enc,len);
}

IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    // use a CPKIFCryptoPPKeyMaterial object since it can easily produce whichever format
    // is needed for the public key
    CPKIFCryptoPPKeyMaterialPtr km(new CPKIFCryptoPPKeyMaterial(*theirCert));
    CPKIFBufferPtr rawKey = km->GetRawSPKI();
    return SecretAgree(myPrivateKey, rawKey, alg);
}

// If myPrivateKey is absent, theirPublicKey needs to be a whole subject public key info structure.
// If myPrivateKey is supplied, theirPublicKey is assumed to be just the integer.

IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    CPKIFOIDPtr kaOID = alg->OID();
    CryptoPP::SecByteBlock theirPubInteger;
    CPKIFCryptoPPCredentialPtr myCppCred;


    CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> theirPub;
    CryptoPP::ByteQueue pubq;
    pubq.Put(theirPublicKey->GetBuffer(),theirPublicKey->GetLength());
    try {
        theirPub.BERDecode(pubq);
    } catch(CryptoPP::BERDecodeErr &) {
        RAISE_CRYPTO_EXCEPTION("Unable to decode public key for ECDH",thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }
    
    // Unlike much of crypto++, Agree() expects just the integer, not the whole spki
    GetEncodedPublicKey(theirPubInteger,theirPub);

    // Generate a new ephemeral keypair if needed. Parameters will match their public key.
    if(!myPrivateKey) {

        CryptoPP::AutoSeededRandomPool rng;
        CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> ephemeralPriv;
        ephemeralPriv.Initialize(rng,theirPub.GetGroupParameters());

        // this is round-about, but encoding it here and stuffing it into a credential object
        // makes it easier to support originator/recipient with less code and conveys the nice bonus
        // of making static-static easy
        CryptoPP::ByteQueue ephemq;
        ephemeralPriv.DEREncode(ephemq);
        CPKIFCryptoPPCredential * ephemeralCred = new CPKIFCryptoPPCredential();
        CPKIFBufferPtr keyBuf(new CPKIFBuffer());
        unsigned char * keyBufRaw = keyBuf->AllocateBuffer(static_cast<int>(ephemq.MaxRetrievable()));
        ephemq.Get(keyBufRaw,keyBuf->GetLength());
        ephemeralCred->SetPrivateKey(keyBuf);
        myCppCred = CPKIFCryptoPPCredentialPtr(ephemeralCred);
        myCppCred->SetAlgorithm(CPKIFAlgorithm::GetAlg(PKIFCRYPTO::ECC));
        // make sure the caller gets the newly generated key for further encoding, etc.
        myPrivateKey = dynamic_pointer_cast<CPKIFCredential, CPKIFCryptoPPCredential>(myCppCred);
        
    }


    if(!myCppCred) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-Crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }
    
    // whether it was generated or passed in, decode now
    CryptoPP::ByteQueue privq;
    privq.Put(myCppCred->m_keyBuf->GetBuffer(),myCppCred->m_keyBuf->GetLength());
    CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> myPriv;
    myPriv.BERDecode(privq);

    bool kaResult = false;
    CryptoPP::ECDH<CryptoPP::ECP>::Domain * ecdh = 0;

    if(*kaOID == *g_ecdh_std_sha256kdf || *kaOID == *g_ecdh_std_sha384kdf) {
        // ECDH parameters should come from caller's keypair
        ecdh = new CryptoPP::ECDH<CryptoPP::ECP>::Domain(myPriv.GetGroupParameters());
        
    } else {
        RAISE_CRYPTO_EXCEPTION("Unsupported key agreement scheme",thisComponent,PKIF_CRYPTOPP_UNSUPPORTED_ALG,this);        
    }

    // this really shouldn't ever happen. normally we've either caught the unsupported scheme above
    // or you wouldn't have been able to get the credential in here in the first place.
    if(!ecdh) {
        RAISE_CRYPTO_EXCEPTION("Unable to initialize ECDH key agreement", thisComponent, COMMON_UNKNOWN_ERROR, this);
    }
    CPKIFCryptoPPKAContextPtr kaCtx(new CPKIFCryptoPPKAContext());
    kaCtx->SetOwner(this);
    kaCtx->SetAlgorithm(alg);
    CPKIFBufferPtr sharedSecret(new CPKIFBuffer());
    unsigned char* ss = sharedSecret->AllocateBuffer(ecdh->AgreedValueLength());
    CryptoPP::SecByteBlock myExp;
    GetPrivateExponent(myExp,myPriv);

    
    kaResult = ecdh->Agree(ss, myExp, theirPubInteger);

    if(!kaResult) {
        // if Agree() returned false, that generally indicates either a decoding failure or
        // incompatible domain parameters. As the explanation for PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT indicates,
        // in this code it will nearly always be incompatible domain parameters, since the encoding has had to
        // traverse so many pipes to even get here.
        RAISE_CRYPTO_EXCEPTION("Unable to complete key agreement operation", thisComponent, PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT, this);
    }

    kaCtx->SetSecret(sharedSecret);
    return dynamic_pointer_cast<IPKIFKeyAgreeContext,CPKIFCryptoPPKAContext>(kaCtx);
}

// originator interfaces for authenticated key agreement
// to re-use an ephemeral keypair, pass one in. if an invalid smart pointer is passed, a new, compatible
// pair will be generated
IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        CPKIFCredentialPtr & ephemeralKeyPair,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    CPKIFCryptoPPKeyMaterialPtr km(new CPKIFCryptoPPKeyMaterial(*theirCert));
    CPKIFBufferPtr rawKey = km->GetRawSPKI();
    return SecretAgree(myPrivateKey, ephemeralKeyPair, rawKey, alg);
}

// to re-use an ephemeral keypair, pass one in. if an invalid smart pointer is passed, a new, compatible
// pair will be generated
IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        CPKIFCredentialPtr & ephemeralKeyPair,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    CPKIFOIDPtr kaOID = alg->OID();
    if(*kaOID != *g_ecmqv_sha1kdf) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ SecretAgree() called with an unsupported algorithm",
            thisComponent,CRYPTO_ALG_NOT_SUPPORTED,this);
    }

    CPKIFCryptoPPCredentialPtr myCppCred = dynamic_pointer_cast<CPKIFCryptoPPCredential, CPKIFCredential>(myPrivateKey);
    if(!myCppCred) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-Crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }

    // import the originator static keypair so parameters are available for generation of the ephemeral
    // keypair if needed
    CryptoPP::ByteQueue privq;
    privq.Put(myCppCred->m_keyBuf->GetBuffer(),myCppCred->m_keyBuf->GetLength());
    CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> myPriv;
    myPriv.BERDecode(privq);

    // Generate a new ephemeral keypair if needed
    CPKIFCryptoPPCredentialPtr ephemCppCred;
    if(!ephemeralKeyPair) {
        CryptoPP::AutoSeededRandomPool rng;
        CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> ephemeralPriv;
        // parameters need to be the same as our private and their public
        ephemeralPriv.Initialize(rng,myPriv.GetGroupParameters());
        CryptoPP::ByteQueue ephemq;
        ephemeralPriv.DEREncode(ephemq);
        CPKIFCryptoPPCredential * ephemeralCred = new CPKIFCryptoPPCredential();
        ephemeralCred->SetAlgorithm(myCppCred->GetAlgorithm());
        CPKIFBufferPtr keyBuf(new CPKIFBuffer());
        // cast should be safe given that this is a key we just generated
        unsigned char * keyBufRaw = keyBuf->AllocateBuffer((int)ephemq.MaxRetrievable());
        ephemq.Get(keyBufRaw,keyBuf->GetLength());
        ephemeralCred->SetPrivateKey(keyBuf);
        ephemCppCred = CPKIFCryptoPPCredentialPtr(ephemeralCred);
        // place it in the credential pointer so it can be re-used later for encoding, etc. if needed
        ephemeralKeyPair = dynamic_pointer_cast<CPKIFCredential, CPKIFCryptoPPCredential>(ephemCppCred);
    } else {
        ephemCppCred = dynamic_pointer_cast<CPKIFCryptoPPCredential, CPKIFCredential>(ephemeralKeyPair);
    }
    if(!ephemCppCred) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-Crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }

    // need to decode the ephemeral pair here in case it was passed in rather than generated
    CryptoPP::ByteQueue ephemq;
    ephemq.Put(ephemCppCred->m_keyBuf->GetBuffer(),ephemCppCred->m_keyBuf->GetLength());
    CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> ephemPriv;
    try {
        ephemPriv.BERDecode(ephemq);
    } catch(CryptoPP::BERDecodeErr &){
        RAISE_CRYPTO_EXCEPTION("Unable to decode ephemeral keypair for MQV",thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }

    CryptoPP::SecByteBlock myprivbb;
    GetPrivateExponent(myprivbb,myPriv);

    // XXX *** Allow either a full SubjectPublicKeyInfo structure or an integer to work
    CryptoPP::SecByteBlock theirPubInteger;
    CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> theirPubTmp;
    CryptoPP::ByteQueue pubq;
    
    try {
        pubq.Put(theirPublicKey->GetBuffer(),theirPublicKey->GetLength());
        theirPubTmp.BERDecode(pubq);
        GetEncodedPublicKey(theirPubInteger,theirPubTmp);
    } catch(CryptoPP::Exception &) {
        theirPubInteger.New(theirPublicKey->GetLength());
        memcpy(theirPubInteger,theirPublicKey->GetBuffer(),theirPublicKey->GetLength());
    }

    

    CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> ephemPub;
    ephemPriv.MakePublicKey(ephemPub);

    CryptoPP::SecByteBlock eprivbb;
    CryptoPP::SecByteBlock epubbb;
    CryptoPP::SecByteBlock econcat;

    // Crypto++ MQV expects the ephemeral private key to have the public key material
    // tacked onto the end of the buffer
    GetPrivateExponent(eprivbb,ephemPriv);
    GetEncodedPublicKey(epubbb,ephemPub);
    econcat.New(eprivbb.m_size+epubbb.m_size);
    memcpy(econcat,eprivbb,eprivbb.m_size);
    memcpy(econcat+eprivbb.m_size,epubbb,epubbb.m_size);

    CryptoPP::ECMQV<CryptoPP::ECP>::Domain ecmqv(myPriv.GetGroupParameters());
    CPKIFCryptoPPKAContextPtr ctx(new CPKIFCryptoPPKAContext());
    ctx->SetOwner(this);
    ctx->SetAlgorithm(alg);
    CPKIFBufferPtr sharedSecret(new CPKIFBuffer());
    unsigned char* ss = sharedSecret->AllocateBuffer(ecmqv.AgreedValueLength());
    bool kaResult = ecmqv.Agree(ss,myprivbb,econcat,theirPubInteger,theirPubInteger);

    if(!kaResult) {
        // if Agree() returned false, that generally indicates either a decoding failure or
        // incompatible domain parameters. As the explanation for PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT indicates,
        // in this code it will nearly always be incompatible domain parameters, since the encoding has had to
        // traverse so many pipes to even get here.
        RAISE_CRYPTO_EXCEPTION("Unable to complete key agreement operation", thisComponent, PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT, this);
    }
    ctx->SetSecret(sharedSecret);
    return dynamic_pointer_cast<IPKIFKeyAgreeContext,CPKIFCryptoPPKAContext>(ctx);

}

// recipient interfaces for authenticated key agreement

IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& ephemeralPublicKey,
                                        const CPKIFCertificatePtr& theirCert,
                                        const CPKIFAlgorithm * alg)
{
    CPKIFCryptoPPKeyMaterialPtr km(new CPKIFCryptoPPKeyMaterial(*theirCert));
    CPKIFBufferPtr rawKey = km->GetRawSPKI();
    return SecretAgree(myPrivateKey, ephemeralPublicKey, rawKey, alg);
}

IPKIFKeyAgreeContextPtr CPKIFCryptoPP::SecretAgree(
                                        const CPKIFCredentialPtr& myPrivateKey,
                                        const CPKIFBufferPtr& ephemeralPublicKey,
                                        const CPKIFBufferPtr& theirPublicKey,
                                        const CPKIFAlgorithm * alg)
{
    CPKIFOIDPtr kaOID = alg->OID();
    if(*kaOID != *g_ecmqv_sha1kdf) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ KeyAgreement() called with an unsupported algorithm",
            thisComponent,CRYPTO_ALG_NOT_SUPPORTED,this);
    }
    CPKIFCryptoPPCredentialPtr myCppCred = dynamic_pointer_cast<CPKIFCryptoPPCredential, CPKIFCredential>(myPrivateKey);
    if(!myCppCred) {
        RAISE_CRYPTO_EXCEPTION("Crypto++ Crypto colleague was given a non-Crypto++ credential",
            thisComponent,CRYPTO_UNRECOGNIZED_CREDENTIAL,this);
    }
    CryptoPP::ByteQueue privq;
    privq.Put(myCppCred->m_keyBuf->GetBuffer(),myCppCred->m_keyBuf->GetLength());
    CryptoPP::DL_PrivateKey_EC<CryptoPP::ECP> myPriv;
    myPriv.BERDecode(privq);
    CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> myPub;
    myPriv.MakePublicKey(myPub);
    
    CryptoPP::SecByteBlock epbb(ephemeralPublicKey->GetLength());
    memcpy(epbb, ephemeralPublicKey->GetBuffer(), ephemeralPublicKey->GetLength());

    // using a raw key instead. parameters will be taken from our static key
    

    CryptoPP::SecByteBlock myprivbb;
    GetPrivateExponent(myprivbb,myPriv);

    CryptoPP::SecByteBlock mypubbb;
    GetEncodedPublicKey(mypubbb,myPub);

    // XXX *** Allow either a full SubjectPublicKeyInfo structure or an integer to work
    CryptoPP::SecByteBlock theirPubInteger;
    CryptoPP::DL_PublicKey_EC<CryptoPP::ECP> theirPubTmp;
    CryptoPP::ByteQueue pubq;
    
    try {
        pubq.Put(theirPublicKey->GetBuffer(),theirPublicKey->GetLength());
        theirPubTmp.BERDecode(pubq);
        GetEncodedPublicKey(theirPubInteger,theirPubTmp);
    } catch(CryptoPP::Exception &) {
        theirPubInteger.New(theirPublicKey->GetLength());
        memcpy(theirPubInteger,theirPublicKey->GetBuffer(),theirPublicKey->GetLength());
    }

    CryptoPP::SecByteBlock myconcat;

    // Crypto++ MQV expects the ephemeral private key to have the public key material
    // tacked onto the end of the buffer
    myconcat.New(myprivbb.m_size+mypubbb.m_size);
    memcpy(myconcat,myprivbb,myprivbb.m_size);
    memcpy(myconcat+myprivbb.m_size,mypubbb,mypubbb.m_size);

    CryptoPP::ECMQV<CryptoPP::ECP>::Domain ecmqv(myPriv.GetGroupParameters());
    CPKIFCryptoPPKAContextPtr ctx(new CPKIFCryptoPPKAContext());
    ctx->SetOwner(this);
    ctx->SetAlgorithm(alg);
    CPKIFBufferPtr sharedSecret(new CPKIFBuffer());
    unsigned char* ss = sharedSecret->AllocateBuffer(ecmqv.AgreedValueLength());
    bool kaResult = ecmqv.Agree(ss,myprivbb,myconcat,theirPubInteger,epbb);

    if(!kaResult) {
        // if Agree() returned false, that generally indicates either a decoding failure or
        // incompatible domain parameters. As the explanation for PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT indicates,
        // in this code it will nearly always be incompatible domain parameters, since the encoding has had to
        // traverse so many pipes to even get here.
        RAISE_CRYPTO_EXCEPTION("Unable to complete key agreement operation", thisComponent, PKIF_CRYPTOPP_INVALID_KEY_AGREEMENT, this);
    }
    ctx->SetSecret(sharedSecret);
    return dynamic_pointer_cast<IPKIFKeyAgreeContext,CPKIFCryptoPPKAContext>(ctx);
}


CPKIFKeyMaterialPtr CPKIFCryptoPP::DeriveKey(
                                            const IPKIFKeyAgreeContextPtr & context,
                                            unsigned long keyLen
                                            )
{
    const CPKIFAlgorithm * kaAlg = context->GetAlgorithm();
    CPKIFOIDPtr kaOID = kaAlg->OID();
    if( *kaOID != *g_ecdh_std_sha256kdf &&
        *kaOID != *g_ecdh_std_sha384kdf )
    {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with an invalid algorithm",
            thisComponent,COMMON_INVALID_INPUT,this);
    }
    CPKIFCryptoPPKAContextPtr cppCtx = dynamic_pointer_cast<CPKIFCryptoPPKAContext,IPKIFKeyAgreeContext>(context);
    if(!cppCtx) {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with an invalid context",
            thisComponent,COMMON_INVALID_INPUT,this);
    }

    unsigned long digestSize = 0;
    try {
        digestSize = boost::numeric_cast<unsigned long,int>(kaAlg->DigestSize());
    }catch(...){
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with an invalid algorithm parameter",
            thisComponent,COMMON_INVALID_INPUT,this);
    }

    
    CPKIFBufferList appendedBuffers = context->GetAppendedSharedInfo();
    if(appendedBuffers.size() != 1) {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with invalid shared info input",
            thisComponent,COMMON_INVALID_INPUT,this);
    }
    CPKIFBufferList prependedBuffers = context->GetPrependedSharedInfo();
    if(prependedBuffers.size() != 0) {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with invalid shared info input",
            thisComponent,COMMON_INVALID_INPUT,this);
    }
    CPKIFBufferPtr sharedInfo = appendedBuffers[0];


    CACASNWRAPPER_CREATE(ECC_CMS_SharedInfo,ecsPDU);

    
    
    // if the caller did not specify a key length, attempt to pull it out of the sharedInfo structure
    if(0 == keyLen) {
        ECC_CMS_SharedInfo * ecsi = ecsPDU.Decode(sharedInfo->GetBuffer(),sharedInfo->GetLength());
        if(!ecsi) throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "keyLen is invalid and not in sharedInfo.");
        u_long nwKeySize32;
        if(ecsi->suppPubInfo.numocts > sizeof(u_long)) throw CPKIFException(TOOLKIT_CRYPTO, COMMON_INVALID_INPUT, "sharedInfo is invalid.");
        memcpy(&nwKeySize32,ecsi->suppPubInfo.data,ecsi->suppPubInfo.numocts);
        u_long keySize32 = ntohl(nwKeySize32);
        keyLen = keySize32;
    }
    
    if(keyLen > digestSize || keyLen <= 0) {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with invalid parameters",
            thisComponent,COMMON_INVALID_INPUT,this);
    }

    CryptoPP::HashTransformation * sha = 0;

    switch(kaAlg->HashAlg())
    {
    case PKIFCRYPTO::SHA256:
        sha = new CryptoPP::SHA256;
        break;
    case PKIFCRYPTO::SHA384:
        sha = new CryptoPP::SHA384;
        break;
    default:
        // throw below
        break;
    }

    boost::scoped_ptr<CryptoPP::HashTransformation> pSha(sha);
    if(!pSha) {
        RAISE_CRYPTO_EXCEPTION("CPKIFCryptoPP::DeriveKey() called with incompatible digest",
            thisComponent,COMMON_INVALID_INPUT,this);
    }
    
    // counter is constant for this
    unsigned char counter[4] = {0x00,0x00,0x00,0x01};
    CPKIFBufferPtr secret = cppCtx->GetSecret();
    pSha->Update(secret->GetBuffer(),secret->GetLength());
    pSha->Update(counter,4);
    pSha->Update(sharedInfo->GetBuffer(),sharedInfo->GetLength());
    unsigned int digestLen = sha->DigestSize();
    // SecByteBlock will zero itself in its dtor
    CryptoPP::SecByteBlock tmpKey;
    tmpKey.New(digestLen);
    pSha->Final(tmpKey);
    CPKIFCryptoPPKeyMaterialPtr cppKM(new CPKIFCryptoPPKeyMaterial());
    cppKM->SetKeyAlg(kaAlg);
    // copy the first keyLen bytes out
    cppKM->SetSymmetricKey(tmpKey,keyLen);
    return dynamic_pointer_cast<CPKIFKeyMaterial,CPKIFCryptoPPKeyMaterial>(cppKM);
}