/*

 * Copyright (c) 2001-2009 Nokia Corporation and/or its subsidiary(-ies).

 * All rights reserved.

 * This component and the accompanying materials are made available

 * under the terms of the License "Eclipse Public License v1.0"

 * which accompanies this distribution, and is available

 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

 *

 * Initial Contributors:

 * Nokia Corporation - initial contribution.

 *

 * Contributors:

 *

 * Description: 

 * General Security Definitions

 *

 */

 /**

  @file 

  @publishedAll

  @released

 */

 #ifndef __SECURITYDEFS_H__

 #define __SECURITYDEFS_H__

 #include <e32std.h>

 #include <e32base.h>

 #ifndef SYMBIAN_ENABLE_SPLIT_HEADERS

 #include <securitydefsconst.h>

 #endif

 /** General Security Definitions */

 // Old keystore interface, deprecated //////////////////////////////////////////

 /**

  * What a key can be used for.

  * The values this can take are defined in TKeyUsageVals.

  *

  * @deprecated

  */

 typedef TInt TKeyUsage;

 /**

  * What a key can be used for.

  *

  * These values can be ORed together if a key has several usages. EAllKeyUsages

  * is used when searching for all keys, rather than ones with a particular

  * usage.  As these can be combined, TKeyUsage is used to store them.

  *

  * @deprecated

  */

 enum TKeyUsageVals

 	{

     EDigitalSignature =  0x80000000,

     ENonRepudiation =  0x40000000,

     EKeyEncipherment =  0x20000000,

     EDataEncipherment =  0x10000000,

     EKeyAgreement =   0x08000000,

     EKeyCertSign =   0x04000000,

     ECRLSign =    0x02000000,

     EEncipherOnly =   0x01000000,

     EDecipherOnly =   0x00800000,

     EAllKeyUsages =   -1

 	};

 // End of deprecated keystore API //////////////////////////////////////////////

 /**

  * What a key can be used for - PKCS#15 scheme.

  *

  */

 enum TKeyUsagePKCS15

 	{

 	EPKCS15UsageEncrypt				= 0x001,

 	EPKCS15UsageDecrypt				= 0x002,

 	EPKCS15UsageSign				= 0x004,

 	EPKCS15UsageSignRecover			= 0x008,

 	EPKCS15UsageWrap				= 0x010,

 	EPKCS15UsageUnwrap				= 0x020,	

 	EPKCS15UsageVerify				= 0x040,

 	EPKCS15UsageVerifyRecover		= 0x080,

 	EPKCS15UsageDerive				= 0x100,

 	EPKCS15UsageNonRepudiation		= 0x200,

 	// Common combinations

 	EPKCS15UsageEncryptWrap         = 0x011,

 	EPKCS15UsageVerifyVerifyRecover = 0x0C0,

 	EPKCS15UsageDecryptUnwrap       = 0x022,

 	EPKCS15UsageSignSignRecover     = 0x00C,

 	EPKCS15UsageVerifyEncrypt       = 0x0D1,

 	EPKCS15UsageSignDecrypt         = 0x02E,

 	// For use in filters to return all keys

 	EPKCS15UsageAll					= 0xffffffff,

 	EPKCS15UsageNone				= 0x00000000

 	};

 inline TKeyUsagePKCS15 operator|(TKeyUsagePKCS15 aLeft, TKeyUsagePKCS15 aRight);

 inline TKeyUsagePKCS15 operator&(TKeyUsagePKCS15 aLeft, TKeyUsagePKCS15 aRight);

 inline const TKeyUsagePKCS15& operator|=(TKeyUsagePKCS15& aLeft, TKeyUsagePKCS15 aRight);

 inline const TKeyUsagePKCS15& operator&=(TKeyUsagePKCS15& aLeft, TKeyUsagePKCS15 aRight);

 /**

  * What a key can be used for - X.509 scheme.

  *

  */

 enum TKeyUsageX509

 	{

 	EX509UsageDigitalSignature		= 0x80000000,

 	EX509UsageNonRepudiation		= 0x40000000,

 	EX509UsageKeyEncipherment		= 0x20000000,

 	EX509UsageDataEncipherment		= 0x10000000,

 	EX509UsageKeyAgreement			= 0x08000000,

 	EX509UsageKeyCertSign			= 0x04000000,

 	EX509UsageCRLSign				= 0x02000000,

 	EX509UsageEncipherOnly			= 0x01000000,

 	EX509UsageDecipherOnly			= 0x00800000,

 	// Values for commonly permitted combinations

 	EX509UsageAnySign               = 0x86000000,

 	EX509UsageAllEncipher           = 0x30000000,

 	EX509UsageAllSignEncipher       = 0xB6000000,

 	/// For use in filters to return all keys

 	EX509UsageAll					= 0xffffffff,

 	EX509UsageNone					= 0x00000000

 	};

 inline TKeyUsageX509 operator|(TKeyUsageX509 aLeft, TKeyUsageX509 aRight);

 inline TKeyUsageX509 operator&(TKeyUsageX509 aLeft, TKeyUsageX509 aRight);

 inline const TKeyUsageX509& operator|=(TKeyUsageX509& aLeft, TKeyUsageX509 aRight);

 inline const TKeyUsageX509& operator&=(TKeyUsageX509& aLeft, TKeyUsageX509 aRight);

 /** 

  *

  *

  * @param aUsage

  * @return

  */

 IMPORT_C TKeyUsageX509 KeyUsagePKCS15ToX509(TKeyUsagePKCS15 aUsage);

 /** 

  *

  *

  * @param aUsage

  * @return

  */

 IMPORT_C TKeyUsagePKCS15 KeyUsageX509ToPKCS15Private(TKeyUsageX509 aUsage);

 /** 

  *

  *

  * @param aUsage

  * @return

  */

 IMPORT_C TKeyUsagePKCS15 KeyUsageX509ToPKCS15Public(TKeyUsageX509 aUsage);

 /**

  * Supported types of certificate format. Note these must be only 1 byte long as

  * the file cert store only seralises them as 1 byte.

  * 

  */

 enum TCertificateFormat

 	{

     EX509Certificate    = 0x00,

     EWTLSCertificate    = 0x01,

 	EX968Certificate    = 0x02,

 	EUnknownCertificate = 0x0f,

 	EX509CertificateUrl = 0x10,

 	EWTLSCertificateUrl = 0x11,

 	EX968CertificateUrl = 0x12

 	};

 /**

  * The owner of a certificate.

  * 

  */

 enum TCertificateOwnerType

 	{

 	ECACertificate,

 	EUserCertificate,

 	EPeerCertificate

 	};

 /** The length of a SHA-1 hash 

  * 

  */

 const TInt KSHA1HashLengthBytes = 20;

 /**

  * A SHA-1 hash.

  * 

  */

 typedef  TBuf8<KSHA1HashLengthBytes> TSHA1Hash;

 //const TInt KMD5HashLengthBytes = 16;

 //typedef TMD5Hash TBufC8<KMD5HashLengthBytes>;

 /**

  * A SHA-1 hash is also used as a key identifier.

  * 

  */

 typedef TSHA1Hash TKeyIdentifier;

 /**

  * Errors that can occur when validating a certificate chain.

  * 

  * Except EValidatedOK, all these are fatal errors unless specified.

  *

  */

 enum TValidationError

 	{

 	/** Validation OK */

 	EValidatedOK,

 	/** Certificate chain has no root */

 	EChainHasNoRoot,

 	/** Invalid signature  */

 	ESignatureInvalid,

 	/** Date out of range */

 	EDateOutOfRange,

 	/** Name is excluded */

 	ENameIsExcluded,

 	/** Name is not permitted */

 	ENameNotPermitted,	//subtle difference here!

 	/** Not a CA certificate */

 	ENotCACert,

 	/** Certificate revoked */

 	ECertificateRevoked,

 	/** Unrecognized critical extension */

 	EUnrecognizedCriticalExtension,

 	/** No basic constraint in CA certificate */

 	ENoBasicConstraintInCACert,

 	/** No acceptable policy */

 	ENoAcceptablePolicy,

 	/** Path too long */

 	EPathTooLong,

 	/** Negative path length specified */

 	ENegativePathLengthSpecified,

 	/** Names do not chain */

 	ENamesDontChain,

 	/** Required policy not found */

 	ERequiredPolicyNotFound,

 	/** Bad key usage */

 	EBadKeyUsage,

 	/** 

 	 * Root certificate not self-signed.

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ERootCertNotSelfSigned,

 	/** 

 	 * Critical extended key usage

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalExtendedKeyUsage,

 	/** 

 	 * Critical certificate policies with qualifiers

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalCertPoliciesWithQualifiers,

 	/** 

 	 * Critical policy mapping

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalPolicyMapping,

 	/** 

 	 * Critical Device Id

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalDeviceId,

 	/** 

 	 * Critical Sid

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalSid,

 	/** 

 	 * Critical Vid

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalVid,

 	/** 

 	 * Critical Capabilities

 	 * 

 	 * We cannot tell if this is fatal or not, as we lack the context.

 	 */

 	ECriticalCapabilities

 	};

 #include "securitydefs.inl"

 #endif