xref: /AOO41X/main/libxmlsec/xmlsec1-customkeymanage.patch (revision cdf0e10c4e3984b49a9502b011690b615761d4a3)

--- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.am	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.am	2009-09-21 14:02:48.563253008 +0200
@@ -3,6 +3,7 @@
 xmlsecmscryptoincdir = $(includedir)/xmlsec1/xmlsec/mscrypto

 xmlsecmscryptoinc_HEADERS = \
+akmngr.h \
 app.h \
 certkeys.h \
 crypto.h \
--- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.in	2009-06-25 22:53:30.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.in	2009-09-21 14:02:48.571021349 +0200
@@ -281,6 +281,7 @@
 NULL =
 xmlsecmscryptoincdir = $(includedir)/xmlsec1/xmlsec/mscrypto
 xmlsecmscryptoinc_HEADERS = \
+akmngr.h \
 app.h \
 certkeys.h \
 crypto.h \
--- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/akmngr.h	2009-09-21 14:07:19.052318336 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/akmngr.h	2009-09-21 14:02:48.504966762 +0200
@@ -1 +1,71 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright ..........................
+ */
+#ifndef __XMLSEC_MSCRYPTO_AKMNGR_H__
+#define __XMLSEC_MSCRYPTO_AKMNGR_H__
+
+#include <windows.h>
+#include <wincrypt.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/transforms.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+XMLSEC_CRYPTO_EXPORT xmlSecKeysMngrPtr
+xmlSecMSCryptoAppliedKeysMngrCreate(
+    HCERTSTORE keyStore ,
+    HCERTSTORE certStore
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrSymKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY	symKey
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrPubKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY	pubKey
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrPriKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY	priKey
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrAdoptKeyStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE keyStore
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrAdoptTrustedStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE trustedStore
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecMSCryptoAppliedKeysMngrAdoptUntrustedStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE untrustedStore
+) ;
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* __XMLSEC_MSCRYPTO_AKMNGR_H__ */
+
+
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.am	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.am	2009-09-21 14:02:48.577933031 +0200
@@ -10,6 +10,9 @@
 keysstore.h \
 pkikeys.h \
 x509.h \
+akmngr.h \
+tokens.h \
+ciphers.h \
 $(NULL)

 install-exec-hook:
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.in	2009-06-25 22:53:31.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.in	2009-09-21 14:02:48.585376325 +0200
@@ -288,6 +288,9 @@
 keysstore.h \
 pkikeys.h \
 x509.h \
+akmngr.h \
+tokens.h \
+ciphers.h \
 $(NULL)

 all: all-am
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/akmngr.h	2009-09-21 14:07:19.105517659 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/akmngr.h	2009-09-21 14:02:48.510978278 +0200
@@ -1 +1,56 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright ..........................
+ */
+#ifndef __XMLSEC_NSS_AKMNGR_H__
+#define __XMLSEC_NSS_AKMNGR_H__
+
+#include <nss.h>
+#include <nspr.h>
+#include <pk11func.h>
+#include <cert.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/transforms.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+XMLSEC_CRYPTO_EXPORT xmlSecKeysMngrPtr
+xmlSecNssAppliedKeysMngrCreate(
+    PK11SlotInfo** slots,
+	int cSlots,
+    CERTCertDBHandle* handler
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssAppliedKeysMngrSymKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	PK11SymKey*			symKey
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssAppliedKeysMngrPubKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	SECKEYPublicKey*	pubKey
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssAppliedKeysMngrPriKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	SECKEYPrivateKey*	priKey
+) ;
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* __XMLSEC_NSS_AKMNGR_H__ */
+
+
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/app.h	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/app.h	2009-09-21 14:02:48.612847068 +0200
@@ -22,6 +22,9 @@
 #include <xmlsec/keysmngr.h>
 #include <xmlsec/transforms.h>

+#include <xmlsec/nss/tokens.h>
+#include <xmlsec/nss/akmngr.h>
+
 /**
  * Init/shutdown
  */
@@ -36,6 +39,8 @@
 									    xmlSecKeyPtr key);
 XMLSEC_CRYPTO_EXPORT int 		xmlSecNssAppDefaultKeysMngrLoad	(xmlSecKeysMngrPtr mngr,
 									 const char* uri);
+XMLSEC_CRYPTO_EXPORT int		xmlSecNssAppDefaultKeysMngrAdoptKeySlot(xmlSecKeysMngrPtr mngr,
+									 xmlSecNssKeySlotPtr keySlot);
 XMLSEC_CRYPTO_EXPORT int 		xmlSecNssAppDefaultKeysMngrSave	(xmlSecKeysMngrPtr mngr,
 									 const char* filename,
 									 xmlSecKeyDataType type);
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/ciphers.h	2009-09-21 14:07:19.146496548 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/ciphers.h	2009-09-21 14:02:48.516689712 +0200
@@ -1 +1,35 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright ..........................
+ */
+#ifndef __XMLSEC_NSS_CIPHERS_H__
+#define __XMLSEC_NSS_CIPHERS_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/transforms.h>
+
+
+XMLSEC_CRYPTO_EXPORT int xmlSecNssSymKeyDataAdoptKey( xmlSecKeyDataPtr data,
+									PK11SymKey* symkey ) ;
+
+XMLSEC_CRYPTO_EXPORT xmlSecKeyDataPtr xmlSecNssSymKeyDataKeyAdopt( PK11SymKey* symKey ) ;
+
+XMLSEC_CRYPTO_EXPORT PK11SymKey*   xmlSecNssSymKeyDataGetKey(xmlSecKeyDataPtr data);
+
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* __XMLSEC_NSS_CIPHERS_H__ */
+
+
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/keysstore.h	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/keysstore.h	2009-09-21 14:02:48.626261748 +0200
@@ -16,6 +16,8 @@
 #endif /* __cplusplus */

 #include <xmlsec/xmlsec.h>
+#include <xmlsec/keysmngr.h>
+#include <xmlsec/nss/tokens.h>

 /****************************************************************************
  *
@@ -31,6 +33,8 @@
 XMLSEC_CRYPTO_EXPORT xmlSecKeyStoreId	xmlSecNssKeysStoreGetKlass	(void);
 XMLSEC_CRYPTO_EXPORT int		xmlSecNssKeysStoreAdoptKey	(xmlSecKeyStorePtr store,
 									 xmlSecKeyPtr key);
+XMLSEC_CRYPTO_EXPORT int		xmlSecNssKeysStoreAdoptKeySlot(xmlSecKeyStorePtr store,
+									 xmlSecNssKeySlotPtr keySlot);
 XMLSEC_CRYPTO_EXPORT int		xmlSecNssKeysStoreLoad 	(xmlSecKeyStorePtr store,
 								 const char *uri,
 								 xmlSecKeysMngrPtr keysMngr);
--- misc/xmlsec1-1.2.14/include/xmlsec/nss/tokens.h	2009-09-21 14:07:19.172421448 +0200
+++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/tokens.h	2009-09-21 14:02:48.522913605 +0200
@@ -1 +1,182 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright (c) 2003 Sun Microsystems, Inc.  All rights reserved.
+ *
+ * Contributor(s): _____________________________
+ *
+ */
+#ifndef __XMLSEC_NSS_TOKENS_H__
+#define __XMLSEC_NSS_TOKENS_H__
+
+#include <string.h>
+
+#include <nss.h>
+#include <pk11func.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/list.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+/**
+ * xmlSecNssKeySlotListId
+ *
+ * The crypto mechanism list klass
+ */
+#define xmlSecNssKeySlotListId xmlSecNssKeySlotListGetKlass()
+XMLSEC_CRYPTO_EXPORT xmlSecPtrListId xmlSecNssKeySlotListGetKlass( void ) ;
+
+/*******************************************
+ * KeySlot interfaces
+ *******************************************/
+/**
+ * Internal NSS key slot data
+ * @mechanismList:		the mechanisms that the slot bound with.
+ * @slot:				the pkcs slot
+ *
+ * This context is located after xmlSecPtrList
+ */
+typedef struct _xmlSecNssKeySlot	xmlSecNssKeySlot ;
+typedef struct _xmlSecNssKeySlot*	xmlSecNssKeySlotPtr ;
+
+struct _xmlSecNssKeySlot {
+	CK_MECHANISM_TYPE_PTR	mechanismList ; /* mech. array, NULL ternimated */
+	PK11SlotInfo*			slot ;
+} ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotSetMechList(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE_PTR mechanismList
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotEnableMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE mechanism
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotDisableMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE mechanism
+) ;
+
+XMLSEC_CRYPTO_EXPORT CK_MECHANISM_TYPE_PTR
+xmlSecNssKeySlotGetMechList(
+    xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotSetSlot(
+    xmlSecNssKeySlotPtr keySlot ,
+	PK11SlotInfo* slot
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotInitialize(
+    xmlSecNssKeySlotPtr keySlot ,
+	PK11SlotInfo* slot
+) ;
+
+XMLSEC_CRYPTO_EXPORT void
+xmlSecNssKeySlotFinalize(
+    xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT PK11SlotInfo*
+xmlSecNssKeySlotGetSlot(
+	xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT xmlSecNssKeySlotPtr
+xmlSecNssKeySlotCreate() ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotCopy(
+	xmlSecNssKeySlotPtr newKeySlot ,
+	xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT xmlSecNssKeySlotPtr
+xmlSecNssKeySlotDuplicate(
+	xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT void
+xmlSecNssKeySlotDestroy(
+	    xmlSecNssKeySlotPtr keySlot
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotBindMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE type
+) ;
+
+XMLSEC_CRYPTO_EXPORT int
+xmlSecNssKeySlotSupportMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE type
+) ;
+
+
+/************************************************************************
+ * PKCS#11 crypto token interfaces
+ *
+ * A PKCS#11 slot repository will be defined internally. From the
+ * repository, a user can specify a particular slot for a certain crypto
+ * mechanism.
+ *
+ * In some situation, some cryptographic operation should act in a user
+ * designated devices. The interfaces defined here provide the way. If
+ * the user do not initialize the repository distinctly, the interfaces
+ * use the default functions provided by NSS itself.
+ *
+ ************************************************************************/
+/**
+ * Initialize NSS pkcs#11 slot repository
+ *
+ * Returns 0 if success or -1 if an error occurs.
+ */
+XMLSEC_CRYPTO_EXPORT int xmlSecNssSlotInitialize( void ) ;
+
+/**
+ * Shutdown and destroy NSS pkcs#11 slot repository
+ */
+XMLSEC_CRYPTO_EXPORT void xmlSecNssSlotShutdown() ;
+
+/**
+ * Get PKCS#11 slot handler
+ * @type	the mechanism that the slot must support.
+ *
+ * Returns a pointer to PKCS#11 slot or NULL if an error occurs.
+ *
+ * Notes: The returned handler must be destroied distinctly.
+ */
+XMLSEC_CRYPTO_EXPORT PK11SlotInfo* xmlSecNssSlotGet( CK_MECHANISM_TYPE type ) ;
+
+/**
+ * Adopt a pkcs#11 slot with a mechanism into the repository
+ * @slot:	the pkcs#11 slot.
+ * @mech:	the mechanism.
+ *
+ * If @mech is available( @mech != CKM_INVALID_MECHANISM ), every operation with
+ * this mechanism only can perform on the @slot.
+ *
+ * Returns 0 if success or -1 if an error occurs.
+ */
+XMLSEC_CRYPTO_EXPORT int xmlSecNssSlotAdopt( PK11SlotInfo* slot, CK_MECHANISM_TYPE mech ) ;
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif	/* __XMLSEC_NSS_TOKENS_H__ */
+
--- misc/xmlsec1-1.2.14/src/mscrypto/akmngr.c	2009-09-21 14:07:19.078910929 +0200
+++ misc/build/xmlsec1-1.2.14/src/mscrypto/akmngr.c	2009-09-21 14:02:48.531281225 +0200
@@ -1 +1,236 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright.........................
+ */
+#include "globals.h"
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/keysmngr.h>
+#include <xmlsec/transforms.h>
+#include <xmlsec/errors.h>
+
+#include <xmlsec/mscrypto/crypto.h>
+#include <xmlsec/mscrypto/keysstore.h>
+#include <xmlsec/mscrypto/akmngr.h>
+#include <xmlsec/mscrypto/x509.h>
+
+/**
+ * xmlSecMSCryptoAppliedKeysMngrCreate:
+ * @hKeyStore:		the pointer to key store.
+ * @hCertStore:		the pointer to certificate database.
+ *
+ * Create and load key store and certificate database into keys manager
+ *
+ * Returns keys manager pointer on success or NULL otherwise.
+ */
+xmlSecKeysMngrPtr
+xmlSecMSCryptoAppliedKeysMngrCreate(
+    HCERTSTORE hKeyStore ,
+    HCERTSTORE hCertStore
+) {
+	xmlSecKeyDataStorePtr	certStore = NULL ;
+	xmlSecKeysMngrPtr		keyMngr = NULL ;
+	xmlSecKeyStorePtr		keyStore = NULL ;
+
+	keyStore = xmlSecKeyStoreCreate( xmlSecMSCryptoKeysStoreId ) ;
+	if( keyStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeyStoreCreate" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * At present, MS Crypto engine do not provide a way to setup a key store.
+	 */
+	if( keyStore != NULL ) {
+		/*TODO: binding key store.*/
+	}
+
+	keyMngr = xmlSecKeysMngrCreate() ;
+	if( keyMngr == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrCreate" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeyStoreDestroy( keyStore ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Add key store to manager, from now on keys manager destroys the store if
+	 * needed
+	 */
+	if( xmlSecKeysMngrAdoptKeysStore( keyMngr, keyStore ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+			"xmlSecKeysMngrAdoptKeyStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeyStoreDestroy( keyStore ) ;
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Initialize crypto library specific data in keys manager
+	 */
+	if( xmlSecMSCryptoKeysMngrInit( keyMngr ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecMSCryptoKeysMngrInit" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Set certificate databse to X509 key data store
+	 */
+	/*-
+	 * At present, MS Crypto engine do not provide a way to setup a cert store.
+	 */
+
+	/*-
+	 * Set the getKey callback
+	 */
+	keyMngr->getKey = xmlSecKeysMngrGetKey ;
+
+	return keyMngr ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrSymKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY			symKey
+) {
+	/*TODO: import the key into keys manager.*/
+	return(0) ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrPubKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY	pubKey
+) {
+	/*TODO: import the key into keys manager.*/
+	return(0) ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrPriKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	HCRYPTKEY	priKey
+) {
+	/*TODO: import the key into keys manager.*/
+	return(0) ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrAdoptKeyStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE keyStore
+) {
+	xmlSecKeyDataStorePtr x509Store ;
+
+	xmlSecAssert2( mngr != NULL, -1 ) ;
+	xmlSecAssert2( keyStore != NULL, -1 ) ;
+
+    x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ;
+	if( x509Store == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetDataStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	if( xmlSecMSCryptoX509StoreAdoptKeyStore( x509Store, keyStore ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) ,
+			"xmlSecMSCryptoX509StoreAdoptKeyStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	return( 0 ) ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrAdoptTrustedStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE trustedStore
+) {
+	xmlSecKeyDataStorePtr x509Store ;
+
+	xmlSecAssert2( mngr != NULL, -1 ) ;
+	xmlSecAssert2( trustedStore != NULL, -1 ) ;
+
+    x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ;
+	if( x509Store == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetDataStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	if( xmlSecMSCryptoX509StoreAdoptTrustedStore( x509Store, trustedStore ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) ,
+			"xmlSecMSCryptoX509StoreAdoptKeyStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	return( 0 ) ;
+}
+
+int
+xmlSecMSCryptoAppliedKeysMngrAdoptUntrustedStore (
+	xmlSecKeysMngrPtr	mngr ,
+	HCERTSTORE untrustedStore
+) {
+	xmlSecKeyDataStorePtr x509Store ;
+
+	xmlSecAssert2( mngr != NULL, -1 ) ;
+	xmlSecAssert2( untrustedStore != NULL, -1 ) ;
+
+    x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ;
+	if( x509Store == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetDataStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	if( xmlSecMSCryptoX509StoreAdoptUntrustedStore( x509Store, untrustedStore ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) ,
+			"xmlSecMSCryptoX509StoreAdoptKeyStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 ) ;
+	}
+
+	return( 0 ) ;
+}
+
--- misc/xmlsec1-1.2.14/src/nss/Makefile.am	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/Makefile.am	2009-09-21 14:02:48.591560472 +0200
@@ -35,6 +35,9 @@
 	kw_des.c \
 	kw_aes.c \
 	globals.h \
+	akmngr.c \
+	keywrapers.c \
+	tokens.c \
 	$(NULL)

 if SHAREDLIB_HACK
--- misc/xmlsec1-1.2.14/src/nss/Makefile.in	2009-06-25 22:53:33.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/Makefile.in	2009-09-21 14:02:48.599339718 +0200
@@ -72,7 +72,8 @@
 am__libxmlsec1_nss_la_SOURCES_DIST = app.c bignum.c ciphers.c crypto.c \
 	digests.c hmac.c pkikeys.c signatures.c symkeys.c x509.c \
 	x509vfy.c keysstore.c keytrans.c kw_des.c kw_aes.c globals.h \
-	../strings.c
+	../strings.c \
+	akmngr.c keywrapers.c tokens.c
 am__objects_1 =
 @SHAREDLIB_HACK_TRUE@am__objects_2 = libxmlsec1_nss_la-strings.lo
 am_libxmlsec1_nss_la_OBJECTS = libxmlsec1_nss_la-app.lo \
@@ -83,6 +84,8 @@
 	libxmlsec1_nss_la-x509.lo libxmlsec1_nss_la-x509vfy.lo \
 	libxmlsec1_nss_la-keysstore.lo libxmlsec1_nss_la-keytrans.lo \
 	libxmlsec1_nss_la-kw_des.lo libxmlsec1_nss_la-kw_aes.lo \
+	libxmlsec1_nss_la-akmngr.lo libxmlsec1_nss_la-keywrapers.lo \
+	libxmlsec1_nss_la-tokens.lo \
 	$(am__objects_1) $(am__objects_2)
 libxmlsec1_nss_la_OBJECTS = $(am_libxmlsec1_nss_la_OBJECTS)
 libxmlsec1_nss_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
@@ -333,6 +336,7 @@
 libxmlsec1_nss_la_SOURCES = app.c bignum.c ciphers.c crypto.c \
 	digests.c hmac.c pkikeys.c signatures.c symkeys.c x509.c \
 	x509vfy.c keysstore.c keytrans.c kw_des.c kw_aes.c globals.h \
+	akmngr.c keywrapers.c tokens.c \
 	$(NULL) $(am__append_1)
 libxmlsec1_nss_la_LIBADD = \
 	../libxmlsec1.la \
@@ -439,6 +443,9 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-symkeys.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509vfy.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-akmngr.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-tokens.Plo@am__quote@

 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -468,6 +475,27 @@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-app.lo `test -f 'app.c' || echo '$(srcdir)/'`app.c

+libxmlsec1_nss_la-akmngr.lo: akmngr.c
+@am__fastdepCC_TRUE@	if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-akmngr.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo" -c -o libxmlsec1_nss_la-akmngr.lo `test -f 'akmngr.c' || echo '$(srcdir)/'`akmngr.c; \
+@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo"; exit 1; fi
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='akmngr.c' object='libxmlsec1_nss_la-akmngr.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-akmngr.lo `test -f 'akmngr.c' || echo '$(srcdir)/'`akmngr.c
+
+libxmlsec1_nss_la-keywrapers.lo: keywrapers.c
+@am__fastdepCC_TRUE@	if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-keywrapers.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo" -c -o libxmlsec1_nss_la-keywrapers.lo `test -f 'keywrapers.c' || echo '$(srcdir)/'`keywrapers.c; \
+@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo"; exit 1; fi
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='keywrapers.c' object='libxmlsec1_nss_la-keywrapers.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-keywrapers.lo `test -f 'keywrapers.c' || echo '$(srcdir)/'`keywrapers.c
+
+libxmlsec1_nss_la-tokens.lo: tokens.c
+@am__fastdepCC_TRUE@	if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-tokens.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo" -c -o libxmlsec1_nss_la-tokens.lo `test -f 'tokens.c' || echo '$(srcdir)/'`tokens.c; \
+@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-tokens.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo"; exit 1; fi
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='tokens.c' object='libxmlsec1_nss_la-tokens.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-tokens.lo `test -f 'tokens.c' || echo '$(srcdir)/'`tokens.c
+
 libxmlsec1_nss_la-bignum.lo: bignum.c
 @am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-bignum.lo -MD -MP -MF $(DEPDIR)/libxmlsec1_nss_la-bignum.Tpo -c -o libxmlsec1_nss_la-bignum.lo `test -f 'bignum.c' || echo '$(srcdir)/'`bignum.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/libxmlsec1_nss_la-bignum.Tpo $(DEPDIR)/libxmlsec1_nss_la-bignum.Plo
--- misc/xmlsec1-1.2.14/src/nss/akmngr.c	2009-09-21 14:07:19.197249962 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/akmngr.c	2009-09-21 14:02:48.539616129 +0200
@@ -1 +1,384 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright.........................
+ */
+#include "globals.h"
+
+#include <nspr.h>
+#include <nss.h>
+#include <pk11func.h>
+#include <cert.h>
+#include <keyhi.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/transforms.h>
+#include <xmlsec/errors.h>
+
+#include <xmlsec/nss/crypto.h>
+#include <xmlsec/nss/tokens.h>
+#include <xmlsec/nss/akmngr.h>
+#include <xmlsec/nss/pkikeys.h>
+#include <xmlsec/nss/ciphers.h>
+#include <xmlsec/nss/keysstore.h>
+
+/**
+ * xmlSecNssAppliedKeysMngrCreate:
+ * @slot:			array of pointers to NSS PKCS#11 slot infomation.
+ * @cSlots:			number of slots in the array
+ * @handler:		the pointer to NSS certificate database.
+ *
+ * Create and load NSS crypto slot and certificate database into keys manager
+ *
+ * Returns keys manager pointer on success or NULL otherwise.
+ */
+xmlSecKeysMngrPtr
+xmlSecNssAppliedKeysMngrCreate(
+	PK11SlotInfo** slots,
+	int cSlots,
+	CERTCertDBHandle* handler
+) {
+	xmlSecKeyDataStorePtr	certStore = NULL ;
+	xmlSecKeysMngrPtr		keyMngr = NULL ;
+	xmlSecKeyStorePtr		keyStore = NULL ;
+	int islot = 0;
+	keyStore = xmlSecKeyStoreCreate( xmlSecNssKeysStoreId ) ;
+	if( keyStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeyStoreCreate" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return NULL ;
+	}
+
+	for (islot = 0; islot < cSlots; islot++)
+	{
+		xmlSecNssKeySlotPtr		keySlot ;
+
+		/* Create a key slot */
+		keySlot = xmlSecNssKeySlotCreate() ;
+		if( keySlot == NULL ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+				"xmlSecNssKeySlotCreate" ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+			xmlSecKeyStoreDestroy( keyStore ) ;
+			return NULL ;
+		}
+
+		/* Set slot */
+		if( xmlSecNssKeySlotSetSlot( keySlot , slots[islot] ) < 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+				"xmlSecNssKeySlotSetSlot" ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+			xmlSecKeyStoreDestroy( keyStore ) ;
+			xmlSecNssKeySlotDestroy( keySlot ) ;
+			return NULL ;
+		}
+
+		/* Adopt keySlot */
+		if( xmlSecNssKeysStoreAdoptKeySlot( keyStore , keySlot ) < 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+				"xmlSecNssKeysStoreAdoptKeySlot" ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+			xmlSecKeyStoreDestroy( keyStore ) ;
+			xmlSecNssKeySlotDestroy( keySlot ) ;
+			return NULL ;
+		}
+	}
+
+	keyMngr = xmlSecKeysMngrCreate() ;
+	if( keyMngr == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrCreate" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeyStoreDestroy( keyStore ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Add key store to manager, from now on keys manager destroys the store if
+	 * needed
+	 */
+	if( xmlSecKeysMngrAdoptKeysStore( keyMngr, keyStore ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+			"xmlSecKeysMngrAdoptKeyStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeyStoreDestroy( keyStore ) ;
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Initialize crypto library specific data in keys manager
+	 */
+	if( xmlSecNssKeysMngrInit( keyMngr ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrCreate" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+
+	/*-
+	 * Set certificate databse to X509 key data store
+	 */
+	/**
+	 * Because Tej's implementation of certDB use the default DB, so I ignore
+	 * the certDB handler at present. I'll modify the cert store sources to
+	 * accept particular certDB instead of default ones.
+	certStore = xmlSecKeysMngrGetDataStore( keyMngr , xmlSecNssKeyDataStoreX509Id ) ;
+	if( certStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+			"xmlSecKeysMngrGetDataStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+
+	if( xmlSecNssKeyDataStoreX509SetCertDb( certStore , handler ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) ,
+			"xmlSecNssKeyDataStoreX509SetCertDb" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+		xmlSecKeysMngrDestroy( keyMngr ) ;
+		return NULL ;
+	}
+	*/
+
+	/*-
+	 * Set the getKey callback
+	 */
+	keyMngr->getKey = xmlSecKeysMngrGetKey ;
+
+	return keyMngr ;
+}
+
+int
+xmlSecNssAppliedKeysMngrSymKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	PK11SymKey*			symKey
+) {
+	xmlSecKeyPtr		key ;
+	xmlSecKeyDataPtr	data ;
+	xmlSecKeyStorePtr	keyStore ;
+
+	xmlSecAssert2( mngr != NULL , -1 ) ;
+	xmlSecAssert2( symKey != NULL , -1 ) ;
+
+	keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ;
+	if( keyStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetKeysStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+	xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ;
+
+	data = xmlSecNssSymKeyDataKeyAdopt( symKey ) ;
+	if( data == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+
+	key = xmlSecKeyCreate() ;
+	if( key == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecKeySetValue( key , data ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDestroy( key ) ;
+		return(-1) ;
+	}
+
+	return(0) ;
+}
+
+int
+xmlSecNssAppliedKeysMngrPubKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	SECKEYPublicKey*	pubKey
+) {
+	xmlSecKeyPtr		key ;
+	xmlSecKeyDataPtr	data ;
+	xmlSecKeyStorePtr	keyStore ;
+
+	xmlSecAssert2( mngr != NULL , -1 ) ;
+	xmlSecAssert2( pubKey != NULL , -1 ) ;
+
+	keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ;
+	if( keyStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetKeysStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+	xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ;
+
+	data = xmlSecNssPKIAdoptKey( NULL, pubKey ) ;
+	if( data == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssPKIAdoptKey" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+
+	key = xmlSecKeyCreate() ;
+	if( key == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecKeySetValue( key , data ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDestroy( key ) ;
+		return(-1) ;
+	}
+
+	return(0) ;
+}
+
+int
+xmlSecNssAppliedKeysMngrPriKeyLoad(
+	xmlSecKeysMngrPtr	mngr ,
+	SECKEYPrivateKey*	priKey
+) {
+	xmlSecKeyPtr		key ;
+	xmlSecKeyDataPtr	data ;
+	xmlSecKeyStorePtr	keyStore ;
+
+	xmlSecAssert2( mngr != NULL , -1 ) ;
+	xmlSecAssert2( priKey != NULL , -1 ) ;
+
+	keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ;
+	if( keyStore == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecKeysMngrGetKeysStore" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+	xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ;
+
+	data = xmlSecNssPKIAdoptKey( priKey, NULL ) ;
+	if( data == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssPKIAdoptKey" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1) ;
+	}
+
+	key = xmlSecKeyCreate() ;
+	if( key == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecKeySetValue( key , data ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDataDestroy( data ) ;
+		return(-1) ;
+	}
+
+	if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecNssSymKeyDataKeyAdopt" ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecKeyDestroy( key ) ;
+		return(-1) ;
+	}
+
+	return(0) ;
+}
+
--- misc/xmlsec1-1.2.14/src/nss/hmac.c	2009-06-26 06:18:13.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/hmac.c	2009-09-21 14:02:48.649065288 +0200
@@ -23,8 +23,8 @@
 #include <xmlsec/transforms.h>
 #include <xmlsec/errors.h>

-#include <xmlsec/nss/app.h>
 #include <xmlsec/nss/crypto.h>
+#include <xmlsec/nss/tokens.h>

 /* sizes in bits */
 #define XMLSEC_NSS_MIN_HMAC_SIZE		80
@@ -286,13 +286,13 @@
     keyItem.data = xmlSecBufferGetData(buffer);
     keyItem.len  = xmlSecBufferGetSize(buffer);

-    slot = PK11_GetBestSlot(ctx->digestType, NULL);
+    slot = xmlSecNssSlotGet(ctx->digestType);
     if(slot == NULL) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
-		    "PK11_GetBestSlot",
+		    "xmlSecNssSlotGet",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
+		    "error code=%d", PORT_GetError());
 	return(-1);
     }

--- misc/xmlsec1-1.2.14/src/nss/keysstore.c	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/keysstore.c	2009-09-21 14:02:48.633533885 +0200
@@ -1,36 +1,56 @@
 /**
  * XMLSec library
  *
- * Nss keys store that uses Simple Keys Store under the hood. Uses the
- * Nss DB as a backing store for the finding keys, but the NSS DB is
- * not written to by the keys store.
- * So, if store->findkey is done and the key is not found in the simple
- * keys store, the NSS DB is looked up.
- * If store is called to adopt a key, that key is not written to the NSS
- * DB.
- * Thus, the NSS DB can be used to pre-load keys and becomes an alternate
- * source of keys for xmlsec
- *
  * This is free software; see Copyright file in the source
  * distribution for precise wording.
  *
  * Copyright (c) 2003 America Online, Inc.  All rights reserved.
  */
+
+/**
+ * NSS key store uses a key list and a slot list as the key repository. NSS slot
+ * list is a backup repository for the finding keys. If a key is not found from
+ * the key list, the NSS slot list is looked up.
+ *
+ * Any key in the key list will not save to pkcs11 slot. When a store to called
+ * to adopt a key, the key is resident in the key list; While a store to called
+ * to set a is resident in the key list; While a store to called to set a slot
+ * list, which means that the keys in the listed slot can be used for xml sign-
+ * nature or encryption.
+ *
+ * Then, a user can adjust slot list to effect the crypto behaviors of xmlSec.
+ *
+ * The framework will decrease the user interfaces to administrate xmlSec crypto
+ * engine. He can only focus on NSS layer functions. For examples, after the
+ * user set up a slot list handler to the keys store, he do not need to do any
+ * other work atop xmlSec interfaces, his action on the slot list handler, such
+ * as add a token to, delete a token from the list, will directly effect the key
+ * store behaviors.
+ *
+ * For example, a scenariio:
+ * 0. Create a slot list;( NSS interfaces )
+ * 1. Create a keys store;( xmlSec interfaces )
+ * 2. Set slot list with the keys store;( xmlSec Interfaces )
+ * 3. Add a slot to the slot list;( NSS interfaces )
+ * 4. Perform xml signature; ( xmlSec Interfaces )
+ * 5. Deleter a slot from the slot list;( NSS interfaces )
+ * 6. Perform xml encryption; ( xmlSec Interfaces )
+ * 7. Perform xml signature;( xmlSec Interfaces )
+ * 8. Destroy the keys store;( xmlSec Interfaces )
+ * 8. Destroy the slot list.( NSS Interfaces )
+ */
 #include "globals.h"

 #include <stdlib.h>
 #include <string.h>

 #include <nss.h>
-#include <cert.h>
 #include <pk11func.h>
+#include <prinit.h>
 #include <keyhi.h>

-#include <libxml/tree.h>
-
 #include <xmlsec/xmlsec.h>
-#include <xmlsec/buffer.h>
-#include <xmlsec/base64.h>
+#include <xmlsec/keys.h>
 #include <xmlsec/errors.h>
 #include <xmlsec/xmltree.h>

@@ -38,82 +58,461 @@

 #include <xmlsec/nss/crypto.h>
 #include <xmlsec/nss/keysstore.h>
-#include <xmlsec/nss/x509.h>
+#include <xmlsec/nss/tokens.h>
+#include <xmlsec/nss/ciphers.h>
 #include <xmlsec/nss/pkikeys.h>

 /****************************************************************************
  *
- * Nss Keys Store. Uses Simple Keys Store under the hood
+ * Internal NSS key store context
  *
- * Simple Keys Store ptr is located after xmlSecKeyStore
+ * This context is located after xmlSecKeyStore
  *
  ***************************************************************************/
+typedef struct _xmlSecNssKeysStoreCtx  xmlSecNssKeysStoreCtx ;
+typedef struct _xmlSecNssKeysStoreCtx* xmlSecNssKeysStoreCtxPtr ;
+
+struct _xmlSecNssKeysStoreCtx {
+       xmlSecPtrListPtr                keyList ;
+       xmlSecPtrListPtr                slotList ;
+} ;
+
 #define xmlSecNssKeysStoreSize \
-	(sizeof(xmlSecKeyStore) + sizeof(xmlSecKeyStorePtr))
+	( sizeof( xmlSecKeyStore ) + sizeof( xmlSecNssKeysStoreCtx ) )

-#define xmlSecNssKeysStoreGetSS(store) \
-    ((xmlSecKeyStoreCheckSize((store), xmlSecNssKeysStoreSize)) ? \
-     (xmlSecKeyStorePtr*)(((xmlSecByte*)(store)) + sizeof(xmlSecKeyStore)) : \
-     (xmlSecKeyStorePtr*)NULL)
-
-static int			xmlSecNssKeysStoreInitialize	(xmlSecKeyStorePtr store);
-static void			xmlSecNssKeysStoreFinalize	(xmlSecKeyStorePtr store);
-static xmlSecKeyPtr 		xmlSecNssKeysStoreFindKey	(xmlSecKeyStorePtr store,
-								 const xmlChar* name,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
+#define xmlSecNssKeysStoreGetCtx( data ) \
+       ( ( xmlSecNssKeysStoreCtxPtr )( ( ( xmlSecByte* )( data ) ) + sizeof( xmlSecKeyStore ) ) )

-static xmlSecKeyStoreKlass xmlSecNssKeysStoreKlass = {
-    sizeof(xmlSecKeyStoreKlass),
-    xmlSecNssKeysStoreSize,
+int xmlSecNssKeysStoreAdoptKeySlot(
+       xmlSecKeyStorePtr               store ,
+       xmlSecNssKeySlotPtr             keySlot
+) {
+       xmlSecNssKeysStoreCtxPtr context = NULL ;
+
+       xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ;
+       xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ;
+       context = xmlSecNssKeysStoreGetCtx( store ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecNssKeysStoreGetCtx" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( context->slotList == NULL ) {
+               if( ( context->slotList = xmlSecPtrListCreate( xmlSecNssKeySlotListId ) ) == NULL ) {
+                       xmlSecError( XMLSEC_ERRORS_HERE ,
+                               xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                               "xmlSecPtrListCreate" ,
+                               XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+                       return -1 ;
+               }
+       }
+
+       if( !xmlSecPtrListCheckId( context->slotList , xmlSecNssKeySlotListId ) ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecPtrListCheckId" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( xmlSecPtrListAdd( context->slotList , keySlot ) < 0 ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecPtrListAdd" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+       return 0 ;
+}

-    /* data */
-    BAD_CAST "NSS-keys-store",		/* const xmlChar* name; */
-
-    /* constructors/destructor */
-    xmlSecNssKeysStoreInitialize,	/* xmlSecKeyStoreInitializeMethod initialize; */
-    xmlSecNssKeysStoreFinalize,		/* xmlSecKeyStoreFinalizeMethod finalize; */
-    xmlSecNssKeysStoreFindKey,		/* xmlSecKeyStoreFindKeyMethod findKey; */
-
-    /* reserved for the future */
-    NULL,				/* void* reserved0; */
-    NULL,				/* void* reserved1; */
-};
+int xmlSecNssKeysStoreAdoptKey(
+       xmlSecKeyStorePtr       store ,
+       xmlSecKeyPtr            key
+) {
+       xmlSecNssKeysStoreCtxPtr context = NULL ;
+
+       xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ;
+       xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ;
+
+       context = xmlSecNssKeysStoreGetCtx( store ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecNssKeysStoreGetCtx" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( context->keyList == NULL ) {
+               if( ( context->keyList = xmlSecPtrListCreate( xmlSecKeyPtrListId ) ) == NULL ) {
+                       xmlSecError( XMLSEC_ERRORS_HERE ,
+                               xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                               "xmlSecPtrListCreate" ,
+                               XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+                       return -1 ;
+               }
+       }
+
+       if( !xmlSecPtrListCheckId( context->keyList , xmlSecKeyPtrListId ) ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecPtrListCheckId" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( xmlSecPtrListAdd( context->keyList , key ) < 0 ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecPtrListAdd" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }

-/**
- * xmlSecNssKeysStoreGetKlass:
- *
- * The Nss list based keys store klass.
+       return 0 ;
+}
+
+/*
+ * xmlSecKeyStoreInitializeMethod:
+ * @store:             the store.
+ *
+ * Keys store specific initialization method.
  *
- * Returns: Nss list based keys store klass.
+ * Returns 0 on success or a negative value if an error occurs.
  */
-xmlSecKeyStoreId
-xmlSecNssKeysStoreGetKlass(void) {
-    return(&xmlSecNssKeysStoreKlass);
+static int
+xmlSecNssKeysStoreInitialize(
+       xmlSecKeyStorePtr store
+) {
+       xmlSecNssKeysStoreCtxPtr context = NULL ;
+
+       xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ;
+       xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ;
+
+       context = xmlSecNssKeysStoreGetCtx( store ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecNssKeysStoreGetCtx" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       context->keyList = NULL ;
+       context->slotList = NULL ;
+
+       return 0 ;
 }

 /**
- * xmlSecNssKeysStoreAdoptKey:
- * @store:		the pointer to Nss keys store.
- * @key:		the pointer to key.
- *
- * Adds @key to the @store.
  *
- * Returns: 0 on success or a negative value if an error occurs.
+ * xmlSecKeyStoreFinalizeMethod:
+ * @store:             the store.
+ *
+ * Keys store specific finalization (destroy) method.
  */
-int
-xmlSecNssKeysStoreAdoptKey(xmlSecKeyStorePtr store, xmlSecKeyPtr key) {
-    xmlSecKeyStorePtr *ss;
-
-    xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1);
-    xmlSecAssert2((key != NULL), -1);
+void
+xmlSecNssKeysStoreFinalize(
+       xmlSecKeyStorePtr store
+) {
+       xmlSecNssKeysStoreCtxPtr context = NULL ;
+
+       xmlSecAssert( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) ) ;
+       xmlSecAssert( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) ) ;
+
+       context = xmlSecNssKeysStoreGetCtx( store ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                       "xmlSecNssKeysStoreGetCtx" ,
+                       XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return ;
+       }
+
+       if( context->keyList != NULL ) {
+               xmlSecPtrListDestroy( context->keyList ) ;
+               context->keyList = NULL ;
+       }
+
+       if( context->slotList != NULL ) {
+               xmlSecPtrListDestroy( context->slotList ) ;
+               context->slotList = NULL ;
+       }
+}
+
+xmlSecKeyPtr
+xmlSecNssKeysStoreFindKeyFromSlot(
+       PK11SlotInfo* slot,
+       const xmlChar* name,
+       xmlSecKeyInfoCtxPtr keyInfoCtx
+) {
+       xmlSecKeyPtr            key = NULL ;
+       xmlSecKeyDataPtr        data = NULL ;
+       int                                     length ;
+
+       xmlSecAssert2( slot != NULL , NULL ) ;
+       xmlSecAssert2( name != NULL , NULL ) ;
+       xmlSecAssert2( keyInfoCtx != NULL , NULL ) ;
+
+       if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypeSymmetric ) == xmlSecKeyDataTypeSymmetric ) {
+               PK11SymKey*                     symKey ;
+               PK11SymKey*                     curKey ;
+
+               /* Find symmetric key from the slot by name */
+               symKey = PK11_ListFixedKeysInSlot( slot , ( char* )name , NULL ) ;
+               for( curKey = symKey ; curKey != NULL ; curKey = PK11_GetNextSymKey( curKey ) ) {
+                       /* Check the key request */
+                       length = PK11_GetKeyLength( curKey ) ;
+                       length *= 8 ;
+                       if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) &&
+                               ( length > 0 ) &&
+                               ( length < keyInfoCtx->keyReq.keyBitsSize ) )
+                               continue ;
+
+                       /* We find a eligible key */
+                       data = xmlSecNssSymKeyDataKeyAdopt( curKey ) ;
+                       if( data == NULL ) {
+                               /* Do nothing */
+                       }
+                       break ;
+               }
+
+               /* Destroy the sym key list */
+               for( curKey = symKey ; curKey != NULL ; ) {
+                       symKey = curKey ;
+                       curKey = PK11_GetNextSymKey( symKey ) ;
+                       PK11_FreeSymKey( symKey ) ;
+               }
+       } else if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePublic ) == xmlSecKeyDataTypePublic ) {
+               SECKEYPublicKeyList*            pubKeyList ;
+               SECKEYPublicKey*                        pubKey ;
+               SECKEYPublicKeyListNode*        curPub ;
+
+               /* Find asymmetric key from the slot by name */
+               pubKeyList = PK11_ListPublicKeysInSlot( slot , ( char* )name ) ;
+               pubKey = NULL ;
+               curPub = PUBKEY_LIST_HEAD(pubKeyList);
+               for( ; !PUBKEY_LIST_END(curPub, pubKeyList) ; curPub = PUBKEY_LIST_NEXT( curPub ) ) {
+                       /* Check the key request */
+                       length = SECKEY_PublicKeyStrength( curPub->key ) ;
+                       length *= 8 ;
+                       if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) &&
+                               ( length > 0 ) &&
+                               ( length < keyInfoCtx->keyReq.keyBitsSize ) )
+                               continue ;
+
+                       /* We find a eligible key */
+                       pubKey = curPub->key ;
+                       break ;
+               }
+
+               if( pubKey != NULL ) {
+                       data = xmlSecNssPKIAdoptKey( NULL, pubKey ) ;
+                       if( data == NULL ) {
+                               /* Do nothing */
+                       }
+               }
+
+               /* Destroy the public key list */
+               SECKEY_DestroyPublicKeyList( pubKeyList ) ;
+       } else if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePrivate ) == xmlSecKeyDataTypePrivate ) {
+               SECKEYPrivateKeyList*           priKeyList = NULL ;
+               SECKEYPrivateKey*                       priKey = NULL ;
+               SECKEYPrivateKeyListNode*       curPri ;
+
+               /* Find asymmetric key from the slot by name */
+               priKeyList = PK11_ListPrivKeysInSlot( slot , ( char* )name , NULL ) ;
+               priKey = NULL ;
+               curPri = PRIVKEY_LIST_HEAD(priKeyList);
+               for( ; !PRIVKEY_LIST_END(curPri, priKeyList) ; curPri = PRIVKEY_LIST_NEXT( curPri ) ) {
+                       /* Check the key request */
+                       length = PK11_SignatureLen( curPri->key ) ;
+                       length *= 8 ;
+                       if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) &&
+                               ( length > 0 ) &&
+                               ( length < keyInfoCtx->keyReq.keyBitsSize ) )
+                               continue ;
+
+                       /* We find a eligible key */
+                       priKey = curPri->key ;
+                       break ;
+               }
+
+               if( priKey != NULL ) {
+                       data = xmlSecNssPKIAdoptKey( priKey, NULL ) ;
+                       if( data == NULL ) {
+                               /* Do nothing */
+                       }
+               }
+
+               /* Destroy the private key list */
+               SECKEY_DestroyPrivateKeyList( priKeyList ) ;
+       }
+
+       /* If we have gotten the key value */
+       if( data != NULL ) {
+               if( ( key = xmlSecKeyCreate() ) == NULL ) {
+                       xmlSecError( XMLSEC_ERRORS_HERE ,
+                               NULL ,
+                               "xmlSecKeyCreate" ,
+                               XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+                       xmlSecKeyDataDestroy( data ) ;
+                       return NULL ;
+               }
+
+               if( xmlSecKeySetValue( key , data ) < 0 ) {
+                       xmlSecError( XMLSEC_ERRORS_HERE ,
+                               NULL ,
+                               "xmlSecKeySetValue" ,
+                               XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+                       xmlSecKeyDestroy( key ) ;
+                       xmlSecKeyDataDestroy( data ) ;
+                       return NULL ;
+               }
+       }

-    ss = xmlSecNssKeysStoreGetSS(store);
-    xmlSecAssert2(((ss != NULL) && (*ss != NULL) &&
-		   (xmlSecKeyStoreCheckId(*ss, xmlSecSimpleKeysStoreId))), -1);
+    return(key);
+}
+
+/**
+ * xmlSecKeyStoreFindKeyMethod:
+ * @store:             the store.
+ * @name:              the desired key name.
+ * @keyInfoCtx:        the pointer to key info context.
+ *
+ * Keys store specific find method. The caller is responsible for destroying
+ * the returned key using #xmlSecKeyDestroy method.
+ *
+ * Returns the pointer to a key or NULL if key is not found or an error occurs.
+ */
+static xmlSecKeyPtr
+xmlSecNssKeysStoreFindKey(
+       xmlSecKeyStorePtr store ,
+       const xmlChar* name ,
+       xmlSecKeyInfoCtxPtr keyInfoCtx
+) {
+    xmlSecNssKeysStoreCtxPtr context = NULL ;
+    xmlSecKeyPtr    key = NULL ;
+    xmlSecNssKeySlotPtr     keySlot = NULL ;
+    xmlSecSize              pos ;
+    xmlSecSize              size ;
+
+    xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , NULL ) ;
+    xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , NULL ) ;
+    xmlSecAssert2( keyInfoCtx != NULL , NULL ) ;
+
+    context = xmlSecNssKeysStoreGetCtx( store ) ;
+    if( context == NULL ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                    "xmlSecNssKeysStoreGetCtx" ,
+                    XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return NULL ;
+    }
+
+    /*-
+     * Look for key at keyList at first.
+     */
+    if( context->keyList != NULL ) {
+            size = xmlSecPtrListGetSize( context->keyList ) ;
+            for( pos = 0 ; pos < size ; pos ++ ) {
+                    key = ( xmlSecKeyPtr )xmlSecPtrListGetItem( context->keyList , pos ) ;
+                    if( key != NULL && xmlSecKeyMatch( key , name , &( keyInfoCtx->keyReq ) ) ) {
+                            return xmlSecKeyDuplicate( key ) ;
+                    }
+            }
+    }
+
+    /*-
+     * Find the key from slotList
+     */
+    if( context->slotList != NULL ) {
+            PK11SlotInfo*                   slot = NULL ;
+
+            size = xmlSecPtrListGetSize( context->slotList ) ;
+            for( pos = 0 ; pos < size ; pos ++ ) {
+                    keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( context->slotList , pos ) ;
+                    slot = xmlSecNssKeySlotGetSlot( keySlot ) ;
+                    if( slot == NULL ) {
+                            continue ;
+                    } else {
+                            key = xmlSecNssKeysStoreFindKeyFromSlot( slot, name, keyInfoCtx ) ;
+                            if( key == NULL ) {
+                                    continue ;
+                            } else {
+                                    return( key ) ;
+                            }
+                    }
+            }
+    }
+
+    /*-
+     * Create a session key if we can not find the key from keyList and slotList
+     */
+    if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypeSession ) == xmlSecKeyDataTypeSession ) {
+            key = xmlSecKeyGenerate( keyInfoCtx->keyReq.keyId , keyInfoCtx->keyReq.keyBitsSize , xmlSecKeyDataTypeSession ) ;
+            if( key == NULL ) {
+                    xmlSecError( XMLSEC_ERRORS_HERE ,
+                            xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) ,
+                            "xmlSecKeySetValue" ,
+                            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+                            XMLSEC_ERRORS_NO_MESSAGE ) ;
+                    return NULL ;
+            }
+
+            return key ;
+    }
+
+   /**
+    * We have no way to find the key any more.
+    */
+    return NULL ;
+}
+
+static xmlSecKeyStoreKlass xmlSecNssKeysStoreKlass = {
+       sizeof( xmlSecKeyStoreKlass ) ,
+       xmlSecNssKeysStoreSize ,
+       BAD_CAST "implicit_nss_keys_store" ,
+       xmlSecNssKeysStoreInitialize ,
+       xmlSecNssKeysStoreFinalize ,
+       xmlSecNssKeysStoreFindKey ,
+       NULL ,
+       NULL
+} ;

-    return (xmlSecSimpleKeysStoreAdoptKey(*ss, key));
+/**
+ * xmlSecNssKeysStoreGetKlass:
+ *
+ * The simple list based keys store klass.
+ *
+ */
+xmlSecKeyStoreId
+xmlSecNssKeysStoreGetKlass( void ) {
+    return &xmlSecNssKeysStoreKlass ;
 }

+/**************************
+ * Application routines
+ */
+
 /**
  * xmlSecNssKeysStoreLoad:
  * @store:		the pointer to Nss keys store.
@@ -252,234 +651,147 @@
  */
 int
 xmlSecNssKeysStoreSave(xmlSecKeyStorePtr store, const char *filename, xmlSecKeyDataType type) {
-    xmlSecKeyStorePtr *ss;
+    xmlSecKeyInfoCtx keyInfoCtx;
+    xmlSecNssKeysStoreCtxPtr context ;
+    xmlSecPtrListPtr list;
+    xmlSecKeyPtr key;
+    xmlSecSize i, keysSize;
+    xmlDocPtr doc;
+    xmlNodePtr cur;
+    xmlSecKeyDataPtr data;
+    xmlSecPtrListPtr idsList;
+    xmlSecKeyDataId dataId;
+    xmlSecSize idsSize, j;
+    int ret;

     xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1);
-    xmlSecAssert2((filename != NULL), -1);
-
-    ss = xmlSecNssKeysStoreGetSS(store);
-    xmlSecAssert2(((ss != NULL) && (*ss != NULL) &&
-		   (xmlSecKeyStoreCheckId(*ss, xmlSecSimpleKeysStoreId))), -1);
-
-    return (xmlSecSimpleKeysStoreSave(*ss, filename, type));
-}
-
-static int
-xmlSecNssKeysStoreInitialize(xmlSecKeyStorePtr store) {
-    xmlSecKeyStorePtr *ss;
+    xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ), -1 ) ;
+    xmlSecAssert2(filename != NULL, -1);

-    xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1);
+    context = xmlSecNssKeysStoreGetCtx( store ) ;
+    xmlSecAssert2( context != NULL, -1 );

-    ss = xmlSecNssKeysStoreGetSS(store);
-    xmlSecAssert2((*ss == NULL), -1);
+    list = context->keyList ;
+       xmlSecAssert2( list != NULL, -1 );
+    xmlSecAssert2(xmlSecPtrListCheckId(list, xmlSecKeyPtrListId), -1);

-    *ss = xmlSecKeyStoreCreate(xmlSecSimpleKeysStoreId);
-    if(*ss == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
+    /* create doc */
+    doc = xmlSecCreateTree(BAD_CAST "Keys", xmlSecNs);
+    if(doc == NULL) {
+	    xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
-		    "xmlSecKeyStoreCreate",
+		    "xmlSecCreateTree",
 		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "xmlSecSimpleKeysStoreId");
+		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }

-    return(0);
-}
-
-static void
-xmlSecNssKeysStoreFinalize(xmlSecKeyStorePtr store) {
-    xmlSecKeyStorePtr *ss;
-
-    xmlSecAssert(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId));
-
-    ss = xmlSecNssKeysStoreGetSS(store);
-    xmlSecAssert((ss != NULL) && (*ss != NULL));
-
-    xmlSecKeyStoreDestroy(*ss);
-}
-
-static xmlSecKeyPtr
-xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name,
-		          xmlSecKeyInfoCtxPtr keyInfoCtx) {
-    xmlSecKeyStorePtr* ss;
-    xmlSecKeyPtr key = NULL;
-    xmlSecKeyPtr retval = NULL;
-    xmlSecKeyReqPtr keyReq = NULL;
-    CERTCertificate *cert = NULL;
-    SECKEYPublicKey *pubkey = NULL;
-    SECKEYPrivateKey *privkey = NULL;
-    xmlSecKeyDataPtr data = NULL;
-    xmlSecKeyDataPtr x509Data = NULL;
-    int ret;
-
-    xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), NULL);
-    xmlSecAssert2(keyInfoCtx != NULL, NULL);
-
-    ss = xmlSecNssKeysStoreGetSS(store);
-    xmlSecAssert2(((ss != NULL) && (*ss != NULL)), NULL);
-
-    key = xmlSecKeyStoreFindKey(*ss, name, keyInfoCtx);
-    if (key != NULL) {
-	return (key);
-    }
-
-    /* Try to find the key in the NSS DB, and construct an xmlSecKey.
-     * we must have a name to lookup keys in NSS DB.
-     */
-    if (name == NULL) {
-	goto done;
-    }
+    idsList = xmlSecKeyDataIdsGet();
+    xmlSecAssert2(idsList != NULL, -1);

-    /* what type of key are we looking for?
-     * TBD: For now, we'll look only for public/private keys using the
-     * name as a cert nickname. Later on, we can attempt to find
-     * symmetric keys using PK11_FindFixedKey
-     */
-    keyReq = &(keyInfoCtx->keyReq);
-    if (keyReq->keyType &
-	(xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate)) {
-	cert = CERT_FindCertByNickname (CERT_GetDefaultCertDB(), (char *)name);
-	if (cert == NULL) {
-	    goto done;
-	}
+    keysSize = xmlSecPtrListGetSize(list);
+    idsSize = xmlSecPtrListGetSize(idsList);
+    for(i = 0; i < keysSize; ++i) {
+        key = (xmlSecKeyPtr)xmlSecPtrListGetItem(list, i);
+        xmlSecAssert2(key != NULL, -1);

-	if (keyReq->keyType & xmlSecKeyDataTypePublic) {
- 	    pubkey = CERT_ExtractPublicKey(cert);
-	    if (pubkey == NULL) {
+        cur = xmlSecAddChild(xmlDocGetRootElement(doc), xmlSecNodeKeyInfo, xmlSecDSigNs);
+        if(cur == NULL) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
-			    NULL,
-			    "CERT_ExtractPublicKey",
-			    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			    XMLSEC_ERRORS_NO_MESSAGE);
-		goto done;
-	    }
+                    xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+                    "xmlSecAddChild",
+                    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                    "node=%s",
+                    xmlSecErrorsSafeString(xmlSecNodeKeyInfo));
+            xmlFreeDoc(doc);
+            return(-1);
 	}

-	if (keyReq->keyType & xmlSecKeyDataTypePrivate) {
- 	    privkey = PK11_FindKeyByAnyCert(cert, NULL);
-	    if (privkey == NULL) {
+        /* special data key name */
+        if(xmlSecKeyGetName(key) != NULL) {
+            if(xmlSecAddChild(cur, xmlSecNodeKeyName, xmlSecDSigNs) == NULL) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
-			    NULL,
-			    "PK11_FindKeyByAnyCert",
-			    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			    XMLSEC_ERRORS_NO_MESSAGE);
-		goto done;
+                xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+                "xmlSecAddChild",
+                XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                "node=%s",
+                xmlSecErrorsSafeString(xmlSecNodeKeyName));
+            xmlFreeDoc(doc);
+            return(-1);
 	    }
 	}

-	data = xmlSecNssPKIAdoptKey(privkey, pubkey);
-	if(data == NULL) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecNssPKIAdoptKey",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			XMLSEC_ERRORS_NO_MESSAGE);
-	    goto done;
-	}
-	privkey = NULL;
-	pubkey = NULL;
-
-        key = xmlSecKeyCreate();
-        if (key == NULL) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecKeyCreate",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			XMLSEC_ERRORS_NO_MESSAGE);
-	    return (NULL);
-        }
-
-	x509Data = xmlSecKeyDataCreate(xmlSecNssKeyDataX509Id);
-	if(x509Data == NULL) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecKeyDataCreate",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"transform=%s",
-			xmlSecErrorsSafeString(xmlSecTransformKlassGetName(xmlSecNssKeyDataX509Id)));
-	    goto done;
-	}
+        /* create nodes for other keys data */
+        for(j = 0; j < idsSize; ++j) {
+            dataId = (xmlSecKeyDataId)xmlSecPtrListGetItem(idsList, j);
+            xmlSecAssert2(dataId != xmlSecKeyDataIdUnknown, -1);
+
+            if(dataId->dataNodeName == NULL) {
+                continue;
+            }
+
+            data = xmlSecKeyGetData(key, dataId);
+            if(data == NULL) {
+                continue;
+	    }

-	ret = xmlSecNssKeyDataX509AdoptKeyCert(x509Data, cert);
-	if (ret < 0) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecNssKeyDataX509AdoptKeyCert",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"data=%s",
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data)));
-	    goto done;
-	}
-	cert = CERT_DupCertificate(cert);
-	if (cert == NULL) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"CERT_DupCertificate",
-			XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			"data=%s",
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data)));
-	    goto done;
+            if(xmlSecAddChild(cur, dataId->dataNodeName, dataId->dataNodeNs) == NULL) {
+	        xmlSecError(XMLSEC_ERRORS_HERE,
+                xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+                "xmlSecAddChild",
+		XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                "node=%s",
+                xmlSecErrorsSafeString(dataId->dataNodeName));
+                xmlFreeDoc(doc);
+                return(-1);
+	    }
 	}

-	ret = xmlSecNssKeyDataX509AdoptCert(x509Data, cert);
+	ret = xmlSecKeyInfoCtxInitialize(&keyInfoCtx, NULL);
 	if (ret < 0) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecNssKeyDataX509AdoptCert",
+            xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+            "xmlSecKeyInfoCtxInitialize",
 			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"data=%s",
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data)));
-	    goto done;
+            XMLSEC_ERRORS_NO_MESSAGE);
+            xmlFreeDoc(doc);
+            return(-1);
 	}
-	cert = NULL;

-	ret = xmlSecKeySetValue(key, data);
-	if (ret < 0) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecKeySetValue",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"data=%s",
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)));
-	    goto done;
-	}
-	data = NULL;
+        keyInfoCtx.mode                 = xmlSecKeyInfoModeWrite;
+        keyInfoCtx.keyReq.keyId         = xmlSecKeyDataIdUnknown;
+        keyInfoCtx.keyReq.keyType       = type;
+        keyInfoCtx.keyReq.keyUsage      = xmlSecKeyDataUsageAny;

-	ret = xmlSecKeyAdoptData(key, x509Data);
+        /* finally write key in the node */
+        ret = xmlSecKeyInfoNodeWrite(cur, key, &keyInfoCtx);
 	if (ret < 0) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecKeyAdoptData",
+            xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+            "xmlSecKeyInfoNodeWrite",
 			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"data=%s",
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data)));
-	    goto done;
-	}
-	x509Data = NULL;
+            XMLSEC_ERRORS_NO_MESSAGE);
+        xmlSecKeyInfoCtxFinalize(&keyInfoCtx);
+        xmlFreeDoc(doc);
+        return(-1);
+        }

-	retval = key;
-	key = NULL;
+        xmlSecKeyInfoCtxFinalize(&keyInfoCtx);
     }

-done:
-    if (cert != NULL) {
-	CERT_DestroyCertificate(cert);
-    }
-    if (pubkey != NULL) {
-	SECKEY_DestroyPublicKey(pubkey);
-    }
-    if (privkey != NULL) {
-	SECKEY_DestroyPrivateKey(privkey);
-    }
-    if (data != NULL) {
-	xmlSecKeyDataDestroy(data);
-    }
-    if (x509Data != NULL) {
-	xmlSecKeyDataDestroy(x509Data);
-    }
-    if (key != NULL) {
-	xmlSecKeyDestroy(key);
+    /* now write result */
+    ret = xmlSaveFormatFile(filename, doc, 1);
+    if (ret < 0) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+                    xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)),
+            "xmlSaveFormatFile",
+            XMLSEC_ERRORS_R_XML_FAILED,
+            "filename=%s",
+            xmlSecErrorsSafeString(filename));
+        xmlFreeDoc(doc);
+        return(-1);
     }

-    return (retval);
+    xmlFreeDoc(doc);
+    return(0);
 }
--- misc/xmlsec1-1.2.14/src/nss/keywrapers.c	2009-09-21 14:07:19.223802688 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/keywrapers.c	2009-09-21 14:02:48.548869372 +0200
@@ -1 +1,1213 @@
-dummy
+/**
+ *
+ * XMLSec library
+ *
+ * AES Algorithm support
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright .................................
+ */
+#include "globals.h"
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <nss.h>
+#include <pk11func.h>
+#include <hasht.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/xmltree.h>
+#include <xmlsec/keys.h>
+#include <xmlsec/transforms.h>
+#include <xmlsec/errors.h>
+
+#include <xmlsec/nss/crypto.h>
+#include <xmlsec/nss/ciphers.h>
+
+#define XMLSEC_NSS_AES128_KEY_SIZE		16
+#define XMLSEC_NSS_AES192_KEY_SIZE		24
+#define XMLSEC_NSS_AES256_KEY_SIZE		32
+#define XMLSEC_NSS_DES3_KEY_SIZE		24
+#define XMLSEC_NSS_DES3_KEY_LENGTH      24
+#define XMLSEC_NSS_DES3_IV_LENGTH       8
+#define XMLSEC_NSS_DES3_BLOCK_LENGTH    8
+
+static xmlSecByte xmlSecNssKWDes3Iv[XMLSEC_NSS_DES3_IV_LENGTH] = {
+    0x4a, 0xdd, 0xa2, 0x2c, 0x79, 0xe8, 0x21, 0x05
+};
+
+/*********************************************************************
+ *
+ * key wrap transforms
+ *
+ ********************************************************************/
+typedef struct _xmlSecNssKeyWrapCtx			xmlSecNssKeyWrapCtx ;
+typedef struct _xmlSecNssKeyWrapCtx*		xmlSecNssKeyWrapCtxPtr ;
+
+#define xmlSecNssKeyWrapSize	\
+	( sizeof( xmlSecTransform ) + sizeof( xmlSecNssKeyWrapCtx ) )
+
+#define xmlSecNssKeyWrapGetCtx( transform ) \
+	( ( xmlSecNssKeyWrapCtxPtr )( ( ( xmlSecByte* )( transform ) ) + sizeof( xmlSecTransform ) ) )
+
+struct _xmlSecNssKeyWrapCtx {
+	CK_MECHANISM_TYPE		cipher ;
+	PK11SymKey*				symkey ;
+	xmlSecKeyDataId			keyId ;
+	xmlSecBufferPtr			material ; /* to be encrypted/decrypted key material */
+} ;
+
+static int 		xmlSecNssKeyWrapInitialize(xmlSecTransformPtr transform);
+static void 	xmlSecNssKeyWrapFinalize(xmlSecTransformPtr transform);
+static int  	xmlSecNssKeyWrapSetKeyReq(xmlSecTransformPtr transform,
+							 xmlSecKeyReqPtr keyReq);
+static int  	xmlSecNssKeyWrapSetKey(xmlSecTransformPtr transform,
+							 xmlSecKeyPtr key);
+static int  	xmlSecNssKeyWrapExecute(xmlSecTransformPtr transform,
+							 int last,
+							 xmlSecTransformCtxPtr transformCtx);
+static xmlSecSize  	xmlSecNssKeyWrapGetKeySize(xmlSecTransformPtr transform);
+
+static int
+xmlSecNssKeyWrapCheckId(
+	xmlSecTransformPtr transform
+) {
+	#ifndef XMLSEC_NO_DES
+	if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWDes3Id ) ) {
+		return(1);
+	}
+	#endif /* XMLSEC_NO_DES */
+
+	#ifndef XMLSEC_NO_AES
+	if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes128Id ) ||
+		xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes192Id ) ||
+		xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes256Id ) ) {
+
+		return(1);
+    }
+	#endif /* XMLSEC_NO_AES */
+
+    return(0);
+}
+
+static xmlSecSize
+xmlSecNssKeyWrapGetKeySize(xmlSecTransformPtr transform) {
+#ifndef XMLSEC_NO_DES
+	if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWDes3Id ) ) {
+		return(XMLSEC_NSS_DES3_KEY_SIZE);
+	} else
+#endif /* XMLSEC_NO_DES */
+
+#ifndef XMLSEC_NO_AES
+    if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes128Id)) {
+		return(XMLSEC_NSS_AES128_KEY_SIZE);
+    } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes192Id)) {
+		return(XMLSEC_NSS_AES192_KEY_SIZE);
+    } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes256Id)) {
+		return(XMLSEC_NSS_AES256_KEY_SIZE);
+    } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes256Id)) {
+		return(XMLSEC_NSS_AES256_KEY_SIZE);
+    } else
+#endif /* XMLSEC_NO_AES */
+
+	if(1)
+   		return(0);
+}
+
+
+static int
+xmlSecNssKeyWrapInitialize(xmlSecTransformPtr transform) {
+	xmlSecNssKeyWrapCtxPtr context ;
+    int ret;
+
+    xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1);
+    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1);
+
+	context = xmlSecNssKeyWrapGetCtx( transform ) ;
+	xmlSecAssert2( context != NULL , -1 ) ;
+
+	#ifndef XMLSEC_NO_DES
+	if( transform->id == xmlSecNssTransformKWDes3Id ) {
+		context->cipher = CKM_DES3_CBC ;
+		context->keyId = xmlSecNssKeyDataDesId ;
+	} else
+	#endif		/* XMLSEC_NO_DES */
+
+	#ifndef XMLSEC_NO_AES
+	if( transform->id == xmlSecNssTransformKWAes128Id ) {
+	/*	context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/
+		context->cipher = CKM_AES_CBC ;
+		context->keyId = xmlSecNssKeyDataAesId ;
+	} else
+	if( transform->id == xmlSecNssTransformKWAes192Id ) {
+	/*	context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/
+		context->cipher = CKM_AES_CBC ;
+		context->keyId = xmlSecNssKeyDataAesId ;
+	} else
+	if( transform->id == xmlSecNssTransformKWAes256Id ) {
+	/*	context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/
+		context->cipher = CKM_AES_CBC ;
+		context->keyId = xmlSecNssKeyDataAesId ;
+	} else
+	#endif		/* XMLSEC_NO_AES */
+
+
+	if( 1 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+		    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
+		    NULL ,
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+		    XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	context->symkey = NULL ;
+	context->material = NULL ;
+
+    return(0);
+}
+
+static void
+xmlSecNssKeyWrapFinalize(xmlSecTransformPtr transform) {
+	xmlSecNssKeyWrapCtxPtr context ;
+
+    xmlSecAssert(xmlSecNssKeyWrapCheckId(transform));
+    xmlSecAssert(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize));
+
+	context = xmlSecNssKeyWrapGetCtx( transform ) ;
+	xmlSecAssert( context != NULL ) ;
+
+	if( context->symkey != NULL ) {
+		PK11_FreeSymKey( context->symkey ) ;
+		context->symkey = NULL ;
+	}
+
+	if( context->material != NULL ) {
+		xmlSecBufferDestroy(context->material);
+		context->material = NULL ;
+	}
+}
+
+static int
+xmlSecNssKeyWrapSetKeyReq(xmlSecTransformPtr transform,  xmlSecKeyReqPtr keyReq) {
+	xmlSecNssKeyWrapCtxPtr context ;
+	xmlSecSize cipherSize = 0 ;
+
+
+    xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1);
+    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1);
+    xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1);
+    xmlSecAssert2(keyReq != NULL, -1);
+
+	context = xmlSecNssKeyWrapGetCtx( transform ) ;
+	xmlSecAssert2( context != NULL , -1 ) ;
+
+    keyReq->keyId 	 = context->keyId;
+    keyReq->keyType  = xmlSecKeyDataTypeSymmetric;
+    if(transform->operation == xmlSecTransformOperationEncrypt) {
+		keyReq->keyUsage = xmlSecKeyUsageEncrypt;
+    } else {
+		keyReq->keyUsage = xmlSecKeyUsageDecrypt;
+    }
+
+	keyReq->keyBitsSize = xmlSecNssKeyWrapGetKeySize( transform ) ;
+
+    return(0);
+}
+
+static int
+xmlSecNssKeyWrapSetKey(xmlSecTransformPtr transform, xmlSecKeyPtr key) {
+	xmlSecNssKeyWrapCtxPtr context = NULL ;
+	xmlSecKeyDataPtr	keyData = NULL ;
+	PK11SymKey*			symkey = NULL ;
+
+    xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1);
+    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1);
+    xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1);
+    xmlSecAssert2(key != NULL, -1);
+
+	context = xmlSecNssKeyWrapGetCtx( transform ) ;
+	if( context == NULL || context->keyId == NULL || context->symkey != NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+		    xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+		    "xmlSecNssKeyWrapGetCtx" ,
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+		    XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+	xmlSecAssert2( xmlSecKeyCheckId( key, context->keyId ), -1 ) ;
+
+	keyData = xmlSecKeyGetValue( key ) ;
+	if( keyData == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+		    xmlSecErrorsSafeString( xmlSecKeyGetName( key ) ) ,
+		    "xmlSecKeyGetValue" ,
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+		    XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( ( symkey = xmlSecNssSymKeyDataGetKey( keyData ) ) == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+		    xmlSecErrorsSafeString( xmlSecKeyDataGetName( keyData ) ) ,
+		    "xmlSecNssSymKeyDataGetKey" ,
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+		    XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	context->symkey = symkey ;
+
+	return(0) ;
+}
+
+/**
+ * key wrap transform
+ */
+static int
+xmlSecNssKeyWrapCtxInit(
+	xmlSecNssKeyWrapCtxPtr		ctx ,
+	xmlSecBufferPtr 			in ,
+	xmlSecBufferPtr 			out ,
+	int 						encrypt ,
+	xmlSecTransformCtxPtr 		transformCtx
+) {
+	xmlSecSize			blockSize ;
+
+	xmlSecAssert2( ctx != NULL , -1 ) ;
+	xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
+	xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
+	xmlSecAssert2( in != NULL , -1 ) ;
+	xmlSecAssert2( out != NULL , -1 ) ;
+	xmlSecAssert2( transformCtx != NULL , -1 ) ;
+
+	if( ctx->material != NULL ) {
+		xmlSecBufferDestroy( ctx->material ) ;
+		ctx->material = NULL ;
+	}
+
+	if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_GetBlockSize" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	ctx->material = xmlSecBufferCreate( blockSize ) ;
+	if( ctx->material == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferCreate" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	/* read raw key material into context */
+	if( xmlSecBufferSetData( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferSetData" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferRemoveHead" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	return(0);
+}
+
+/**
+ * key wrap transform update
+ */
+static int
+xmlSecNssKeyWrapCtxUpdate(
+	xmlSecNssKeyWrapCtxPtr		ctx ,
+	xmlSecBufferPtr 			in ,
+	xmlSecBufferPtr 			out ,
+	int 						encrypt ,
+	xmlSecTransformCtxPtr 		transformCtx
+) {
+	xmlSecAssert2( ctx != NULL , -1 ) ;
+	xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
+	xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
+	xmlSecAssert2( ctx->material != NULL , -1 ) ;
+	xmlSecAssert2( in != NULL , -1 ) ;
+	xmlSecAssert2( out != NULL , -1 ) ;
+	xmlSecAssert2( transformCtx != NULL , -1 ) ;
+
+	/* read raw key material and append into context */
+	if( xmlSecBufferAppend( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferAppend" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferRemoveHead" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	return(0);
+}
+
+static int
+xmlSecNssKWDes3BufferReverse(xmlSecByte *buf, xmlSecSize size) {
+    xmlSecSize s;
+    xmlSecSize i;
+    xmlSecByte c;
+
+    xmlSecAssert2(buf != NULL, -1);
+
+    s = size / 2;
+    --size;
+    for(i = 0; i < s; ++i) {
+	c = buf[i];
+	buf[i] = buf[size - i];
+	buf[size - i] = c;
+    }
+    return(0);
+}
+
+static xmlSecByte *
+xmlSecNssComputeSHA1(const xmlSecByte *in, xmlSecSize inSize,
+		     xmlSecByte *out, xmlSecSize outSize)
+{
+    PK11Context *context = NULL;
+    SECStatus s;
+    xmlSecByte *digest = NULL;
+    unsigned int len;
+
+    xmlSecAssert2(in != NULL, NULL);
+    xmlSecAssert2(out != NULL, NULL);
+    xmlSecAssert2(outSize >= SHA1_LENGTH, NULL);
+
+    /* Create a context for hashing (digesting) */
+    context = PK11_CreateDigestContext(SEC_OID_SHA1);
+    if (context == NULL) {
+	xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_CreateDigestContext",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "error code = %d", PORT_GetError());
+	goto done;
+    }
+
+    s = PK11_DigestBegin(context);
+    if (s != SECSuccess) {
+	xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_DigestBegin",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "error code = %d", PORT_GetError());
+	goto done;
+    }
+
+    s = PK11_DigestOp(context, in, inSize);
+    if (s != SECSuccess) {
+	xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_DigestOp",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "error code = %d", PORT_GetError());
+	goto done;
+    }
+
+    s = PK11_DigestFinal(context, out, &len, outSize);
+    if (s != SECSuccess) {
+	xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_DigestFinal",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "error code = %d", PORT_GetError());
+	goto done;
+    }
+    xmlSecAssert2(len == SHA1_LENGTH, NULL);
+
+    digest = out;
+
+done:
+    if (context != NULL) {
+	PK11_DestroyContext(context, PR_TRUE);
+    }
+    return (digest);
+}
+
+static int
+xmlSecNssKWDes3Encrypt(
+	PK11SymKey*					symKey ,
+	CK_MECHANISM_TYPE			cipherMech ,
+    const xmlSecByte*			iv ,
+	xmlSecSize					ivSize ,
+    const xmlSecByte*			in ,
+	xmlSecSize					inSize ,
+    xmlSecByte*     			out ,
+	xmlSecSize					outSize ,
+	int							enc
+) {
+    PK11Context*        EncContext = NULL;
+	SECItem				ivItem ;
+	SECItem*			secParam = NULL ;
+    int					tmp1_outlen;
+    unsigned int		tmp2_outlen;
+	int                 result_len = -1;
+	SECStatus           rv;
+
+	xmlSecAssert2( cipherMech != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( symKey != NULL , -1 ) ;
+    xmlSecAssert2(iv != NULL, -1);
+    xmlSecAssert2(ivSize == XMLSEC_NSS_DES3_IV_LENGTH, -1);
+    xmlSecAssert2(in != NULL, -1);
+    xmlSecAssert2(inSize > 0, -1);
+    xmlSecAssert2(out != NULL, -1);
+    xmlSecAssert2(outSize >= inSize, -1);
+
+	/* Prepare IV */
+	ivItem.data = ( unsigned char* )iv ;
+	ivItem.len = ivSize ;
+
+    secParam = PK11_ParamFromIV(cipherMech, &ivItem);
+    if (secParam == NULL) {
+		xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_ParamFromIV",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "Error code = %d", PORT_GetError());
+		goto done;
+    }
+
+    EncContext = PK11_CreateContextBySymKey(cipherMech,
+		    			    enc ? CKA_ENCRYPT : CKA_DECRYPT,
+					    symKey, secParam);
+    if (EncContext == NULL) {
+		xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_CreateContextBySymKey",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "Error code = %d", PORT_GetError());
+		goto done;
+    }
+
+    tmp1_outlen = tmp2_outlen = 0;
+    rv = PK11_CipherOp(EncContext, out, &tmp1_outlen, outSize,
+		       (unsigned char *)in, inSize);
+    if (rv != SECSuccess) {
+		xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_CipherOp",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "Error code = %d", PORT_GetError());
+		goto done;
+    }
+
+    rv = PK11_DigestFinal(EncContext, out+tmp1_outlen,
+		    	  &tmp2_outlen, outSize-tmp1_outlen);
+    if (rv != SECSuccess) {
+		xmlSecError(XMLSEC_ERRORS_HERE,
+		    NULL,
+		    "PK11_DigestFinal",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    "Error code = %d", PORT_GetError());
+		goto done;
+    }
+
+    result_len = tmp1_outlen + tmp2_outlen;
+
+done:
+    if (secParam) {
+		SECITEM_FreeItem(secParam, PR_TRUE);
+    }
+    if (EncContext) {
+	PK11_DestroyContext(EncContext, PR_TRUE);
+    }
+
+    return(result_len);
+}
+
+static int
+xmlSecNssKeyWrapDesOp(
+	xmlSecNssKeyWrapCtxPtr		ctx ,
+	int 						encrypt ,
+	xmlSecBufferPtr 			result
+) {
+    xmlSecByte sha1[SHA1_LENGTH];
+    xmlSecByte iv[XMLSEC_NSS_DES3_IV_LENGTH];
+    xmlSecByte* in;
+    xmlSecSize inSize;
+    xmlSecByte* out;
+    xmlSecSize outSize;
+    xmlSecSize s;
+    int ret;
+    SECStatus status;
+
+	xmlSecAssert2( ctx != NULL , -1 ) ;
+	xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
+	xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
+	xmlSecAssert2( ctx->material != NULL , -1 ) ;
+	xmlSecAssert2( result != NULL , -1 ) ;
+
+	in = xmlSecBufferGetData(ctx->material);
+	inSize = xmlSecBufferGetSize(ctx->material) ;
+	out = xmlSecBufferGetData(result);
+	outSize = xmlSecBufferGetMaxSize(result) ;
+	if( encrypt ) {
+    	/* step 2: calculate sha1 and CMS */
+    	if(xmlSecNssComputeSHA1(in, inSize, sha1, SHA1_LENGTH) == NULL) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+			    "xmlSecNssComputeSHA1",
+			    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			    XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+
+	    /* step 3: construct WKCKS */
+    	memcpy(out, in, inSize);
+	    memcpy(out + inSize, sha1, XMLSEC_NSS_DES3_BLOCK_LENGTH);
+
+    	/* step 4: generate random iv */
+    	status = PK11_GenerateRandom(iv, XMLSEC_NSS_DES3_IV_LENGTH);
+    	if(status != SECSuccess) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"PK11_GenerateRandom",
+		    	XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    	"error code = %d", PORT_GetError());
+			return(-1);
+    	}
+
+    	/* step 5: first encryption, result is TEMP1 */
+    	ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher,
+				    iv, XMLSEC_NSS_DES3_IV_LENGTH,
+					out, inSize + XMLSEC_NSS_DES3_IV_LENGTH,
+					out, outSize, 1);
+    	if(ret < 0) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"xmlSecNssKWDes3Encrypt",
+		    	XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		    	XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+
+    	/* step 6: construct TEMP2=IV || TEMP1 */
+    	memmove(out + XMLSEC_NSS_DES3_IV_LENGTH, out,
+	    	inSize + XMLSEC_NSS_DES3_IV_LENGTH);
+    	memcpy(out, iv, XMLSEC_NSS_DES3_IV_LENGTH);
+    		s = ret + XMLSEC_NSS_DES3_IV_LENGTH;
+
+    	/* step 7: reverse octets order, result is TEMP3 */
+	    ret = xmlSecNssKWDes3BufferReverse(out, s);
+   	 	if(ret < 0) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+			    "xmlSecNssKWDes3BufferReverse",
+			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+
+    	/* step 8: second encryption with static IV */
+    	ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher,
+				    xmlSecNssKWDes3Iv, XMLSEC_NSS_DES3_IV_LENGTH,
+					out, s,
+					out, outSize, 1);
+    	if(ret < 0) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+			    "xmlSecNssKWDes3Encrypt",
+			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+		s = ret;
+
+		if( xmlSecBufferSetSize( result , s ) < 0 ) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+			    "xmlSecBufferSetSize",
+			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+		}
+	} else {
+    	/* step 2: first decryption with static IV, result is TEMP3 */
+    	ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher,
+				    xmlSecNssKWDes3Iv, XMLSEC_NSS_DES3_IV_LENGTH,
+					in, inSize,
+					out, outSize, 0);
+    	if((ret < 0) || (ret < XMLSEC_NSS_DES3_IV_LENGTH)) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"xmlSecNssKWDes3Encrypt",
+		    	XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		    	XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+    	s = ret;
+
+    	/* step 3: reverse octets order in TEMP3, result is TEMP2 */
+    	ret = xmlSecNssKWDes3BufferReverse(out, s);
+    	if(ret < 0) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"xmlSecNssKWDes3BufferReverse",
+		    	XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		    	XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+
+    	/* steps 4 and 5: get IV and decrypt second time, result is WKCKS */
+    	ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher,
+				    out, XMLSEC_NSS_DES3_IV_LENGTH,
+					out+XMLSEC_NSS_DES3_IV_LENGTH, s-XMLSEC_NSS_DES3_IV_LENGTH,
+					out, outSize, 0);
+    	if((ret < 0) || (ret < XMLSEC_NSS_DES3_BLOCK_LENGTH)) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"xmlSecNssKWDes3Encrypt",
+		    	XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		    	XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+    	}
+		s = ret - XMLSEC_NSS_DES3_IV_LENGTH;
+
+    	/* steps 6 and 7: calculate SHA1 and validate it */
+    	if(xmlSecNssComputeSHA1(out, s, sha1, SHA1_LENGTH) == NULL) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+		    	NULL,
+		    	"xmlSecNssComputeSHA1",
+		    	XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    	XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+   		 }
+
+		if(memcmp(sha1, out + s, XMLSEC_NSS_DES3_BLOCK_LENGTH) != 0) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+		   		 NULL,
+			    XMLSEC_ERRORS_R_INVALID_DATA,
+			    "SHA1 does not match");
+			return(-1);
+		}
+
+		if( xmlSecBufferSetSize( result , s ) < 0 ) {
+			xmlSecError(XMLSEC_ERRORS_HERE,
+			    NULL,
+			    "xmlSecBufferSetSize",
+			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_NO_MESSAGE);
+			return(-1);
+		}
+	}
+
+	return(0);
+}
+
+static int
+xmlSecNssKeyWrapAesOp(
+	xmlSecNssKeyWrapCtxPtr		ctx ,
+	int 						encrypt ,
+	xmlSecBufferPtr 			result
+) {
+    PK11Context*        cipherCtx = NULL;
+	SECItem				ivItem ;
+	SECItem*			secParam = NULL ;
+	xmlSecSize			inSize ;
+	xmlSecSize			inBlocks ;
+	int					blockSize ;
+	int					midSize ;
+	int					finSize ;
+	xmlSecByte*			out ;
+    xmlSecSize			outSize;
+
+	xmlSecAssert2( ctx != NULL , -1 ) ;
+	xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
+	xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
+	xmlSecAssert2( ctx->material != NULL , -1 ) ;
+	xmlSecAssert2( result != NULL , -1 ) ;
+
+	/* Do not set any IV */
+    memset(&ivItem, 0, sizeof(ivItem));
+
+	/* Get block size */
+	if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_GetBlockSize" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	inSize = xmlSecBufferGetSize( ctx->material ) ;
+	if( xmlSecBufferSetMaxSize( result , inSize + blockSize ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferSetMaxSize" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	/* Get Param for context initialization */
+	if( ( secParam = PK11_ParamFromIV( ctx->cipher , &ivItem ) ) == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_ParamFromIV" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	cipherCtx = PK11_CreateContextBySymKey( ctx->cipher , encrypt ? CKA_ENCRYPT : CKA_DECRYPT , ctx->symkey , secParam ) ;
+	if( cipherCtx == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_CreateContextBySymKey" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		SECITEM_FreeItem( secParam , PR_TRUE ) ;
+		return(-1);
+	}
+
+	out = xmlSecBufferGetData(result) ;
+	outSize = xmlSecBufferGetMaxSize(result) ;
+	if( PK11_CipherOp( cipherCtx , out, &midSize , outSize , xmlSecBufferGetData( ctx->material ) , inSize ) != SECSuccess ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_CipherOp" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( PK11_DigestFinal( cipherCtx , out + midSize , &finSize , outSize - midSize ) != SECSuccess ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_DigestFinal" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( xmlSecBufferSetSize( result , midSize + finSize ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferSetSize" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	return 0 ;
+}
+
+/**
+ * Block cipher transform final
+ */
+static int
+xmlSecNssKeyWrapCtxFinal(
+	xmlSecNssKeyWrapCtxPtr		ctx ,
+	xmlSecBufferPtr 			in ,
+	xmlSecBufferPtr 			out ,
+	int 						encrypt ,
+	xmlSecTransformCtxPtr 		transformCtx
+) {
+	PK11SymKey*			targetKey ;
+	xmlSecSize			blockSize ;
+	xmlSecBufferPtr		result ;
+
+	xmlSecAssert2( ctx != NULL , -1 ) ;
+	xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+	xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
+	xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
+	xmlSecAssert2( ctx->material != NULL , -1 ) ;
+	xmlSecAssert2( in != NULL , -1 ) ;
+	xmlSecAssert2( out != NULL , -1 ) ;
+	xmlSecAssert2( transformCtx != NULL , -1 ) ;
+
+	/* read raw key material and append into context */
+	if( xmlSecBufferAppend( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferAppend" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferRemoveHead" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	/* Now we get all of the key materail */
+	/* from now on we will wrap or unwrap the key */
+	if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"PK11_GetBlockSize" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	result = xmlSecBufferCreate( blockSize ) ;
+	if( result == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferCreate" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	switch( ctx->cipher ) {
+		case CKM_DES3_CBC :
+			if( xmlSecNssKeyWrapDesOp(ctx, encrypt, result) < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					NULL ,
+					"xmlSecNssKeyWrapDesOp" ,
+					XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				xmlSecBufferDestroy(result);
+				return(-1);
+			}
+			break ;
+	/*	case CKM_NETSCAPE_AES_KEY_WRAP :*/
+		case CKM_AES_CBC :
+			if( xmlSecNssKeyWrapAesOp(ctx, encrypt, result) < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					NULL ,
+					"xmlSecNssKeyWrapAesOp" ,
+					XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				xmlSecBufferDestroy(result);
+				return(-1);
+			}
+			break ;
+	}
+
+	/* Write output */
+	if( xmlSecBufferAppend( out, xmlSecBufferGetData(result), xmlSecBufferGetSize(result) ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			"xmlSecBufferAppend" ,
+			XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		xmlSecBufferDestroy(result);
+		return(-1);
+	}
+	xmlSecBufferDestroy(result);
+
+	return(0);
+}
+
+static int
+xmlSecNssKeyWrapExecute(xmlSecTransformPtr transform, int last, xmlSecTransformCtxPtr transformCtx) {
+	xmlSecNssKeyWrapCtxPtr 	context = NULL ;
+	xmlSecBufferPtr			inBuf, outBuf ;
+	int						operation ;
+	int						rtv ;
+
+	xmlSecAssert2( xmlSecNssKeyWrapCheckId( transform ), -1 ) ;
+	xmlSecAssert2( xmlSecTransformCheckSize( transform, xmlSecNssKeyWrapSize ), -1 ) ;
+    xmlSecAssert2( ( transform->operation == xmlSecTransformOperationEncrypt ) || ( transform->operation == xmlSecTransformOperationDecrypt ), -1 ) ;
+	xmlSecAssert2( transformCtx != NULL , -1 ) ;
+
+	context = xmlSecNssKeyWrapGetCtx( transform ) ;
+	if( context == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+		    xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+		    "xmlSecNssKeyWrapGetCtx" ,
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+		    XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return(-1);
+	}
+
+	inBuf = &( transform->inBuf ) ;
+	outBuf = &( transform->outBuf ) ;
+
+	if( transform->status == xmlSecTransformStatusNone ) {
+		transform->status = xmlSecTransformStatusWorking ;
+	}
+
+	operation = ( transform->operation == xmlSecTransformOperationEncrypt ) ? 1 : 0 ;
+	if( transform->status == xmlSecTransformStatusWorking ) {
+		if( context->material == NULL ) {
+			rtv = xmlSecNssKeyWrapCtxInit( context, inBuf , outBuf , operation , transformCtx ) ;
+			if( rtv < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+					"xmlSecNssKeyWrapCtxInit" ,
+					XMLSEC_ERRORS_R_INVALID_STATUS ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				return(-1);
+			}
+		}
+
+		if( context->material == NULL && last != 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+				NULL ,
+				XMLSEC_ERRORS_R_INVALID_STATUS ,
+				"No enough data to intialize transform" ) ;
+			return(-1);
+		}
+
+		if( context->material != NULL ) {
+			rtv = xmlSecNssKeyWrapCtxUpdate( context, inBuf , outBuf , operation , transformCtx ) ;
+			if( rtv < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+					"xmlSecNssKeyWrapCtxUpdate" ,
+					XMLSEC_ERRORS_R_INVALID_STATUS ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				return(-1);
+			}
+		}
+
+		if( last ) {
+			rtv = xmlSecNssKeyWrapCtxFinal( context, inBuf , outBuf , operation , transformCtx ) ;
+			if( rtv < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+					"xmlSecNssKeyWrapCtxFinal" ,
+					XMLSEC_ERRORS_R_INVALID_STATUS ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				return(-1);
+			}
+			transform->status = xmlSecTransformStatusFinished ;
+		}
+	} else if( transform->status == xmlSecTransformStatusFinished ) {
+		if( xmlSecBufferGetSize( inBuf ) != 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+				NULL ,
+				XMLSEC_ERRORS_R_INVALID_STATUS ,
+				"status=%d", transform->status ) ;
+			return(-1);
+		}
+	} else {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+			NULL ,
+			XMLSEC_ERRORS_R_INVALID_STATUS ,
+			"status=%d", transform->status ) ;
+		return(-1);
+	}
+
+	return(0);
+}
+
+#ifndef XMLSEC_NO_AES
+
+
+#ifdef __MINGW32__ // for runtime-pseudo-reloc
+static struct _xmlSecTransformKlass xmlSecNssKWAes128Klass = {
+#else
+static xmlSecTransformKlass xmlSecNssKWAes128Klass = {
+#endif
+    /* klass/object sizes */
+    sizeof(xmlSecTransformKlass),		/* xmlSecSize klassSize */
+    xmlSecNssKeyWrapSize,				/* xmlSecSize objSize */
+
+    xmlSecNameKWAes128,				/* const xmlChar* name; */
+    xmlSecHrefKWAes128,				/* const xmlChar* href; */
+    xmlSecTransformUsageEncryptionMethod,	/* xmlSecAlgorithmUsage usage; */
+
+    xmlSecNssKeyWrapInitialize, 			/* xmlSecTransformInitializeMethod initialize; */
+    xmlSecNssKeyWrapFinalize,			/* xmlSecTransformFinalizeMethod finalize; */
+    NULL,					/* xmlSecTransformNodeReadMethod readNode; */
+    NULL,					/* xmlSecTransformNodeWriteMethod writeNode; */
+    xmlSecNssKeyWrapSetKeyReq,			/* xmlSecTransformSetKeyMethod setKeyReq; */
+    xmlSecNssKeyWrapSetKey,			/* xmlSecTransformSetKeyMethod setKey; */
+    NULL,					/* xmlSecTransformValidateMethod validate; */
+    xmlSecTransformDefaultGetDataType,		/* xmlSecTransformGetDataTypeMethod getDataType; */
+    xmlSecTransformDefaultPushBin,		/* xmlSecTransformPushBinMethod pushBin; */
+    xmlSecTransformDefaultPopBin,		/* xmlSecTransformPopBinMethod popBin; */
+    NULL,					/* xmlSecTransformPushXmlMethod pushXml; */
+    NULL,					/* xmlSecTransformPopXmlMethod popXml; */
+    xmlSecNssKeyWrapExecute,			/* xmlSecTransformExecuteMethod execute; */
+
+    NULL,					/* void* reserved0; */
+    NULL,					/* void* reserved1; */
+};
+
+#ifdef __MINGW32__ // for runtime-pseudo-reloc
+static struct _xmlSecTransformKlass xmlSecNssKWAes192Klass = {
+#else
+static xmlSecTransformKlass xmlSecNssKWAes192Klass = {
+#endif
+    /* klass/object sizes */
+    sizeof(xmlSecTransformKlass),		/* xmlSecSize klassSize */
+    xmlSecNssKeyWrapSize,				/* xmlSecSize objSize */
+
+    xmlSecNameKWAes192,				/* const xmlChar* name; */
+    xmlSecHrefKWAes192,				/* const xmlChar* href; */
+    xmlSecTransformUsageEncryptionMethod,	/* xmlSecAlgorithmUsage usage; */
+
+    xmlSecNssKeyWrapInitialize, 			/* xmlSecTransformInitializeMethod initialize; */
+    xmlSecNssKeyWrapFinalize,			/* xmlSecTransformFinalizeMethod finalize; */
+    NULL,					/* xmlSecTransformNodeReadMethod readNode; */
+    NULL,					/* xmlSecTransformNodeWriteMethod writeNode; */
+    xmlSecNssKeyWrapSetKeyReq,			/* xmlSecTransformSetKeyMethod setKeyReq; */
+    xmlSecNssKeyWrapSetKey,			/* xmlSecTransformSetKeyMethod setKey; */
+    NULL,					/* xmlSecTransformValidateMethod validate; */
+    xmlSecTransformDefaultGetDataType,		/* xmlSecTransformGetDataTypeMethod getDataType; */
+    xmlSecTransformDefaultPushBin,		/* xmlSecTransformPushBinMethod pushBin; */
+    xmlSecTransformDefaultPopBin,		/* xmlSecTransformPopBinMethod popBin; */
+    NULL,					/* xmlSecTransformPushXmlMethod pushXml; */
+    NULL,					/* xmlSecTransformPopXmlMethod popXml; */
+    xmlSecNssKeyWrapExecute,			/* xmlSecTransformExecuteMethod execute; */
+
+    NULL,					/* void* reserved0; */
+    NULL,					/* void* reserved1; */
+};
+
+#ifdef __MINGW32__ // for runtime-pseudo-reloc
+static struct _xmlSecTransformKlass xmlSecNssKWAes256Klass = {
+#else
+static xmlSecTransformKlass xmlSecNssKWAes256Klass = {
+#endif
+    /* klass/object sizes */
+    sizeof(xmlSecTransformKlass),		/* xmlSecSize klassSize */
+    xmlSecNssKeyWrapSize,				/* xmlSecSize objSize */
+
+    xmlSecNameKWAes256,				/* const xmlChar* name; */
+    xmlSecHrefKWAes256,				/* const xmlChar* href; */
+    xmlSecTransformUsageEncryptionMethod,	/* xmlSecAlgorithmUsage usage; */
+
+    xmlSecNssKeyWrapInitialize, 			/* xmlSecTransformInitializeMethod initialize; */
+    xmlSecNssKeyWrapFinalize,			/* xmlSecTransformFinalizeMethod finalize; */
+    NULL,					/* xmlSecTransformNodeReadMethod readNode; */
+    NULL,					/* xmlSecTransformNodeWriteMethod writeNode; */
+    xmlSecNssKeyWrapSetKeyReq,			/* xmlSecTransformSetKeyMethod setKeyReq; */
+    xmlSecNssKeyWrapSetKey,			/* xmlSecTransformSetKeyMethod setKey; */
+    NULL,					/* xmlSecTransformValidateMethod validate; */
+    xmlSecTransformDefaultGetDataType,		/* xmlSecTransformGetDataTypeMethod getDataType; */
+    xmlSecTransformDefaultPushBin,		/* xmlSecTransformPushBinMethod pushBin; */
+    xmlSecTransformDefaultPopBin,		/* xmlSecTransformPopBinMethod popBin; */
+    NULL,					/* xmlSecTransformPushXmlMethod pushXml; */
+    NULL,					/* xmlSecTransformPopXmlMethod popXml; */
+    xmlSecNssKeyWrapExecute,			/* xmlSecTransformExecuteMethod execute; */
+
+    NULL,					/* void* reserved0; */
+    NULL,					/* void* reserved1; */
+};
+
+/**
+ * xmlSecNssTransformKWAes128GetKlass:
+ *
+ * The AES-128 key wrapper transform klass.
+ *
+ * Returns AES-128 key wrapper transform klass.
+ */
+xmlSecTransformId
+xmlSecNssTransformKWAes128GetKlass(void) {
+    return(&xmlSecNssKWAes128Klass);
+}
+
+/**
+ * xmlSecNssTransformKWAes192GetKlass:
+ *
+ * The AES-192 key wrapper transform klass.
+ *
+ * Returns AES-192 key wrapper transform klass.
+ */
+xmlSecTransformId
+xmlSecNssTransformKWAes192GetKlass(void) {
+    return(&xmlSecNssKWAes192Klass);
+}
+
+/**
+ *
+ * The AES-256 key wrapper transform klass.
+ *
+ * Returns AES-256 key wrapper transform klass.
+ */
+xmlSecTransformId
+xmlSecNssTransformKWAes256GetKlass(void) {
+    return(&xmlSecNssKWAes256Klass);
+}
+
+#endif /* XMLSEC_NO_AES */
+
+
+#ifndef XMLSEC_NO_DES
+
+#ifdef __MINGW32__ // for runtime-pseudo-reloc
+static struct _xmlSecTransformKlass xmlSecNssKWDes3Klass = {
+#else
+static xmlSecTransformKlass xmlSecNssKWDes3Klass = {
+#endif
+    /* klass/object sizes */
+    sizeof(xmlSecTransformKlass),		/* xmlSecSize klassSize */
+    xmlSecNssKeyWrapSize,			/* xmlSecSize objSize */
+
+    xmlSecNameKWDes3,				/* const xmlChar* name; */
+    xmlSecHrefKWDes3, 				/* const xmlChar* href; */
+    xmlSecTransformUsageEncryptionMethod,	/* xmlSecAlgorithmUsage usage; */
+
+    xmlSecNssKeyWrapInitialize, 			/* xmlSecTransformInitializeMethod initialize; */
+    xmlSecNssKeyWrapFinalize,			/* xmlSecTransformFinalizeMethod finalize; */
+    NULL,					/* xmlSecTransformNodeReadMethod readNode; */
+    NULL,					/* xmlSecTransformNodeWriteMethod writeNode; */
+    xmlSecNssKeyWrapSetKeyReq,			/* xmlSecTransformSetKeyMethod setKeyReq; */
+    xmlSecNssKeyWrapSetKey,			/* xmlSecTransformSetKeyMethod setKey; */
+    NULL,					/* xmlSecTransformValidateMethod validate; */
+    xmlSecTransformDefaultGetDataType,		/* xmlSecTransformGetDataTypeMethod getDataType; */
+    xmlSecTransformDefaultPushBin,		/* xmlSecTransformPushBinMethod pushBin; */
+    xmlSecTransformDefaultPopBin,		/* xmlSecTransformPopBinMethod popBin; */
+    NULL,					/* xmlSecTransformPushXmlMethod pushXml; */
+    NULL,					/* xmlSecTransformPopXmlMethod popXml; */
+    xmlSecNssKeyWrapExecute,			/* xmlSecTransformExecuteMethod execute; */
+
+    NULL,					/* void* reserved0; */
+    NULL,					/* void* reserved1; */
+};
+
+/**
+ * xmlSecNssTransformKWDes3GetKlass:
+ *
+ * The Triple DES key wrapper transform klass.
+ *
+ * Returns Triple DES key wrapper transform klass.
+ */
+xmlSecTransformId
+xmlSecNssTransformKWDes3GetKlass(void) {
+    return(&xmlSecNssKWDes3Klass);
+}
+
+#endif /* XMLSEC_NO_DES */
+
--- misc/xmlsec1-1.2.14/src/nss/pkikeys.c	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/pkikeys.c	2009-09-21 14:02:48.657352624 +0200
@@ -24,6 +24,7 @@
 #include <xmlsec/nss/crypto.h>
 #include <xmlsec/nss/bignum.h>
 #include <xmlsec/nss/pkikeys.h>
+#include <xmlsec/nss/tokens.h>

 /**************************************************************************
  *
@@ -115,6 +116,8 @@
                           xmlSecNssPKIKeyDataCtxPtr ctxSrc)
 {
     xmlSecNSSPKIKeyDataCtxFree(ctxDst);
+    ctxDst->privkey = NULL ;
+    ctxDst->pubkey = NULL ;
     if (ctxSrc->privkey != NULL) {
 	ctxDst->privkey = SECKEY_CopyPrivateKey(ctxSrc->privkey);
 	if(ctxDst->privkey == NULL) {
@@ -588,13 +591,13 @@
 	goto done;
     }

-    slot = PK11_GetBestSlot(CKM_DSA, NULL);
+    slot = xmlSecNssSlotGet(CKM_DSA);
     if(slot == NULL) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-		    "PK11_GetBestSlot",
+		    "xmlSecNssSlotGet",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
+		    "error code=%d", PORT_GetError());
 	ret = -1;
 	goto done;
     }
@@ -792,14 +795,14 @@
     if (slot != NULL) {
 	PK11_FreeSlot(slot);
     }
-    if (ret != 0) {
+
 	if (pubkey != NULL) {
 	    SECKEY_DestroyPublicKey(pubkey);
 	}
 	if (data != NULL) {
 	    xmlSecKeyDataDestroy(data);
 	}
-    }
+
     return(ret);
 }

@@ -818,7 +821,7 @@

     ctx = xmlSecNssPKIKeyDataGetCtx(xmlSecKeyGetValue(key));
     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);
+/*    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/

     if(((xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate) & keyInfoCtx->keyReq.keyType) == 0) {
 	/* we can have only private key or public key */
@@ -940,7 +943,8 @@
 		    xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 		    "PK11_PQG_ParamGen",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    "size=%d", sizeBits);
+		    "size=%d, error code=%d", sizeBits, PORT_GetError());
+	ret = -1;
 	goto done;
     }

@@ -950,11 +954,12 @@
 		    xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 		    "PK11_PQG_VerifyParams",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    "size=%d", sizeBits);
+		    "size=%d, error code=%d", sizeBits, PORT_GetError());
+	ret = -1;
 	goto done;
     }

-    slot = PK11_GetBestSlot(CKM_DSA_KEY_PAIR_GEN, NULL);
+    slot = xmlSecNssSlotGet(CKM_DSA_KEY_PAIR_GEN);
     PK11_Authenticate(slot, PR_TRUE, NULL /* default pwd callback */);
     privkey = PK11_GenerateKeyPair(slot, CKM_DSA_KEY_PAIR_GEN, pqgParams,
 				   &pubkey, PR_FALSE, PR_TRUE, NULL);
@@ -964,8 +969,9 @@
 		    xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 		    "PK11_GenerateKeyPair",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
+		    "error code=%d", PORT_GetError());

+	ret = -1;
 	goto done;
     }

@@ -979,6 +985,8 @@
 	goto done;
     }

+    privkey = NULL ;
+    pubkey = NULL ;
     ret = 0;

 done:
@@ -991,16 +999,13 @@
     if (pqgVerify != NULL) {
 	PK11_PQG_DestroyVerify(pqgVerify);
     }
-    if (ret == 0) {
-	return (0);
-    }
     if (pubkey != NULL) {
 	SECKEY_DestroyPublicKey(pubkey);
     }
     if (privkey != NULL) {
 	SECKEY_DestroyPrivateKey(privkey);
     }
-    return(-1);
+    return(ret);
 }

 static xmlSecKeyDataType
@@ -1010,10 +1015,10 @@
     xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDsaId), xmlSecKeyDataTypeUnknown);
     ctx = xmlSecNssPKIKeyDataGetCtx(data);
     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);
+/*    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/
     if (ctx->privkey != NULL) {
 	return(xmlSecKeyDataTypePrivate | xmlSecKeyDataTypePublic);
-    } else {
+    } else if( ctx->pubkey != NULL ) {
 	return(xmlSecKeyDataTypePublic);
     }

@@ -1027,7 +1032,7 @@
     xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDsaId), 0);
     ctx = xmlSecNssPKIKeyDataGetCtx(data);
     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);
+/*    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/

     return(8 * SECKEY_PublicKeyStrength(ctx->pubkey));
 }
@@ -1216,13 +1221,13 @@
 	goto done;
     }

-    slot = PK11_GetBestSlot(CKM_RSA_PKCS, NULL);
+    slot = xmlSecNssSlotGet(CKM_RSA_PKCS);
     if(slot == NULL) {
         xmlSecError(XMLSEC_ERRORS_HERE,
                     xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-                    "PK11_GetBestSlot",
+                    "xmlSecNssSlotGet",
                     XMLSEC_ERRORS_R_CRYPTO_FAILED,
-                    XMLSEC_ERRORS_NO_MESSAGE);
+                    "error code=%d", PORT_GetError());
         ret = -1;
         goto done;
     }
@@ -1384,7 +1389,7 @@

     ctx = xmlSecNssPKIKeyDataGetCtx(xmlSecKeyGetValue(key));
     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);
+/*    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);*/


     if(((xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate) & keyInfoCtx->keyReq.keyType) == 0) {
@@ -1455,7 +1460,7 @@
     params.keySizeInBits = sizeBits;
     params.pe = 65537;

-    slot = PK11_GetBestSlot(CKM_RSA_PKCS_KEY_PAIR_GEN, NULL);
+    slot = xmlSecNssSlotGet(CKM_RSA_PKCS_KEY_PAIR_GEN);
     PK11_Authenticate(slot, PR_TRUE, NULL /* default pwd callback */);
     privkey = PK11_GenerateKeyPair(slot, CKM_RSA_PKCS_KEY_PAIR_GEN, &params,
 				   &pubkey, PR_FALSE, PR_TRUE, NULL);
@@ -1525,7 +1530,7 @@

     ctx = xmlSecNssPKIKeyDataGetCtx(data);
     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);
+/*    xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);*/

     return(8 * SECKEY_PublicKeyStrength(ctx->pubkey));
 }
--- misc/xmlsec1-1.2.14/src/nss/symkeys.c	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/symkeys.c	2009-09-21 14:02:48.620574832 +0200
@@ -15,20 +15,41 @@
 #include <stdio.h>
 #include <string.h>

+#include <pk11func.h>
+#include <nss.h>
+
 #include <xmlsec/xmlsec.h>
 #include <xmlsec/xmltree.h>
+#include <xmlsec/base64.h>
 #include <xmlsec/keys.h>
 #include <xmlsec/keyinfo.h>
 #include <xmlsec/transforms.h>
 #include <xmlsec/errors.h>

 #include <xmlsec/nss/crypto.h>
+#include <xmlsec/nss/ciphers.h>
+#include <xmlsec/nss/tokens.h>

 /*****************************************************************************
  *
- * Symmetic (binary) keys - just a wrapper for xmlSecKeyDataBinary
+ * Symmetic (binary) keys - a wrapper over slot information and PK11SymKey
  *
  ****************************************************************************/
+typedef struct _xmlSecNssSymKeyDataCtx      xmlSecNssSymKeyDataCtx ;
+typedef struct _xmlSecNssSymKeyDataCtx*     xmlSecNssSymKeyDataCtxPtr ;
+
+struct _xmlSecNssSymKeyDataCtx {
+    CK_MECHANISM_TYPE       cipher ;    /* the symmetic key mechanism */
+    PK11SlotInfo*           slot ;      /* the key resident slot */
+    PK11SymKey*             symkey ;    /* the symmetic key */
+} ;
+
+#define xmlSecNssSymKeyDataSize \
+    ( sizeof( xmlSecKeyData ) + sizeof( xmlSecNssSymKeyDataCtx ) )
+
+#define xmlSecNssSymKeyDataGetCtx( data ) \
+    ( ( xmlSecNssSymKeyDataCtxPtr )( ( ( xmlSecByte* )( data ) ) + sizeof( xmlSecKeyData ) ) )
+
 static int	xmlSecNssSymKeyDataInitialize		(xmlSecKeyDataPtr data);
 static int	xmlSecNssSymKeyDataDuplicate		(xmlSecKeyDataPtr dst,
 							 xmlSecKeyDataPtr src);
@@ -67,107 +88,743 @@
     (xmlSecKeyDataIsValid((data)) && \
      xmlSecNssSymKeyDataKlassCheck((data)->id))

+/**
+ * xmlSecNssSymKeyDataAdoptKey:
+ * @data:                              the pointer to symmetric key data.
+ * @symkey:                            the symmetric key
+ *
+ * Set the value of symmetric key data.
+ *
+ * Returns 0 on success or a negative value if an error occurs.
+ */
+int
+xmlSecNssSymKeyDataAdoptKey(
+       xmlSecKeyDataPtr data ,
+       PK11SymKey* symkey
+) {
+       xmlSecNssSymKeyDataCtxPtr context = NULL ;
+
+       xmlSecAssert2( xmlSecNssSymKeyDataCheckId( data ), -1 ) ;
+       xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), -1 ) ;
+       xmlSecAssert2( symkey != NULL, -1 ) ;
+
+       context = xmlSecNssSymKeyDataGetCtx( data ) ;
+       xmlSecAssert2(context != NULL, -1);
+
+       context->cipher = PK11_GetMechanism( symkey ) ;
+
+       if( context->slot != NULL ) {
+               PK11_FreeSlot( context->slot ) ;
+               context->slot = NULL ;
+       }
+       context->slot = PK11_GetSlotFromKey( symkey ) ;
+
+       if( context->symkey != NULL ) {
+               PK11_FreeSymKey( context->symkey ) ;
+               context->symkey = NULL ;
+       }
+       context->symkey = PK11_ReferenceSymKey( symkey ) ;
+
+       return 0 ;
+}
+
+xmlSecKeyDataPtr xmlSecNssSymKeyDataKeyAdopt(
+    PK11SymKey*     symKey
+) {
+       xmlSecKeyDataPtr        data = NULL ;
+       CK_MECHANISM_TYPE       mechanism = CKM_INVALID_MECHANISM ;
+
+       xmlSecAssert2( symKey != NULL , NULL ) ;
+
+       mechanism = PK11_GetMechanism( symKey ) ;
+       switch( mechanism ) {
+               case CKM_DES3_KEY_GEN :
+               case CKM_DES3_CBC :
+               case CKM_DES3_MAC :
+                       data = xmlSecKeyDataCreate( xmlSecNssKeyDataDesId ) ;
+                       if( data == NULL ) {
+                               xmlSecError( XMLSEC_ERRORS_HERE ,
+                                       NULL ,
+                                       "xmlSecKeyDataCreate" ,
+                                       XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                                       "xmlSecNssKeyDataDesId" ) ;
+                               return NULL ;
+                       }
+                       break ;
+               case CKM_AES_KEY_GEN :
+               case CKM_AES_CBC :
+               case CKM_AES_MAC :
+                       data = xmlSecKeyDataCreate( xmlSecNssKeyDataAesId ) ;
+                       if( data == NULL ) {
+                               xmlSecError( XMLSEC_ERRORS_HERE ,
+                                       NULL ,
+                                       "xmlSecKeyDataCreate" ,
+                                       XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                                       "xmlSecNssKeyDataDesId" ) ;
+                               return NULL ;
+                       }
+                       break ;
+               default :
+                       xmlSecError( XMLSEC_ERRORS_HERE ,
+                               NULL ,
+                               NULL ,
+                               XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                               "Unsupported mechanism" ) ;
+                       return NULL ;
+       }
+
+       if( xmlSecNssSymKeyDataAdoptKey( data , symKey ) < 0 ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                       NULL ,
+                       "xmlSecNssSymKeyDataAdoptKey" ,
+                       XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                       XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+               xmlSecKeyDataDestroy( data ) ;
+               return NULL ;
+       }
+
+       return data ;
+}
+
+
+PK11SymKey*
+xmlSecNssSymKeyDataGetKey(
+    xmlSecKeyDataPtr data
+) {
+    xmlSecNssSymKeyDataCtxPtr ctx;
+    PK11SymKey* symkey ;
+
+    xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), NULL);
+    xmlSecAssert2(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize), NULL);
+
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, NULL);
+
+    if( ctx->symkey != NULL ) {
+        symkey = PK11_ReferenceSymKey( ctx->symkey ) ;
+    } else {
+        symkey = NULL ;
+    }
+
+    return(symkey);
+}
+
 static int
 xmlSecNssSymKeyDataInitialize(xmlSecKeyDataPtr data) {
+    xmlSecNssSymKeyDataCtxPtr ctx;
+
     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), -1);
-
-    return(xmlSecKeyDataBinaryValueInitialize(data));
+    xmlSecAssert2(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize), -1);
+
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, -1);
+
+    memset( ctx, 0, sizeof(xmlSecNssSymKeyDataCtx));
+
+    /* Set the block cipher mechanism */
+#ifndef XMLSEC_NO_DES
+    if(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDesId)) {
+        ctx->cipher = CKM_DES3_KEY_GEN;
+    } else
+#endif  /* XMLSEC_NO_DES */
+
+#ifndef XMLSEC_NO_AES
+    if(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDesId)) {
+        ctx->cipher = CKM_AES_KEY_GEN;
+    } else
+#endif  /* XMLSEC_NO_AES */
+
+    if(1) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
+            NULL ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            "Unsupported block cipher" ) ;
+        return(-1) ;
+    }
+
+    return(0);
 }

 static int
 xmlSecNssSymKeyDataDuplicate(xmlSecKeyDataPtr dst, xmlSecKeyDataPtr src) {
+    xmlSecNssSymKeyDataCtxPtr ctxDst;
+    xmlSecNssSymKeyDataCtxPtr ctxSrc;
+
     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(dst), -1);
+    xmlSecAssert2(xmlSecKeyDataCheckSize(dst, xmlSecNssSymKeyDataSize), -1);
     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(src), -1);
+    xmlSecAssert2(xmlSecKeyDataCheckSize(src, xmlSecNssSymKeyDataSize), -1);
     xmlSecAssert2(dst->id == src->id, -1);
-
-    return(xmlSecKeyDataBinaryValueDuplicate(dst, src));
+
+    ctxDst = xmlSecNssSymKeyDataGetCtx(dst);
+    xmlSecAssert2(ctxDst != NULL, -1);
+
+    ctxSrc = xmlSecNssSymKeyDataGetCtx(src);
+    xmlSecAssert2(ctxSrc != NULL, -1);
+
+    ctxDst->cipher = ctxSrc->cipher ;
+
+    if( ctxSrc->slot != NULL ) {
+        if( ctxDst->slot != NULL && ctxDst->slot != ctxSrc->slot ) {
+            PK11_FreeSlot( ctxDst->slot ) ;
+            ctxDst->slot = NULL ;
+        }
+
+        if( ctxDst->slot == NULL && ctxSrc->slot != NULL )
+            ctxDst->slot = PK11_ReferenceSlot( ctxSrc->slot ) ;
+    } else {
+        if( ctxDst->slot != NULL ) {
+            PK11_FreeSlot( ctxDst->slot ) ;
+            ctxDst->slot = NULL ;
+        }
+    }
+
+    if( ctxSrc->symkey != NULL ) {
+        if( ctxDst->symkey != NULL && ctxDst->symkey != ctxSrc->symkey ) {
+            PK11_FreeSymKey( ctxDst->symkey ) ;
+            ctxDst->symkey = NULL ;
+        }
+
+        if( ctxDst->symkey == NULL && ctxSrc->symkey != NULL )
+            ctxDst->symkey = PK11_ReferenceSymKey( ctxSrc->symkey ) ;
+    } else {
+        if( ctxDst->symkey != NULL ) {
+            PK11_FreeSymKey( ctxDst->symkey ) ;
+            ctxDst->symkey = NULL ;
+        }
+    }
+
+    return(0);
 }

 static void
 xmlSecNssSymKeyDataFinalize(xmlSecKeyDataPtr data) {
+    xmlSecNssSymKeyDataCtxPtr ctx;
+
     xmlSecAssert(xmlSecNssSymKeyDataCheckId(data));
-
-    xmlSecKeyDataBinaryValueFinalize(data);
+    xmlSecAssert(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize));
+
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert(ctx != NULL);
+
+    if( ctx->slot != NULL ) {
+        PK11_FreeSlot( ctx->slot ) ;
+        ctx->slot = NULL ;
+    }
+
+    if( ctx->symkey != NULL ) {
+        PK11_FreeSymKey( ctx->symkey ) ;
+        ctx->symkey = NULL ;
+    }
+
+    ctx->cipher = CKM_INVALID_MECHANISM ;
 }

 static int
 xmlSecNssSymKeyDataXmlRead(xmlSecKeyDataId id, xmlSecKeyPtr key,
 			       xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
-    xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1);
+    PK11SymKey* symKey ;
+    PK11SlotInfo* slot ;
+    xmlSecBufferPtr keyBuf;
+    xmlSecSize len;
+    xmlSecKeyDataPtr data;
+    xmlSecNssSymKeyDataCtxPtr ctx;
+    SECItem keyItem ;
+    int ret;
+
+    xmlSecAssert2(id != xmlSecKeyDataIdUnknown, -1);
+    xmlSecAssert2(key != NULL, -1);
+    xmlSecAssert2(node != NULL, -1);
+    xmlSecAssert2(keyInfoCtx != NULL, -1);
+
+    /* Create a new KeyData from a id */
+    data = xmlSecKeyDataCreate(id);
+    if(data == NULL ) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyDataCreate",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+        return(-1);
+    }
+
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, -1);
+
+    /* Create a buffer for raw symmetric key value */
+    if( ( keyBuf = xmlSecBufferCreate( 128 ) ) == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecBufferCreate" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+
+    /* Read the raw key value */
+    if( xmlSecBufferBase64NodeContentRead( keyBuf , node ) < 0 ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            xmlSecErrorsSafeString(xmlSecNodeGetName(node)),
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+        xmlSecBufferDestroy( keyBuf ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+
+    /* Get slot */
+    slot = xmlSecNssSlotGet(ctx->cipher);
+    if( slot == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecNssSlotGet" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+        xmlSecBufferDestroy( keyBuf ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+
+    /* Wrap the raw key value SECItem */
+    keyItem.type = siBuffer ;
+    keyItem.data = xmlSecBufferGetData( keyBuf ) ;
+    keyItem.len = xmlSecBufferGetSize( keyBuf ) ;
+
+    /* Import the raw key into slot temporalily and get the key handler*/
+    symKey = PK11_ImportSymKey(slot, ctx->cipher, PK11_OriginGenerated, CKA_VALUE, &keyItem, NULL ) ;
+    if( symKey == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "PK11_ImportSymKey" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+               PK11_FreeSlot( slot ) ;
+        xmlSecBufferDestroy( keyBuf ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+       PK11_FreeSlot( slot ) ;
+
+    /* raw key material has been copied into symKey, it isn't used any more */
+    xmlSecBufferDestroy( keyBuf ) ;
+
+    /* Adopt the symmetric key into key data */
+    ret = xmlSecNssSymKeyDataAdoptKey(data, symKey);
+    if(ret < 0) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyDataBinaryValueSetBuffer",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+        PK11_FreeSymKey( symKey ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1);
+    }
+    /* symKey has been duplicated into data, it isn't used any more */
+    PK11_FreeSymKey( symKey ) ;
+
+    /* Check value */
+    if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), data) != 1) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyReqMatchKeyValue",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+               xmlSecKeyDataDestroy( data ) ;
+        return(0);
+    }

-    return(xmlSecKeyDataBinaryValueXmlRead(id, key, node, keyInfoCtx));
+    ret = xmlSecKeySetValue(key, data);
+    if(ret < 0) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeySetValue",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1);
+    }
+
+    return(0);
 }

 static int
 xmlSecNssSymKeyDataXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
 				    xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
+    PK11SymKey* symKey ;
+
     xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1);
-
-    return(xmlSecKeyDataBinaryValueXmlWrite(id, key, node, keyInfoCtx));
+    xmlSecAssert2(key != NULL, -1);
+    xmlSecAssert2(node != NULL, -1);
+    xmlSecAssert2(keyInfoCtx != NULL, -1);
+
+       /* Get symmetric key from "key" */
+    symKey = xmlSecNssSymKeyDataGetKey(xmlSecKeyGetValue(key));
+    if( symKey != NULL ) {
+        SECItem* keyItem ;
+               xmlSecBufferPtr keyBuf ;
+
+               /* Extract raw key data from symmetric key */
+               if( PK11_ExtractKeyValue( symKey ) != SECSuccess ) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "PK11_ExtractKeyValue",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+               }
+
+               /* Get raw key data from "symKey" */
+        keyItem = PK11_GetKeyData( symKey ) ;
+           if(keyItem == NULL) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "PK11_GetKeyData",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+       }
+
+               /* Create key data buffer with raw kwy material */
+               keyBuf = xmlSecBufferCreate(keyItem->len) ;
+           if(keyBuf == NULL) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "xmlSecBufferCreate",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+       }
+
+               xmlSecBufferSetData( keyBuf , keyItem->data , keyItem->len ) ;
+
+               /* Write raw key material into current xml node */
+               if( xmlSecBufferBase64NodeContentWrite( keyBuf, node, XMLSEC_BASE64_LINESIZE ) < 0 ) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "xmlSecBufferBase64NodeContentWrite",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       xmlSecBufferDestroy(keyBuf);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+               }
+               xmlSecBufferDestroy(keyBuf);
+               PK11_FreeSymKey( symKey ) ;
+    }
+
+    return 0 ;
 }

 static int
 xmlSecNssSymKeyDataBinRead(xmlSecKeyDataId id, xmlSecKeyPtr key,
 				    const xmlSecByte* buf, xmlSecSize bufSize,
 				    xmlSecKeyInfoCtxPtr keyInfoCtx) {
-    xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1);
+    PK11SymKey* symKey ;
+    PK11SlotInfo* slot ;
+    xmlSecKeyDataPtr data;
+    xmlSecNssSymKeyDataCtxPtr ctx;
+    SECItem keyItem ;
+    int ret;
+
+    xmlSecAssert2(id != xmlSecKeyDataIdUnknown, -1);
+    xmlSecAssert2(key != NULL, -1);
+    xmlSecAssert2(buf != NULL, -1);
+    xmlSecAssert2(bufSize != 0, -1);
+    xmlSecAssert2(keyInfoCtx != NULL, -1);
+
+    /* Create a new KeyData from a id */
+    data = xmlSecKeyDataCreate(id);
+    if(data == NULL ) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyDataCreate",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+        return(-1);
+    }
+
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, -1);
+
+    /* Get slot */
+    slot = xmlSecNssSlotGet(ctx->cipher);
+    if( slot == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecNssSlotGet" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+
+    /* Wrap the raw key value SECItem */
+    keyItem.type = siBuffer ;
+    keyItem.data = buf ;
+    keyItem.len = bufSize ;
+
+    /* Import the raw key into slot temporalily and get the key handler*/
+    symKey = PK11_ImportSymKey(slot, ctx->cipher, PK11_OriginGenerated, CKA_VALUE, &keyItem, NULL ) ;
+    if( symKey == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "PK11_ImportSymKey" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+               PK11_FreeSlot( slot ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1) ;
+    }
+
+    /* Adopt the symmetric key into key data */
+    ret = xmlSecNssSymKeyDataAdoptKey(data, symKey);
+    if(ret < 0) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyDataBinaryValueSetBuffer",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+        PK11_FreeSymKey( symKey ) ;
+               PK11_FreeSlot( slot ) ;
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1);
+    }
+    /* symKey has been duplicated into data, it isn't used any more */
+    PK11_FreeSymKey( symKey ) ;
+       PK11_FreeSlot( slot ) ;
+
+    /* Check value */
+    if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), data) != 1) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeyReqMatchKeyValue",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+               xmlSecKeyDataDestroy( data ) ;
+        return(0);
+    }

-    return(xmlSecKeyDataBinaryValueBinRead(id, key, buf, bufSize, keyInfoCtx));
+    ret = xmlSecKeySetValue(key, data);
+    if(ret < 0) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+            xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+            "xmlSecKeySetValue",
+            XMLSEC_ERRORS_R_XMLSEC_FAILED,
+            XMLSEC_ERRORS_NO_MESSAGE);
+               xmlSecKeyDataDestroy( data ) ;
+        return(-1);
+    }
+
+    return(0);
 }

 static int
 xmlSecNssSymKeyDataBinWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
 				    xmlSecByte** buf, xmlSecSize* bufSize,
 				    xmlSecKeyInfoCtxPtr keyInfoCtx) {
+    PK11SymKey* symKey ;
+
     xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1);
+    xmlSecAssert2(key != NULL, -1);
+    xmlSecAssert2(buf != NULL, -1);
+    xmlSecAssert2(bufSize != 0, -1);
+    xmlSecAssert2(keyInfoCtx != NULL, -1);
+
+       /* Get symmetric key from "key" */
+    symKey = xmlSecNssSymKeyDataGetKey(xmlSecKeyGetValue(key));
+    if( symKey != NULL ) {
+        SECItem* keyItem ;
+
+               /* Extract raw key data from symmetric key */
+               if( PK11_ExtractKeyValue( symKey ) != SECSuccess ) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "PK11_ExtractKeyValue",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+               }
+
+               /* Get raw key data from "symKey" */
+        keyItem = PK11_GetKeyData( symKey ) ;
+           if(keyItem == NULL) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               "PK11_GetKeyData",
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                       XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+       }
+
+               *bufSize = keyItem->len;
+               *buf = ( xmlSecByte* )xmlMalloc( *bufSize );
+               if( *buf == NULL ) {
+               xmlSecError(XMLSEC_ERRORS_HERE,
+               xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+               NULL,
+               XMLSEC_ERRORS_R_XMLSEC_FAILED,
+               XMLSEC_ERRORS_NO_MESSAGE);
+                       PK11_FreeSymKey( symKey ) ;
+               return(-1);
+       }
+
+       memcpy((*buf), keyItem->data, (*bufSize));
+       PK11_FreeSymKey( symKey ) ;
+    }

-    return(xmlSecKeyDataBinaryValueBinWrite(id, key, buf, bufSize, keyInfoCtx));
+    return 0 ;
 }

 static int
 xmlSecNssSymKeyDataGenerate(xmlSecKeyDataPtr data, xmlSecSize sizeBits, xmlSecKeyDataType type ATTRIBUTE_UNUSED) {
-    xmlSecBufferPtr buffer;
+    PK11SymKey* symkey ;
+    PK11SlotInfo* slot ;
+    xmlSecNssSymKeyDataCtxPtr ctx;
+    int ret;

     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), -1);
     xmlSecAssert2(sizeBits > 0, -1);

-    buffer = xmlSecKeyDataBinaryValueGetBuffer(data);
-    xmlSecAssert2(buffer != NULL, -1);
-
-    return(xmlSecNssGenerateRandom(buffer, (sizeBits + 7) / 8));
+    ctx = xmlSecNssSymKeyDataGetCtx(data);
+    xmlSecAssert2(ctx != NULL, -1);
+
+    if( sizeBits % 8 != 0 ) {
+            xmlSecError(XMLSEC_ERRORS_HERE,
+         xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
+         NULL,
+         XMLSEC_ERRORS_R_XMLSEC_FAILED,
+         "Symmetric key size must be octuple");
+     return(-1);
+    }
+
+    /* Get slot */
+    slot = xmlSecNssSlotGet(ctx->cipher);
+    if( slot == NULL ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
+            "xmlSecNssSlotGet" ,
+            XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+        return(-1) ;
+    }
+
+    if( PK11_Authenticate( slot, PR_FALSE , NULL ) != SECSuccess ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                "PK11_Authenticate" ,
+                XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                XMLSEC_ERRORS_NO_MESSAGE ) ;
+            PK11_FreeSlot( slot ) ;
+            return -1 ;
+    }
+
+    symkey = PK11_KeyGen( slot , ctx->cipher , NULL , sizeBits/8 , NULL ) ;
+    if( symkey == NULL ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                "PK11_KeyGen" ,
+                XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                XMLSEC_ERRORS_NO_MESSAGE ) ;
+            PK11_FreeSlot( slot ) ;
+            return -1 ;
+    }
+
+    if( ctx->slot != NULL ) {
+            PK11_FreeSlot( ctx->slot ) ;
+            ctx->slot = NULL ;
+    }
+    ctx->slot = slot ;
+
+    if( ctx->symkey != NULL ) {
+            PK11_FreeSymKey( ctx->symkey ) ;
+            ctx->symkey = NULL ;
+    }
+    ctx->symkey = symkey ;
+
+    return 0;
 }

 static xmlSecKeyDataType
 xmlSecNssSymKeyDataGetType(xmlSecKeyDataPtr data) {
-    xmlSecBufferPtr buffer;
+    xmlSecNssSymKeyDataCtxPtr context = NULL ;
+    xmlSecKeyDataType type = xmlSecKeyDataTypeUnknown ;

     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), xmlSecKeyDataTypeUnknown);
+    xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), xmlSecKeyDataTypeUnknown ) ;

-    buffer = xmlSecKeyDataBinaryValueGetBuffer(data);
-    xmlSecAssert2(buffer != NULL, xmlSecKeyDataTypeUnknown);
+    context = xmlSecNssSymKeyDataGetCtx( data ) ;
+    if( context == NULL ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                "xmlSecNssSymKeyDataGetCtx" ,
+                XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return xmlSecKeyDataTypeUnknown ;
+    }

-    return((xmlSecBufferGetSize(buffer) > 0) ? xmlSecKeyDataTypeSymmetric : xmlSecKeyDataTypeUnknown);
+    if( context->symkey != NULL ) {
+            type |= xmlSecKeyDataTypeSymmetric ;
+    } else {
+            type |= xmlSecKeyDataTypeUnknown ;
+    }
+
+    return type ;
 }

 static xmlSecSize
 xmlSecNssSymKeyDataGetSize(xmlSecKeyDataPtr data) {
+    xmlSecNssSymKeyDataCtxPtr context ;
+    unsigned int    length = 0 ;
+
     xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), 0);
+    xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), 0 ) ;
+    context = xmlSecNssSymKeyDataGetCtx( data ) ;
+    if( context == NULL ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                "xmlSecNssSymKeyDataGetCtx" ,
+                XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return 0 ;
+    }
+
+    if( context->symkey != NULL ) {
+            length = PK11_GetKeyLength( context->symkey ) ;
+            length *= 8 ;
+    }

-    return(xmlSecKeyDataBinaryValueGetSize(data));
+    return length ;
 }

 static void
 xmlSecNssSymKeyDataDebugDump(xmlSecKeyDataPtr data, FILE* output) {
     xmlSecAssert(xmlSecNssSymKeyDataCheckId(data));

-    xmlSecKeyDataBinaryValueDebugDump(data, output);
+    /* print only size, everything else is sensitive */
+    fprintf( output , "=== %s: size=%d\n" , data->id->dataNodeName ,
+        xmlSecKeyDataGetSize(data)) ;
 }

 static void
 xmlSecNssSymKeyDataDebugXmlDump(xmlSecKeyDataPtr data, FILE* output) {
     xmlSecAssert(xmlSecNssSymKeyDataCheckId(data));
-
-    xmlSecKeyDataBinaryValueDebugXmlDump(data, output);
+
+    /* print only size, everything else is sensitive */
+    fprintf( output , "<%s size=\"%d\" />\n" , data->id->dataNodeName ,
+        xmlSecKeyDataGetSize(data)) ;
 }

 static int
@@ -201,7 +858,7 @@
  *************************************************************************/
 static xmlSecKeyDataKlass xmlSecNssKeyDataAesKlass = {
     sizeof(xmlSecKeyDataKlass),
-    xmlSecKeyDataBinarySize,
+    xmlSecNssSymKeyDataSize,

     /* data */
     xmlSecNameAESKeyValue,
@@ -282,7 +939,7 @@
  *************************************************************************/
 static xmlSecKeyDataKlass xmlSecNssKeyDataDesKlass = {
     sizeof(xmlSecKeyDataKlass),
-    xmlSecKeyDataBinarySize,
+    xmlSecNssSymKeyDataSize,

     /* data */
     xmlSecNameDESKeyValue,
@@ -364,7 +1021,7 @@
  *************************************************************************/
 static xmlSecKeyDataKlass xmlSecNssKeyDataHmacKlass = {
     sizeof(xmlSecKeyDataKlass),
-    xmlSecKeyDataBinarySize,
+    xmlSecNssSymKeyDataSize,

     /* data */
     xmlSecNameHMACKeyValue,
--- misc/xmlsec1-1.2.14/src/nss/tokens.c	2009-09-21 14:07:19.249145861 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/tokens.c	2009-09-21 14:02:48.556772442 +0200
@@ -1 +1,548 @@
-dummy
+/**
+ * XMLSec library
+ *
+ * This is free software; see Copyright file in the source
+ * distribution for preciese wording.
+ *
+ * Copyright..................................
+ *
+ * Contributor(s): _____________________________
+ *
+ */
+
+/**
+ * In order to ensure that particular crypto operation is performed on
+ * particular crypto device, a subclass of xmlSecList is used to store slot and
+ * mechanism information.
+ *
+ * In the list, a slot is bound with a mechanism. If the mechanism is available,
+ * this mechanism only can perform on the slot; otherwise, it can perform on
+ * every eligibl slot in the list.
+ *
+ * When try to find a slot for a particular mechanism, the slot bound with
+ * avaliable mechanism will be looked up firstly.
+ */
+#include "globals.h"
+#include <string.h>
+
+#include <xmlsec/xmlsec.h>
+#include <xmlsec/errors.h>
+#include <xmlsec/list.h>
+
+#include <xmlsec/nss/tokens.h>
+
+int
+xmlSecNssKeySlotSetMechList(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE_PTR mechanismList
+) {
+	int counter ;
+
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+
+	if( keySlot->mechanismList != CK_NULL_PTR ) {
+		xmlFree( keySlot->mechanismList ) ;
+
+		for( counter = 0 ; *( mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ;
+		keySlot->mechanismList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ;
+		if( keySlot->mechanismList == NULL ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			return( -1 );
+		}
+		for( ; counter >= 0 ; counter -- )
+			*( keySlot->mechanismList + counter ) = *(  mechanismList + counter ) ;
+	}
+
+	return( 0 );
+}
+
+int
+xmlSecNssKeySlotEnableMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE mechanism
+) {
+	int counter ;
+	CK_MECHANISM_TYPE_PTR newList ;
+
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+
+	if( mechanism != CKM_INVALID_MECHANISM ) {
+		for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ;
+		newList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ;
+		if( newList == NULL ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			return( -1 );
+		}
+		*( newList + counter + 1 ) = CKM_INVALID_MECHANISM ;
+		*( newList + counter ) = mechanism ;
+		for( counter -= 1 ; counter >= 0 ; counter -- )
+			*( newList + counter ) = *(  keySlot->mechanismList + counter ) ;
+
+		xmlFree( keySlot->mechanismList ) ;
+		keySlot->mechanismList = newList ;
+	}
+
+	return(0);
+}
+
+int
+xmlSecNssKeySlotDisableMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE mechanism
+) {
+	int counter ;
+
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+
+	for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) {
+		if( *( keySlot->mechanismList + counter ) == mechanism ) {
+			for( ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) {
+				*( keySlot->mechanismList + counter ) = *( keySlot->mechanismList + counter + 1 ) ;
+			}
+
+			break ;
+		}
+	}
+
+	return(0);
+}
+
+CK_MECHANISM_TYPE_PTR
+xmlSecNssKeySlotGetMechList(
+    xmlSecNssKeySlotPtr keySlot
+) {
+	if( keySlot != NULL )
+		return keySlot->mechanismList ;
+	else
+		return NULL ;
+}
+
+int
+xmlSecNssKeySlotSetSlot(
+    xmlSecNssKeySlotPtr keySlot ,
+	PK11SlotInfo* slot
+) {
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+
+	if( slot != NULL && keySlot->slot != slot ) {
+		if( keySlot->slot != NULL )
+			PK11_FreeSlot( keySlot->slot ) ;
+
+		if( keySlot->mechanismList != NULL ) {
+			xmlFree( keySlot->mechanismList ) ;
+			keySlot->mechanismList = NULL ;
+		}
+
+		keySlot->slot = PK11_ReferenceSlot( slot ) ;
+	}
+
+	return(0);
+}
+
+int
+xmlSecNssKeySlotInitialize(
+    xmlSecNssKeySlotPtr keySlot ,
+	PK11SlotInfo* slot
+) {
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+	xmlSecAssert2( keySlot->slot == NULL , -1 ) ;
+	xmlSecAssert2( keySlot->mechanismList == NULL , -1 ) ;
+
+	if( slot != NULL ) {
+		keySlot->slot = PK11_ReferenceSlot( slot ) ;
+	}
+
+	return(0);
+}
+
+void
+xmlSecNssKeySlotFinalize(
+    xmlSecNssKeySlotPtr keySlot
+) {
+	xmlSecAssert( keySlot != NULL ) ;
+
+	if( keySlot->mechanismList != NULL ) {
+		xmlFree( keySlot->mechanismList ) ;
+		keySlot->mechanismList = NULL ;
+	}
+
+	if( keySlot->slot != NULL ) {
+		PK11_FreeSlot( keySlot->slot ) ;
+		keySlot->slot = NULL ;
+	}
+
+}
+
+PK11SlotInfo*
+xmlSecNssKeySlotGetSlot(
+	xmlSecNssKeySlotPtr keySlot
+) {
+	if( keySlot != NULL )
+		return keySlot->slot ;
+	else
+		return NULL ;
+}
+
+xmlSecNssKeySlotPtr
+xmlSecNssKeySlotCreate() {
+	xmlSecNssKeySlotPtr keySlot ;
+
+	/* Allocates a new xmlSecNssKeySlot and fill the fields */
+	keySlot = ( xmlSecNssKeySlotPtr )xmlMalloc( sizeof( xmlSecNssKeySlot ) ) ;
+	if( keySlot == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			NULL ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( NULL );
+	}
+	memset( keySlot, 0, sizeof( xmlSecNssKeySlot ) ) ;
+
+	return( keySlot ) ;
+}
+
+int
+xmlSecNssKeySlotCopy(
+	xmlSecNssKeySlotPtr newKeySlot ,
+	xmlSecNssKeySlotPtr keySlot
+) {
+	CK_MECHANISM_TYPE_PTR mech ;
+	int counter ;
+
+	xmlSecAssert2( newKeySlot != NULL , -1 ) ;
+	xmlSecAssert2( keySlot != NULL , -1 ) ;
+
+	if( keySlot->slot != NULL && newKeySlot->slot != keySlot->slot ) {
+		if( newKeySlot->slot != NULL )
+			PK11_FreeSlot( newKeySlot->slot ) ;
+
+		newKeySlot->slot = PK11_ReferenceSlot( keySlot->slot ) ;
+	}
+
+	if( keySlot->mechanismList != CK_NULL_PTR ) {
+		xmlFree( newKeySlot->mechanismList ) ;
+
+		for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ;
+		newKeySlot->mechanismList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ;
+		if( newKeySlot->mechanismList == NULL ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			return( -1 );
+		}
+		for( ; counter >= 0 ; counter -- )
+			*( newKeySlot->mechanismList + counter ) = *(  keySlot->mechanismList + counter ) ;
+	}
+
+	return( 0 );
+}
+
+xmlSecNssKeySlotPtr
+xmlSecNssKeySlotDuplicate(
+	xmlSecNssKeySlotPtr keySlot
+) {
+	xmlSecNssKeySlotPtr newKeySlot ;
+	int ret ;
+
+	xmlSecAssert2( keySlot != NULL , NULL ) ;
+
+	newKeySlot = xmlSecNssKeySlotCreate() ;
+	if( newKeySlot == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			NULL ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( NULL );
+	}
+
+	if( xmlSecNssKeySlotCopy( newKeySlot, keySlot ) < 0 ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			NULL ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( NULL );
+	}
+
+	return( newKeySlot );
+}
+
+void
+xmlSecNssKeySlotDestroy(
+	    xmlSecNssKeySlotPtr keySlot
+) {
+	xmlSecAssert( keySlot != NULL ) ;
+
+	if( keySlot->mechanismList != NULL )
+		xmlFree( keySlot->mechanismList ) ;
+
+	if( keySlot->slot != NULL )
+		PK11_FreeSlot( keySlot->slot ) ;
+
+	xmlFree( keySlot ) ;
+}
+
+int
+xmlSecNssKeySlotBindMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE type
+) {
+	int counter ;
+
+	xmlSecAssert2( keySlot != NULL , 0 ) ;
+	xmlSecAssert2( keySlot->slot != NULL , 0 ) ;
+	xmlSecAssert2( type != CKM_INVALID_MECHANISM , 0 ) ;
+
+	for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) {
+		if( *( keySlot->mechanismList + counter ) == type )
+			return(1) ;
+	}
+
+	return( 0 ) ;
+}
+
+int
+xmlSecNssKeySlotSupportMech(
+	xmlSecNssKeySlotPtr keySlot ,
+	CK_MECHANISM_TYPE type
+) {
+	xmlSecAssert2( keySlot != NULL , 0 ) ;
+	xmlSecAssert2( keySlot->slot != NULL , 0 ) ;
+	xmlSecAssert2( type != CKM_INVALID_MECHANISM , 0 ) ;
+
+	if( PK11_DoesMechanism( keySlot->slot , type ) == PR_TRUE ) {
+		return(1);
+	} else
+		return(0);
+}
+
+void
+xmlSecNssKeySlotDebugDump(
+	xmlSecNssKeySlotPtr keySlot ,
+	FILE* output
+) {
+	xmlSecAssert( keySlot != NULL ) ;
+	xmlSecAssert( output != NULL ) ;
+
+	fprintf( output, "== KEY SLOT\n" );
+}
+
+void
+xmlSecNssKeySlotDebugXmlDump(
+	xmlSecNssKeySlotPtr keySlot ,
+	FILE* output
+) {
+}
+
+/**
+ * Key Slot List
+ */
+#ifdef __MINGW32__ // for runtime-pseudo-reloc
+static struct _xmlSecPtrListKlass xmlSecNssKeySlotPtrListKlass = {
+#else
+static xmlSecPtrListKlass xmlSecNssKeySlotPtrListKlass = {
+#endif
+    BAD_CAST "mechanism-list",
+    (xmlSecPtrDuplicateItemMethod)xmlSecNssKeySlotDuplicate,
+    (xmlSecPtrDestroyItemMethod)xmlSecNssKeySlotDestroy,
+    (xmlSecPtrDebugDumpItemMethod)xmlSecNssKeySlotDebugDump,
+    (xmlSecPtrDebugDumpItemMethod)xmlSecNssKeySlotDebugXmlDump,
+};
+
+xmlSecPtrListId
+xmlSecNssKeySlotListGetKlass(void) {
+    return(&xmlSecNssKeySlotPtrListKlass);
+}
+
+
+/*-
+ * Global PKCS#11 crypto token repository -- Key slot list
+ */
+static xmlSecPtrListPtr _xmlSecNssKeySlotList = NULL ;
+
+PK11SlotInfo*
+xmlSecNssSlotGet(
+	CK_MECHANISM_TYPE type
+) {
+	PK11SlotInfo*			slot = NULL ;
+	xmlSecNssKeySlotPtr		keySlot ;
+	xmlSecSize				ksSize ;
+	xmlSecSize				ksPos ;
+	char					flag ;
+
+	if( _xmlSecNssKeySlotList == NULL ) {
+		slot = PK11_GetBestSlot( type , NULL ) ;
+	} else {
+		ksSize = xmlSecPtrListGetSize( _xmlSecNssKeySlotList ) ;
+
+		/*-
+		 * Firstly, checking whether the mechanism is bound with a special slot.
+		 * If no bound slot, we try to find the first eligible slot in the list.
+		 */
+		for( flag = 0, ksPos = 0 ; ksPos < ksSize ; ksPos ++ ) {
+			keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( _xmlSecNssKeySlotList, ksPos ) ;
+			if( keySlot != NULL && xmlSecNssKeySlotBindMech( keySlot, type ) ) {
+				slot = xmlSecNssKeySlotGetSlot( keySlot ) ;
+				flag = 2 ;
+			} else if( flag == 0 && xmlSecNssKeySlotSupportMech( keySlot, type ) ) {
+				slot = xmlSecNssKeySlotGetSlot( keySlot ) ;
+				flag = 1 ;
+			}
+
+			if( flag == 2 )
+				break ;
+		}
+		if( slot != NULL )
+			slot = PK11_ReferenceSlot( slot ) ;
+	}
+
+	if( slot != NULL && PK11_NeedLogin( slot ) ) {
+		if( PK11_Authenticate( slot , PR_TRUE , NULL ) != SECSuccess ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			PK11_FreeSlot( slot ) ;
+			return( NULL );
+		}
+	}
+
+	return slot ;
+}
+
+int
+xmlSecNssSlotInitialize(
+	void
+) {
+	if( _xmlSecNssKeySlotList != NULL ) {
+		xmlSecPtrListDestroy( _xmlSecNssKeySlotList ) ;
+		_xmlSecNssKeySlotList = NULL ;
+	}
+
+	_xmlSecNssKeySlotList = xmlSecPtrListCreate( xmlSecNssKeySlotListId ) ;
+	if( _xmlSecNssKeySlotList == NULL ) {
+		xmlSecError( XMLSEC_ERRORS_HERE ,
+			NULL ,
+			NULL ,
+			XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+			XMLSEC_ERRORS_NO_MESSAGE ) ;
+		return( -1 );
+	}
+
+	return(0);
+}
+
+void
+xmlSecNssSlotShutdown(
+	void
+) {
+	if( _xmlSecNssKeySlotList != NULL ) {
+		xmlSecPtrListDestroy( _xmlSecNssKeySlotList ) ;
+		_xmlSecNssKeySlotList = NULL ;
+	}
+}
+
+int
+xmlSecNssSlotAdopt(
+	PK11SlotInfo* slot,
+	CK_MECHANISM_TYPE type
+) {
+	xmlSecNssKeySlotPtr		keySlot ;
+	xmlSecSize				ksSize ;
+	xmlSecSize				ksPos ;
+	char					flag ;
+
+	xmlSecAssert2( _xmlSecNssKeySlotList != NULL, -1 ) ;
+	xmlSecAssert2( slot != NULL, -1 ) ;
+
+	ksSize = xmlSecPtrListGetSize( _xmlSecNssKeySlotList ) ;
+
+	/*-
+	 * Firstly, checking whether the slot is in the repository already.
+	 */
+	flag = 0 ;
+	for( ksPos = 0 ; ksPos < ksSize ; ksPos ++ ) {
+		keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( _xmlSecNssKeySlotList, ksPos ) ;
+		/* If find the slot in the list */
+		if( keySlot != NULL && xmlSecNssKeySlotGetSlot( keySlot ) == slot ) {
+			/* If mechnism type is valid, bind the slot with the mechanism */
+			if( type != CKM_INVALID_MECHANISM ) {
+				if( xmlSecNssKeySlotEnableMech( keySlot, type ) < 0 ) {
+					xmlSecError( XMLSEC_ERRORS_HERE ,
+						NULL ,
+						NULL ,
+						XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+						XMLSEC_ERRORS_NO_MESSAGE ) ;
+					return(-1);
+				}
+			}
+
+			flag = 1 ;
+		}
+	}
+
+	/* If the slot do not in the list, add a new item to the list */
+	if( flag == 0 ) {
+		/* Create a new KeySlot */
+		keySlot = xmlSecNssKeySlotCreate() ;
+		if( keySlot == NULL ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			return(-1);
+		}
+
+		/* Initialize the keySlot with a slot */
+		if( xmlSecNssKeySlotInitialize( keySlot, slot ) < 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			xmlSecNssKeySlotDestroy( keySlot ) ;
+			return(-1);
+		}
+
+		/* If mechnism type is valid, bind the slot with the mechanism */
+		if( type != CKM_INVALID_MECHANISM ) {
+			if( xmlSecNssKeySlotEnableMech( keySlot, type ) < 0 ) {
+				xmlSecError( XMLSEC_ERRORS_HERE ,
+					NULL ,
+					NULL ,
+					XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+					XMLSEC_ERRORS_NO_MESSAGE ) ;
+				xmlSecNssKeySlotDestroy( keySlot ) ;
+				return(-1);
+			}
+		}
+
+		/* Add keySlot into the list */
+		if( xmlSecPtrListAdd( _xmlSecNssKeySlotList, keySlot ) < 0 ) {
+			xmlSecError( XMLSEC_ERRORS_HERE ,
+				NULL ,
+				NULL ,
+				XMLSEC_ERRORS_R_XMLSEC_FAILED ,
+				XMLSEC_ERRORS_NO_MESSAGE ) ;
+			xmlSecNssKeySlotDestroy( keySlot ) ;
+			return(-1);
+		}
+	}
+
+	return(0);
+}
+
--- misc/xmlsec1-1.2.14/src/nss/x509.c	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/x509.c	2009-09-21 14:02:48.642312431 +0200
@@ -34,7 +34,6 @@
 #include <xmlsec/keys.h>
 #include <xmlsec/keyinfo.h>
 #include <xmlsec/keysmngr.h>
-#include <xmlsec/x509.h>
 #include <xmlsec/base64.h>
 #include <xmlsec/errors.h>

@@ -61,33 +60,18 @@
 static int		xmlSecNssX509CertificateNodeRead	(xmlSecKeyDataPtr data,
 								 xmlNodePtr node,
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
-static int		xmlSecNssX509CertificateNodeWrite	(CERTCertificate* cert,
-								 xmlNodePtr node,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static int		xmlSecNssX509SubjectNameNodeRead	(xmlSecKeyDataPtr data,
 								 xmlNodePtr node,
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
-static int		xmlSecNssX509SubjectNameNodeWrite	(CERTCertificate* cert,
-								 xmlNodePtr node,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static int		xmlSecNssX509IssuerSerialNodeRead	(xmlSecKeyDataPtr data,
 								 xmlNodePtr node,
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
-static int		xmlSecNssX509IssuerSerialNodeWrite	(CERTCertificate* cert,
-								 xmlNodePtr node,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static int		xmlSecNssX509SKINodeRead		(xmlSecKeyDataPtr data,
 								 xmlNodePtr node,
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
-static int		xmlSecNssX509SKINodeWrite		(CERTCertificate* cert,
-								 xmlNodePtr node,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static int		xmlSecNssX509CRLNodeRead		(xmlSecKeyDataPtr data,
 								 xmlNodePtr node,
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
-static int		xmlSecNssX509CRLNodeWrite		(CERTSignedCrl* crl,
-								 xmlNodePtr node,
-								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static int		xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data,
 								xmlSecKeyPtr key,
 								xmlSecKeyInfoCtxPtr keyInfoCtx);
@@ -104,9 +88,6 @@
 								 xmlSecKeyInfoCtxPtr keyInfoCtx);
 static xmlChar*		xmlSecNssX509CrlBase64DerWrite		(CERTSignedCrl* crl,
 								 int base64LineWrap);
-static xmlChar*		xmlSecNssX509NameWrite			(CERTName* nm);
-static xmlChar*		xmlSecNssASN1IntegerWrite		(SECItem *num);
-static xmlChar*		xmlSecNssX509SKIWrite			(CERTCertificate* cert);
 static void		xmlSecNssX509CertDebugDump		(CERTCertificate* cert,
 								 FILE* output);
 static void		xmlSecNssX509CertDebugXmlDump		(CERTCertificate* cert,
@@ -752,31 +733,22 @@
 xmlSecNssKeyDataX509XmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key,
 				xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlSecKeyDataPtr data;
+    xmlNodePtr cur;
+    xmlChar* buf;
     CERTCertificate* cert;
     CERTSignedCrl* crl;
     xmlSecSize size, pos;
-    int content = 0;
-    int ret;

     xmlSecAssert2(id == xmlSecNssKeyDataX509Id, -1);
     xmlSecAssert2(key != NULL, -1);
     xmlSecAssert2(node != NULL, -1);
     xmlSecAssert2(keyInfoCtx != NULL, -1);

-    content = xmlSecX509DataGetNodeContent (node, 1, keyInfoCtx);
-    if (content < 0) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-		    "xmlSecX509DataGetNodeContent",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "content=%d", content);
-	return(-1);
-    } else if(content == 0) {
-	/* by default we are writing certificates and crls */
-	content = XMLSEC_X509DATA_DEFAULT;
+    /* todo: flag in ctx remove all existing content */
+    if(0) {
+        xmlNodeSetContent(node, NULL);
     }

-    /* get x509 data */
     data = xmlSecKeyGetData(key, id);
     if(data == NULL) {
 	/* no x509 data in the key */
@@ -796,79 +768,74 @@
 	    return(-1);
 	}

-	if((content & XMLSEC_X509DATA_CERTIFICATE_NODE) != 0) {
-	    ret = xmlSecNssX509CertificateNodeWrite(cert, node, keyInfoCtx);
-	    if(ret < 0) {
+	/* set base64 lines size from context */
+	buf = xmlSecNssX509CertBase64DerWrite(cert, keyInfoCtx->base64LineSize);
+	if(buf == NULL) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssX509CertificateNodeWrite",
+			    "xmlSecNssX509CertBase64DerWrite",
 			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
+			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
-	    }
 	}

-	if((content & XMLSEC_X509DATA_SUBJECTNAME_NODE) != 0) {
-	    ret = xmlSecNssX509SubjectNameNodeWrite(cert, node, keyInfoCtx);
-	    if(ret < 0) {
+	cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
+	if(cur == NULL) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssX509SubjectNameNodeWrite",
+			    "xmlSecAddChild",
 			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
+			    "node=%s",
+			    xmlSecErrorsSafeString(xmlSecNodeX509Certificate));
+		xmlFree(buf);
 		return(-1);
-	    }
 	}
+	/* todo: add \n around base64 data - from context */
+	/* todo: add errors check */
+	xmlNodeSetContent(cur, xmlSecStringCR);
+	xmlNodeSetContent(cur, buf);
+	xmlFree(buf);
+    }

-	if((content & XMLSEC_X509DATA_ISSUERSERIAL_NODE) != 0) {
-	    ret = xmlSecNssX509IssuerSerialNodeWrite(cert, node, keyInfoCtx);
-	    if(ret < 0) {
-		xmlSecError(XMLSEC_ERRORS_HERE,
-			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssX509IssuerSerialNodeWrite",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
-		return(-1);
-	    }
+    /* write crls */
+    size = xmlSecNssKeyDataX509GetCrlsSize(data);
+    for(pos = 0; pos < size; ++pos) {
+	crl = xmlSecNssKeyDataX509GetCrl(data, pos);
+	if(crl == NULL) {
+	    xmlSecError(XMLSEC_ERRORS_HERE,
+		xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+		"xmlSecNssKeyDataX509GetCrl",
+		XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		"pos=%d", pos);
+	    return(-1);
 	}

-	if((content & XMLSEC_X509DATA_SKI_NODE) != 0) {
-	    ret = xmlSecNssX509SKINodeWrite(cert, node, keyInfoCtx);
-	    if(ret < 0) {
-		xmlSecError(XMLSEC_ERRORS_HERE,
-			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssX509SKINodeWrite",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
-		return(-1);
-	    }
+        /* set base64 lines size from context */
+        buf = xmlSecNssX509CrlBase64DerWrite(crl, keyInfoCtx->base64LineSize);
+        if(buf == NULL) {
+	    xmlSecError(XMLSEC_ERRORS_HERE,
+		xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+		"xmlSecNssX509CrlBase64DerWrite",
+		XMLSEC_ERRORS_R_XMLSEC_FAILED,
+		XMLSEC_ERRORS_NO_MESSAGE);
+	    return(-1);
 	}
-    }

-    /* write crls if needed */
-    if((content & XMLSEC_X509DATA_CRL_NODE) != 0) {
-	size = xmlSecNssKeyDataX509GetCrlsSize(data);
-	for(pos = 0; pos < size; ++pos) {
-	    crl = xmlSecNssKeyDataX509GetCrl(data, pos);
-	    if(crl == NULL) {
-		xmlSecError(XMLSEC_ERRORS_HERE,
-			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssKeyDataX509GetCrl",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
-		return(-1);
-	    }
-
-	    ret = xmlSecNssX509CRLNodeWrite(crl, node, keyInfoCtx);
-	    if(ret < 0) {
-		xmlSecError(XMLSEC_ERRORS_HERE,
-			    xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
-			    "xmlSecNssX509CRLNodeWrite",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			    "pos=%d", pos);
-		return(-1);
-	    }
-	}
+        cur = xmlSecAddChild(node, xmlSecNodeX509CRL, xmlSecDSigNs);
+        if(cur == NULL) {
+            xmlSecError(XMLSEC_ERRORS_HERE,
+                        xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)),
+                        "xmlSecAddChild",
+                        XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                        "new_node=%s",
+                        xmlSecErrorsSafeString(xmlSecNodeX509CRL));
+            xmlFree(buf);
+            return(-1);
+        }
+        /* todo: add \n around base64 data - from context */
+        /* todo: add errors check */
+        xmlNodeSetContent(cur, xmlSecStringCR);
+        xmlNodeSetContent(cur, buf);
     }

     return(0);
@@ -1057,46 +1024,6 @@
     return(0);
 }

-static int
-xmlSecNssX509CertificateNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
-    xmlChar* buf;
-    xmlNodePtr cur;
-
-    xmlSecAssert2(cert != NULL, -1);
-    xmlSecAssert2(node != NULL, -1);
-    xmlSecAssert2(keyInfoCtx != NULL, -1);
-
-    /* set base64 lines size from context */
-    buf = xmlSecNssX509CertBase64DerWrite(cert, keyInfoCtx->base64LineSize);
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecNssX509CertBase64DerWrite",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-
-    cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs);
-    if(cur == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509Certificate));
-	xmlFree(buf);
-	return(-1);
-    }
-
-    /* todo: add \n around base64 data - from context */
-    /* todo: add errors check */
-    xmlNodeSetContent(cur, xmlSecStringCR);
-    xmlNodeSetContent(cur, buf);
-    xmlFree(buf);
-    return(0);
-}
-
 static int
 xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlSecKeyDataStorePtr x509Store;
@@ -1120,19 +1047,13 @@
     }

     subject = xmlNodeGetContent(node);
-    if((subject == NULL) || (xmlSecIsEmptyString(subject) == 1)) {
-	if(subject != NULL) {
-	    xmlFree(subject);
-	}
-	if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) {
+    if(subject == NULL) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 		        xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 			xmlSecErrorsSafeString(xmlSecNodeGetName(node)),
 			XMLSEC_ERRORS_R_INVALID_NODE_CONTENT,
 			XMLSEC_ERRORS_NO_MESSAGE);
 	    return(-1);
-	}
-	return(0);
     }

     cert = xmlSecNssX509StoreFindCert(x509Store, subject, NULL, NULL, NULL, keyInfoCtx);
@@ -1169,40 +1090,6 @@
     return(0);
 }

-static int
-xmlSecNssX509SubjectNameNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) {
-    xmlChar* buf = NULL;
-    xmlNodePtr cur = NULL;
-
-    xmlSecAssert2(cert != NULL, -1);
-    xmlSecAssert2(node != NULL, -1);
-
-    buf = xmlSecNssX509NameWrite(&(cert->subject));
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-	    NULL,
-	    "xmlSecNssX509NameWrite(&(cert->subject))",
-	    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-	    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-
-    cur = xmlSecAddChild(node, xmlSecNodeX509SubjectName, xmlSecDSigNs);
-    if(cur == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-	    NULL,
-	    "xmlSecAddChild",
-	    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-	    "node=%s",
-	    xmlSecErrorsSafeString(xmlSecNodeX509SubjectName));
-	xmlFree(buf);
-	return(-1);
-    }
-    xmlSecNodeEncodeAndSetContent(cur, buf);
-    xmlFree(buf);
-    return(0);
-}
-
 static int
 xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlSecKeyDataStorePtr x509Store;
@@ -1228,21 +1115,9 @@
     }

     cur = xmlSecGetNextElementNode(node->children);
-    if(cur == NULL) {
-	if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
-			xmlSecErrorsSafeString(xmlSecNodeX509IssuerName),
-			XMLSEC_ERRORS_R_NODE_NOT_FOUND,
-			"node=%s",
-			xmlSecErrorsSafeString(xmlSecNodeGetName(cur)));
-	    return(-1);
-	}
-	return(0);
-    }

     /* the first is required node X509IssuerName */
-    if(!xmlSecCheckNodeName(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs)) {
+    if((cur == NULL) || !xmlSecCheckNodeName(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs)) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 		    xmlSecErrorsSafeString(xmlSecNodeX509IssuerName),
@@ -1336,78 +1211,6 @@
     return(0);
 }

-static int
-xmlSecNssX509IssuerSerialNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) {
-    xmlNodePtr cur;
-    xmlNodePtr issuerNameNode;
-    xmlNodePtr issuerNumberNode;
-    xmlChar* buf;
-
-    xmlSecAssert2(cert != NULL, -1);
-    xmlSecAssert2(node != NULL, -1);
-
-    /* create xml nodes */
-    cur = xmlSecAddChild(node, xmlSecNodeX509IssuerSerial, xmlSecDSigNs);
-    if(cur == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509IssuerSerial));
-	return(-1);
-    }
-
-    issuerNameNode = xmlSecAddChild(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs);
-    if(issuerNameNode == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509IssuerName));
-	return(-1);
-    }
-
-    issuerNumberNode = xmlSecAddChild(cur, xmlSecNodeX509SerialNumber, xmlSecDSigNs);
-    if(issuerNumberNode == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509SerialNumber));
-	return(-1);
-    }
-
-    /* write data */
-    buf = xmlSecNssX509NameWrite(&(cert->issuer));
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecNssX509NameWrite(&(cert->issuer))",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-    xmlSecNodeEncodeAndSetContent(issuerNameNode, buf);
-    xmlFree(buf);
-
-    buf = xmlSecNssASN1IntegerWrite(&(cert->serialNumber));
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecNssASN1IntegerWrite(&(cert->serialNumber))",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-    xmlNodeSetContent(issuerNumberNode, buf);
-    xmlFree(buf);
-
-    return(0);
-}
-
 static int
 xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlSecKeyDataStorePtr x509Store;
@@ -1431,11 +1234,7 @@
     }

     ski = xmlNodeGetContent(node);
-    if((ski == NULL) || (xmlSecIsEmptyString(ski) == 1)) {
-	if(ski != NULL) {
-	    xmlFree(ski);
-	}
-	if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) {
+    if(ski == NULL) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 			xmlSecErrorsSafeString(xmlSecNodeGetName(node)),
@@ -1443,8 +1242,6 @@
 			"node=%s",
 			xmlSecErrorsSafeString(xmlSecNodeX509SKI));
 	    return(-1);
-	}
-	return(0);
     }

     cert = xmlSecNssX509StoreFindCert(x509Store, NULL, NULL, NULL, ski, keyInfoCtx);
@@ -1479,41 +1276,6 @@
     return(0);
 }

-static int
-xmlSecNssX509SKINodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) {
-    xmlChar *buf = NULL;
-    xmlNodePtr cur = NULL;
-
-    xmlSecAssert2(cert != NULL, -1);
-    xmlSecAssert2(node != NULL, -1);
-
-    buf = xmlSecNssX509SKIWrite(cert);
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecNssX509SKIWrite",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-
-    cur = xmlSecAddChild(node, xmlSecNodeX509SKI, xmlSecDSigNs);
-    if(cur == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "new_node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509SKI));
-	xmlFree(buf);
-	return(-1);
-    }
-    xmlSecNodeEncodeAndSetContent(cur, buf);
-    xmlFree(buf);
-
-    return(0);
-}
-
 static int
 xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlChar *content;
@@ -1524,19 +1286,13 @@
     xmlSecAssert2(keyInfoCtx != NULL, -1);

     content = xmlNodeGetContent(node);
-   if((content == NULL) || (xmlSecIsEmptyString(content) == 1)) {
-	if(content != NULL) {
-	    xmlFree(content);
-	}
-	if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) {
+    if(content == NULL){
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 			xmlSecErrorsSafeString(xmlSecNodeGetName(node)),
 			XMLSEC_ERRORS_R_INVALID_NODE_CONTENT,
 			XMLSEC_ERRORS_NO_MESSAGE);
 	    return(-1);
-	}
-	return(0);
     }

     crl = xmlSecNssX509CrlBase64DerRead(content, keyInfoCtx);
@@ -1556,47 +1312,6 @@
 }

 static int
-xmlSecNssX509CRLNodeWrite(CERTSignedCrl* crl, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) {
-    xmlChar* buf = NULL;
-    xmlNodePtr cur = NULL;
-
-    xmlSecAssert2(crl != NULL, -1);
-    xmlSecAssert2(node != NULL, -1);
-    xmlSecAssert2(keyInfoCtx != NULL, -1);
-
-    /* set base64 lines size from context */
-    buf = xmlSecNssX509CrlBase64DerWrite(crl, keyInfoCtx->base64LineSize);
-    if(buf == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecNssX509CrlBase64DerWrite",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(-1);
-    }
-
-    cur = xmlSecAddChild(node, xmlSecNodeX509CRL, xmlSecDSigNs);
-    if(cur == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecAddChild",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "new_node=%s",
-		    xmlSecErrorsSafeString(xmlSecNodeX509CRL));
-	xmlFree(buf);
-	return(-1);
-    }
-    /* todo: add \n around base64 data - from context */
-    /* todo: add errors check */
-    xmlNodeSetContent(cur, xmlSecStringCR);
-    xmlNodeSetContent(cur, buf);
-    xmlFree(buf);
-
-    return(0);
-}
-
-
-static int
 xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key,
 				    xmlSecKeyInfoCtxPtr keyInfoCtx) {
     xmlSecNssX509DataCtxPtr ctx;
@@ -1604,6 +1319,10 @@
     int ret;
     SECStatus status;
     PRTime notBefore, notAfter;
+
+    PK11SlotInfo* slot ;
+    SECKEYPublicKey *pubKey = NULL;
+    SECKEYPrivateKey *priKey = NULL;

     xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataX509Id), -1);
     xmlSecAssert2(key != NULL, -1);
@@ -1636,10 +1355,14 @@
 			    xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)),
 			    "CERT_DupCertificate",
 			    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			    XMLSEC_ERRORS_NO_MESSAGE);
+			    "error code=%d", PORT_GetError());
 		return(-1);
 	    }
-
+
+          /*-
+	   * Get Public key from cert, which does not always work for sign
+	   * action.
+           *
 	    keyValue = xmlSecNssX509CertGetKey(ctx->keyCert);
 	    if(keyValue == NULL) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
@@ -1649,6 +1372,54 @@
 			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
 	    }
+	   */
+            /*-
+             * I'll search key according to KeyReq.
+             */
+	    slot = cert->slot ;
+	    if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePrivate ) == xmlSecKeyDataTypePrivate ) {
+	        if( ( priKey = PK11_FindPrivateKeyFromCert( slot , cert , NULL ) ) == NULL ) {
+	                xmlSecError( XMLSEC_ERRORS_HERE ,
+	                    xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+	                    "PK11_FindPrivateKeyFromCert" ,
+	                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+	                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+	                return -1 ;
+	            }
+	    }
+
+            if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePublic ) == xmlSecKeyDataTypePublic ) {
+                if( ( pubKey = CERT_ExtractPublicKey( cert ) ) == NULL ) {
+                    xmlSecError( XMLSEC_ERRORS_HERE ,
+                        xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                        "CERT_ExtractPublicKey" ,
+                        XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                        XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+
+                    if( priKey != NULL )
+                        SECKEY_DestroyPrivateKey( priKey ) ;
+                    return -1 ;
+                }
+            }
+
+            keyValue = xmlSecNssPKIAdoptKey(priKey, pubKey);
+            if( keyValue == NULL ) {
+                xmlSecError( XMLSEC_ERRORS_HERE ,
+                xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) ,
+                "xmlSecNssPKIAdoptKey" ,
+                XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                XMLSEC_ERRORS_NO_MESSAGE ) ;
+
+                if( priKey != NULL )
+                    SECKEY_DestroyPrivateKey( priKey ) ;
+
+                if( pubKey != NULL )
+                    SECKEY_DestroyPublicKey( pubKey ) ;
+
+                return -1 ;
+            }
+            /* Modify keyValue get Done */

 	    /* verify that the key matches our expectations */
 	    if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), keyValue) != 1) {
@@ -1950,86 +1721,6 @@
     return(res);
 }

-static xmlChar*
-xmlSecNssX509NameWrite(CERTName* nm) {
-    xmlChar *res = NULL;
-    char *str;
-
-    xmlSecAssert2(nm != NULL, NULL);
-
-    str = CERT_NameToAscii(nm);
-    if (str == NULL) {
-        xmlSecError(XMLSEC_ERRORS_HERE,
-        	    NULL,
-        	    "CERT_NameToAscii",
-        	    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-        	    XMLSEC_ERRORS_NO_MESSAGE);
-        return(NULL);
-    }
-
-    res = xmlStrdup(BAD_CAST str);
-    if(res == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlStrdup",
-		    XMLSEC_ERRORS_R_MALLOC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	PORT_Free(str);
-	return(NULL);
-    }
-    PORT_Free(str);
-    return(res);
-}
-
-static xmlChar*
-xmlSecNssASN1IntegerWrite(SECItem *num) {
-    xmlChar *res = NULL;
-
-    xmlSecAssert2(num != NULL, NULL);
-
-    /* TODO : to be implemented after
-     * NSS bug http://bugzilla.mozilla.org/show_bug.cgi?id=212864 is fixed
-     */
-    return(res);
-}
-
-static xmlChar*
-xmlSecNssX509SKIWrite(CERTCertificate* cert) {
-    xmlChar *res = NULL;
-    SECItem ski;
-    SECStatus rv;
-
-    xmlSecAssert2(cert != NULL, NULL);
-
-    memset(&ski, 0, sizeof(ski));
-
-    rv = CERT_FindSubjectKeyIDExtension(cert, &ski);
-    if (rv != SECSuccess) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "CERT_FindSubjectKeyIDExtension",
-		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	SECITEM_FreeItem(&ski, PR_FALSE);
-	return(NULL);
-    }
-
-    res = xmlSecBase64Encode(ski.data, ski.len, 0);
-    if(res == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "xmlSecBase64Encode",
-	    	    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	SECITEM_FreeItem(&ski, PR_FALSE);
-	return(NULL);
-    }
-    SECITEM_FreeItem(&ski, PR_FALSE);
-
-    return(res);
-}
-
-
 static void
 xmlSecNssX509CertDebugDump(CERTCertificate* cert, FILE* output) {
     SECItem *sn;
--- misc/xmlsec1-1.2.14/src/nss/x509vfy.c	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/src/nss/x509vfy.c	2009-09-21 14:02:48.669245207 +0200
@@ -30,6 +30,7 @@
 #include <xmlsec/keyinfo.h>
 #include <xmlsec/keysmngr.h>
 #include <xmlsec/base64.h>
+#include <xmlsec/bn.h>
 #include <xmlsec/errors.h>

 #include <xmlsec/nss/crypto.h>
@@ -61,17 +62,7 @@

 static int		xmlSecNssX509StoreInitialize	(xmlSecKeyDataStorePtr store);
 static void		xmlSecNssX509StoreFinalize	(xmlSecKeyDataStorePtr store);
-static int 		xmlSecNssX509NameStringRead	(xmlSecByte **str,
-							 int *strLen,
-							 xmlSecByte *res,
-							 int resLen,
-							 xmlSecByte delim,
-							 int ingoreTrailingSpaces);
-static xmlSecByte * 	xmlSecNssX509NameRead		(xmlSecByte *str,
-							 int len);
-
-static void 		xmlSecNssNumToItem(SECItem *it, unsigned long num);
-
+static int		xmlSecNssIntegerToItem( const xmlChar* integer , SECItem *it ) ;

 static xmlSecKeyDataStoreKlass xmlSecNssX509StoreKlass = {
     sizeof(xmlSecKeyDataStoreKlass),
@@ -339,40 +330,28 @@
 xmlSecNssX509FindCert(xmlChar *subjectName, xmlChar *issuerName,
 		      xmlChar *issuerSerial, xmlChar *ski) {
     CERTCertificate *cert = NULL;
-    xmlChar         *p = NULL;
     CERTName *name = NULL;
     SECItem *nameitem = NULL;
     PRArenaPool *arena = NULL;

     if (subjectName != NULL) {
-	p = xmlSecNssX509NameRead(subjectName, xmlStrlen(subjectName));
-	if (p == NULL) {
-            xmlSecError(XMLSEC_ERRORS_HERE,
-                        NULL,
-                        "xmlSecNssX509NameRead",
-                        XMLSEC_ERRORS_R_XMLSEC_FAILED,
-                        "subject=%s",
-                        xmlSecErrorsSafeString(subjectName));
-	    goto done;
-	}
-
 	arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 	if (arena == NULL) {
             xmlSecError(XMLSEC_ERRORS_HERE,
                         NULL,
                         "PORT_NewArena",
                         XMLSEC_ERRORS_R_CRYPTO_FAILED,
-                        XMLSEC_ERRORS_NO_MESSAGE);
+                        "error code=%d", PORT_GetError());
 	    goto done;
 	}

-	name = CERT_AsciiToName((char*)p);
+	name = CERT_AsciiToName((char*)subjectName);
 	if (name == NULL) {
             xmlSecError(XMLSEC_ERRORS_HERE,
                         NULL,
                         "CERT_AsciiToName",
                         XMLSEC_ERRORS_R_XMLSEC_FAILED,
-                        XMLSEC_ERRORS_NO_MESSAGE);
+                        "error code=%d", PORT_GetError());
 	    goto done;
 	}

@@ -394,34 +373,23 @@
     if((issuerName != NULL) && (issuerSerial != NULL)) {
 	CERTIssuerAndSN issuerAndSN;

-	p = xmlSecNssX509NameRead(issuerName, xmlStrlen(issuerName));
-	if (p == NULL) {
-            xmlSecError(XMLSEC_ERRORS_HERE,
-                        NULL,
-                        "xmlSecNssX509NameRead",
-                        XMLSEC_ERRORS_R_XMLSEC_FAILED,
-                        "issuer=%s",
-                        xmlSecErrorsSafeString(issuerName));
-	    goto done;
-	}
-
 	arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 	if (arena == NULL) {
             xmlSecError(XMLSEC_ERRORS_HERE,
                         NULL,
                         "PORT_NewArena",
                         XMLSEC_ERRORS_R_CRYPTO_FAILED,
-                        XMLSEC_ERRORS_NO_MESSAGE);
+                        "error code=%d", PORT_GetError());
 	    goto done;
 	}

-	name = CERT_AsciiToName((char*)p);
+	name = CERT_AsciiToName((char*)issuerName);
 	if (name == NULL) {
             xmlSecError(XMLSEC_ERRORS_HERE,
                         NULL,
                         "CERT_AsciiToName",
                         XMLSEC_ERRORS_R_XMLSEC_FAILED,
-                        XMLSEC_ERRORS_NO_MESSAGE);
+                        "error code=%d", PORT_GetError());
 	    goto done;
 	}

@@ -441,8 +409,15 @@
 	issuerAndSN.derIssuer.data = nameitem->data;
 	issuerAndSN.derIssuer.len = nameitem->len;

-	/* TBD: serial num can be arbitrarily long */
-	xmlSecNssNumToItem(&issuerAndSN.serialNumber, PORT_Atoi((char *)issuerSerial));
+        if( xmlSecNssIntegerToItem( issuerSerial, &issuerAndSN.serialNumber ) < 0 ) {
+                xmlSecError(XMLSEC_ERRORS_HERE,
+                        NULL,
+                        "xmlSecNssIntegerToItem",
+                        XMLSEC_ERRORS_R_XMLSEC_FAILED,
+                        "serial number=%s",
+                        xmlSecErrorsSafeString(issuerSerial));
+                goto done;
+        }

 	cert = CERT_FindCertByIssuerAndSN(CERT_GetDefaultCertDB(),
 					  &issuerAndSN);
@@ -473,9 +448,6 @@
     }

 done:
-    if (p != NULL) {
-	PORT_Free(p);
-    }
     if (arena != NULL) {
 	PORT_FreeArena(arena, PR_FALSE);
     }
@@ -486,176 +458,6 @@
     return(cert);
 }

-static xmlSecByte *
-xmlSecNssX509NameRead(xmlSecByte *str, int len) {
-    xmlSecByte name[256];
-    xmlSecByte value[256];
-    xmlSecByte *retval = NULL;
-    xmlSecByte *p = NULL;
-    int nameLen, valueLen;
-
-    xmlSecAssert2(str != NULL, NULL);
-
-    /* return string should be no longer than input string */
-    retval = (xmlSecByte *)PORT_Alloc(len+1);
-    if(retval == NULL) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    "PORT_Alloc",
-		    XMLSEC_ERRORS_R_MALLOC_FAILED,
-		    XMLSEC_ERRORS_NO_MESSAGE);
-	return(NULL);
-    }
-    p = retval;
-
-    while(len > 0) {
-	/* skip spaces after comma or semicolon */
-	while((len > 0) && isspace(*str)) {
-	    ++str; --len;
-	}
-
-	nameLen = xmlSecNssX509NameStringRead(&str, &len, name, sizeof(name), '=', 0);
-	if(nameLen < 0) {
-	    xmlSecError(XMLSEC_ERRORS_HERE,
-			NULL,
-			"xmlSecNssX509NameStringRead",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			XMLSEC_ERRORS_NO_MESSAGE);
-	    goto done;
-	}
-	memcpy(p, name, nameLen);
-	p+=nameLen;
-	*p++='=';
-	if(len > 0) {
-	    ++str; --len;
-	    if((*str) == '\"') {
-		valueLen = xmlSecNssX509NameStringRead(&str, &len,
-					value, sizeof(value), '"', 1);
-		if(valueLen < 0) {
-		    xmlSecError(XMLSEC_ERRORS_HERE,
-				NULL,
-				"xmlSecNssX509NameStringRead",
-				XMLSEC_ERRORS_R_XMLSEC_FAILED,
-				XMLSEC_ERRORS_NO_MESSAGE);
-		    goto done;
-    		}
-		/* skip spaces before comma or semicolon */
-		while((len > 0) && isspace(*str)) {
-		    ++str; --len;
-		}
-		if((len > 0) && ((*str) != ',')) {
-		    xmlSecError(XMLSEC_ERRORS_HERE,
-				NULL,
-				NULL,
-				XMLSEC_ERRORS_R_INVALID_DATA,
-				"comma is expected");
-		    goto done;
-		}
-		if(len > 0) {
-		    ++str; --len;
-		}
-		*p++='\"';
-		memcpy(p, value, valueLen);
-		p+=valueLen;
-		*p++='\"';
-	    } else if((*str) == '#') {
-		/* TODO: read octect values */
-		xmlSecError(XMLSEC_ERRORS_HERE,
-			    NULL,
-			    NULL,
-			    XMLSEC_ERRORS_R_INVALID_DATA,
-			    "reading octect values is not implemented yet");
-		goto done;
-	    } else {
-		valueLen = xmlSecNssX509NameStringRead(&str, &len,
-					value, sizeof(value), ',', 1);
-		if(valueLen < 0) {
-		    xmlSecError(XMLSEC_ERRORS_HERE,
-				NULL,
-				"xmlSecNssX509NameStringRead",
-				XMLSEC_ERRORS_R_XMLSEC_FAILED,
-				XMLSEC_ERRORS_NO_MESSAGE);
-		    goto done;
-    		}
-		memcpy(p, value, valueLen);
-		p+=valueLen;
-		if (len > 0)
-		    *p++=',';
-	    }
-	} else {
-	    valueLen = 0;
-	}
-	if(len > 0) {
-	    ++str; --len;
-	}
-    }
-
-    *p = 0;
-    return(retval);
-
-done:
-    PORT_Free(retval);
-    return (NULL);
-}
-
-static int
-xmlSecNssX509NameStringRead(xmlSecByte **str, int *strLen,
-			    xmlSecByte *res, int resLen,
-			    xmlSecByte delim, int ingoreTrailingSpaces) {
-    xmlSecByte *p, *q, *nonSpace;
-
-    xmlSecAssert2(str != NULL, -1);
-    xmlSecAssert2(strLen != NULL, -1);
-    xmlSecAssert2(res != NULL, -1);
-
-    p = (*str);
-    nonSpace = q = res;
-    while(((p - (*str)) < (*strLen)) && ((*p) != delim) && ((q - res) < resLen)) {
-	if((*p) != '\\') {
-	    if(ingoreTrailingSpaces && !isspace(*p)) {
-		nonSpace = q;
-	    }
-	    *(q++) = *(p++);
-	} else {
-	    ++p;
-	    nonSpace = q;
-	    if(xmlSecIsHex((*p))) {
-		if((p - (*str) + 1) >= (*strLen)) {
-		    xmlSecError(XMLSEC_ERRORS_HERE,
-				NULL,
-				NULL,
-				XMLSEC_ERRORS_R_INVALID_DATA,
-				"two hex digits expected");
-	    	    return(-1);
-		}
-		*(q++) = xmlSecGetHex(p[0]) * 16 + xmlSecGetHex(p[1]);
-		p += 2;
-	    } else {
-		if(((++p) - (*str)) >= (*strLen)) {
-		    xmlSecError(XMLSEC_ERRORS_HERE,
-				NULL,
-				NULL,
-				XMLSEC_ERRORS_R_INVALID_DATA,
-				"escaped symbol missed");
-		    return(-1);
-		}
-		*(q++) = *(p++);
-	    }
-	}
-    }
-    if(((p - (*str)) < (*strLen)) && ((*p) != delim)) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    NULL,
-		    NULL,
-		    XMLSEC_ERRORS_R_INVALID_SIZE,
-		    "buffer is too small");
-	return(-1);
-    }
-    (*strLen) -= (p - (*str));
-    (*str) = p;
-    return((ingoreTrailingSpaces) ? nonSpace - res + 1 : q - res);
-}
-
 /* code lifted from NSS */
 static void
 xmlSecNssNumToItem(SECItem *it, unsigned long ui)
@@ -699,6 +501,77 @@
     it->len = len;
     PORT_Memcpy(it->data, bb + (sizeof(bb) - len), len);
 }
+
+static int
+xmlSecNssIntegerToItem(
+       const xmlChar* integer ,
+       SECItem *item
+) {
+    xmlSecBn bn ;
+    xmlSecSize i, length ;
+    const xmlSecByte* bnInteger ;
+
+    xmlSecAssert2( integer != NULL, -1 ) ;
+    xmlSecAssert2( item != NULL, -1 ) ;
+
+    if( xmlSecBnInitialize( &bn, 0 ) < 0 ) {
+        xmlSecError(XMLSEC_ERRORS_HERE,
+                       NULL,
+                       "xmlSecBnInitialize",
+                       XMLSEC_ERRORS_R_INVALID_DATA,
+                       XMLSEC_ERRORS_NO_MESSAGE);
+           return -1 ;
+    }
+
+    if( xmlSecBnFromDecString( &bn, integer ) < 0 ) {
+                   xmlSecError(XMLSEC_ERRORS_HERE,
+                               NULL,
+                               "xmlSecBnFromDecString",
+                               XMLSEC_ERRORS_R_INVALID_DATA,
+                               XMLSEC_ERRORS_NO_MESSAGE);
+        xmlSecBnFinalize( &bn ) ;
+        return -1 ;
+    }
+
+    length = xmlSecBnGetSize( &bn ) ;
+    if( length <= 0 ) {
+                   xmlSecError(XMLSEC_ERRORS_HERE,
+                               NULL,
+                               "xmlSecBnGetSize",
+                               XMLSEC_ERRORS_R_INVALID_DATA,
+                               XMLSEC_ERRORS_NO_MESSAGE);
+    }
+
+    bnInteger = xmlSecBnGetData( &bn ) ;
+    if( bnInteger == NULL ) {
+                   xmlSecError(XMLSEC_ERRORS_HERE,
+                               NULL,
+                               "xmlSecBnGetData",
+                               XMLSEC_ERRORS_R_INVALID_DATA,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+        xmlSecBnFinalize( &bn ) ;
+        return -1 ;
+    }
+
+    item->data = ( unsigned char * )PORT_Alloc( length );
+    if( item->data == NULL ) {
+                   xmlSecError(XMLSEC_ERRORS_HERE,
+                               NULL,
+                               "PORT_Alloc",
+                               XMLSEC_ERRORS_R_INVALID_DATA,
+                               XMLSEC_ERRORS_NO_MESSAGE ) ;
+        xmlSecBnFinalize( &bn ) ;
+        return -1 ;
+    }
+
+    item->len = length;
+    for( i = 0 ; i < length ; i ++ )
+        item->data[i] = *( bnInteger + i ) ;
+
+    xmlSecBnFinalize( &bn ) ;
+
+    return 0 ;
+}
 #endif /* XMLSEC_NO_X509 */


--- misc/xmlsec1-1.2.14/win32/Makefile.msvc	2009-06-25 22:53:18.000000000 +0200
+++ misc/build/xmlsec1-1.2.14/win32/Makefile.msvc	2009-09-21 14:02:48.607277908 +0200
@@ -218,6 +218,9 @@
 	$(XMLSEC_OPENSSL_INTDIR_A)\x509vfy.obj

 XMLSEC_NSS_OBJS = \
+	$(XMLSEC_NSS_INTDIR)\akmngr.obj\
+	$(XMLSEC_NSS_INTDIR)\keywrapers.obj\
+	$(XMLSEC_NSS_INTDIR)\tokens.obj\
 	$(XMLSEC_NSS_INTDIR)\app.obj\
 	$(XMLSEC_NSS_INTDIR)\bignum.obj\
 	$(XMLSEC_NSS_INTDIR)\ciphers.obj \
@@ -253,6 +256,7 @@
 	$(XMLSEC_NSS_INTDIR_A)\strings.obj

 XMLSEC_MSCRYPTO_OBJS = \
+	$(XMLSEC_MSCRYPTO_INTDIR)\akmngr.obj\
 	$(XMLSEC_MSCRYPTO_INTDIR)\app.obj\
 	$(XMLSEC_MSCRYPTO_INTDIR)\crypto.obj \
 	$(XMLSEC_MSCRYPTO_INTDIR)\ciphers.obj \