Programlama yapalım ve Öğrenelim. - Delphi Eğitim34
  Ana Sayfa
  .NET Eğitim Notları
  Visual C# .NET Örnek Kodları
  VisualBasic.NET Örnek Kodları
  J# Örnekleri
  ASP.NET Örnek Kodları
  Delphi Eğitim
  => Delphi Eğitim1
  => Delphi Eğitim2
  => Delphi Eğitim3
  => Delphi Eğitim4
  => Delphi Eğitim5
  => Delphi Eğitim6
  => Delphi Eğitim7
  => Delphi Eğitim8
  => Delphi Eğitim9
  => Delphi Eğitim10
  => Delphi Eğitim11
  => Delphi Eğitim13
  => Delphi Eğitim14
  => Delphi Eğitim15
  => Delphi Eğitim16
  => Delphi Eğitim17
  => Delphi Eğitim18
  => Delphi Eğitim19
  => Delphi Eğitim20
  => Delphi Eğitim21
  => Delphi Eğitim22
  => Delphi Eğitim23
  => Delphi Eğitim24
  => Delphi Eğitim25
  => Delphi Eğitim26
  => Delphi Eğitim27
  => Delphi Eğitim28
  => Delphi Eğitim29
  => Delphi Eğitim30
  => Delphi Eğtim31
  => Delphi Eğitim32
  => Delphi Eğitim33
  => Delphi Eğitim34
  => Delphi Eğitim35
  => Delphi Eğitim36
  => Delphi Eğitim37
  => Delphi Eğitim38
  => Delphi Eğitim39
  => Delphi Eğitim40
  => Delphi Eğitim41
  => Delphi Eğitim42
  => Delphi Eğitim43
  => Delphi Eğitim44
  => Delphi Eğitim45
  => Delphi Eğitim46
  => Delphi Eğitim47
  => Delphi Eğitim48
  => Delphi Eğitim49
  => Delphi Eğitim50
  => Delphi Eğitim51
  => Delphi Eğitim52
  => Delphi Eğitim53
  => Delphi Eğitim54
  => Delphi Eğitim55
  => Delphi Eğitim56
  => Delphi Eğitim57
  => Delphi Eğitim58
  => Delphi Eğitim59
  => Delphi Eğitim60
  => Delphi Eğitim61
  => Delphi Eğitim62
  => Delphi Eğitim63
  => Delphi Eğitim64
  => Delphi Eğitim65
  => Delphi Eğitim66
  => Delphi Eğitim67
  => Delphi Eğitim68
  => Delphi Eğitim69
  => Delphi Eğitim70
  => Delphi Eğitim71
  => Delphi Eğitim72
  => Delphi Eğitim73
  => Delphi Eğitim74
  => Delphi Eğitim75
  => Delphi Eğitim76
  => Delphi Eğitim77
  => Delphi Eğitim78
  => Delphi Eğitim79
  => Delphi Eğitim80
  => Delphi Eğitim81
  => Delphi Eğitim82
  => Delphi Eğitim83
  => Delphi Eğitim84
  => Delphi Eğitim85
  => Delphi Eğitim86
  => Delphi Eğitim87
  => Delphi Eğitim88
  => Delphi Eğitim89
  => Delphi Eğitim90
  => Delphi Eğitim91
  => Delphi Eğitim92
  => Delphi Eğitim93
  => Delphi Eğitim94
  => Delphi Eğitim95
  => Delphi Eğitim96
  => Delphi Eğitim97
  => Delphi Eğitim98
  => Delphi Eğitim99
  => Delphi Eğitim100
  => Delphi Eğitim101
  => Delphi Eğitim102
  => Delphi Eğitim103
  => Delphi Eğitim104
  => Delphi Eğitim105
  => Delphi Eğitim106
  => Delphi Eğitim107
  => Delphi Eğitim108
  => Delphi Eğitim109
  => Delphi Eğitim110
  => Delphi Eğitim111
  => Delphi Eğitim112
  => Delphi Eğitim113
  => Delphi Eğitim114
  => Delphi Eğitim115
  => Delphi Eğitim116
  => Delphi Eğitim117
  => Delphi Eğitim118
  => Delphi Eğitim119
  => Delphi Eğitim120
  => Delphi Eğitim121
  => Delphi Eğitim122
  => Delphi Eğitim123
  => Delphi Eğitim124
  => Delphi Eğitim125
  => Delphi Eğitim126
  => Delphi Eğitim127
  => Delphi Eğitim128
  => Delphi Eğitim129
  => Delphi Eğitim130
  => Delphi Eğitim131
  => Delphi Eğitim132
  => Delphi Eğitim133
  => Delphi Eğitim134
  => Delphi Eğitim135
  => Delphi Eğitim136
  => Delphi Eğitim137
  => Delphi Eğitim138
  => Delphi Eğitim139
  => Delphi Eğitim140
  => Delphi Eğitim141
  => Delphi Eğitim142
  => Delphi Eğitim143
  => Delphi Eğitim144
  => Delphi Eğitim145
  => Delphi Eğitim146
  => Delphi eğitim147
  => Delphi Eğitim148
  => Delphi Eğitim149
  => Delphi Eğitim150
  => Delphi Eğitim151
  => Delphi Eğitim152
  => Delphi Eğitim153
  => Delphi Eğitim154
  => Delphi Eğitim155
  => Delphi Eğitim156
  => Delphi Eğitim157
  => Delphi Eğitim158
  => Delphi Eğitim159
  => Delphi Eğitim160
  => Delphi Eğitim161
  => Delphi Eğitim162
  => Delphi Eğitim164
  => Delphi Eğitim165
  => Delphi Eğitim166
  => Delphi Eğitim167
  => Delphi Eğitim168
  => Delphi Eğitim169
  => Delphi Eğitim170
  => Delphi Eğitim171
  => Delphi Eğitim172
  => Delphi Eğitim173
  => Delphi Eğitim174
  => Delphi Eğitim175
  => Delphi Eğitim176
  => Delphi Eğitim177
  => Delphi Eğitim178
  => Delphi Eğitim179
  => Delphi Eğitim180
  => Delphi Eğitim181
  => Delphi Eğitim182
  => Delphi Eğitim183
  => Delphi Eğitim184
  => Delphi Eğitim185
  => Delphi Eğitim186
  => Delphi Eğitim187
  => Delphi Eğitim188
  => Delphi Eğitim189
  => Delphi Eğitim190
  => Delphi Eğitim191
  => Delphi Eğitim192
  => Delphi Eğitim193
  => Delphi Eğitim194
  => Delphi Eğitim195
  => Delphi Eğitim196
  => Delphi Eğitim197
  => Delphi Eğitim198
  => Delphi Eğitim199
  => Delphi Eğitim200
  => Delphi Eğitim201
  => Delphi Eğitim202
  => Delphi Eğitim203
  => Delphi Eğitim204
  => Delphi Eğitim205
  => Delphi Eğitim206
  => Delphi Eğitim207
  => Delphi Eğitim208
  => Delphi Eğitim209
  => Delphi Eğitim210
  => Delphi Eğitim211
  => Delphi Eğitim212
  => Delphi Eğitim213
  => Delphi Eğitim214
  => Delphi Eğitim215
  => Delphi Eğitim216
  => Delphi Eğitim217
  => Delphi Eğitim218
  => Delphi Eğitim219
  => Delphi Eğitim220
  => Delphi Eğitim221
  => Delphi Eğitim222
  => Delphi Eğitim223
  => Delphi Eğitim224
  => Delphi Eğitim225
  => Delphi Eğitim226
  => Delphi Eğitim227
  => Delphi Eğitim228
  => Delphi Eğitim229
  => Delphi Eğitim230
  => Delphi Eğitim231
  => Delphi Eğitim232
  => Delphi Eğitim233
  => Delphi Eğitim234
  => Delphi Eğitim235
  => Delphi Eğitim236
  => Delphi Eğitim237
  => Delphi Eğitim238
  => Delphi Eğitim239
  => Delphi Eğitim240
  => Delphi Eğitim241
  => Delphi Eğitim242
  İletişim

Explorera Button ekleme

///// commandx

 

procedure CreateExplorerButton(Path: string);

const

Tagit = '{10954C80-4F0F-11d3-B17C-00C0DFE39736}';

var

Reg: TRegistry;

Path: string;

Path1: string;

Merge: string;

begin

Path := 'c:your_program_path';

Reg := TRegistry.Create;

try

with Reg do

begin

RootKey := HKEY_LOCAL_MACHINE;

Path1 := 'SoftwareMicrosoftInternet ExplorerExtensions';

Merge := Path1 + Tagit;

OpenKey(Merge, True);

WriteString('ButtonText', 'ButtonText');

WriteString('MenuText', 'Tools Menu Item');

WriteString('MenuStatusBar', 'Run Script');

WriteString('ClSid', '{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}');

WriteString('Default Visible', 'Yes');

WriteString('Exec', Path + 'ProgramName.exe');

WriteString('HotIcon', ',4');

WriteString('Icon', ',4');

end

finally

Reg.CloseKey;

Reg.Free;

end;

end;

 

Delphi - .....................................

 

Cryptographic API interface.

NT sistemlerle gelen crypt api (crypt32.dll) yi programınız içersinden kullanarak

 

  CALG_MD2              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD2);

  CALG_MD4              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD4);

  CALG_MD5              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD5);

  CALG_SHA              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_SHA);

  CALG_SHA1             = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_SHA1);

  CALG_MAC              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MAC);

  CALG_RSA_SIGN         = (ALG_CLASS_SIGNATURE or ALG_TYPE_RSA or ALG_SID_RSA_ANY);

  CALG_DSS_SIGN         = (ALG_CLASS_SIGNATURE or ALG_TYPE_DSS or ALG_SID_DSS_ANY);

  CALG_RSA_KEYX         = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_RSA or ALG_SID_RSA_ANY);

  CALG_DES              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_DES);

  CALG_3DES_112         = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_3DES_112);

  CALG_3DES             = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_3DES);

  CALG_RC2              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_RC2);

  CALG_RC4              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_STREAM or ALG_SID_RC4);

  CALG_SEAL             = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_STREAM or ALG_SID_SEAL);

  CALG_DH_SF            = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_DH or ALG_SID_DH_SANDF);

  CALG_DH_EPHEM         = (ALG_CLASS_KEY_EXCHANGE  or  ALG_TYPE_DH  or  ALG_SID_DH_EPHEM);

  CALG_AGREEDKEY_ANY    = (ALG_CLASS_KEY_EXCHANGE  or ALG_TYPE_DH or ALG_SID_AGREED_KEY_ANY);

  CALG_KEA_KEYX         = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_DH or ALG_SID_KEA);

  CALG_HUGHES_MD5       = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_ANY or ALG_SID_MD5);

  CALG_SKIPJACK         = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_SKIPJACK);

  CALG_TEK              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_TEK);

  CALG_CYLINK_MEK       = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_CYLINK_MEK);

  CALG_SSL3_SHAMD5      = (ALG_CLASS_HASH  or  ALG_TYPE_ANY  or  ALG_SID_SSL3SHAMD5);

  CALG_SSL3_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SSL3_MASTER);

  CALG_SCHANNEL_MASTER_HASH = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_MASTER_HASH);

  CALG_SCHANNEL_MAC_KEY = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_MAC_KEY);

  CALG_SCHANNEL_ENC_KEY = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_ENC_KEY);

  CALG_PCT1_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_PCT1_MASTER);

  CALG_SSL2_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SSL2_MASTER);

  CALG_TLS1_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_TLS1_MASTER);

  CALG_RC5              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_RC5);

  CALG_HMAC             = (ALG_CLASS_HASH  or  ALG_TYPE_ANY  or  ALG_SID_HMAC);

 

  hash ve algoritmalar ile şifreleme yapma şansına sahip olursunuz uygulamanıza

  dcp tarzı crypt kütüphaneleride gömmenize gerek kalmaz.

  bu algoritmalar, konsol programcılığı ile uğraşanlar için güzel bir

  yoldur.

 

Function DoCrypt(Data, Password: string; DoCrypt: Boolean):String;

var

  hProv: HCRYPTPROV;

  hash: HCRYPTHASH;

  key: HCRYPTKEY;

  len: dWord;

 

begin

  CryptAcquireContext(@hProv, nil, nil, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);

  CryptCreateHash(hProv, CALG_SHA, 0, 0, @hash);

  CryptHashData(hash, @Password[1], Length(Password), 0);

  CryptDeriveKey(hProv, CALG_RC4, hash, 0, @key);

  CryptDestroyHash(hash);

  Try

  Len:=Length(Data);

  if DoCrypt then CryptEncrypt(key, 0, False, 0, @Data[1], @len, len)

                  else

                  CryptDecrypt(key, 0, False, 0, @Data[1], @len);

  finally

   Result:=Data;

  end;

  CryptReleaseContext(hProv, 0);

end;

 

şifreleme yapmak için örnek fonksiyon.

 

 "CALG_SHA" ve "CALG_RC4" baika hash / algoritma ile değiştirme şansınız var.

 

ShowMessage( DoCrypt('ben şifrelenecem ne güzel ','ŞİFRE123',TRUE) );

 

gibi kullanılır sondaki true verinin crypt yapılacağını false ise decrypt

yapılacağını belirtir. tabiki bu fonksiyonu kullanmak için uses e ExWcrypt2

unitini eklemeyi unutmamak gerek.

 

 

ExWcrypt2.pas

-------------

 

{******************************************************************}

{                                                                  }

{ Borland Delphi Runtime Library                                   }

{ Cryptographic API interface unit                                 }

{                                                                  }

{ Portions created by Microsoft are                                }

{ Copyright (C) 1993-1998 Microsoft Corporation.                   }

{ All Rights Reserved.                                             }

{                                                                  }

{ The original file is: wincrypt.h, 1992 - 1997                    }

{ The original Pascal code is: wcrypt2.pas, released 01 Jan 1998   }

{ The initial developer of the Pascal code is                      }

{  Massimo Maria Ghisalberti  (nissl@dada.it)                      }

{                                                                  }

{ Portions created by Massimo Maria Ghisalberti are                }

{ Copyright (C) 1997-1998 Massimo Maria Ghisalberti                }

{                                                                  }

{ Contributor(s):                                                  }

{     Peter Tang (peter.tang@citicorp.com)                         }

{     Phil Shrimpton (phil@shrimpton.co.uk)                        }

{                                                                  }

{ Obtained through:                                                }

{                                                                  }

{ Joint Endeavour of Delphi Innovators (Project JEDI)              }

{                                                                  }

{ You may retrieve the latest version of this file at the Project  }

{ JEDI home page, located at http://delphi-jedi.org                }

{                                                                  }

{ The contents of this file are used with permission, subject to   }

{ the Mozilla Public License Version 1.1 (the "License"); you may  }

{ not use this file except in compliance with the License. You may }

{ obtain a copy of the License at                                  }

{ http://www.mozilla.org/MPL/MPL-1.1.html                          }

{                                                                  }

{ Software distributed under the License is distributed on an      }

{ "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or   }

{ implied. See the License for the specific language governing     }

{ rights and limitations under the License.                        }

{                                                                  }

{******************************************************************}

 

unit wcrypt2;

 

{.DEFINE NT5}

 

{$ALIGN ON}

 

{$IFNDEF VER90}

  {$WEAKPACKAGEUNIT}

{$ENDIF}

 

interface

 

uses

  Windows

  {$IFDEF VER90}

  ,Ole2

  {$ENDIF};

 

const

  ADVAPI32    = 'advapi32.dll';

  CRYPT32     = 'crypt32.dll';

  SOFTPUB     = 'softpub.dll';

{$IFDEF NT5}

  ADVAPI32NT5 = 'advapi32.dll';

{$ENDIF}

 

{Support Type}

 

type

    PVOID = Pointer;

    LONG  = DWORD;

    {$IFDEF UNICODE}

      LPAWSTR = PWideChar;

    {$ELSE}

      LPAWSTR = PAnsiChar;

    {$ENDIF}

 

//-----------------------------------------------------------------------------

    // Type support for a pointer to an array of pointer (type **name)

    PLPSTR          = Pointer; // type for a pointer to Array of pointer a type

    PPCERT_INFO     = Pointer; // type for a pointer to Array of pointer a type

    PPVOID          = Pointer; // type for a pointer to Array of pointer a type

    PPCCERT_CONTEXT = Pointer; // type for a pointer to Array of pointer a type

    PPCCTL_CONTEXT  = Pointer; // type for a pointer to Array of pointer a type

    PPCCRL_CONTEXT  = Pointer; // type for a pointer to Array of pointer a type

//-----------------------------------------------------------------------------

 

//+---------------------------------------------------------------------------

//

//  Microsoft Windows

//  Copyright (C) Microsoft Corporation, 1992 - 1997.

//

//  File:       wincrypt.h

//

//  Contents:   Cryptographic API Prototypes and Definitions

//

//----------------------------------------------------------------------------

 

 

//

// Algorithm IDs and Flags

//

 

// ALG_ID crackers

function GET_ALG_CLASS(x:integer) :integer;

function GET_ALG_TYPE(x:integer) :integer;

function GET_ALG_SID(x:integer) :integer;

 

Const

  // Algorithm classes

  ALG_CLASS_ANY          = 0;

  ALG_CLASS_SIGNATURE    = (1 shl 13);

  ALG_CLASS_MSG_ENCRYPT  = (2 shl 13);

  ALG_CLASS_DATA_ENCRYPT = (3 shl 13);

  ALG_CLASS_HASH         = (4 shl 13);

  ALG_CLASS_KEY_EXCHANGE = (5 shl 13);

 

  // Algorithm types

  ALG_TYPE_ANY           = 0;

  ALG_TYPE_DSS           = (1 shl 9);

  ALG_TYPE_RSA           = (2 shl 9);

  ALG_TYPE_BLOCK         = (3 shl 9);

  ALG_TYPE_STREAM        = (4 shl 9);

  ALG_TYPE_DH            = (5 shl 9);

  ALG_TYPE_SECURECHANNEL = (6 shl 9);

 

  // Generic sub-ids

  ALG_SID_ANY = 0;

 

  // Some RSA sub-ids

  ALG_SID_RSA_ANY        = 0;

  ALG_SID_RSA_PKCS       = 1;

  ALG_SID_RSA_MSATWORK   = 2;

  ALG_SID_RSA_ENTRUST    = 3;

  ALG_SID_RSA_PGP        = 4;

 

  // Some DSS sub-ids

  ALG_SID_DSS_ANY        = 0;

  ALG_SID_DSS_PKCS       = 1;

  ALG_SID_DSS_DMS        = 2;

 

  // Block cipher sub ids

  // DES sub_ids

  ALG_SID_DES            = 1;

  ALG_SID_3DES           = 3;

  ALG_SID_DESX           = 4;

  ALG_SID_IDEA           = 5;

  ALG_SID_CAST           = 6;

  ALG_SID_SAFERSK64      = 7;

  ALD_SID_SAFERSK128     = 8;

  ALG_SID_SAFERSK128     = 8;

  ALG_SID_3DES_112       = 9;

  ALG_SID_CYLINK_MEK     = 12;

  ALG_SID_RC5            = 13;

 

  // Fortezza sub-ids

  ALG_SID_SKIPJACK       = 10;

  ALG_SID_TEK            = 11;

 

  // KP_MODE

  CRYPT_MODE_CBCI        = 6;  {ANSI CBC Interleaved}

  CRYPT_MODE_CFBP        = 7;  {ANSI CFB Pipelined}

  CRYPT_MODE_OFBP        = 8;  {ANSI OFB Pipelined}

  CRYPT_MODE_CBCOFM      = 9;  {ANSI CBC + OF Masking}

  CRYPT_MODE_CBCOFMI     = 10; {ANSI CBC + OFM Interleaved}

 

  // RC2 sub-ids

  ALG_SID_RC2            = 2;

 

  // Stream cipher sub-ids

  ALG_SID_RC4            = 1;

  ALG_SID_SEAL           = 2;

 

  // Diffie-Hellman sub-ids

  ALG_SID_DH_SANDF       = 1;

  ALG_SID_DH_EPHEM       = 2;

  ALG_SID_AGREED_KEY_ANY = 3;

  ALG_SID_KEA            = 4;

 

  // Hash sub ids

  ALG_SID_MD2            = 1;

  ALG_SID_MD4            = 2;

  ALG_SID_MD5            = 3;

  ALG_SID_SHA            = 4;

  ALG_SID_SHA1           = 4;

  ALG_SID_MAC            = 5;

  ALG_SID_RIPEMD         = 6;

  ALG_SID_RIPEMD160      = 7;

  ALG_SID_SSL3SHAMD5     = 8;

  ALG_SID_HMAC           = 9;

 

  // secure channel sub ids

  ALG_SID_SSL3_MASTER          = 1;

  ALG_SID_SCHANNEL_MASTER_HASH = 2;

  ALG_SID_SCHANNEL_MAC_KEY     = 3;

  ALG_SID_PCT1_MASTER          = 4;

  ALG_SID_SSL2_MASTER          = 5;

  ALG_SID_TLS1_MASTER          = 6;

  ALG_SID_SCHANNEL_ENC_KEY     = 7;

 

  // Our silly example sub-id

  ALG_SID_EXAMPLE              = 80;

 

{$IFNDEF ALGIDDEF}

  {$DEFINE ALGIDDEF}

Type ALG_ID = ULONG;

{$ENDIF}

 

// algorithm identifier definitions

Const

  CALG_MD2              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD2);

  CALG_MD4              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD4);

  CALG_MD5              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MD5);

  CALG_SHA              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_SHA);

  CALG_SHA1             = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_SHA1);

  CALG_MAC              = (ALG_CLASS_HASH or ALG_TYPE_ANY or ALG_SID_MAC);

  CALG_RSA_SIGN         = (ALG_CLASS_SIGNATURE or ALG_TYPE_RSA or ALG_SID_RSA_ANY);

  CALG_DSS_SIGN         = (ALG_CLASS_SIGNATURE or ALG_TYPE_DSS or ALG_SID_DSS_ANY);

  CALG_RSA_KEYX         = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_RSA or ALG_SID_RSA_ANY);

  CALG_DES              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_DES);

  CALG_3DES_112         = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_3DES_112);

  CALG_3DES             = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_3DES);

  CALG_RC2              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_RC2);

  CALG_RC4              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_STREAM or ALG_SID_RC4);

  CALG_SEAL             = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_STREAM or ALG_SID_SEAL);

  CALG_DH_SF            = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_DH or ALG_SID_DH_SANDF);

  CALG_DH_EPHEM         = (ALG_CLASS_KEY_EXCHANGE  or  ALG_TYPE_DH  or  ALG_SID_DH_EPHEM);

  CALG_AGREEDKEY_ANY    = (ALG_CLASS_KEY_EXCHANGE  or ALG_TYPE_DH or ALG_SID_AGREED_KEY_ANY);

  CALG_KEA_KEYX         = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_DH or ALG_SID_KEA);

  CALG_HUGHES_MD5       = (ALG_CLASS_KEY_EXCHANGE or ALG_TYPE_ANY or ALG_SID_MD5);

  CALG_SKIPJACK         = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_SKIPJACK);

  CALG_TEK              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_TEK);

  CALG_CYLINK_MEK       = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_CYLINK_MEK);

  CALG_SSL3_SHAMD5      = (ALG_CLASS_HASH  or  ALG_TYPE_ANY  or  ALG_SID_SSL3SHAMD5);

  CALG_SSL3_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SSL3_MASTER);

  CALG_SCHANNEL_MASTER_HASH = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_MASTER_HASH);

  CALG_SCHANNEL_MAC_KEY = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_MAC_KEY);

  CALG_SCHANNEL_ENC_KEY = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SCHANNEL_ENC_KEY);

  CALG_PCT1_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_PCT1_MASTER);

  CALG_SSL2_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_SSL2_MASTER);

  CALG_TLS1_MASTER      = (ALG_CLASS_MSG_ENCRYPT or ALG_TYPE_SECURECHANNEL or ALG_SID_TLS1_MASTER);

  CALG_RC5              = (ALG_CLASS_DATA_ENCRYPT or ALG_TYPE_BLOCK or ALG_SID_RC5);

  CALG_HMAC             = (ALG_CLASS_HASH  or  ALG_TYPE_ANY  or  ALG_SID_HMAC);

 

type

  PVTableProvStruc = ^VTableProvStruc;

  VTableProvStruc = record

    Version         :DWORD;

    FuncVerifyImage :TFarProc;

    FuncReturnhWnd  :TFarProc;

    dwProvType      :DWORD;

    pbContextInfo   :PBYTE;

    cbContextInfo   :DWORD;

end;

 

//type HCRYPTPROV = ULONG;

//type HCRYPTKEY  = ULONG;

//type HCRYPTHASH = ULONG;

 

 

const

  // dwFlags definitions for CryptAcquireContext

  CRYPT_VERIFYCONTEXT  = $F0000000;

  CRYPT_NEWKEYSET      = $00000008;

  CRYPT_DELETEKEYSET   = $00000010;

  CRYPT_MACHINE_KEYSET = $00000020;

 

  // dwFlag definitions for CryptGenKey

  CRYPT_EXPORTABLE     = $00000001;

  CRYPT_USER_PROTECTED = $00000002;

  CRYPT_CREATE_SALT    = $00000004;

  CRYPT_UPDATE_KEY     = $00000008;

  CRYPT_NO_SALT        = $00000010;

  CRYPT_PREGEN         = $00000040;

  CRYPT_RECIPIENT      = $00000010;

  CRYPT_INITIATOR      = $00000040;

  CRYPT_ONLINE         = $00000080;

  CRYPT_SF             = $00000100;

  CRYPT_CREATE_IV      = $00000200;

  CRYPT_KEK            = $00000400;

  CRYPT_DATA_KEY       = $00000800;

 

  // dwFlags definitions for CryptDeriveKey

  CRYPT_SERVER         = $00000400;

 

  KEY_LENGTH_MASK      = $FFFF0000;

 

  // dwFlag definitions for CryptExportKey

  CRYPT_Y_ONLY        = $00000001;

  CRYPT_SSL2_SLUMMING = $00000002;

 

  // dwFlags definitions for CryptHashSessionKey

  CRYPT_LITTLE_ENDIAN = $00000001;

 

  // dwFlag definitions for CryptSetProviderEx and CryptGetDefaultProvider

  CRYPT_MACHINE_DEFAULT = $00000001;

  CRYPT_USER_DEFAULT    = $00000002;

  CRYPT_DELETE_DEFAULT  = $00000004;

 

  // exported key blob definitions

  SIMPLEBLOB        = $1;

  PUBLICKEYBLOB     = $6;

  PRIVATEKEYBLOB    = $7;

  PLAINTEXTKEYBLOB  = $8;

  AT_KEYEXCHANGE    = 1;

  AT_SIGNATURE      = 2;

  CRYPT_USERDATA    = 1;

 

  // dwParam

  KP_IV                 = 1;  // Initialization vector

  KP_SALT               = 2;  // Salt value

  KP_PADDING            = 3;  // Padding values

  KP_MODE               = 4;  // Mode of the cipher

  KP_MODE_BITS          = 5;  // Number of bits to feedback

  KP_PERMISSIONS        = 6;  // Key permissions DWORD

  KP_ALGID              = 7;  // Key algorithm

  KP_BLOCKLEN           = 8;  // Block size of the cipher

  KP_KEYLEN             = 9;  // Length of key in bits

  KP_SALT_EX            = 10; // Length of salt in bytes

  KP_P                  = 11; // DSS/Diffie-Hellman P value

  KP_G                  = 12; // DSS/Diffie-Hellman G value

  KP_Q                  = 13; // DSS Q value

  KP_X                  = 14; // Diffie-Hellman X value

  KP_Y                  = 15; // Y value

  KP_RA                 = 16; // Fortezza RA value

  KP_RB                 = 17; // Fortezza RB value

  KP_INFO               = 18; // for putting information into an RSA envelope

  KP_EFFECTIVE_KEYLEN   = 19; // setting and getting RC2 effective key length

  KP_SCHANNEL_ALG = 20; // for setting the Secure Channel algorithms

  KP_CLIENT_RANDOM      = 21; // for setting the Secure Channel client random data

  KP_SERVER_RANDOM      = 22; // for setting the Secure Channel server random data

  KP_RP                 = 23;

  KP_PRECOMP_MD5        = 24;

  KP_PRECOMP_SHA        = 25;

  KP_CERTIFICATE        = 26; // for setting Secure Channel certificate data (PCT1)

  KP_CLEAR_KEY          = 27; // for setting Secure Channel clear key data (PCT1)

  KP_PUB_EX_LEN         = 28;

  KP_PUB_EX_VAL         = 29;

 

  // KP_PADDING

  PKCS5_PADDING         = 1; {PKCS 5 (sec 6.2) padding method}

  RANDOM_PADDING        = 2;

  ZERO_PADDING          = 3;

 

  // KP_MODE

  CRYPT_MODE_CBC    = 1; // Cipher block chaining

  CRYPT_MODE_ECB    = 2; // Electronic code book

  CRYPT_MODE_OFB    = 3; // Output feedback mode

  CRYPT_MODE_CFB    = 4; // Cipher feedback mode

  CRYPT_MODE_CTS    = 5; // Ciphertext stealing mode

 

  // KP_PERMISSIONS

  CRYPT_ENCRYPT     = $0001; // Allow encryption

  CRYPT_DECRYPT     = $0002; // Allow decryption

  CRYPT_EXPORT      = $0004; // Allow key to be exported

  CRYPT_READ        = $0008; // Allow parameters to be read

  CRYPT_WRITE       = $0010; // Allow parameters to be set

  CRYPT_MAC         = $0020; // Allow MACs to be used with key

  CRYPT_EXPORT_KEY  = $0040; // Allow key to be used for exporting keys

  CRYPT_IMPORT_KEY  = $0080; // Allow key to be used for importing keys

 

  HP_ALGID          = $0001; // Hash algorithm

  HP_HASHVAL        = $0002; // Hash value

  HP_HASHSIZE       = $0004; // Hash value size

 

  HP_HMAC_INFO      = $0005; // information for creating an HMAC

 

  CRYPT_FAILED      = FALSE;

  CRYPT_SUCCEED     = TRUE;

 

function RCRYPT_SUCCEEDED(rt:BOOL):BOOL;

function RCRYPT_FAILED(rt:BOOL):BOOL;

 

const

  // CryptGetProvParam

  PP_ENUMALGS            = 1;

  PP_ENUMCONTAINERS      = 2;

  PP_IMPTYPE             = 3;

  PP_NAME                = 4;

  PP_VERSION             = 5;

  PP_CONTAINER           = 6;

  PP_CHANGE_PASSWORD     = 7;

  PP_KEYSET_SEC_DESCR    = 8;  // get/set security descriptor of keyset

  PP_CERTCHAIN           = 9;  // for retrieving certificates from tokens

  PP_KEY_TYPE_SUBTYPE    = 10;

  PP_PROVTYPE            = 16;

  PP_KEYSTORAGE          = 17;

  PP_APPLI_CERT          = 18;

  PP_SYM_KEYSIZE         = 19;

  PP_SESSION_KEYSIZE     = 20;

  PP_UI_PROMPT           = 21;

  PP_ENUMALGS_EX         = 22;

  CRYPT_FIRST            = 1;

  CRYPT_NEXT             = 2;

  CRYPT_IMPL_HARDWARE    = 1;

  CRYPT_IMPL_SOFTWARE    = 2;

  CRYPT_IMPL_MIXED       = 3;

  CRYPT_IMPL_UNKNOWN     = 4;

 

  // key storage flags

  CRYPT_SEC_DESCR        = $00000001;

  CRYPT_PSTORE           = $00000002;

  CRYPT_UI_PROMPT        = $00000004;

 

  // protocol flags

  CRYPT_FLAG_PCT1        = $0001;

  CRYPT_FLAG_SSL2        = $0002;

  CRYPT_FLAG_SSL3        = $0004;

  CRYPT_FLAG_TLS1        = $0008;

 

  // CryptSetProvParam

  PP_CLIENT_HWND         = 1;

  PP_CONTEXT_INFO        = 11;

  PP_KEYEXCHANGE_KEYSIZE = 12;

  PP_SIGNATURE_KEYSIZE   = 13;

  PP_KEYEXCHANGE_ALG     = 14;

  PP_SIGNATURE_ALG       = 15;

  PP_DELETEKEY           = 24;

 

  PROV_RSA_FULL          = 1;

  PROV_RSA_SIG           = 2;

  PROV_DSS               = 3;

  PROV_FORTEZZA          = 4;

  PROV_MS_EXCHANGE       = 5;

  PROV_SSL               = 6;

 

PROV_RSA_SCHANNEL        = 12;

PROV_DSS_DH              = 13;

PROV_EC_ECDSA_SIG        = 14;

PROV_EC_ECNRA_SIG        = 15;

PROV_EC_ECDSA_FULL       = 16;

PROV_EC_ECNRA_FULL       = 17;

PROV_SPYRUS_LYNKS        = 20;

 

 

  // STT defined Providers

  PROV_STT_MER           = 7;

  PROV_STT_ACQ           = 8;

  PROV_STT_BRND          = 9;

  PROV_STT_ROOT          = 10;

  PROV_STT_ISS           = 11;

 

  // Provider friendly names

  MS_DEF_PROV_A          = 'Microsoft Base Cryptographic Provider v1.0';

  {$IFNDEF VER90}

    MS_DEF_PROV_W        = WideString( 'Microsoft Base Cryptographic Provider v1.0');

  {$ELSE}

    MS_DEF_PROV_W        = ( 'Microsoft Base Cryptographic Provider v1.0');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_DEF_PROV            = MS_DEF_PROV_W;

{$ELSE}

  MS_DEF_PROV            = MS_DEF_PROV_A;

{$ENDIF}

 

  MS_ENHANCED_PROV_A   = 'Microsoft Enhanced Cryptographic Provider v1.0';

  {$IFNDEF VER90}

    MS_ENHANCED_PROV_W = WideString('Microsoft Enhanced Cryptographic Provider v1.0');

  {$ELSE}

    MS_ENHANCED_PROV_W = ('Microsoft Enhanced Cryptographic Provider v1.0');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_ENHANCED_PROV = MS_ENHANCED_PROV_W;

{$ELSE}

  MS_ENHANCED_PROV = MS_ENHANCED_PROV_A;

{$ENDIF}

 

  MS_DEF_RSA_SIG_PROV_A    = 'Microsoft RSA Signature Cryptographic Provider';

  {$IFNDEF VER90}

    MS_DEF_RSA_SIG_PROV_W  = WideString('Microsoft RSA Signature Cryptographic Provider');

  {$ELSE}

    MS_DEF_RSA_SIG_PROV_W  = ('Microsoft RSA Signature Cryptographic Provider');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_DEF_RSA_SIG_PROV = MS_DEF_RSA_SIG_PROV_W;

{$ELSE}

  MS_DEF_RSA_SIG_PROV = MS_DEF_RSA_SIG_PROV_A;

{$ENDIF}

 

  MS_DEF_RSA_SCHANNEL_PROV_A    = 'Microsoft Base RSA SChannel Cryptographic Provider';

  {$IFNDEF VER90}

    MS_DEF_RSA_SCHANNEL_PROV_W  = WideString('Microsoft Base RSA SChannel Cryptographic Provider');

  {$ELSE}

    MS_DEF_RSA_SCHANNEL_PROV_W  = ('Microsoft Base RSA SChannel Cryptographic Provider');

  {$ENDIF}

 

 

{$IFDEF UNICODE}

  MS_DEF_RSA_SCHANNEL_PROV = MS_DEF_RSA_SCHANNEL_PROV_W;

{$ELSE}

  MS_DEF_RSA_SCHANNEL_PROV = MS_DEF_RSA_SCHANNEL_PROV_A;

{$ENDIF}

 

  MS_ENHANCED_RSA_SCHANNEL_PROV_A    = 'Microsoft Enhanced RSA SChannel Cryptographic Provider';

  {$IFNDEF VER90}

    MS_ENHANCED_RSA_SCHANNEL_PROV_W  = WideString('Microsoft Enhanced RSA SChannel Cryptographic Provider');

  {$ELSE}

    MS_ENHANCED_RSA_SCHANNEL_PROV_W  = ('Microsoft Enhanced RSA SChannel Cryptographic Provider');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_ENHANCED_RSA_SCHANNEL_PROV = MS_ENHANCED_RSA_SCHANNEL_PROV_W;

{$ELSE}

  MS_ENHANCED_RSA_SCHANNEL_PROV = MS_ENHANCED_RSA_SCHANNEL_PROV_A;

{$ENDIF}

 

  MS_DEF_DSS_PROV_A    =  'Microsoft Base DSS Cryptographic Provider';

  {$IFNDEF VER90}

    MS_DEF_DSS_PROV_W  = WideString('Microsoft Base DSS Cryptographic Provider');

  {$ELSE}

    MS_DEF_DSS_PROV_W  = ('Microsoft Base DSS Cryptographic Provider');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_DEF_DSS_PROV = MS_DEF_DSS_PROV_W;

{$ELSE}

  MS_DEF_DSS_PROV = MS_DEF_DSS_PROV_A;

{$ENDIF}

 

  MS_DEF_DSS_DH_PROV_A    = 'Microsoft Base DSS and Diffie-Hellman Cryptographic Provider';

  {$IFNDEF VER90}

    MS_DEF_DSS_DH_PROV_W  = WideString('Microsoft Base DSS and Diffie-Hellman Cryptographic Provider');

  {$ELSE}

    MS_DEF_DSS_DH_PROV_W  = ('Microsoft Base DSS and Diffie-Hellman Cryptographic Provider');

  {$ENDIF}

 

{$IFDEF UNICODE}

  MS_DEF_DSS_DH_PROV = MS_DEF_DSS_DH_PROV_W;

{$ELSE}

  MS_DEF_DSS_DH_PROV = MS_DEF_DSS_DH_PROV_A;

{$ENDIF}

 

  MAXUIDLEN              = 64;

  CUR_BLOB_VERSION       = 2;

 

{structure for use with CryptSetHashParam with CALG_HMAC}

type

  PHMAC_INFO = ^HMAC_INFO;

  HMAC_INFO = record

    HashAlgid     :ALG_ID;

    pbInnerString :PBYTE;

    cbInnerString :DWORD;

    pbOuterString :PBYTE;

    cbOuterString :DWORD;

  end;

 

// structure for use with CryptSetHashParam with CALG_HMAC

type

  PSCHANNEL_ALG = ^SCHANNEL_ALG;

  SCHANNEL_ALG  = record

    dwUse :DWORD;

    Algid :ALG_ID;

    cBits :DWORD;

  end;

 

// uses of algortihms for SCHANNEL_ALG structure

const

  SCHANNEL_MAC_KEY = $00000000;

  SCHANNEL_ENC_KEY = $00000001;

 

type

  PPROV_ENUMALGS = ^PROV_ENUMALGS;

  PROV_ENUMALGS = record

    aiAlgid   :ALG_ID;

    dwBitLen  :DWORD;

    dwNameLen :DWORD;

    szName    :array[0..20-1] of Char;

  end ;

 

type

  PPROV_ENUMALGS_EX = ^PROV_ENUMALGS_EX;

  PROV_ENUMALGS_EX = record

    aiAlgid       :ALG_ID;

    dwDefaultLen  :DWORD;

    dwMinLen      :DWORD;

    dwMaxLen      :DWORD;

    dwProtocols   :DWORD;

    dwNameLen     :DWORD;

    szName        :array[0..20-1] of Char;

    dwLongNameLen :DWORD;

    szLongName    :array[0..40-1] of Char;

    end;

 

type

  PPUBLICKEYSTRUC = ^PUBLICKEYSTRUC;

  PUBLICKEYSTRUC = record

    bType    :BYTE;

    bVersion :BYTE;

    reserved :Word;

    aiKeyAlg :ALG_ID;

  end;

 

type

  BLOBHEADER  = PUBLICKEYSTRUC;

  PBLOBHEADER = ^BLOBHEADER;

 

type

  PRSAPUBKEY = ^RSAPUBKEY;

  RSAPUBKEY = record

    magic  :DWORD;  // Has to be RSA1

    bitlen :DWORD;  // # of bits in modulus

    pubexp :DWORD;  // public exponent

                    // Modulus data follows

    end;

 

type

  PPUBKEY = ^PUBKEY;

  PUBKEY = record

    magic  :DWORD;

    bitlen :DWORD; // # of bits in modulus

  end;

 

type

  DHPUBKEY  = PUBKEY;

  DSSPUBKEY = PUBKEY;

  KEAPUBKEY = PUBKEY;

  TEKPUBKEY = PUBKEY;

 

 

type

  PDSSSEED = ^DSSSEED;

  DSSSEED = record

    counter :DWORD;

    seed    :array[0..20-1] of BYTE;

  end;

 

type

  PKEY_TYPE_SUBTYPE = ^KEY_TYPE_SUBTYPE;

  KEY_TYPE_SUBTYPE = record

    dwKeySpec :DWORD;

    Type_     :TGUID; {conflict with base Delphi type: original name 'Type'}

    Subtype   :TGUID;

  end;

 

type

  HCRYPTPROV  = ULONG;

  PHCRYPTPROV = ^HCRYPTPROV;

  HCRYPTKEY   = ULONG;

  PHCRYPTKEY  = ^HCRYPTKEY;

  HCRYPTHASH  = ULONG;

  PHCRYPTHASH = ^HCRYPTHASH;

 

function CryptAcquireContextA(phProv       :PHCRYPTPROV;

                              pszContainer :PAnsiChar;

                              pszProvider  :PAnsiChar;

                              dwProvType   :DWORD;

                              dwFlags      :DWORD) :BOOL;stdcall;

 

function CryptAcquireContext(phProv        :PHCRYPTPROV;

                              pszContainer :LPAWSTR;

                              pszProvider  :LPAWSTR;

                              dwProvType   :DWORD;

                              dwFlags      :DWORD) :BOOL;stdcall;

 

function CryptAcquireContextW(phProv       :PHCRYPTPROV;

                              pszContainer :PWideChar;

                              pszProvider  :PWideChar;

                              dwProvType   :DWORD;

                              dwFlags      :DWORD) :BOOL ;stdcall;

 

 

function CryptReleaseContext(hProv   :HCRYPTPROV;

                             dwFlags :DWORD) :BOOL;stdcall;

 

 

 

function CryptGenKey(hProv   :HCRYPTPROV;

                     Algid   :ALG_ID;

                     dwFlags :DWORD;

                     phKey   :PHCRYPTKEY) :BOOL;stdcall ;

 

 

function CryptDeriveKey(hProv     :HCRYPTPROV;

                        Algid     :ALG_ID;

                        hBaseData :HCRYPTHASH;

                        dwFlags   :DWORD;

                        phKey     :PHCRYPTKEY) :BOOL;stdcall ;

 

 

 

function CryptDestroyKey(hKey  :HCRYPTKEY) :BOOL;stdcall ;

 

 

function CryptSetKeyParam(hKey    :HCRYPTKEY;

                          dwParam :DWORD;

                          pbData  :PBYTE;

                          dwFlags :DWORD) :BOOL;stdcall;

 

 

function CryptGetKeyParam(hKey       :HCRYPTKEY;

                          dwParam    :DWORD;

                          pbData     :PBYTE;

                          pdwDataLen :PDWORD;

                          dwFlags    :DWORD) :BOOL;stdcall;

 

 

function CryptSetHashParam(hHash   :HCRYPTHASH;

                           dwParam :DWORD;

                           pbData  :PBYTE;

                           dwFlags :DWORD) :BOOL;stdcall;

 

 

function CryptGetHashParam(hHash      :HCRYPTHASH;

                           dwParam    :DWORD;

                           pbData     :PBYTE;

                           pdwDataLen :PDWORD;

                           dwFlags    :DWORD) :BOOL;stdcall;

 

 

function CryptSetProvParam(hProv   :HCRYPTPROV;

                           dwParam :DWORD;

                           pbData  :PBYTE;

                           dwFlags :DWORD) :BOOL;stdcall;

 

 

function CryptGetProvParam(hProv      :HCRYPTPROV;

                           dwParam    :DWORD;

                           pbData     :PBYTE;

                           pdwDataLen :PDWORD;

                           dwFlags    :DWORD) :BOOL;stdcall;

 

 

function CryptGenRandom(hProv    :HCRYPTPROV;

                        dwLen    :DWORD;

                        pbBuffer :PBYTE) :BOOL;stdcall;

 

 

function CryptGetUserKey(hProv     :HCRYPTPROV;

                         dwKeySpec :DWORD;

                         phUserKey :PHCRYPTKEY) :BOOL;stdcall;

 

 

function CryptExportKey(hKey       :HCRYPTKEY;

                        hExpKey    :HCRYPTKEY;

                        dwBlobType :DWORD;

                        dwFlags    :DWORD;

                        pbData     :PBYTE;

                        pdwDataLen :PDWORD) :BOOL;stdcall;

 

 

function CryptImportKey(hProv     :HCRYPTPROV;

                        pbData    :PBYTE;

                        dwDataLen :DWORD;

                        hPubKey   :HCRYPTKEY;

                        dwFlags   :DWORD;

                        phKey     :PHCRYPTKEY) :BOOL;stdcall;

 

 

function CryptEncrypt(hKey       :HCRYPTKEY;

                      hHash      :HCRYPTHASH;

                      Final      :BOOL;

                      dwFlags    :DWORD;

                      pbData     :PBYTE;

                      pdwDataLen :PDWORD;

                      dwBufLen   :DWORD) :BOOL;stdcall;

 

 

function CryptDecrypt(hKey       :HCRYPTKEY;

                      hHash      :HCRYPTHASH;

                      Final      :BOOL;

                      dwFlags    :DWORD;

                      pbData     :PBYTE;

                      pdwDataLen :PDWORD) :BOOL;stdcall;

 

 

function CryptCreateHash(hProv   :HCRYPTPROV;

                         Algid   :ALG_ID;

                         hKey    :HCRYPTKEY;

                         dwFlags :DWORD;

                         phHash  :PHCRYPTHASH) :BOOL;stdcall;

 

 

function CryptHashData(hHash       :HCRYPTHASH;

                 const pbData      :PBYTE;

                       dwDataLen   :DWORD;

                       dwFlags     :DWORD) :BOOL;stdcall;

 

 

function CryptHashSessionKey(hHash   :HCRYPTHASH;

                             hKey    :HCRYPTKEY;

                             dwFlags :DWORD) :BOOL;stdcall;

 

 

function CryptDestroyHash(hHash :HCRYPTHASH) :BOOL;stdcall;

 

 

function CryptSignHashA(hHash        :HCRYPTHASH;

                        dwKeySpec    :DWORD;

                        sDescription :PAnsiChar;

                        dwFlags      :DWORD;

                        pbSignature  :PBYTE;

                        pdwSigLen    :PDWORD) :BOOL;stdcall;

 

 

function CryptSignHash(hHash         :HCRYPTHASH;

                        dwKeySpec    :DWORD;

                        sDescription :LPAWSTR;

                        dwFlags      :DWORD;

                        pbSignature  :PBYTE;

                        pdwSigLen    :PDWORD) :BOOL;stdcall;

 

function CryptSignHashW(hHash        :HCRYPTHASH;

                        dwKeySpec    :DWORD;

                        sDescription :PWideChar;

                        dwFlags      :DWORD;

                        pbSignature  :PBYTE;

                        pdwSigLen    :PDWORD) :BOOL;stdcall;

 

function CryptSignHashU(hHash        :HCRYPTHASH;

                        dwKeySpec    :DWORD;

                        sDescription :PWideChar;

                        dwFlags      :DWORD;

                        pbSignature  :PBYTE;

                        pdwSigLen    :PDWORD) :BOOL;stdcall;

 

function CryptVerifySignatureA(hHash        :HCRYPTHASH;

                         const pbSignature  :PBYTE;

                               dwSigLen     :DWORD;

                               hPubKey      :HCRYPTKEY;

                               sDescription :PAnsiChar;

                               dwFlags      :DWORD) :BOOL;stdcall;

 

function CryptVerifySignature(hHash         :HCRYPTHASH;

                        const pbSignature  :PBYTE;

                              dwSigLen     :DWORD;

                              hPubKey      :HCRYPTKEY;

                              sDescription :LPAWSTR;

                               dwFlags      :DWORD) :BOOL;stdcall;

 

 

function CryptVerifySignatureW(hHash        :HCRYPTHASH;

                         const pbSignature  :PBYTE;

                               dwSigLen     :DWORD;

                               hPubKey      :HCRYPTKEY;

                               sDescription :PWideChar;

                               dwFlags      :DWORD) :BOOL;stdcall;

 

 

function CryptSetProviderA(pszProvName :PAnsiChar;

                           dwProvType  :DWORD) :BOOL;stdcall;

 

function CryptSetProvider(pszProvName :LPAWSTR;

                           dwProvType :DWORD) :BOOL;stdcall;

 

function CryptSetProviderW(pszProvName :PWideChar;

                           dwProvType  :DWORD) :BOOL;stdcall;

 

function CryptSetProviderU(pszProvName :PWideChar;

                           dwProvType  :DWORD) :BOOL;stdcall;

 

{$IFDEF NT5}

 

function CryptSetProviderExA(pszProvName :LPCSTR;

                             dwProvType  :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD):BOOL;stdcall;

 

function CryptSetProviderExW(pszProvName :LPCWSTR;

                             dwProvType  :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD):BOOL;stdcall;

 

function CryptSetProviderEx(pszProvName :LPAWSTR;

                            dwProvType  :DWORD;

                            pdwReserved :PDWORD;

                            dwFlags     :DWORD):BOOL;stdcall;

 

 

function CryptGetDefaultProviderA(dwProvType  :DWORD;

                                  pdwReserved :DWORD;

                                  dwFlags     :DWORD;

                                  pszProvName :LPSTR;

                                  pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptGetDefaultProviderW(dwProvType  :DWORD;

                                  pdwReserved :DWORD;

                                  dwFlags     :DWORD;

                                  pszProvName :LPWSTR;

                                  pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptGetDefaultProvider(dwProvType  :DWORD;

                                 pdwReserved :DWORD;

                                 dwFlags     :DWORD;

                                 pszProvName :LPAWSTR;

                                 pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProviderTypesA(dwIndex     :DWORD;

                                 pdwReserved :PDWORD;

                                 dwFlags     :DWORD;

                                 pdwProvType :PDWORD;

                                 pszTypeName :LPSTR;

                                 pcbTypeName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProviderTypesW(dwIndex     :DWORD;

                                 pdwReserved :PDWORD;

                                 dwFlags     :DWORD;

                                 pdwProvType :PDWORD;

                                 pszTypeName :LPWSTR;

                                 pcbTypeName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProviderTypes(dwIndex     :DWORD;

                                pdwReserved :PDWORD;

                                dwFlags     :DWORD;

                                pdwProvType :PDWORD;

                                pszTypeName :LPAWSTR;

                                pcbTypeName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProvidersA(dwIndex     :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD;

                             pdwProvType :PDWORD;

                             pszProvName :LPSTR;

                             pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProvidersW(dwIndex     :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD;

                             pdwProvType :PDWORD;

                             pszProvName :LPWSTR;

                             pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptEnumProviders(dwIndex      :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD;

                             pdwProvType :PDWORD;

                             pszProvName :LPAWSTR;

                             pcbProvName :PDWORD):BOOL ; stdcall;

 

function CryptContextAddRef(hProv       :HCRYPTPROV;

                            pdwReserved :PDWORD;

                            dwFlags     :DWORD):BOOL ; stdcall;

 

function CryptDuplicateKey(hKey        :HCRYPTKEY;

                           pdwReserved :PDWORD;

                           dwFlags     :DWORD;

                           phKey       :PHCRYPTKEY):BOOL ; stdcall;

 

function CryptDuplicateHash(hHash       :HCRYPTHASH;

                            pdwReserved :PDWORD;

                            dwFlags     :DWORD;

                            phHash      :PHCRYPTHASH):BOOL ; stdcall;

 

{$ENDIF NT5}

 

function CryptEnumProvidersU(dwIndex     :DWORD;

                             pdwReserved :PDWORD;

                             dwFlags     :DWORD;

                             pdwProvType :PDWORD;

                             pszProvName :LPWSTR;

                             pcbProvName :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  CRYPTOAPI BLOB definitions

//--------------------------------------------------------------------------

 

type

  PCRYPTOAPI_BLOB = ^CRYPTOAPI_BLOB;

  CRYPTOAPI_BLOB = record

    cbData :DWORD;

    pbData :PBYTE;

  end;

 

type

  CRYPT_INTEGER_BLOB            = CRYPTOAPI_BLOB;

  PCRYPT_INTEGER_BLOB           = ^CRYPT_INTEGER_BLOB;

  CRYPT_UINT_BLOB               = CRYPTOAPI_BLOB;

  PCRYPT_UINT_BLOB              = ^CRYPT_UINT_BLOB;

  CRYPT_OBJID_BLOB              = CRYPTOAPI_BLOB;

  PCRYPT_OBJID_BLOB             = ^CRYPT_OBJID_BLOB;

  CERT_NAME_BLOB                = CRYPTOAPI_BLOB;

  PCERT_NAME_BLOB               = ^CERT_NAME_BLOB;

  CERT_RDN_VALUE_BLOB           = CRYPTOAPI_BLOB;

  PCERT_RDN_VALUE_BLOB          = ^CERT_RDN_VALUE_BLOB;

  CERT_BLOB                     = CRYPTOAPI_BLOB;

  PCERT_BLOB                    = ^CERT_BLOB;

  CRL_BLOB                      = CRYPTOAPI_BLOB;

  PCRL_BLOB                     = ^CRL_BLOB;

  DATA_BLOB                     = CRYPTOAPI_BLOB;

  PDATA_BLOB                    = ^DATA_BLOB;     // JEFFJEFF temporary (too generic)

  CRYPT_DATA_BLOB               = CRYPTOAPI_BLOB;

  PCRYPT_DATA_BLOB              = ^CRYPT_DATA_BLOB;

  CRYPT_HASH_BLOB               = CRYPTOAPI_BLOB;

  PCRYPT_HASH_BLOB              = ^CRYPT_HASH_BLOB;

  CRYPT_DIGEST_BLOB             = CRYPTOAPI_BLOB;

  PCRYPT_DIGEST_BLOB            = ^CRYPT_DIGEST_BLOB;

  CRYPT_DER_BLOB                = CRYPTOAPI_BLOB;

  PCRYPT_DER_BLOB               = ^CRYPT_DER_BLOB;

  CRYPT_ATTR_BLOB               = CRYPTOAPI_BLOB;

  PCRYPT_ATTR_BLOB              = ^CRYPT_ATTR_BLOB;

 

//+-------------------------------------------------------------------------

//  In a CRYPT_BIT_BLOB the last byte may contain 0-7 unused bits. Therefore, the

//  overall bit length is cbData * 8 - cUnusedBits.

//--------------------------------------------------------------------------

 

type

  PCRYPT_BIT_BLOB = ^CRYPT_BIT_BLOB;

  CRYPT_BIT_BLOB = record

    cbData      :DWORD;

    pbData      :PBYTE;

    cUnusedBits :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  Type used for any algorithm

//

//  Where the Parameters CRYPT_OBJID_BLOB is in its encoded representation. For most

//  algorithm types, the Parameters CRYPT_OBJID_BLOB is NULL (Parameters.cbData = 0).

//--------------------------------------------------------------------------

 

type

  PCRYPT_ALGORITHM_IDENTIFIER = ^CRYPT_ALGORITHM_IDENTIFIER;

  CRYPT_ALGORITHM_IDENTIFIER = record

    pszObjId   :LPSTR;

    Parameters :CRYPT_OBJID_BLOB;

  end;

 

// Following are the definitions of various algorithm object identifiers

// RSA

const

  szOID_RSA         = '1.2.840.113549';

  szOID_PKCS        = '1.2.840.113549.1';

  szOID_RSA_HASH    = '1.2.840.113549.2';

  szOID_RSA_ENCRYPT = '1.2.840.113549.3';

 

  szOID_PKCS_1      = '1.2.840.113549.1.1';

  szOID_PKCS_2      = '1.2.840.113549.1.2';

  szOID_PKCS_3      = '1.2.840.113549.1.3';

  szOID_PKCS_4      = '1.2.840.113549.1.4';

  szOID_PKCS_5      = '1.2.840.113549.1.5';

  szOID_PKCS_6      = '1.2.840.113549.1.6';

  szOID_PKCS_7      = '1.2.840.113549.1.7';

  szOID_PKCS_8      = '1.2.840.113549.1.8';

  szOID_PKCS_9      = '1.2.840.113549.1.9';

  szOID_PKCS_10     = '1.2.840.113549.1.10';

 

  szOID_RSA_RSA     = '1.2.840.113549.1.1.1';

  szOID_RSA_MD2RSA  = '1.2.840.113549.1.1.2';

  szOID_RSA_MD4RSA  = '1.2.840.113549.1.1.3';

  szOID_RSA_MD5RSA  = '1.2.840.113549.1.1.4';

  szOID_RSA_SHA1RSA = '1.2.840.113549.1.1.5';

  szOID_RSA_SETOAEP_RSA  = '1.2.840.113549.1.1.6';

 

  szOID_RSA_data             = '1.2.840.113549.1.7.1';

  szOID_RSA_signedData       = '1.2.840.113549.1.7.2';

  szOID_RSA_envelopedData    = '1.2.840.113549.1.7.3';

  szOID_RSA_signEnvData      = '1.2.840.113549.1.7.4';

  szOID_RSA_digestedData     = '1.2.840.113549.1.7.5';

  szOID_RSA_hashedData       = '1.2.840.113549.1.7.5';

  szOID_RSA_encryptedData    = '1.2.840.113549.1.7.6';

 

  szOID_RSA_emailAddr           = '1.2.840.113549.1.9.1';

  szOID_RSA_unstructName        = '1.2.840.113549.1.9.2';

  szOID_RSA_contentType         = '1.2.840.113549.1.9.3';

  szOID_RSA_messageDigest       = '1.2.840.113549.1.9.4';

  szOID_RSA_signingTime         = '1.2.840.113549.1.9.5';

  szOID_RSA_counterSign         = '1.2.840.113549.1.9.6';

  szOID_RSA_challengePwd        = '1.2.840.113549.1.9.7';

  szOID_RSA_unstructAddr        = '1.2.840.113549.1.9.8';

  szOID_RSA_extCertAttrs        = '1.2.840.113549.1.9.9';

  szOID_RSA_SMIMECapabilities   = '1.2.840.113549.1.9.15';

  szOID_RSA_preferSignedData    = '1.2.840.113549.1.9.15.1';

 

  szOID_RSA_MD2 = '1.2.840.113549.2.2';

  szOID_RSA_MD4 = '1.2.840.113549.2.4';

  szOID_RSA_MD5 = '1.2.840.113549.2.5';

 

  szOID_RSA_RC2CBC        = '1.2.840.113549.3.2';

  szOID_RSA_RC4           = '1.2.840.113549.3.4';

  szOID_RSA_DES_EDE3_CBC  = '1.2.840.113549.3.7';

  szOID_RSA_RC5_CBCPad    = '1.2.840.113549.3.9';

 

// ITU-T UsefulDefinitions

  szOID_DS          = '2.5';

  szOID_DSALG       = '2.5.8';

  szOID_DSALG_CRPT  = '2.5.8.1';

  szOID_DSALG_HASH  = '2.5.8.2';

  szOID_DSALG_SIGN  = '2.5.8.3';

  szOID_DSALG_RSA   = '2.5.8.1.1';

 

// NIST OSE Implementors' Workshop (OIW)

// http://nemo.ncsl.nist.gov/oiw/agreements/stable/OSI/12s_9506.w51

// http://nemo.ncsl.nist.gov/oiw/agreements/working/OSI/12w_9503.w51

  szOID_OIW            = '1.3.14';

// NIST OSE Implementors' Workshop (OIW) Security SIG algorithm identifiers

  szOID_OIWSEC         = '1.3.14.3.2';

  szOID_OIWSEC_md4RSA  = '1.3.14.3.2.2';

  szOID_OIWSEC_md5RSA  = '1.3.14.3.2.3';

  szOID_OIWSEC_md4RSA2 = '1.3.14.3.2.4';

  szOID_OIWSEC_desECB  = '1.3.14.3.2.6';

  szOID_OIWSEC_desCBC  = '1.3.14.3.2.7';

  szOID_OIWSEC_desOFB  = '1.3.14.3.2.8';

  szOID_OIWSEC_desCFB  = '1.3.14.3.2.9';

  szOID_OIWSEC_desMAC  = '1.3.14.3.2.10';

  szOID_OIWSEC_rsaSign = '1.3.14.3.2.11';

  szOID_OIWSEC_dsa     = '1.3.14.3.2.12';

  szOID_OIWSEC_shaDSA  = '1.3.14.3.2.13';

  szOID_OIWSEC_mdc2RSA = '1.3.14.3.2.14';

  szOID_OIWSEC_shaRSA  = '1.3.14.3.2.15';

  szOID_OIWSEC_dhCommMod = '1.3.14.3.2.16';

  szOID_OIWSEC_desEDE    = '1.3.14.3.2.17';

  szOID_OIWSEC_sha       = '1.3.14.3.2.18';

  szOID_OIWSEC_mdc2      = '1.3.14.3.2.19';

  szOID_OIWSEC_dsaComm   = '1.3.14.3.2.20';

  szOID_OIWSEC_dsaCommSHA  = '1.3.14.3.2.21';

  szOID_OIWSEC_rsaXchg     = '1.3.14.3.2.22';

  szOID_OIWSEC_keyHashSeal = '1.3.14.3.2.23';

  szOID_OIWSEC_md2RSASign  = '1.3.14.3.2.24';

  szOID_OIWSEC_md5RSASign  = '1.3.14.3.2.25';

  szOID_OIWSEC_sha1        = '1.3.14.3.2.26';

  szOID_OIWSEC_dsaSHA1     = '1.3.14.3.2.27';

  szOID_OIWSEC_dsaCommSHA1 =  '1.3.14.3.2.28';

  szOID_OIWSEC_sha1RSASign =  '1.3.14.3.2.29';

// NIST OSE Implementors' Workshop (OIW) Directory SIG algorithm identifiers

  szOID_OIWDIR             = '1.3.14.7.2';

  szOID_OIWDIR_CRPT        = '1.3.14.7.2.1';

  szOID_OIWDIR_HASH        = '1.3.14.7.2.2';

  szOID_OIWDIR_SIGN        = '1.3.14.7.2.3';

  szOID_OIWDIR_md2         = '1.3.14.7.2.2.1';

  szOID_OIWDIR_md2RSA      = '1.3.14.7.2.3.1';

 

 

// INFOSEC Algorithms

// joint-iso-ccitt(2) country(16) us(840) organization(1) us-government(101) dod(2) id-infosec(1)

  szOID_INFOSEC                       = '2.16.840.1.101.2.1';

  szOID_INFOSEC_sdnsSignature         = '2.16.840.1.101.2.1.1.1';

  szOID_INFOSEC_mosaicSignature       = '2.16.840.1.101.2.1.1.2';

  szOID_INFOSEC_sdnsConfidentiality   = '2.16.840.1.101.2.1.1.3';

  szOID_INFOSEC_mosaicConfidentiality = '2.16.840.1.101.2.1.1.4';

  szOID_INFOSEC_sdnsIntegrity         = '2.16.840.1.101.2.1.1.5';

  szOID_INFOSEC_mosaicIntegrity       = '2.16.840.1.101.2.1.1.6';

  szOID_INFOSEC_sdnsTokenProtection   = '2.16.840.1.101.2.1.1.7';

  szOID_INFOSEC_mosaicTokenProtection = '2.16.840.1.101.2.1.1.8';

  szOID_INFOSEC_sdnsKeyManagement     = '2.16.840.1.101.2.1.1.9';

  szOID_INFOSEC_mosaicKeyManagement   = '2.16.840.1.101.2.1.1.10';

  szOID_INFOSEC_sdnsKMandSig          = '2.16.840.1.101.2.1.1.11';

  szOID_INFOSEC_mosaicKMandSig        = '2.16.840.1.101.2.1.1.12';

  szOID_INFOSEC_SuiteASignature       = '2.16.840.1.101.2.1.1.13';

  szOID_INFOSEC_SuiteAConfidentiality = '2.16.840.1.101.2.1.1.14';

  szOID_INFOSEC_SuiteAIntegrity       = '2.16.840.1.101.2.1.1.15';

  szOID_INFOSEC_SuiteATokenProtection = '2.16.840.1.101.2.1.1.16';

  szOID_INFOSEC_SuiteAKeyManagement   = '2.16.840.1.101.2.1.1.17';

  szOID_INFOSEC_SuiteAKMandSig        = '2.16.840.1.101.2.1.1.18';

  szOID_INFOSEC_mosaicUpdatedSig      = '2.16.840.1.101.2.1.1.19';

  szOID_INFOSEC_mosaicKMandUpdSig     = '2.16.840.1.101.2.1.1.20';

  szOID_INFOSEC_mosaicUpdatedInteg    = '2.16.840.1.101.2.1.1.21';

 

type

  PCRYPT_OBJID_TABLE = ^CRYPT_OBJID_TABLE;

  CRYPT_OBJID_TABLE = record

    dwAlgId  :DWORD;

    pszObjId :LPCSTR;

  end;

 

//+-------------------------------------------------------------------------

//  PKCS #1 HashInfo (DigestInfo)

//--------------------------------------------------------------------------

 

type

  PCRYPT_HASH_INFO = ^CRYPT_HASH_INFO;

  CRYPT_HASH_INFO = record

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    Hash :CRYPT_HASH_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  Type used for an extension to an encoded content

//

//  Where the Value's CRYPT_OBJID_BLOB is in its encoded representation.

//--------------------------------------------------------------------------

 

type

  PCERT_EXTENSION = ^CERT_EXTENSION;

  CERT_EXTENSION = record

    pszObjId :LPSTR;

    fCritical :BOOL;

    Value :CRYPT_OBJID_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  AttributeTypeValue

//

//  Where the Value's CRYPT_OBJID_BLOB is in its encoded representation.

//--------------------------------------------------------------------------

 

type

  PCRYPT_ATTRIBUTE_TYPE_VALUE =^CRYPT_ATTRIBUTE_TYPE_VALUE;

  CRYPT_ATTRIBUTE_TYPE_VALUE = record

    pszObjId :LPSTR;

    Value :CRYPT_OBJID_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  Attributes

//

//  Where the Value's PATTR_BLOBs are in their encoded representation.

//--------------------------------------------------------------------------

 

type

  PCRYPT_ATTRIBUTE = ^CRYPT_ATTRIBUTE;

  CRYPT_ATTRIBUTE = record

     pszObjId :LPSTR;

     cValue :DWORD;

     rgValue :PCRYPT_ATTR_BLOB;

  end;

 

type

  PCRYPT_ATTRIBUTES =^CRYPT_ATTRIBUTES;

  CRYPT_ATTRIBUTES = record

    cAttr  :DWORD; {IN}

    rgAttr :PCRYPT_ATTRIBUTE; {IN}

  end;

 

//+-------------------------------------------------------------------------

//  Attributes making up a Relative Distinguished Name (CERT_RDN)

//

//  The interpretation of the Value depends on the dwValueType.

//  See below for a list of the types.

//--------------------------------------------------------------------------

 

type

  PCERT_RDN_ATTR = ^CERT_RDN_ATTR;

  CERT_RDN_ATTR = record

    pszObjId :LPSTR;

    dwValueType :DWORD;

    Value :CERT_RDN_VALUE_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  CERT_RDN attribute Object Identifiers

//--------------------------------------------------------------------------

// Labeling attribute types:

const

  szOID_COMMON_NAME          = '2.5.4.3';  // case-ignore string

  szOID_SUR_NAME             = '2.5.4.4';  // case-ignore string

  szOID_DEVICE_SERIAL_NUMBER = '2.5.4.5';  // printable string

 

// Geographic attribute types:

  szOID_COUNTRY_NAME            = '2.5.4.6';  // printable 2char string

  szOID_LOCALITY_NAME           = '2.5.4.7';  // case-ignore string

  szOID_STATE_OR_PROVINCE_NAME  = '2.5.4.8';  // case-ignore string

  szOID_STREET_ADDRESS          = '2.5.4.9';  // case-ignore string

 

// Organizational attribute types:

  szOID_ORGANIZATION_NAME          = '2.5.4.10';// case-ignore string

  szOID_ORGANIZATIONAL_UNIT_NAME   = '2.5.4.11'; // case-ignore string

  szOID_TITLE                      = '2.5.4.12'; // case-ignore string

 

// Explanatory attribute types:

  szOID_DESCRIPTION          = '2.5.4.13'; // case-ignore string

  szOID_SEARCH_GUIDE         = '2.5.4.14';

  szOID_BUSINESS_CATEGORY    = '2.5.4.15'; // case-ignore string

 

// Postal addressing attribute types:

  szOID_POSTAL_ADDRESS       = '2.5.4.16';

  szOID_POSTAL_CODE          = '2.5.4.17'; // case-ignore string

  szOID_POST_OFFICE_BOX      = '2.5.4.18'; // case-ignore string

  szOID_PHYSICAL_DELIVERY_OFFICE_NAME = '2.5.4.19'; // case-ignore string

 

// Telecommunications addressing attribute types:

  szOID_TELEPHONE_NUMBER              = '2.5.4.20'; // telephone number

  szOID_TELEX_NUMBER                  = '2.5.4.21';

  szOID_TELETEXT_TERMINAL_IDENTIFIER  = '2.5.4.22';

  szOID_FACSIMILE_TELEPHONE_NUMBER    = '2.5.4.23';

  szOID_X21_ADDRESS                   = '2.5.4.24'; // numeric string

  szOID_INTERNATIONAL_ISDN_NUMBER     = '2.5.4.25'; // numeric string

  szOID_REGISTERED_ADDRESS            = '2.5.4.26';

  szOID_DESTINATION_INDICATOR         = '2.5.4.27'; // printable string

 

// Preference attribute types:

  szOID_PREFERRED_DELIVERY_METHOD     = '2.5.4.28';

 

// OSI application attribute types:

  szOID_PRESENTATION_ADDRESS          = '2.5.4.29';

  szOID_SUPPORTED_APPLICATION_CONTEXT = '2.5.4.30';

 

// Relational application attribute types:

  szOID_MEMBER                        = '2.5.4.31';

  szOID_OWNER                         = '2.5.4.32';

  szOID_ROLE_OCCUPANT                 = '2.5.4.33';

  szOID_SEE_ALSO                      = '2.5.4.34';

 

// Security attribute types:

  szOID_USER_PASSWORD                 = '2.5.4.35';

  szOID_USER_CERTIFICATE              = '2.5.4.36';

  szOID_CA_CERTIFICATE                = '2.5.4.37';

  szOID_AUTHORITY_REVOCATION_LIST     = '2.5.4.38';

  szOID_CERTIFICATE_REVOCATION_LIST   = '2.5.4.39';

  szOID_CROSS_CERTIFICATE_PAIR        = '2.5.4.40';

 

// Undocumented attribute types???

//#define szOID_???                         '2.5.4.41'

  szOID_GIVEN_NAME                    = '2.5.4.42'; // case-ignore string

  szOID_INITIALS                      = '2.5.4.43'; // case-ignore string

 

// Pilot user attribute types:

  szOID_DOMAIN_COMPONENT      = '0.9.2342.19200300.100.1.25'; // IA5 string

 

//+-------------------------------------------------------------------------

//  CERT_RDN Attribute Value Types

//

//  For RDN_ENCODED_BLOB, the Value's CERT_RDN_VALUE_BLOB is in its encoded

//  representation. Otherwise, its an array of bytes.

//

//  For all CERT_RDN types, Value.cbData is always the number of bytes, not

//  necessarily the number of elements in the string. For instance,

//  RDN_UNIVERSAL_STRING is an array of ints (cbData == intCnt * 4) and

//  RDN_BMP_STRING is an array of unsigned shorts (cbData == ushortCnt * 2).

//

//  For CertDecodeName, two 0 bytes are always appended to the end of the

//  string (ensures a CHAR or WCHAR string is null terminated).

//  These added 0 bytes are't included in the BLOB.cbData.

//--------------------------------------------------------------------------

 

const

  CERT_RDN_ANY_TYPE             = 0;

  CERT_RDN_ENCODED_BLOB         = 1;

  CERT_RDN_OCTET_STRING         = 2;

  CERT_RDN_NUMERIC_STRING       = 3;

  CERT_RDN_PRINTABLE_STRING     = 4;

  CERT_RDN_TELETEX_STRING       = 5;

  CERT_RDN_T61_STRING           = 5;

  CERT_RDN_VIDEOTEX_STRING      = 6;

  CERT_RDN_IA5_STRING           = 7;

  CERT_RDN_GRAPHIC_STRING       = 8;

  CERT_RDN_VISIBLE_STRING       = 9;

  CERT_RDN_ISO646_STRING        = 9;

  CERT_RDN_GENERAL_STRING       = 10;

  CERT_RDN_UNIVERSAL_STRING     = 11;

  CERT_RDN_INT4_STRING          = 11;

  CERT_RDN_BMP_STRING           = 12;

  CERT_RDN_UNICODE_STRING       = 12;

 

 

// Macro to check that the dwValueType is a character string and not an

// encoded blob or octet string

function IS_CERT_RDN_CHAR_STRING(X :DWORD) :BOOL;

 

//+-------------------------------------------------------------------------

//  A CERT_RDN consists of an array of the above attributes

//--------------------------------------------------------------------------

 

type

  PCERT_RDN = ^CERT_RDN;

  CERT_RDN = record

    cRDNAttr :DWORD;

    rgRDNAttr :PCERT_RDN_ATTR;

  end;

 

//+-------------------------------------------------------------------------

//  Information stored in a subject's or issuer's name. The information

//  is represented as an array of the above RDNs.

//--------------------------------------------------------------------------

 

type

  PCERT_NAME_INFO = ^CERT_NAME_INFO;

  CERT_NAME_INFO = record

    cRDN :DWORD;

    rgRDN :PCERT_RDN;

  end;

 

//+-------------------------------------------------------------------------

//  Name attribute value without the Object Identifier

//

//  The interpretation of the Value depends on the dwValueType.

//  See above for a list of the types.

//--------------------------------------------------------------------------

 

type

  PCERT_NAME_VALUE = ^CERT_NAME_VALUE;

  CERT_NAME_VALUE = record

    dwValueType :DWORD;

    Value :CERT_RDN_VALUE_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  Public Key Info

//

//  The PublicKey is the encoded representation of the information as it is

//  stored in the bit string

//--------------------------------------------------------------------------

 

type

  PCERT_PUBLIC_KEY_INFO = ^CERT_PUBLIC_KEY_INFO;

  CERT_PUBLIC_KEY_INFO = record

    Algorithm :CRYPT_ALGORITHM_IDENTIFIER;

    PublicKey :CRYPT_BIT_BLOB;

  end;

 

const

  CERT_RSA_PUBLIC_KEY_OBJID        = szOID_RSA_RSA;

  CERT_DEFAULT_OID_PUBLIC_KEY_SIGN = szOID_RSA_RSA;

  CERT_DEFAULT_OID_PUBLIC_KEY_XCHG = szOID_RSA_RSA;

 

//+-------------------------------------------------------------------------

//  Information stored in a certificate

//

//  The Issuer, Subject, Algorithm, PublicKey and Extension BLOBs are the

//  encoded representation of the information.

//--------------------------------------------------------------------------

 

type

  PCERT_INFO = ^CERT_INFO;

  CERT_INFO = record

    dwVersion              :DWORD;

    SerialNumber           :CRYPT_INTEGER_BLOB;

    SignatureAlgorithm     :CRYPT_ALGORITHM_IDENTIFIER;

    Issuer                 :CERT_NAME_BLOB;

    NotBefore              :TFILETIME;

    NotAfter               :TFILETIME;

    Subject                :CERT_NAME_BLOB;

    SubjectPublicKeyInfo   :CERT_PUBLIC_KEY_INFO;

    IssuerUniqueId         :CRYPT_BIT_BLOB;

    SubjectUniqueId        :CRYPT_BIT_BLOB;

    cExtension             :DWORD;

    rgExtension            :PCERT_EXTENSION;

  end;

 

//+-------------------------------------------------------------------------

//  Certificate versions

//--------------------------------------------------------------------------

const

  CERT_V1 = 0;

  CERT_V2 = 1;

  CERT_V3 = 2;

 

//+-------------------------------------------------------------------------

//  Certificate Information Flags

//--------------------------------------------------------------------------

 

  CERT_INFO_VERSION_FLAG                 = 1;

  CERT_INFO_SERIAL_NUMBER_FLAG           = 2;

  CERT_INFO_SIGNATURE_ALGORITHM_FLAG     = 3;

  CERT_INFO_ISSUER_FLAG                  = 4;

  CERT_INFO_NOT_BEFORE_FLAG              = 5;

  CERT_INFO_NOT_AFTER_FLAG               = 6;

  CERT_INFO_SUBJECT_FLAG                 = 7;

  CERT_INFO_SUBJECT_PUBLIC_KEY_INFO_FLAG = 8;

  CERT_INFO_ISSUER_UNIQUE_ID_FLAG        = 9;

  CERT_INFO_SUBJECT_UNIQUE_ID_FLAG       = 10;

  CERT_INFO_EXTENSION_FLAG               = 11;

 

//+-------------------------------------------------------------------------

//  An entry in a CRL

//

//  The Extension BLOBs are the encoded representation of the information.

//--------------------------------------------------------------------------

 

type

  PCRL_ENTRY = ^CRL_ENTRY;

  CRL_ENTRY = record

    SerialNumber :CRYPT_INTEGER_BLOB;

    RevocationDate :TFILETIME;

    cExtension :DWORD;

    rgExtension :PCERT_EXTENSION;

  end;

 

//+-------------------------------------------------------------------------

//  Information stored in a CRL

//

//  The Issuer, Algorithm and Extension BLOBs are the encoded

//  representation of the information.

//--------------------------------------------------------------------------

 

type

  PCRL_INFO = ^CRL_INFO;

  CRL_INFO = record

    dwVersion           :DWORD;

    SignatureAlgorithm  :CRYPT_ALGORITHM_IDENTIFIER;

    Issuer              :CERT_NAME_BLOB;

    ThisUpdate          :TFILETIME;

    NextUpdate          :TFILETIME;

    cCRLEntry           :DWORD;

    rgCRLEntry          :PCRL_ENTRY;

    cExtension          :DWORD;

    rgExtension         :PCERT_EXTENSION;

  end;

 

//+-------------------------------------------------------------------------

//  CRL versions

//--------------------------------------------------------------------------

const

  CRL_V1 = 0;

  CRL_V2 = 1;

 

//+-------------------------------------------------------------------------

//  Information stored in a certificate request

//

//  The Subject, Algorithm, PublicKey and Attribute BLOBs are the encoded

//  representation of the information.

//--------------------------------------------------------------------------

 

type

  PCERT_REQUEST_INFO = ^CERT_REQUEST_INFO;

  CERT_REQUEST_INFO = record

    dwVersion            :DWORD;

    Subject              :CERT_NAME_BLOB;

    SubjectPublicKeyInfo :CERT_PUBLIC_KEY_INFO;

    cAttribute           :DWORD;

    rgAttribute          :PCRYPT_ATTRIBUTE;

  end;

 

//+-------------------------------------------------------------------------

//  Certificate Request versions

//--------------------------------------------------------------------------

const CERT_REQUEST_V1 = 0;

 

//+-------------------------------------------------------------------------

//  Information stored in Netscape's Keygen request

//--------------------------------------------------------------------------

type

  PCERT_KEYGEN_REQUEST_INFO = ^CERT_KEYGEN_REQUEST_INFO;

  CERT_KEYGEN_REQUEST_INFO = record

    dwVersion            :DWORD;

    SubjectPublicKeyInfo :CERT_PUBLIC_KEY_INFO;

    pwszChallengeString  :LPWSTR;        // encoded as IA5

  end;

 

const

  CERT_KEYGEN_REQUEST_V1 = 0;

 

 

//+-------------------------------------------------------------------------

//  Certificate, CRL, Certificate Request or Keygen Request Signed Content

//

//  The "to be signed" encoded content plus its signature. The ToBeSigned

//  is the encoded CERT_INFO, CRL_INFO, CERT_REQUEST_INFO or

//  CERT_KEYGEN_REQUEST_INFO.

//--------------------------------------------------------------------------

type

  PCERT_SIGNED_CONTENT_INFO = ^CERT_SIGNED_CONTENT_INFO;

  CERT_SIGNED_CONTENT_INFO = record

    ToBeSigned          :CRYPT_DER_BLOB;

    SignatureAlgorithm  :CRYPT_ALGORITHM_IDENTIFIER;

    Signature           :CRYPT_BIT_BLOB;

end;

 

//+-------------------------------------------------------------------------

//  Certificate Trust List (CTL)

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CTL Usage. Also used for EnhancedKeyUsage extension.

//--------------------------------------------------------------------------

 

type

  PCTL_USAGE =^CTL_USAGE;

  CTL_USAGE = record

    cUsageIdentifier :DWORD;

    rgpszUsageIdentifier :PLPSTR;      // array of pszObjId

  end;

 

type

  CERT_ENHKEY_USAGE = CTL_USAGE;

  PCERT_ENHKEY_USAGE = ^CERT_ENHKEY_USAGE;

 

 

//+-------------------------------------------------------------------------

//  An entry in a CTL

//--------------------------------------------------------------------------

type

  PCTL_ENTRY = ^CTL_ENTRY;

  CTL_ENTRY = record

    SubjectIdentifier :CRYPT_DATA_BLOB;    // For example, its hash

    cAttribute        :DWORD;

    rgAttribute       :PCRYPT_ATTRIBUTE;   // OPTIONAL

  end;

 

//+-------------------------------------------------------------------------

//  Information stored in a CTL

//--------------------------------------------------------------------------

type

  PCTL_INFO = ^CTL_INFO;

  CTL_INFO = record

    dwVersion           :DWORD;

    SubjectUsage        :CTL_USAGE;

    ListIdentifier      :CRYPT_DATA_BLOB;     // OPTIONAL

    SequenceNumber      :CRYPT_INTEGER_BLOB;  // OPTIONAL

    ThisUpdate          :TFILETIME;

    NextUpdate          :TFILETIME;           // OPTIONAL

    SubjectAlgorithm    :CRYPT_ALGORITHM_IDENTIFIER;

    cCTLEntry           :DWORD;

    rgCTLEntry          :PCTL_ENTRY;          // OPTIONAL

    cExtension          :DWORD;

    rgExtension         :PCERT_EXTENSION;     // OPTIONAL

  end;

 

//+-------------------------------------------------------------------------

//  CTL versions

//--------------------------------------------------------------------------

const

  CTL_V1 = 0;

 

//+-------------------------------------------------------------------------

//  TimeStamp Request

//

//  The pszTimeStamp is the OID for the Time type requested

//  The pszContentType is the Content Type OID for the content, usually DATA

//  The Content is a un-decoded blob

//--------------------------------------------------------------------------

 

type

  PCRYPT_TIME_STAMP_REQUEST_INFO = ^CRYPT_TIME_STAMP_REQUEST_INFO;

  CRYPT_TIME_STAMP_REQUEST_INFO = record

    pszTimeStampAlgorithm :LPSTR;   // pszObjId

    pszContentType        :LPSTR;   // pszObjId

    Content               :CRYPT_OBJID_BLOB;

    cAttribute            :DWORD;

    rgAttribute           :PCRYPT_ATTRIBUTE;

  end;

 

//+-------------------------------------------------------------------------

//  Certificate and Message encoding types

//

//  The encoding type is a DWORD containing both the certificate and message

//  encoding types. The certificate encoding type is stored in the LOWORD.

//  The message encoding type is stored in the HIWORD. Some functions or

//  structure fields require only one of the encoding types. The following

//  naming convention is used to indicate which encoding type(s) are

//  required:

//      dwEncodingType              (both encoding types are required)

//      dwMsgAndCertEncodingType    (both encoding types are required)

//      dwMsgEncodingType           (only msg encoding type is required)

//      dwCertEncodingType          (only cert encoding type is required)

//

//  Its always acceptable to specify both.

//--------------------------------------------------------------------------

 

const

  CERT_ENCODING_TYPE_MASK = $0000FFFF;

  CMSG_ENCODING_TYPE_MASK = $FFFF0000;

 

//#define GET_CERT_ENCODING_TYPE(X)   (X & CERT_ENCODING_TYPE_MASK)

//#define GET_CMSG_ENCODING_TYPE(X)   (X & CMSG_ENCODING_TYPE_MASK)

function GET_CERT_ENCODING_TYPE(X :DWORD):DWORD;

function GET_CMSG_ENCODING_TYPE(X :DWORD):DWORD;

 

const

  CRYPT_ASN_ENCODING  = $00000001;

  CRYPT_NDR_ENCODING = $00000002;

  X509_ASN_ENCODING = $00000001;

  X509_NDR_ENCODING = $00000002;

  PKCS_7_ASN_ENCODING = $00010000;

  PKCS_7_NDR_ENCODING = $00020000;

 

//+-------------------------------------------------------------------------

//  format the specified data structure according to the certificate

//  encoding type.

//

//--------------------------------------------------------------------------

 

function CryptFormatObject(dwCertEncodingType :DWORD;

                           dwFormatType       :DWORD;

                           dwFormatStrType    :DWORD;

                           pFormatStruct      :PVOID;

                           lpszStructType     :LPCSTR;

                     const pbEncoded          :PBYTE;

                           cbEncoded          :DWORD;

                           pbFormat           :PVOID;

                           pcbFormat          :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Encode / decode the specified data structure according to the certificate

//  encoding type.

//

//  See below for a list of the predefined data structures.

//--------------------------------------------------------------------------

 

function CryptEncodeObject(dwCertEncodingType :DWORD;

                           lpszStructType     :LPCSTR;

                     const pvStructInfo       :PVOID;

                           pbEncoded          :PBYTE;

                           pcbEncoded         :PDWORD ):BOOL ; stdcall;

 

function CryptDecodeObject(dwCertEncodingType :DWORD;

                           lpszStructType     :LPCSTR;

                     const pbEncoded          :PBYTE;

                           cbEncoded          :DWORD;

                           dwFlags            :DWORD;

                           pvStructInfo       :PVOID;

                           pcbStructInfo      :PDWORD):BOOL ; stdcall;

 

// When the following flag is set the nocopy optimization is enabled.

// This optimization where appropriate, updates the pvStructInfo fields

// to point to content residing within pbEncoded instead of making a copy

// of and appending to pvStructInfo.

//

// Note, when set, pbEncoded can't be freed until pvStructInfo is freed.

const

  CRYPT_DECODE_NOCOPY_FLAG = $1;

 

//+-------------------------------------------------------------------------

//  Predefined X509 certificate data structures that can be encoded / decoded.

//--------------------------------------------------------------------------

  CRYPT_ENCODE_DECODE_NONE         = 0;

  X509_CERT                        = (LPCSTR(1));

  X509_CERT_TO_BE_SIGNED           = (LPCSTR(2));

  X509_CERT_CRL_TO_BE_SIGNED       = (LPCSTR(3));

  X509_CERT_REQUEST_TO_BE_SIGNED   = (LPCSTR(4));

  X509_EXTENSIONS                  = (LPCSTR(5));

  X509_NAME_VALUE                  = (LPCSTR(6));

  X509_NAME                        = (LPCSTR(7));

  X509_PUBLIC_KEY_INFO             = (LPCSTR(8));

 

//+-------------------------------------------------------------------------

//  Predefined X509 certificate extension data structures that can be

//  encoded / decoded.

//--------------------------------------------------------------------------

  X509_AUTHORITY_KEY_ID            = (LPCSTR(9));

  X509_KEY_ATTRIBUTES              = (LPCSTR(10));

  X509_KEY_USAGE_RESTRICTION       = (LPCSTR(11));

  X509_ALTERNATE_NAME              = (LPCSTR(12));

  X509_BASIC_CONSTRAINTS          = (LPCSTR(13));

  X509_KEY_USAGE                   = (LPCSTR(14));

  X509_BASIC_CONSTRAINTS2          = (LPCSTR(15));

  X509_CERT_POLICIES               = (LPCSTR(16));

 

//+-------------------------------------------------------------------------

//  Additional predefined data structures that can be encoded / decoded.

//--------------------------------------------------------------------------

  PKCS_UTC_TIME                    = (LPCSTR(17));

  PKCS_TIME_REQUEST                = (LPCSTR(18));

  RSA_CSP_PUBLICKEYBLOB            = (LPCSTR(19));

  X509_UNICODE_NAME                = (LPCSTR(20));

 

  X509_KEYGEN_REQUEST_TO_BE_SIGNED  = (LPCSTR(21));

  PKCS_ATTRIBUTE                    = (LPCSTR(22));

  PKCS_CONTENT_INFO_SEQUENCE_OF_ANY = (LPCSTR(23));

 

//+-------------------------------------------------------------------------

//  Predefined primitive data structures that can be encoded / decoded.

//--------------------------------------------------------------------------

  X509_UNICODE_NAME_VALUE    = (LPCSTR(24));

  X509_ANY_STRING            = X509_NAME_VALUE;

  X509_UNICODE_ANY_STRING    = X509_UNICODE_NAME_VALUE;

  X509_OCTET_STRING          = (LPCSTR(25));

  X509_BITS                  = (LPCSTR(26));

  X509_INTEGER               = (LPCSTR(27));

  X509_MULTI_BYTE_INTEGER    = (LPCSTR(28));

  X509_ENUMERATED            = (LPCSTR(29));

  X509_CHOICE_OF_TIME        = (LPCSTR(30));

 

//+-------------------------------------------------------------------------

//  More predefined X509 certificate extension data structures that can be

//  encoded / decoded.

//--------------------------------------------------------------------------

 

  X509_AUTHORITY_KEY_ID2        = (LPCSTR(31));

//  X509_AUTHORITY_INFO_ACCESS          (LPCSTR(32));

  X509_CRL_REASON_CODE          = X509_ENUMERATED;

  PKCS_CONTENT_INFO             = (LPCSTR(33));

  X509_SEQUENCE_OF_ANY          = (LPCSTR(34));

  X509_CRL_DIST_POINTS          = (LPCSTR(35));

  X509_ENHANCED_KEY_USAGE       = (LPCSTR(36));

  PKCS_CTL                      = (LPCSTR(37));

 

  X509_MULTI_BYTE_UINT          = (LPCSTR(38));

  X509_DSS_PUBLICKEY            =  X509_MULTI_BYTE_UINT;

  X509_DSS_PARAMETERS           = (LPCSTR(39));

  X509_DSS_SIGNATURE            = (LPCSTR(40));

  PKCS_RC2_CBC_PARAMETERS       = (LPCSTR(41));

  PKCS_SMIME_CAPABILITIES       = (LPCSTR(42));

 

//+-------------------------------------------------------------------------

//  Predefined PKCS #7 data structures that can be encoded / decoded.

//--------------------------------------------------------------------------

  PKCS7_SIGNER_INFO             = (LPCSTR(500));

 

//+-------------------------------------------------------------------------

//  Predefined Software Publishing Credential (SPC)  data structures that

//  can be encoded / decoded.

//

//  Predefined values: 2000 .. 2999

//

//  See spc.h for value and data structure definitions.

//--------------------------------------------------------------------------

//+-------------------------------------------------------------------------

//  Extension Object Identifiers

//--------------------------------------------------------------------------

const

  szOID_AUTHORITY_KEY_IDENTIFIER      = '2.5.29.1';

  szOID_KEY_ATTRIBUTES                = '2.5.29.2';

  szOID_KEY_USAGE_RESTRICTION         = '2.5.29.4';

  szOID_SUBJECT_ALT_NAME              = '2.5.29.7';

  szOID_ISSUER_ALT_NAME               = '2.5.29.8';

  szOID_BASIC_CONSTRAINTS             = '2.5.29.10';

  szOID_KEY_USAGE                     = '2.5.29.15';

  szOID_BASIC_CONSTRAINTS2            = '2.5.29.19';

  szOID_CERT_POLICIES                 = '2.5.29.32';

 

  szOID_AUTHORITY_KEY_IDENTIFIER2     =  '2.5.29.35';

  szOID_SUBJECT_KEY_IDENTIFIER        = '2.5.29.14';

  szOID_SUBJECT_ALT_NAME2             = '2.5.29.17';

  szOID_ISSUER_ALT_NAME2              = '2.5.29.18';

  szOID_CRL_REASON_CODE               = '2.5.29.21';

  szOID_CRL_DIST_POINTS               = '2.5.29.31';

  szOID_ENHANCED_KEY_USAGE            = '2.5.29.37';

 

 

// Internet Public Key Infrastructure

  szOID_PKIX                          = '1.3.6.1.5.5.7';

  szOID_AUTHORITY_INFO_ACCESS         = '1.3.6.1.5.5.7.2';

 

// Microsoft extensions or attributes

  szOID_CERT_EXTENSIONS               = '1.3.6.1.4.1.311.2.1.14';

  szOID_NEXT_UPDATE_LOCATION          = '1.3.6.1.4.1.311.10.2';

 

//  Microsoft PKCS #7 ContentType Object Identifiers

  szOID_CTL                           = '1.3.6.1.4.1.311.10.1';

 

//+-------------------------------------------------------------------------

//  Extension Object Identifiers (currently not implemented)

//--------------------------------------------------------------------------

  szOID_POLICY_MAPPINGS               = '2.5.29.5';

  szOID_SUBJECT_DIR_ATTRS             = '2.5.29.9';

 

//+-------------------------------------------------------------------------

//  Enhanced Key Usage (Purpose) Object Identifiers

//--------------------------------------------------------------------------

const szOID_PKIX_KP                       = '1.3.6.1.5.5.7.3';

 

// Consistent key usage bits: DIGITAL_SIGNATURE, KEY_ENCIPHERMENT

// or KEY_AGREEMENT

  szOID_PKIX_KP_SERVER_AUTH           = '1.3.6.1.5.5.7.3.1';

 

// Consistent key usage bits: DIGITAL_SIGNATURE

  szOID_PKIX_KP_CLIENT_AUTH           = '1.3.6.1.5.5.7.3.2';

 

// Consistent key usage bits: DIGITAL_SIGNATURE

  szOID_PKIX_KP_CODE_SIGNING          = '1.3.6.1.5.5.7.3.3';

 

// Consistent key usage bits: DIGITAL_SIGNATURE, NON_REPUDIATION and/or

// (KEY_ENCIPHERMENT or KEY_AGREEMENT)

  szOID_PKIX_KP_EMAIL_PROTECTION      = '1.3.6.1.5.5.7.3.4';

 

//+-------------------------------------------------------------------------

//  Microsoft Enhanced Key Usage (Purpose) Object Identifiers

//+-------------------------------------------------------------------------

 

//  Signer of CTLs

  szOID_KP_CTL_USAGE_SIGNING          = '1.3.6.1.4.1.311.10.3.1';

 

//  Signer of TimeStamps

  szOID_KP_TIME_STAMP_SIGNING         = '1.3.6.1.4.1.311.10.3.2';

 

//+-------------------------------------------------------------------------

//  Microsoft Attribute Object Identifiers

//+-------------------------------------------------------------------------

  szOID_YESNO_TRUST_ATTR              = '1.3.6.1.4.1.311.10.4.1';

 

//+-------------------------------------------------------------------------

//  X509_CERT

//

//  The "to be signed" encoded content plus its signature. The ToBeSigned

//  content is the CryptEncodeObject() output for one of the following:

//  X509_CERT_TO_BE_SIGNED, X509_CERT_CRL_TO_BE_SIGNED or

//  X509_CERT_REQUEST_TO_BE_SIGNED.

//

//  pvStructInfo points to CERT_SIGNED_CONTENT_INFO.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_CERT_TO_BE_SIGNED

//

//  pvStructInfo points to CERT_INFO.

//

//  For CryptDecodeObject(), the pbEncoded is the "to be signed" plus its

//  signature (output of a X509_CERT CryptEncodeObject()).

//

//  For CryptEncodeObject(), the pbEncoded is just the "to be signed".

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_CERT_CRL_TO_BE_SIGNED

//

//  pvStructInfo points to CRL_INFO.

//

//  For CryptDecodeObject(), the pbEncoded is the "to be signed" plus its

//  signature (output of a X509_CERT CryptEncodeObject()).

//

//  For CryptEncodeObject(), the pbEncoded is just the "to be signed".

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_CERT_REQUEST_TO_BE_SIGNED

//

//  pvStructInfo points to CERT_REQUEST_INFO.

//

//  For CryptDecodeObject(), the pbEncoded is the "to be signed" plus its

//  signature (output of a X509_CERT CryptEncodeObject()).

//

//  For CryptEncodeObject(), the pbEncoded is just the "to be signed".

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_EXTENSIONS

//  szOID_CERT_EXTENSIONS

//

//  pvStructInfo points to following CERT_EXTENSIONS.

//--------------------------------------------------------------------------

type

  PCERT_EXTENSIONS = ^CERT_EXTENSIONS;

  CERT_EXTENSIONS = record

    cExtension  :DWORD;

    rgExtension :PCERT_EXTENSION;

  end;

 

//+-------------------------------------------------------------------------

//  X509_NAME_VALUE

//  X509_ANY_STRING

//

//  pvStructInfo points to CERT_NAME_VALUE.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_UNICODE_NAME_VALUE

//  X509_UNICODE_ANY_STRING

//

//  pvStructInfo points to CERT_NAME_VALUE.

//

//  The name values are unicode strings.

//

//  For CryptEncodeObject:

//    Value.pbData points to the unicode string.

//    If Value.cbData = 0, then, the unicode string is NULL terminated.

//    Otherwise, Value.cbData is the unicode string byte count. The byte count

//    is twice the character count.

//

//    If the unicode string contains an invalid character for the specified

//    dwValueType, then, *pcbEncoded is updated with the unicode character

//    index of the first invalid character. LastError is set to:

//    CRYPT_E_INVALID_NUMERIC_STRING, CRYPT_E_INVALID_PRINTABLE_STRING or

//    CRYPT_E_INVALID_IA5_STRING.

//

//    The unicode string is converted before being encoded according to

//    the specified dwValueType. If dwValueType is set to 0, LastError

//    is set to E_INVALIDARG.

//

//    If the dwValueType isn't one of the character strings (its a

//    CERT_RDN_ENCODED_BLOB or CERT_RDN_OCTET_STRING), then, CryptEncodeObject

//    will return FALSE with LastError set to CRYPT_E_NOT_CHAR_STRING.

//

//  For CryptDecodeObject:

//    Value.pbData points to a NULL terminated unicode string. Value.cbData

//    contains the byte count of the unicode string excluding the NULL

//    terminator. dwValueType contains the type used in the encoded object.

//    Its not forced to CERT_RDN_UNICODE_STRING. The encoded value is

//    converted to the unicode string according to the dwValueType.

//

//    If the encoded object isn't one of the character string types, then,

//    CryptDecodeObject will return FALSE with LastError set to

//    CRYPT_E_NOT_CHAR_STRING. For a non character string, decode using

//    X509_NAME_VALUE or X509_ANY_STRING.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_NAME

//

//  pvStructInfo points to CERT_NAME_INFO.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_UNICODE_NAME

//

//  pvStructInfo points to CERT_NAME_INFO.

//

//  The RDN attribute values are unicode strings except for the dwValueTypes of

//  CERT_RDN_ENCODED_BLOB or CERT_RDN_OCTET_STRING. These dwValueTypes are

//  the same as for a X509_NAME. Their values aren't converted to/from unicode.

//

//  For CryptEncodeObject:

//    Value.pbData points to the unicode string.

//    If Value.cbData = 0, then, the unicode string is NULL terminated.

//    Otherwise, Value.cbData is the unicode string byte count. The byte count

//    is twice the character count.

//

//    If dwValueType = 0 (CERT_RDN_ANY_TYPE), the pszObjId is used to find

//    an acceptable dwValueType. If the unicode string contains an

//    invalid character for the found or specified dwValueType, then,

//    *pcbEncoded is updated with the error location of the invalid character.

//    See below for details. LastError is set to:

//    CRYPT_E_INVALID_NUMERIC_STRING, CRYPT_E_INVALID_PRINTABLE_STRING or

//    CRYPT_E_INVALID_IA5_STRING.

//

//    The unicode string is converted before being encoded according to

//    the specified or ObjId matching dwValueType.

//

//  For CryptDecodeObject:

//    Value.pbData points to a NULL terminated unicode string. Value.cbData

//    contains the byte count of the unicode string excluding the NULL

//    terminator. dwValueType contains the type used in the encoded object.

//    Its not forced to CERT_RDN_UNICODE_STRING. The encoded value is

//    converted to the unicode string according to the dwValueType.

//

//    If the dwValueType of the encoded value isn't a character string

//    type, then, it isn't converted to UNICODE. Use the

//    IS_CERT_RDN_CHAR_STRING() macro on the dwValueType to check

//    that Value.pbData points to a converted unicode string.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  Unicode Name Value Error Location Definitions

//

//  Error location is returned in *pcbEncoded by

//  CryptEncodeObject(X509_UNICODE_NAME)

//

//  Error location consists of:

//    RDN_INDEX     - 10 bits << 22

//    ATTR_INDEX    - 6 bits << 16

//    VALUE_INDEX   - 16 bits (unicode character index)

//--------------------------------------------------------------------------

const

  CERT_UNICODE_RDN_ERR_INDEX_MASK     = $3FF;

  CERT_UNICODE_RDN_ERR_INDEX_SHIFT    = 22;

  CERT_UNICODE_ATTR_ERR_INDEX_MASK    = $003F;

  CERT_UNICODE_ATTR_ERR_INDEX_SHIFT   = 16;

  CERT_UNICODE_VALUE_ERR_INDEX_MASK   = $0000FFFF;

  CERT_UNICODE_VALUE_ERR_INDEX_SHIFT  = 0;

 

{#define GET_CERT_UNICODE_RDN_ERR_INDEX(X)  

    ((X >> CERT_UNICODE_RDN_ERR_INDEX_SHIFT) & CERT_UNICODE_RDN_ERR_INDEX_MASK)}

function  GET_CERT_UNICODE_RDN_ERR_INDEX(X :integer):integer;

{#define GET_CERT_UNICODE_ATTR_ERR_INDEX(X) 

    ((X >> CERT_UNICODE_ATTR_ERR_INDEX_SHIFT) & CERT_UNICODE_ATTR_ERR_INDEX_MASK)}

function  GET_CERT_UNICODE_ATTR_ERR_INDEX(X :integer):integer;

{#define GET_CERT_UNICODE_VALUE_ERR_INDEX(X)

    (X & CERT_UNICODE_VALUE_ERR_INDEX_MASK)}

function  GET_CERT_UNICODE_VALUE_ERR_INDEX(X :integer):integer;

 

//+-------------------------------------------------------------------------

//  X509_PUBLIC_KEY_INFO

//

//  pvStructInfo points to CERT_PUBLIC_KEY_INFO.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  X509_AUTHORITY_KEY_ID

//  szOID_AUTHORITY_KEY_IDENTIFIER

//

//  pvStructInfo points to following CERT_AUTHORITY_KEY_ID_INFO.

//--------------------------------------------------------------------------

type

  PCERT_AUTHORITY_KEY_ID_INFO = ^CERT_AUTHORITY_KEY_ID_INFO;

  CERT_AUTHORITY_KEY_ID_INFO = record

    KeyId            :CRYPT_DATA_BLOB;

    CertIssuer       :CERT_NAME_BLOB;

    CertSerialNumber :CRYPT_INTEGER_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  X509_KEY_ATTRIBUTES

//  szOID_KEY_ATTRIBUTES

//

//  pvStructInfo points to following CERT_KEY_ATTRIBUTES_INFO.

//--------------------------------------------------------------------------

type

  PCERT_PRIVATE_KEY_VALIDITY = ^CERT_PRIVATE_KEY_VALIDITY;

  CERT_PRIVATE_KEY_VALIDITY = record

    NotBefore :TFILETIME;

    NotAfter  :TFILETIME;

  end;

 

type

  PCERT_KEY_ATTRIBUTES_INFO = ^CERT_KEY_ATTRIBUTES_INFO;

  CERT_KEY_ATTRIBUTES_INFO = record

    KeyId                  :CRYPT_DATA_BLOB;

    IntendedKeyUsage       :CRYPT_BIT_BLOB;

    pPrivateKeyUsagePeriod :PCERT_PRIVATE_KEY_VALIDITY;     // OPTIONAL

  end;

 

const

  CERT_DIGITAL_SIGNATURE_KEY_USAGE    = $80;

  CERT_NON_REPUDIATION_KEY_USAGE      = $40;

  CERT_KEY_ENCIPHERMENT_KEY_USAGE     = $20;

  CERT_DATA_ENCIPHERMENT_KEY_USAGE    = $10;

  CERT_KEY_AGREEMENT_KEY_USAGE        = $08;

  CERT_KEY_CERT_SIGN_KEY_USAGE        = $04;

  CERT_OFFLINE_CRL_SIGN_KEY_USAGE     = $02;

 

  CERT_CRL_SIGN_KEY_USAGE             = $02;

 

//+-------------------------------------------------------------------------

//  X509_KEY_USAGE_RESTRICTION

//  szOID_KEY_USAGE_RESTRICTION

//

//  pvStructInfo points to following CERT_KEY_USAGE_RESTRICTION_INFO.

//--------------------------------------------------------------------------

type

  PCERT_POLICY_ID = ^CERT_POLICY_ID;

  CERT_POLICY_ID = record

    cCertPolicyElementId     :DWORD;

    rgpszCertPolicyElementId :PLPSTR;  // pszObjId

  end;

 

type

  PCERT_KEY_USAGE_RESTRICTION_INFO = ^CERT_KEY_USAGE_RESTRICTION_INFO;

  CERT_KEY_USAGE_RESTRICTION_INFO = record

    cCertPolicyId      :DWORD;

    rgCertPolicyId     :PCERT_POLICY_ID;

    RestrictedKeyUsage :CRYPT_BIT_BLOB;

  end;

 

// See CERT_KEY_ATTRIBUTES_INFO for definition of the RestrictedKeyUsage bits

 

//+-------------------------------------------------------------------------

//  X509_ALTERNATE_NAME

//  szOID_SUBJECT_ALT_NAME

//  szOID_ISSUER_ALT_NAME

//  szOID_SUBJECT_ALT_NAME2

//  szOID_ISSUER_ALT_NAME2

//

//  pvStructInfo points to following CERT_ALT_NAME_INFO.

//--------------------------------------------------------------------------

 

type

  PCERT_ALT_NAME_ENTRY = ^CERT_ALT_NAME_ENTRY;

  CERT_ALT_NAME_ENTRY = record

    dwAltNameChoice :DWORD;

    case integer of

    {1}0: ({OtherName :Not implemented});

    {2}1: (pwszRfc822Name  :LPWSTR);            //(encoded IA5)

    {3}2: (pwszDNSName     :LPWSTR);            //(encoded IA5)

    {4}3: ({x400Address    :Not implemented});

    {5}4: (DirectoryName   :CERT_NAME_BLOB);

    {6}5: ({pEdiPartyName  :Not implemented});

    {7}6: (pwszURL         :LPWSTR);            //(encoded IA5)

    {8}7: (IPAddress       :CRYPT_DATA_BLOB);   //(Octet String)

    {9}8: (pszRegisteredID :LPSTR);             //(Octet String)

    end;

 

const

  CERT_ALT_NAME_OTHER_NAME      = 1;

  CERT_ALT_NAME_RFC822_NAME     = 2;

  CERT_ALT_NAME_DNS_NAME        = 3;

  CERT_ALT_NAME_X400_ADDRESS    = 4;

  CERT_ALT_NAME_DIRECTORY_NAME  = 5;

  CERT_ALT_NAME_EDI_PARTY_NAME  = 6;

  CERT_ALT_NAME_URL             = 7;

  CERT_ALT_NAME_IP_ADDRESS      = 8;

  CERT_ALT_NAME_REGISTERED_ID   = 9;

 

type

  PCERT_ALT_NAME_INFO = ^CERT_ALT_NAME_INFO;

  CERT_ALT_NAME_INFO = record

    cAltEntry  :DWORD;

    rgAltEntry :PCERT_ALT_NAME_ENTRY;

  end;

 

//+-------------------------------------------------------------------------

//  Alternate name IA5 Error Location Definitions for

//  CRYPT_E_INVALID_IA5_STRING.

//

//  Error location is returned in *pcbEncoded by

//  CryptEncodeObject(X509_ALTERNATE_NAME)

//

//  Error location consists of:

//    ENTRY_INDEX   - 8 bits << 16

//    VALUE_INDEX   - 16 bits (unicode character index)

//--------------------------------------------------------------------------

 

const

  CERT_ALT_NAME_ENTRY_ERR_INDEX_MASK  = $FF;

  CERT_ALT_NAME_ENTRY_ERR_INDEX_SHIFT = 16;

  CERT_ALT_NAME_VALUE_ERR_INDEX_MASK  = $0000FFFF;

  CERT_ALT_NAME_VALUE_ERR_INDEX_SHIFT = 0;

 

{#define GET_CERT_ALT_NAME_ENTRY_ERR_INDEX(X)  

    ((X >> CERT_ALT_NAME_ENTRY_ERR_INDEX_SHIFT) &

                                  CERT_ALT_NAME_ENTRY_ERR_INDEX_MASK)}

function GET_CERT_ALT_NAME_ENTRY_ERR_INDEX(X :DWORD):DWORD;

 

{#define GET_CERT_ALT_NAME_VALUE_ERR_INDEX(X)

    (X & CERT_ALT_NAME_VALUE_ERR_INDEX_MASK)}

function GET_CERT_ALT_NAME_VALUE_ERR_INDEX(X :DWORD):DWORD;

 

//+-------------------------------------------------------------------------

//  X509_BASIC_CONSTRAINTS

//  szOID_BASIC_CONSTRAINTS

//

//  pvStructInfo points to following CERT_BASIC_CONSTRAINTS_INFO.

//--------------------------------------------------------------------------

 

type

  PCERT_BASIC_CONSTRAINTS_INFO = ^CERT_BASIC_CONSTRAINTS_INFO;

  CERT_BASIC_CONSTRAINTS_INFO = record

    SubjectType          :CRYPT_BIT_BLOB;

    fPathLenConstraint   :BOOL;

    dwPathLenConstraint  :DWORD;

    cSubtreesConstraint  :DWORD;

    rgSubtreesConstraint :PCERT_NAME_BLOB;

  end;

 

const

  CERT_CA_SUBJECT_FLAG         = $80;

  CERT_END_ENTITY_SUBJECT_FLAG = $40;

 

//+-------------------------------------------------------------------------

//  X509_BASIC_CONSTRAINTS2

//  szOID_BASIC_CONSTRAINTS2

//

//  pvStructInfo points to following CERT_BASIC_CONSTRAINTS2_INFO.

//--------------------------------------------------------------------------

 

type

  PCERT_BASIC_CONSTRAINTS2_INFO = ^CERT_BASIC_CONSTRAINTS2_INFO;

  CERT_BASIC_CONSTRAINTS2_INFO = record

    fCA                 :BOOL;

    fPathLenConstraint  :BOOL;

    dwPathLenConstraint :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  X509_KEY_USAGE

//  szOID_KEY_USAGE

//

//  pvStructInfo points to a CRYPT_BIT_BLOB. Has same bit definitions as

//  CERT_KEY_ATTRIBUTES_INFO's IntendedKeyUsage.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_CERT_POLICIES

//  szOID_CERT_POLICIES

//

//  pvStructInfo points to following CERT_POLICIES_INFO.

//--------------------------------------------------------------------------

 

type

  PCERT_POLICY_QUALIFIER_INFO = ^CERT_POLICY_QUALIFIER_INFO;

  CERT_POLICY_QUALIFIER_INFO = record

    pszPolicyQualifierId  :LPSTR;            // pszObjId

    Qualifier             :CRYPT_OBJID_BLOB; // optional

  end;

 

type

  PCERT_POLICY_INFO = ^CERT_POLICY_INFO;

  CERT_POLICY_INFO = record

    pszPolicyIdentifier :LPSTR;    // pszObjId

    cPolicyQualifier    :DWORD;       // optional

    rgPolicyQualifier   :PCERT_POLICY_QUALIFIER_INFO;

  end;

 

type

  PCERT_POLICIES_INFO = ^CERT_POLICIES_INFO;

  CERT_POLICIES_INFO = record

    cPolicyInfo  :DWORD;

    rgPolicyInfo :PCERT_POLICY_INFO;

  end;

 

//+-------------------------------------------------------------------------

//  RSA_CSP_PUBLICKEYBLOB

//

//  pvStructInfo points to a PUBLICKEYSTRUC immediately followed by a

//  RSAPUBKEY and the modulus bytes.

//

//  CryptExportKey outputs the above StructInfo for a dwBlobType of

//  PUBLICKEYBLOB. CryptImportKey expects the above StructInfo when

//  importing a public key.

//

//  For dwCertEncodingType = X509_ASN_ENCODING, the RSA_CSP_PUBLICKEYBLOB is

//  encoded as a PKCS #1 RSAPublicKey consisting of a SEQUENCE of a

//  modulus INTEGER and a publicExponent INTEGER. The modulus is encoded

//  as being a unsigned integer. When decoded, if the modulus was encoded

//  as unsigned integer with a leading 0 byte, the 0 byte is removed before

//  converting to the CSP modulus bytes.

//

//  For decode, the aiKeyAlg field of PUBLICKEYSTRUC is always set to

//  CALG_RSA_KEYX.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_KEYGEN_REQUEST_TO_BE_SIGNED

//

//  pvStructInfo points to CERT_KEYGEN_REQUEST_INFO.

//

//  For CryptDecodeObject(), the pbEncoded is the "to be signed" plus its

//  signature (output of a X509_CERT CryptEncodeObject()).

//

//  For CryptEncodeObject(), the pbEncoded is just the "to be signed".

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  PKCS_ATTRIBUTE data structure

//

//  pvStructInfo points to a CRYPT_ATTRIBUTE.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  PKCS_CONTENT_INFO_SEQUENCE_OF_ANY data structure

//

//  pvStructInfo points to following CRYPT_CONTENT_INFO_SEQUENCE_OF_ANY.

//

//  For X509_ASN_ENCODING: encoded as a PKCS#7 ContentInfo structure wrapping

//  a sequence of ANY. The value of the contentType field is pszObjId,

//  while the content field is the following structure:

//      SequenceOfAny ::= SEQUENCE OF ANY

//

//  The CRYPT_DER_BLOBs point to the already encoded ANY content.

//--------------------------------------------------------------------------

 

type

  PCRYPT_CONTENT_INFO_SEQUENCE_OF_ANY = ^CRYPT_CONTENT_INFO_SEQUENCE_OF_ANY;

  CRYPT_CONTENT_INFO_SEQUENCE_OF_ANY = record

    pszObjId :LPSTR;

    cValue   :DWORD;

    rgValue  :PCRYPT_DER_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  PKCS_CONTENT_INFO data structure

//

//  pvStructInfo points to following CRYPT_CONTENT_INFO.

//

//  For X509_ASN_ENCODING: encoded as a PKCS#7 ContentInfo structure.

//  The CRYPT_DER_BLOB points to the already encoded ANY content.

//--------------------------------------------------------------------------

 

type

  PCRYPT_CONTENT_INFO = ^CRYPT_CONTENT_INFO;

  CRYPT_CONTENT_INFO = record

    pszObjId :LPSTR;

    Content  :CRYPT_DER_BLOB;

  end;

 

 

//+-------------------------------------------------------------------------

//  X509_OCTET_STRING data structure

//

//  pvStructInfo points to a CRYPT_DATA_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_BITS data structure

//

//  pvStructInfo points to a CRYPT_BIT_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_INTEGER data structure

//

//  pvStructInfo points to an int.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_MULTI_BYTE_INTEGER data structure

//

//  pvStructInfo points to a CRYPT_INTEGER_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_ENUMERATED data structure

//

//  pvStructInfo points to an int containing the enumerated value

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_CHOICE_OF_TIME data structure

//

//  pvStructInfo points to a FILETIME.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_SEQUENCE_OF_ANY data structure

//

//  pvStructInfo points to following CRYPT_SEQUENCE_OF_ANY.

//

//  The CRYPT_DER_BLOBs point to the already encoded ANY content.

//--------------------------------------------------------------------------

 

type

  PCRYPT_SEQUENCE_OF_ANY = ^CRYPT_SEQUENCE_OF_ANY;

  CRYPT_SEQUENCE_OF_ANY = record

    cValue  :DWORD;

    rgValue :PCRYPT_DER_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  X509_AUTHORITY_KEY_ID2

//  szOID_AUTHORITY_KEY_IDENTIFIER2

//

//  pvStructInfo points to following CERT_AUTHORITY_KEY_ID2_INFO.

//

//  For CRYPT_E_INVALID_IA5_STRING, the error location is returned in

//  *pcbEncoded by CryptEncodeObject(X509_AUTHORITY_KEY_ID2)

//

//  See X509_ALTERNATE_NAME for error location defines.

//--------------------------------------------------------------------------

 

type

  PCERT_AUTHORITY_KEY_ID2_INFO = ^CERT_AUTHORITY_KEY_ID2_INFO;

  CERT_AUTHORITY_KEY_ID2_INFO = record

    KeyId                     :CRYPT_DATA_BLOB;

    AuthorityCertIssuer       :CERT_ALT_NAME_INFO;  // Optional, set cAltEntry to 0 to omit.

    AuthorityCertSerialNumber :CRYPT_INTEGER_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  szOID_SUBJECT_KEY_IDENTIFIER

//

//  pvStructInfo points to a CRYPT_DATA_BLOB.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  X509_CRL_REASON_CODE

//  szOID_CRL_REASON_CODE

//

//  pvStructInfo points to an int which can be set to one of the following

//  enumerated values:

//--------------------------------------------------------------------------

 

const

  CRL_REASON_UNSPECIFIED            = 0;

  CRL_REASON_KEY_COMPROMISE         = 1;

  CRL_REASON_CA_COMPROMISE          = 2;

  CRL_REASON_AFFILIATION_CHANGED    = 3;

  CRL_REASON_SUPERSEDED             = 4;

  CRL_REASON_CESSATION_OF_OPERATION = 5;

  CRL_REASON_CERTIFICATE_HOLD       = 6;

  CRL_REASON_REMOVE_FROM_CRL        = 8;

 

//+-------------------------------------------------------------------------

//  X509_CRL_DIST_POINTS

//  szOID_CRL_DIST_POINTS

//

//  pvStructInfo points to following CRL_DIST_POINTS_INFO.

//

//  For CRYPT_E_INVALID_IA5_STRING, the error location is returned in

//  *pcbEncoded by CryptEncodeObject(X509_CRL_DIST_POINTS)

//

//  Error location consists of:

//    CRL_ISSUER_BIT    - 1 bit  << 31 (0 for FullName, 1 for CRLIssuer)

//    POINT_INDEX       - 7 bits << 24

//    ENTRY_INDEX       - 8 bits << 16

//    VALUE_INDEX       - 16 bits (unicode character index)

//

//  See X509_ALTERNATE_NAME for ENTRY_INDEX and VALUE_INDEX error location

//  defines.

//--------------------------------------------------------------------------

 

type

  PCRL_DIST_POINT_NAME = ^CRL_DIST_POINT_NAME;

  CRL_DIST_POINT_NAME = record

    dwDistPointNameChoice :DWORD;

    case integer of

      0:(FullName :CERT_ALT_NAME_INFO);  {1}

      1:({IssuerRDN :Not implemented});  {2}

  end;

 

const

  CRL_DIST_POINT_NO_NAME         = 0;

  CRL_DIST_POINT_FULL_NAME       = 1;

  CRL_DIST_POINT_ISSUER_RDN_NAME = 2;

 

type

  PCRL_DIST_POINT = ^CRL_DIST_POINT;

  CRL_DIST_POINT = record

    DistPointName :CRL_DIST_POINT_NAME;   // OPTIONAL

    ReasonFlags   :CRYPT_BIT_BLOB;        // OPTIONAL

    CRLIssuer     :CERT_ALT_NAME_INFO;    // OPTIONAL

  end;

 

const

  CRL_REASON_UNUSED_FLAG                 = $80;

  CRL_REASON_KEY_COMPROMISE_FLAG         = $40;

  CRL_REASON_CA_COMPROMISE_FLAG          = $20;

  CRL_REASON_AFFILIATION_CHANGED_FLAG    = $10;

  CRL_REASON_SUPERSEDED_FLAG             = $08;

  CRL_REASON_CESSATION_OF_OPERATION_FLAG = $04;

  CRL_REASON_CERTIFICATE_HOLD_FLAG       = $02;

 

type

  PCRL_DIST_POINTS_INFO = ^CRL_DIST_POINTS_INFO;

  CRL_DIST_POINTS_INFO = record

    cDistPoint  :DWORD;

    rgDistPoint :PCRL_DIST_POINT;

  end;

 

const

  CRL_DIST_POINT_ERR_INDEX_MASK  = $7F;

  CRL_DIST_POINT_ERR_INDEX_SHIFT = 24;

 

{#define GET_CRL_DIST_POINT_ERR_INDEX(X)  

    ((X >> CRL_DIST_POINT_ERR_INDEX_SHIFT) & CRL_DIST_POINT_ERR_INDEX_MASK)}

function GET_CRL_DIST_POINT_ERR_INDEX(X :DWORD):DWORD;

const CRL_DIST_POINT_ERR_CRL_ISSUER_BIT = (DWORD($80000000));

 

{#define IS_CRL_DIST_POINT_ERR_CRL_ISSUER(X)  

    (0 != (X & CRL_DIST_POINT_ERR_CRL_ISSUER_BIT))}

function IS_CRL_DIST_POINT_ERR_CRL_ISSUER(X :DWORD):BOOL;

 

//+-------------------------------------------------------------------------

//  X509_ENHANCED_KEY_USAGE

//  szOID_ENHANCED_KEY_USAGE

//

//  pvStructInfo points to a CERT_ENHKEY_USAGE, CTL_USAGE.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NEXT_UPDATE_LOCATION

//

//  pvStructInfo points to a CERT_ALT_NAME_INFO.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  PKCS_CTL

//  szOID_CTL

//

//  pvStructInfo points to a CTL_INFO.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_MULTI_BYTE_UINT

//

//  pvStructInfo points to a CRYPT_UINT_BLOB. Before encoding, inserts a

//  leading 0x00. After decoding, removes a leading 0x00.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_DSS_PUBLICKEY

//

//  pvStructInfo points to a CRYPT_UINT_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  X509_DSS_PARAMETERS

//

//  pvStructInfo points to following CERT_DSS_PARAMETERS data structure.

//--------------------------------------------------------------------------

 

type

  PCERT_DSS_PARAMETERS = ^CERT_DSS_PARAMETERS;

  CERT_DSS_PARAMETERS = record

    p :CRYPT_UINT_BLOB;

    q :CRYPT_UINT_BLOB;

    g :CRYPT_UINT_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  X509_DSS_SIGNATURE

//

//  pvStructInfo is a BYTE rgbSignature[CERT_DSS_SIGNATURE_LEN]. The

//  bytes are ordered as output by the DSS CSP's CryptSignHash().

//--------------------------------------------------------------------------

 

const

  CERT_DSS_R_LEN         = 20;

  CERT_DSS_S_LEN         = 20;

  CERT_DSS_SIGNATURE_LEN = (CERT_DSS_R_LEN + CERT_DSS_S_LEN);

 

// Sequence of 2 unsigned integers (the extra +1 is for a potential leading

// 0x00 to make the integer unsigned)

  CERT_MAX_ASN_ENCODED_DSS_SIGNATURE_LEN = (2 + 2*(2 + 20 +1));

 

//+-------------------------------------------------------------------------

//  PKCS_RC2_CBC_PARAMETERS

//  szOID_RSA_RC2CBC

//

//  pvStructInfo points to following CRYPT_RC2_CBC_PARAMETERS data structure.

//--------------------------------------------------------------------------

 

type

  PCRYPT_RC2_CBC_PARAMETERS = ^CRYPT_RC2_CBC_PARAMETERS;

  CRYPT_RC2_CBC_PARAMETERS = record

    dwVersion :DWORD;

    fIV       :BOOL;           // set if has following IV

    rgbIV     :array[0..8-1] of BYTE;

  end;

 

const

  CRYPT_RC2_40BIT_VERSION  = 160;

  CRYPT_RC2_64BIT_VERSION  = 120;

  CRYPT_RC2_128BIT_VERSION = 58;

 

 

//+-------------------------------------------------------------------------

//  PKCS_SMIME_CAPABILITIES

//  szOID_RSA_SMIMECapabilities

//

//  pvStructInfo points to following CRYPT_SMIME_CAPABILITIES data structure.

//

//  Note, for CryptEncodeObject(X509_ASN_ENCODING), Parameters.cbData == 0

//  causes the encoded parameters to be omitted and not encoded as a NULL

//  (05 00) as is done when encoding a CRYPT_ALGORITHM_IDENTIFIER. This

//  is per the SMIME specification for encoding capabilities.

//--------------------------------------------------------------------------

 

type

  PCRYPT_SMIME_CAPABILITY = ^CRYPT_SMIME_CAPABILITY;

  CRYPT_SMIME_CAPABILITY = record

    pszObjId   :LPSTR;

    Parameters :CRYPT_OBJID_BLOB;

  end;

 

type

  PCRYPT_SMIME_CAPABILITIES = ^CRYPT_SMIME_CAPABILITIES;

  CRYPT_SMIME_CAPABILITIES = record

    cCapability  :DWORD;

    rgCapability :PCRYPT_SMIME_CAPABILITY;

  end;

 

 

//+-------------------------------------------------------------------------

//  PKCS7_SIGNER_INFO

//

//  pvStructInfo points to CMSG_SIGNER_INFO.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  Netscape Certificate Extension Object Identifiers

//--------------------------------------------------------------------------

 

const

  szOID_NETSCAPE                   = '2.16.840.1.113730';

  szOID_NETSCAPE_CERT_EXTENSION    = '2.16.840.1.113730.1';

  szOID_NETSCAPE_CERT_TYPE         = '2.16.840.1.113730.1.1';

  szOID_NETSCAPE_BASE_URL          = '2.16.840.1.113730.1.2';

  szOID_NETSCAPE_REVOCATION_URL    = '2.16.840.1.113730.1.3';

  szOID_NETSCAPE_CA_REVOCATION_URL = '2.16.840.1.113730.1.4';

  szOID_NETSCAPE_CERT_RENEWAL_URL  = '2.16.840.1.113730.1.7';

  szOID_NETSCAPE_CA_POLICY_URL     = '2.16.840.1.113730.1.8';

  szOID_NETSCAPE_SSL_SERVER_NAME   = '2.16.840.1.113730.1.12';

  szOID_NETSCAPE_COMMENT           = '2.16.840.1.113730.1.13';

 

//+-------------------------------------------------------------------------

//  Netscape Certificate Data Type Object Identifiers

//--------------------------------------------------------------------------

 

const

  szOID_NETSCAPE_DATA_TYPE      = '2.16.840.1.113730.2';

  szOID_NETSCAPE_CERT_SEQUENCE  = '2.16.840.1.113730.2.5';

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_CERT_TYPE extension

//

//  Its value is a bit string. CryptDecodeObject/CryptEncodeObject using

//  X509_BITS.

//

//  The following bits are defined:

//--------------------------------------------------------------------------

 

const

  NETSCAPE_SSL_CLIENT_AUTH_CERT_TYPE  = $80;

  NETSCAPE_SSL_SERVER_AUTH_CERT_TYPE  = $40;

  NETSCAPE_SSL_CA_CERT_TYPE           = $04;

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_BASE_URL extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  When present this string is added to the beginning of all relative URLs

//  in the certificate.  This extension can be considered an optimization

//  to reduce the size of the URL extensions.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_REVOCATION_URL extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a relative or absolute URL that can be used to check the

//  revocation status of a certificate. The revocation check will be

//  performed as an HTTP GET method using a url that is the concatenation of

//  revocation-url and certificate-serial-number.

//  Where the certificate-serial-number is encoded as a string of

//  ascii hexadecimal digits. For example, if the netscape-base-url is

//  https://www.certs-r-us.com/, the netscape-revocation-url is

//  cgi-bin/check-rev.cgi?, and the certificate serial number is 173420,

//  the resulting URL would be:

//  https://www.certs-r-us.com/cgi-bin/check-rev.cgi?02a56c

//

//  The server should return a document with a Content-Type of

//  application/x-netscape-revocation.  The document should contain

//  a single ascii digit, '1' if the certificate is not curently valid,

//  and '0' if it is curently valid.

//

//  Note: for all of the URLs that include the certificate serial number,

//  the serial number will be encoded as a string which consists of an even

//  number of hexadecimal digits.  If the number of significant digits is odd,

//  the string will have a single leading zero to ensure an even number of

//  digits is generated.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_CA_REVOCATION_URL extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a relative or absolute URL that can be used to check the

//  revocation status of any certificates that are signed by the CA that

//  this certificate belongs to. This extension is only valid in CA

//  certificates.  The use of this extension is the same as the above

//  szOID_NETSCAPE_REVOCATION_URL extension.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_CERT_RENEWAL_URL extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a relative or absolute URL that points to a certificate renewal

//  form. The renewal form will be accessed with an HTTP GET method using a

//  url that is the concatenation of renewal-url and

//  certificate-serial-number. Where the certificate-serial-number is

//  encoded as a string of ascii hexadecimal digits. For example, if the

//  netscape-base-url is https://www.certs-r-us.com/, the

//  netscape-cert-renewal-url is cgi-bin/check-renew.cgi?, and the

//  certificate serial number is 173420, the resulting URL would be:

//  https://www.certs-r-us.com/cgi-bin/check-renew.cgi?02a56c

//  The document returned should be an HTML form that will allow the user

//  to request a renewal of their certificate.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_CA_POLICY_URL extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a relative or absolute URL that points to a web page that

//  describes the policies under which the certificate was issued.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_SSL_SERVER_NAME extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a "shell expression" that can be used to match the hostname of the

//  SSL server that is using this certificate.  It is recommended that if

//  the server's hostname does not match this pattern the user be notified

//  and given the option to terminate the SSL connection.  If this extension

//  is not present then the CommonName in the certificate subject's

//  distinguished name is used for the same purpose.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_COMMENT extension

//

//  Its value is an IA5_STRING. CryptDecodeObject/CryptEncodeObject using

//  X509_ANY_STRING or X509_UNICODE_ANY_STRING, where,

//  dwValueType = CERT_RDN_IA5_STRING.

//

//  It is a comment that may be displayed to the user when the certificate

//  is viewed.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  szOID_NETSCAPE_CERT_SEQUENCE

//

//  Its value is a PKCS#7 ContentInfo structure wrapping a sequence of

//  certificates. The value of the contentType field is

//  szOID_NETSCAPE_CERT_SEQUENCE, while the content field is the following

//  structure:

//      CertificateSequence ::= SEQUENCE OF Certificate.

//

//  CryptDecodeObject/CryptEncodeObject using

//  PKCS_CONTENT_INFO_SEQUENCE_OF_ANY, where,

//  pszObjId = szOID_NETSCAPE_CERT_SEQUENCE and the CRYPT_DER_BLOBs point

//  to encoded X509 certificates.

//--------------------------------------------------------------------------

 

 

//+=========================================================================

//  Object IDentifier (OID) Installable Functions:  Data Structures and APIs

//==========================================================================

 

type

  HCRYPTOIDFUNCSET = procedure;

  HCRYPTOIDFUNCADDR = procedure;

 

// Predefined OID Function Names

const

  CRYPT_OID_ENCODE_OBJECT_FUNC     = 'CryptDllEncodeObject';

  CRYPT_OID_DECODE_OBJECT_FUNC     = 'CryptDllDecodeObject';

  CRYPT_OID_CREATE_COM_OBJECT_FUNC = 'CryptDllCreateCOMObject';

  CRYPT_OID_VERIFY_REVOCATION_FUNC = 'CertDllVerifyRevocation';

  CRYPT_OID_VERIFY_CTL_USAGE_FUNC  = 'CertDllVerifyCTLUsage';

  CRYPT_OID_FORMAT_OBJECT_FUNC     = 'CryptDllFormatObject';

  CRYPT_OID_FIND_OID_INFO_FUNC     = 'CryptDllFindOIDInfo';

 

// CryptDllEncodeObject has same function signature as CryptEncodeObject.

 

// CryptDllDecodeObject has same function signature as CryptDecodeObject.

 

// CryptDllCreateCOMObject has the following signature:

//      BOOL WINAPI CryptDllCreateCOMObject(

//          IN DWORD dwEncodingType,

//          IN LPCSTR pszOID,

//          IN PCRYPT_DATA_BLOB pEncodedContent,

//          IN DWORD dwFlags,

//          IN REFIID riid,

//          OUT void **ppvObj);

 

// CertDllVerifyRevocation has the same signature as CertVerifyRevocation

//  (See CertVerifyRevocation for details on when called)

 

// CertDllVerifyCTLUsage has the same signature as CertVerifyCTLUsage

 

// CryptDllFindOIDInfo currently is only used to store values used by

// CryptFindOIDInfo. See CryptFindOIDInfo() for more details.

 

//  Example of a complete OID Function Registry Name:

//    HKEY_LOCAL_MACHINESoftwareMicrosoftCryptographyOID

//      Encoding Type 1CryptDllEncodeObject1.2.3

//

//  The key's L"Dll" value contains the name of the Dll.

//  The key's L"FuncName" value overrides the default function name

 

const

  CRYPT_OID_REGPATH                    = 'SoftwareMicrosoftCryptographyOID';

  CRYPT_OID_REG_ENCODING_TYPE_PREFIX   = 'EncodingType ';

{$IFNDEF VER90}

    CRYPT_OID_REG_DLL_VALUE_NAME         = WideString('Dll');

    CRYPT_OID_REG_FUNC_NAME_VALUE_NAME   = WideString('FuncName');

{$ELSE}

    CRYPT_OID_REG_DLL_VALUE_NAME         = ('Dll');

    CRYPT_OID_REG_FUNC_NAME_VALUE_NAME   = ('FuncName');

{$ENDIF}

  CRYPT_OID_REG_FUNC_NAME_VALUE_NAME_A = 'FuncName';

 

// OID used for Default OID functions

  CRYPT_DEFAULT_OID    = 'DEFAULT';

 

type

  PCRYPT_OID_FUNC_ENTRY = ^CRYPT_OID_FUNC_ENTRY;

  CRYPT_OID_FUNC_ENTRY = record

    pszOID     :LPCSTR;

    pvFuncAddr :PVOID;

  end;

 

const

  CRYPT_INSTALL_OID_FUNC_BEFORE_FLAG = 1;

 

//+-------------------------------------------------------------------------

//  Install a set of callable OID function addresses.

//

//  By default the functions are installed at end of the list.

//  Set CRYPT_INSTALL_OID_FUNC_BEFORE_FLAG to install at beginning of list.

//

//  hModule should be updated with the hModule passed to DllMain to prevent

//  the Dll containing the function addresses from being unloaded by

//  CryptGetOIDFuncAddress/CryptFreeOIDFunctionAddress. This would be the

//  case when the Dll has also regsvr32'ed OID functions via

//  CryptRegisterOIDFunction.

//

//  DEFAULT functions are installed by setting rgFuncEntry[].pszOID =

//  CRYPT_DEFAULT_OID.

//--------------------------------------------------------------------------

 

function CryptInstallOIDFunctionAddress(hModule :HMODULE;  // hModule passed to DllMain

                                        dwEncodingType :DWORD;

                                        pszFuncName :LPCSTR;

                                        cFuncEntry :DWORD;

                                  const rgFuncEntry :array of CRYPT_OID_FUNC_ENTRY;

                                        dwFlags :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Initialize and return handle to the OID function set identified by its

//  function name.

//

//  If the set already exists, a handle to the existing set is returned.

//--------------------------------------------------------------------------

 

function CryptInitOIDFunctionSet(pszFuncName :LPCSTR;

                                 dwFlags :DWORD ):HCRYPTOIDFUNCSET ; stdcall;

//+-------------------------------------------------------------------------

//  Search the list of installed functions for an encoding type and OID match.

//  If not found, search the registry.

//

//  For success, returns TRUE with *ppvFuncAddr updated with the function's

//  address and *phFuncAddr updated with the function address's handle.

//  The function's handle is AddRef'ed. CryptFreeOIDFunctionAddress needs to

//  be called to release it.

//

//  For a registry match, the Dll containing the function is loaded.

//--------------------------------------------------------------------------

 

function CryptGetOIDFunctionAddress(hFuncSet :HCRYPTOIDFUNCSET;

                                    dwEncodingType :DWORD;

                                    pszOID :LPCSTR;

                                    dwFlags :DWORD;

                                var ppvFuncAddr :array of PVOID;

                                var phFuncAddr :HCRYPTOIDFUNCADDR):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Get the list of registered default Dll entries for the specified

//  function set and encoding type.

//

//  The returned list consists of none, one or more null terminated Dll file

//  names. The list is terminated with an empty (L"") Dll file name.

//  For example: L"first.dll" L"" L"second.dll" L"" L""

//--------------------------------------------------------------------------

 

function CryptGetDefaultOIDDllList(hFuncSet :HCRYPTOIDFUNCSET;

                                   dwEncodingType :DWORD;

                                   pwszDllList    :LPWSTR;

                                   pcchDllList    :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Either: get the first or next installed DEFAULT function OR

//  load the Dll containing the DEFAULT function.

//

//  If pwszDll is NULL, search the list of installed DEFAULT functions.

//  *phFuncAddr must be set to NULL to get the first installed function.

//  Successive installed functions are returned by setting *phFuncAddr

//  to the hFuncAddr returned by the previous call.

//

//  If pwszDll is NULL, the input *phFuncAddr

//  is always CryptFreeOIDFunctionAddress'ed by this function, even for

//  an error.

//

//  If pwszDll isn't NULL, then, attempts to load the Dll and the DEFAULT

//  function. *phFuncAddr is ignored upon entry and isn't

//  CryptFreeOIDFunctionAddress'ed.

//

//  For success, returns TRUE with *ppvFuncAddr updated with the function's

//  address and *phFuncAddr updated with the function address's handle.

//  The function's handle is AddRef'ed. CryptFreeOIDFunctionAddress needs to

//  be called to release it or CryptGetDefaultOIDFunctionAddress can also

//  be called for a NULL pwszDll.

//--------------------------------------------------------------------------

 

function CryptGetDefaultOIDFunctionAddress(hFuncSet :HCRYPTOIDFUNCSET;

                                           dwEncodingType :DWORD;

                                           pwszDll :DWORD;

                                           dwFlags :LPCWSTR;

                                       var ppvFuncAddr :array of PVOID;

                                       var phFuncAddr :HCRYPTOIDFUNCADDR):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Releases the handle AddRef'ed and returned by CryptGetOIDFunctionAddress

//  or CryptGetDefaultOIDFunctionAddress.

//

//  If a Dll was loaded for the function its unloaded. However, before doing

//  the unload, the DllCanUnloadNow function exported by the loaded Dll is

//  called. It should return S_FALSE to inhibit the unload or S_TRUE to enable

//  the unload. If the Dll doesn't export DllCanUnloadNow, the Dll is unloaded.

//

//  DllCanUnloadNow has the following signature:

//      STDAPI  DllCanUnloadNow(void);

//--------------------------------------------------------------------------

 

function CryptFreeOIDFunctionAddress(hFuncAddr :HCRYPTOIDFUNCADDR;

                                     dwFlags :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Register the Dll containing the function to be called for the specified

//  encoding type, function name and OID.

//

//  pwszDll may contain environment-variable strings

//  which are ExpandEnvironmentStrings()'ed before loading the Dll.

//

//  In addition to registering the DLL, you may override the

//  name of the function to be called. For example,

//      pszFuncName = "CryptDllEncodeObject",

//      pszOverrideFuncName = "MyEncodeXyz".

//  This allows a Dll to export multiple OID functions for the same

//  function name without needing to interpose its own OID dispatcher function.

//--------------------------------------------------------------------------

 

function CryptRegisterOIDFunction(dwEncodingType :DWORD;

                                  pszFuncName :LPCSTR;

                                  pszOID :LPCSTR; //OPTIONAL

                                  pwszDll :LPCWSTR; //OPTIONAL

                                  pszOverrideFuncName :LPCSTR):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Unregister the Dll containing the function to be called for the specified

//  encoding type, function name and OID.

//--------------------------------------------------------------------------

 

function CryptUnregisterOIDFunction(dwEncodingType :DWORD;

                                    pszFuncName :LPCSTR;

                                    pszOID :LPCSTR):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Register the Dll containing the default function to be called for the

//  specified encoding type and function name.

//

//  Unlike CryptRegisterOIDFunction, you can't override the function name

//  needing to be exported by the Dll.

//

//  The Dll is inserted before the entry specified by dwIndex.

//    dwIndex == 0, inserts at the beginning.

//    dwIndex == CRYPT_REGISTER_LAST_INDEX, appends at the end.

//

//  pwszDll may contain environment-variable strings

//  which are ExpandEnvironmentStrings()'ed before loading the Dll.

//--------------------------------------------------------------------------

 

function CryptRegisterDefaultOIDFunction(dwEncodingType :DWORD;

                                         pszFuncName :LPCSTR;

                                         dwIndex :DWORD;

                                         pwszDll :LPCWSTR):BOOL ; stdcall;

 

const

  CRYPT_REGISTER_FIRST_INDEX = 0;

  CRYPT_REGISTER_LAST_INDEX  = $FFFFFFFF;

 

//+-------------------------------------------------------------------------

//  Unregister the Dll containing the default function to be called for

//  the specified encoding type and function name.

//--------------------------------------------------------------------------

 

function CryptUnregisterDefaultOIDFunction(dwEncodingType :DWORD;

                                           pszFuncName :LPCSTR;

                                           pwszDll :LPCWSTR):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Set the value for the specified encoding type, function name, OID and

//  value name.

//

//  See RegSetValueEx for the possible value types.

//

//  String types are UNICODE.

//--------------------------------------------------------------------------

 

function CryptSetOIDFunctionValue(dwEncodingType :DWORD;

                                  pszFuncName :LPCSTR;

                                  pszOID :LPCSTR;

                                  pwszValueName :LPCWSTR;

                                  dwValueType :DWORD;

                            const pbValueData :PBYTE;

                                  cbValueData :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Get the value for the specified encoding type, function name, OID and

//  value name.

//

//  See RegEnumValue for the possible value types.

//

//  String types are UNICODE.

//--------------------------------------------------------------------------

 

function CryptGetOIDFunctionValue(dwEncodingType :DWORD;

                                  pszFuncName :LPCSTR;

                                  pwszValueName :LPCSTR;

                                  pszOID :LPCWSTR;

                                  pdwValueType  :PDWORD;

                                  pbValueData  :PBYTE;

                                  pcbValueData :PDWORD):BOOL ; stdcall;

 

type

  PFN_CRYPT_ENUM_OID_FUNC = function (dwEncodingType :DWORD;

                                      pszFuncName :LPCSTR;

                                      pszOID :LPCSTR;

                                      cValue :DWORD;

                                const rgdwValueType :array of DWORD;

                                const rgpwszValueName :array of LPCWSTR;

                                const rgpbValueData :array of PBYTE;

                                const rgcbValueData :array of DWORD;

                                      pvArg :PVOID):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Enumerate the OID functions identified by their encoding type,

//  function name and OID.

//

//  pfnEnumOIDFunc is called for each registry key matching the input

//  parameters. Setting dwEncodingType to CRYPT_MATCH_ANY_ENCODING_TYPE matches

//  any. Setting pszFuncName or pszOID to NULL matches any.

//

//  Set pszOID == CRYPT_DEFAULT_OID to restrict the enumeration to only the

//  DEFAULT functions

//

//  String types are UNICODE.

//--------------------------------------------------------------------------

 

function CryptEnumOIDFunction(dwEncodingType :DWORD;

                              pszFuncName :LPCSTR;    //OPTIONAL

                              pszOID :LPCSTR;         //OPTIONAL

                              dwFlags :DWORD;

                              pvArg :PVOID;

                              pfnEnumOIDFunc :PFN_CRYPT_ENUM_OID_FUNC):BOOL ; stdcall;

 

const

  CRYPT_MATCH_ANY_ENCODING_TYPE = $FFFFFFFF;

 

//+=========================================================================

//  Object IDentifier (OID) Information:  Data Structures and APIs

//==========================================================================

 

//+-------------------------------------------------------------------------

//  OID Information

//--------------------------------------------------------------------------

 

type

  PCRYPT_OID_INFO = ^CRYPT_OID_INFO;

  CRYPT_OID_INFO = record

    cbSize :DWORD;

    pszOID :LPCSTR;

    pwszName :LPCWSTR;

    dwGroupId :DWORD;

    EnumValue : record {type EnumValue for the union part of the original struct --max--}

    case integer of

      0:(dwValue :DWORD);

      1:(Algid :ALG_ID);

      2:(dwLength :DWORD);

    end;

    ExtraInfo :CRYPT_DATA_BLOB;

  end;

 

type

  CCRYPT_OID_INFO  = CRYPT_OID_INFO;

  PCCRYPT_OID_INFO = ^CCRYPT_OID_INFO;

 

//+-------------------------------------------------------------------------

//  OID Group IDs

//--------------------------------------------------------------------------

 

const

  CRYPT_HASH_ALG_OID_GROUP_ID      = 1;

  CRYPT_ENCRYPT_ALG_OID_GROUP_ID   = 2;

  CRYPT_PUBKEY_ALG_OID_GROUP_ID    = 3;

  CRYPT_SIGN_ALG_OID_GROUP_ID      = 4;

  CRYPT_RDN_ATTR_OID_GROUP_ID      = 5;

  CRYPT_EXT_OR_ATTR_OID_GROUP_ID   = 6;

  CRYPT_ENHKEY_USAGE_OID_GROUP_ID  = 7;

  CRYPT_POLICY_OID_GROUP_ID        = 8;

  CRYPT_LAST_OID_GROUP_ID          = 8;

 

  CRYPT_FIRST_ALG_OID_GROUP_ID     = CRYPT_HASH_ALG_OID_GROUP_ID;

  CRYPT_LAST_ALG_OID_GROUP_ID      = CRYPT_SIGN_ALG_OID_GROUP_ID;

 

 

// The CRYPT_*_ALG_OID_GROUP_ID's have an Algid. The CRYPT_RDN_ATTR_OID_GROUP_ID

// has a dwLength. The CRYPT_EXT_OR_ATTR_OID_GROUP_ID,

// CRYPT_ENHKEY_USAGE_OID_GROUP_ID or CRYPT_POLICY_OID_GROUP_ID don't have a

// dwValue.

 

// CRYPT_PUBKEY_ALG_OID_GROUP_ID has the following optional ExtraInfo:

//  DWORD[0] - Flags. CRYPT_OID_INHIBIT_SIGNATURE_FORMAT_FLAG can be set to

//             inhibit the reformatting of the signature before

//             CryptVerifySignature is called or after CryptSignHash

//             is called. CRYPT_OID_USE_PUBKEY_PARA_FOR_PKCS7_FLAG can

//             be set to include the public key algorithm's parameters

//             in the PKCS7's digestEncryptionAlgorithm's parameters.

 

  CRYPT_OID_INHIBIT_SIGNATURE_FORMAT_FLAG  = $1;

  CRYPT_OID_USE_PUBKEY_PARA_FOR_PKCS7_FLAG = $2;

 

// CRYPT_SIGN_ALG_OID_GROUP_ID has the following optional ExtraInfo:

//  DWORD[0] - Public Key Algid.

//  DWORD[1] - Flags. Same as above for CRYPT_PUBKEY_ALG_OID_GROUP_ID.

 

// CRYPT_RDN_ATTR_OID_GROUP_ID has the following optional ExtraInfo:

//  Array of DWORDs:

//   [0 ..] - Null terminated list of acceptable RDN attribute

//            value types. An empty list implies CERT_RDN_PRINTABLE_STRING,

//            CERT_RDN_T61_STRING, 0.

 

//+-------------------------------------------------------------------------

//  Find OID information. Returns NULL if unable to find any information

//  for the specified key and group. Note, returns a pointer to a constant

//  data structure. The returned pointer MUST NOT be freed.

//

//  dwKeyType's:

//    CRYPT_OID_INFO_OID_KEY, pvKey points to a szOID

//    CRYPT_OID_INFO_NAME_KEY, pvKey points to a wszName

//    CRYPT_OID_INFO_ALGID_KEY, pvKey points to an ALG_ID

//    CRYPT_OID_INFO_SIGN_KEY, pvKey points to an array of two ALG_ID's:

//      ALG_ID[0] - Hash Algid

//      ALG_ID[1] - PubKey Algid

//

//  Setting dwGroupId to 0, searches all groups according to the dwKeyType.

//  Otherwise, only the dwGroupId is searched.

//--------------------------------------------------------------------------

 

function CryptFindOIDInfo(dwKeyType :DWORD;

                          pvKey :PVOID;

                          dwGroupId :DWORD):PCCRYPT_OID_INFO ; stdcall;

 

const

  CRYPT_OID_INFO_OID_KEY   = 1;

  CRYPT_OID_INFO_NAME_KEY  = 2;

  CRYPT_OID_INFO_ALGID_KEY = 3;

  CRYPT_OID_INFO_SIGN_KEY  = 4;

 

//+-------------------------------------------------------------------------

//  Register OID information. The OID information specified in the

//  CCRYPT_OID_INFO structure is persisted to the registry.

//

//  crypt32.dll contains information for the commonly known OIDs. This function

//  allows applications to augment crypt32.dll's OID information. During

//  CryptFindOIDInfo's first call, the registered OID information is installed.

//

//  By default the registered OID information is installed after crypt32.dll's

//  OID entries. Set CRYPT_INSTALL_OID_INFO_BEFORE_FLAG to install before.

//--------------------------------------------------------------------------

 

function CryptRegisterOIDInfo(pInfo :PCCRYPT_OID_INFO;

                              dwFlags:DWORD):BOOL ; stdcall;

 

const

  CRYPT_INSTALL_OID_INFO_BEFORE_FLAG = 1;

 

//+-------------------------------------------------------------------------

//  Unregister OID information. Only the pszOID and dwGroupId fields are

//  used to identify the OID information to be unregistered.

//--------------------------------------------------------------------------

 

function CryptUnregisterOIDInfo(pInfo :PCCRYPT_OID_INFO):BOOL ; stdcall;

 

//+=========================================================================

//  Low Level Cryptographic Message Data Structures and APIs

//==========================================================================

 

type

  HCRYPTMSG = Pointer;

 

const

  szOID_PKCS_7_DATA                = '1.2.840.113549.1.7.1';

  szOID_PKCS_7_SIGNED              = '1.2.840.113549.1.7.2';

  szOID_PKCS_7_ENVELOPED           = '1.2.840.113549.1.7.3';

  szOID_PKCS_7_SIGNEDANDENVELOPED  = '1.2.840.113549.1.7.4';

  szOID_PKCS_7_DIGESTED            = '1.2.840.113549.1.7.5';

  szOID_PKCS_7_ENCRYPTED           = '1.2.840.113549.1.7.6';

 

  szOID_PKCS_9_CONTENT_TYPE        = '1.2.840.113549.1.9.3';

  szOID_PKCS_9_MESSAGE_DIGEST      = '1.2.840.113549.1.9.4';

 

//+-------------------------------------------------------------------------

//  Message types

//--------------------------------------------------------------------------

 

const

  CMSG_DATA                  = 1;

  CMSG_SIGNED                = 2;

  CMSG_ENVELOPED             = 3;

  CMSG_SIGNED_AND_ENVELOPED  = 4;

  CMSG_HASHED                = 5;

  CMSG_ENCRYPTED             = 6;

 

//+-------------------------------------------------------------------------

//  Message Type Bit Flags

//--------------------------------------------------------------------------

 

  CMSG_ALL_FLAGS                 = (not ULONG(0));

  CMSG_DATA_FLAG                 = (1 shl CMSG_DATA);

  CMSG_SIGNED_FLAG               = (1 shl CMSG_SIGNED);

  CMSG_ENVELOPED_FLAG            = (1 shl CMSG_ENVELOPED);

  CMSG_SIGNED_AND_ENVELOPED_FLAG = (1 shl CMSG_SIGNED_AND_ENVELOPED);

  CMSG_HASHED_FLAG               = (1 shl CMSG_HASHED);

  CMSG_ENCRYPTED_FLAG            = (1 shl CMSG_ENCRYPTED);

 

//+-------------------------------------------------------------------------

//  The message encode information (pvMsgEncodeInfo) is message type dependent

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_DATA: pvMsgEncodeInfo = NULL

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNED

//

//  The pCertInfo in the CMSG_SIGNER_ENCODE_INFO provides the Issuer, SerialNumber

//  and PublicKeyInfo.Algorithm. The PublicKeyInfo.Algorithm implicitly

//  specifies the HashEncryptionAlgorithm to be used.

//

//  The hCryptProv and dwKeySpec specify the private key to use. If dwKeySpec

//  == 0, then, defaults to AT_SIGNATURE.

//

//  pvHashAuxInfo currently isn't used and must be set to NULL.

//--------------------------------------------------------------------------

 

type

  PCMSG_SIGNER_ENCODE_INFO = ^CMSG_SIGNER_ENCODE_INFO;

  CMSG_SIGNER_ENCODE_INFO = record

    cbSize        :DWORD;

    pCertInfo     :PCERT_INFO;

    hCryptProv    :HCRYPTPROV;

    dwKeySpec     :DWORD;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvHashAuxInfo :PVOID;

    cAuthAttr     :DWORD;

    rgAuthAttr    :PCRYPT_ATTRIBUTE;

    cUnauthAttr   :DWORD;

    rgUnauthAttr  :PCRYPT_ATTRIBUTE;

  end;

 

type

  PCMSG_SIGNED_ENCODE_INFO = ^CMSG_SIGNED_ENCODE_INFO;

  CMSG_SIGNED_ENCODE_INFO = record

    cbSize        :DWORD;

    cSigners      :DWORD;

    rgSigners     :PCMSG_SIGNER_ENCODE_INFO;

    cCertEncoded  :DWORD;

    rgCertEncoded :PCERT_BLOB;

    cCrlEncoded   :DWORD;

    rgCrlEncoded  :PCRL_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_ENVELOPED

//

//  The PCERT_INFO for the rgRecipients provides the Issuer, SerialNumber

//  and PublicKeyInfo. The PublicKeyInfo.Algorithm implicitly

//  specifies the KeyEncryptionAlgorithm to be used.

//

//  The PublicKeyInfo.PublicKey in PCERT_INFO is used to encrypt the content

//  encryption key for the recipient.

//

//  hCryptProv is used to do the content encryption, recipient key encryption

//  and export. The hCryptProv's private keys aren't used.

//

//  Note: CAPI currently doesn't support more than one KeyEncryptionAlgorithm

//  per provider. This will need to be fixed.

//

//  pvEncryptionAuxInfo currently isn't used and must be set to NULL.

//--------------------------------------------------------------------------

 

type

  PCMSG_ENVELOPED_ENCODE_INFO = ^CMSG_ENVELOPED_ENCODE_INFO;

  CMSG_ENVELOPED_ENCODE_INFO = record

    cbSize :DWORD;

    hCryptProv :HCRYPTPROV;

    ContentEncryptionAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvEncryptionAuxInfo :PVOID;

    cRecipients :DWORD;

    rgpRecipients :PPCERT_INFO; // pointer to array of PCERT_INFO

end;

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNED_AND_ENVELOPED

//

//  For PKCS #7, a signed and enveloped message doesn't have the

//  signer's authenticated or unauthenticated attributes. Otherwise, a

//  combination of the CMSG_SIGNED_ENCODE_INFO and CMSG_ENVELOPED_ENCODE_INFO.

//--------------------------------------------------------------------------

 

type

  PCMSG_SIGNED_AND_ENVELOPED_ENCODE_INFO = ^CMSG_SIGNED_AND_ENVELOPED_ENCODE_INFO;

  CMSG_SIGNED_AND_ENVELOPED_ENCODE_INFO = record

    cbSize        :DWORD;

    SignedInfo    :CMSG_SIGNED_ENCODE_INFO;

    EnvelopedInfo :CMSG_ENVELOPED_ENCODE_INFO;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_HASHED

//

//  hCryptProv is used to do the hash. Doesn't need to use a private key.

//

//  If fDetachedHash is set, then, the encoded message doesn't contain

//  any content (its treated as NULL Data)

//

//  pvHashAuxInfo currently isn't used and must be set to NULL.

//--------------------------------------------------------------------------

 

type

  PCMSG_HASHED_ENCODE_INFO = ^CMSG_HASHED_ENCODE_INFO;

  CMSG_HASHED_ENCODE_INFO = record

    cbSize :DWORD;

    hCryptProv :HCRYPTPROV;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvHashAuxInfo :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_ENCRYPTED

//

//  The key used to encrypt the message is identified outside of the message

//  content (for example, password).

//

//  The content input to CryptMsgUpdate has already been encrypted.

//

//  pvEncryptionAuxInfo currently isn't used and must be set to NULL.

//--------------------------------------------------------------------------

 

type

  PCMSG_ENCRYPTED_ENCODE_INFO = ^CMSG_ENCRYPTED_ENCODE_INFO;

  CMSG_ENCRYPTED_ENCODE_INFO = record

    cbSize :DWORD;

    ContentEncryptionAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvEncryptionAuxInfo :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  This parameter allows messages to be of variable length with streamed

//  output.

//

//  By default, messages are of a definite length and

//  CryptMsgGetParam(CMSG_CONTENT_PARAM) is

//  called to get the cryptographically processed content. Until closed,

//  the handle keeps a copy of the processed content.

//

//  With streamed output, the processed content can be freed as its streamed.

//

//  If the length of the content to be updated is known at the time of the

//  open, then, ContentLength should be set to that length. Otherwise, it

//  should be set to CMSG_INDEFINITE_LENGTH.

//--------------------------------------------------------------------------

 

type

  PFN_CMSG_STREAM_OUTPUT = function (

                               const pvArg :PVOID;

                                     pbData :PBYTE;

                                     cbData :DWORD;

                                     fFinal :BOOL):BOOL ; stdcall;

 

const

  CMSG_INDEFINITE_LENGTH = ($FFFFFFFF);

 

type

  PCMSG_STREAM_INFO = ^CMSG_STREAM_INFO;

  CMSG_STREAM_INFO = record

    cbContent :DWORD;

    pfnStreamOutput :PFN_CMSG_STREAM_OUTPUT;

    pvArg :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  Open dwFlags

//--------------------------------------------------------------------------

 

const

  CMSG_BARE_CONTENT_FLAG              = $00000001;

  CMSG_LENGTH_ONLY_FLAG               = $00000002;

  CMSG_DETACHED_FLAG                  = $00000004;

  CMSG_AUTHENTICATED_ATTRIBUTES_FLAG  = $00000008;

  CMSG_CONTENTS_OCTETS_FLAG           = $00000010;

  CMSG_MAX_LENGTH_FLAG                = $00000020;

 

//+-------------------------------------------------------------------------

//  Open a cryptographic message for encoding

//

//  For PKCS #7:

//  If the content to be passed to CryptMsgUpdate has already

//  been message encoded (the input to CryptMsgUpdate is the streamed output

//  from another message encode), then, the CMSG_ENCODED_CONTENT_INFO_FLAG should

//  be set in dwFlags. If not set, then, the inner ContentType is Data and

//  the input to CryptMsgUpdate is treated as the inner Data type's Content,

//  a string of bytes.

//  If CMSG_BARE_CONTENT_FLAG is specified for a streamed message,

//  the streamed output will not have an outer ContentInfo wrapper. This

//  makes it suitable to be streamed into an enclosing message.

//

//  The pStreamInfo parameter needs to be set to stream the encoded message

//  output.

//--------------------------------------------------------------------------

 

function CryptMsgOpenToEncode(dwMsgEncodingType :DWORD;

                              dwFlags :DWORD;

                              dwMsgType :DWORD;

                              pvMsgEncodeInfo :PVOID;

                              pszInnerContentObjID :LPSTR;      //OPTIONAL

                              pStreamInfo :PCMSG_STREAM_INFO    //OPTIONAL

                              ):HCRYPTMSG ; stdcall;

 

//+-------------------------------------------------------------------------

//  Calculate the length of an encoded cryptographic message.

//

//  Calculates the length of the encoded message given the

//  message type, encoding parameters and total length of

//  the data to be updated. Note, this might not be the exact length. However,

//  it will always be greater than or equal to the actual length.

//--------------------------------------------------------------------------

 

function CryptMsgCalculateEncodedLength(dwMsgEncodingType :DWORD;

                                        dwFlags :DWORD;

                                        dwMsgType :DWORD;

                                        pvMsgEncodeInfo :PVOID;

                                        pszInnerContentObjID :LPSTR; //OPTIONAL

                                        cbData :DWORD):DWORD ; stdcall;

 

//+-------------------------------------------------------------------------

//  Open a cryptographic message for decoding

//

//  For PKCS #7: if the inner ContentType isn't Data, then, the inner

//  ContentInfo consisting of both ContentType and Content is output.

//  To also enable ContentInfo output for the Data ContentType, then,

//  the CMSG_ENCODED_CONTENT_INFO_FLAG should be set

//  in dwFlags. If not set, then, only the content portion of the inner

//  ContentInfo is output for the Data ContentType.

//

//  To only calculate the length of the decoded message, set the

//  CMSG_LENGTH_ONLY_FLAG in dwFlags. After the final CryptMsgUpdate get the

//  MSG_CONTENT_PARAM. Note, this might not be the exact length. However,

//  it will always be greater than or equal to the actual length.

//

//  hCryptProv specifies the crypto provider to use for hashing and/or

//  decrypting the message. For enveloped messages, hCryptProv also specifies

//  the private exchange key to use. For signed messages, hCryptProv is used

//  when CryptMsgVerifySigner is called.

//

//  For enveloped messages, the pRecipientInfo contains the Issuer and

//  SerialNumber identifying the RecipientInfo in the message.

//

//  Note, the pRecipientInfo should correspond to the provider's private

//  exchange key.

//

//  If pRecipientInfo is NULL, then, the message isn't decrypted. To decrypt

//  the message, CryptMsgControl(CMSG_CTRL_DECRYPT) is called after the final

//  CryptMsgUpdate.

//

//  The pStreamInfo parameter needs to be set to stream the decoded content

//  output. Note, if pRecipientInfo is NULL, then, the streamed output isn't

//  decrypted.

//--------------------------------------------------------------------------

 

function CryptMsgOpenToDecode(dwMsgEncodingType :DWORD;

                              dwFlags :DWORD;

                              dwMsgType :DWORD;

                              hCryptProv :HCRYPTPROV;

                              pRecipientInfo :PCERT_INFO;   //OPTIONAL

                              pStreamInfo:PCMSG_STREAM_INFO //OPTIONAL

                              ):HCRYPTMSG ; stdcall;

 

//+-------------------------------------------------------------------------

//  Close a cryptographic message handle

//

//  LastError is preserved unless FALSE is returned.

//--------------------------------------------------------------------------

 

function CryptMsgClose(hCryptMsg :HCRYPTMSG):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Update the content of a cryptographic message. Depending on how the

//  message was opened, the content is either encoded or decoded.

//

//  This function is repetitively called to append to the message content.

//  fFinal is set to identify the last update. On fFinal, the encode/decode

//  is completed. The encoded/decoded content and the decoded parameters

//  are valid until the open and all duplicated handles are closed.

//--------------------------------------------------------------------------

 

function CryptMsgUpdate(hCryptMsg :HCRYPTMSG;

                  const pbData :PBYTE;

                        cbData :DWORD;

                        fFinal :BOOL):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Perform a special "control" function after the final CryptMsgUpdate of a

//  encoded/decoded cryptographic message.

//

//  The dwCtrlType parameter specifies the type of operation to be performed.

//

//  The pvCtrlPara definition depends on the dwCtrlType value.

//

//  See below for a list of the control operations and their pvCtrlPara

//  type definition.

//--------------------------------------------------------------------------

 

function CryptMsgControl(hCryptMsg :HCRYPTMSG;

                         dwFlags :DWORD;

                         dwCtrlType :DWORD;

                         pvCtrlPara :PVOID):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Message control types

//--------------------------------------------------------------------------

 

const

  CMSG_CTRL_VERIFY_SIGNATURE       = 1;

  CMSG_CTRL_DECRYPT                = 2;

  CMSG_CTRL_VERIFY_HASH            = 5;

  CMSG_CTRL_ADD_SIGNER             = 6;

  CMSG_CTRL_DEL_SIGNER             = 7;

  CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR = 8;

  CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR = 9;

  CMSG_CTRL_ADD_CERT               = 10;

  CMSG_CTRL_DEL_CERT               = 11;

  CMSG_CTRL_ADD_CRL                = 12;

  CMSG_CTRL_DEL_CRL                = 13;

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_VERIFY_SIGNATURE

//

//  Verify the signature of a SIGNED or SIGNED_AND_ENVELOPED

//  message after it has been decoded.

//

//  For a SIGNED_AND_ENVELOPED message, called after

//  CryptMsgControl(CMSG_CTRL_DECRYPT), if CryptMsgOpenToDecode was called

//  with a NULL pRecipientInfo.

//

//  pvCtrlPara points to a CERT_INFO struct.

//

//  The CERT_INFO contains the Issuer and SerialNumber identifying

//  the Signer of the message. The CERT_INFO also contains the

//  PublicKeyInfo

//  used to verify the signature. The cryptographic provider specified

//  in CryptMsgOpenToDecode is used.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_DECRYPT

//

//  Decrypt an ENVELOPED or SIGNED_AND_ENVELOPED message after it has been

//  decoded.

//

//  hCryptProv and dwKeySpec specify the private key to use. For dwKeySpec ==

//  0, defaults to AT_KEYEXCHANGE.

//

//  dwRecipientIndex is the index of the recipient in the message associated

//  with the hCryptProv's private key.

//

//  This control function needs to be called, if you don't know the appropriate

//  recipient before calling CryptMsgOpenToDecode. After the final

//  CryptMsgUpdate, the list of recipients is obtained by iterating through

//  CMSG_RECIPIENT_INFO_PARAM. The recipient corresponding to a private

//  key owned by the caller is selected and passed to this function to decrypt

//  the message.

//

//  Note, the message can only be decrypted once.

//--------------------------------------------------------------------------

 

type

  PCMSG_CTRL_DECRYPT_PARA = ^CMSG_CTRL_DECRYPT_PARA;

  CMSG_CTRL_DECRYPT_PARA = record

    cbSize :DWORD;

    hCryptProv :HCRYPTPROV;

    dwKeySpec :DWORD;

    dwRecipientIndex :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_VERIFY_HASH

//

//  Verify the hash of a HASHED message after it has been decoded.

//

//  Only the hCryptMsg parameter is used, to specify the message whose

//  hash is being verified.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_ADD_SIGNER

//

//  Add a signer to a signed-data or signed-and-enveloped-data message.

//

//  pvCtrlPara points to a CMSG_SIGNER_ENCODE_INFO.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_DEL_SIGNER

//

//  Remove a signer from a signed-data or signed-and-enveloped-data message.

//

//  pvCtrlPara points to a DWORD containing the 0-based index of the

//  signer to be removed.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR

//

//  Add an unauthenticated attribute to the SignerInfo of a signed-data or

//  signed-and-enveloped-data message.

//

//  The unauthenticated attribute is input in the form of an encoded blob.

//--------------------------------------------------------------------------

 

type

  PCMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR_PARA = ^CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR_PARA;

  CMSG_CTRL_ADD_SIGNER_UNAUTH_ATTR_PARA = record

    cbSize :DWORD;

    dwSignerIndex :DWORD;

    blob :CRYPT_DATA_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR

//

//  Delete an unauthenticated attribute from the SignerInfo of a signed-data

//  or signed-and-enveloped-data message.

//

//  The unauthenticated attribute to be removed is specified by

//  a 0-based index.

//--------------------------------------------------------------------------

 

type

  PCMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR_PARA = ^CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR_PARA;

  CMSG_CTRL_DEL_SIGNER_UNAUTH_ATTR_PARA = record

    cbSize :DWORD;

    dwSignerIndex :DWORD;

    dwUnauthAttrIndex :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_ADD_CERT

//

//  Add a certificate to a signed-data or signed-and-enveloped-data message.

//

//  pvCtrlPara points to a CRYPT_DATA_BLOB containing the certificate's

//  encoded bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_DEL_CERT

//

//  Delete a certificate from a signed-data or signed-and-enveloped-data

//  message.

//

//  pvCtrlPara points to a DWORD containing the 0-based index of the

//  certificate to be removed.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_ADD_CRL

//

//  Add a CRL to a signed-data or signed-and-enveloped-data message.

//

//  pvCtrlPara points to a CRYPT_DATA_BLOB containing the CRL's

//  encoded bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CTRL_DEL_CRL

//

//  Delete a CRL from a signed-data or signed-and-enveloped-data message.

//

//  pvCtrlPara points to a DWORD containing the 0-based index of the CRL

//  to be removed.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  Verify a countersignature, at the SignerInfo level.

//  ie. verify that pbSignerInfoCountersignature contains the encrypted

//  hash of the encryptedDigest field of pbSignerInfo.

//

//  hCryptProv is used to hash the encryptedDigest field of pbSignerInfo.

//  The only fields referenced from pciCountersigner are SerialNumber, Issuer,

//  and SubjectPublicKeyInfo.

//--------------------------------------------------------------------------

 

function CryptMsgVerifyCountersignatureEncoded(hCryptProv :HCRYPTPROV;

                                               dwEncodingType :DWORD;

                                               pbSignerInfo :PBYTE;

                                               cbSignerInfo :DWORD;

                                               pbSignerInfoCountersignature :PBYTE;

                                               cbSignerInfoCountersignature :DWORD;

                                               pciCountersigner :PCERT_INFO):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Countersign an already-existing signature in a message

//

//  dwIndex is a zero-based index of the SignerInfo to be countersigned.

//--------------------------------------------------------------------------

 

function CryptMsgCountersign(hCryptMsg :HCRYPTMSG;

                             dwIndex :DWORD;

                             cCountersigners :DWORD;

                             rgCountersigners :PCMSG_SIGNER_ENCODE_INFO):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Countersign an already-existing signature (encoded SignerInfo).

//  Output an encoded SignerInfo blob, suitable for use as a countersignature

//  attribute in the unauthenticated attributes of a signed-data or

//  signed-and-enveloped-data message.

//--------------------------------------------------------------------------

 

function CryptMsgCountersignEncoded(dwEncodingType :DWORD;

                                    pbSignerInfo :PBYTE;

                                    cbSignerInfo :DWORD;

                                    cCountersigners :DWORD;

                                    rgCountersigners :PCMSG_SIGNER_ENCODE_INFO;

                                    pbCountersignature :PBYTE;

                                    pcbCountersignature :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Get a parameter after encoding/decoding a cryptographic message. Called

//  after the final CryptMsgUpdate. Only the CMSG_CONTENT_PARAM and

//  CMSG_COMPUTED_HASH_PARAM are valid for an encoded message.

//

//  For an encoded HASHED message, the CMSG_COMPUTED_HASH_PARAM can be got

//  before any CryptMsgUpdates to get its length.

//

//  The pvData type definition depends on the dwParamType value.

//

//  Elements pointed to by fields in the pvData structure follow the

//  structure. Therefore, *pcbData may exceed the size of the structure.

//

//  Upon input, if *pcbData == 0, then, *pcbData is updated with the length

//  of the data and the pvData parameter is ignored.

//

//  Upon return, *pcbData is updated with the length of the data.

//

//  The OBJID BLOBs returned in the pvData structures point to

//  their still encoded representation. The appropriate functions

//  must be called to decode the information.

//

//  See below for a list of the parameters to get.

//--------------------------------------------------------------------------

 

function CryptMsgGetParam(hCryptMsg :HCRYPTMSG;

                          dwParamType :DWORD;

                          dwIndex :DWORD;

                          pvData :PVOID;

                          pcbData :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Get parameter types and their corresponding data structure definitions.

//--------------------------------------------------------------------------

 

const

  CMSG_TYPE_PARAM                  = 1;

  CMSG_CONTENT_PARAM               = 2;

  CMSG_BARE_CONTENT_PARAM          = 3;

  CMSG_INNER_CONTENT_TYPE_PARAM    = 4;

  CMSG_SIGNER_COUNT_PARAM          = 5;

  CMSG_SIGNER_INFO_PARAM           = 6;

  CMSG_SIGNER_CERT_INFO_PARAM      = 7;

  CMSG_SIGNER_HASH_ALGORITHM_PARAM = 8;

  CMSG_SIGNER_AUTH_ATTR_PARAM      = 9;

  CMSG_SIGNER_UNAUTH_ATTR_PARAM    = 10;

  CMSG_CERT_COUNT_PARAM            = 11;

  CMSG_CERT_PARAM                  = 12;

  CMSG_CRL_COUNT_PARAM             = 13;

  CMSG_CRL_PARAM                   = 14;

  CMSG_ENVELOPE_ALGORITHM_PARAM    = 15;

  CMSG_RECIPIENT_COUNT_PARAM       = 17;

  CMSG_RECIPIENT_INDEX_PARAM       = 18;

  CMSG_RECIPIENT_INFO_PARAM        = 19;

  CMSG_HASH_ALGORITHM_PARAM        = 20;

  CMSG_HASH_DATA_PARAM             = 21;

  CMSG_COMPUTED_HASH_PARAM         = 22;

  CMSG_ENCRYPT_PARAM               = 26;

  CMSG_ENCRYPTED_DIGEST            = 27;

  CMSG_ENCODED_SIGNER              = 28;

  CMSG_ENCODED_MESSAGE             = 29;

 

//+-------------------------------------------------------------------------

//  CMSG_TYPE_PARAM

//

//  The type of the decoded message.

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CONTENT_PARAM

//

//  The encoded content of a cryptographic message. Depending on how the

//  message was opened, the content is either the whole PKCS#7

//  message (opened to encode) or the inner content (opened to decode).

//  In the decode case, the decrypted content is returned, if enveloped.

//  If not enveloped, and if the inner content is of type DATA, the returned

//  data is the contents octets of the inner content.

//

//  pvData points to the buffer receiving the content bytes

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_BARE_CONTENT_PARAM

//

//  The encoded content of an encoded cryptographic message, without the

//  outer layer of ContentInfo. That is, only the encoding of the

//  ContentInfo.content field is returned.

//

//  pvData points to the buffer receiving the content bytes

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_INNER_CONTENT_TYPE_PARAM

//

//  The type of the inner content of a decoded cryptographic message,

//  in the form of a NULL-terminated object identifier string

//  (eg. "1.2.840.113549.1.7.1").

//

//  pvData points to the buffer receiving the object identifier string

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_COUNT_PARAM

//

//  Count of signers in a SIGNED or SIGNED_AND_ENVELOPED message

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_CERT_INFO_PARAM

//

//  To get all the signers, repetitively call CryptMsgGetParam, with

//  dwIndex set to 0 .. SignerCount - 1.

//

//  pvData points to a CERT_INFO struct.

//

//  Only the following fields have been updated in the CERT_INFO struct:

//  Issuer and SerialNumber.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_INFO_PARAM

//

//  To get all the signers, repetitively call CryptMsgGetParam, with

//  dwIndex set to 0 .. SignerCount - 1.

//

//  pvData points to a CMSG_SIGNER_INFO struct.

//--------------------------------------------------------------------------

 

type

  PCMSG_SIGNER_INFO = ^CMSG_SIGNER_INFO;

  CMSG_SIGNER_INFO = record

    dwVersion :DWORD;

    Issuer :CERT_NAME_BLOB;

    SerialNumber :CRYPT_INTEGER_BLOB;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    HashEncryptionAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    EncryptedHash :CRYPT_DATA_BLOB;

    AuthAttrs :CRYPT_ATTRIBUTES;

    UnauthAttrs :CRYPT_ATTRIBUTES;

  end;

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_HASH_ALGORITHM_PARAM

//

//  This parameter specifies the HashAlgorithm that was used for the signer.

//

//  Set dwIndex to iterate through all the signers.

//

//  pvData points to an CRYPT_ALGORITHM_IDENTIFIER struct.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_AUTH_ATTR_PARAM

//

//  The authenticated attributes for the signer.

//

//  Set dwIndex to iterate through all the signers.

//

//  pvData points to a CMSG_ATTR struct.

//--------------------------------------------------------------------------

 

type

  CMSG_ATTR   = CRYPT_ATTRIBUTES;

  PCMSG_ATTR  = ^CRYPT_ATTRIBUTES;

 

//+-------------------------------------------------------------------------

//  CMSG_SIGNER_UNAUTH_ATTR_PARAM

//

//  The unauthenticated attributes for the signer.

//

//  Set dwIndex to iterate through all the signers.

//

//  pvData points to a CMSG_ATTR struct.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CERT_COUNT_PARAM

//

//  Count of certificates in a SIGNED or SIGNED_AND_ENVELOPED message.

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CERT_PARAM

//

//  To get all the certificates, repetitively call CryptMsgGetParam, with

//  dwIndex set to 0 .. CertCount - 1.

//

//  pvData points to an array of the certificate's encoded bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CRL_COUNT_PARAM

//

//  Count of CRLs in a SIGNED or SIGNED_AND_ENVELOPED message.

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_CRL_PARAM

//

//  To get all the CRLs, repetitively call CryptMsgGetParam, with

//  dwIndex set to 0 .. CrlCount - 1.

//

//  pvData points to an array of the CRL's encoded bytes.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  CMSG_ENVELOPE_ALGORITHM_PARAM

//

//  The ContentEncryptionAlgorithm that was used in

//  an ENVELOPED or SIGNED_AND_ENVELOPED message.

//

//  pvData points to an CRYPT_ALGORITHM_IDENTIFIER struct.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_RECIPIENT_COUNT_PARAM

//

//  Count of recipients in an ENVELOPED or SIGNED_AND_ENVELOPED message.

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_RECIPIENT_INDEX_PARAM

//

//  Index of the recipient used to decrypt an ENVELOPED or SIGNED_AND_ENVELOPED

//  message.

//

//  pvData points to a DWORD

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_RECIPIENT_INFO_PARAM

//

//  To get all the recipients, repetitively call CryptMsgGetParam, with

//  dwIndex set to 0 .. RecipientCount - 1.

//

//  pvData points to a CERT_INFO struct.

//

//  Only the following fields have been updated in the CERT_INFO struct:

//  Issuer, SerialNumber and PublicKeyAlgorithm. The PublicKeyAlgorithm

//  specifies the KeyEncryptionAlgorithm that was used.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_HASH_ALGORITHM_PARAM

//

//  The HashAlgorithm in a HASHED message.

//

//  pvData points to an CRYPT_ALGORITHM_IDENTIFIER struct.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_HASH_DATA_PARAM

//

//  The hash in a HASHED message.

//

//  pvData points to an array of bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_COMPUTED_HASH_PARAM

//

//  The computed hash for a HASHED message.

//

//  This may be called for either an encoded or decoded message.

//  It also may be called before any encoded CryptMsgUpdates to get its length.

//

//  pvData points to an array of bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_ENCRYPT_PARAM

//

//  The ContentEncryptionAlgorithm that was used in an ENCRYPTED message.

//

//  pvData points to an CRYPT_ALGORITHM_IDENTIFIER struct.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CMSG_ENCODED_MESSAGE

//

//  The full encoded message. This is useful in the case of a decoded

//  message which has been modified (eg. a signed-data or

//  signed-and-enveloped-data message which has been countersigned).

//

//  pvData points to an array of the message's encoded bytes.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CryptMsg OID installable functions

//--------------------------------------------------------------------------

 

// If *phCryptProv is NULL upon entry, then, if supported, the installable

// function should acquire a default provider and return. Note, its up

// to the installable function to release at process detach.

 

const

  CMSG_OID_GEN_ENCRYPT_KEY_FUNC = 'CryptMsgDllGenEncryptKey';

 

type

  PFN_CMSG_GEN_ENCRYPT_KEY = function (phCryptProv :PHCRYPTPROV;

                                       paiEncrypt :PCRYPT_ALGORITHM_IDENTIFIER;

                                       pvEncryptAuxInfo :PVOID;

                                       pPublicKeyInfo :PCERT_PUBLIC_KEY_INFO;

                                       phEncryptKey :PHCRYPTKEY

                                       ):BOOL ; stdcall;

 

const

  CMSG_OID_EXPORT_ENCRYPT_KEY_FUNC = 'CryptMsgDllExportEncryptKey';

 

type

  PFN_CMSG_EXPORT_ENCRYPT_KEY = function (hCryptProv :HCRYPTPROV;

                                          hEncryptKey :HCRYPTKEY;

                                          pPublicKeyInfo :PCERT_PUBLIC_KEY_INFO;

                                          pbData :PBYTE;

                                          pcbData :PDWORD):BOOL ; stdcall;

 

const

  CMSG_OID_IMPORT_ENCRYPT_KEY_FUNC = 'CryptMsgDllImportEncryptKey';

 

type

  PFN_CMSG_IMPORT_ENCRYPT_KEY = function (hCryptProv :HCRYPTPROV;

                                          dwKeySpec :DWORD;

                                          paiEncrypt :PCRYPT_ALGORITHM_IDENTIFIER;

                                          paiPubKey :PCRYPT_ALGORITHM_IDENTIFIER;

                                          pbEncodedKey :PBYTE;

                                          cbEncodedKey :DWORD;

                                          phEncryptKey :PHCRYPTKEY

                                          ):BOOL ; stdcall;

 

//+=========================================================================

//  Certificate Store Data Structures and APIs

//==========================================================================

 

//+-------------------------------------------------------------------------

//              In its most basic implementation, a cert store is simply a

//              collection of certificates and/or CRLs. This is the case when

//              a cert store is opened with all of its certificates and CRLs

//              coming from a PKCS #7 encoded cryptographic message.

//

//              Nonetheless, all cert stores have the following properties:

//               - A public key may have more than one certificate in the store.

//                 For example, a private/public key used for signing may have a

//                 certificate issued for VISA and another issued for

//                 Mastercard. Also, when a certificate is renewed there might

//                 be more than one certificate with the same subject and

//                 issuer.

//               - However, each certificate in the store is uniquely

//                 identified by its Issuer and SerialNumber.

//               - There's an issuer of subject certificate relationship. A

//                 certificate's issuer is found by doing a match of

//                 pSubjectCert->Issuer with pIssuerCert->Subject.

//                 The relationship is verified by using

//                 the issuer's public key to verify the subject certificate's

//                 signature. Note, there might be X.509 v3 extensions

//                 to assist in finding the issuer certificate.

//               - Since issuer certificates might be renewed, a subject

//                 certificate might have more than one issuer certificate.

//               - There's an issuer of CRL relationship. An

//                 issuer's CRL is found by doing a match of

//                 pIssuerCert->Subject with pCrl->Issuer.

//                 The relationship is verified by using

//                 the issuer's public key to verify the CRL's

//                 signature. Note, there might be X.509 v3 extensions

//                 to assist in finding the CRL.

//               - Since some issuers might support the X.509 v3 delta CRL

//                 extensions, an issuer might have more than one CRL.

//               - The store shouldn't have any redundant certificates or

//                 CRLs. There shouldn't be two certificates with the same

//                 Issuer and SerialNumber. There shouldn't be two CRLs with

//                 the same Issuer, ThisUpdate and NextUpdate.

//               - The store has NO policy or trust information. No

//                 certificates are tagged as being "root". Its up to

//                 the application to maintain a list of CertIds (Issuer +

//                 SerialNumber) for certificates it trusts.

//               - The store might contain bad certificates and/or CRLs.

//                 The issuer's signature of a subject certificate or CRL may

//                 not verify. Certificates or CRLs may not satisfy their

//                 time validity requirements. Certificates may be

//                 revoked.

//

//              In addition to the certificates and CRLs, properties can be

//              stored. There are two predefined property IDs for a user

//              certificate: CERT_KEY_PROV_HANDLE_PROP_ID and

//              CERT_KEY_PROV_INFO_PROP_ID. The CERT_KEY_PROV_HANDLE_PROP_ID

//              is a HCRYPTPROV handle to the private key assoicated

//              with the certificate. The CERT_KEY_PROV_INFO_PROP_ID contains

//              information to be used to call

//              CryptAcquireContext and CryptProvSetParam to get a handle

//              to the private key associated with the certificate.

//

//              There exists two more predefined property IDs for certificates

//              and CRLs, CERT_SHA1_HASH_PROP_ID and CERT_MD5_HASH_PROP_ID.

//              If these properties don't already exist, then, a hash of the

//              content is computed. (CERT_HASH_PROP_ID maps to the default

//              hash algorithm, currently, CERT_SHA1_HASH_PROP_ID).

//

//              There are additional APIs for creating certificate and CRL

//      contexts not in a store (CertCreateCertificateContext and

//      CertCreateCRLContext).

//

//--------------------------------------------------------------------------

 

type

  HCERTSTORE = PVOID;

 

//+-------------------------------------------------------------------------

//  Certificate context.

//

//  A certificate context contains both the encoded and decoded representation

//  of a certificate. A certificate context returned by a cert store function

//  must be freed by calling the CertFreeCertificateContext function. The

//  CertDuplicateCertificateContext function can be called to make a duplicate

//  copy (which also must be freed by calling CertFreeCertificateContext).

//--------------------------------------------------------------------------

 

type

  PCERT_CONTEXT = ^CERT_CONTEXT;

  CERT_CONTEXT = record

    dwCertEncodingType :DWORD;

    pbCertEncoded :PBYTE;

    cbCertEncoded :DWORD;

    pCertInfo :PCERT_INFO;

    hCertStore :HCERTSTORE;

  end;

 

type

  PCCERT_CONTEXT = ^CERT_CONTEXT;

 

//+-------------------------------------------------------------------------

//  CRL context.

//

//  A CRL context contains both the encoded and decoded representation

//  of a CRL. A CRL context returned by a cert store function

//  must be freed by calling the CertFreeCRLContext function. The

//  CertDuplicateCRLContext function can be called to make a duplicate

//  copy (which also must be freed by calling CertFreeCRLContext).

//--------------------------------------------------------------------------

 

type

  PCRL_CONTEXT = ^CRL_CONTEXT;

  CRL_CONTEXT = record

    dwCertEncodingType :DWORD;

    pbCrlEncoded :PBYTE;

    cbCrlEncoded :DWORD;

    pCrlInfo :PCRL_INFO;

    hCertStore :HCERTSTORE;

  end;

 

type

  PCCRL_CONTEXT = ^CRL_CONTEXT;

 

//+-------------------------------------------------------------------------

//  Certificate Trust List (CTL) context.

//

//  A CTL context contains both the encoded and decoded representation

//  of a CTL. Also contains an opened HCRYPTMSG handle to the decoded

//  cryptographic signed message containing the CTL_INFO as its inner content.

//  pbCtlContent is the encoded inner content of the signed message.

//

//  The CryptMsg APIs can be used to extract additional signer information.

//--------------------------------------------------------------------------

 

type

  PCTL_CONTEXT = ^CTL_CONTEXT;

  CTL_CONTEXT = record

    dwMsgAndCertEncodingType :DWORD;

    pbCtlEncoded :PBYTE;

    cbCtlEncoded :DWORD;

    pCtlInfo :PCTL_INFO;

    hCertStore :HCERTSTORE;

    hCryptMsg :HCRYPTMSG;

    pbCtlContent :PBYTE;

    cbCtlContent :DWORD;

  end;

 

type

  PCCTL_CONTEXT = ^CTL_CONTEXT;

 

//+-------------------------------------------------------------------------

//  Certificate, CRL and CTL property IDs

//

//  See CertSetCertificateContextProperty or CertGetCertificateContextProperty

//  for usage information.

//--------------------------------------------------------------------------

 

const

  CERT_KEY_PROV_HANDLE_PROP_ID        = 1;

  CERT_KEY_PROV_INFO_PROP_ID          = 2;

  CERT_SHA1_HASH_PROP_ID              = 3;

  CERT_MD5_HASH_PROP_ID               = 4;

  CERT_HASH_PROP_ID                   = CERT_SHA1_HASH_PROP_ID;

  CERT_KEY_CONTEXT_PROP_ID            = 5;

  CERT_KEY_SPEC_PROP_ID               = 6;

  CERT_IE30_RESERVED_PROP_ID          = 7;

  CERT_PUBKEY_HASH_RESERVED_PROP_ID   = 8;

  CERT_ENHKEY_USAGE_PROP_ID           = 9;

  CERT_CTL_USAGE_PROP_ID              = CERT_ENHKEY_USAGE_PROP_ID;

  CERT_NEXT_UPDATE_LOCATION_PROP_ID   = 10;

  CERT_FRIENDLY_NAME_PROP_ID          = 11;

  CERT_PVK_FILE_PROP_ID               = 12;

// Note, 32 - 34 are reserved for the CERT, CRL and CTL file element IDs.

  CERT_FIRST_RESERVED_PROP_ID         = 13;

 

  CERT_LAST_RESERVED_PROP_ID          = $00007FFF;

  CERT_FIRST_USER_PROP_ID             = $00008000;

  CERT_LAST_USER_PROP_ID              = $0000FFFF;

 

function IS_CERT_HASH_PROP_ID( X :DWORD):BOOL ;

 

//+-------------------------------------------------------------------------

//  Cryptographic Key Provider Information

//

//  CRYPT_KEY_PROV_INFO defines the CERT_KEY_PROV_INFO_PROP_ID's pvData.

//

//  The CRYPT_KEY_PROV_INFO fields are passed to CryptAcquireContext

//  to get a HCRYPTPROV handle. The optional CRYPT_KEY_PROV_PARAM fields are

//  passed to CryptProvSetParam to further initialize the provider.

//

//  The dwKeySpec field identifies the private key to use from the container

//  For example, AT_KEYEXCHANGE or AT_SIGNATURE.

//--------------------------------------------------------------------------

 

type

  PCRYPT_KEY_PROV_PARAM = ^CRYPT_KEY_PROV_PARAM;

  CRYPT_KEY_PROV_PARAM = record

    dwParam :DWORD;

    pbData  :PBYTE;

    cbData  :DWORD;

    dwFlags :DWORD;

  end;

 

type

  PCRYPT_KEY_PROV_INFO = ^CRYPT_KEY_PROV_INFO;

  CRYPT_KEY_PROV_INFO = record

    pwszContainerName :LPWSTR;

    pwszProvName      :LPWSTR;

    dwProvType        :DWORD;

    dwFlags           :DWORD;

    cProvParam        :DWORD;

    rgProvParam       :PCRYPT_KEY_PROV_PARAM;

    dwKeySpec         :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  The following flag should be set in the above dwFlags to enable

//  a CertSetCertificateContextProperty(CERT_KEY_CONTEXT_PROP_ID) after a

//  CryptAcquireContext is done in the Sign or Decrypt Message functions.

//

//  The following define must not collide with any of the

//  CryptAcquireContext dwFlag defines.

//--------------------------------------------------------------------------

 

const

  CERT_SET_KEY_PROV_HANDLE_PROP_ID = $00000001;

  CERT_SET_KEY_CONTEXT_PROP_ID     = $00000001;

 

//+-------------------------------------------------------------------------

//  Certificate Key Context

//

//  CERT_KEY_CONTEXT defines the CERT_KEY_CONTEXT_PROP_ID's pvData.

//--------------------------------------------------------------------------

 

type

  PCERT_KEY_CONTEXT = ^CERT_KEY_CONTEXT;

  CERT_KEY_CONTEXT = record

    cbSize     :DWORD;           // sizeof(CERT_KEY_CONTEXT)

    hCryptProv :HCRYPTPROV;

    dwKeySpec  :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  Certificate Store Provider Types

//--------------------------------------------------------------------------

 

const

  CERT_STORE_PROV_MSG = (LPCSTR(1));

  CERT_STORE_PROV_MEMORY = (LPCSTR(2));

  CERT_STORE_PROV_FILE = (LPCSTR(3));

  CERT_STORE_PROV_REG = (LPCSTR(4));

 

  CERT_STORE_PROV_PKCS7 = (LPCSTR(5));

  CERT_STORE_PROV_SERIALIZED = (LPCSTR(6));

  CERT_STORE_PROV_FILENAME_A = (LPCSTR(7));

  CERT_STORE_PROV_FILENAME_W = (LPCSTR(8));

  CERT_STORE_PROV_FILENAME =  CERT_STORE_PROV_FILENAME_W;

  CERT_STORE_PROV_SYSTEM_A = (LPCSTR(9));

  CERT_STORE_PROV_SYSTEM_W =  (LPCSTR(10));

  CERT_STORE_PROV_SYSTEM = CERT_STORE_PROV_SYSTEM_W;

 

  sz_CERT_STORE_PROV_MEMORY = 'Memory';

  sz_CERT_STORE_PROV_FILENAME_W = 'File';

  sz_CERT_STORE_PROV_FILENAME = sz_CERT_STORE_PROV_FILENAME_W;

  sz_CERT_STORE_PROV_SYSTEM_W = 'System';

  sz_CERT_STORE_PROV_SYSTEM = sz_CERT_STORE_PROV_SYSTEM_W;

  sz_CERT_STORE_PROV_PKCS7 = 'PKCS7';

  sz_CERT_STORE_PROV_SERIALIZED = 'Serialized';

 

//+-------------------------------------------------------------------------

//  Certificate Store verify/results flags

//--------------------------------------------------------------------------

 

  CERT_STORE_SIGNATURE_FLAG = $00000001;

  CERT_STORE_TIME_VALIDITY_FLAG = $00000002;

  CERT_STORE_REVOCATION_FLAG = $00000004;

  CERT_STORE_NO_CRL_FLAG = $00010000;

  CERT_STORE_NO_ISSUER_FLAG = $00020000;

 

//+-------------------------------------------------------------------------

//  Certificate Store open/property flags

//--------------------------------------------------------------------------

 

  CERT_STORE_NO_CRYPT_RELEASE_FLAG = $00000001;

  CERT_STORE_READONLY_FLAG = $00008000;

 

//+-------------------------------------------------------------------------

//  Certificate Store Provider flags are in the HiWord (0xFFFF0000)

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  Certificate System Store Flag Values

//--------------------------------------------------------------------------

// Location of the system store in the registry:

//  HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE

  CERT_SYSTEM_STORE_LOCATION_MASK = $00030000;

  CERT_SYSTEM_STORE_CURRENT_USER  = $00010000;

  CERT_SYSTEM_STORE_LOCAL_MACHINE = $00020000;

 

//+-------------------------------------------------------------------------

//  Open the cert store using the specified store provider.

//

//  hCryptProv specifies the crypto provider to use to create the hash

//  properties or verify the signature of a subject certificate or CRL.

//  The store doesn't need to use a private

//  key. If the CERT_STORE_NO_CRYPT_RELEASE_FLAG isn't set, hCryptProv is

//  CryptReleaseContext'ed on the final CertCloseStore.

//

//  Note, if the open fails, hCryptProv is released if it would have been

//  released when the store was closed.

//

//  If hCryptProv is zero, then, the default provider and container for the

//  PROV_RSA_FULL provider type is CryptAcquireContext'ed with

//  CRYPT_VERIFYCONTEXT access. The CryptAcquireContext is deferred until

//  the first create hash or verify signature. In addition, once acquired,

//  the default provider isn't released until process exit when crypt32.dll

//  is unloaded. The acquired default provider is shared across all stores

//  and threads.

//

//  After initializing the store's data structures and optionally acquiring a

//  default crypt provider, CertOpenStore calls CryptGetOIDFunctionAddress to

//  get the address of the CRYPT_OID_OPEN_STORE_PROV_FUNC specified by

//  lpszStoreProvider. Since a store can contain certificates with different

//  encoding types, CryptGetOIDFunctionAddress is called with dwEncodingType

//  set to 0 and not the dwEncodingType passed to CertOpenStore.

//  PFN_CERT_DLL_OPEN_STORE_FUNC specifies the signature of the provider's

//  open function. This provider open function is called to load the

//  store's certificates and CRLs. Optionally, the provider may return an

//  array of functions called before a certificate or CRL is added or deleted

//  or has a property that is set.

//

//  Use of the dwEncodingType parameter is provider dependent. The type

//  definition for pvPara also depends on the provider.

//

//  Store providers are installed or registered via

//  CryptInstallOIDFunctionAddress or CryptRegisterOIDFunction, where,

//  dwEncodingType is 0 and pszFuncName is CRYPT_OID_OPEN_STORE_PROV_FUNC.

//

//  Here's a list of the predefined provider types (implemented in crypt32.dll):

//

//  CERT_STORE_PROV_MSG:

//      Gets the certificates and CRLs from the specified cryptographic message.

//      dwEncodingType contains the message and certificate encoding types.

//      The message's handle is passed in pvPara. Given,

//          HCRYPTMSG hCryptMsg; pvPara = (const void *) hCryptMsg;

//

//  CERT_STORE_PROV_MEMORY

//  sz_CERT_STORE_PROV_MEMORY:

//      Opens a store without any initial certificates or CRLs. pvPara

//      isn't used.

//

//  CERT_STORE_PROV_FILE:

//      Reads the certificates and CRLs from the specified file. The file's

//      handle is passed in pvPara. Given,

//          HANDLE hFile; pvPara = (const void *) hFile;

//

//      For a successful open, the file pointer is advanced past

//      the certificates and CRLs and their properties read from the file.

//      Note, only expects a serialized store and not a file containing

//      either a PKCS #7 signed message or a single encoded certificate.

//

//      The hFile isn't closed.

//

//  CERT_STORE_PROV_REG:

//      Reads the certificates and CRLs from the registry. The registry's

//      key handle is passed in pvPara. Given,

//          HKEY hKey; pvPara = (const void *) hKey;

//

//      The input hKey isn't closed by the provider. Before returning, the

//      provider opens/creates "Certificates" and "CRLs" subkeys. These

//      subkeys remain open until the store is closed.

//

//      If CERT_STORE_READONLY_FLAG is set, then, the registry subkeys are

//      RegOpenKey'ed with KEY_READ_ACCESS. Otherwise, the registry subkeys

//      are RegCreateKey'ed with KEY_ALL_ACCESS.

//

//      This provider returns the array of functions for reading, writing,

//      deleting and property setting certificates and CRLs.

//      Any changes to the opened store are immediately pushed through to

//      the registry. However, if CERT_STORE_READONLY_FLAG is set, then,

//      writing, deleting or property setting results in a

//      SetLastError(E_ACCESSDENIED).

//

//      Note, all the certificates and CRLs are read from the registry

//      when the store is opened. The opened store serves as a write through

//      cache. However, the opened store isn't notified of other changes

//      made to the registry. Note, RegNotifyChangeKeyValue is supported

//      on NT but not supported on Windows95.

//

//  CERT_STORE_PROV_PKCS7:

//  sz_CERT_STORE_PROV_PKCS7:

//      Gets the certificates and CRLs from the encoded PKCS #7 signed message.

//      dwEncodingType specifies the message and certificate encoding types.

//      The pointer to the encoded message's blob is passed in pvPara. Given,

//          CRYPT_DATA_BLOB EncodedMsg; pvPara = (const void *) &EncodedMsg;

//

//      Note, also supports the IE3.0 special version of a

//      PKCS #7 signed message referred to as a "SPC" formatted message.

//

//  CERT_STORE_PROV_SERIALIZED:

//  sz_CERT_STORE_PROV_SERIALIZED:

//      Gets the certificates and CRLs from memory containing a serialized

//      store.  The pointer to the serialized memory blob is passed in pvPara.

//      Given,

//          CRYPT_DATA_BLOB Serialized; pvPara = (const void *) &Serialized;

//

//  CERT_STORE_PROV_FILENAME_A:

//  CERT_STORE_PROV_FILENAME_W:

//  CERT_STORE_PROV_FILENAME:

//  sz_CERT_STORE_PROV_FILENAME_W:

//  sz_CERT_STORE_PROV_FILENAME:

//      Opens the file and first attempts to read as a serialized store. Then,

//      as a PKCS #7 signed message. Finally, as a single encoded certificate.

//      The filename is passed in pvPara. The filename is UNICODE for the

//      "_W" provider and ASCII for the "_A" provider. For "_W": given,

//          LPCWSTR pwszFilename; pvPara = (const void *) pwszFilename;

//      For "_A": given,

//          LPCSTR pszFilename; pvPara = (const void *) pszFilename;

//

//      Note, the default (without "_A" or "_W") is unicode.

//

//      Note, also supports the reading of the IE3.0 special version of a

//      PKCS #7 signed message file referred to as a "SPC" formatted file.

//

//  CERT_STORE_PROV_SYSTEM_A:

//  CERT_STORE_PROV_SYSTEM_W:

//  CERT_STORE_PROV_SYSTEM:

//  sz_CERT_STORE_PROV_SYSTEM_W:

//  sz_CERT_STORE_PROV_SYSTEM:

//      Opens the specified "system" store. Currently, all the system

//      stores are stored in the registry. The upper word of the dwFlags

//      parameter is used to specify the location of the system store. It

//      should be set to either CERT_SYSTEM_STORE_CURRENT_USER for

//      HKEY_CURRENT_USER or CERT_SYSTEM_STORE_LOCAL_MACHINE for

//      HKEY_LOCAL_MACHINE.

//

//      After opening the registry key associated with the system name,

//      the CERT_STORE_PROV_REG provider is called to complete the open.

//

//      The system store name is passed in pvPara. The name is UNICODE for the

//      "_W" provider and ASCII for the "_A" provider. For "_W": given,

//          LPCWSTR pwszSystemName; pvPara = (const void *) pwszSystemName;

//      For "_A": given,

//          LPCSTR pszSystemName; pvPara = (const void *) pszSystemName;

//

//      Note, the default (without "_A" or "_W") is UNICODE.

//

//      If CERT_STORE_READONLY_FLAG is set, then, the registry is

//      RegOpenKey'ed with KEY_READ_ACCESS. Otherwise, the registry is

//      RegCreateKey'ed with KEY_ALL_ACCESS.

//

//      The "root" store is treated differently from the other system

//      stores. Before a certificate is added to or deleted from the "root"

//      store, a pop up message box is displayed. The certificate's subject,

//      issuer, serial number, time validity, sha1 and md5 thumbprints are

//      displayed. The user is given the option to do the add or delete.

//      If they don't allow the operation, LastError is set to E_ACCESSDENIED.

//--------------------------------------------------------------------------

 

function CertOpenStore(lpszStoreProvider :LPCSTR;

                       dwEncodingType :DWORD;

                       hCryptProv :HCRYPTPROV;

                       dwFlags :DWORD;

                 const pvPara :PVOID):HCERTSTORE ; stdcall;

 

//+-------------------------------------------------------------------------

//  OID Installable Certificate Store Provider Data Structures

//--------------------------------------------------------------------------

 

// Handle returned by the store provider when opened.

type

  HCERTSTOREPROV = PVOID;

 

// Store Provider OID function's pszFuncName.

const

  CRYPT_OID_OPEN_STORE_PROV_FUNC = 'CertDllOpenStoreProv';

 

// Note, the Store Provider OID function's dwEncodingType is always 0.

 

// The following information is returned by the provider when opened. Its

// zeroed with cbSize set before the provider is called. If the provider

// doesn't need to be called again after the open it doesn't need to

// make any updates to the CERT_STORE_PROV_INFO.

 

type

  PCERT_STORE_PROV_INFO = ^CERT_STORE_PROV_INFO;

  CERT_STORE_PROV_INFO = record

    cbSize :DWORD;

    cStoreProvFunc :DWORD;

    rgpvStoreProvFunc :PPVOID;

    hStoreProv :HCERTSTOREPROV;

    dwStoreProvFlags :DWORD;

  end;

 

// Definition of the store provider's open function.

//

// *pStoreProvInfo has been zeroed before the call.

//

// Note, pStoreProvInfo->cStoreProvFunc should be set last.  Once set,

// all subsequent store calls, such as CertAddSerializedElementToStore will

// call the appropriate provider callback function.

 

type

  PFN_CERT_DLL_OPEN_STORE_PROV_FUNC = function (lpszStoreProvider :LPCSTR;

                                                dwEncodingType :DWORD;

                                                hCryptProv :HCRYPTPROV;

                                                dwFlags :DWORD;

                                          const pvPara :PVOID;

                                                hCertStore :HCERTSTORE;

                                                pStoreProvInfo :PCERT_STORE_PROV_INFO

                                                ):BOOL ; stdcall;

 

// Indices into the store provider's array of callback functions.

//

// The provider can implement any subset of the following functions. It

// sets pStoreProvInfo->cStoreProvFunc to the last index + 1 and any

// preceding not implemented functions to NULL.

 

const

  CERT_STORE_PROV_CLOSE_FUNC = 0;

  CERT_STORE_PROV_READ_CERT_FUNC = 1;

  CERT_STORE_PROV_WRITE_CERT_FUNC = 2;

  CERT_STORE_PROV_DELETE_CERT_FUNC = 3;

  CERT_STORE_PROV_SET_CERT_PROPERTY_FUNC = 4;

  CERT_STORE_PROV_READ_CRL_FUNC = 5;

  CERT_STORE_PROV_WRITE_CRL_FUNC = 6;

  CERT_STORE_PROV_DELETE_CRL_FUNC = 7;

  CERT_STORE_PROV_SET_CRL_PROPERTY_FUNC = 8;

  CERT_STORE_PROV_READ_CTL_FUNC = 9;

  CERT_STORE_PROV_WRITE_CTL_FUNC = 10;

  CERT_STORE_PROV_DELETE_CTL_FUNC = 11;

  CERT_STORE_PROV_SET_CTL_PROPERTY_FUNC = 12;

 

// Called by CertCloseStore when the store's reference count is

// decremented to 0.

 

type

  PFN_CERT_STORE_PROV_CLOSE = procedure(hStoreProv :HCERTSTOREPROV;

                                        dwFlags :DWORD) ; stdcall;

 

// Currently not called directly by the store APIs. However, may be exported

// to support other providers based on it.

//

// Reads the provider's copy of the certificate context. If it exists,

// creates a new certificate context.

 

type

  PFN_CERT_STORE_PROV_READ_CERT = function (hStoreProv :HCERTSTOREPROV;

                                            pStoreCertContext :PCCERT_CONTEXT;

                                            dwFlags :DWORD;

                                        var ppProvCertContext :PCCERT_CONTEXT

                                            ):BOOL ; stdcall;

 

const

  CERT_STORE_PROV_WRITE_ADD_FLAG = $1;

 

// Called by CertAddEncodedCertificateToStore,

// CertAddCertificateContextToStore or CertAddSerializedElementToStore before

// adding to the store. The CERT_STORE_PROV_WRITE_ADD_FLAG is set. In

// addition to the encoded certificate, the added pCertContext might also

// have properties.

//

// Returns TRUE if its OK to update the the store.

 

type

  PFN_CERT_STORE_PROV_WRITE_CERT = function (hStoreProv :HCERTSTOREPROV;

                                             pCertContext :PCCERT_CONTEXT;

                                             dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertDeleteCertificateFromStore before deleting from the

// store.

//

// Returns TRUE if its OK to delete from the store.

 

type

  PFN_CERT_STORE_PROV_DELETE_CERT = function (hStoreProv :HCERTSTOREPROV;

                                              pCertContext :PCCERT_CONTEXT;

                                              dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertSetCertificateContextProperty before setting the

// certificate's property. Also called by CertGetCertificateContextProperty,

// when getting a hash property that needs to be created and then persisted

// via the set.

//

// Upon input, the property hasn't been set for the pCertContext parameter.

//

// Returns TRUE if its OK to set the property.

 

type

  PFN_CERT_STORE_PROV_SET_CERT_PROPERTY = function (hStoreProv :HCERTSTOREPROV;

                                                    pCertContext :PCCERT_CONTEXT;

                                                    dwPropId :DWORD;

                                                    dwFlags :DWORD;

                                              const pvData :PVOID

                                                    ):BOOL ; stdcall;

 

// Currently not called directly by the store APIs. However, may be exported

// to support other providers based on it.

//

// Reads the provider's copy of the CRL context. If it exists,

// creates a new CRL context.

 

type

  PFN_CERT_STORE_PROV_READ_CRL = function (hStoreProv :HCERTSTOREPROV;

                                           pStoreCrlContext :PCCRL_CONTEXT;

                                           dwFlags :DWORD;

                                       var ppProvCrlContext :PCCRL_CONTEXT

                                           ):BOOL ; stdcall;

 

// Called by CertAddEncodedCRLToStore,

// CertAddCRLContextToStore or CertAddSerializedElementToStore before

// adding to the store. The CERT_STORE_PROV_WRITE_ADD_FLAG is set. In

// addition to the encoded CRL, the added pCertContext might also

// have properties.

//

// Returns TRUE if its OK to update the the store.

 

type

  PFN_CERT_STORE_PROV_WRITE_CRL = function (hStoreProv :HCERTSTOREPROV;

                                            pCrlContext :PCCRL_CONTEXT;

                                            dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertDeleteCRLFromStore before deleting from the store.

//

// Returns TRUE if its OK to delete from the store.

 

type

  PFN_CERT_STORE_PROV_DELETE_CRL = function (hStoreProv :HCERTSTOREPROV;

                                             pCrlContext :PCCRL_CONTEXT;

                                             dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertDeleteCRLFromStore before deleting from the store.

//

// Returns TRUE if its OK to delete from the store.

 

type

  PFN_CERT_STORE_PROV_SET_CRL_PROPERTY = function (hStoreProv :HCERTSTOREPROV;

                                                   pCrlContext :PCCRL_CONTEXT;

                                                   dwPropId :DWORD;

                                                   dwFlags :DWORD;

                                                   pvData :PVOID):BOOL ; stdcall;

 

// Currently not called directly by the store APIs. However, may be exported

// to support other providers based on it.

//

// Reads the provider's copy of the CTL context. If it exists,

// creates a new CTL context.

 

type

  PFN_CERT_STORE_PROV_READ_CTL = function (hStoreProv :HCERTSTOREPROV;

                                           pStoreCtlContext :PCCTL_CONTEXT;

                                           dwFlags :DWORD;

                                       var ppProvCtlContext :PCCTL_CONTEXT

                                           ):BOOL ; stdcall;

 

// Called by CertAddEncodedCTLToStore,

// CertAddCTLContextToStore or CertAddSerializedElementToStore before

// adding to the store. The CERT_STORE_PROV_WRITE_ADD_FLAG is set. In

// addition to the encoded CTL, the added pCertContext might also

// have properties.

//

// Returns TRUE if its OK to update the the store.

 

type

  PFN_CERT_STORE_PROV_WRITE_CTL = function (hStoreProv :HCERTSTOREPROV;

                                            pCtlContext :PCCTL_CONTEXT;

                                            dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertDeleteCTLFromStore before deleting from the store.

//

// Returns TRUE if its OK to delete from the store.

 

type

  PFN_CERT_STORE_PROV_DELETE_CTL = function (hStoreProv :HCERTSTOREPROV;

                                             pCtlContext :PCCTL_CONTEXT;

                                             dwFlags :DWORD):BOOL ; stdcall;

 

// Called by CertSetCTLContextProperty before setting the

// CTL's property. Also called by CertGetCTLContextProperty,

// when getting a hash property that needs to be created and then persisted

// via the set.

//

// Upon input, the property hasn't been set for the pCtlContext parameter.

//

// Returns TRUE if its OK to set the property.

 

type

  PFN_CERT_STORE_PROV_SET_CTL_PROPERTY = function (hStoreProv :HCERTSTOREPROV;

                                                   pCtlContext :PCCTL_CONTEXT;

                                                   dwPropId :DWORD;

                                                   dwFlags :DWORD;

                                             const pvData :PVOID

                                                   ):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Duplicate a cert store handle

//--------------------------------------------------------------------------

 

function CertDuplicateStore(hCertStore :HCERTSTORE):HCERTSTORE ; stdcall;

 

const CERT_STORE_SAVE_AS_STORE = 1;

const CERT_STORE_SAVE_AS_PKCS7 = 2;

 

const CERT_STORE_SAVE_TO_FILE = 1;

const CERT_STORE_SAVE_TO_MEMORY = 2;

const CERT_STORE_SAVE_TO_FILENAME_A = 3;

const CERT_STORE_SAVE_TO_FILENAME_W = 4;

const CERT_STORE_SAVE_TO_FILENAME = CERT_STORE_SAVE_TO_FILENAME_W;

 

//+-------------------------------------------------------------------------

//  Save the cert store. Extended version with lots of options.

//

//  According to the dwSaveAs parameter, the store can be saved as a

//  serialized store (CERT_STORE_SAVE_AS_STORE) containing properties in

//  addition to encoded certificates, CRLs and CTLs or the store can be saved

//  as a PKCS #7 signed message (CERT_STORE_SAVE_AS_PKCS7) which doesn't

//  include the properties or CTLs.

//

//  Note, the CERT_KEY_CONTEXT_PROP_ID property (and its

//  CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_SPEC_PROP_ID) isn't saved into

//  a serialized store.

//

//  For CERT_STORE_SAVE_AS_PKCS7, the dwEncodingType specifies the message

//  encoding type. The dwEncodingType parameter isn't used for

//  CERT_STORE_SAVE_AS_STORE.

//

//  The dwFlags parameter currently isn't used and should be set to 0.

//

//  The dwSaveTo and pvSaveToPara parameters specify where to save the

//  store as follows:

//    CERT_STORE_SAVE_TO_FILE:

//      Saves to the specified file. The file's handle is passed in

//      pvSaveToPara. Given,

//          HANDLE hFile; pvSaveToPara = (void *) hFile;

//

//      For a successful save, the file pointer is positioned after the

//      last write.

//

//    CERT_STORE_SAVE_TO_MEMORY:

//      Saves to the specified memory blob. The pointer to

//      the memory blob is passed in pvSaveToPara. Given,

//          CRYPT_DATA_BLOB SaveBlob; pvSaveToPara = (void *) &SaveBlob;

//      Upon entry, the SaveBlob's pbData and cbData need to be initialized.

//      Upon return, cbData is updated with the actual length.

//      For a length only calculation, pbData should be set to NULL. If

//      pbData is non-NULL and cbData isn't large enough, FALSE is returned

//      with a last error of ERRROR_MORE_DATA.

//

//    CERT_STORE_SAVE_TO_FILENAME_A:

//    CERT_STORE_SAVE_TO_FILENAME_W:

//    CERT_STORE_SAVE_TO_FILENAME:

//      Opens the file and saves to it. The filename is passed in pvSaveToPara.

//      The filename is UNICODE for the "_W" option and ASCII for the "_A"

//      option. For "_W": given,

//          LPCWSTR pwszFilename; pvSaveToPara = (void *) pwszFilename;

//      For "_A": given,

//          LPCSTR pszFilename; pvSaveToPara = (void *) pszFilename;

//

//      Note, the default (without "_A" or "_W") is UNICODE.

//

//--------------------------------------------------------------------------

 

function CertSaveStore(hCertStore :HCERTSTORE;

                       dwEncodingType :DWORD;

                       dwSaveAs :DWORD;

                       dwSaveTo :DWORD;

                       pvSaveToPara :PVOID;

                       dwFlags :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Certificate Store close flags

//--------------------------------------------------------------------------

const CERT_CLOSE_STORE_FORCE_FLAG = $00000001;

const CERT_CLOSE_STORE_CHECK_FLAG = $00000002;

 

//+-------------------------------------------------------------------------

//  Close a cert store handle.

//

//  There needs to be a corresponding close for each open and duplicate.

//

//  Even on the final close, the cert store isn't freed until all of its

//  certificate and CRL contexts have also been freed.

//

//  On the final close, the hCryptProv passed to CertStoreOpen is

//  CryptReleaseContext'ed.

//

//  To force the closure of the store with all of its memory freed, set the

//  CERT_STORE_CLOSE_FORCE_FLAG. This flag should be set when the caller does

//  its own reference counting and wants everything to vanish.

//

//  To check if all the store's certificates and CRLs have been freed and that

//  this is the last CertCloseStore, set the CERT_CLOSE_STORE_CHECK_FLAG. If

//  set and certs, CRLs or stores still need to be freed/closed, FALSE is

//  returned with LastError set to CRYPT_E_PENDING_CLOSE. Note, for FALSE,

//  the store is still closed. This is a diagnostic flag.

//

//  LastError is preserved unless CERT_CLOSE_STORE_CHECK_FLAG is set and FALSE

//  is returned.

//--------------------------------------------------------------------------

 

function CertCloseStore(hCertStore :HCERTSTORE; dwFlags :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Get the subject certificate context uniquely identified by its Issuer and

//  SerialNumber from the store.

//

//  If the certificate isn't found, NULL is returned. Otherwise, a pointer to

//  a read only CERT_CONTEXT is returned. CERT_CONTEXT must be freed by calling

//  CertFreeCertificateContext. CertDuplicateCertificateContext can be called to make a

//  duplicate.

//

//  The returned certificate might not be valid. Normally, it would be

//  verified when getting its issuer certificate (CertGetIssuerCertificateFromStore).

//--------------------------------------------------------------------------

 

function CertGetSubjectCertificateFromStore(hCertStore :HCERTSTORE;

                                            dwCertEncodingType :DWORD;

                                            pCertId :PCERT_INFO         // Only the Issuer and SerialNumber

                                            ):PCCERT_CONTEXT ; stdcall; // fields are used

 

//+-------------------------------------------------------------------------

//  Enumerate the certificate contexts in the store.

//

//  If a certificate isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CERT_CONTEXT is returned. CERT_CONTEXT

//  must be freed by calling CertFreeCertificateContext or is freed when passed as the

//  pPrevCertContext on a subsequent call. CertDuplicateCertificateContext

//  can be called to make a duplicate.

//

//  pPrevCertContext MUST BE NULL to enumerate the first

//  certificate in the store. Successive certificates are enumerated by setting

//  pPrevCertContext to the CERT_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevCertContext is always CertFreeCertificateContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

 

function CertEnumCertificatesInStore(hCertStore :HCERTSTORE;

                                     pPrevCertContext :PCCERT_CONTEXT

                                     ):PCCERT_CONTEXT ; stdcall;

 

//+-------------------------------------------------------------------------

//  Find the first or next certificate context in the store.

//

//  The certificate is found according to the dwFindType and its pvFindPara.

//  See below for a list of the find types and its parameters.

//

//  Currently dwFindFlags is only used for CERT_FIND_SUBJECT_ATTR,

//  CERT_FIND_ISSUER_ATTR or CERT_FIND_CTL_USAGE. Otherwise, must be set to 0.

//

//  Usage of dwCertEncodingType depends on the dwFindType.

//

//  If the first or next certificate isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CERT_CONTEXT is returned. CERT_CONTEXT

//  must be freed by calling CertFreeCertificateContext or is freed when passed as the

//  pPrevCertContext on a subsequent call. CertDuplicateCertificateContext

//  can be called to make a duplicate.

//

//  pPrevCertContext MUST BE NULL on the first

//  call to find the certificate. To find the next certificate, the

//  pPrevCertContext is set to the CERT_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevCertContext is always CertFreeCertificateContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

 

function CertFindCertificateInStore(hCertStore :HCERTSTORE;

                                    dwCertEncodingType :DWORD;

                                    dwFindFlags :DWORD;

                                    dwFindType :DWORD;

                              const pvFindPara :PVOID;

                                    pPrevCertContext :PCCERT_CONTEXT

                                    ):PCCERT_CONTEXT ; stdcall;

 

//+-------------------------------------------------------------------------

// Certificate comparison functions

//--------------------------------------------------------------------------

 

const CERT_COMPARE_SHIFT = 16;

const CERT_COMPARE_ANY = 0;

const CERT_COMPARE_SHA1_HASH = 1;

const CERT_COMPARE_NAME = 2;

const CERT_COMPARE_ATTR = 3;

const CERT_COMPARE_MD5_HASH  = 4;

const CERT_COMPARE_PROPERTY = 5;

const CERT_COMPARE_PUBLIC_KEY = 6;

const CERT_COMPARE_HASH = CERT_COMPARE_SHA1_HASH;

const CERT_COMPARE_NAME_STR_A = 7;

const CERT_COMPARE_NAME_STR_W = 8;

const CERT_COMPARE_KEY_SPEC = 9;

const CERT_COMPARE_ENHKEY_USAGE = 10;

const CERT_COMPARE_CTL_USAGE = CERT_COMPARE_ENHKEY_USAGE;

 

//+-------------------------------------------------------------------------

//  dwFindType

//

//  The dwFindType definition consists of two components:

//   - comparison function

//   - certificate information flag

//--------------------------------------------------------------------------

 

const CERT_FIND_ANY = (CERT_COMPARE_ANY shl CERT_COMPARE_SHIFT);

const CERT_FIND_SHA1_HASH = (CERT_COMPARE_SHA1_HASH shl CERT_COMPARE_SHIFT);

const CERT_FIND_MD5_HASH = (CERT_COMPARE_MD5_HASH shl CERT_COMPARE_SHIFT);

const CERT_FIND_HASH = CERT_FIND_SHA1_HASH;

const CERT_FIND_PROPERTY = (CERT_COMPARE_PROPERTY shl CERT_COMPARE_SHIFT);

const CERT_FIND_PUBLIC_KEY = (CERT_COMPARE_PUBLIC_KEY shl CERT_COMPARE_SHIFT);

 

const CERT_FIND_SUBJECT_NAME = (CERT_COMPARE_NAME shl CERT_COMPARE_SHIFT or CERT_INFO_SUBJECT_FLAG);

const CERT_FIND_SUBJECT_ATTR = (CERT_COMPARE_ATTR shl CERT_COMPARE_SHIFT or  CERT_INFO_SUBJECT_FLAG);

const CERT_FIND_ISSUER_NAME = (CERT_COMPARE_NAME shl CERT_COMPARE_SHIFT or  CERT_INFO_ISSUER_FLAG);

const CERT_FIND_ISSUER_ATTR = (CERT_COMPARE_ATTR shl CERT_COMPARE_SHIFT or   CERT_INFO_ISSUER_FLAG);

const CERT_FIND_SUBJECT_STR_A =  (CERT_COMPARE_NAME_STR_A shl CERT_COMPARE_SHIFT or   CERT_INFO_SUBJECT_FLAG);

const CERT_FIND_SUBJECT_STR_W =  (CERT_COMPARE_NAME_STR_W shl CERT_COMPARE_SHIFT or   CERT_INFO_SUBJECT_FLAG);

const CERT_FIND_SUBJECT_STR = CERT_FIND_SUBJECT_STR_W;

const CERT_FIND_ISSUER_STR_A = (CERT_COMPARE_NAME_STR_A shl CERT_COMPARE_SHIFT or  CERT_INFO_ISSUER_FLAG);

const CERT_FIND_ISSUER_STR_W =  (CERT_COMPARE_NAME_STR_W shl CERT_COMPARE_SHIFT or  CERT_INFO_ISSUER_FLAG);

const CERT_FIND_ISSUER_STR = CERT_FIND_ISSUER_STR_W;

const CERT_FIND_KEY_SPEC = (CERT_COMPARE_KEY_SPEC shl CERT_COMPARE_SHIFT);

const CERT_FIND_ENHKEY_USAGE = (CERT_COMPARE_ENHKEY_USAGE shl CERT_COMPARE_SHIFT);

const CERT_FIND_CTL_USAGE = CERT_FIND_ENHKEY_USAGE;

 

//+-------------------------------------------------------------------------

//  CERT_FIND_ANY

//

//  Find any certificate.

//

//  pvFindPara isn't used.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_HASH

//

//  Find a certificate with the specified hash.

//

//  pvFindPara points to a CRYPT_HASH_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_PROPERTY

//

//  Find a certificate having the specified property.

//

//  pvFindPara points to a DWORD containing the PROP_ID

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_PUBLIC_KEY

//

//  Find a certificate matching the specified public key.

//

//  pvFindPara points to a CERT_PUBLIC_KEY_INFO containing the public key

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_SUBJECT_NAME

//  CERT_FIND_ISSUER_NAME

//

//  Find a certificate with the specified subject/issuer name. Does an exact

//  match of the entire name.

//

//  Restricts search to certificates matching the dwCertEncodingType.

//

//  pvFindPara points to a CERT_NAME_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_SUBJECT_ATTR

//  CERT_FIND_ISSUER_ATTR

//

//  Find a certificate with the specified subject/issuer attributes.

//

//  Compares the attributes in the subject/issuer name with the

//  Relative Distinguished Name's (CERT_RDN) array of attributes specified in

//  pvFindPara. The comparison iterates through the CERT_RDN attributes and looks

//  for an attribute match in any of the subject/issuer's RDNs.

//

//  The CERT_RDN_ATTR fields can have the following special values:

//    pszObjId == NULL              - ignore the attribute object identifier

//    dwValueType == RDN_ANY_TYPE   - ignore the value type

//    Value.pbData == NULL          - match any value

//

//  Currently only an exact, case sensitive match is supported.

//

//  CERT_UNICODE_IS_RDN_ATTRS_FLAG should be set in dwFindFlags if the RDN was

//  initialized with unicode strings as for

//  CryptEncodeObject(X509_UNICODE_NAME).

//

//  Restricts search to certificates matching the dwCertEncodingType.

//

//  pvFindPara points to a CERT_RDN (defined in wincert.h).

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_SUBJECT_STR_A

//  CERT_FIND_SUBJECT_STR_W | CERT_FIND_SUBJECT_STR

//  CERT_FIND_ISSUER_STR_A

//  CERT_FIND_ISSUER_STR_W  | CERT_FIND_ISSUER_STR

//

//  Find a certificate containing the specified subject/issuer name string.

//

//  First, the certificate's subject/issuer is converted to a name string

//  via CertNameToStrA/CertNameToStrW(CERT_SIMPLE_NAME_STR). Then, a

//  case insensitive substring within string match is performed.

//

//  Restricts search to certificates matching the dwCertEncodingType.

//

//  For *_STR_A, pvFindPara points to a null terminated character string.

//  For *_STR_W, pvFindPara points to a null terminated wide character string.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_KEY_SPEC

//

//  Find a certificate having a CERT_KEY_SPEC_PROP_ID property matching

//  the specified KeySpec.

//

//  pvFindPara points to a DWORD containing the KeySpec.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CERT_FIND_ENHKEY_USAGE

//

//  Find a certificate having the szOID_ENHANCED_KEY_USAGE extension or

//  the CERT_ENHKEY_USAGE_PROP_ID and matching the specified pszUsageIdentifers.

//

//  pvFindPara points to a CERT_ENHKEY_USAGE data structure. If pvFindPara

//  is NULL or CERT_ENHKEY_USAGE's cUsageIdentifier is 0, then, matches any

//  certificate having enhanced key usage.

//

//  The CERT_FIND_OPTIONAL_ENHKEY_USAGE_FLAG can be set in dwFindFlags to

//  also match a certificate without either the extension or property.

//

//  If CERT_FIND_NO_ENHKEY_USAGE_FLAG is set in dwFindFlags, finds

//  certificates without the key usage extension or property. Setting this

//  flag takes precedence over pvFindPara being NULL.

//

//  If the CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG is set, then, only does a match

//  using the extension. If pvFindPara is NULL or cUsageIdentifier is set to

//  0, finds certificates having the extension. If

//  CERT_FIND_OPTIONAL_ENHKEY_USAGE_FLAG is set, also matches a certificate

//  without the extension. If CERT_FIND_NO_ENHKEY_USAGE_FLAG is set, finds

//  certificates without the extension.

//

//  If the CERT_FIND_EXT_PROP_ENHKEY_USAGE_FLAG is set, then, only does a match

//  using the property. If pvFindPara is NULL or cUsageIdentifier is set to

//  0, finds certificates having the property. If

//  CERT_FIND_OPTIONAL_ENHKEY_USAGE_FLAG is set, also matches a certificate

//  without the property. If CERT_FIND_NO_ENHKEY_USAGE_FLAG is set, finds

//  certificates without the property.

//--------------------------------------------------------------------------

 

const CERT_FIND_OPTIONAL_ENHKEY_USAGE_FLAG = $1;

const CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG = $2;

const CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG = $4;

const CERT_FIND_NO_ENHKEY_USAGE_FLAG = $8;

const CERT_FIND_OPTIONAL_CTL_USAGE_FLAG = CERT_FIND_OPTIONAL_ENHKEY_USAGE_FLAG;

const CERT_FIND_EXT_ONLY_CTL_USAGE_FLAG = CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG;

const CERT_FIND_PROP_ONLY_CTL_USAGE_FLAG = CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG;

const CERT_FIND_NO_CTL_USAGE_FLAG = CERT_FIND_NO_ENHKEY_USAGE_FLAG;

 

//+-------------------------------------------------------------------------

//  Get the certificate context from the store for the first or next issuer

//  of the specified subject certificate. Perform the enabled

//  verification checks on the subject. (Note, the checks are on the subject

//  using the returned issuer certificate.)

//

//  If the first or next issuer certificate isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CERT_CONTEXT is returned. CERT_CONTEXT

//  must be freed by calling CertFreeCertificateContext or is freed when passed as the

//  pPrevIssuerContext on a subsequent call. CertDuplicateCertificateContext

//  can be called to make a duplicate.

//

//  For a self signed subject certificate, NULL is returned with LastError set

//  to CERT_STORE_SELF_SIGNED. The enabled verification checks are still done.

//

//  The pSubjectContext may have been obtained from this store, another store

//  or created by the caller application. When created by the caller, the

//  CertCreateCertificateContext function must have been called.

//

//  An issuer may have multiple certificates. This may occur when the validity

//  period is about to change. pPrevIssuerContext MUST BE NULL on the first

//  call to get the issuer. To get the next certificate for the issuer, the

//  pPrevIssuerContext is set to the CERT_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevIssuerContext is always CertFreeCertificateContext'ed by

//  this function, even for an error.

//

//  The following flags can be set in *pdwFlags to enable verification checks

//  on the subject certificate context:

//      CERT_STORE_SIGNATURE_FLAG     - use the public key in the returned

//                                      issuer certificate to verify the

//                                      signature on the subject certificate.

//                                      Note, if pSubjectContext->hCertStore ==

//                                      hCertStore, the store provider might

//                                      be able to eliminate a redo of

//                                      the signature verify.

//      CERT_STORE_TIME_VALIDITY_FLAG - get the current time and verify that

//                                      its within the subject certificate's

//                                      validity period

//      CERT_STORE_REVOCATION_FLAG    - check if the subject certificate is on

//                                      the issuer's revocation list

//

//  If an enabled verification check fails, then, its flag is set upon return.

//  If CERT_STORE_REVOCATION_FLAG was enabled and the issuer doesn't have a

//  CRL in the store, then, CERT_STORE_NO_CRL_FLAG is set in addition to

//  the CERT_STORE_REVOCATION_FLAG.

//

//  If CERT_STORE_SIGNATURE_FLAG or CERT_STORE_REVOCATION_FLAG is set, then,

//  CERT_STORE_NO_ISSUER_FLAG is set if it doesn't have an issuer certificate

//  in the store.

//

//  For a verification check failure, a pointer to the issuer's CERT_CONTEXT

//  is still returned and SetLastError isn't updated.

//--------------------------------------------------------------------------

function CertGetIssuerCertificateFromStore(hCertStore :HCERTSTORE;

                                           pSubjectContext :PCCERT_CONTEXT;

                                           pPrevIssuerContext :PCCERT_CONTEXT; //OPTIONAL

                                           pdwFlags :PDWORD):PCCERT_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Perform the enabled verification checks on the subject certificate

//  using the issuer. Same checks and flags definitions as for the above

//  CertGetIssuerCertificateFromStore.

//

//  If you are only checking CERT_STORE_TIME_VALIDITY_FLAG, then, the

//  issuer can be NULL.

//

//  For a verification check failure, SUCCESS is still returned.

//--------------------------------------------------------------------------

 

function CertVerifySubjectCertificateContext(pSubject :PCCERT_CONTEXT;

                                             pIssuer :PCCERT_CONTEXT; //OPTIONAL

                                             pdwFlags :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Duplicate a certificate context

//--------------------------------------------------------------------------

 

function CertDuplicateCertificateContext(pCertContext :PCCERT_CONTEXT):PCCERT_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Create a certificate context from the encoded certificate. The created

//  context isn't put in a store.

//

//  Makes a copy of the encoded certificate in the created context.

//

//  If unable to decode and create the certificate context, NULL is returned.

//  Otherwise, a pointer to a read only CERT_CONTEXT is returned.

//  CERT_CONTEXT must be freed by calling CertFreeCertificateContext.

//  CertDuplicateCertificateContext can be called to make a duplicate.

//

//  CertSetCertificateContextProperty and CertGetCertificateContextProperty can be called

//  to store properties for the certificate.

//--------------------------------------------------------------------------

function CertCreateCertificateContext(dwCertEncodingType :DWORD;

                                      pbCertEncoded :PBYTE;

                                      cbCertEncoded :DWORD):PCCERT_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Free a certificate context

//

//  There needs to be a corresponding free for each context obtained by a

//  get, find, duplicate or create.

//--------------------------------------------------------------------------

function CertFreeCertificateContext(pCertContext :PCCERT_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Set the property for the specified certificate context.

//

//  The type definition for pvData depends on the dwPropId value. There are

//  five predefined types:

//      CERT_KEY_PROV_HANDLE_PROP_ID - a HCRYPTPROV for the certificate's

//      private key is passed in pvData. Updates the hCryptProv field

//      of the CERT_KEY_CONTEXT_PROP_ID. If the CERT_KEY_CONTEXT_PROP_ID

//      doesn't exist, its created with all the other fields zeroed out. If

//      CERT_STORE_NO_CRYPT_RELEASE_FLAG isn't set, HCRYPTPROV is implicitly

//      released when either the property is set to NULL or on the final

//      free of the CertContext.

//

//      CERT_KEY_PROV_INFO_PROP_ID - a PCRYPT_KEY_PROV_INFO for the certificate's

//      private key is passed in pvData.

//

//      CERT_SHA1_HASH_PROP_ID -

//      CERT_MD5_HASH_PROP_ID  - normally, either property is implicitly

//      set by doing a CertGetCertificateContextProperty. pvData points to a

//      CRYPT_HASH_BLOB.

//

//      CERT_KEY_CONTEXT_PROP_ID - a PCERT_KEY_CONTEXT for the certificate's

//      private key is passed in pvData. The CERT_KEY_CONTEXT contains both the

//      hCryptProv and dwKeySpec for the private key.

//      See the CERT_KEY_PROV_HANDLE_PROP_ID for more information about

//      the hCryptProv field and dwFlags settings. Note, more fields may

//      be added for this property. The cbSize field value will be adjusted

//      accordingly.

//

//      CERT_KEY_SPEC_PROP_ID - the dwKeySpec for the private key. pvData

//      points to a DWORD containing the KeySpec

//

//      CERT_ENHKEY_USAGE_PROP_ID - enhanced key usage definition for the

//      certificate. pvData points to a CRYPT_DATA_BLOB containing an

//      ASN.1 encoded CERT_ENHKEY_USAGE (encoded via

//      CryptEncodeObject(X509_ENHANCED_KEY_USAGE).

//

//      CERT_NEXT_UPDATE_LOCATION_PROP_ID - location of the next update.

//      Currently only applicable to CTLs. pvData points to a CRYPT_DATA_BLOB

//      containing an ASN.1 encoded CERT_ALT_NAME_INFO (encoded via

//      CryptEncodeObject(X509_ALTERNATE_NAME)).

//

//      CERT_FRIENDLY_NAME_PROP_ID - friendly name for the cert, CRL or CTL.

//      pvData points to a CRYPT_DATA_BLOB. pbData is a pointer to a NULL

//      terminated unicode, wide character string.

//      cbData = (wcslen((LPWSTR) pbData) + 1) * sizeof(WCHAR).

//

//  For all the other PROP_IDs: an encoded PCRYPT_DATA_BLOB is passed in pvData.

//

//  If the property already exists, then, the old value is deleted and silently

//  replaced. Setting, pvData to NULL, deletes the property.

//--------------------------------------------------------------------------

function CertSetCertificateContextProperty(pCertContext :PCCERT_CONTEXT;

                                           dwPropId :DWORD;

                                           dwFlags :DWORD;

                                           pvData :PVOID):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Get the property for the specified certificate context.

//

//  For CERT_KEY_PROV_HANDLE_PROP_ID, pvData points to a HCRYPTPROV.

//

//  For CERT_KEY_PROV_INFO_PROP_ID, pvData points to a CRYPT_KEY_PROV_INFO structure.

//  Elements pointed to by fields in the pvData structure follow the

//  structure. Therefore, *pcbData may exceed the size of the structure.

//

//  For CERT_KEY_CONTEXT_PROP_ID, pvData points to a CERT_KEY_CONTEXT structure.

//

//  For CERT_KEY_SPEC_PROP_ID, pvData points to a DWORD containing the KeySpec.

//  If the CERT_KEY_CONTEXT_PROP_ID exists, the KeySpec is obtained from there.

//  Otherwise, if the CERT_KEY_PROV_INFO_PROP_ID exists, its the source

//  of the KeySpec.

//

//  For CERT_SHA1_HASH_PROP_ID or CERT_MD5_HASH_PROP_ID, if the hash

//  doesn't already exist, then, its computed via CryptHashCertificate()

//  and then set. pvData points to the computed hash. Normally, the length

//  is 20 bytes for SHA and 16 for MD5.

//

//  For all other PROP_IDs, pvData points to an encoded array of bytes.

//--------------------------------------------------------------------------

function CertGetCertificateContextProperty(pCertContext :PCCERT_CONTEXT;

                                           dwPropId :DWORD;

                                           pvData :PVOID;

                                           pcbData :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Enumerate the properties for the specified certificate context.

//

//  To get the first property, set dwPropId to 0. The ID of the first

//  property is returned. To get the next property, set dwPropId to the

//  ID returned by the last call. To enumerate all the properties continue

//  until 0 is returned.

//

//  CertGetCertificateContextProperty is called to get the property's data.

//

//  Note, since, the CERT_KEY_PROV_HANDLE_PROP_ID and CERT_KEY_SPEC_PROP_ID

//  properties are stored as fields in the CERT_KEY_CONTEXT_PROP_ID

//  property, they aren't enumerated individually.

//--------------------------------------------------------------------------

function CertEnumCertificateContextProperties(pCertContext :PCCERT_CONTEXT;

                                              dwPropId :DWORD):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//  Get the first or next CRL context from the store for the specified

//  issuer certificate. Perform the enabled verification checks on the CRL.

//

//  If the first or next CRL isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CRL_CONTEXT is returned. CRL_CONTEXT

//  must be freed by calling CertFreeCRLContext. However, the free must be

//  pPrevCrlContext on a subsequent call. CertDuplicateCRLContext

//  can be called to make a duplicate.

//

//  The pIssuerContext may have been obtained from this store, another store

//  or created by the caller application. When created by the caller, the

//  CertCreateCertificateContext function must have been called.

//

//  If pIssuerContext == NULL, finds all the CRLs in the store.

//

//  An issuer may have multiple CRLs. For example, it generates delta CRLs

//  using a X.509 v3 extension. pPrevCrlContext MUST BE NULL on the first

//  call to get the CRL. To get the next CRL for the issuer, the

//  pPrevCrlContext is set to the CRL_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevCrlContext is always CertFreeCRLContext'ed by

//  this function, even for an error.

//

//  The following flags can be set in *pdwFlags to enable verification checks

//  on the returned CRL:

//      CERT_STORE_SIGNATURE_FLAG     - use the public key in the

//                                      issuer's certificate to verify the

//                                      signature on the returned CRL.

//                                      Note, if pIssuerContext->hCertStore ==

//                                      hCertStore, the store provider might

//                                      be able to eliminate a redo of

//                                      the signature verify.

//      CERT_STORE_TIME_VALIDITY_FLAG - get the current time and verify that

//                                      its within the CRL's ThisUpdate and

//                                      NextUpdate validity period.

//

//  If an enabled verification check fails, then, its flag is set upon return.

//

//  If pIssuerContext == NULL, then, an enabled CERT_STORE_SIGNATURE_FLAG

//  always fails and the CERT_STORE_NO_ISSUER_FLAG is also set.

//

//  For a verification check failure, a pointer to the first or next

//  CRL_CONTEXT is still returned and SetLastError isn't updated.

//--------------------------------------------------------------------------

function CertGetCRLFromStore(hCertStore :HCERTSTORE;

                             pIssuerContext :PCCERT_CONTEXT; //OPTIONAL

                             pPrevCrlContext :PCCRL_CONTEXT;

                             pdwFlags :PDWORD):PCCRL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Duplicate a CRL context

//--------------------------------------------------------------------------

function CertDuplicateCRLContext(pCrlContext :PCCRL_CONTEXT):PCCRL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Create a CRL context from the encoded CRL. The created

//  context isn't put in a store.

//

//  Makes a copy of the encoded CRL in the created context.

//

//  If unable to decode and create the CRL context, NULL is returned.

//  Otherwise, a pointer to a read only CRL_CONTEXT is returned.

//  CRL_CONTEXT must be freed by calling CertFreeCRLContext.

//  CertDuplicateCRLContext can be called to make a duplicate.

//

//  CertSetCRLContextProperty and CertGetCRLContextProperty can be called

//  to store properties for the CRL.

//--------------------------------------------------------------------------

function CertCreateCRLContext(dwCertEncodingType :DWORD;

                              pbCrlEncoded :PBYTE;

                              cbCrlEncoded :DWORD):PCCRL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Free a CRL context

//

//  There needs to be a corresponding free for each context obtained by a

//  get, duplicate or create.

//--------------------------------------------------------------------------

function CertFreeCRLContext(pCrlContext :PCCRL_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Set the property for the specified CRL context.

//

//  Same Property Ids and semantics as CertSetCertificateContextProperty.

//--------------------------------------------------------------------------

function CertSetCRLContextProperty(pCrlContext :PCCRL_CONTEXT;

                                   dwPropId :DWORD;

                                   dwFlags :DWORD;

                             const pvData :PVOID):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Get the property for the specified CRL context.

//

//  Same Property Ids and semantics as CertGetCertificateContextProperty.

//

//  CERT_SHA1_HASH_PROP_ID or CERT_MD5_HASH_PROP_ID is the predefined

//  property of most interest.

//--------------------------------------------------------------------------

function CertGetCRLContextProperty(pCrlContext :PCCRL_CONTEXT;

                                   dwPropId :DWORD;

                                   pvData :PVOID;

                                   pcbData :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Enumerate the properties for the specified CRL context.

//

//  To get the first property, set dwPropId to 0. The ID of the first

//  property is returned. To get the next property, set dwPropId to the

//  ID returned by the last call. To enumerate all the properties continue

//  until 0 is returned.

//

//  CertGetCRLContextProperty is called to get the property's data.

//--------------------------------------------------------------------------

function CertEnumCRLContextProperties(pCrlContext :PCCRL_CONTEXT;

                                      dwPropId :DWORD):DWORD ; stdcall;

//+-------------------------------------------------------------------------

// Add certificate/CRL, encoded, context or element disposition values.

//--------------------------------------------------------------------------

const CERT_STORE_ADD_NEW = 1;

const CERT_STORE_ADD_USE_EXISTING = 2;

const CERT_STORE_ADD_REPLACE_EXISTING = 3;

const CERT_STORE_ADD_ALWAYS = 4;

 

//+-------------------------------------------------------------------------

//  Add the encoded certificate to the store according to the specified

//  disposition action.

//

//  Makes a copy of the encoded certificate before adding to the store.

//

//  dwAddDispostion specifies the action to take if the certificate

//  already exists in the store. This parameter must be one of the following

//  values:

//    CERT_STORE_ADD_NEW

//      Fails if the certificate already exists in the store. LastError

//      is set to CRYPT_E_EXISTS.

//    CERT_STORE_ADD_USE_EXISTING

//      If the certifcate already exists, then, its used and if ppCertContext

//      is non-NULL, the existing context is duplicated.

//    CERT_STORE_ADD_REPLACE_EXISTING

//      If the certificate already exists, then, the existing certificate

//      context is deleted before creating and adding the new context.

//    CERT_STORE_ADD_ALWAYS

//      No check is made to see if the certificate already exists. A

//      new certificate context is always created. This may lead to

//      duplicates in the store.

//

//  CertGetSubjectCertificateFromStore is called to determine if the

//  certificate already exists in the store.

//

//  ppCertContext can be NULL, indicating the caller isn't interested

//  in getting the CERT_CONTEXT of the added or existing certificate.

//--------------------------------------------------------------------------

function CertAddEncodedCertificateToStore(hCertStore :HCERTSTORE;

                                          dwCertEncodingType :DWORD;

                                    const pbCertEncoded :PBYTE;

                                          cbCertEncoded :DWORD;

                                          dwAddDisposition :DWORD;

                                      var ppCertContext :PCCERT_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Add the certificate context to the store according to the specified

//  disposition action.

//

//  In addition to the encoded certificate, the context's properties are

//  also copied.  Note, the CERT_KEY_CONTEXT_PROP_ID property (and its

//  CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_SPEC_PROP_ID) isn't copied.

//

//  Makes a copy of the certificate context before adding to the store.

//

//  dwAddDispostion specifies the action to take if the certificate

//  already exists in the store. This parameter must be one of the following

//  values:

//    CERT_STORE_ADD_NEW

//      Fails if the certificate already exists in the store. LastError

//      is set to CRYPT_E_EXISTS.

//    CERT_STORE_ADD_USE_EXISTING

//      If the certifcate already exists, then, its used and if ppStoreContext

//      is non-NULL, the existing context is duplicated. Iterates

//      through pCertContext's properties and only copies the properties

//      that don't already exist. The SHA1 and MD5 hash properties aren't

//      copied.

//    CERT_STORE_ADD_REPLACE_EXISTING

//      If the certificate already exists, then, the existing certificate

//      context is deleted before creating and adding a new context.

//      Properties are copied before doing the add.

//    CERT_STORE_ADD_ALWAYS

//      No check is made to see if the certificate already exists. A

//      new certificate context is always created and added. This may lead to

//      duplicates in the store. Properties are

//      copied before doing the add.

//

//  CertGetSubjectCertificateFromStore is called to determine if the

//  certificate already exists in the store.

//

//  ppStoreContext can be NULL, indicating the caller isn't interested

//  in getting the CERT_CONTEXT of the added or existing certificate.

//--------------------------------------------------------------------------

function CertAddCertificateContextToStore(hCertStore :HCERTSTORE;

                                          pCertContext :PCCERT_CONTEXT;

                                          dwAddDisposition :DWORD;

                                      var ppStoreContext :PCCERT_CONTEXT //OPTIONAL

                                          ):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Certificate Store Context Types

//--------------------------------------------------------------------------

const CERT_STORE_CERTIFICATE_CONTEXT = 1;

const CERT_STORE_CRL_CONTEXT = 2;

const CERT_STORE_CTL_CONTEXT = 3;

 

//+-------------------------------------------------------------------------

//  Certificate Store Context Bit Flags

//--------------------------------------------------------------------------

const CERT_STORE_ALL_CONTEXT_FLAG = (not ULONG(0));

const CERT_STORE_CERTIFICATE_CONTEXT_FLAG = (1 shl CERT_STORE_CERTIFICATE_CONTEXT);

const CERT_STORE_CRL_CONTEXT_FLAG =  (1 shl CERT_STORE_CRL_CONTEXT);

const CERT_STORE_CTL_CONTEXT_FLAG = (1 shl CERT_STORE_CTL_CONTEXT);

 

//+-------------------------------------------------------------------------

//  Add the serialized certificate or CRL element to the store.

//

//  The serialized element contains the encoded certificate, CRL or CTL and

//  its properties, such as, CERT_KEY_PROV_INFO_PROP_ID.

//

//  If hCertStore is NULL, creates a certificate, CRL or CTL context not

//  residing in any store.

//

//  dwAddDispostion specifies the action to take if the certificate or CRL

//  already exists in the store. See CertAddCertificateContextToStore for a

//  list of and actions taken.

//

//  dwFlags currently isn't used and should be set to 0.

//

//  dwContextTypeFlags specifies the set of allowable contexts. For example, to

//  add either a certificate or CRL, set dwContextTypeFlags to:

//      CERT_STORE_CERTIFICATE_CONTEXT_FLAG | CERT_STORE_CRL_CONTEXT_FLAG

//

//  *pdwContextType is updated with the type of the context returned in

//  *ppvContxt. pdwContextType or ppvContext can be NULL, indicating the

//  caller isn't interested in getting the output. If *ppvContext is

//  returned it must be freed by calling CertFreeCertificateContext or

//  CertFreeCRLContext.

//--------------------------------------------------------------------------

function CertAddSerializedElementToStore(hCertStore :HCERTSTORE;

                                         pbElement :PBYTE;

                                         cbElement :DWORD;

                                         dwAddDisposition :DWORD;

                                         dwFlags :DWORD;

                                         dwContextTypeFlags :DWORD;

                                         pdwContextType :PDWORD;

                                     var ppvContext : array of PVOID):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Delete the specified certificate from the store.

//

//  All subsequent gets or finds for the certificate will fail. However,

//  memory allocated for the certificate isn't freed until all of its contexts

//  have also been freed.

//

//  The pCertContext is obtained from a get, enum, find or duplicate.

//

//  Some store provider implementations might also delete the issuer's CRLs

//  if this is the last certificate for the issuer in the store.

//

//  NOTE: the pCertContext is always CertFreeCertificateContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

function CertDeleteCertificateFromStore(pCertContext :PCCERT_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Add the encoded CRL to the store according to the specified

//  disposition option.

//

//  Makes a copy of the encoded CRL before adding to the store.

//

//  dwAddDispostion specifies the action to take if the CRL

//  already exists in the store. See CertAddEncodedCertificateToStore for a

//  list of and actions taken.

//

//  Compares the CRL's Issuer to determine if the CRL already exists in the

//  store.

//

//  ppCrlContext can be NULL, indicating the caller isn't interested

//  in getting the CRL_CONTEXT of the added or existing CRL.

//--------------------------------------------------------------------------

function CertAddEncodedCRLToStore(hCertStore :HCERTSTORE;

                                  dwCertEncodingType :DWORD;

                                  pbCrlEncoded :PBYTE;

                                  cbCrlEncoded :DWORD;

                                  dwAddDisposition :DWORD;

                              var ppCrlContext :PCCRL_CONTEXT

                                  ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Add the CRL context to the store according to the specified

//  disposition option.

//

//  In addition to the encoded CRL, the context's properties are

//  also copied.  Note, the CERT_KEY_CONTEXT_PROP_ID property (and its

//  CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_SPEC_PROP_ID) isn't copied.

//

//  Makes a copy of the encoded CRL before adding to the store.

//

//  dwAddDispostion specifies the action to take if the CRL

//  already exists in the store. See CertAddCertificateContextToStore for a

//  list of and actions taken.

//

//  Compares the CRL's Issuer, ThisUpdate and NextUpdate to determine

//  if the CRL already exists in the store.

//

//  ppStoreContext can be NULL, indicating the caller isn't interested

//  in getting the CRL_CONTEXT of the added or existing CRL.

//--------------------------------------------------------------------------

function CertAddCRLContextToStore(hCertStore :HCERTSTORE;

                                  pCrlContext :PCCRL_CONTEXT;

                                  dwAddDisposition :DWORD;

                              var ppStoreContext :PCCRL_CONTEXT

                                  ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Delete the specified CRL from the store.

//

//  All subsequent gets for the CRL will fail. However,

//  memory allocated for the CRL isn't freed until all of its contexts

//  have also been freed.

//

//  The pCrlContext is obtained from a get or duplicate.

//

//  NOTE: the pCrlContext is always CertFreeCRLContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

function CertDeleteCRLFromStore(pCrlContext :PCCRL_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Serialize the certificate context's encoded certificate and its

//  properties.

//--------------------------------------------------------------------------

function CertSerializeCertificateStoreElement(pCertContext :PCCERT_CONTEXT;

                                              dwFlags :DWORD;

                                              pbElement :PBYTE;

                                              pcbElement :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Serialize the CRL context's encoded CRL and its properties.

//--------------------------------------------------------------------------

function CertSerializeCRLStoreElement(pCrlContext :PCCRL_CONTEXT;

                                      dwFlags :DWORD;

                                      pbElement :PBYTE;

                                      pcbElement :PDWORD):BOOL ; stdcall;

//+=========================================================================

//  Certificate Trust List (CTL) Store Data Structures and APIs

//==========================================================================

 

//+-------------------------------------------------------------------------

//  Duplicate a CTL context

//--------------------------------------------------------------------------

function CertDuplicateCTLContext(pCtlContext :PCCTL_CONTEXT):PCCTL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Create a CTL context from the encoded CTL. The created

//  context isn't put in a store.

//

//  Makes a copy of the encoded CTL in the created context.

//

//  If unable to decode and create the CTL context, NULL is returned.

//  Otherwise, a pointer to a read only CTL_CONTEXT is returned.

//  CTL_CONTEXT must be freed by calling CertFreeCTLContext.

//  CertDuplicateCTLContext can be called to make a duplicate.

//

//  CertSetCTLContextProperty and CertGetCTLContextProperty can be called

//  to store properties for the CTL.

//--------------------------------------------------------------------------

function CertCreateCTLContext(dwMsgAndCertEncodingType :DWORD;

                        const pbCtlEncoded :PBYTE;

                              cbCtlEncoded :DWORD):PCCTL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Free a CTL context

//

//  There needs to be a corresponding free for each context obtained by a

//  get, duplicate or create.

//--------------------------------------------------------------------------

function CertFreeCTLContext(pCtlContext :PCCTL_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Set the property for the specified CTL context.

//

//  Same Property Ids and semantics as CertSetCertificateContextProperty.

//--------------------------------------------------------------------------

function CertSetCTLContextProperty(pCtlContext :PCCTL_CONTEXT;

                                   dwPropId :DWORD;

                                   dwFlags :DWORD;

                             const pvData :PVOID):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Get the property for the specified CTL context.

//

//  Same Property Ids and semantics as CertGetCertificateContextProperty.

//

//  CERT_SHA1_HASH_PROP_ID or CERT_NEXT_UPDATE_LOCATION_PROP_ID are the

//  predefined properties of most interest.

//--------------------------------------------------------------------------

function CertGetCTLContextProperty(pCtlContext :PCCTL_CONTEXT;

                                   dwPropId :DWORD;

                                   pvData :PVOID;

                                   pcbData :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Enumerate the properties for the specified CTL context.

//--------------------------------------------------------------------------

function CertEnumCTLContextProperties(pCtlContext :PCCTL_CONTEXT;

                                      dwPropId :DWORD):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//  Enumerate the CTL contexts in the store.

//

//  If a CTL isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CTL_CONTEXT is returned. CTL_CONTEXT

//  must be freed by calling CertFreeCTLContext or is freed when passed as the

//  pPrevCtlContext on a subsequent call. CertDuplicateCTLContext

//  can be called to make a duplicate.

//

//  pPrevCtlContext MUST BE NULL to enumerate the first

//  CTL in the store. Successive CTLs are enumerated by setting

//  pPrevCtlContext to the CTL_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevCtlContext is always CertFreeCTLContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

function CertEnumCTLsInStore(hCertStore :HCERTSTORE;

                             pPrevCtlContext :PCCTL_CONTEXT

                             ):PCCTL_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  Attempt to find the specified subject in the CTL.

//

//  For CTL_CERT_SUBJECT_TYPE, pvSubject points to a CERT_CONTEXT. The CTL's

//  SubjectAlgorithm is examined to determine the representation of the

//  subject's identity. Initially, only SHA1 or MD5 hash will be supported.

//  The appropriate hash property is obtained from the CERT_CONTEXT.

//

//  For CTL_ANY_SUBJECT_TYPE, pvSubject points to the CTL_ANY_SUBJECT_INFO

//  structure which contains the SubjectAlgorithm to be matched in the CTL

//  and the SubjectIdentifer to be matched in one of the CTL entries.

//

//  The certificate's hash or the CTL_ANY_SUBJECT_INFO's SubjectIdentifier

//  is used as the key in searching the subject entries. A binary

//  memory comparison is done between the key and the entry's SubjectIdentifer.

//

//  dwEncodingType isn't used for either of the above SubjectTypes.

//--------------------------------------------------------------------------

function CertFindSubjectInCTL(dwEncodingType :DWORD;

                              dwSubjectType :DWORD;

                              pvSubject :PVOID;

                              pCtlContext :PCCTL_CONTEXT;

                              dwFlags :DWORD):PCTL_ENTRY ; stdcall;

// Subject Types:

//  CTL_ANY_SUBJECT_TYPE, pvSubject points to following CTL_ANY_SUBJECT_INFO.

//  CTL_CERT_SUBJECT_TYPE, pvSubject points to CERT_CONTEXT.

const CTL_ANY_SUBJECT_TYPE = 1;

const CTL_CERT_SUBJECT_TYPE = 2;

 

type

  PCTL_ANY_SUBJECT_INFO = ^CTL_ANY_SUBJECT_INFO;

  CTL_ANY_SUBJECT_INFO = record

    SubjectAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    SubjectIdentifier :CRYPT_DATA_BLOB;

  end;

 

//+-------------------------------------------------------------------------

//  Find the first or next CTL context in the store.

//

//  The CTL is found according to the dwFindType and its pvFindPara.

//  See below for a list of the find types and its parameters.

//

//  Currently dwFindFlags isn't used and must be set to 0.

//

//  Usage of dwMsgAndCertEncodingType depends on the dwFindType.

//

//  If the first or next CTL isn't found, NULL is returned.

//  Otherwise, a pointer to a read only CTL_CONTEXT is returned. CTL_CONTEXT

//  must be freed by calling CertFreeCTLContext or is freed when passed as the

//  pPrevCtlContext on a subsequent call. CertDuplicateCTLContext

//  can be called to make a duplicate.

//

//  pPrevCtlContext MUST BE NULL on the first

//  call to find the CTL. To find the next CTL, the

//  pPrevCtlContext is set to the CTL_CONTEXT returned by a previous call.

//

//  NOTE: a NON-NULL pPrevCtlContext is always CertFreeCTLContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

function CertFindCTLInStore(hCertStore :HCERTSTORE;

                            dwMsgAndCertEncodingType :DWORD;

                            dwFindFlags :DWORD;

                            dwFindType :DWORD;

                      const pvFindPara :PVOID;

                            pPrevCtlContext :PCCTL_CONTEXT):PCCTL_CONTEXT ; stdcall;

 

const CTL_FIND_ANY = 0;

const CTL_FIND_SHA1_HASH = 1;

const CTL_FIND_MD5_HASH = 2;

const CTL_FIND_USAGE = 3;

const CTL_FIND_SUBJECT = 4;

 

type

  PCTL_FIND_USAGE_PARA = ^CTL_FIND_USAGE_PARA;

  CTL_FIND_USAGE_PARA = record

    cbSize :DWORD;

    SubjectUsage :CTL_USAGE;         // optional

    ListIdentifier :CRYPT_DATA_BLOB; // optional

    pSigner :PCERT_INFO;             // optional

  end;

 

const CTL_FIND_NO_LIST_ID_CBDATA = $FFFFFFFF;

const CTL_FIND_NO_SIGNER_PTR     = (PCERT_INFO($FFFFFFFF));

 

const CTL_FIND_SAME_USAGE_FLAG   = $1;

 

type

  PCTL_FIND_SUBJECT_PARA = ^CTL_FIND_SUBJECT_PARA;

  CTL_FIND_SUBJECT_PARA = record

    cbSize :DWORD;

    pUsagePara :PCTL_FIND_USAGE_PARA; // optional

    dwSubjectType :DWORD;

    pvSubject :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  CTL_FIND_ANY

//

//  Find any CTL.

//

//  pvFindPara isn't used.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CTL_FIND_SHA1_HASH

//  CTL_FIND_MD5_HASH

//

//  Find a CTL with the specified hash.

//

//  pvFindPara points to a CRYPT_HASH_BLOB.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CTL_FIND_USAGE

//

//  Find a CTL having the specified usage identifiers, list identifier or

//  signer. The CertEncodingType of the signer is obtained from the

//  dwMsgAndCertEncodingType parameter.

//

//  pvFindPara points to a CTL_FIND_USAGE_PARA data structure. The

//  SubjectUsage.cUsageIdentifer can be 0 to match any usage. The

//  ListIdentifier.cbData can be 0 to match any list identifier. To only match

//  CTLs without a ListIdentifier, cbData must be set to

//  CTL_FIND_NO_LIST_ID_CBDATA. pSigner can be NULL to match any signer. Only

//  the Issuer and SerialNumber fields of the pSigner's PCERT_INFO are used.

//  To only match CTLs without a signer, pSigner must be set to

//  CTL_FIND_NO_SIGNER_PTR.

//

//  The CTL_FIND_SAME_USAGE_FLAG can be set in dwFindFlags to

//  only match CTLs with the same usage identifiers. CTLs having additional

//  usage identifiers aren't matched. For example, if only "1.2.3" is specified

//  in CTL_FIND_USAGE_PARA, then, for a match, the CTL must only contain

//  "1.2.3" and not any additional usage identifers.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  CTL_FIND_SUBJECT

//

//  Find a CTL having the specified subject. CertFindSubjectInCTL can be

//  called to get a pointer to the subject's entry in the CTL.  pUsagePara can

//  optionally be set to enable the above CTL_FIND_USAGE matching.

//

//  pvFindPara points to a CTL_FIND_SUBJECT_PARA data structure.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  Add the encoded CTL to the store according to the specified

//  disposition option.

//

//  Makes a copy of the encoded CTL before adding to the store.

//

//  dwAddDispostion specifies the action to take if the CTL

//  already exists in the store. See CertAddEncodedCertificateToStore for a

//  list of and actions taken.

//

//  Compares the CTL's SubjectUsage, ListIdentifier and any of its signers

//  to determine if the CTL already exists in the store.

//

//  ppCtlContext can be NULL, indicating the caller isn't interested

//  in getting the CTL_CONTEXT of the added or existing CTL.

//--------------------------------------------------------------------------

function CertAddEncodedCTLToStore(hCertStore :HCERTSTORE;

                                  dwMsgAndCertEncodingType :DWORD;

                            const pbCtlEncoded :PBYTE;

                                  cbCtlEncoded :DWORD;

                                  dwAddDisposition :DWORD;

                              var ppCtlContext :PCCTL_CONTEXT //OPTIONAL

                                  ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Add the CTL context to the store according to the specified

//  disposition option.

//

//  In addition to the encoded CTL, the context's properties are

//  also copied.  Note, the CERT_KEY_CONTEXT_PROP_ID property (and its

//  CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_SPEC_PROP_ID) isn't copied.

//

//  Makes a copy of the encoded CTL before adding to the store.

//

//  dwAddDispostion specifies the action to take if the CTL

//  already exists in the store. See CertAddCertificateContextToStore for a

//  list of and actions taken.

//

//  Compares the CTL's SubjectUsage, ListIdentifier and any of its signers

//  to determine if the CTL already exists in the store.

//

//  ppStoreContext can be NULL, indicating the caller isn't interested

//  in getting the CTL_CONTEXT of the added or existing CTL.

//--------------------------------------------------------------------------

function CertAddCTLContextToStore(hCertStore :HCERTSTORE;

                                  pCtlContext :PCCTL_CONTEXT;

                                  dwAddDisposition :DWORD;

                              var ppStoreContext :PCCTL_CONTEXT

                                  ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Serialize the CTL context's encoded CTL and its properties.

//--------------------------------------------------------------------------

function CertSerializeCTLStoreElement(pCtlContext :PCCTL_CONTEXT;

                                      dwFlags :DWORD;

                                      pbElement :PBYTE;

                                      pcbElement :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Delete the specified CTL from the store.

//

//  All subsequent gets for the CTL will fail. However,

//  memory allocated for the CTL isn't freed until all of its contexts

//  have also been freed.

//

//  The pCtlContext is obtained from a get or duplicate.

//

//  NOTE: the pCtlContext is always CertFreeCTLContext'ed by

//  this function, even for an error.

//--------------------------------------------------------------------------

function CertDeleteCTLFromStore(pCtlContext :PCCTL_CONTEXT):BOOL ; stdcall;

//+=========================================================================

//  Enhanced Key Usage Helper Functions

//==========================================================================

 

//+-------------------------------------------------------------------------

//  Get the enhanced key usage extension or property from the certificate

//  and decode.

//

//  If the CERT_FIND_EXT_ONLY_ENHKEY_USAGE_FLAG is set, then, only get the

//  extension.

//

//  If the CERT_FIND_PROP_ONLY_ENHKEY_USAGE_FLAG is set, then, only get the

//  property.

//--------------------------------------------------------------------------

function CertGetEnhancedKeyUsage(pCertContext :PCCERT_CONTEXT;

                                 dwFlags :DWORD;

                                 pUsage :PCERT_ENHKEY_USAGE;

                                 pcbUsage :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Set the enhanced key usage property for the certificate.

//--------------------------------------------------------------------------

function CertSetEnhancedKeyUsage(pCertContext :PCCERT_CONTEXT;

                                 pUsage :PCERT_ENHKEY_USAGE

                                 ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Add the usage identifier to the certificate's enhanced key usage property.

//--------------------------------------------------------------------------

function CertAddEnhancedKeyUsageIdentifier(pCertContext :PCCERT_CONTEXT;

                                           pszUsageIdentifier :LPCSTR

                                           ):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Remove the usage identifier from the certificate's enhanced key usage

//  property.

//--------------------------------------------------------------------------

function CertRemoveEnhancedKeyUsageIdentifier(pCertContext :PCCERT_CONTEXT;

                                              pszUsageIdentifier :LPCSTR

                                              ):BOOL ; stdcall;

 

//+=========================================================================

//  Cryptographic Message helper functions for verifying and signing a

//  CTL.

//==========================================================================

 

//+-------------------------------------------------------------------------

//  Get and verify the signer of a cryptographic message.

//

//  To verify a CTL, the hCryptMsg is obtained from the CTL_CONTEXT's

//  hCryptMsg field.

//

//  If CMSG_TRUSTED_SIGNER_FLAG is set, then, treat the Signer stores as being

//  trusted and only search them to find the certificate corresponding to the

//  signer's issuer and serial number.  Otherwise, the SignerStores are

//  optionally provided to supplement the message's store of certificates.

//  If a signer certificate is found, its public key is used to verify

//  the message signature. The CMSG_SIGNER_ONLY_FLAG can be set to

//  return the signer without doing the signature verify.

//

//  If CMSG_USE_SIGNER_INDEX_FLAG is set, then, only get the signer specified

//  by *pdwSignerIndex. Otherwise, iterate through all the signers

//  until a signer verifies or no more signers.

//

//  For a verified signature, *ppSigner is updated with certificate context

//  of the signer and *pdwSignerIndex is updated with the index of the signer.

//  ppSigner and/or pdwSignerIndex can be NULL, indicating the caller isn't

//  interested in getting the CertContext and/or index of the signer.

//--------------------------------------------------------------------------

function CryptMsgGetAndVerifySigner(hCryptMsg :HCRYPTMSG;

                                    cSignerStore :DWORD;

                                var rghSignerStore :HCERTSTORE;

                                    dwFlags :DWORD;

                                var ppSigner :PCCERT_CONTEXT;

                                    pdwSignerIndex :PDWORD):BOOL ; stdcall;

 

const CMSG_TRUSTED_SIGNER_FLAG   = $1;

const CMSG_SIGNER_ONLY_FLAG      = $2;

const CMSG_USE_SIGNER_INDEX_FLAG = $4;

 

//+-------------------------------------------------------------------------

//  Sign an encoded CTL.

//

//  The pbCtlContent can be obtained via a CTL_CONTEXT's pbCtlContent

//  field or via a CryptEncodeObject(PKCS_CTL).

//--------------------------------------------------------------------------

function CryptMsgSignCTL(dwMsgEncodingType :DWORD;

                         pbCtlContent :PBYTE;

                         cbCtlContent :DWORD;

                         pSignInfo :PCMSG_SIGNED_ENCODE_INFO;

                         dwFlags :DWORD;

                         pbEncoded :PBYTE;

                         pcbEncoded :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Encode the CTL and create a signed message containing the encoded CTL.

//--------------------------------------------------------------------------

function CryptMsgEncodeAndSignCTL(dwMsgEncodingType :DWORD;

                                  pCtlInfo :PCTL_INFO;

                                  pSignInfo :PCMSG_SIGNED_ENCODE_INFO;

                                  dwFlags :DWORD;

                                  pbEncoded :PBYTE;

                                  pcbEncoded :PDWORD):BOOL ; stdcall;

 

//+=========================================================================

//  Certificate Verify CTL Usage Data Structures and APIs

//==========================================================================

type

  PHCERTSTORE = ^HCERTSTORE;

 

type

  PCTL_VERIFY_USAGE_PARA = ^CTL_VERIFY_USAGE_PARA;

  CTL_VERIFY_USAGE_PARA = record

    cbSize :DWORD;

    ListIdentifier :CRYPT_DATA_BLOB;// OPTIONAL

    cCtlStore :DWORD;

    rghCtlStore :PHCERTSTORE;       // OPTIONAL

    cSignerStore :DWORD;

    rghSignerStore :PHCERTSTORE;    // OPTIONAL

  end;

 

type

  PCTL_VERIFY_USAGE_STATUS = ^CTL_VERIFY_USAGE_STATUS;

  CTL_VERIFY_USAGE_STATUS = record

    cbSize :DWORD;

    dwError :DWORD;

    dwFlags :DWORD;

    ppCtl :PPCCTL_CONTEXT;             // IN OUT OPTIONAL

    dwCtlEntryIndex :DWORD;

    ppSigner :PPCCERT_CONTEXT ;        // IN OUT OPTIONAL

    dwSignerIndex :DWORD;

  end;

 

const CERT_VERIFY_INHIBIT_CTL_UPDATE_FLAG = $1;

const CERT_VERIFY_TRUSTED_SIGNERS_FLAG = $2;

const CERT_VERIFY_NO_TIME_CHECK_FLAG = $4;

const CERT_VERIFY_ALLOW_MORE_USAGE_FLAG = $8;

 

const CERT_VERIFY_UPDATED_CTL_FLAG = $1;

 

//+-------------------------------------------------------------------------

//  Verify that a subject is trusted for the specified usage by finding a

//  signed and time valid CTL with the usage identifiers and containing the

//  the subject. A subject can be identified by either its certificate context

//  or any identifier such as its SHA1 hash.

//

//  See CertFindSubjectInCTL for definition of dwSubjectType and pvSubject

//  parameters.

//

//  Via pVerifyUsagePara, the caller can specify the stores to be searched

//  to find the CTL. The caller can also specify the stores containing

//  acceptable CTL signers. By setting the ListIdentifier, the caller

//  can also restrict to a particular signer CTL list.

//

//  Via pVerifyUsageStatus, the CTL containing the subject, the subject's

//  index into the CTL's array of entries, and the signer of the CTL

//  are returned. If the caller is not interested, ppCtl and ppSigner can be set

//  to NULL. Returned contexts must be freed via the store's free context APIs.

//

//  If the CERT_VERIFY_INHIBIT_CTL_UPDATE_FLAG isn't set, then, a time

//  invalid CTL in one of the CtlStores may be replaced. When replaced, the

//  CERT_VERIFY_UPDATED_CTL_FLAG is set in pVerifyUsageStatus->dwFlags.

//

//  If the CERT_VERIFY_TRUSTED_SIGNERS_FLAG is set, then, only the

//  SignerStores specified in pVerifyUsageStatus are searched to find

//  the signer. Otherwise, the SignerStores provide additional sources

//  to find the signer's certificate.

//

//  If CERT_VERIFY_NO_TIME_CHECK_FLAG is set, then, the CTLs aren't checked

//  for time validity.

//

//  If CERT_VERIFY_ALLOW_MORE_USAGE_FLAG is set, then, the CTL may contain

//  additional usage identifiers than specified by pSubjectUsage. Otherwise,

//  the found CTL will contain the same usage identifers and no more.

//

//  CertVerifyCTLUsage will be implemented as a dispatcher to OID installable

//  functions. First, it will try to find an OID function matching the first

//  usage object identifier in the pUsage sequence. Next, it will dispatch

//  to the default CertDllVerifyCTLUsage functions.

//

//  If the subject is trusted for the specified usage, then, TRUE is

//  returned. Otherwise, FALSE is returned with dwError set to one of the

//  following:

//      CRYPT_E_NO_VERIFY_USAGE_DLL

//      CRYPT_E_NO_VERIFY_USAGE_CHECK

//      CRYPT_E_VERIFY_USAGE_OFFLINE

//      CRYPT_E_NOT_IN_CTL

//      CRYPT_E_NO_TRUSTED_SIGNER

//--------------------------------------------------------------------------

function CertVerifyCTLUsage(dwEncodingType :DWORD;

                            dwSubjectType :DWORD;

                            pvSubject :PVOID;

                            pSubjectUsage :PCTL_USAGE;

                            dwFlags :DWORD;

                            pVerifyUsagePara :PCTL_VERIFY_USAGE_PARA;

                            pVerifyUsageStatus:PCTL_VERIFY_USAGE_STATUS

                            ):BOOL ; stdcall;

 

//+=========================================================================

//  Certificate Revocation Data Structures and APIs

//==========================================================================

 

//+-------------------------------------------------------------------------

//  The following data structure may be passed to CertVerifyRevocation to

//  assist in finding the issuer of the context to be verified.

//

//  When pIssuerCert is specified, pIssuerCert is the issuer of

//  rgpvContext[cContext - 1].

//

//  When cCertStore and rgCertStore are specified, these stores may contain

//  an issuer certificate.

//--------------------------------------------------------------------------

type

  PCERT_REVOCATION_PARA = ^CERT_REVOCATION_PARA;

  CERT_REVOCATION_PARA = record

    cbSize :DWORD;

    pIssuerCert :PCCERT_CONTEXT;

    cCertStore :DWORD;

    rgCertStore :PHCERTSTORE ;

  end;

 

//+-------------------------------------------------------------------------

//  The following data structure is returned by CertVerifyRevocation to

//  specify the status of the revoked or unchecked context. Review the

//  following CertVerifyRevocation comments for details.

//

//  Upon input to CertVerifyRevocation, cbSize must be set to a size

//  >= sizeof(CERT_REVOCATION_STATUS). Otherwise, CertVerifyRevocation

//  returns FALSE and sets LastError to E_INVALIDARG.

//

//  Upon input to the installed or registered CRYPT_OID_VERIFY_REVOCATION_FUNC

//  functions, the dwIndex, dwError and dwReason have been zero'ed.

//--------------------------------------------------------------------------

type

  PCERT_REVOCATION_STATUS = ^CERT_REVOCATION_STATUS;

  CERT_REVOCATION_STATUS = record

    cbSize :DWORD;

    dwIndex :DWORD;

    dwError :DWORD;

    dwReason :DWORD;

  end;

//+-------------------------------------------------------------------------

//  Verifies the array of contexts for revocation. The dwRevType parameter

//  indicates the type of the context data structure passed in rgpvContext.

//  Currently only the revocation of certificates is defined.

//

//  If the CERT_VERIFY_REV_CHAIN_FLAG flag is set, then, CertVerifyRevocation

//  is verifying a chain of certs where, rgpvContext[i + 1] is the issuer

//  of rgpvContext[i]. Otherwise, CertVerifyRevocation makes no assumptions

//  about the order of the contexts.

//

//  To assist in finding the issuer, the pRevPara may optionally be set. See

//  the CERT_REVOCATION_PARA data structure for details.

//

//  The contexts must contain enough information to allow the

//  installable or registered revocation DLLs to find the revocation server. For

//  certificates, this information would normally be conveyed in an

//  extension such as the IETF's AuthorityInfoAccess extension.

//

//  CertVerifyRevocation returns TRUE if all of the contexts were successfully

//  checked and none were revoked. Otherwise, returns FALSE and updates the

//  returned pRevStatus data structure as follows:

//    dwIndex

//      Index of the first context that was revoked or unable to

//      be checked for revocation

//    dwError

//      Error status. LastError is also set to this error status.

//      dwError can be set to one of the following error codes defined

//      in winerror.h:

//        ERROR_SUCCESS - good context

//        CRYPT_E_REVOKED - context was revoked. dwReason contains the

//           reason for revocation

//        CRYPT_E_REVOCATION_OFFLINE - unable to connect to the

//           revocation server

//        CRYPT_E_NOT_IN_REVOCATION_DATABASE - the context to be checked

//           was not found in the revocation server's database.

//        CRYPT_E_NO_REVOCATION_CHECK - the called revocation function

//           wasn't able to do a revocation check on the context

//        CRYPT_E_NO_REVOCATION_DLL - no installed or registered Dll was

//           found to verify revocation

//    dwReason

//      The dwReason is currently only set for CRYPT_E_REVOKED and contains

//      the reason why the context was revoked. May be one of the following

//      CRL reasons defined by the CRL Reason Code extension ("2.5.29.21")

//          CRL_REASON_UNSPECIFIED              0

//          CRL_REASON_KEY_COMPROMISE           1

//          CRL_REASON_CA_COMPROMISE            2

//          CRL_REASON_AFFILIATION_CHANGED      3

//          CRL_REASON_SUPERSEDED               4

//          CRL_REASON_CESSATION_OF_OPERATION   5

//          CRL_REASON_CERTIFICATE_HOLD         6

//

//  For each entry in rgpvContext, CertVerifyRevocation iterates

//  through the CRYPT_OID_VERIFY_REVOCATION_FUNC

//  function set's list of installed DEFAULT functions.

//  CryptGetDefaultOIDFunctionAddress is called with pwszDll = NULL. If no

//  installed functions are found capable of doing the revocation verification,

//  CryptVerifyRevocation iterates through CRYPT_OID_VERIFY_REVOCATION_FUNC's

//  list of registered DEFAULT Dlls. CryptGetDefaultOIDDllList is called to

//  get the list. CryptGetDefaultOIDFunctionAddress is called to load the Dll.

//

//  The called functions have the same signature as CertVerifyRevocation. A

//  called function returns TRUE if it was able to successfully check all of

//  the contexts and none were revoked. Otherwise, the called function returns

//  FALSE and updates pRevStatus. dwIndex is set to the index of

//  the first context that was found to be revoked or unable to be checked.

//  dwError and LastError are updated. For CRYPT_E_REVOKED, dwReason

//  is updated. Upon input to the called function, dwIndex, dwError and

//  dwReason have been zero'ed. cbSize has been checked to be >=

//  sizeof(CERT_REVOCATION_STATUS).

//

//  If the called function returns FALSE, and dwError isn't set to

//  CRYPT_E_REVOKED, then, CertVerifyRevocation either continues on to the

//  next DLL in the list for a returned dwIndex of 0 or for a returned

//  dwIndex > 0, restarts the process of finding a verify function by

//  advancing the start of the context array to the returned dwIndex and

//  decrementing the count of remaining contexts.

//--------------------------------------------------------------------------

function CertVerifyRevocation(dwEncodingType :DWORD;

                              dwRevType :DWORD;

                              cContext :DWORD;

                              rgpvContext :array of PVOID;

                              dwFlags :DWORD;

                              pRevPara :PCERT_REVOCATION_PARA;

                              pRevStatus :PCERT_REVOCATION_STATUS

                              ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Revocation types

//--------------------------------------------------------------------------

const CERT_CONTEXT_REVOCATION_TYPE = 1;

 

//+-------------------------------------------------------------------------

//  When the following flag is set, rgpvContext[] consists of a chain

//  of certificates, where rgpvContext[i + 1] is the issuer of rgpvContext[i].

//--------------------------------------------------------------------------

const CERT_VERIFY_REV_CHAIN_FLAG = $1;

 

//+-------------------------------------------------------------------------

//  CERT_CONTEXT_REVOCATION_TYPE

//

//  pvContext points to a const CERT_CONTEXT.

//--------------------------------------------------------------------------

 

//+=========================================================================

//  Certificate Helper APIs

//==========================================================================

 

 

//+-------------------------------------------------------------------------

//  Compare two multiple byte integer blobs to see if they are identical.

//

//  Before doing the comparison, leading zero bytes are removed from a

//  positive number and leading 0xFF bytes are removed from a negative

//  number.

//

//  The multiple byte integers are treated as Little Endian. pbData[0] is the

//  least significant byte and pbData[cbData - 1] is the most significant

//  byte.

//

//  Returns TRUE if the integer blobs are identical after removing leading

//  0 or 0xFF bytes.

//--------------------------------------------------------------------------

function CertCompareIntegerBlob(pInt1 :PCRYPT_INTEGER_BLOB;

                                pInt2 :PCRYPT_INTEGER_BLOB

                                ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Compare two certificates to see if they are identical.

//

//  Since a certificate is uniquely identified by its Issuer and SerialNumber,

//  these are the only fields needing to be compared.

//

//  Returns TRUE if the certificates are identical.

//--------------------------------------------------------------------------

function CertCompareCertificate(dwCertEncodingType :DWORD;

                                pCertId1 :PCERT_INFO;

                                pCertId2 :PCERT_INFO):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Compare two certificate names to see if they are identical.

//

//  Returns TRUE if the names are identical.

//--------------------------------------------------------------------------

function CertCompareCertificateName(dwCertEncodingType :DWORD;

                                    pCertName1 :PCERT_NAME_BLOB;

                                    pCertName2 :PCERT_NAME_BLOB):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Compare the attributes in the certificate name with the specified

//  Relative Distinguished Name's (CERT_RDN) array of attributes.

//  The comparison iterates through the CERT_RDN attributes and looks for an

//  attribute match in any of the certificate name's RDNs.

//  Returns TRUE if all the attributes are found and match.

//

//  The CERT_RDN_ATTR fields can have the following special values:

//    pszObjId == NULL              - ignore the attribute object identifier

//    dwValueType == RDN_ANY_TYPE   - ignore the value type

//

//  Currently only an exact, case sensitive match is supported.

//

//  CERT_UNICODE_IS_RDN_ATTRS_FLAG should be set if the pRDN was initialized

//  with unicode strings as for CryptEncodeObject(X509_UNICODE_NAME).

//--------------------------------------------------------------------------

function CertIsRDNAttrsInCertificateName(dwCertEncodingType :DWORD;

                                         dwFlags :DWORD;

                                         pCertName :PCERT_NAME_BLOB;

                                         pRDN :PCERT_RDN):BOOL ; stdcall;

 

const CERT_UNICODE_IS_RDN_ATTRS_FLAG = $1;

 

//+-------------------------------------------------------------------------

//  Compare two public keys to see if they are identical.

//

//  Returns TRUE if the keys are identical.

//--------------------------------------------------------------------------

function CertComparePublicKeyInfo(dwCertEncodingType :DWORD;

                                  pPublicKey1 :PCERT_PUBLIC_KEY_INFO;

                                  pPublicKey2 :PCERT_PUBLIC_KEY_INFO

                                  ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Get the public/private key's bit length.

//

//  Returns 0 if unable to determine the key's length.

//--------------------------------------------------------------------------

function CertGetPublicKeyLength(dwCertEncodingType :DWORD;

                                pPublicKey :PCERT_PUBLIC_KEY_INFO

                                ):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//  Verify the signature of a subject certificate or a CRL using the

//  public key info

//

//  Returns TRUE for a valid signature.

//

//  hCryptProv specifies the crypto provider to use to verify the signature.

//  It doesn't need to use a private key.

//--------------------------------------------------------------------------

function CryptVerifyCertificateSignature(hCryptProv :HCRYPTPROV;

                                         dwCertEncodingType :DWORD;

                                   const pbEncoded :PBYTE;

                                         cbEncoded :DWORD;

                                         pPublicKey :PCERT_PUBLIC_KEY_INFO

                                         ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Compute the hash of the "to be signed" information in the encoded

//  signed content (CERT_SIGNED_CONTENT_INFO).

//

//  hCryptProv specifies the crypto provider to use to compute the hash.

//  It doesn't need to use a private key.

//--------------------------------------------------------------------------

function CryptHashToBeSigned(hCryptProv :HCRYPTPROV;

                             dwCertEncodingType :DWORD;

                       const pbEncoded :PBYTE;

                             cbEncoded :DWORD;

                             pbComputedHash :PBYTE;

                             pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Hash the encoded content.

//

//  hCryptProv specifies the crypto provider to use to compute the hash.

//  It doesn't need to use a private key.

//

//  Algid specifies the CAPI hash algorithm to use. If Algid is 0, then, the

//  default hash algorithm (currently SHA1) is used.

//--------------------------------------------------------------------------

function CryptHashCertificate(hCryptProv :HCRYPTPROV;

                              Algid :ALG_ID;

                              dwFlags :DWORD;

                        const pbEncoded :PBYTE;

                              cbEncoded :DWORD;

                              pbComputedHash :PBYTE;

                              pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Sign the "to be signed" information in the encoded signed content.

//

//  hCryptProv specifies the crypto provider to use to do the signature.

//  It uses the specified private key.

//--------------------------------------------------------------------------

function CryptSignCertificate(hCryptProv :HCRYPTPROV;

                              dwKeySpec :DWORD;

                              dwCertEncodingType :DWORD;

                        const pbEncodedToBeSigned :PBYTE;

                              cbEncodedToBeSigned :DWORD;

                              pSignatureAlgorithm :PCRYPT_ALGORITHM_IDENTIFIER;

                        const pvHashAuxInfo :PVOID;

                              pbSignature :PBYTE;

                              pcbSignature:PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Encode the "to be signed" information. Sign the encoded "to be signed".

//  Encode the "to be signed" and the signature.

//

//  hCryptProv specifies the crypto provider to use to do the signature.

//  It uses the specified private key.

//--------------------------------------------------------------------------

function CryptSignAndEncodeCertificate(hCryptProv :HCRYPTPROV;

                                       dwKeySpec :DWORD;

                                       dwCertEncodingType :DWORD;

                                 const lpszStructType :LPCSTR; // "to be signed"

                                       pvStructInfo :PVOID;

                                       pSignatureAlgorithm :PCRYPT_ALGORITHM_IDENTIFIER;

                                 const pvHashAuxInfo :PVOID;

                                       pbEncoded :PBYTE;

                                       pcbEncoded :PDWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Verify the time validity of a certificate.

//

//  Returns -1 if before NotBefore, +1 if after NotAfter and otherwise 0 for

//  a valid certificate

//

//  If pTimeToVerify is NULL, uses the current time.

//--------------------------------------------------------------------------

function CertVerifyTimeValidity(pTimeToVerify :PFILETIME;

                                pCertInfo :PCERT_INFO):LONG ; stdcall;

 

//+-------------------------------------------------------------------------

//  Verify the time validity of a CRL.

//

//  Returns -1 if before ThisUpdate, +1 if after NextUpdate and otherwise 0 for

//  a valid CRL

//

//  If pTimeToVerify is NULL, uses the current time.

//--------------------------------------------------------------------------

function CertVerifyCRLTimeValidity(pTimeToVerify :PFILETIME;

                                   pCrlInfo :PCRL_INFO):LONG ; stdcall;

//+-------------------------------------------------------------------------

//  Verify that the subject's time validity nests within the issuer's time

//  validity.

//

//  Returns TRUE if it nests. Otherwise, returns FALSE.

//--------------------------------------------------------------------------

function CertVerifyValidityNesting(pSubjectInfo :PCERT_INFO;

                                   pIssuerInfo :PCERT_INFO):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Verify that the subject certificate isn't on its issuer CRL.

//

//  Returns true if the certificate isn't on the CRL.

//--------------------------------------------------------------------------

function CertVerifyCRLRevocation(dwCertEncodingType :DWORD;

                                 pCertId :PCERT_INFO;    // Only the Issuer and SerialNumber

                                 cCrlInfo :DWORD;        // fields are used

                                 rgpCrlInfo :array of PCRL_INFO):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Convert the CAPI AlgId to the ASN.1 Object Identifier string

//

//  Returns NULL if there isn't an ObjId corresponding to the AlgId.

//--------------------------------------------------------------------------

function CertAlgIdToOID(dwAlgId :DWORD):LPCSTR ; stdcall;

//+-------------------------------------------------------------------------

//  Convert the ASN.1 Object Identifier string to the CAPI AlgId.

//

//  Returns 0 if there isn't an AlgId corresponding to the ObjId.

//--------------------------------------------------------------------------

function CertOIDToAlgId(pszObjId :LPCSTR):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//  Find an extension identified by its Object Identifier.

//

//  If found, returns pointer to the extension. Otherwise, returns NULL.

//--------------------------------------------------------------------------

function CertFindExtension(pszObjId :LPCSTR;

                           cExtensions :DWORD;

                           rgExtensions :array of CERT_EXTENSION):PCERT_EXTENSION ; stdcall;

//+-------------------------------------------------------------------------

//  Find the first attribute identified by its Object Identifier.

//

//  If found, returns pointer to the attribute. Otherwise, returns NULL.

//--------------------------------------------------------------------------

function CertFindAttribute(pszObjId :LPCSTR;

                           cAttr :DWORD;

                           rgAttr :array of CRYPT_ATTRIBUTE):PCRYPT_ATTRIBUTE ; stdcall;

//+-------------------------------------------------------------------------

//  Find the first CERT_RDN attribute identified by its Object Identifier in

//  the name's list of Relative Distinguished Names.

//

//  If found, returns pointer to the attribute. Otherwise, returns NULL.

//--------------------------------------------------------------------------

function CertFindRDNAttr(pszObjId :LPCSTR;

                         pName :PCERT_NAME_INFO ):PCERT_RDN_ATTR ; stdcall;

//+-------------------------------------------------------------------------

//  Get the intended key usage bytes from the certificate.

//

//  If the certificate doesn't have any intended key usage bytes, returns FALSE

//  and *pbKeyUsage is zeroed. Otherwise, returns TRUE and up through

//  cbKeyUsage bytes are copied into *pbKeyUsage. Any remaining uncopied

//  bytes are zeroed.

//--------------------------------------------------------------------------

function CertGetIntendedKeyUsage(dwCertEncodingType :DWORD;

                                 pCertInfo :PCERT_INFO;

                                 pbKeyUsage :PBYTE;

                                 cbKeyUsage :DWORD):BOOL ; stdcall;

 

//+-------------------------------------------------------------------------

//  Export the public key info associated with the provider's corresponding

//  private key.

//

//  Calls CryptExportPublicKeyInfo with pszPublicKeyObjId = szOID_RSA_RSA,

//  dwFlags = 0 and pvAuxInfo = NULL.

//--------------------------------------------------------------------------

function CryptExportPublicKeyInfo(hCryptProv :HCRYPTPROV;

                                  dwKeySpec :DWORD;

                                  dwCertEncodingType :DWORD;

                                  pInfo :PCERT_PUBLIC_KEY_INFO;

                                  pcbInfo :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Export the public key info associated with the provider's corresponding

//  private key.

//

//  Uses the dwCertEncodingType and pszPublicKeyObjId to call the

//  installable CRYPT_OID_EXPORT_PUBLIC_KEY_INFO_FUNC. The called function

//  has the same signature as CryptExportPublicKeyInfoEx.

//

//  If unable to find an installable OID function for the pszPublicKeyObjId,

//  attempts to export as a RSA Public Key (szOID_RSA_RSA).

//

//  The dwFlags and pvAuxInfo aren't used for szOID_RSA_RSA.

//--------------------------------------------------------------------------

const CRYPT_OID_EXPORT_PUBLIC_KEY_INFO_FUNC = 'CryptDllExportPublicKeyInfoEx';

 

function CryptExportPublicKeyInfoEx(hCryptProv :HCRYPTPROV;

                                    dwKeySpec :DWORD;

                                    dwCertEncodingType :DWORD;

                                    pszPublicKeyObjId :LPSTR;

                                    dwFlags :DWORD;

                                    pvAuxInfo :PVOID;

                                    pInfo :PCERT_PUBLIC_KEY_INFO;

                                    pcbInfo :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Convert and import the public key info into the provider and return a

//  handle to the public key.

//

//  Calls CryptImportPublicKeyInfoEx with aiKeyAlg = 0, dwFlags = 0 and

//  pvAuxInfo = NULL.

//--------------------------------------------------------------------------

function CryptImportPublicKeyInfo(hCryptProv :HCRYPTPROV;

                                  dwCertEncodingType :DWORD;

                                  pInfo :PCERT_PUBLIC_KEY_INFO;

                                  phKey :PHCRYPTKEY):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Convert and import the public key info into the provider and return a

//  handle to the public key.

//

//  Uses the dwCertEncodingType and pInfo->Algorithm.pszObjId to call the

//  installable CRYPT_OID_IMPORT_PUBLIC_KEY_INFO_FUNC. The called function

//  has the same signature as CryptImportPublicKeyInfoEx.

//

//  If unable to find an installable OID function for the pszObjId,

//  attempts to import as a RSA Public Key (szOID_RSA_RSA).

//

//  For szOID_RSA_RSA: aiKeyAlg may be set to CALG_RSA_SIGN or CALG_RSA_KEYX.

//  Defaults to CALG_RSA_KEYX. The dwFlags and pvAuxInfo aren't used.

//--------------------------------------------------------------------------

const CRYPT_OID_IMPORT_PUBLIC_KEY_INFO_FUNC = 'CryptDllImportPublicKeyInfoEx';

 

function CryptImportPublicKeyInfoEx(hCryptProv :HCRYPTPROV;

                                    dwCertEncodingType :DWORD;

                                    pInfo :PCERT_PUBLIC_KEY_INFO;

                                    aiKeyAlg :ALG_ID;

                                    dwFlags :DWORD;

                                    pvAuxInfo :PVOID;

                                    phKey :PHCRYPTKEY

                                    ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Compute the hash of the encoded public key info.

//

//  The public key info is encoded and then hashed.

//--------------------------------------------------------------------------

function CryptHashPublicKeyInfo(hCryptProv :HCRYPTPROV;

                                Algid :ALG_ID;

                                dwFlags :DWORD;

                                dwCertEncodingType :DWORD;

                                pInfo :PCERT_PUBLIC_KEY_INFO;

                                pbComputedHash :PBYTE;

                                pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Convert a Name Value to a null terminated char string

//

//  Returns the number of characters converted including the terminating null

//  character. If psz is NULL or csz is 0, returns the required size of the

//  destination string (including the terminating null char).

//

//  If psz != NULL && csz != 0, returned psz is always NULL terminated.

//

//  Note: csz includes the NULL char.

//--------------------------------------------------------------------------

function CertRDNValueToStrA(dwValueType :DWORD;

                            pValue :PCERT_RDN_VALUE_BLOB;

                            psz :LPSTR;                   //OPTIONAL

                            csz :DWORD):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//  Convert a Name Value to a null terminated char string

//

//  Returns the number of characters converted including the terminating null

//  character. If psz is NULL or csz is 0, returns the required size of the

//  destination string (including the terminating null char).

//

//  If psz != NULL && csz != 0, returned psz is always NULL terminated.

//

//  Note: csz includes the NULL char.

//--------------------------------------------------------------------------

function CertRDNValueToStrW(dwValueType :DWORD;

                            pValue :PCERT_RDN_VALUE_BLOB;

                            psz :LPWSTR;                   //OPTIONAL

                            csz :DWORD):DWORD ; stdcall;

 

function CertRDNValueToStr(dwValueType :DWORD;

                           pValue :PCERT_RDN_VALUE_BLOB;

                           psz :LPAWSTR;     //OPTIONAL

                           csz :DWORD):DWORD ; stdcall;

 

//+-------------------------------------------------------------------------

//  Convert the certificate name blob to a null terminated char string.

//

//  Follows the string representation of distinguished names specified in

//  RFC 1779. (Note, added double quoting "" for embedded quotes, quote

//  empty strings and don't quote strings containing consecutive spaces).

//  RDN values of type CERT_RDN_ENCODED_BLOB or CERT_RDN_OCTET_STRING are

//  formatted in hexadecimal (e.g. #0A56CF).

//

//  The name string is formatted according to the dwStrType:

//    CERT_SIMPLE_NAME_STR

//      The object identifiers are discarded. CERT_RDN entries are separated

//      by ", ". Multiple attributes per CERT_RDN are separated by " + ".

//      For example:

//          Microsoft, Joe Cool + Programmer

//    CERT_OID_NAME_STR

//      The object identifiers are included with a "=" separator from their

//      attribute value. CERT_RDN entries are separated by ", ".

//      Multiple attributes per CERT_RDN are separated by " + ". For example:

//          2.5.4.11=Microsoft, 2.5.4.3=Joe Cool + 2.5.4.12=Programmer

//    CERT_X500_NAME_STR

//      The object identifiers are converted to their X500 key name. Otherwise,

//      same as CERT_OID_NAME_STR. If the object identifier doesn't have

//      a corresponding X500 key name, then, the object identifier is used with

//      a "OID." prefix. For example:

//          OU=Microsoft, CN=Joe Cool + T=Programmer, OID.1.2.3.4.5.6=Unknown

//

//  We quote the RDN value if it contains leading or trailing whitespace

//  or one of the following characters: ",", "+", "=", """, "n",  "<", ">",

//  "#" or ";". The quoting character is ". If the the RDN Value contains

//  a " it is double quoted (""). For example:

//      OU="  Microsoft", CN="Joe ""Cool""" + T="Programmer, Manager"

//

//  CERT_NAME_STR_SEMICOLON_FLAG can be or'ed into dwStrType to replace

//  the ", " separator with a "; " separator.

//

//  CERT_NAME_STR_CRLF_FLAG can be or'ed into dwStrType to replace

//  the ", " separator with a "rn" separator.

//

//  CERT_NAME_STR_NO_PLUS_FLAG can be or'ed into dwStrType to replace the

//  " + " separator with a single space, " ".

//

//  CERT_NAME_STR_NO_QUOTING_FLAG can be or'ed into dwStrType to inhibit

//  the above quoting.

//

//  Returns the number of characters converted including the terminating null

//  character. If psz is NULL or csz is 0, returns the required size of the

//  destination string (including the terminating null char).

//

//  If psz != NULL && csz != 0, returned psz is always NULL terminated.

//

//  Note: csz includes the NULL char.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//--------------------------------------------------------------------------

function CertNameToStrA(dwCertEncodingType :DWORD;

                        pName :PCERT_NAME_BLOB;

                        dwStrType :DWORD;

                        psz :LPSTR; //OPTIONAL

                        csz :DWORD):DWORD ; stdcall;

//+-------------------------------------------------------------------------

//--------------------------------------------------------------------------

function CertNameToStrW(dwCertEncodingType :DWORD;

                        pName :PCERT_NAME_BLOB;

                        dwStrType :DWORD;

                        psz :LPWSTR; //OPTIONAL

                        csz :DWORD):DWORD ; stdcall;

 

function CertNameToStr(dwCertEncodingType :DWORD;

                       pName :PCERT_NAME_BLOB;

                       dwStrType :DWORD;

                       psz :LPAWSTR; //OPTIONAL

                       csz :DWORD):DWORD ; stdcall;

 

//+-------------------------------------------------------------------------

//  Certificate name string types

//--------------------------------------------------------------------------

const CERT_SIMPLE_NAME_STR = 1;

const CERT_OID_NAME_STR = 2;

const CERT_X500_NAME_STR = 3;

 

//+-------------------------------------------------------------------------

//  Certificate name string type flags OR'ed with the above types

//--------------------------------------------------------------------------

const CERT_NAME_STR_SEMICOLON_FLAG = $40000000;

const CERT_NAME_STR_NO_PLUS_FLAG = $20000000;

const CERT_NAME_STR_NO_QUOTING_FLAG = $10000000;

const CERT_NAME_STR_CRLF_FLAG = $08000000;

const CERT_NAME_STR_COMMA_FLAG = $04000000;

 

 

//+-------------------------------------------------------------------------

//  Convert the null terminated X500 string to an encoded certificate name.

//

//  The input string is expected to be formatted the same as the output

//  from the above CertNameToStr API.

//

//  The CERT_SIMPLE_NAME_STR type isn't supported. Otherwise, when dwStrType

//  is set to 0, CERT_OID_NAME_STR or CERT_X500_NAME_STR, allow either a

//  case insensitive X500 key (CN=), case insensitive "OID." prefixed

//  object identifier (OID.1.2.3.4.5.6=) or an object identifier (1.2.3.4=).

//

//  If no flags are OR'ed into dwStrType, then, allow "," or ";" as RDN

//  separators and "+" as the multiple RDN value separator. Quoting is

//  supported. A quote may be included in a quoted value by double quoting,

//  for example (CN="Joe ""Cool"""). A value starting with a "#" is treated

//  as ascii hex and converted to a CERT_RDN_OCTET_STRING. Embedded whitespace

//  is skipped (1.2.3 = # AB CD 01  is the same as 1.2.3=#ABCD01).

//

//  Whitespace surrounding the keys, object identifers and values is removed.

//

//  CERT_NAME_STR_COMMA_FLAG can be or'ed into dwStrType to only allow the

//  "," as the RDN separator.

//

//  CERT_NAME_STR_SEMICOLON_FLAG can be or'ed into dwStrType to only allow the

//  ";" as the RDN separator.

//

//  CERT_NAME_STR_CRLF_FLAG can be or'ed into dwStrType to only allow

//  "r" or "n" as the RDN separator.

//

//  CERT_NAME_STR_NO_PLUS_FLAG can be or'ed into dwStrType to ignore "+"

//  as a separator and not allow multiple values per RDN.

//

//  CERT_NAME_STR_NO_QUOTING_FLAG can be or'ed into dwStrType to inhibit

//  quoting.

//

//  Support the following X500 Keys:

//

//  Key         Object Identifier               RDN Value Type(s)

//  ---         -----------------               -----------------

//  CN          szOID_COMMON_NAME               Printable, T61

//  L           szOID_LOCALITY_NAME             Printable, T61

//  O           szOID_ORGANIZATION_NAME         Printable, T61

//  OU          szOID_ORGANIZATIONAL_UNIT_NAME  Printable, T61

//  Email       szOID_RSA_emailAddr             Only IA5

//  C           szOID_COUNTRY_NAME              Only Printable

//  S           szOID_STATE_OR_PROVINCE_NAME    Printable, T61

//  ST          szOID_STATE_OR_PROVINCE_NAME    Printable, T61

//  STREET      szOID_STREET_ADDRESS            Printable, T61

//  T           szOID_TITLE                     Printable, T61

//  Title       szOID_TITLE                     Printable, T61

//  G           szOID_GIVEN_NAME                Printable, T61

//  GivenName   szOID_GIVEN_NAME                Printable, T61

//  I           szOID_INITIALS                  Printable, T61

//  Initials    szOID_INITIALS                  Printable, T61

//  SN          szOID_SUR_NAME                  Printable, T61

//  DC          szOID_DOMAIN_COMPONENT          Only IA5

//

//  The T61 types are UTF-8 encoded.

//

//  Returns TRUE if successfully parsed the input string and encoded

//  the name.

//

//  If the input string is detected to be invalid, *ppszError is updated

//  to point to the beginning of the invalid character sequence. Otherwise,

//  *ppszError is set to NULL. *ppszError is updated with a non-NULL pointer

//  for the following errors:

//      CRYPT_E_INVALID_X500_STRING

//      CRYPT_E_INVALID_NUMERIC_STRING

//      CRYPT_E_INVALID_PRINTABLE_STRING

//      CRYPT_E_INVALID_IA5_STRING

//

//  ppszError can be set to NULL if not interested in getting a pointer

//  to the invalid character sequence.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//--------------------------------------------------------------------------

function CertStrToNameA(dwCertEncodingType :DWORD;

                        pszX500 :LPCSTR;

                        dwStrType :DWORD;

                        pvReserved :PVOID;

                        pbEncoded :PBYTE;

                        pcbEncoded :PDWORD;

                     var ppszError :array of LPCSTR):BOOL ; stdcall;  {--max-- iniziato qui}

//+-------------------------------------------------------------------------

//--------------------------------------------------------------------------

function CertStrToNameW(dwCertEncodingType :DWORD;

                        pszX500 :LPCWSTR;

                        dwStrType :DWORD;

                        pvReserved :PVOID;

                        pbEncoded :PBYTE;

                        pcbEncoded :PDWORD;

                    var ppszError :array of LPWSTR):BOOL ; stdcall;

 

function CertStrToName(dwCertEncodingType :DWORD;

                       pszX500 :LPAWSTR;

                       dwStrType :DWORD;

                       pvReserved :PVOID;

                       pbEncoded :PBYTE;

                       pcbEncoded :PDWORD;

                   var ppszError :array of LPAWSTR):BOOL ; stdcall;

 

//+=========================================================================

//  Simplified Cryptographic Message Data Structures and APIs

//==========================================================================

 

 

//+-------------------------------------------------------------------------

//              Conventions for the *pb and *pcb output parameters:

//

//              Upon entry to the function:

//                  if pcb is OPTIONAL && pcb == NULL, then,

//                      No output is returned

//                  else if pb == NULL && pcb != NULL, then,

//                      Length only determination. No length error is

//                      returned.

//                  otherwise where (pb != NULL && pcb != NULL && *pcb != 0)

//                      Output is returned. If *pcb isn't big enough a

//                      length error is returned. In all cases *pcb is updated

//                      with the actual length needed/returned.

//--------------------------------------------------------------------------

 

 

//+-------------------------------------------------------------------------

//  Type definitions of the parameters used for doing the cryptographic

//  operations.

//--------------------------------------------------------------------------

 

//+-------------------------------------------------------------------------

//  Callback to get and verify the signer's certificate.

//

//  Passed the CertId of the signer (its Issuer and SerialNumber) and a

//  handle to its cryptographic signed message's cert store.

//

//  For CRYPT_E_NO_SIGNER, called with pSignerId == NULL.

//

//  For a valid signer certificate, returns a pointer to a read only

//  CERT_CONTEXT. The returned CERT_CONTEXT is either obtained from a

//  cert store or was created via CertCreateCertificateContext. For either case,

//  its freed via CertFreeCertificateContext.

//

//  If a valid certificate isn't found, this callback returns NULL with

//  LastError set via SetLastError().

//

//  The NULL implementation tries to get the Signer certificate from the

//  message cert store. It doesn't verify the certificate.

//--------------------------------------------------------------------------

 

type

    PFN_CRYPT_GET_SIGNER_CERTIFICATE = function (pvGetArg :PVOID;

                                                 dwCertEncodingType :DWORD;

                                                 pSignerId :PCERT_INFO;        // Only the Issuer and SerialNumber

                                                 hMsgCertStore :HCERTSTORE     // fields have been updated

                                                 ):PCCERT_CONTEXT ; stdcall;

//+-------------------------------------------------------------------------

//  The CRYPT_SIGN_MESSAGE_PARA are used for signing messages using the

//  specified signing certificate contexts. (Note, allows multiple signers.)

//

//  Either the CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_PROV_INFO_PROP_ID must

//  be set for each rgpSigningCert[]. Either one specifies the private

//  signature key to use.

//

//  If any certificates and/or CRLs are to be included in the signed message,

//  then, the MsgCert and MsgCrl parameters need to be updated. If the

//  rgpSigningCerts are to be included, then, they must also be in the

//  rgpMsgCert array.

//

//  cbSize must be set to the sizeof(CRYPT_SIGN_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//

//  pvHashAuxInfo currently isn't used and must be set to NULL.

//

//  dwFlags normally is set to 0. However, if the encoded output

//  is to be a CMSG_SIGNED inner content of an outer cryptographic message,

//  such as a CMSG_ENVELOPED, then, the CRYPT_MESSAGE_BARE_CONTENT_OUT_FLAG

//  should be set. If not set, then it would be encoded as an inner content

//  type of CMSG_DATA.

//

//  dwInnerContentType is normally set to 0. It needs to be set if the

//  ToBeSigned input is the encoded output of another cryptographic

//  message, such as, an CMSG_ENVELOPED. When set, it's one of the cryptographic

//  message types, for example, CMSG_ENVELOPED.

//

//  If the inner content of a nested cryptographic message is data (CMSG_DATA

//  the default), then, neither dwFlags or dwInnerContentType need to be set.

//--------------------------------------------------------------------------

 

type

  PCRYPT_SIGN_MESSAGE_PARA = ^CRYPT_SIGN_MESSAGE_PARA;

  CRYPT_SIGN_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgEncodingType :DWORD;

    pSigningCert :PCCERT_CONTEXT;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvHashAuxInfo :PVOID;

    cMsgCert :DWORD;

    rgpMsgCert :PPCCERT_CONTEXT;// pointer to array of PCCERT_CONTEXT

    cMsgCrl :DWORD;

    rgpMsgCrl :PPCCRL_CONTEXT; // pointer to array of PCCERT_CO

    cAuthAttr :DWORD;

    rgAuthAttr :PCRYPT_ATTRIBUTE;

    cUnauthAttr :DWORD;

    rgUnauthAttr :PCRYPT_ATTRIBUTE;

    dwFlags :DWORD;

    dwInnerContentType :DWORD;

  end;

const CRYPT_MESSAGE_BARE_CONTENT_OUT_FLAG = $1;

 

//+-------------------------------------------------------------------------

//  The CRYPT_VERIFY_MESSAGE_PARA are used to verify signed messages.

//

//  hCryptProv is used to do hashing and signature verification.

//

//  The dwCertEncodingType specifies the encoding type of the certificates

//  and/or CRLs in the message.

//

//  pfnGetSignerCertificate is called to get and verify the message signer's

//  certificate.

//

//  cbSize must be set to the sizeof(CRYPT_VERIFY_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//--------------------------------------------------------------------------

type

  PCRYPT_VERIFY_MESSAGE_PARA = ^CRYPT_VERIFY_MESSAGE_PARA;

  CRYPT_VERIFY_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgAndCertEncodingType :DWORD;

    hCryptProv :HCRYPTPROV;

    pfnGetSignerCertificate :PFN_CRYPT_GET_SIGNER_CERTIFICATE;

    pvGetArg :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  The CRYPT_ENCRYPT_MESSAGE_PARA are used for encrypting messages.

//

//  hCryptProv is used to do content encryption, recipient key

//  encryption, and recipient key export. Its private key

//  isn't used.

//

//  pvEncryptionAuxInfo currently isn't used and must be set to NULL.

//

//  cbSize must be set to the sizeof(CRYPT_ENCRYPT_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//

//  dwFlags normally is set to 0. However, if the encoded output

//  is to be a CMSG_ENVELOPED inner content of an outer cryptographic message,

//  such as a CMSG_SIGNED, then, the CRYPT_MESSAGE_BARE_CONTENT_OUT_FLAG

//  should be set. If not set, then it would be encoded as an inner content

//  type of CMSG_DATA.

//

//  dwInnerContentType is normally set to 0. It needs to be set if the

//  ToBeEncrypted input is the encoded output of another cryptographic

//  message, such as, an CMSG_SIGNED. When set, it's one of the cryptographic

//  message types, for example, CMSG_SIGNED.

//

//  If the inner content of a nested cryptographic message is data (CMSG_DATA

//  the default), then, neither dwFlags or dwInnerContentType need to be set.

//--------------------------------------------------------------------------

type

  PCRYPT_ENCRYPT_MESSAGE_PARA = ^CRYPT_ENCRYPT_MESSAGE_PARA;

  CRYPT_ENCRYPT_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgEncodingType :DWORD;

    hCryptProv :HCRYPTPROV;

    ContentEncryptionAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvEncryptionAuxInfo :PVOID;

    dwFlags :DWORD;

    dwInnerContentType :DWORD;

  end;

 

//+-------------------------------------------------------------------------

//  The CRYPT_DECRYPT_MESSAGE_PARA are used for decrypting messages.

//

//  The CertContext to use for decrypting a message is obtained from one

//  of the specified cert stores. An encrypted message can have one or

//  more recipients. The recipients are identified by their CertId (Issuer

//  and SerialNumber). The cert stores are searched to find the CertContext

//  corresponding to the CertId.

//

//  Only CertContexts in the store with either

//  the CERT_KEY_PROV_HANDLE_PROP_ID or CERT_KEY_PROV_INFO_PROP_ID set

//  can be used. Either property specifies the private exchange key to use.

//

//  cbSize must be set to the sizeof(CRYPT_DECRYPT_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//--------------------------------------------------------------------------

type

  PCRYPT_DECRYPT_MESSAGE_PARA = ^CRYPT_DECRYPT_MESSAGE_PARA;

  CRYPT_DECRYPT_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgAndCertEncodingType :DWORD;

    cCertStore :DWORD;

    rghCertStore :PHCERTSTORE;

  end;

//+-------------------------------------------------------------------------

//  The CRYPT_HASH_MESSAGE_PARA are used for hashing or unhashing

//  messages.

//

//  hCryptProv is used to compute the hash.

//

//  pvHashAuxInfo currently isn't used and must be set to NULL.

//

//  cbSize must be set to the sizeof(CRYPT_HASH_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//--------------------------------------------------------------------------

type

  PCRYPT_HASH_MESSAGE_PARA = ^CRYPT_HASH_MESSAGE_PARA;

  CRYPT_HASH_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgEncodingType :DWORD;

    hCryptProv :HCRYPTPROV;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvHashAuxInfo :PVOID;

  end;

 

//+-------------------------------------------------------------------------

//  The CRYPT_KEY_SIGN_MESSAGE_PARA are used for signing messages until a

//  certificate has been created for the signature key.

//

//  pvHashAuxInfo currently isn't used and must be set to NULL.

//

//  If PubKeyAlgorithm isn't set, defaults to szOID_RSA_RSA.

//

//  cbSize must be set to the sizeof(CRYPT_KEY_SIGN_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//--------------------------------------------------------------------------

type

  PCRYPT_KEY_SIGN_MESSAGE_PARA = ^CRYPT_KEY_SIGN_MESSAGE_PARA;

  CRYPT_KEY_SIGN_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgAndCertEncodingType :DWORD;

    hCryptProv :HCRYPTPROV;

    dwKeySpec :DWORD;

    HashAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

    pvHashAuxInfo :PVOID;

    PubKeyAlgorithm :CRYPT_ALGORITHM_IDENTIFIER;

  end;

 

//+-------------------------------------------------------------------------

//  The CRYPT_KEY_VERIFY_MESSAGE_PARA are used to verify signed messages without

//  a certificate for the signer.

//

//  Normally used until a certificate has been created for the key.

//

//  hCryptProv is used to do hashing and signature verification.

//

//  cbSize must be set to the sizeof(CRYPT_KEY_VERIFY_MESSAGE_PARA) or else

//  LastError will be updated with E_INVALIDARG.

//--------------------------------------------------------------------------

type

  PCRYPT_KEY_VERIFY_MESSAGE_PARA = ^CRYPT_KEY_VERIFY_MESSAGE_PARA;

  CRYPT_KEY_VERIFY_MESSAGE_PARA = record

    cbSize :DWORD;

    dwMsgEncodingType :DWORD;

    hCryptProv :HCRYPTPROV;

  end;

 

//+-------------------------------------------------------------------------

//  Sign the message.

//

//  If fDetachedSignature is TRUE, the "to be signed" content isn't included

//  in the encoded signed blob.

//--------------------------------------------------------------------------

function CryptSignMessage(pSignPara :PCRYPT_SIGN_MESSAGE_PARA;

                          fDetachedSignature :BOOL;

                          cToBeSigned :DWORD;

                    const rgpbToBeSigned :array of PBYTE;

                          rgcbToBeSigned :array of DWORD;

                          pbSignedBlob :PBYTE;

                          pcbSignedBlob :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Verify a signed message.

//

//  If pbDecoded == NULL, then, *pcbDecoded is implicitly set to 0 on input.

//  For *pcbDecoded == 0 && ppSignerCert == NULL on input, the signer isn't

//  verified.

//

//  A message might have more than one signer. Set dwSignerIndex to iterate

//  through all the signers. dwSignerIndex == 0 selects the first signer.

//

//  pVerifyPara's pfnGetSignerCertificate is called to get the signer's

//  certificate.

//

//  For a verified signer and message, *ppSignerCert is updated

//  with the CertContext of the signer. It must be freed by calling

//  CertFreeCertificateContext. Otherwise, *ppSignerCert is set to NULL.

//

//  ppSignerCert can be NULL, indicating the caller isn't interested

//  in getting the CertContext of the signer.

//

//  pcbDecoded can be NULL, indicating the caller isn't interested in getting

//  the decoded content. Furthermore, if the message doesn't contain any

//  content or signers, then, pcbDecoded must be set to NULL, to allow the

//  pVerifyPara->pfnGetCertificate to be called. Normally, this would be

//  the case when the signed message contains only certficates and CRLs.

//  If pcbDecoded is NULL and the message doesn't have the indicated signer,

//  pfnGetCertificate is called with pSignerId set to NULL.

//

//  If the message doesn't contain any signers || dwSignerIndex > message's

//  SignerCount, then, an error is returned with LastError set to

//  CRYPT_E_NO_SIGNER. Also, for CRYPT_E_NO_SIGNER, pfnGetSignerCertificate

//  is still called with pSignerId set to NULL.

//

//  Note, an alternative way to get the certificates and CRLs from a

//  signed message is to call CryptGetMessageCertificates.

//--------------------------------------------------------------------------

function CryptVerifyMessageSignature(pVerifyPara :PCRYPT_VERIFY_MESSAGE_PARA;

                                     dwSignerIndex :DWORD;

                               const pbSignedBlob :PBYTE;

                                     cbSignedBlob :DWORD;

                                     pbDecoded :PBYTE;

                                     pcbDecoded :DWORD;

                                     ppSignerCert :PCCERT_CONTEXT

                                     ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Returns the count of signers in the signed message. For no signers, returns

//  0. For an error returns -1 with LastError updated accordingly.

//--------------------------------------------------------------------------

function CryptGetMessageSignerCount(dwMsgEncodingType :DWORD;

                              const pbSignedBlob :PBYTE;

                                    cbSignedBlob :DWORD):LONG ; stdcall;

//+-------------------------------------------------------------------------

//  Returns the cert store containing the message's certs and CRLs.

//  For an error, returns NULL with LastError updated.

//--------------------------------------------------------------------------

function CryptGetMessageCertificates(dwMsgAndCertEncodingType :DWORD;

                                     hCryptProv :HCRYPTPROV; // passed to CertOpenStore

                                     dwFlags :DWORD;  // passed to CertOpenStore

                               const pbSignedBlob :PBYTE;

                                     cbSignedBlob :DWORD):HCERTSTORE ; stdcall;

//+-------------------------------------------------------------------------

//  Verify a signed message containing detached signature(s).

//  The "to be signed" content is passed in separately. No

//  decoded output. Otherwise, identical to CryptVerifyMessageSignature.

//--------------------------------------------------------------------------

function CryptVerifyDetachedMessageSignature(pVerifyPara :PCRYPT_VERIFY_MESSAGE_PARA;

                                             dwSignerIndex :DWORD;

                                       const pbDetachedSignBlob :PBYTE;

                                             cbDetachedSignBlob :DWORD;

                                             cToBeSigned :DWORD;

                                       const rgpbToBeSigned :array of PBYTE;

                                             rgcbToBeSigned :array of DWORD;

                                             ppSignerCert :PPCCERT_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Encrypts the message for the recipient(s).

//--------------------------------------------------------------------------

function CryptEncryptMessage(pEncryptPara :PCRYPT_ENCRYPT_MESSAGE_PARA;

                             cRecipientCert :DWORD;

                             rgpRecipientCert :array of PCCERT_CONTEXT;

                             const pbToBeEncrypted :PBYTE;

                             cbToBeEncrypted :DWORD;

                             pbEncryptedBlob :PBYTE;

                             pcbEncryptedBlob :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Decrypts the message.

//

//  If pbDecrypted == NULL, then, *pcbDecrypted is implicitly set to 0 on input.

//  For *pcbDecrypted == 0 && ppXchgCert == NULL on input, the message isn't

//  decrypted.

//

//  For a successfully decrypted message, *ppXchgCert is updated

//  with the CertContext used to decrypt. It must be freed by calling

//  CertStoreFreeCert. Otherwise, *ppXchgCert is set to NULL.

//

//  ppXchgCert can be NULL, indicating the caller isn't interested

//  in getting the CertContext used to decrypt.

//--------------------------------------------------------------------------

function CryptDecryptMessage(pDecryptPara :PCRYPT_DECRYPT_MESSAGE_PARA;

                       const pbEncryptedBlob :PBYTE;

                             cbEncryptedBlob :DWORD;

                             pbDecrypted :PBYTE;

                             pcbDecrypted :PDWORD;

                             ppXchgCert :PPCCERT_CONTEXT):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Sign the message and encrypt for the recipient(s). Does a CryptSignMessage

//  followed with a CryptEncryptMessage.

//

//  Note: this isn't the CMSG_SIGNED_AND_ENVELOPED. Its a CMSG_SIGNED

//  inside of an CMSG_ENVELOPED.

//--------------------------------------------------------------------------

function CryptSignAndEncryptMessage(pSignPara :PCRYPT_SIGN_MESSAGE_PARA;

                                    pEncryptPara :PCRYPT_ENCRYPT_MESSAGE_PARA;

                                    cRecipientCert :DWORD;

                                    rgpRecipientCert :array of PCCERT_CONTEXT;

                              const pbToBeSignedAndEncrypted :PBYTE;

                                    cbToBeSignedAndEncrypted :DWORD;

                                    pbSignedAndEncryptedBlob :PBYTE;

                                    pcbSignedAndEncryptedBlob :PDWORD

                                    ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Decrypts the message and verifies the signer. Does a CryptDecryptMessage

//  followed with a CryptVerifyMessageSignature.

//

//  If pbDecrypted == NULL, then, *pcbDecrypted is implicitly set to 0 on input.

//  For *pcbDecrypted == 0 && ppSignerCert == NULL on input, the signer isn't

//  verified.

//

//  A message might have more than one signer. Set dwSignerIndex to iterate

//  through all the signers. dwSignerIndex == 0 selects the first signer.

//

//  The pVerifyPara's VerifySignerPolicy is called to verify the signer's

//  certificate.

//

//  For a successfully decrypted and verified message, *ppXchgCert and

//  *ppSignerCert are updated. They must be freed by calling

//  CertStoreFreeCert. Otherwise, they are set to NULL.

//

//  ppXchgCert and/or ppSignerCert can be NULL, indicating the

//  caller isn't interested in getting the CertContext.

//

//  Note: this isn't the CMSG_SIGNED_AND_ENVELOPED. Its a CMSG_SIGNED

//  inside of an CMSG_ENVELOPED.

//

//  The message always needs to be decrypted to allow access to the

//  signed message. Therefore, if ppXchgCert != NULL, its always updated.

//--------------------------------------------------------------------------

function CryptDecryptAndVerifyMessageSignature(pDecryptPara :PCRYPT_DECRYPT_MESSAGE_PARA;

                                               pVerifyPara :PCRYPT_VERIFY_MESSAGE_PARA;

                                               dwSignerIndex :DWORD;

                                         const pbEncryptedBlob :PBYTE;

                                               cbEncryptedBlob :DWORD;

                                               pbDecrypted :PBYTE;

                                               pcbDecrypted :PDWORD;

                                           var ppXchgCert :array of PCCERT_CONTEXT;

                                           var ppSignerCert :array of PCCERT_CONTEXT

                                               ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Decodes a cryptographic message which may be one of the following types:

//    CMSG_DATA

//    CMSG_SIGNED

//    CMSG_ENVELOPED

//    CMSG_SIGNED_AND_ENVELOPED

//    CMSG_HASHED

//

//  dwMsgTypeFlags specifies the set of allowable messages. For example, to

//  decode either SIGNED or ENVELOPED messages, set dwMsgTypeFlags to:

//      CMSG_SIGNED_FLAG | CMSG_ENVELOPED_FLAG.

//

//  dwProvInnerContentType is only applicable when processing nested

//  crytographic messages. When processing an outer crytographic message

//  it must be set to 0. When decoding a nested cryptographic message

//  its the dwInnerContentType returned by a previous CryptDecodeMessage

//  of the outer message. The InnerContentType can be any of the CMSG types,

//  for example, CMSG_DATA, CMSG_SIGNED, ...

//

//  The optional *pdwMsgType is updated with the type of message.

//

//  The optional *pdwInnerContentType is updated with the type of the inner

//  message. Unless there is cryptographic message nesting, CMSG_DATA

//  is returned.

//

//  For CMSG_DATA: returns decoded content.

//  For CMSG_SIGNED: same as CryptVerifyMessageSignature.

//  For CMSG_ENVELOPED: same as CryptDecryptMessage.

//  For CMSG_SIGNED_AND_ENVELOPED: same as CryptDecryptMessage plus

//      CryptVerifyMessageSignature.

//  For CMSG_HASHED: verifies the hash and returns decoded content.

//--------------------------------------------------------------------------

function CryptDecodeMessage(dwMsgTypeFlags :DWORD;

                            pDecryptPara   :PCRYPT_DECRYPT_MESSAGE_PARA;

                            pVerifyPara    :PCRYPT_VERIFY_MESSAGE_PARA ;

                            dwSignerIndex  :DWORD;

                      const pbEncodedBlob  :PBYTE;

                            cbEncodedBlob  :DWORD;

                            dwPrevInnerContentType :DWORD;

                            pdwMsgType     :PDWORD;

                            pdwInnerContentType :PDWORD;

                            pbDecoded      :PBYTE;

                            pcbDecoded     :PDWORD;

                        var ppXchgCert     :array of PCCERT_CONTEXT;

                        var ppSignerCert   :array of PCCERT_CONTEXT

                            ):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Hash the message.

//

//  If fDetachedHash is TRUE, only the ComputedHash is encoded in the

//  pbHashedBlob. Otherwise, both the ToBeHashed and ComputedHash

//  are encoded.

//

//  pcbHashedBlob or pcbComputedHash can be NULL, indicating the caller

//  isn't interested in getting the output.

//--------------------------------------------------------------------------

function CryptHashMessage(pHashPara :PCRYPT_HASH_MESSAGE_PARA;

                          fDetachedHash :BOOL;

                          cToBeHashed :DWORD;

                    const rgpbToBeHashed :array of PBYTE;

                          rgcbToBeHashed :array of DWORD;

                          pbHashedBlob :PBYTE;

                          pcbHashedBlob :PDWORD;

                          pbComputedHash :PBYTE;

                          pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Verify a hashed message.

//

//  pcbToBeHashed or pcbComputedHash can be NULL,

//  indicating the caller isn't interested in getting the output.

//--------------------------------------------------------------------------

function CryptVerifyMessageHash(pHashPara :PCRYPT_HASH_MESSAGE_PARA;

                                pbHashedBlob :PBYTE;

                                cbHashedBlob :DWORD;

                                pbToBeHashed :PBYTE;

                                pcbToBeHashed :PDWORD;

                                pbComputedHash :PBYTE;

                                pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Verify a hashed message containing a detached hash.

//  The "to be hashed" content is passed in separately. No

//  decoded output. Otherwise, identical to CryptVerifyMessageHash.

//

//  pcbComputedHash can be NULL, indicating the caller isn't interested

//  in getting the output.

//--------------------------------------------------------------------------

function CryptVerifyDetachedMessageHash(pHashPara :PCRYPT_HASH_MESSAGE_PARA;

                                        pbDetachedHashBlob :PBYTE;

                                        cbDetachedHashBlob :DWORD;

                                        cToBeHashed :DWORD;

                                        rgpbToBeHashed :array of PBYTE;

                                        rgcbToBeHashed :array of DWORD;

                                        pbComputedHash :PBYTE;

                                        pcbComputedHash :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Sign the message using the provider's private key specified in the

//  parameters. A dummy SignerId is created and stored in the message.

//

//  Normally used until a certificate has been created for the key.

//--------------------------------------------------------------------------

function CryptSignMessageWithKey(pSignPara :PCRYPT_KEY_SIGN_MESSAGE_PARA;

                           const pbToBeSigned :PBYTE;

                                 cbToBeSigned :DWORD;

                                 pbSignedBlob :PBYTE;

                                 pcbSignedBlob :PDWORD):BOOL ; stdcall;

//+-------------------------------------------------------------------------

//  Verify a signed message using the specified public key info.

//

//  Normally called by a CA until it has created a certificate for the

//  key.

//

//  pPublicKeyInfo contains the public key to use to verify the signed

//  message. If NULL, the signature isn't verified (for instance, the decoded

//  content may contain the PublicKeyInfo).

//

//  pcbDecoded can be NULL, indicating the caller isn't interested

//  in getting the decoded content.

//--------------------------------------------------------------------------

function CryptVerifyMessageSignatureWithKey(pVerifyPara :PCRYPT_KEY_VERIFY_MESSAGE_PARA;

                                            pPublicKeyInfo :PCERT_PUBLIC_KEY_INFO;

                                      const pbSignedBlob :PBYTE;

                                            cbSignedBlob :DWORD;

                                            pbDecoded :PBYTE;

                                            pcbDecoded :PDWORD):BOOL ; stdcall;

 

//+=========================================================================

//  System Certificate Store Data Structures and APIs

//==========================================================================

 

 

//+-------------------------------------------------------------------------

//  Get a system certificate store based on a subsystem protocol.

//

//  Current examples of subsystems protocols are:

//      "MY"    Cert Store hold certs with associated Private Keys

//      "CA"    Certifying Authority certs

//      "ROOT"  Root Certs

//      "SPC"   Software publisher certs

//

//

//  If hProv is NULL the default provider "1" is opened for you.

//  When the store is closed the provider is release. Otherwise

//  if hProv is not NULL, no provider is created or released.

//

//  The returned Cert Store can be searched for an appropriate Cert

//  using the Cert Store API's (see certstor.h)

//

//  When done, the cert store should be closed using CertStoreClose

//--------------------------------------------------------------------------

 

function CertOpenSystemStoreA(hProv :HCRYPTPROV;

                              szSubsystemProtocol :LPCSTR):HCERTSTORE ; stdcall;

 

function CertOpenSystemStoreW(hProv :HCRYPTPROV;

                              szSubsystemProtocol :LPCWSTR):HCERTSTORE ; stdcall;

 

function CertOpenSystemStore(hProv :HCRYPTPROV;

                             szSubsystemProtocol :LPAWSTR):HCERTSTORE ; stdcall;

 

function CertAddEncodedCertificateToSystemStoreA(szCertStoreName :LPCSTR;

                                           const pbCertEncoded :PBYTE;

                                                cbCertEncoded :DWORD):BOOL ; stdcall;

 

function CertAddEncodedCertificateToSystemStoreW(szCertStoreName :LPCWSTR;

                                           const pbCertEncoded :PBYTE;

                                                 cbCertEncoded :DWORD):BOOL ; stdcall;

 

function CertAddEncodedCertificateToSystemStore(szCertStoreName :LPAWSTR;

                                          const pbCertEncoded :PBYTE;

                                                cbCertEncoded :DWORD):BOOL ; stdcall;

 

 

//+-------------------------------------------------------------------------

//  Find all certificate chains tying the given issuer name to any certificate

//  that the current user has a private key for.

//

//  If no certificate chain is found, FALSE is returned with LastError set

//  to CRYPT_E_NOT_FOUND and the counts zeroed.

//

//  IE 3.0 ASSUMPTION:

//   The client certificates are in the "My" system store. The issuer

//   cerificates may be in the "Root", "CA" or "My" system stores.

//--------------------------------------------------------------------------

type

  PCERT_CHAIN = ^CERT_CHAIN;

  CERT_CHAIN = record

    cCerts :DWORD;     // number of certs in chain

    certs :PCERT_BLOB;      // pointer to array of cert chain blobs representing the certs

    keyLocatorInfo :CRYPT_KEY_PROV_INFO; // key locator for cert

  end;

 

 

// WINCRYPT32API    This is not exported by crypt32, it is exported by softpub

function FindCertsByIssuer(pCertChains :PCERT_CHAIN;

                           pcbCertChains :PDWORD;

                           pcCertChains :PDWORD;       // count of certificates chains returned

                           pbEncodedIssuerName :PBYTE;   // DER encoded issuer name

                           cbEncodedIssuerName :DWORD; // count in bytes of encoded issuer name

                           pwszPurpose :LPCWSTR; // "ClientAuth" or "CodeSigning"

                           dwKeySpec :DWORD  // only return signers supporting this keyspec

                           ):HRESULT ; stdcall;

 

//////////////////////////// VERSION 2 ////////////////////////////////////////////////////////////////////

 

implementation

 

{Macro inplementation}

function GET_ALG_CLASS(x:integer) :integer;

begin

  Result:=(x and (7 shl 13));

end;

 

function GET_ALG_TYPE(x:integer) :integer;

begin

  Result:=(x and (15 shl 9));

end;

 

function GET_ALG_SID(x:integer) :integer;

begin

  Result:=(x and (511));

end;

 

function RCRYPT_SUCCEEDED(rt:BOOL):BOOL;

begin

  Result:= rt = CRYPT_SUCCEED;

end;

 

function RCRYPT_FAILED(rt:BOOL):BOOL;

begin

  Result:= rt = CRYPT_FAILED;

end ;

 

function  GET_CERT_UNICODE_RDN_ERR_INDEX(X :integer):integer;

begin

    Result :=  ((X shr CERT_UNICODE_RDN_ERR_INDEX_SHIFT) and CERT_UNICODE_RDN_ERR_INDEX_MASK);

end;

 

function  GET_CERT_UNICODE_ATTR_ERR_INDEX(X :integer):integer;

begin

    Result := ((X shr CERT_UNICODE_ATTR_ERR_INDEX_SHIFT) and CERT_UNICODE_ATTR_ERR_INDEX_MASK);

end;

 

function  GET_CERT_UNICODE_VALUE_ERR_INDEX(X :integer):integer;

begin

    Result := (X and CERT_UNICODE_VALUE_ERR_INDEX_MASK);

end;

 

function GET_CERT_ALT_NAME_ENTRY_ERR_INDEX(X :DWORD):DWORD;

begin

    Result := ((X shr CERT_ALT_NAME_ENTRY_ERR_INDEX_SHIFT) and CERT_ALT_NAME_ENTRY_ERR_INDEX_MASK);

end;

 

function GET_CERT_ALT_NAME_VALUE_ERR_INDEX(X :DWORD):DWORD;

begin

    Result := (X and CERT_ALT_NAME_VALUE_ERR_INDEX_MASK);

end;

 

function GET_CRL_DIST_POINT_ERR_INDEX(X :DWORD):DWORD;

begin

Result := ((X shr CRL_DIST_POINT_ERR_INDEX_SHIFT) and CRL_DIST_POINT_ERR_INDEX_MASK);

end;

 

function IS_CRL_DIST_POINT_ERR_CRL_ISSUER(X :DWORD):BOOL;

begin

    Result := (0 <> (X and CRL_DIST_POINT_ERR_CRL_ISSUER_BIT));

end;

///////////////////////////////////////version 2 /////////////////////////

 

function IS_CERT_RDN_CHAR_STRING(X :DWORD) :BOOL;

begin

    Result :=BOOL(X >= CERT_RDN_NUMERIC_STRING);

 end;

 

function GET_CERT_ENCODING_TYPE(X :DWORD):DWORD;

begin

    Result := (X and CERT_ENCODING_TYPE_MASK);

end;

 

function GET_CMSG_ENCODING_TYPE(X :DWORD):DWORD;

begin

    Result := (X and CMSG_ENCODING_TYPE_MASK);

end;

 

function IS_CERT_HASH_PROP_ID( X :DWORD):BOOL ;

begin

    if (X = CERT_SHA1_HASH_PROP_ID) or (X = CERT_MD5_HASH_PROP_ID) then

        Result := True

    else

        Result := False;

end;

{end Macro}

 

function CryptAcquireContextA    ;external ADVAPI32 name 'CryptAcquireContextA';

{$IFDEF UNICODE}

function CryptAcquireContext     ;external ADVAPI32 name 'CryptAcquireContextW';

{$ELSE}

function CryptAcquireContext     ;external ADVAPI32 name 'CryptAcquireContextA';

{$ENDIF}

function CryptAcquireContextW    ;external ADVAPI32 name 'CryptAcquireContextW';

function CryptReleaseContext     ;external ADVAPI32 name 'CryptReleaseContext';

function CryptGenKey             ;external ADVAPI32 name 'CryptGenKey';

function CryptDeriveKey          ;external ADVAPI32 name 'CryptDeriveKey';

function CryptDestroyKey         ;external ADVAPI32 name 'CryptDestroyKey';

function CryptSetKeyParam        ;external ADVAPI32 name 'CryptSetKeyParam';

function CryptGetKeyParam        ;external ADVAPI32 name 'CryptGetKeyParam';

function CryptSetHashParam       ;external ADVAPI32 name 'CryptSetHashParam';

function CryptGetHashParam       ;external ADVAPI32 name 'CryptGetHashParam';

function CryptSetProvParam       ;external ADVAPI32 name 'CryptSetProvParam';

function CryptGetProvParam       ;external ADVAPI32 name 'CryptGetProvParam';

function CryptGenRandom          ;external ADVAPI32 name 'CryptGenRandom';

function CryptGetUserKey         ;external ADVAPI32 name 'CryptGetUserKey';

function CryptExportKey          ;external ADVAPI32 name 'CryptExportKey';

function CryptImportKey          ;external ADVAPI32 name 'CryptImportKey';

function CryptEncrypt            ;external ADVAPI32 name 'CryptEncrypt';

function CryptDecrypt            ;external ADVAPI32 name 'CryptDecrypt';

function CryptCreateHash         ;external ADVAPI32 name 'CryptCreateHash';

function CryptHashData           ;external ADVAPI32 name 'CryptHashData';

function CryptHashSessionKey     ;external ADVAPI32 name 'CryptHashSessionKey';

function CryptDestroyHash        ;external ADVAPI32 name 'CryptDestroyHash';

function CryptSignHashA          ;external ADVAPI32 name 'CryptSignHashA';

function CryptSignHashW          ;external ADVAPI32 name 'CryptSignHashW';

function CryptSignHashU          ;external CRYPT32 name 'CryptSignHashU';

{$IFDEF UNICODE}

function CryptSignHash           ;external ADVAPI32 name 'CryptSignHashW';

{$ELSE}

function CryptSignHash           ;external ADVAPI32 name 'CryptSignHashA';

{$ENDIF}

function CryptVerifySignatureA   ;external ADVAPI32 name 'CryptVerifySignatureA';

function CryptVerifySignatureW   ;external ADVAPI32 name 'CryptVerifySignatureW';

{$IFDEF UNICODE}

function CryptVerifySignature    ;external ADVAPI32 name 'CryptVerifySignatureW';

{$ELSE}

function CryptVerifySignature    ;external ADVAPI32 name 'CryptVerifySignatureA';

{$ENDIF}

function CryptSetProviderW       ;external ADVAPI32 name 'CryptSetProviderW';

function CryptSetProviderA       ;external ADVAPI32 name 'CryptSetProviderA';

function CryptSetProviderU       ;external CRYPT32 name 'CryptSetProviderU';

{$IFDEF UNICODE}

function CryptSetProvider        ;external ADVAPI32 name 'CryptSetProviderW';

{$ELSE}

function CryptSetProvider        ;external ADVAPI32 name 'CryptSetProviderA';

{$ENDIF}

 

{$IFDEF NT5}

function CryptSetProviderExA ;external ADVAPI32NT5 name 'CryptSetProviderExA';//nt5 advapi32

function CryptSetProviderExW ;external ADVAPI32NT5 name 'CryptSetProviderExW';

{$IFDEF UNICODE}

function CryptSetProviderEx ;external ADVAPI32NT5 name 'CryptSetProviderExW';

{$ELSE}

function  CryptSetProviderEx  ;external ADVAPI32NT5 name 'CryptSetProviderExA';

{$ENDIF} // !UNICODE

 

function CryptGetDefaultProviderA ; external ADVAPI32NT5 name 'CryptGetDefaultProviderA';//nt5 advapi32

function CryptGetDefaultProviderW ; external ADVAPI32NT5 name 'CryptGetDefaultProviderW';

{$IFDEF UNICODE}

function CryptGetDefaultProvider ; external ADVAPI32NT5 name 'CryptGetDefaultProviderW';

{$ELSE}

function CryptGetDefaultProvider; external ADVAPI32NT5 name 'CryptGetDefaultProviderA';

{$ENDIF} // !UNICODE

 

function CryptEnumProviderTypesA ; external ADVAPI32NT5 name 'CryptEnumProviderTypesA';//nt5 advapi32

function CryptEnumProviderTypesW ; external ADVAPI32NT5 name 'CryptEnumProviderTypesW';

{$IFDEF UNICODE}

function CryptEnumProviderTypes ; external ADVAPI32NT5 name 'CryptEnumProviderTypesW';

{$ELSE}

function CryptEnumProviderTypes ; external ADVAPI32NT5 name 'CryptEnumProviderTypesA';

{$ENDIF} // !UNICODE

 

function CryptEnumProvidersA; external ADVAPI32NT5 name 'CryptEnumProvidersA';//nt5 advapi32

function CryptEnumProvidersW; external ADVAPI32NT5 name 'CryptEnumProvidersW';

 

{$IFDEF UNICODE}

function CryptEnumProviders; external ADVAPI32NT5 name 'CryptEnumProvidersW';

{$ELSE}

function CryptEnumProviders; external ADVAPI32NT5 name 'CryptEnumProvidersA';

{$ENDIF} // !UNICODE

function CryptContextAddRef; external ADVAPI32NT5 name 'CryptContextAddRef';//nt5 advapi32

function CryptDuplicateKey; external ADVAPI32NT5 name 'CryptDuplicateKey';//nt5 advapi32

function CryptDuplicateHash; external ADVAPI32NT5 name 'CryptDuplicateHash';//nt5 advapi32

{$ENDIF NT5}

 

function CryptEnumProvidersU; external CRYPT32 name 'CryptEnumProvidersU';

function CryptFormatObject; external CRYPT32 name 'CryptFormatObject';

function CryptEncodeObject; external CRYPT32 name 'CryptEncodeObject';

function CryptDecodeObject; external CRYPT32 name 'CryptDecodeObject';

function CryptInstallOIDFunctionAddress; external CRYPT32 name 'CryptInstallOIDFunctionAddress';

function CryptInitOIDFunctionSet; external CRYPT32 name 'CryptInitOIDFunctionSet';

function CryptGetOIDFunctionAddress; external CRYPT32 name 'CryptGetOIDFunctionAddress';

function CryptGetDefaultOIDDllList; external CRYPT32 name 'CryptGetDefaultOIDDllList';

function CryptGetDefaultOIDFunctionAddress; external CRYPT32 name 'CryptGetDefaultOIDFunctionAddress';

function CryptFreeOIDFunctionAddress; external CRYPT32 name 'CryptFreeOIDFunctionAddress';

function CryptRegisterOIDFunction; external CRYPT32 name 'CryptRegisterOIDFunction';

function CryptUnregisterOIDFunction; external CRYPT32 name 'CryptUnregisterOIDFunction';

function CryptRegisterDefaultOIDFunction; external CRYPT32 name 'CryptRegisterDefaultOIDFunction';

function CryptUnregisterDefaultOIDFunction; external CRYPT32 name 'CryptUnregisterDefaultOIDFunction';

function CryptSetOIDFunctionValue; external CRYPT32 name 'CryptSetOIDFunctionValue';

function CryptGetOIDFunctionValue; external CRYPT32 name 'CryptGetOIDFunctionValue';

function CryptEnumOIDFunction; external CRYPT32 name 'CryptEnumOIDFunction';

function CryptFindOIDInfo; external CRYPT32 name 'CryptFindOIDInfo';

 

function CryptRegisterOIDInfo; external CRYPT32 name 'CryptRegisterOIDInfo';

function CryptUnregisterOIDInfo; external CRYPT32 name 'CryptUnregisterOIDInfo';

function CryptMsgOpenToEncode; external CRYPT32 name 'CryptMsgOpenToEncode';

function CryptMsgCalculateEncodedLength; external CRYPT32 name 'CryptMsgCalculateEncodedLength';

function CryptMsgOpenToDecode; external CRYPT32 name 'CryptMsgOpenToDecode';

function CryptMsgClose; external CRYPT32 name 'CryptMsgClose';

function CryptMsgUpdate; external CRYPT32 name 'CryptMsgUpdate';

function CryptMsgControl; external CRYPT32 name 'CryptMsgControl';

function CryptMsgVerifyCountersignatureEncoded; external CRYPT32 name 'CryptMsgVerifyCountersignatureEncoded';

function CryptMsgCountersign; external CRYPT32 name 'CryptMsgCountersign';

function CryptMsgCountersignEncoded; external CRYPT32 name 'CryptMsgCountersignEncoded';

function CryptMsgGetParam; external CRYPT32 name 'CryptMsgGetParam';

function CertOpenStore; external CRYPT32 name 'CertOpenStore';

function CertDuplicateStore; external CRYPT32 name 'CertDuplicateStore';

function CertSaveStore; external CRYPT32 name 'CertSaveStore';

function CertCloseStore; external CRYPT32 name 'CertCloseStore';

function CertGetSubjectCertificateFromStore; external CRYPT32 name 'CertGetSubjectCertificateFromStore';

function CertEnumCertificatesInStore; external CRYPT32 name 'CertEnumCertificatesInStore';

function CertFindCertificateInStore; external CRYPT32 name 'CertFindCertificateInStore';

function CertGetIssuerCertificateFromStore; external CRYPT32 name 'CertGetIssuerCertificateFromStore';

function CertVerifySubjectCertificateContext; external CRYPT32 name 'CertVerifySubjectCertificateContext';

function CertDuplicateCertificateContext; external CRYPT32 name 'CertDuplicateCertificateContext';

function CertCreateCertificateContext; external CRYPT32 name 'CertCreateCertificateContext';

function CertFreeCertificateContext; external CRYPT32 name 'CertFreeCertificateContext';

function CertSetCertificateContextProperty; external CRYPT32 name 'CertSetCertificateContextProperty';

function CertGetCertificateContextProperty; external CRYPT32 name 'CertGetCertificateContextProperty';

function CertEnumCertificateContextProperties; external CRYPT32 name 'CertEnumCertificateContextProperties';

function CertGetCRLFromStore; external CRYPT32 name 'CertGetCRLFromStore';

function CertDuplicateCRLContext; external CRYPT32 name 'CertDuplicateCRLContext';

function CertCreateCRLContext; external CRYPT32 name 'CertCreateCRLContext';

function CertFreeCRLContext; external CRYPT32 name 'CertFreeCRLContext';

function CertSetCRLContextProperty; external CRYPT32 name 'CertSetCRLContextProperty';

function CertGetCRLContextProperty; external CRYPT32 name 'CertGetCRLContextProperty';

function CertEnumCRLContextProperties; external CRYPT32 name 'CertEnumCRLContextProperties';

function CertAddEncodedCertificateToStore; external CRYPT32 name 'CertAddEncodedCertificateToStore';

function CertAddCertificateContextToStore; external CRYPT32 name 'CertAddCertificateContextToStore';

function CertAddSerializedElementToStore; external CRYPT32 name 'CertAddSerializedElementToStore';

function CertDeleteCertificateFromStore; external CRYPT32 name 'CertDeleteCertificateFromStore';

function CertAddEncodedCRLToStore; external CRYPT32 name 'CertAddEncodedCRLToStore';

function CertAddCRLContextToStore; external CRYPT32 name 'CertAddCRLContextToStore';

function CertDeleteCRLFromStore; external CRYPT32 name 'CertDeleteCRLFromStore';

function CertSerializeCertificateStoreElement; external CRYPT32 name 'CertSerializeCertificateStoreElement';

function CertSerializeCRLStoreElement; external CRYPT32 name 'CertSerializeCRLStoreElement';

function CertDuplicateCTLContext; external CRYPT32 name 'CertDuplicateCTLContext';

function CertCreateCTLContext; external CRYPT32 name 'CertCreateCTLContext';

function CertFreeCTLContext; external CRYPT32 name 'CertFreeCTLContext';

function CertSetCTLContextProperty; external CRYPT32 name 'CertSetCTLContextProperty';

function CertGetCTLContextProperty; external CRYPT32 name 'CertGetCTLContextProperty';

function CertEnumCTLContextProperties; external CRYPT32 name 'CertEnumCTLContextProperties';

function CertEnumCTLsInStore; external CRYPT32 name 'CertEnumCTLsInStore';

function CertFindSubjectInCTL; external CRYPT32 name 'CertFindSubjectInCTL';

function CertFindCTLInStore; external CRYPT32 name 'CertFindCTLInStore';

function CertAddEncodedCTLToStore; external CRYPT32 name 'CertAddEncodedCTLToStore';

function CertAddCTLContextToStore; external CRYPT32 name 'CertAddCTLContextToStore';

function CertSerializeCTLStoreElement; external CRYPT32 name 'CertSerializeCTLStoreElement';

function CertDeleteCTLFromStore; external CRYPT32 name 'CertDeleteCTLFromStore';

function CertGetEnhancedKeyUsage; external CRYPT32 name 'CertGetEnhancedKeyUsage';

function CertSetEnhancedKeyUsage; external CRYPT32 name 'CertSetEnhancedKeyUsage';

function CertAddEnhancedKeyUsageIdentifier; external CRYPT32 name 'CertAddEnhancedKeyUsageIdentifier';

function CertRemoveEnhancedKeyUsageIdentifier; external CRYPT32 name 'CertRemoveEnhancedKeyUsageIdentifier';

function CryptMsgGetAndVerifySigner; external CRYPT32 name 'CryptMsgGetAndVerifySigner';

function CryptMsgSignCTL; external CRYPT32 name 'CryptMsgSignCTL';

function CryptMsgEncodeAndSignCTL; external CRYPT32 name 'CryptMsgEncodeAndSignCTL';

function CertVerifyCTLUsage; external CRYPT32 name 'CertVerifyCTLUsage';

function CertVerifyRevocation; external CRYPT32 name 'CertVerifyRevocation';

function CertCompareIntegerBlob; external CRYPT32 name 'CertCompareIntegerBlob';

function CertCompareCertificate; external CRYPT32 name 'CertCompareCertificate';

function CertCompareCertificateName; external CRYPT32 name 'CertCompareCertificateName';

function CertIsRDNAttrsInCertificateName; external CRYPT32 name 'CertIsRDNAttrsInCertificateName';

function CertComparePublicKeyInfo; external CRYPT32 name 'CertComparePublicKeyInfo';

function CertGetPublicKeyLength; external CRYPT32 name 'CertGetPublicKeyLength';

function CryptVerifyCertificateSignature; external CRYPT32 name 'CryptVerifyCertificateSignature';

function CryptHashToBeSigned; external CRYPT32 name 'CryptHashToBeSigned';

function CryptHashCertificate; external CRYPT32 name 'CryptHashCertificate';

function CryptSignCertificate; external CRYPT32 name 'CryptSignCertificate';

function CryptSignAndEncodeCertificate; external CRYPT32 name 'CryptSignAndEncodeCertificate';

function CertVerifyTimeValidity; external CRYPT32 name 'CertVerifyTimeValidity';

function CertVerifyCRLTimeValidity; external CRYPT32 name 'CertVerifyCRLTimeValidity';

function CertVerifyValidityNesting; external CRYPT32 name 'CertVerifyValidityNesting';

function CertVerifyCRLRevocation; external CRYPT32 name 'CertVerifyCRLRevocation';

function CertAlgIdToOID; external CRYPT32 name 'CertAlgIdToOID';

function CertOIDToAlgId; external CRYPT32 name 'CertOIDToAlgId';

function CertFindExtension; external CRYPT32 name 'CertFindExtension';

function CertFindAttribute; external CRYPT32 name 'CertFindAttribute';

function CertFindRDNAttr; external CRYPT32 name 'CertFindRDNAttr';

function CertGetIntendedKeyUsage; external CRYPT32 name 'CertGetIntendedKeyUsage';

function CryptExportPublicKeyInfo; external CRYPT32 name 'CryptExportPublicKeyInfo';

function CryptExportPublicKeyInfoEx; external CRYPT32 name 'CryptExportPublicKeyInfoEx';

function CryptImportPublicKeyInfo; external CRYPT32 name 'CryptImportPublicKeyInfo';

function CryptImportPublicKeyInfoEx; external CRYPT32 name 'CryptImportPublicKeyInfoEx';

function CryptHashPublicKeyInfo; external CRYPT32 name 'CryptHashPublicKeyInfo';

function CertRDNValueToStrA; external CRYPT32 name 'CertRDNValueToStrA';

function CertRDNValueToStrW; external CRYPT32 name 'CertRDNValueToStrW';

{$IFDEF UNICODE}

function CertRDNValueToStr; external CRYPT32 name 'CertRDNValueToStrW';

{$ELSE}

function CertRDNValueToStr; external CRYPT32 name 'CertRDNValueToStrA';

{$ENDIF} // !UNICODE

function CertNameToStrA; external CRYPT32 name 'CertNameToStrA';

function CertNameToStrW; external CRYPT32 name 'CertNameToStrW';

{$IFDEF UNICODE}

function CertNameToStr; external CRYPT32 name 'CertNameToStrW';

{$ELSE}

function CertNameToStr; external CRYPT32 name 'CertNameToStrA';

{$ENDIF} // !UNICODE

function CertStrToNameW; external CRYPT32 name 'CertStrToNameW';

function CertStrToNameA; external CRYPT32 name 'CertStrToNameA';

{$IFDEF UNICODE}

function CertStrToName; external CRYPT32 name 'CertStrToNameW';

{$ELSE}

function CertStrToName; external CRYPT32 name 'CertStrToNameA';

{$ENDIF} // !UNICODE

function CryptSignMessage; external CRYPT32 name 'CryptSignMessage';

//function CryptSignMessageWithKey; external CRYPT32 name 'CryptSignMessageWithKey';

function CryptVerifyMessageSignature; external CRYPT32 name 'CryptVerifyMessageSignature';

//function CryptVerifyMessageSignatureWithKey; external CRYPT32 name 'CryptVerifyMessageSignatureWithKey';

function CryptGetMessageSignerCount; external CRYPT32 name 'CryptGetMessageSignerCount';

function CryptGetMessageCertificates; external CRYPT32 name 'CryptGetMessageCertificates';

function CryptVerifyDetachedMessageSignature; external CRYPT32 name 'CryptVerifyDetachedMessageSignature';

function CryptEncryptMessage; external CRYPT32 name 'CryptEncryptMessage';

function CryptDecryptMessage; external CRYPT32 name 'CryptDecryptMessage';

function CryptSignAndEncryptMessage; external CRYPT32 name 'CryptSignAndEncryptMessage';

function CryptDecryptAndVerifyMessageSignature; external CRYPT32 name 'CryptDecryptAndVerifyMessageSignature';

function CryptDecodeMessage; external CRYPT32 name 'CryptDecodeMessage';

function CryptHashMessage; external CRYPT32 name 'CryptHashMessage';

function CryptVerifyMessageHash; external CRYPT32 name 'CryptVerifyMessageHash';

function CryptVerifyDetachedMessageHash; external CRYPT32 name 'CryptVerifyDetachedMessageHash';

function CryptSignMessageWithKey; external CRYPT32 name 'CryptSignMessageWithKey';

function CryptVerifyMessageSignatureWithKey; external CRYPT32 name 'CryptVerifyMessageSignatureWithKey';

function CertOpenSystemStoreA; external CRYPT32 name 'CertOpenSystemStoreA';

function CertOpenSystemStoreW; external CRYPT32 name 'CertOpenSystemStoreW';

{$IFDEF UNICODE}

function CertOpenSystemStore; external CRYPT32 name 'CertOpenSystemStoreW';

{$ELSE}

function CertOpenSystemStore; external CRYPT32 name 'CertOpenSystemStoreA';

{$ENDIF} // !UNICODE

function CertAddEncodedCertificateToSystemStoreA; external CRYPT32 name 'CertAddEncodedCertificateToSystemStoreA';

function CertAddEncodedCertificateToSystemStoreW; external CRYPT32 name 'CertAddEncodedCertificateToSystemStoreW';

{$IFDEF UNICODE}

function CertAddEncodedCertificateToSystemStore; external CRYPT32 name 'CertAddEncodedCertificateToSystemStoreW';

{$ELSE}

function CertAddEncodedCertificateToSystemStore; external CRYPT32 name 'CertAddEncodedCertificateToSystemStoreA';

{$ENDIF} // !UNICODE

function FindCertsByIssuer; external SOFTPUB name 'FindCertsByIssuer';

end.

 

--------------------------------------

 

enfes kodlarınız varsa paylaşın.

msn: admin@g3nius.net

 

Delphi - .....................................

Bu web sitesi ücretsiz olarak Bedava-Sitem.com ile oluşturulmuştur. Siz de kendi web sitenizi kurmak ister misiniz?
Ücretsiz kaydol