Merge branch 'ia/public_key_api/OTP-8722' into dev

* ia/public_key_api/OTP-8722:
  Revise the public_key API

Resolved, version is now 0.8.
Conflicts:
	lib/public_key/vsn.mk

1 files changed, 389 insertions, 260 deletions

diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 12354eee5d..95c3d714d3 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -23,239 +23,396 @@
 
 -include("public_key.hrl").
 
--export([decode_private_key/1, decode_private_key/2, decode_dhparams/1, 
-	 decrypt_private/2, decrypt_private/3, encrypt_public/2, 
-	 encrypt_public/3, decrypt_public/2, decrypt_public/3, 
-	 encrypt_private/2, encrypt_private/3, gen_key/1, sign/2, sign/3,
-	 verify_signature/3, verify_signature/4, verify_signature/5,
-	 pem_to_der/1, pem_to_der/2, der_to_pem/2,
-	 pkix_decode_cert/2, pkix_encode_cert/1, pkix_transform/2,
-	 pkix_is_self_signed/1, pkix_is_fixed_dh_cert/1,
+-export([pem_decode/1, pem_encode/1, 
+	 der_decode/2, der_encode/2,
+	 pem_entry_decode/1,
+	 pem_entry_decode/2,
+	 pem_entry_encode/2,
+	 pem_entry_encode/3,
+	 pkix_decode_cert/2, pkix_encode/3,
+	 encrypt_private/2, encrypt_private/3,
+	 decrypt_private/2, decrypt_private/3, 
+	 encrypt_public/2, encrypt_public/3, 
+	 decrypt_public/2, decrypt_public/3,
+	 sign/3, verify/4,
+	 pkix_sign/2, pkix_verify/2,	 
+	 pkix_is_self_signed/1, 
+	 pkix_is_fixed_dh_cert/1,
+	 pkix_is_issuer/2,
 	 pkix_issuer_id/2,
-	 pkix_is_issuer/2, pkix_normalize_general_name/1,
+	 pkix_normalize_name/1,
 	 pkix_path_validation/3
 	]).
 
+%% Deprecated
+-export([decode_private_key/1, decode_private_key/2, pem_to_der/1]).
+
+-deprecated({pem_to_der, 1, next_major_release}).
+-deprecated({decode_private_key, 1, next_major_release}).
+-deprecated({decode_private_key, 2, next_major_release}).
+
+-type rsa_public_key()       ::  #'RSAPublicKey'{}.
+-type rsa_private_key()      ::  #'RSAPrivateKey'{}.
+-type dsa_private_key()      ::  #'DSAPrivateKey'{}.
+-type dsa_public_key()       :: {integer(), #'Dss-Parms'{}}.
+-type rsa_padding()          :: 'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding' 
+			      | 'rsa_no_padding'.
+-type public_crypt_options() :: [{rsa_pad, rsa_padding()}].
+-type rsa_digest_type()      :: 'md5' | 'sha'.
+-type dss_digest_type()      :: 'none' | 'sha'.
+
+-define(UINT32(X), X:32/unsigned-big-integer).
+
 %%====================================================================
 %% API
 %%====================================================================
 
 %%--------------------------------------------------------------------
-%% Function: decode_private_key(KeyInfo [,Password]) -> 
-%%                                     {ok, PrivateKey} | {error, Reason}
-%%
-%%	KeyInfo = {Type, der_bin(), ChipherInfo} - as returned from
-%%	pem_to_der/[1,2] for private keys
-%%      Type = rsa_private_key | dsa_private_key
-%%	ChipherInfo = opaque() | no_encryption
+-spec pem_decode(binary()) -> [pem_entry()].
+%%
+%% Description: Decode PEM binary data and return
+%% entries as asn1 der encoded entities. 
+%%--------------------------------------------------------------------
+pem_decode(PemBin) when is_binary(PemBin) ->
+    pubkey_pem:decode(PemBin).
+
+%%--------------------------------------------------------------------
+-spec pem_encode([pem_entry()]) -> binary().
 %%
-%% Description: Decodes an asn1 der encoded private key.
+%% Description: Creates a PEM binary.
 %%--------------------------------------------------------------------
-decode_private_key(KeyInfo) ->
-    decode_private_key(KeyInfo, no_passwd).
+pem_encode(PemEntries) when is_list(PemEntries) ->
+    iolist_to_binary(pubkey_pem:encode(PemEntries)).
 
-decode_private_key(KeyInfo = {rsa_private_key, _, _}, Password) ->
-    DerEncoded = pubkey_pem:decode_key(KeyInfo, Password),
-    'OTP-PUB-KEY':decode('RSAPrivateKey', DerEncoded);
-decode_private_key(KeyInfo = {dsa_private_key, _, _}, Password) ->
-    DerEncoded = pubkey_pem:decode_key(KeyInfo, Password),
-    'OTP-PUB-KEY':decode('DSAPrivateKey', DerEncoded).
+%%--------------------------------------------------------------------
+-spec pem_entry_decode(pem_entry(), [string()]) -> term().
+%
+%% Description: Decodes a pem entry. pem_decode/1 returns a list of
+%% pem entries.
+%%--------------------------------------------------------------------
+pem_entry_decode({Asn1Type, Der, not_encrypted}) when is_atom(Asn1Type),
+						      is_binary(Der) ->
+    der_decode(Asn1Type, Der).
+pem_entry_decode({Asn1Type, Der, not_encrypted}, _) when is_atom(Asn1Type),
+							 is_binary(Der) ->
+    der_decode(Asn1Type, Der);
+pem_entry_decode({Asn1Type, CryptDer, {Cipher, Salt}} = PemEntry, 
+		 Password) when is_atom(Asn1Type),
+				is_binary(CryptDer),
+				is_list(Cipher),
+				is_binary(Salt),
+				erlang:byte_size(Salt) == 8
+				->
+    Der = pubkey_pem:decipher(PemEntry, Password),
+    der_decode(Asn1Type, Der).
 
+%%--------------------------------------------------------------------
+-spec pem_entry_encode(pki_asn1_type(), term()) -> pem_entry().
+-spec pem_entry_encode(pki_asn1_type(), term(),
+		       {{Cipher :: string(), Salt :: binary()}, string()}) -> pem_entry().
+%
+%% Description: Creates a pem entry that can be feed to pem_encode/1.
+%%--------------------------------------------------------------------
+pem_entry_encode(Asn1Type, Entity)  when is_atom(Asn1Type) ->
+    Der = der_encode(Asn1Type, Entity),
+    {Asn1Type, Der, not_encrypted}.
+pem_entry_encode(Asn1Type, Entity, 
+		 {{Cipher, Salt}= CipherInfo, Password}) when is_atom(Asn1Type),
+							      is_list(Cipher),
+							      is_binary(Salt),
+							      erlang:byte_size(Salt) == 8,
+							      is_list(Password)->
+    Der = der_encode(Asn1Type, Entity),
+    DecryptDer = pubkey_pem:cipher(Der, CipherInfo, Password),
+    {Asn1Type, DecryptDer, CipherInfo}.
 
 %%--------------------------------------------------------------------
-%% Function: decode_dhparams(DhParamInfo) -> 
-%%                                     {ok, DhParams} | {error, Reason}
-%%
-%%	DhParamsInfo = {Type, der_bin(), ChipherInfo} - as returned from
-%%	pem_to_der/[1,2] for DH parameters.
-%%      Type = dh_params
-%%	ChipherInfo = opaque() | no_encryption
+-spec der_decode(asn1_type(), der_encoded()) -> term().
 %%
-%% Description: Decodes an asn1 der encoded DH parameters.
+%% Description: Decodes a public key asn1 der encoded entity.
 %%--------------------------------------------------------------------
-decode_dhparams({dh_params, DerEncoded, not_encrypted}) ->
-    'OTP-PUB-KEY':decode('DHParameter', DerEncoded).
+der_decode(Asn1Type, Der) when is_atom(Asn1Type), is_binary(Der) ->
+    try 
+	{ok, Decoded} = 'OTP-PUB-KEY':decode(Asn1Type, Der),
+	Decoded
+    catch	    
+	error:{badmatch, {error, _}} = Error ->
+	    erlang:error(Error)
+    end.
 
 %%--------------------------------------------------------------------
-%% Function: decrypt_private(CipherText, Key) -> 
-%%           decrypt_private(CipherText, Key, Options) -> PlainTex
-%%           decrypt_public(CipherText, Key) -> 
-%%           decrypt_public(CipherText, Key, Options) -> PlainTex
+-spec der_encode(asn1_type(), term()) -> der_encoded().
 %%
-%%	CipherText = binary()
-%%      Key = rsa_key()
-%%      PlainText = binary()
+%% Description: Encodes a public key entity with asn1 DER encoding.
+%%--------------------------------------------------------------------
+der_encode(Asn1Type, Entity) when is_atom(Asn1Type) ->
+    try 
+	{ok, Encoded} = 'OTP-PUB-KEY':encode(Asn1Type, Entity),
+	iolist_to_binary(Encoded)
+    catch	    
+	error:{badmatch, {error, _}} = Error ->
+	    erlang:error(Error)
+    end.
+
+%%--------------------------------------------------------------------
+-spec pkix_decode_cert(der_encoded(), plain | otp) -> 
+			      #'Certificate'{} | #'OTPCertificate'{}.
 %%
-%% Description: Decrypts <CipherText>.
+%% Description: Decodes an asn1 der encoded pkix certificate. The otp
+%% option will use the customized asn1 specification OTP-PKIX.asn1 for
+%% decoding and also recursively decode most of the standard
+%% extensions.
+%% --------------------------------------------------------------------
+pkix_decode_cert(DerCert, plain)  when is_binary(DerCert) ->
+    der_decode('Certificate', DerCert);
+pkix_decode_cert(DerCert, otp) when is_binary(DerCert) ->
+    try 
+	{ok, #'OTPCertificate'{}= Cert} = 
+	    pubkey_cert_records:decode_cert(DerCert),
+	Cert
+    catch
+	error:{badmatch, {error, _}} = Error ->
+	    erlang:error(Error)
+    end.
+
+%%--------------------------------------------------------------------
+-spec pkix_encode(asn1_type(), term(), otp | plain) -> der_encoded().
+%%
+%% Description: Der encodes a certificate or part of a certificate.
+%% This function must be used for encoding certificates or parts of certificates
+%% that are decoded with the otp format, whereas for the plain format this
+%% function will only call der_encode/2.   
+%%--------------------------------------------------------------------
+pkix_encode(Asn1Type, Term, plain) when is_atom(Asn1Type) ->
+    der_encode(Asn1Type, Term);
+
+pkix_encode(Asn1Type, Term0, otp) when is_atom(Asn1Type) ->
+    Term = pubkey_cert_records:transform(Term0, encode),
+    der_encode(Asn1Type, Term).
+
+%%--------------------------------------------------------------------
+-spec decrypt_private(CipherText :: binary(), rsa_private_key()) -> 
+			     PlainText :: binary().
+-spec decrypt_private(CipherText :: binary(), rsa_private_key(), 
+		      public_crypt_options()) -> PlainText :: binary().
+%%
+%% Description: Public key decryption using the private key.
 %%--------------------------------------------------------------------
 decrypt_private(CipherText, Key) ->
     decrypt_private(CipherText, Key, []).
-decrypt_private(CipherText, Key, Options)  ->
-    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
-    pubkey_crypto:decrypt_private(CipherText, Key, Padding).
 
-decrypt_public(CipherText, Key) ->
-    decrypt_public(CipherText, Key, []).
-decrypt_public(CipherText, Key, Options)  ->
+decrypt_private(CipherText, 
+		#'RSAPrivateKey'{modulus = N,publicExponent = E,
+				 privateExponent = D}, 
+		Options)  when is_binary(CipherText), 
+			       is_list(Options) ->
     Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
-    pubkey_crypto:decrypt_public(CipherText, Key, Padding).
+    crypto:rsa_private_decrypt(CipherText, 
+			       [crypto:mpint(E), crypto:mpint(N),
+				crypto:mpint(D)], Padding).
 
 %%--------------------------------------------------------------------
-%% Function: encrypt_public(PlainText, Key, Options) -> CipherText
-%%           encrypt_private(PlainText, Key, Options) -> CipherText
-%%
-%%      PlainText = iolist()
-%%      Key = rsa_private_key()
-%%      CipherText = binary()
+-spec decrypt_public(CipherText :: binary(), rsa_public_key()) -> 
+			    PlainText :: binary().
+-spec decrypt_public(CipherText :: binary(), rsa_public_key(), 
+		     public_crypt_options()) -> PlainText :: binary().
 %%
-%% Description: Encrypts <Plain>
+%% Description: Public key decryption using the public key.
 %%--------------------------------------------------------------------
-encrypt_public(PlainText, Key) ->
-    encrypt_public(PlainText, Key, []).
-encrypt_public(PlainText, Key, Options)  ->
-    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
-    pubkey_crypto:encrypt_public(PlainText, Key, Padding).
+decrypt_public(CipherText, Key) ->
+    decrypt_public(CipherText, Key, []).
 
-encrypt_private(PlainText, Key) ->
-    encrypt_private(PlainText, Key, []).
-encrypt_private(PlainText, Key, Options)  ->
-    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
-    pubkey_crypto:encrypt_private(PlainText, Key, Padding).
+decrypt_public(CipherText, #'RSAPublicKey'{modulus = N, publicExponent = E}, 
+	       Options) when is_binary(CipherText), is_list(Options)  ->
+    decrypt_public(CipherText, N,E, Options);
 
-%%--------------------------------------------------------------------
-%% Function: gen_key(Params) -> Keys
-%%
-%%	Params = #'DomainParameters'{} - Currently only supported option
-%%	Keys = {PublicDHKey = integer(), PrivateDHKey = integer()}
-%%
-%% Description: Generates keys. Currently supports Diffie-Hellman keys.
-%%--------------------------------------------------------------------
-gen_key(#'DHParameter'{prime = P, base = G}) when is_integer(P), 
-						  is_integer(G) ->
-    pubkey_crypto:gen_key(diffie_hellman, [P, G]).
+decrypt_public(CipherText,#'RSAPrivateKey'{modulus = N, publicExponent = E}, 
+	       Options) when is_binary(CipherText), is_list(Options) ->
+    decrypt_public(CipherText, N,E, Options).
 
 %%--------------------------------------------------------------------
-%% Function: pem_to_der(CertSource) ->
-%%           pem_to_der(CertSource, Password) -> {ok, [Entry]} |
-%%                                               {error, Reason}
-%%
-%%      CertSource = File | CertData
-%%      CertData = binary()
-%%	File = path()
-%%	Entry = {entry_type(), der_bin(), ChipherInfo}
-%%      ChipherInfo = opague() | no_encryption
-%%      der_bin() = binary()
-%%	entry_type() = cert | cert_req | rsa_private_key | dsa_private_key
-%%      dh_params
+-spec encrypt_public(PlainText :: binary(), rsa_public_key()) ->  
+			    CipherText :: binary().
+-spec encrypt_public(PlainText :: binary(), rsa_public_key(), 
+		     public_crypt_options()) ->  CipherText :: binary().
 %%
-%% Description: decode PEM binary data or a PEM file and return
-%% entries as asn1 der encoded entities. Currently supported entry
-%% types are certificates, certificate requests, rsa private keys and
-%% dsa private keys. In the case of a key entry ChipherInfo will be
-%% private keys and Diffie Hellam parameters .In the case of a key
-%% entry ChipherInfo will be used by decode_private_key/2 if the key
-%% is protected by a password.
+%% Description: Public key encryption using the public key.
 %%--------------------------------------------------------------------
-pem_to_der(CertSource) ->
-    pem_to_der(CertSource, no_passwd).
+encrypt_public(PlainText, Key) ->
+    encrypt_public(PlainText, Key, []).
 
-pem_to_der(File, Password) when is_list(File) ->
-    pubkey_pem:read_file(File, Password);
-pem_to_der(PemBin, Password) when is_binary(PemBin) ->
-    pubkey_pem:decode(PemBin, Password).
+encrypt_public(PlainText, #'RSAPublicKey'{modulus=N,publicExponent=E}, 
+	       Options) when is_binary(PlainText), is_list(Options) ->
+    encrypt_public(PlainText, N,E, Options);
 
-der_to_pem(File, TypeDerList) ->
-    pubkey_pem:write_file(File, TypeDerList).
+encrypt_public(PlainText, #'RSAPrivateKey'{modulus=N,publicExponent=E}, 
+	       Options) when is_binary(PlainText), is_list(Options) ->
+    encrypt_public(PlainText, N,E, Options).
 
 %%--------------------------------------------------------------------
-%% Function: pkix_decode_cert(BerCert, Type) -> {ok, Cert} | {error, Reason}
-%%
-%%	BerCert = binary()
-%%      Type = plain | otp
-%%      Cert = certificate()
+-spec encrypt_private(PlainText :: binary(), rsa_private_key()) -> 
+			     CipherText :: binary().
+-spec encrypt_private(PlainText :: binary(), rsa_private_key(), 
+		      public_crypt_options()) -> CipherText :: binary().
 %%
-%% Description:  Decodes an asn1 ber encoded pkix certificate.
-%% otp - Uses OTP-PKIX.asn1 to decode known extensions and
-%% enhance the signature field in #'Certificate'{} and '#TBSCertificate'{}. 
+%% Description: Public key encryption using the private key.
 %%--------------------------------------------------------------------
-pkix_decode_cert(BinCert, Type) ->
-    pubkey_cert_records:decode_cert(BinCert, Type).
+encrypt_private(PlainText, Key) ->
+    encrypt_private(PlainText, Key, []).
+
+encrypt_private(PlainText, #'RSAPrivateKey'{modulus = N,
+					    publicExponent = E, 
+					    privateExponent = D}, 
+		Options) when is_binary(PlainText), is_list(Options) ->		
+    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
+    crypto:rsa_private_encrypt(PlainText, [crypto:mpint(E), 
+					   crypto:mpint(N), 
+					   crypto:mpint(D)], Padding).
 
 %%--------------------------------------------------------------------
-%% Function: pkix_encode_cert(Cert) -> {ok, binary()} | {error, Reason}
-%%
-%%	Cert = #'Certificate'{} 
+-spec sign(PlainTextOrDigest :: binary(), rsa_digest_type() | dss_digest_type(), 
+	   rsa_private_key() | 
+	   dsa_private_key()) -> Signature :: binary().
 %%
-%% Description: Encodes a certificate record using asn1.
+%% Description: Create digital signature.
 %%--------------------------------------------------------------------
-pkix_encode_cert(Cert) ->
-    pubkey_cert_records:encode_cert(Cert).
+sign(PlainText, DigestType,  #'RSAPrivateKey'{modulus = N,  publicExponent = E,
+					      privateExponent = D}) 
+  when is_binary(PlainText),
+       DigestType == md5;
+       DigestType == sha ->
+    
+    crypto:rsa_sign(DigestType, sized_binary(PlainText), [crypto:mpint(E),
+							  crypto:mpint(N),
+							  crypto:mpint(D)]);
+
+sign(Digest, none, #'DSAPrivateKey'{p = P, q = Q, g = G, x = X}) 
+  when is_binary(Digest)->
+    crypto:dss_sign(none, Digest, 
+		    [crypto:mpint(P), crypto:mpint(Q), 
+		     crypto:mpint(G), crypto:mpint(X)]);
+  
+sign(PlainText, sha, #'DSAPrivateKey'{p = P, q = Q, g = G, x = X}) 
+  when is_binary(PlainText) ->
+    crypto:dss_sign(sized_binary(PlainText), 
+		    [crypto:mpint(P), crypto:mpint(Q), 
+		     crypto:mpint(G), crypto:mpint(X)]).
+
+%%--------------------------------------------------------------------
+-spec verify(PlainTextOrDigest :: binary(), rsa_digest_type() | dss_digest_type(), 
+	     Signature :: binary(), rsa_public_key() 
+	     | dsa_public_key()) -> boolean().
+%%
+%% Description: Verifies a digital signature.
+%%--------------------------------------------------------------------
+verify(PlainText, DigestType, Signature, 
+       #'RSAPublicKey'{modulus = Mod, publicExponent = Exp}) 
+  when is_binary (PlainText), DigestType == sha; DigestType == md5 ->
+    crypto:rsa_verify(DigestType,
+		      sized_binary(PlainText), 
+		      sized_binary(Signature), 
+		      [crypto:mpint(Exp), crypto:mpint(Mod)]);
+
+verify(Digest, none, Signature, {Key,  #'Dss-Parms'{p = P, q = Q, g = G}}) 
+  when is_integer(Key),  is_binary(Digest), is_binary(Signature) ->
+    crypto:dss_verify(none, 
+		      Digest, 
+		      sized_binary(Signature), 
+		      [crypto:mpint(P), crypto:mpint(Q), 
+		       crypto:mpint(G), crypto:mpint(Key)]);
     
+verify(PlainText, sha, Signature, {Key,  #'Dss-Parms'{p = P, q = Q, g = G}}) 
+  when is_integer(Key),  is_binary(PlainText), is_binary(Signature) ->
+    crypto:dss_verify(sized_binary(PlainText), 
+		      sized_binary(Signature), 
+		      [crypto:mpint(P), crypto:mpint(Q), 
+		       crypto:mpint(G), crypto:mpint(Key)]).
 %%--------------------------------------------------------------------
-%% Function: pkix_transform(CertPart, Op) -> TransformedCertPart
+-spec pkix_sign(#'OTPTBSCertificate'{},
+		rsa_private_key() | dsa_private_key()) -> der_encoded().
 %%
-%%	CertPart = pkix part data
-%%      Op = encode | decode
-%%
-%% Description: Transform parts of a pkix certificate between 'plain' format
-%% and the internal 'otp' format, see pkix_decode_cert/2.
-%% Decode transforms from 'plain' to 'otp' and encode from 'otp' to 'plain'
-%% format.
+%% Description: Sign a pkix x.509 certificate. Returns the corresponding
+%% der encoded 'Certificate'{}
 %%--------------------------------------------------------------------
-pkix_transform(CertPart, Op) ->
-    pubkey_cert_records:transform(CertPart, Op).
+pkix_sign(#'OTPTBSCertificate'{signature = 
+				   #'SignatureAlgorithm'{algorithm = Alg} 
+			       = SigAlg} = TBSCert, Key) ->
+
+    Msg = pkix_encode('OTPTBSCertificate', TBSCert, otp),    
+    DigestType = pubkey_cert:digest_type(Alg),
+    Signature = sign(Msg, DigestType, Key),
+    Cert = #'OTPCertificate'{tbsCertificate= TBSCert,
+			     signatureAlgorithm = SigAlg,
+			     signature = {0, Signature}
+			    },
+    pkix_encode('OTPCertificate', Cert, otp).
 
 %%--------------------------------------------------------------------
-%% Function: pkix_path_validation(TrustedCert, CertChain, Options) -> 
-%%   {ok, {{algorithm(), public_key(), public_key_params()} policy_tree()}} |
-%%   {error, Reason}
+-spec pkix_verify(der_encoded(), rsa_public_key()| 
+		  dsa_public_key()) -> boolean().
 %%
-%% Description: Performs a bacis path validation according to RFC 3280.
+%% Description: Verify pkix x.509 certificate signature.
 %%--------------------------------------------------------------------
-pkix_path_validation(TrustedCert, CertChain, Options)
-  when is_binary(TrustedCert) ->
-    {ok, OtpCert} = pkix_decode_cert(TrustedCert, otp),
-    pkix_path_validation(OtpCert, CertChain, Options);
+pkix_verify(DerCert, {Key, #'Dss-Parms'{}} = DSAKey) 
+  when is_binary(DerCert), is_integer(Key) ->
+    {DigestType, PlainText, Signature} = pubkey_cert:verify_data(DerCert),
+    verify(PlainText, DigestType, Signature, DSAKey);
+
+pkix_verify(DerCert,  #'RSAPublicKey'{} = RSAKey) 
+  when is_binary(DerCert) ->
+    {DigestType, PlainText, Signature} = pubkey_cert:verify_data(DerCert),
+    verify(PlainText, DigestType, Signature, RSAKey).
 
-pkix_path_validation(#'OTPCertificate'{} = TrustedCert, CertChain, Options) 
-  when is_list(CertChain), is_list(Options) ->
-    MaxPathDefault = length(CertChain),
-    ValidationState = pubkey_cert:init_validation_state(TrustedCert, 
-							MaxPathDefault, 
-							Options),
-    Fun = proplists:get_value(validate_extensions_fun, Options,
-			      fun(Extensions, State, _, AccError) ->
-				      {Extensions, State, AccError}
-			      end),
-    Verify = proplists:get_value(verify, Options, true),
-    path_validation(CertChain, ValidationState, Fun, Verify).
 %%--------------------------------------------------------------------
-%% Function: pkix_is_fixed_dh_cert(Cert) -> true | false
+-spec pkix_is_issuer(Cert :: der_encoded()| #'OTPCertificate'{},
+		     IssuerCert :: der_encoded()| 
+				   #'OTPCertificate'{}) -> boolean().
 %%
-%% Description: Checks if a Certificate is a fixed Diffie-Hellman Cert
+%% Description: Checks if <IssuerCert> issued <Cert>.
 %%--------------------------------------------------------------------
-pkix_is_fixed_dh_cert(#'OTPCertificate'{} = OTPCert) ->
-    pubkey_cert:is_fixed_dh_cert(OTPCert);
-pkix_is_fixed_dh_cert(Cert) when is_binary(Cert) ->
-    {ok, OtpCert} = pkix_decode_cert(Cert, otp),
-    pkix_is_fixed_dh_cert(OtpCert).
+pkix_is_issuer(Cert, IssuerCert)  when is_binary(Cert) ->
+    OtpCert = pkix_decode_cert(Cert, otp),
+    pkix_is_issuer(OtpCert, IssuerCert);
+
+pkix_is_issuer(Cert, IssuerCert) when is_binary(IssuerCert) ->
+    OtpIssuerCert = pkix_decode_cert(IssuerCert, otp),
+    pkix_is_issuer(Cert, OtpIssuerCert);
+
+pkix_is_issuer(#'OTPCertificate'{tbsCertificate = TBSCert}, 
+	       #'OTPCertificate'{tbsCertificate = Candidate}) ->
+    pubkey_cert:is_issuer(TBSCert#'OTPTBSCertificate'.issuer,
+			  Candidate#'OTPTBSCertificate'.subject).
 
 %%--------------------------------------------------------------------
-%% Function: pkix_is_self_signed(Cert) -> true | false
+-spec pkix_is_self_signed(der_encoded()| #'OTPCertificate'{}) -> boolean().
 %%
 %% Description: Checks if a Certificate is self signed. 
 %%--------------------------------------------------------------------
 pkix_is_self_signed(#'OTPCertificate'{} = OTPCert) ->
     pubkey_cert:is_self_signed(OTPCert);
 pkix_is_self_signed(Cert) when is_binary(Cert) ->
-    {ok, OtpCert} = pkix_decode_cert(Cert, otp),
+    OtpCert = pkix_decode_cert(Cert, otp),
     pkix_is_self_signed(OtpCert).
-
+  
 %%--------------------------------------------------------------------
-%% Function: pkix_issuer_id(Cert) -> {ok, {SerialNr, Issuer}} | {error, Reason}
-%%                                     
-%%	Cert = asn1_der_encoded() | 'OTPCertificate'{}
+-spec pkix_is_fixed_dh_cert(der_encoded()| #'OTPCertificate'{}) -> boolean().
 %%
+%% Description: Checks if a Certificate is a fixed Diffie-Hellman Cert.
+%%--------------------------------------------------------------------
+pkix_is_fixed_dh_cert(#'OTPCertificate'{} = OTPCert) ->
+    pubkey_cert:is_fixed_dh_cert(OTPCert);
+pkix_is_fixed_dh_cert(Cert) when is_binary(Cert) ->
+    OtpCert = pkix_decode_cert(Cert, otp),
+    pkix_is_fixed_dh_cert(OtpCert).
+
+%%--------------------------------------------------------------------
+-spec pkix_issuer_id(der_encoded()| #'OTPCertificate'{}, 
+		     IssuedBy :: self | other) -> 
+			    {ok, {SerialNr :: integer(), 
+				  Issuer :: {rdnSequence, 
+					     [#'AttributeTypeAndValue'{}]}}} 
+				| {error, Reason :: term()}.
+%
 %% Description: Returns the issuer id.  
 %%--------------------------------------------------------------------
 pkix_issuer_id(#'OTPCertificate'{} = OtpCert, self) ->
@@ -265,115 +422,64 @@ pkix_issuer_id(#'OTPCertificate'{} = OtpCert, other) ->
     pubkey_cert:issuer_id(OtpCert, other);
 
 pkix_issuer_id(Cert, Signed) when is_binary(Cert) ->
-    {ok, OtpCert} = pkix_decode_cert(Cert, otp),
+    OtpCert = pkix_decode_cert(Cert, otp),
     pkix_issuer_id(OtpCert, Signed).
 
 %%--------------------------------------------------------------------
-%% Function: pkix_is_issuer(Cert, IssuerCert) -> true | false
-%%
-%%	Cert = asn1_der_encoded() | 'OTPCertificate'{}
-%%	IssuerCert = asn1_der_encoded() | 'OTPCertificate'{}
+-spec pkix_normalize_name({rdnSequence, 
+				   [#'AttributeTypeAndValue'{}]}) -> 
+					 {rdnSequence, 
+					  [#'AttributeTypeAndValue'{}]}.
 %%
-%% Description: Checks if <IssuerCert> issued <Cert>.
+%% Description: Normalizes a issuer name so that it can be easily
+%%              compared to another issuer name. 
 %%--------------------------------------------------------------------
-pkix_is_issuer(Cert, IssuerCert)  when is_binary(Cert) ->
-    {ok, OtpCert} = pkix_decode_cert(Cert, otp),
-    pkix_is_issuer(OtpCert, IssuerCert);
-
-pkix_is_issuer(Cert, IssuerCert) when is_binary(IssuerCert) ->
-    {ok, OtpIssuerCert} = pkix_decode_cert(IssuerCert, otp),
-    pkix_is_issuer(Cert, OtpIssuerCert);
+pkix_normalize_name(Issuer) -> 
+    pubkey_cert:normalize_general_name(Issuer).
 
-pkix_is_issuer(#'OTPCertificate'{tbsCertificate = TBSCert}, 
-	       #'OTPCertificate'{tbsCertificate = Candidate}) ->
-    pubkey_cert:is_issuer(TBSCert#'OTPTBSCertificate'.issuer,
-			  Candidate#'OTPTBSCertificate'.subject).
-    
-%%--------------------------------------------------------------------
-%% Function: pkix_normalize_general_name(Issuer) -> 
-%%
-%%	Issuer = general_name() - see PKIX
-%%   
-%% Description: Normalizes a general name so that it can be easily
-%%              compared to another genral name. 
+%%-------------------------------------------------------------------- 
+-spec pkix_path_validation(der_encoded()| #'OTPCertificate'{}, 
+			   CertChain :: [der_encoded()] , 
+			   Options :: list()) ->  
+				  {ok, {PublicKeyInfo :: term(), 
+					PolicyTree :: term(),
+					[{bad_cert, Reason :: term()}]}} | 
+				  {error, {bad_cert, Reason :: term()}}.
+%% Description: Performs a basic path validation according to RFC 5280.
 %%--------------------------------------------------------------------
-pkix_normalize_general_name(Issuer) -> 
-    pubkey_cert:normalize_general_name(Issuer).
+pkix_path_validation(TrustedCert, CertChain, Options)
+  when is_binary(TrustedCert) ->
+    OtpCert = pkix_decode_cert(TrustedCert, otp),
+    pkix_path_validation(OtpCert, CertChain, Options);
+
+pkix_path_validation(#'OTPCertificate'{} = TrustedCert, CertChain, Options) 
+  when is_list(CertChain), is_list(Options) ->
+    MaxPathDefault = length(CertChain),
+    ValidationState = pubkey_cert:init_validation_state(TrustedCert, 
+							MaxPathDefault, 
+							Options),
+    Fun = proplists:get_value(validate_extensions_fun, Options,
+			      fun(Extensions, State, _, AccError) ->
+				      {Extensions, State, AccError}
+			      end),
+    Verify = proplists:get_value(verify, Options, true),
+    path_validation(CertChain, ValidationState, Fun, Verify).
 
 %%--------------------------------------------------------------------
-%% Function:sign(Msg, Key) -> {ok, Signature} 
-%%          sign(Msg, Key, KeyParams) -> {ok, Signature}
-%%
-%%	Msg = binary() | #'TBSCertificate'{}
-%%      Key = private_key()
-%%	KeyParams = key_params()
-%%      Signature = binary()
-%%
-%% Description: Signs plaintext Msg or #TBSCertificate{}, in the later
-%%              case a der encoded "#Certificate{}" will be returned. 
+%%% Internal functions
 %%--------------------------------------------------------------------
-sign(Msg, #'RSAPrivateKey'{} = Key) when is_binary(Msg) -> 
-    pubkey_crypto:sign(Msg, Key);
-
-sign(Msg, #'DSAPrivateKey'{} = Key) when is_binary(Msg) ->
-    pubkey_crypto:sign(Msg, Key);
 
-sign(#'OTPTBSCertificate'{signature = #'SignatureAlgorithm'{algorithm = Alg} 
-			  = SigAlg} = TBSCert, Key) ->
-    Msg = pubkey_cert_records:encode_tbs_cert(TBSCert),
-    DigestType = pubkey_cert:digest_type(Alg),
-    Signature = pubkey_crypto:sign(DigestType, Msg, Key),
-    Cert = #'OTPCertificate'{tbsCertificate= TBSCert,
-			     signatureAlgorithm = SigAlg,
-			     signature = {0, Signature}
-			    },
-    pkix_encode_cert(Cert).
+encrypt_public(PlainText, N, E, Options)->
+    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
+    crypto:rsa_public_encrypt(PlainText, [crypto:mpint(E),crypto:mpint(N)],
+			      Padding).
 
-sign(DigestType, Msg, Key) ->
-    pubkey_crypto:sign(DigestType, Msg, Key).
+decrypt_public(CipherText, N,E, Options) ->  
+    Padding = proplists:get_value(rsa_pad, Options, rsa_pkcs1_padding),
+    crypto:rsa_public_decrypt(CipherText,[crypto:mpint(E), crypto:mpint(N)], 
+			      Padding).
 
-%%--------------------------------------------------------------------
-%% Function: verify_signature(PlainText, DigestType, Signature, Key) ->
-%%           verify_signature(PlainText, DigestType,
-%%                                       Signature, Key, KeyParams) -> 
-%%           verify_signature(DerCert, Key, KeyParams) ->
-%%
-%%      PlainText = binary()
-%%      DigestType = md5 | sha
-%%      DerCert = asn1_der_encoded()
-%%      Signature = binary()
-%%      Key = public_key()
-%%      KeyParams = key_params()
-%%      Verified = boolean()
-%%
-%% Description: Verifies the signature <Signature>.
-%%--------------------------------------------------------------------
-verify_signature(PlainText, DigestType, Signature, #'RSAPublicKey'{} = Key)
-  when is_binary(PlainText), is_binary(Signature), DigestType == sha;
-       DigestType == md5 ->
-    pubkey_crypto:verify(DigestType, PlainText, Signature, Key, undefined).
-
-verify_signature(PlainText, DigestType, Signature, #'RSAPublicKey'{} = Key,
-		 KeyParams) 
-  when is_binary(PlainText), is_binary(Signature), DigestType == sha;
-       DigestType == md5 ->
-    pubkey_crypto:verify(DigestType, PlainText, Signature, Key, KeyParams);
-verify_signature(PlainText, sha, Signature, Key, #'Dss-Parms'{} = KeyParams) 
-  when is_binary(PlainText), is_binary(Signature), is_integer(Key) ->
-    pubkey_crypto:verify(sha, PlainText, Signature, Key, KeyParams);
-verify_signature(Hash, none, Signature, Key, KeyParams) ->
-    pubkey_crypto:verify(none, Hash, Signature, Key, KeyParams).
-
-verify_signature(DerCert, Key, #'Dss-Parms'{} = KeyParams) 
-  when is_binary(DerCert), is_integer(Key) ->
-    pubkey_cert:verify_signature(DerCert, Key, KeyParams);
-verify_signature(DerCert,  #'RSAPublicKey'{} = Key, KeyParams) 
-  when is_binary(DerCert) ->
-    pubkey_cert:verify_signature(DerCert, Key, KeyParams).
 
-%%--------------------------------------------------------------------
-%%% Internal functions
-%%--------------------------------------------------------------------
 path_validation([], #path_validation_state{working_public_key_algorithm
 					   = Algorithm,
 					   working_public_key =
@@ -423,7 +529,7 @@ validate(DerCert, #path_validation_state{working_issuer_name = Issuer,
 					 user_state = UserState0,
 					 acc_errors = AccErr0} = 
 	 ValidationState0, ValidateExtensionFun, Verify) -> 
-    {ok, OtpCert} = pkix_decode_cert(DerCert, otp),
+    OtpCert = pkix_decode_cert(DerCert, otp),
     %% All validate functions will throw {bad_cert, Reason} if they 
     %% fail and Verify = true if Verify = false errors
     %% will be accumulated in the validationstate 
@@ -456,3 +562,26 @@ validate(DerCert, #path_validation_state{working_issuer_name = Issuer,
 	ValidationState1#path_validation_state{user_state = UserState,
 					       acc_errors = AccErr},
     pubkey_cert:prepare_for_next_cert(OtpCert, ValidationState).
+
+sized_binary(Binary) when is_binary(Binary) ->
+    Size = size(Binary),
+    <<?UINT32(Size), Binary/binary>>;
+sized_binary(List) ->
+    sized_binary(list_to_binary(List)).
+
+%%--------------------------------------------------------------------
+%%% Deprecated functions
+%%--------------------------------------------------------------------
+pem_to_der(CertSource) ->
+    {ok, Bin} = file:read_file(CertSource),
+    pubkey_pem:decode(Bin).
+
+decode_private_key(KeyInfo) ->
+    decode_private_key(KeyInfo, no_passwd).
+
+decode_private_key(KeyInfo = {'RSAPrivateKey', _, _}, Password) ->
+    DerEncoded = pubkey_pem:decode_key(KeyInfo, Password),
+    'OTP-PUB-KEY':decode('RSAPrivateKey', DerEncoded);
+decode_private_key(KeyInfo = {'DSAPrivateKey', _, _}, Password) ->
+    DerEncoded = pubkey_pem:decode_key(KeyInfo, Password),
+    'OTP-PUB-KEY':decode('DSAPrivateKey', DerEncoded).