Added SILC Server library.
[silc.git] / lib / silccrypt / silcpkcs.h
index d9497309729b4b37112b365dd55163732d74dc4c..eeaa240586c1a6878d280ba68fca094b2c778c68 100644 (file)
@@ -1,10 +1,10 @@
 /*
 
-  silcpkcs.h 
+  silcpkcs.h
 
   Author: Pekka Riikonen <priikone@silcnet.org>
 
-  Copyright (C) 1997 - 2002 Pekka Riikonen
+  Copyright (C) 1997 - 2005 Pekka Riikonen
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
 /****s* silccrypt/SilcPKCSAPI/SilcPKCS
  *
  * NAME
- * 
+ *
  *    typedef struct SilcPKCSStruct *SilcPKCS;
  *
  * DESCRIPTION
  *
  *    This context is the actual PKCS context and is allocated
  *    by silc_pkcs_alloc and given as argument usually to all
- *    silc_pkcs _* functions.  It is freed by the silc_pkcs_free
+ *    silc_pkcs_* functions.  It is freed by the silc_pkcs_free
  *    function.
  *
  ***/
 typedef struct SilcPKCSStruct *SilcPKCS;
 
+/****d* silccrypt/SilcPKCSAPI/SilcPKCSType
+ *
+ * NAME
+ *
+ *    typedef enum { ... } SilcPKCSType
+ *
+ * DESCRIPTION
+ *
+ *    Public key cryptosystem types.  These are defined by the SILC
+ *    Key Exchange protocol.
+ *
+ * SOURCE
+ */
+typedef enum {
+  SILC_PKCS_SILC    = 1,       /* SILC PKCS (mandatory) */
+  SILC_PKCS_SSH2    = 2,       /* SSH2 PKCS (not supported) */
+  SILC_PKCS_X509V3  = 3,       /* X.509v3 PKCS (not supported) */
+  SILC_PKCS_OPENPGP = 4,       /* OpenPGP PKCS (not supported) */
+  SILC_PKCS_SPKI    = 5,       /* SPKI PKCS (not supported) */
+} SilcPKCSType;
+/***/
+
 /* The default SILC PKCS (Public Key Cryptosystem) object to represent
    any PKCS in SILC. */
 typedef struct SilcPKCSObjectStruct {
   char *name;
+  SilcPKCSType type;
   int (*init)(void *, SilcUInt32, SilcRng);
   void (*clear_keys)(void *);
   unsigned char *(*get_public_key)(void *, SilcUInt32 *);
@@ -77,13 +100,13 @@ typedef struct SilcPKCSObjectStruct {
 /****s* silccrypt/SilcPKCSAPI/SilcPublicKey
  *
  * NAME
- * 
- *    typedef struct { ... } *SilcPublicKey;
+ *
+ *    typedef struct { ... } *SilcPublicKey, SilcPublicKeyStruct;
  *
  * DESCRIPTION
  *
  *    SILC style public key object.  Public key is read from file to this
- *    object.  Public keys received from network must be in this format as 
+ *    object.  Public keys received from network must be in this format as
  *    well.  The format is defined by the SILC protocol specification.
  *    This object is allocated by silc_pkcs_public_key_alloc and freed
  *    by silc_pkcs_public_key_free.  The object is given as argument to
@@ -98,21 +121,22 @@ typedef struct {
   char *identifier;
   unsigned char *pk;
   SilcUInt32 pk_len;
-} *SilcPublicKey;
+} *SilcPublicKey, SilcPublicKeyStruct;
 /***/
 
 /****s* silccrypt/SilcPKCSAPI/SilcPublicKeyIdentifier
  *
  * NAME
- * 
- *    typedef struct { ... } *SilcPublicKeyIdentifier;
+ *
+ *    typedef struct { ... } *SilcPublicKeyIdentifier,
+ *                            SilcPublicKeyIdentifierStruct;
  *
  * DESCRIPTION
  *
- *    Decoded SILC Public Key identifier.  Note that some of the fields 
- *    may be NULL.  This context is allcated by the function
+ *    Decoded SILC Public Key identifier.  Note that some of the fields
+ *    may be NULL.  This context is allocated by the function
  *    silc_pkcs_decode_identifier and freed by silc_pkcs_free_identifier.
- *    The identifier in SilcPublicKey is the 'identifier' field, which
+ *    The identifier in SilcPublicKey is the `identifier' field, which
  *    can be given as argument to silc_pkcs_decode_identifier.
  *
  * SOURCE
@@ -124,14 +148,14 @@ typedef struct {
   char *email;
   char *org;
   char *country;
-} *SilcPublicKeyIdentifier;
+} *SilcPublicKeyIdentifier, SilcPublicKeyIdentifierStruct;
 /***/
 
 /****s* silccrypt/SilcPKCSAPI/SilcPrivateKey
  *
  * NAME
- * 
- *    typedef struct { ... } *SilcPrivateKey;
+ *
+ *    typedef struct { ... } *SilcPrivateKey, SilcPrivateKeyStruct;
  *
  * DESCRIPTION
  *
@@ -145,7 +169,7 @@ typedef struct {
   char *name;
   unsigned char *prv;
   SilcUInt32 prv_len;
-} *SilcPrivateKey;
+} *SilcPrivateKey, SilcPrivateKeyStruct;
 
 /* Public and private key file headers */
 #define SILC_PKCS_PUBLIC_KEYFILE_BEGIN "-----BEGIN SILC PUBLIC KEY-----\n"
@@ -177,16 +201,16 @@ extern DLLAPI const SilcPKCSObject silc_default_pkcs[];
    as argument to the init function. By doing this we would achieve
    that PKCS could be used as SIM's. The only requirement would be
    that they are compiled against GMP (well, actually even that would
-   not be a requirement, but the most generic case anyway). The new init 
+   not be a requirement, but the most generic case anyway). The new init
    would look something like this:
 
    #define SILC_PKCS_API_INIT(pkcs) \
    inline int silc_##pkcs##_init(void *context, SilcUInt32 keylen, \
                                  void *p1, void *p2)
 
-   Now we wouldn't have to send the SilcRng object since the primes are 
-   provided as arguments. To send them as void * they could actually be 
-   used as in anyway for real (MP_INT (SilcMPInt) or even something else 
+   Now we wouldn't have to send the SilcRng object since the primes are
+   provided as arguments. To send them as void * they could actually be
+   used as in anyway for real (MP_INT (SilcMPInt) or even something else
    (the pointer could be kludged to be something else in the module))
    (Plus, the SilcRng object management in prime generation would be
    simpler and better what it is now (in silcprimegen.c, that is)).
@@ -242,7 +266,7 @@ int silc_##pkcs##_verify(void *context, \
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_register(const SilcPKCSObject *pkcs);
+ *    SilcBool silc_pkcs_register(const SilcPKCSObject *pkcs);
  *
  * DESCRIPTION
  *
@@ -255,26 +279,26 @@ int silc_##pkcs##_verify(void *context, \
  *    builtin the sources.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_register(const SilcPKCSObject *pkcs);
+SilcBool silc_pkcs_register(const SilcPKCSObject *pkcs);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_unregister
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_unregister(SilcPKCSObject *pkcs);
+ *    SilcBool silc_pkcs_unregister(SilcPKCSObject *pkcs);
  *
  * DESCRIPTION
  *
  *    Unregister a PKCS from the SILC. Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_unregister(SilcPKCSObject *pkcs);
+SilcBool silc_pkcs_unregister(SilcPKCSObject *pkcs);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_register_default
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_register_default(void);
+ *    SilcBool silc_pkcs_register_default(void);
  *
  * DESCRIPTION
  *
@@ -283,34 +307,36 @@ bool silc_pkcs_unregister(SilcPKCSObject *pkcs);
  *    order is not wanted. Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_register_default(void);
+SilcBool silc_pkcs_register_default(void);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_unregister_all
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_unregister_all(void);
+ *    SilcBool silc_pkcs_unregister_all(void);
  *
  * DESCRIPTION
  *
  *    Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_unregister_all(void);
+SilcBool silc_pkcs_unregister_all(void);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_alloc
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_alloc(const unsigned char *name, SilcPKCS *new_pkcs);
+ *    SilcBool silc_pkcs_alloc(const unsigned char *name,
+ *                             SilcPKCSType type, SilcPKCS *new_pkcs);
  *
  * DESCRIPTION
  *
- *    Allocates a new SilcPKCS object. The new allocated object is returned
- *    to the 'new_pkcs' argument. Returns FALSE on error.
+ *    Allocates a new SilcPKCS object.  The new allocated object is returned
+ *    to the 'new_pkcs' argument.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_alloc(const unsigned char *name, SilcPKCS *new_pkcs);
+SilcBool silc_pkcs_alloc(const unsigned char *name,
+                        SilcPKCSType type, SilcPKCS *new_pkcs);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_free
  *
@@ -329,14 +355,14 @@ void silc_pkcs_free(SilcPKCS pkcs);
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_is_supported(const unsigned char *name);
+ *    SilcBool silc_pkcs_is_supported(const unsigned char *name);
  *
  * DESCRIPTION
  *
  *    Returns TRUE if PKCS algorithm `name' is supported.
  *
  ***/
-bool silc_pkcs_is_supported(const unsigned char *name);
+SilcBool silc_pkcs_is_supported(const unsigned char *name);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_get_supported
  *
@@ -355,16 +381,17 @@ char *silc_pkcs_get_supported(void);
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_generate_key(SilcPKCS pkcs, SilcUInt32 bits_key_len,
+ *    SilcBool silc_pkcs_generate_key(SilcPKCS pkcs, SilcUInt32 bits_key_len,
  *                               SilcRng rng);
  *
  * DESCRIPTION
  *
  *    Generate new key pair into the `pkcs' context. Returns FALSE on error.
+ *    If the `rng' is NULL global SILC RNG will be used.
  *
  ***/
-bool silc_pkcs_generate_key(SilcPKCS pkcs, SilcUInt32 bits_key_len,
-                           SilcRng rng);
+SilcBool silc_pkcs_generate_key(SilcPKCS pkcs, SilcUInt32 bits_key_len,
+                               SilcRng rng);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_get_key_len
  *
@@ -374,7 +401,7 @@ bool silc_pkcs_generate_key(SilcPKCS pkcs, SilcUInt32 bits_key_len,
  *
  * DESCRIPTION
  *
- *    Returns the length of the key.
+ *    Returns the length of the key in bits.
  *
  ***/
 SilcUInt32 silc_pkcs_get_key_len(SilcPKCS self);
@@ -400,8 +427,9 @@ const char *silc_pkcs_get_name(SilcPKCS pkcs);
  *
  * DESCRIPTION
  *
- *    Returns SILC style public key.  The caller must free the returned
- *    data.
+ *    Returns SILC style public key for the PKCS.  Note that this is not
+ *    the SILC Public Key, but the raw public key data from the PKCS.
+ *    The caller must free the returned data.
  *
  ***/
 unsigned char *silc_pkcs_get_public_key(SilcPKCS pkcs, SilcUInt32 *len);
@@ -411,12 +439,13 @@ unsigned char *silc_pkcs_get_public_key(SilcPKCS pkcs, SilcUInt32 *len);
  * SYNOPSIS
  *
  *    unsigned char *silc_pkcs_get_private_key(SilcPKCS pkcs,
- *                                            SilcUInt32 *len);
+ *                                             SilcUInt32 *len);
  *
  * DESCRIPTION
  *
- *    Returns SILC style private key.  The caller must free the returned
- *    data and SHOULD zero the memory area before freeing.
+ *    Returns SILC style private key.  Note that this is not SilcPrivateKey
+ *    but the raw private key bits from the PKCS.  The caller must free the
+ *    returned data and SHOULD zero the memory area before freeing.
  *
  ***/
 unsigned char *silc_pkcs_get_private_key(SilcPKCS pkcs, SilcUInt32 *len);
@@ -426,11 +455,12 @@ unsigned char *silc_pkcs_get_private_key(SilcPKCS pkcs, SilcUInt32 *len);
  * SYNOPSIS
  *
  *    SilcUInt32 silc_pkcs_public_key_set(SilcPKCS pkcs,
- *                                       SilcPublicKey public_key);
+ *                                        SilcPublicKey public_key);
  *
  * DESCRIPTION
  *
- *    Sets public key from SilcPublicKey. Returns the length of the key.
+ *    Sets public key from SilcPublicKey. Returns the length of the key in
+ *    bits.
  *
  ***/
 SilcUInt32 silc_pkcs_public_key_set(SilcPKCS pkcs, SilcPublicKey public_key);
@@ -441,7 +471,7 @@ SilcUInt32 silc_pkcs_public_key_set(SilcPKCS pkcs, SilcPublicKey public_key);
  *
  *    SilcUInt32 silc_pkcs_public_key_data_set(SilcPKCS pkcs,
  *                                             unsigned char *pk,
- *                                            SilcUInt32 pk_len);
+ *                                             SilcUInt32 pk_len);
  *
  * DESCRIPTION
  *
@@ -456,22 +486,24 @@ SilcUInt32 silc_pkcs_public_key_data_set(SilcPKCS pkcs, unsigned char *pk,
  * SYNOPSIS
  *
  *    SilcUInt32 silc_pkcs_private_key_set(SilcPKCS pkcs,
- *                                        SilcPrivateKey private_key);
+ *                                         SilcPrivateKey private_key);
  *
  * DESCRIPTION
  *
- *    Sets private key from SilcPrivateKey. Returns the length of the key.
+ *    Sets private key from SilcPrivateKey. Returns the length of the key
+ *    in bits.
  *
  ***/
-SilcUInt32 silc_pkcs_private_key_set(SilcPKCS pkcs, SilcPrivateKey private_key);
+SilcUInt32 silc_pkcs_private_key_set(SilcPKCS pkcs,
+                                    SilcPrivateKey private_key);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_private_key_data_set
  *
  * SYNOPSIS
  *
  *    SilcUInt32 silc_pkcs_private_key_data_set(SilcPKCS pkcs,
- *                                             unsigned char *prv,
- *                                             SilcUInt32 prv_len);
+ *                                              unsigned char *prv,
+ *                                              SilcUInt32 prv_len);
  *
  * DESCRIPTION
  *
@@ -485,114 +517,117 @@ SilcUInt32 silc_pkcs_private_key_data_set(SilcPKCS pkcs, unsigned char *prv,
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_encrypt(SilcPKCS pkcs, unsigned char *src,
- *                          SilcUInt32 src_len, unsigned char *dst,
- *                          SilcUInt32 *dst_len);
+ *    SilcBool silc_pkcs_encrypt(SilcPKCS pkcs, unsigned char *src,
+ *                           SilcUInt32 src_len, unsigned char *dst,
+ *                           SilcUInt32 *dst_len);
  *
  * DESCRIPTION
  *
  *    Encrypts. Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_encrypt(SilcPKCS pkcs, unsigned char *src, SilcUInt32 src_len,
-                      unsigned char *dst, SilcUInt32 *dst_len);
+SilcBool silc_pkcs_encrypt(SilcPKCS pkcs, unsigned char *src,
+                          SilcUInt32 src_len,
+                          unsigned char *dst, SilcUInt32 *dst_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_decrypt
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_decrypt(SilcPKCS pkcs, unsigned char *src,
- *                          SilcUInt32 src_len, unsigned char *dst,
- *                          SilcUInt32 *dst_len);
+ *    SilcBool silc_pkcs_decrypt(SilcPKCS pkcs, unsigned char *src,
+ *                           SilcUInt32 src_len, unsigned char *dst,
+ *                           SilcUInt32 *dst_len);
  *
  * DESCRIPTION
  *
- *    Decrypts. Returns FALSE on error.
+ *    Decrypts.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_decrypt(SilcPKCS pkcs, unsigned char *src, SilcUInt32 src_len,
-                      unsigned char *dst, SilcUInt32 *dst_len);
+SilcBool silc_pkcs_decrypt(SilcPKCS pkcs, unsigned char *src,
+                          SilcUInt32 src_len,
+                          unsigned char *dst, SilcUInt32 *dst_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_sign
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_sign(SilcPKCS pkcs, unsigned char *src,
- *                       SilcUInt32 src_len, unsigned char *dst,
- *                       SilcUInt32 *dst_len);
+ *    SilcBool silc_pkcs_sign(SilcPKCS pkcs, unsigned char *src,
+ *                        SilcUInt32 src_len, unsigned char *dst,
+ *                        SilcUInt32 *dst_len);
  *
  * DESCRIPTION
  *
- *    Generates signature. Returns FALSE on error.
+ *    Generates signature.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_sign(SilcPKCS pkcs, unsigned char *src, SilcUInt32 src_len,
-                   unsigned char *dst, SilcUInt32 *dst_len);
+SilcBool silc_pkcs_sign(SilcPKCS pkcs, unsigned char *src, SilcUInt32 src_len,
+                       unsigned char *dst, SilcUInt32 *dst_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_verify
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_verify(SilcPKCS pkcs, unsigned char *signature,
- *                         SilcUInt32 signature_len, unsigned char *data,
- *                         SilcUInt32 data_len);
+ *    SilcBool silc_pkcs_verify(SilcPKCS pkcs, unsigned char *signature,
+ *                          SilcUInt32 signature_len, unsigned char *data,
+ *                          SilcUInt32 data_len);
  *
  * DESCRIPTION
  *
- *    Verifies signature. Returns FALSE on error.
+ *    Verifies signature.  Returns FALSE on error.  The 'signature' is
+ *    verified against the 'data'.
  *
  ***/
-bool silc_pkcs_verify(SilcPKCS pkcs, unsigned char *signature,
-                     SilcUInt32 signature_len, unsigned char *data,
-                     SilcUInt32 data_len);
+SilcBool silc_pkcs_verify(SilcPKCS pkcs, unsigned char *signature,
+                         SilcUInt32 signature_len, unsigned char *data,
+                         SilcUInt32 data_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_sign_with_hash
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_sign_with_hash(SilcPKCS pkcs, SilcHash hash,
- *                                 unsigned char *src, SilcUInt32 src_len,
- *                                 unsigned char *dst, SilcUInt32 *dst_len);
+ *    SilcBool silc_pkcs_sign_with_hash(SilcPKCS pkcs, SilcHash hash,
+ *                                  unsigned char *src, SilcUInt32 src_len,
+ *                                  unsigned char *dst, SilcUInt32 *dst_len);
  *
  * DESCRIPTION
  *
- *    Generates signature with hash. The hash is signed. Returns FALSE on
+ *    Generates signature with hash.  The hash is signed.  Returns FALSE on
  *    error.
  *
  ***/
-bool silc_pkcs_sign_with_hash(SilcPKCS pkcs, SilcHash hash,
-                             unsigned char *src, SilcUInt32 src_len,
-                             unsigned char *dst, SilcUInt32 *dst_len);
+SilcBool silc_pkcs_sign_with_hash(SilcPKCS pkcs, SilcHash hash,
+                                 unsigned char *src, SilcUInt32 src_len,
+                                 unsigned char *dst, SilcUInt32 *dst_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_verify_with_hash
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_verify_with_hash(SilcPKCS pkcs, SilcHash hash,
- *                                   unsigned char *signature,
- *                                   SilcUInt32 signature_len,
- *                                   unsigned char *data,
- *                                   SilcUInt32 data_len);
+ *    SilcBool silc_pkcs_verify_with_hash(SilcPKCS pkcs, SilcHash hash,
+ *                                    unsigned char *signature,
+ *                                    SilcUInt32 signature_len,
+ *                                    unsigned char *data,
+ *                                    SilcUInt32 data_len);
  *
  * DESCRIPTION
  *
- *    Verifies signature with hash. The `data' is hashed and verified against
- *    the `signature'. Returns FALSE on error.
+ *    Verifies signature with hash.  The `data' is hashed and verified against
+ *    the `signature'.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_verify_with_hash(SilcPKCS pkcs, SilcHash hash,
-                               unsigned char *signature,
-                               SilcUInt32 signature_len,
-                               unsigned char *data,
-                               SilcUInt32 data_len);
+SilcBool silc_pkcs_verify_with_hash(SilcPKCS pkcs, SilcHash hash,
+                                   unsigned char *signature,
+                                   SilcUInt32 signature_len,
+                                   unsigned char *data,
+                                   SilcUInt32 data_len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_encode_identifier
  *
  * SYNOPSIS
  *
  *    char *silc_pkcs_encode_identifier(char *username, char *host,
- *                                     char *realname, char *email,
- *                                     char *org, char *country);
+ *                                      char *realname, char *email,
+ *                                      char *org, char *country);
  *
  * DESCRIPTION
  *
@@ -626,7 +661,7 @@ SilcPublicKeyIdentifier silc_pkcs_decode_identifier(char *identifier);
  *
  * DESCRIPTION
  *
- *    Frees decoded public key identifier context. Call this to free the
+ *    Frees decoded public key identifier context.  Call this to free the
  *    context returned by the silc_pkcs_decode_identifier.
  *
  ***/
@@ -637,14 +672,17 @@ void silc_pkcs_free_identifier(SilcPublicKeyIdentifier identifier);
  * SYNOPSIS
  *
  *    SilcPublicKey silc_pkcs_public_key_alloc(const char *name,
- *                                            const char *identifier,
- *                                            const unsigned char *pk,
- *                                            SilcUInt32 pk_len);
+ *                                             const char *identifier,
+ *                                             const unsigned char *pk,
+ *                                             SilcUInt32 pk_len);
  *
  * DESCRIPTION
  *
- *    Allocates SILC style public key formed from sent arguments. All data
- *    is duplicated.
+ *    Allocates SILC style public key formed from sent arguments.  The
+ *    'name' is the algorithm (PKCS) name, the 'identifier' is the public
+ *    key identifier generated with silc_pkcs_encode_identifier, and the
+ *    'pk' and 'pk_len' are the raw public key data returned for example
+ *    by silc_pkcs_get_public_key.
  *
  ***/
 SilcPublicKey silc_pkcs_public_key_alloc(const char *name,
@@ -660,7 +698,7 @@ SilcPublicKey silc_pkcs_public_key_alloc(const char *name,
  *
  * DESCRIPTION
  *
- *    Frees public key.
+ *    Frees public key and all data in it.
  *
  ***/
 void silc_pkcs_public_key_free(SilcPublicKey public_key);
@@ -670,13 +708,14 @@ void silc_pkcs_public_key_free(SilcPublicKey public_key);
  * SYNOPSIS
  *
  *    SilcPrivateKey silc_pkcs_private_key_alloc(const char *name,
- *                                              const unsigned char *prv,
- *                                              SilcUInt32 prv_len);
+ *                                               const unsigned char *prv,
+ *                                               SilcUInt32 prv_len);
  *
  * DESCRIPTION
  *
- *    Allocates SILC private key formed from sent arguments. All data is
- *    duplicated.
+ *    Allocates SILC private key formed from sent arguments.  The 'name'
+ *    is the algorithm name, and the 'prv' and 'prv_len' are the raw
+ *    private key bits returned by silc_pkcs_get_private_key.
  *
  ***/
 SilcPrivateKey silc_pkcs_private_key_alloc(const char *name,
@@ -691,7 +730,8 @@ SilcPrivateKey silc_pkcs_private_key_alloc(const char *name,
  *
  * DESCRIPTION
  *
- *    Frees private key.
+ *    Frees private key and all data in it.  The private key is zeroed
+ *    before it is freed.
  *
  ***/
 void silc_pkcs_private_key_free(SilcPrivateKey private_key);
@@ -705,7 +745,7 @@ void silc_pkcs_private_key_free(SilcPrivateKey private_key);
  *
  * DESCRIPTION
  *
- *    Encodes SILC style public key from SilcPublicKey. Returns the encoded
+ *    Encodes SILC style public key from SilcPublicKey.  Returns the encoded
  *    data.
  *
  ***/
@@ -718,24 +758,24 @@ silc_pkcs_public_key_encode(SilcPublicKey public_key, SilcUInt32 *len);
  *
  *    unsigned char *
  *    silc_pkcs_public_key_data_encode(unsigned char *pk, SilcUInt32 pk_len,
- *                                    char *pkcs, char *identifier,
- *                                    SilcUInt32 *len);
+ *                                     char *pkcs, char *identifier,
+ *                                     SilcUInt32 *len);
  *
  * DESCRIPTION
  *
- *    Encodes SILC style public key. Returns the encoded data.
+ *    Encodes SILC style public key.  Returns the encoded data.
  *
  ***/
 unsigned char *
 silc_pkcs_public_key_data_encode(unsigned char *pk, SilcUInt32 pk_len,
-                                char *pkcs, char *identifier,
-                                SilcUInt32 *len);
+                                 char *pkcs, char *identifier,
+                                 SilcUInt32 *len);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_decode
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_public_key_decode(unsigned char *data,
+ *    SilcBool silc_pkcs_public_key_decode(unsigned char *data,
  *                                     SilcUInt32 data_len,
  *                                     SilcPublicKey *public_key);
  *
@@ -745,14 +785,14 @@ silc_pkcs_public_key_data_encode(unsigned char *pk, SilcUInt32 pk_len,
  *    successful. Allocates new public key as well.
  *
  ***/
-bool silc_pkcs_public_key_decode(unsigned char *data, SilcUInt32 data_len,
+SilcBool silc_pkcs_public_key_decode(unsigned char *data, SilcUInt32 data_len,
                                 SilcPublicKey *public_key);
 
-/****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_decode
+/****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_payload_encode
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_public_key_payload_encode(SilcPublicKey public_key);
+ *    SilcBool silc_pkcs_public_key_payload_encode(SilcPublicKey public_key);
  *
  * DESCRIPTION
  *
@@ -763,23 +803,22 @@ bool silc_pkcs_public_key_decode(unsigned char *data, SilcUInt32 data_len,
  ***/
 SilcBuffer silc_pkcs_public_key_payload_encode(SilcPublicKey public_key);
 
-/****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_decode
+/****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_payload_decode
  *
  * SYNOPSIS
  *
- *    bool
- *    silc_pkcs_public_key_payload_decode(unsigned char *data,
- *                                        SilcUInt32 data_len,
- *                                        SilcPublicKey *public_key);
+ *    SilcBool silc_pkcs_public_key_payload_decode(unsigned char *data,
+ *                                             SilcUInt32 data_len,
+ *                                             SilcPublicKey *public_key);
  *
  * DESCRIPTION
  *
  *    Decodes Public Key Payload from `data' of `data_len' bytes in length
- *    data buffer into `public_key' pointer. Returns FALSE if the payload
+ *    data buffer into `public_key' pointer.  Returns FALSE if the payload
  *    cannot be decoded.
  *
  ***/
-bool silc_pkcs_public_key_payload_decode(unsigned char *data,
+SilcBool silc_pkcs_public_key_payload_decode(unsigned char *data,
                                         SilcUInt32 data_len,
                                         SilcPublicKey *public_key);
 
@@ -787,8 +826,8 @@ bool silc_pkcs_public_key_payload_decode(unsigned char *data,
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_public_key_compare(SilcPublicKey key1,
- *                                     SilcPublicKey key2);
+ *    SilcBool silc_pkcs_public_key_compare(SilcPublicKey key1,
+ *                                      SilcPublicKey key2);
  *
  * DESCRIPTION
  *
@@ -796,7 +835,7 @@ bool silc_pkcs_public_key_payload_decode(unsigned char *data,
  *    FALSE if they are not same.
  *
  ***/
-bool silc_pkcs_public_key_compare(SilcPublicKey key1, SilcPublicKey key2);
+SilcBool silc_pkcs_public_key_compare(SilcPublicKey key1, SilcPublicKey key2);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_public_key_copy
  *
@@ -818,11 +857,11 @@ SilcPublicKey silc_pkcs_public_key_copy(SilcPublicKey public_key);
  *
  *    unsigned char *
  *    silc_pkcs_private_key_encode(SilcPrivateKey private_key,
- *                                SilcUInt32 *len);
+ *                                 SilcUInt32 *len);
  *
  * DESCRIPTION
  *
- *    Encodes SILC private key from SilcPrivateKey. Returns the encoded data.
+ *    Encodes SILC private key from SilcPrivateKey.  Returns the encoded data.
  *
  ***/
 unsigned char *
@@ -834,11 +873,11 @@ silc_pkcs_private_key_encode(SilcPrivateKey private_key, SilcUInt32 *len);
  *
  *    unsigned char *
  *    silc_pkcs_private_key_data_encode(unsigned char *prv, SilcUInt32 prv_len,
- *                                     char *pkcs, SilcUInt32 *len);
+ *                                      char *pkcs, SilcUInt32 *len);
  *
  * DESCRIPTION
  *
- *    Encodes SILC private key. Returns the encoded data.
+ *    Encodes SILC private key.  Returns the encoded data.
  *
  ***/
 unsigned char *
@@ -849,41 +888,43 @@ silc_pkcs_private_key_data_encode(unsigned char *prv, SilcUInt32 prv_len,
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_private_key_decode(unsigned char *data,
- *                                     SilcUInt32 data_len,
- *                                     SilcPrivateKey *private_key);
+ *    SilcBool silc_pkcs_private_key_decode(unsigned char *data,
+ *                                      SilcUInt32 data_len,
+ *                                      SilcPrivateKey *private_key);
  *
  * DESCRIPTION
  *
- *    Decodes SILC style private key. Returns TRUE if the decoding was
- *    successful. Allocates new private key as well.
+ *    Decodes SILC style private key.  Returns TRUE if the decoding was
+ *    successful.  Allocates new private key as well.
  *
  ***/
-bool silc_pkcs_private_key_decode(unsigned char *data, SilcUInt32 data_len,
+SilcBool silc_pkcs_private_key_decode(unsigned char *data, SilcUInt32 data_len,
                                  SilcPrivateKey *private_key);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_save_public_key
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_save_public_key(char *filename, SilcPublicKey public_key,
- *                                  SilcUInt32 encoding);
+ *    SilcBool silc_pkcs_save_public_key(const char *filename,
+ *                                   SilcPublicKey public_key,
+ *                                   SilcUInt32 encoding);
  *
  * DESCRIPTION
  *
- *    Saves public key into file. Returns FALSE on error.
+ *    Saves public key into file.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_save_public_key(char *filename, SilcPublicKey public_key,
+SilcBool silc_pkcs_save_public_key(const char *filename, SilcPublicKey public_key,
                               SilcUInt32 encoding);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_save_public_key_data
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_save_public_key_data(char *filename, unsigned char *data,
- *                                       SilcUInt32 data_len,
- *                                       SilcUInt32 encoding);
+ *    SilcBool silc_pkcs_save_public_key_data(const char *filename,
+ *                                        unsigned char *data,
+ *                                        SilcUInt32 data_len,
+ *                                        SilcUInt32 encoding);
  *
  * DESCRIPTION
  *
@@ -891,16 +932,15 @@ bool silc_pkcs_save_public_key(char *filename, SilcPublicKey public_key,
  *    data when calling this function.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_save_public_key_data(char *filename, unsigned char *data,
-                                   SilcUInt32 data_len,
-                                   SilcUInt32 encoding);
+SilcBool silc_pkcs_save_public_key_data(const char *filename, unsigned char *data,
+                                   SilcUInt32 data_len, SilcUInt32 encoding);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_save_private_key
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_save_private_key(char *filename,
- *                                   SilcPrivateKey private_key,
+ *    SilcBool silc_pkcs_save_private_key(const char *filename,
+ *                                    SilcPrivateKey private_key,
  *                                    unsigned char *passphrase,
  *                                    SilcUInt32 passphrase_len,
  *                                    SilcUInt32 encoding);
@@ -912,7 +952,8 @@ bool silc_pkcs_save_public_key_data(char *filename, unsigned char *data,
  *    is AES with 256 bit key in CBC mode.  Returns FALSE on error.
  *
  ***/
-bool silc_pkcs_save_private_key(char *filename, SilcPrivateKey private_key, 
+SilcBool silc_pkcs_save_private_key(const char *filename,
+                               SilcPrivateKey private_key,
                                unsigned char *passphrase,
                                SilcUInt32 passphrase_len,
                                SilcUInt32 encoding);
@@ -921,23 +962,24 @@ bool silc_pkcs_save_private_key(char *filename, SilcPrivateKey private_key,
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_load_public_key(char *filename, SilcPublicKey *public_key,
- *                                  SilcUInt32 encoding);
+ *    SilcBool silc_pkcs_load_public_key(const char *filename,
+ *                                   SilcPublicKey *public_key,
+ *                                   SilcUInt32 encoding);
  *
  * DESCRIPTION
  *
- *    Loads public key from file and allocates new public key. Returns TRUE
+ *    Loads public key from file and allocates new public key.  Returns TRUE
  *    if loading was successful.
  *
  ***/
-bool silc_pkcs_load_public_key(char *filename, SilcPublicKey *public_key,
+SilcBool silc_pkcs_load_public_key(const char *filename, SilcPublicKey *public_key,
                               SilcUInt32 encoding);
 
 /****f* silccrypt/SilcPKCSAPI/silc_pkcs_load_private_key
  *
  * SYNOPSIS
  *
- *    bool silc_pkcs_load_private_key(char *filename,
+ *    SilcBool silc_pkcs_load_private_key(const char *filename,
  *                                    SilcPrivateKey *private_key,
  *                                    unsigned char *passphrase,
  *                                    SilcUInt32 passphrase_len,
@@ -945,14 +987,15 @@ bool silc_pkcs_load_public_key(char *filename, SilcPublicKey *public_key,
  *
  * DESCRIPTION
  *
- *    Load private key from file and allocates new private key. Returns TRUE
- *    if loading was successful. The `passphrase' is used as decryption
+ *    Loads private key from file and allocates new private key.  Returns TRUE
+ *    if loading was successful.  The `passphrase' is used as decryption
  *    key of the private key file.
  *
  ***/
-bool silc_pkcs_load_private_key(char *filename, SilcPrivateKey *private_key,
+SilcBool silc_pkcs_load_private_key(const char *filename,
+                               SilcPrivateKey *private_key,
                                unsigned char *passphrase,
                                SilcUInt32 passphrase_len,
                                SilcUInt32 encoding);
 
-#endif /* SILCPKCS_H */
+#endif /* !SILCPKCS_H */