MYCertificate now checks validity of self-signed certs loaded from the keychain (because the Security framework doesn't validate self-signed certs.)
5 // Created by Jens Alfke on 3/25/09.
6 // Copyright 2009 Jens Alfke. All rights reserved.
10 @class MYSHA1Digest, MYSymmetricKey, MYCertificate;
13 #import <Security/SecKey.h>
17 /** A public key, which can be used for encrypting data and verifying signatures.
18 MYPublicKeys are created as part of generating a key-pair,
19 or by being imported from data into a MYKeychain. */
20 @interface MYPublicKey : MYKey
23 MYSHA1Digest *_digest; // The key's SHA-1 digest (null if not determined yet)
24 MYCertificate *_certificate; // The cert this key came from (if any)
27 /** The public key's SHA-1 digest. This is a convenient short (20-byte) identifier for the key. */
28 @property (readonly) MYSHA1Digest *publicKeyDigest;
30 /** Encrypts a short piece of data using this key, returning the raw encrypted result.
31 An RSA key can encrypt only blocks smaller than its own key size; this
32 method will fail and return nil if the data is too long.
33 RSA encryption is also much slower than regular symmetric-key encryption, so the correct
34 way to encrypt a large block of data using a public key is to first generate a random
35 symmetric key, called the "session key" (using a Cryptor), encrypt that session key with the
36 public key, and then encrypt your data with the session key. Send the encrypted session key
37 and the encrypted data. */
38 - (NSData*) rawEncryptData: (NSData*)data;
40 /** Verifies the signature of a block of data. If the result is YES, you can be assured that
41 the signature was generated from the data by using this key's matching private key.
42 If the result is NO, something is wrong: either the data or the signature was modified,
43 or the signature was generated by a different private key.
44 (What's actually verified using RSA is the SHA-256 digest of the data.) */
45 - (BOOL) verifySignature: (NSData*)signature ofData: (NSData*)data;
53 /** Initializes a public key directly from its raw RSA modulus and exponent.
54 These numbers must come from an existing key-pair generated by the RSA algorithm;
55 you CANNOT just pass in random data and create a working key! (To create a new key pair,
56 call -[MYKeychain generateRSAKeyPairOfSize:].)
57 @param modulus RSA modulus, a very large integer represented as a blob of big-endian data.
58 @param exponent RSA exponent, a prime number, commonly 17 or 65537.
60 - (id) initWithModulus: (NSData*)modulus exponent: (unsigned)exponent;
62 /** Retrieves the raw RSA modulus and exponent, which together uniquely specify the key.
63 The length of the modulus is the size, in bits, of the key: for example, a 2048-bit key
64 has 256 bytes of modulus data.
65 @param outModulus On return, will contain the modulus: a very large positive integer represented
66 as a blob of unsigned big-endian data.
67 @param outExponent On return, will contain the exponent: a prime number, often 17 or 65537. */
68 - (BOOL) getModulus: (NSData**)outModulus exponent: (unsigned*)outExponent;
72 /** Encrypts a session key using this public key.
73 The holder of the private key can then unwrap the session key from this data.
74 @param sessionKey The symmetric session key to wrap/encrypt
75 @return The encrypted data representing the session key */
76 - (NSData*) wrapSessionKey: (MYSymmetricKey*)sessionKey;