Adding upstream version 115.8.0esr.upstream/115.8.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

30 files changed, 10714 insertions, 0 deletions

diff --git a/security/nss/lib/crmf/Makefile b/security/nss/lib/crmf/Makefile
new file mode 100644
index 0000000000..609d4adefe
--- /dev/null
+++ b/security/nss/lib/crmf/Makefile
@@ -0,0 +1,46 @@
+#! gmake
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+#######################################################################
+# (1) Include initial platform-independent assignments (MANDATORY).   #
+#######################################################################
+
+include manifest.mn
+
+#######################################################################
+# (2) Include "global" configuration information. (OPTIONAL)          #
+#######################################################################
+
+include $(CORE_DEPTH)/coreconf/config.mk
+
+#######################################################################
+# (3) Include "component" configuration information. (OPTIONAL)       #
+#######################################################################
+
+
+
+#######################################################################
+# (4) Include "local" platform-dependent assignments (OPTIONAL).      #
+#######################################################################
+
+#######################################################################
+# (5) Execute "global" rules. (OPTIONAL)                              #
+#######################################################################
+
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+#######################################################################
+# (6) Execute "component" rules. (OPTIONAL)                           #
+#######################################################################
+
+
+
+#######################################################################
+# (7) Execute "local" rules. (OPTIONAL).                              #
+#######################################################################
+
+
diff --git a/security/nss/lib/crmf/asn1cmn.c b/security/nss/lib/crmf/asn1cmn.c
new file mode 100644
index 0000000000..6cf469fb4c
--- /dev/null
+++ b/security/nss/lib/crmf/asn1cmn.c
@@ -0,0 +1,216 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+SEC_ASN1_MKSUB(SEC_AnyTemplate)
+SEC_ASN1_MKSUB(SEC_IntegerTemplate)
+SEC_ASN1_MKSUB(SEC_SignedCertificateTemplate)
+
+static const SEC_ASN1Template CMMFCertResponseTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFCertResponse) },
+    { SEC_ASN1_INTEGER, offsetof(CMMFCertResponse, certReqId) },
+    { SEC_ASN1_INLINE, offsetof(CMMFCertResponse, status),
+      CMMFPKIStatusInfoTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_POINTER,
+      offsetof(CMMFCertResponse, certifiedKeyPair),
+      CMMFCertifiedKeyPairTemplate },
+    { 0 }
+};
+
+static const SEC_ASN1Template CMMFCertOrEncCertTemplate[] = {
+    { SEC_ASN1_ANY, offsetof(CMMFCertOrEncCert, derValue), NULL,
+      sizeof(CMMFCertOrEncCert) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFCertifiedKeyPairTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFCertifiedKeyPair) },
+    { SEC_ASN1_INLINE, offsetof(CMMFCertifiedKeyPair, certOrEncCert),
+      CMMFCertOrEncCertTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER | 0,
+      offsetof(CMMFCertifiedKeyPair, privateKey),
+      CRMFEncryptedValueTemplate },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
+          SEC_ASN1_XTRN | 1,
+      offsetof(CMMFCertifiedKeyPair, derPublicationInfo),
+      SEC_ASN1_SUB(SEC_AnyTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFPKIStatusInfoTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFPKIStatusInfo) },
+    { SEC_ASN1_INTEGER, offsetof(CMMFPKIStatusInfo, status) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_UTF8_STRING,
+      offsetof(CMMFPKIStatusInfo, statusString) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_BIT_STRING,
+      offsetof(CMMFPKIStatusInfo, failInfo) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFSequenceOfCertsTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN, 0,
+      SEC_ASN1_SUB(SEC_SignedCertificateTemplate) }
+};
+
+const SEC_ASN1Template CMMFRandTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFRand) },
+    { SEC_ASN1_INTEGER, offsetof(CMMFRand, integer) },
+    { SEC_ASN1_OCTET_STRING, offsetof(CMMFRand, senderHash) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFPOPODecKeyRespContentTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN,
+      offsetof(CMMFPOPODecKeyRespContent, responses),
+      SEC_ASN1_SUB(SEC_IntegerTemplate),
+      sizeof(CMMFPOPODecKeyRespContent) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFCertOrEncCertEncryptedCertTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | 1,
+      0,
+      CRMFEncryptedValueTemplate },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFCertOrEncCertCertificateTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+      0,
+      SEC_ASN1_SUB(SEC_SignedCertificateTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFCertRepContentTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFCertRepContent) },
+    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_OPTIONAL |
+          SEC_ASN1_CONTEXT_SPECIFIC | 1,
+      offsetof(CMMFCertRepContent, caPubs),
+      CMMFSequenceOfCertsTemplate },
+    { SEC_ASN1_SEQUENCE_OF, offsetof(CMMFCertRepContent, response),
+      CMMFCertResponseTemplate },
+    { 0 }
+};
+
+static const SEC_ASN1Template CMMFChallengeTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFChallenge) },
+    { SEC_ASN1_POINTER | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN,
+      offsetof(CMMFChallenge, owf),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_OCTET_STRING, offsetof(CMMFChallenge, witness) },
+    { SEC_ASN1_ANY, offsetof(CMMFChallenge, senderDER) },
+    { SEC_ASN1_OCTET_STRING, offsetof(CMMFChallenge, key) },
+    { SEC_ASN1_OCTET_STRING, offsetof(CMMFChallenge, challenge) },
+    { 0 }
+};
+
+const SEC_ASN1Template CMMFPOPODecKeyChallContentTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF, offsetof(CMMFPOPODecKeyChallContent, challenges),
+      CMMFChallengeTemplate, sizeof(CMMFPOPODecKeyChallContent) },
+    { 0 }
+};
+
+SECStatus
+cmmf_decode_process_cert_response(PLArenaPool *poolp,
+                                  CERTCertDBHandle *db,
+                                  CMMFCertResponse *inCertResp)
+{
+    SECStatus rv = SECSuccess;
+
+    if (inCertResp->certifiedKeyPair != NULL) {
+        rv = cmmf_decode_process_certified_key_pair(poolp,
+                                                    db,
+                                                    inCertResp->certifiedKeyPair);
+    }
+    return rv;
+}
+
+static CERTCertificate *
+cmmf_DecodeDERCertificate(CERTCertDBHandle *db, SECItem *derCert)
+{
+    CERTCertificate *newCert;
+
+    newCert = CERT_NewTempCertificate(db, derCert, NULL, PR_FALSE, PR_TRUE);
+    return newCert;
+}
+
+static CMMFCertOrEncCertChoice
+cmmf_get_certorenccertchoice_from_der(SECItem *der)
+{
+    CMMFCertOrEncCertChoice retChoice;
+
+    switch (der->data[0] & 0x0f) {
+        case 0:
+            retChoice = cmmfCertificate;
+            break;
+        case 1:
+            retChoice = cmmfEncryptedCert;
+            break;
+        default:
+            retChoice = cmmfNoCertOrEncCert;
+            break;
+    }
+    return retChoice;
+}
+
+static SECStatus
+cmmf_decode_process_certorenccert(PLArenaPool *poolp,
+                                  CERTCertDBHandle *db,
+                                  CMMFCertOrEncCert *inCertOrEncCert)
+{
+    SECStatus rv = SECSuccess;
+
+    inCertOrEncCert->choice =
+        cmmf_get_certorenccertchoice_from_der(&inCertOrEncCert->derValue);
+
+    switch (inCertOrEncCert->choice) {
+        case cmmfCertificate: {
+            /* The DER has implicit tagging, so we gotta switch it to
+             * un-tagged in order for the ASN1 parser to understand it.
+             * Saving the bits that were changed.
+             */
+            inCertOrEncCert->derValue.data[0] = 0x30;
+            inCertOrEncCert->cert.certificate =
+                cmmf_DecodeDERCertificate(db, &inCertOrEncCert->derValue);
+            if (inCertOrEncCert->cert.certificate == NULL) {
+                rv = SECFailure;
+            }
+
+        } break;
+        case cmmfEncryptedCert:
+            PORT_Assert(poolp);
+            if (!poolp) {
+                PORT_SetError(SEC_ERROR_INVALID_ARGS);
+                rv = SECFailure;
+                break;
+            }
+            inCertOrEncCert->cert.encryptedCert =
+                PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+            if (inCertOrEncCert->cert.encryptedCert == NULL) {
+                rv = SECFailure;
+                break;
+            }
+            rv = SEC_ASN1Decode(poolp, inCertOrEncCert->cert.encryptedCert,
+                                CMMFCertOrEncCertEncryptedCertTemplate,
+                                (const char *)inCertOrEncCert->derValue.data,
+                                inCertOrEncCert->derValue.len);
+            break;
+        default:
+            rv = SECFailure;
+    }
+    return rv;
+}
+
+SECStatus
+cmmf_decode_process_certified_key_pair(PLArenaPool *poolp,
+                                       CERTCertDBHandle *db,
+                                       CMMFCertifiedKeyPair *inCertKeyPair)
+{
+    return cmmf_decode_process_certorenccert(poolp,
+                                             db,
+                                             &inCertKeyPair->certOrEncCert);
+}
diff --git a/security/nss/lib/crmf/challcli.c b/security/nss/lib/crmf/challcli.c
new file mode 100644
index 0000000000..a928438948
--- /dev/null
+++ b/security/nss/lib/crmf/challcli.c
@@ -0,0 +1,238 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "secitem.h"
+#include "pk11func.h"
+#include "secder.h"
+#include "sechash.h"
+
+CMMFPOPODecKeyChallContent *
+CMMF_CreatePOPODecKeyChallContentFromDER(const char *buf, long len)
+{
+    PLArenaPool *poolp;
+    CMMFPOPODecKeyChallContent *challContent;
+    SECStatus rv;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    challContent = PORT_ArenaZNew(poolp, CMMFPOPODecKeyChallContent);
+    if (challContent == NULL) {
+        goto loser;
+    }
+    challContent->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, challContent,
+                        CMMFPOPODecKeyChallContentTemplate, buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (challContent->challenges) {
+        while (challContent->challenges[challContent->numChallenges] != NULL) {
+            challContent->numChallenges++;
+        }
+        challContent->numAllocated = challContent->numChallenges;
+    }
+    return challContent;
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+int
+CMMF_POPODecKeyChallContentGetNumChallenges(CMMFPOPODecKeyChallContent *inKeyChallCont)
+{
+    PORT_Assert(inKeyChallCont != NULL);
+    if (inKeyChallCont == NULL) {
+        return 0;
+    }
+    return inKeyChallCont->numChallenges;
+}
+
+SECItem *
+CMMF_POPODecKeyChallContentGetPublicValue(CMMFPOPODecKeyChallContent *inKeyChallCont,
+                                          int inIndex)
+{
+    PORT_Assert(inKeyChallCont != NULL);
+    if (inKeyChallCont == NULL || (inIndex > inKeyChallCont->numChallenges - 1) ||
+        inIndex < 0) {
+        return NULL;
+    }
+    return SECITEM_DupItem(&inKeyChallCont->challenges[inIndex]->key);
+}
+
+static SECAlgorithmID *
+cmmf_get_owf(CMMFPOPODecKeyChallContent *inChalCont,
+             int inIndex)
+{
+    int i;
+
+    for (i = inIndex; i >= 0; i--) {
+        if (inChalCont->challenges[i]->owf != NULL) {
+            return inChalCont->challenges[i]->owf;
+        }
+    }
+    return NULL;
+}
+
+SECStatus
+CMMF_POPODecKeyChallContDecryptChallenge(CMMFPOPODecKeyChallContent *inChalCont,
+                                         int inIndex,
+                                         SECKEYPrivateKey *inPrivKey)
+{
+    CMMFChallenge *challenge;
+    SECItem *decryptedRand = NULL;
+    PLArenaPool *poolp = NULL;
+    SECAlgorithmID *owf;
+    SECStatus rv = SECFailure;
+    SECOidTag tag;
+    CMMFRand randStr;
+    SECItem hashItem;
+    unsigned char hash[HASH_LENGTH_MAX];
+
+    PORT_Assert(inChalCont != NULL && inPrivKey != NULL);
+    if (inChalCont == NULL || inIndex < 0 || inIndex > inChalCont->numChallenges ||
+        inPrivKey == NULL) {
+        return SECFailure;
+    }
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+
+    challenge = inChalCont->challenges[inIndex];
+    decryptedRand = SECITEM_AllocItem(poolp, NULL, challenge->challenge.len);
+    if (decryptedRand == NULL) {
+        goto loser;
+    }
+    rv = PK11_PrivDecryptPKCS1(inPrivKey, decryptedRand->data,
+                               &decryptedRand->len, decryptedRand->len,
+                               challenge->challenge.data, challenge->challenge.len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = SEC_ASN1DecodeItem(poolp, &randStr, CMMFRandTemplate,
+                            decryptedRand);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SECFailure; /* Just so that when we do go to loser,
+                      * I won't have to set it again.
+                      */
+    owf = cmmf_get_owf(inChalCont, inIndex);
+    if (owf == NULL) {
+        /* No hashing algorithm came with the challenges.  Can't verify */
+        goto loser;
+    }
+    /* Verify the hashes in the challenge */
+    tag = SECOID_FindOIDTag(&owf->algorithm);
+    hashItem.len = HASH_ResultLenByOidTag(tag);
+    if (!hashItem.len)
+        goto loser; /* error code has been set */
+
+    rv = PK11_HashBuf(tag, hash, randStr.integer.data, randStr.integer.len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    hashItem.data = hash;
+    if (SECITEM_CompareItem(&hashItem, &challenge->witness) != SECEqual) {
+        /* The hash for the data we decrypted doesn't match the hash provided
+         * in the challenge.  Bail out.
+         */
+        PORT_SetError(SEC_ERROR_BAD_DATA);
+        rv = SECFailure;
+        goto loser;
+    }
+    rv = PK11_HashBuf(tag, hash, challenge->senderDER.data,
+                      challenge->senderDER.len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (SECITEM_CompareItem(&hashItem, &randStr.senderHash) != SECEqual) {
+        /* The hash for the data we decrypted doesn't match the hash provided
+         * in the challenge.  Bail out.
+         */
+        PORT_SetError(SEC_ERROR_BAD_DATA);
+        rv = SECFailure;
+        goto loser;
+    }
+    /* All of the hashes have verified, so we can now store the integer away.*/
+    rv = SECITEM_CopyItem(inChalCont->poolp, &challenge->randomNumber,
+                          &randStr.integer);
+loser:
+    if (poolp) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return rv;
+}
+
+SECStatus
+CMMF_POPODecKeyChallContentGetRandomNumber(CMMFPOPODecKeyChallContent *inKeyChallCont,
+                                           int inIndex,
+                                           long *inDest)
+{
+    CMMFChallenge *challenge;
+
+    PORT_Assert(inKeyChallCont != NULL);
+    if (inKeyChallCont == NULL || inIndex > 0 || inIndex >= inKeyChallCont->numChallenges) {
+        return SECFailure;
+    }
+    challenge = inKeyChallCont->challenges[inIndex];
+    if (challenge->randomNumber.data == NULL) {
+        /* There is no random number here, nothing to see. */
+        return SECFailure;
+    }
+    *inDest = DER_GetInteger(&challenge->randomNumber);
+    return (*inDest == -1) ? SECFailure : SECSuccess;
+}
+
+SECStatus
+CMMF_EncodePOPODecKeyRespContent(long *inDecodedRand,
+                                 int inNumRand,
+                                 CRMFEncoderOutputCallback inCallback,
+                                 void *inArg)
+{
+    PLArenaPool *poolp;
+    CMMFPOPODecKeyRespContent *response;
+    SECItem *currItem;
+    SECStatus rv = SECFailure;
+    int i;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return SECFailure;
+    }
+    response = PORT_ArenaZNew(poolp, CMMFPOPODecKeyRespContent);
+    if (response == NULL) {
+        goto loser;
+    }
+    response->responses = PORT_ArenaZNewArray(poolp, SECItem *, inNumRand + 1);
+    if (response->responses == NULL) {
+        goto loser;
+    }
+    for (i = 0; i < inNumRand; i++) {
+        currItem = response->responses[i] = PORT_ArenaZNew(poolp, SECItem);
+        if (currItem == NULL) {
+            goto loser;
+        }
+        currItem = SEC_ASN1EncodeInteger(poolp, currItem, inDecodedRand[i]);
+        if (currItem == NULL) {
+            goto loser;
+        }
+    }
+    rv = cmmf_user_encode(response, inCallback, inArg,
+                          CMMFPOPODecKeyRespContentTemplate);
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return rv;
+}
diff --git a/security/nss/lib/crmf/cmmf.h b/security/nss/lib/crmf/cmmf.h
new file mode 100644
index 0000000000..1e39a8d2d2
--- /dev/null
+++ b/security/nss/lib/crmf/cmmf.h
@@ -0,0 +1,1082 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CMMF_H_
+#define _CMMF_H_
+/*
+ * These are the functions exported by the security library for
+ * implementing Certificate Management Message Formats (CMMF).
+ *
+ * This API is designed against July 1998 CMMF draft.  Please read this
+ * draft before trying to use this API in an application that use CMMF.
+ */
+#include "seccomon.h"
+#include "cmmft.h"
+#include "crmf.h"
+
+SEC_BEGIN_PROTOS
+
+/******************* Creation Functions *************************/
+
+/*
+ * FUNCTION: CMMF_CreateCertRepContent
+ * INPUTS:
+ *    NONE
+ * NOTES:
+ *    This function will create an empty CMMFCertRepContent Structure.
+ *    The client of the library must set the CMMFCertResponses.
+ *    Call CMMF_CertRepContentSetCertResponse to accomplish this task.
+ *    If the client of the library also wants to include the chain of
+ *    CA certs required to make the certificates in CMMFCertResponse valid,
+ *    then the user must also set the caPubs field of CMMFCertRepContent.
+ *    Call CMMF_CertRepContentSetCAPubs to accomplish this.  After setting
+ *    the desired fields, the user can then call CMMF_EncodeCertRepContent
+ *    to DER-encode the CertRepContent.
+ * RETURN:
+ *    A pointer to the CMMFCertRepContent.  A NULL return value indicates
+ *    an error in allocating memory or failure to initialize the structure.
+ */
+extern CMMFCertRepContent *CMMF_CreateCertRepContent(void);
+
+/*
+ * FUNCTION: CMMF_CreateCertRepContentFromDER
+ * INPUTS
+ *    db
+ *        The certificate database where the certificates will be placed.
+ *        The certificates will be placed in the temporary database associated
+ *        with the handle.
+ *    buf
+ *        A buffer to the DER-encoded CMMFCertRepContent
+ *    len
+ *        The length in bytes of the buffer 'buf'
+ * NOTES:
+ *    This function passes the buffer to the ASN1 decoder and creates a
+ *    CMMFCertRepContent structure.  The user must call
+ *    CMMF_DestroyCertRepContent after the return value is no longer needed.
+ *
+ * RETURN:
+ *    A pointer to the CMMFCertRepContent structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CMMFCertRepContent *
+CMMF_CreateCertRepContentFromDER(CERTCertDBHandle *db,
+                                 const char *buf,
+                                 long len);
+
+/*
+ * FUNCTION: CMMF_CreateCertResponse
+ * INPUTS:
+ *    inCertReqId
+ *        The Certificate Request Id this response is for.
+ * NOTES:
+ *    This creates a CMMFCertResponse.  This response should correspond
+ *    to a request that was received via CRMF.  From the CRMF message you
+ *    can get the Request Id to pass in as inCertReqId, in essence binding
+ *    a CMRFCertRequest message to the CMMFCertResponse created by this
+ *    function.  If no requuest id is associated with the response to create
+ *    then the user should pass in -1 for 'inCertReqId'.
+ *
+ * RETURN:
+ *    A pointer to the new CMMFCertResponse corresponding to the request id
+ *    passed in.  A NULL return value indicates an error while trying to
+ *    create the CMMFCertResponse.
+ */
+extern CMMFCertResponse *CMMF_CreateCertResponse(long inCertReqId);
+
+/*
+ * FUNCTION: CMMF_CreateKeyRecRepContent
+ * INPUTS:
+ *    NONE
+ * NOTES:
+ *    This function creates a new empty CMMFKeyRecRepContent structure.
+ *    At the very minimum, the user  must call
+ *    CMMF_KeyRecRepContentSetPKIStatusInfoStatus field to have an
+ *    encodable structure.  Depending on what the response is, the user may
+ *    have to set other fields as well to properly build up the structure so
+ *    that it can be encoded.  Refer to the CMMF draft for how to properly
+ *    set up a CMMFKeyRecRepContent. This is the structure that an RA returns
+ *    to an end entity when doing key recovery.
+
+ *    The user must call CMMF_DestroyKeyRecRepContent when the return value
+ *    is no longer needed.
+ * RETURN:
+ *    A pointer to the empty CMMFKeyRecRepContent.  A return value of NULL
+ *    indicates an error in allocating memory or initializing the structure.
+ */
+extern CMMFKeyRecRepContent *CMMF_CreateKeyRecRepContent(void);
+
+/*
+ * FUNCTION: CMMF_CreateKeyRecRepContentFromDER
+ * INPUTS:
+ *    db
+ *        The handle for the certificate database where the decoded
+ *        certificates will be placed.  The decoded certificates will
+ *        be placed in the temporary database associated with the
+ *        handle.
+ *    buf
+ *        A buffer contatining the DER-encoded CMMFKeyRecRepContent
+ *    len
+ *        The length in bytes of the buffer 'buf'
+ * NOTES
+ *    This function passes the buffer to the ASN1 decoder and creates a
+ *    CMMFKeyRecRepContent structure.
+ *
+ * RETURN:
+ *    A pointer to the CMMFKeyRecRepContent structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CMMFKeyRecRepContent *
+CMMF_CreateKeyRecRepContentFromDER(CERTCertDBHandle *db,
+                                   const char *buf,
+                                   long len);
+
+/*
+ * FUNCTION: CMMF_CreatePOPODecKeyChallContent
+ * INPUTS:
+ *    NONE
+ * NOTES:
+ *    This function creates an empty CMMFPOPODecKeyChallContent.  The user
+ *    must add the challenges individually specifying the random number to
+ *    be used and the public key to be used when creating each individual
+ *    challenge.  User can accomplish this by calling the function
+ *    CMMF_POPODecKeyChallContentSetNextChallenge.
+ * RETURN:
+ *    A pointer to a CMMFPOPODecKeyChallContent structure.  Ther user can
+ *    then call CMMF_EncodePOPODecKeyChallContent passing in the return
+ *    value from this function after setting all of the challenges.  A
+ *    return value of NULL indicates an error while creating the
+ *    CMMFPOPODecKeyChallContent structure.
+ */
+extern CMMFPOPODecKeyChallContent *
+CMMF_CreatePOPODecKeyChallContent(void);
+
+/*
+ * FUNCTION: CMMF_CreatePOPODecKeyChallContentFromDER
+ * INPUTS
+ *    buf
+ *        A buffer containing the DER-encoded CMMFPOPODecKeyChallContent
+ *    len
+ *        The length in bytes of the buffer 'buf'
+ * NOTES:
+ *    This function passes the buffer to the ASN1 decoder and creates a
+ *    CMMFPOPODecKeyChallContent structure.
+ *
+ * RETURN:
+ *    A pointer to the CMMFPOPODecKeyChallContent structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CMMFPOPODecKeyChallContent *
+CMMF_CreatePOPODecKeyChallContentFromDER(const char *buf, long len);
+
+/*
+ * FUNCTION: CMMF_CreatePOPODecKeyRespContentFromDER
+ * INPUTS:
+ *    buf
+ *        A buffer contatining the DER-encoded CMMFPOPODecKeyRespContent
+ *    len
+ *        The length in bytes of the buffer 'buf'
+ * NOTES
+ *    This function passes the buffer to the ASN1 decoder and creates a
+ *    CMMFPOPODecKeyRespContent structure.
+ *
+ * RETURN:
+ *    A pointer to the CMMFPOPODecKeyRespContent structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CMMFPOPODecKeyRespContent *
+CMMF_CreatePOPODecKeyRespContentFromDER(const char *buf, long len);
+
+/************************** Set Functions *************************/
+
+/*
+ * FUNCTION: CMMF_CertRepContentSetCertResponses
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to operate on.
+ *    inCertResponses
+ *        An array of pointers to CMMFCertResponse structures to
+ *        add to the CMMFCertRepContent structure.
+ *    inNumResponses
+ *        The length of the array 'inCertResponses'
+ * NOTES:
+ *    This function will add the CMMFCertResponse structure to the
+ *    CMMFCertRepContent passed in.  The CMMFCertResponse field of
+ *    CMMFCertRepContent is required, so the client must call this function
+ *    before calling CMMF_EncodeCertRepContent.  If the user calls
+ *    CMMF_EncodeCertRepContent before calling this function,
+ *    CMMF_EncodeCertRepContent will fail.
+ *
+ * RETURN:
+ *    SECSuccess if adding the CMMFCertResponses to the CMMFCertRepContent
+ *    structure was successful.  Any other return value indicates an error
+ *    while trying to add the CMMFCertResponses.
+ */
+extern SECStatus
+CMMF_CertRepContentSetCertResponses(CMMFCertRepContent *inCertRepContent,
+                                    CMMFCertResponse **inCertResponses,
+                                    int inNumResponses);
+
+/*
+ * FUNCTION: CMMF_CertRepContentSetCAPubs
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to operate on.
+ *    inCAPubs
+ *        The certificate list which makes up the chain of CA certificates
+ *        required to make the issued cert valid.
+ * NOTES:
+ *    This function will set the the certificates in the CA chain as part
+ *    of the CMMFCertRepContent.  This field is an optional member of the
+ *    CMMFCertRepContent structure, so the client is not required to call
+ *    this function before calling CMMF_EncodeCertRepContent.
+ *
+ * RETURN:
+ *    SECSuccess if adding the 'inCAPubs' to the CERTRepContent was successful.
+ *    Any other return value indicates an error while adding 'inCAPubs' to the
+ *    CMMFCertRepContent structure.
+ *
+ */
+extern SECStatus
+CMMF_CertRepContentSetCAPubs(CMMFCertRepContent *inCertRepContent,
+                             CERTCertList *inCAPubs);
+
+/*
+ * FUNCTION: CMMF_CertResponseSetPKIStatusInfoStatus
+ * INPUTS:
+ *    inCertResp
+ *        The CMMFCertResponse to operate on.
+ *     inPKIStatus
+ *        The value to set for the PKIStatusInfo.status field.
+ * NOTES:
+ *    This function will set the CertResponse.status.status field of
+ *    the CMMFCertResponse structure.  (View the definition of CertResponse
+ *    in the CMMF draft to see exactly which value this talks about.)  This
+ *    field is a required member of the structure, so the user must call this
+ *    function in order to have a CMMFCertResponse that can be encoded.
+ *
+ * RETURN:
+ *    SECSuccess if setting the field with the passed in value was successful.
+ *    Any other return value indicates an error while trying to set the field.
+ */
+extern SECStatus
+CMMF_CertResponseSetPKIStatusInfoStatus(CMMFCertResponse *inCertResp,
+                                        CMMFPKIStatus inPKIStatus);
+
+/*
+ * FUNCTION: CMMF_CertResponseSetCertificate
+ * INPUTS:
+ *    inCertResp
+ *        The CMMFCertResponse to operate on.
+ *    inCertificate
+ *        The certificate to add to the
+ *        CertResponse.CertifiedKeyPair.certOrEncCert.certificate field.
+ * NOTES:
+ *    This function will take the certificate and make it a member of the
+ *    CMMFCertResponse.  The certificate should be the actual certificate
+ *    being issued via the response.
+ *
+ * RETURN:
+ *    SECSuccess if adding the certificate to the response was successful.
+ *    Any other return value indicates an error in adding the certificate to
+ *    the CertResponse.
+ */
+extern SECStatus
+CMMF_CertResponseSetCertificate(CMMFCertResponse *inCertResp,
+                                CERTCertificate *inCertificate);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentSetPKIStatusInfoStatus
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ *    inPKIStatus
+ *        The value to set the PKIStatusInfo.status field to.
+ * NOTES:
+ *    This function sets the only required field for the KeyRecRepContent.
+ *    In most cases, the user will set this field and other fields of the
+ *    structure to properly create the CMMFKeyRecRepContent structure.
+ *    Refer to the CMMF draft to see which fields need to be set in order
+ *    to create the desired CMMFKeyRecRepContent.
+ *
+ * RETURN:
+ *    SECSuccess if setting the PKIStatusInfo.status field was successful.
+ *    Any other return value indicates an error in setting the field.
+ */
+extern SECStatus
+CMMF_KeyRecRepContentSetPKIStatusInfoStatus(CMMFKeyRecRepContent *inKeyRecRep,
+                                            CMMFPKIStatus inPKIStatus);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentSetNewSignCert
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ *    inNewSignCert
+ *        The new signing cert to add to the CMMFKeyRecRepContent structure.
+ * NOTES:
+ *    This function sets the new signeing cert in the CMMFKeyRecRepContent
+ *    structure.
+ *
+ * RETURN:
+ *    SECSuccess if setting the new signing cert was successful.  Any other
+ *    return value indicates an error occurred while trying to add the
+ *    new signing certificate.
+ */
+extern SECStatus
+CMMF_KeyRecRepContentSetNewSignCert(CMMFKeyRecRepContent *inKeyRecRep,
+                                    CERTCertificate *inNewSignCert);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentSetCACerts
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ *    inCACerts
+ *        The list of CA certificates required to construct a valid
+ *        certificate chain with the certificates that will be returned
+ *        to the end user via this KeyRecRepContent.
+ * NOTES:
+ *    This function sets the caCerts that are required to form a chain with the
+ *    end entity certificates that are being re-issued in this
+ *    CMMFKeyRecRepContent structure.
+ *
+ * RETURN:
+ *    SECSuccess if adding the caCerts was successful.  Any other return value
+ *    indicates an error while tring to add the caCerts.
+ */
+extern SECStatus
+CMMF_KeyRecRepContentSetCACerts(CMMFKeyRecRepContent *inKeyRecRep,
+                                CERTCertList *inCACerts);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentSetCertifiedKeyPair
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ *    inCert
+ *        The certificate to add to the CMMFKeyRecRepContent structure.
+ *    inPrivKey
+ *        The private key associated with the certificate above passed in.
+ *    inPubKey
+ *        The public key to use for wrapping the private key.
+ * NOTES:
+ *    This function adds another certificate-key pair to the
+ *    CMMFKeyRecRepcontent structure.  There may be more than one
+ *    certificate-key pair in the structure, so the user must call this
+ *    function multiple times to add more than one cert-key pair.
+ *
+ * RETURN:
+ *    SECSuccess if adding the certified key pair was successful.  Any other
+ *    return value indicates an error in adding certified key pair to
+ *    CMMFKeyRecRepContent structure.
+ */
+extern SECStatus
+CMMF_KeyRecRepContentSetCertifiedKeyPair(CMMFKeyRecRepContent *inKeyRecRep,
+                                         CERTCertificate *inCert,
+                                         SECKEYPrivateKey *inPrivKey,
+                                         SECKEYPublicKey *inPubKey);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentSetNextChallenge
+ * INPUTS:
+ *    inDecKeyChall
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ *    inRandom
+ *        The random number to use when generating the challenge,
+ *    inSender
+ *        The GeneralName representation of the sender of the challenge.
+ *    inPubKey
+ *        The public key to use when encrypting the challenge.
+ *    passwdArg
+ *        This value will be passed to the function used for getting a
+ *        password.  The password for getting a password should be registered
+ *        by calling PK11_SetPasswordFunc before this function is called.
+ *        If no password callback is registered and the library needs to
+ *        authenticate to the slot for any reason, this function will fail.
+ * NOTES:
+ *    This function adds a challenge to the end of the list of challenges
+ *    contained by 'inDecKeyChall'.  Refer to the CMMF draft on how the
+ *    the random number passed in and the sender's GeneralName are used
+ *    to generate the challenge and witness fields of the challenge.  This
+ *    library will use SHA1 as the one-way function for generating the
+ *    witess field of the challenge.
+ *
+ * RETURN:
+ *    SECSuccess if generating the challenge and adding to the end of list
+ *    of challenges was successful.  Any other return value indicates an error
+ *    while trying to generate the challenge.
+ */
+extern SECStatus
+CMMF_POPODecKeyChallContentSetNextChallenge(CMMFPOPODecKeyChallContent *inDecKeyChall,
+                                            long inRandom,
+                                            CERTGeneralName *inSender,
+                                            SECKEYPublicKey *inPubKey,
+                                            void *passwdArg);
+
+/************************** Encoding Functions *************************/
+
+/*
+ * FUNCTION: CMMF_EncodeCertRepContent
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to DER-encode.
+ *    inCallback
+ *        A callback function that the ASN1 encoder will call whenever it
+ *        wants to write out DER-encoded bytes.  Look at the defintion of
+ *        CRMFEncoderOutputCallback in crmft.h for a description of the
+ *        parameters to the function.
+ *    inArg
+ *        An opaque pointer to a user-supplied argument that will be passed
+ *        to the callback funtion whenever the function is called.
+ * NOTES:
+ *    The CMMF library will use the same DER-encoding scheme as the CRMF
+ *    library.  In other words, when reading CRMF comments that pertain to
+ *    encoding, those comments apply to the CMMF libray as well.
+ *    The callback function will be called multiple times, each time supplying
+ *    the next chunk of DER-encoded bytes.  The user must concatenate the
+ *    output of each successive call to the callback in order to get the
+ *    entire DER-encoded CMMFCertRepContent structure.
+ *
+ * RETURN:
+ *    SECSuccess if encoding the CMMFCertRepContent was successful.  Any
+ *    other return value indicates an error while decoding the structure.
+ */
+extern SECStatus
+CMMF_EncodeCertRepContent(CMMFCertRepContent *inCertRepContent,
+                          CRMFEncoderOutputCallback inCallback,
+                          void *inArg);
+
+/*
+ * FUNCTION: CMMF_EncodeKeyRecRepContent
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRepContent to DER-encode.
+ *    inCallback
+ *        A callback function that the ASN1 encoder will call whenever it
+ *        wants to write out DER-encoded bytes.  Look at the defintion of
+ *        CRMFEncoderOutputCallback in crmft.h for a description of the
+ *        parameters to the function.
+ *    inArg
+ *        An opaque pointer to a user-supplied argument that will be passed
+ *        to the callback funtion whenever the function is called.
+ * NOTES:
+ *    The CMMF library will use the same DER-encoding scheme as the CRMF
+ *    library.  In other words, when reading CRMF comments that pertain to
+ *    encoding, those comments apply to the CMMF libray as well.
+ *    The callback function will be called multiple times, each time supplying
+ *    the next chunk of DER-encoded bytes.  The user must concatenate the
+ *    output of each successive call to the callback in order to get the
+ *    entire DER-encoded CMMFCertRepContent structure.
+ *
+ * RETURN:
+ *    SECSuccess if encoding the CMMFKeyRecRepContent was successful.  Any
+ *    other return value indicates an error while decoding the structure.
+ */
+extern SECStatus
+CMMF_EncodeKeyRecRepContent(CMMFKeyRecRepContent *inKeyRecRep,
+                            CRMFEncoderOutputCallback inCallback,
+                            void *inArg);
+
+/*
+ * FUNCTION: CMMF_EncodePOPODecKeyChallContent
+ * INPUTS:
+ *    inDecKeyChall
+ *        The CMMFDecKeyChallContent to operate on.
+ *    inCallback
+ *        A callback function that the ASN1 encoder will call whenever it
+ *        wants to write out DER-encoded bytes.  Look at the defintion of
+ *        CRMFEncoderOutputCallback in crmft.h for a description of the
+ *        parameters to the function.
+ *    inArg
+ *        An opaque pointer to a user-supplied argument that will be passed
+ *        to the callback function whenever the function is called.
+ * NOTES:
+ *    The CMMF library will use the same DER-encoding scheme as the CRMF
+ *    library.  In other words, when reading CRMF comments that pertain to
+ *    encoding, those comments apply to the CMMF libray as well.
+ *    The callback function will be called multiple times, each time supplying
+ *    the next chunk of DER-encoded bytes.  The user must concatenate the
+ *    output of each successive call to the callback in order to get the
+ *    entire DER-encoded CMMFCertRepContent structure.
+ *    The DER will be an encoding of the type POPODecKeyChallContents, which
+ *    is just a sequence of challenges.
+ *
+ * RETURN:
+ *    SECSuccess if encoding was successful.  Any other return value indicates
+ *    an error in trying to encode the Challenges.
+ */
+extern SECStatus
+CMMF_EncodePOPODecKeyChallContent(CMMFPOPODecKeyChallContent *inDecKeyChall,
+                                  CRMFEncoderOutputCallback inCallback,
+                                  void *inArg);
+
+/*
+ * FUNCTION: CMMF_EncodePOPODecKeyRespContent
+ * INPUTS:
+ *    inDecodedRand
+ *        An array of integers to encode as the responses to
+ *        CMMFPOPODecKeyChallContent.  The integers must be in the same order
+ *        as the challenges extracted from CMMFPOPODecKeyChallContent.
+ *    inNumRand
+ *        The number of random integers contained in the array 'inDecodedRand'
+ *    inCallback
+ *        A callback function that the ASN1 encoder will call whenever it
+ *        wants to write out DER-encoded bytes.  Look at the defintion of
+ *        CRMFEncoderOutputCallback in crmft.h for a description of the
+ *        parameters to the function.
+ *    inArg
+ *        An opaque pointer to a user-supplied argument that will be passed
+ *        to the callback funtion whenever the function is called.
+ * NOTES:
+ *    The CMMF library will use the same DER-encoding scheme as the CRMF
+ *    library.  In other words, when reading CRMF comments that pertain to
+ *    encoding, those comments apply to the CMMF libray as well.
+ *    The callback function will be called multiple times, each time supplying
+ *    the next chunk of DER-encoded bytes.  The user must concatenate the
+ *    output of each successive call to the callback in order to get the
+ *    entire DER-encoded  POPODecKeyRespContent.
+ *
+ * RETURN:
+ *    SECSuccess if encoding was successful.  Any other return value indicates
+ *    an error in trying to encode the Challenges.
+ */
+extern SECStatus
+CMMF_EncodePOPODecKeyRespContent(long *inDecodedRand,
+                                 int inNumRand,
+                                 CRMFEncoderOutputCallback inCallback,
+                                 void *inArg);
+
+/***************  Accessor function  ***********************************/
+
+/*
+ * FUNCTION: CMMF_CertRepContentGetCAPubs
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to extract the caPubs from.
+ * NOTES:
+ *    This function will return a copy of the list of certificates that
+ *    make up the chain of CA's required to make the cert issued valid.
+ *    The user must call CERT_DestroyCertList on the return value when
+ *    done using the return value.
+ *
+ *    Only call this function on a CertRepContent that has been decoded.
+ *    The client must call CERT_DestroyCertList when the certificate list
+ *    is no longer needed.
+ *
+ *    The certs in the list will not be in the temporary database.  In order
+ *    to make these certificates a part of the permanent CA internal database,
+ *    the user must collect the der for all of these certs and call
+ *    CERT_ImportCAChain.  Afterwards the certs will be part of the permanent
+ *    database.
+ *
+ * RETURN:
+ *    A pointer to the CERTCertList representing the CA chain associated
+ *    with the issued cert.  A NULL return value indicates  that no CA Pubs
+ *    were available in the CMMFCertRepContent structure.
+ */
+extern CERTCertList *
+CMMF_CertRepContentGetCAPubs(CMMFCertRepContent *inCertRepContent);
+
+/*
+ * FUNCTION: CMMF_CertRepContentGetNumResponses
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to operate on.
+ * NOTES:
+ *    This function will return the number of CertResponses that are contained
+ *    by the CMMFCertRepContent passed in.
+ *
+ * RETURN:
+ *    The number of CMMFCertResponses contained in the structure passed in.
+ */
+extern int
+CMMF_CertRepContentGetNumResponses(CMMFCertRepContent *inCertRepContent);
+
+/*
+ * FUNCTION: CMMF_CertRepContentGetResponseAtIndex
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to operate on.
+ *    inIndex
+ *        The index of the CMMFCertResponse the user wants a copy of.
+ * NOTES:
+ *    This function creates a copy of the CMMFCertResponse at the index
+ *    corresponding to the parameter 'inIndex'.  Indexing is done like a
+ *    traditional C array, ie the valid indexes are (0...numResponses-1).
+ *    The user must call CMMF_DestroyCertResponse after the return value is
+ *    no longer needed.
+ *
+ * RETURN:
+ *    A pointer to the CMMFCertResponse at the index corresponding to
+ *    'inIndex'.  A return value of NULL indicates an error in copying
+ *    the CMMFCertResponse.
+ */
+extern CMMFCertResponse *
+CMMF_CertRepContentGetResponseAtIndex(CMMFCertRepContent *inCertRepContent,
+                                      int inIndex);
+
+/*
+ * FUNCTION: CMMF_CertResponseGetCertReqId
+ * INPUTS:
+ *    inCertResp
+ *        The CMMFCertResponse to operate on.
+ * NOTES:
+ *    This function returns the CertResponse.certReqId from the
+ *    CMMFCertResponse structure passed in.  If the return value is -1, that
+ *    means there is no associated certificate request with the CertResponse.
+ * RETURN:
+ *    A long representing the id of the certificate request this
+ *    CMMFCertResponse corresponds to.  A return value of -1 indicates an
+ *    error in extracting the value of the integer.
+ */
+extern long CMMF_CertResponseGetCertReqId(CMMFCertResponse *inCertResp);
+
+/*
+ * FUNCTION: CMMF_CertResponseGetPKIStatusInfoStatus
+ * INPUTS:
+ *    inCertResp
+ *        The CMMFCertResponse to operate on.
+ * NOTES:
+ *    This function returns the CertResponse.status.status field of the
+ *    CMMFCertResponse structure.
+ *
+ * RETURN:
+ *    The enumerated value corresponding to the PKIStatus defined in the CMMF
+ *    draft.  See the CMMF draft for the definition of PKIStatus.  See crmft.h
+ *    for the definition of CMMFPKIStatus.
+ */
+extern CMMFPKIStatus
+CMMF_CertResponseGetPKIStatusInfoStatus(CMMFCertResponse *inCertResp);
+
+/*
+ * FUNCTION: CMMF_CertResponseGetCertificate
+ * INPUTS:
+ *    inCertResp
+ *        The Certificate Response to operate on.
+ *    inCertdb
+ *        This is the certificate database where the function will place the
+ *        newly issued certificate.
+ * NOTES:
+ *    This function retrieves the CertResponse.certifiedKeyPair.certificate
+ *    from the CMMFCertResponse.  The user will get a copy of that certificate
+ *    so  the user must call CERT_DestroyCertificate when the return value is
+ *    no longer needed.  The certificate returned will be in the temporary
+ *    certificate database.
+ *
+ * RETURN:
+ *    A pointer to a copy of the certificate contained within the
+ *    CMMFCertResponse.  A return value of NULL indicates an error while trying
+ *    to make a copy of the certificate.
+ */
+extern CERTCertificate *
+CMMF_CertResponseGetCertificate(CMMFCertResponse *inCertResp,
+                                CERTCertDBHandle *inCertdb);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentGetPKIStatusInfoStatus
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent structure to operate on.
+ * NOTES:
+ *    This function retrieves the KeyRecRepContent.status.status field of
+ *    the CMMFKeyRecRepContent structure.
+ * RETURN:
+ *    The CMMFPKIStatus corresponding to the value held in the
+ *    CMMFKeyRecRepContent structure.
+ */
+extern CMMFPKIStatus
+CMMF_KeyRecRepContentGetPKIStatusInfoStatus(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentGetNewSignCert
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ * NOTES:
+ *    This function retrieves the KeyRecRepContent.newSignCert field of the
+ *    CMMFKeyRecRepContent structure.  The user must call
+ *    CERT_DestroyCertificate when the return value is no longer needed. The
+ *    returned certificate will be in the temporary database.  The user
+ *    must then place the certificate permanently in whatever token the
+ *    user determines is the proper destination.  A return value of NULL
+ *    indicates the newSigCert field was not present.
+ */
+extern CERTCertificate *
+CMMF_KeyRecRepContentGetNewSignCert(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentGetCACerts
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ * NOTES:
+ *    This function returns a CERTCertList which contains all of the
+ *    certficates that are in the sequence KeyRecRepContent.caCerts
+ *    User must call CERT_DestroyCertList when the return value is no longer
+ *    needed.  All of these certificates will be placed in the tempoaray
+ *    database.
+ *
+ * RETURN:
+ *    A pointer to the list of caCerts contained in the CMMFKeyRecRepContent
+ *    structure.  A return value of NULL indicates the library was not able to
+ *    make a copy of the certifcates.  This may be because there are no caCerts
+ *    included in the CMMFKeyRecRepContent strucure or an internal error.  Call
+ *    CMMF_KeyRecRepContentHasCACerts to find out if there are any caCerts
+ *    included in 'inKeyRecRep'.
+ */
+extern CERTCertList *
+CMMF_KeyRecRepContentGetCACerts(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentGetNumKeyPairs
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to operate on.
+ * RETURN:
+ *    This function returns the number of CMMFCertifiedKeyPair structures that
+ *    that are stored in the KeyRecRepContent structure.
+ */
+extern int
+CMMF_KeyRecRepContentGetNumKeyPairs(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentGetCertKeyAtIndex
+ * INPUTS:
+ *    inKeyRecRepContent
+ *        The CMMFKeyRecRepContent to operate on.
+ *    inIndex
+ *        The index of the desired CMMFCertifiedKeyPair
+ * NOTES:
+ *    This function retrieves the CMMFCertifiedKeyPair structure at the index
+ *    'inIndex'.  Valid indexes are 0...(numKeyPairs-1)  The user must call
+ *    CMMF_DestroyCertifiedKeyPair when the return value is no longer needed.
+ *
+ * RETURN:
+ *    A pointer to the Certified Key Pair at the desired index.  A return value
+ *    of NULL indicates an error in extracting the Certified Key Pair at the
+ *    desired index.
+ */
+extern CMMFCertifiedKeyPair *
+CMMF_KeyRecRepContentGetCertKeyAtIndex(CMMFKeyRecRepContent *inKeyRecRep,
+                                       int inIndex);
+
+/*
+ * FUNCTION: CMMF_CertifiedKeyPairGetCertificate
+ * INPUTS:
+ *    inCertKeyPair
+ *        The CMMFCertifiedKeyPair to operate on.
+ *    inCertdb
+ *        The database handle for the database you want this certificate
+ *        to wind up in.
+ * NOTES:
+ *    This function retrieves the certificate at
+ *    CertifiedKeyPair.certOrEncCert.certificate
+ *    The user must call CERT_DestroyCertificate when the return value is no
+ *    longer needed.  The user must import this certificate as a token object
+ *    onto PKCS#11 slot in order to make it a permanent object.  The returned
+ *    certificate will be in the temporary database.
+ *
+ * RETURN:
+ *    A pointer to the certificate contained within the certified key pair.
+ *    A return value of NULL indicates an error in creating the copy of the
+ *    certificate.
+ */
+extern CERTCertificate *
+CMMF_CertifiedKeyPairGetCertificate(CMMFCertifiedKeyPair *inCertKeyPair,
+                                    CERTCertDBHandle *inCertdb);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentGetNumChallenges
+ * INPUTS:
+ *    inKeyChallCont
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ * RETURN:
+ *    This function returns the number of CMMFChallenges are contained in
+ *    the CMMFPOPODecKeyChallContent structure.
+ */
+extern int CMMF_POPODecKeyChallContentGetNumChallenges(CMMFPOPODecKeyChallContent *inKeyChallCont);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentGetPublicValue
+ * ---------------------------------------------------
+ * INPUTS:
+ *    inKeyChallCont
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ *    inIndex
+ *        The index of the Challenge within inKeyChallCont to operate on.
+ *        Indexes start from 0, ie the Nth Challenge corresponds to index
+ *        N-1.
+ * NOTES:
+ * This function retrieves the public value stored away in the Challenge at
+ * index inIndex of inKeyChallCont.
+ * RETURN:
+ * A pointer to a SECItem containing the public value.  User must call
+ * SECITEM_FreeItem on the return value when the value is no longer necessary.
+ * A return value of NULL indicates an error while retrieving the public value.
+ */
+extern SECItem *CMMF_POPODecKeyChallContentGetPublicValue(CMMFPOPODecKeyChallContent *inKeyChallCont,
+                                                          int inIndex);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentGetRandomNumber
+ * INPUTS:
+ *    inChallContent
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ *    inIndex
+ *        The index of the challenge to look at.  Valid indexes are 0 through
+ *        (CMMF_POPODecKeyChallContentGetNumChallenges(inChallContent) - 1).
+ *    inDest
+ *        A pointer to a user supplied buffer where the library
+ *        can place a copy of the random integer contatained in the
+ *        challenge.
+ * NOTES:
+ *    This function returns the value held in the decrypted Rand structure
+ *    corresponding to the random integer.  The user must call
+ *    CMMF_POPODecKeyChallContentDecryptChallenge before calling this function.  Call
+ *    CMMF_ChallengeIsDecrypted to find out if the challenge has been
+ *    decrypted.
+ *
+ * RETURN:
+ *    SECSuccess indicates the witness field has been previously decrypted
+ *    and the value for the random integer was successfully placed at *inDest.
+ *    Any other return value indicates an error and that the value at *inDest
+ *    is not a valid value.
+ */
+extern SECStatus CMMF_POPODecKeyChallContentGetRandomNumber(CMMFPOPODecKeyChallContent *inKeyChallCont,
+                                                            int inIndex,
+                                                            long *inDest);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyRespContentGetNumResponses
+ * INPUTS:
+ *    inRespCont
+ *        The POPODecKeyRespContent to operate on.
+ * RETURN:
+ * This function returns the number of responses contained in inRespContent.
+ */
+extern int
+CMMF_POPODecKeyRespContentGetNumResponses(CMMFPOPODecKeyRespContent *inRespCont);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyRespContentGetResponse
+ * INPUTS:
+ *    inRespCont
+ *        The POPODecKeyRespContent to operate on.
+ *    inIndex
+ *        The index of the response to retrieve.
+ *        The Nth response is at index N-1, ie the 1st response is at index 0,
+ *        the 2nd response is at index 1, and so on.
+ *    inDest
+ *        A pointer to a pre-allocated buffer where the library can put the
+ *        value of the response located at inIndex.
+ * NOTES:
+ * The function returns the response contained at index inIndex.
+ * CMMFPOPODecKeyRespContent is a structure that the server will generally
+ * get in response to a CMMFPOPODecKeyChallContent.  The server will expect
+ * to see the responses in the same order as it constructed them in
+ * the CMMFPOPODecKeyChallContent structure.
+ * RETURN:
+ * SECSuccess if getting the response at the desired index was successful.  Any
+ * other return value indicates an errror.
+ */
+extern SECStatus
+CMMF_POPODecKeyRespContentGetResponse(CMMFPOPODecKeyRespContent *inRespCont,
+                                      int inIndex,
+                                      long *inDest);
+
+/************************* Destructor Functions ******************************/
+
+/*
+ * FUNCTION: CMMF_DestroyCertResponse
+ * INPUTS:
+ *    inCertResp
+ *        The CMMFCertResponse to destroy.
+ * NOTES:
+ *    This function frees all the memory associated with the CMMFCertResponse
+ *    passed in.
+ * RETURN:
+ *    SECSuccess if freeing the memory was successful.  Any other return value
+ *    indicates an error while freeing the memory.
+ */
+extern SECStatus CMMF_DestroyCertResponse(CMMFCertResponse *inCertResp);
+
+/*
+ * FUNCTION: CMMF_DestroyCertRepContent
+ * INPUTS:
+ *    inCertRepContent
+ *        The CMMFCertRepContent to destroy
+ * NOTES:
+ *    This function frees the memory associated with the CMMFCertRepContent
+ *    passed in.
+ * RETURN:
+ *    SECSuccess if freeing all the memory associated with the
+ *    CMMFCertRepContent passed in is successful.  Any other return value
+ *    indicates an error while freeing the memory.
+ */
+extern SECStatus
+CMMF_DestroyCertRepContent(CMMFCertRepContent *inCertRepContent);
+
+/*
+ * FUNCTION: CMMF_DestroyKeyRecRepContent
+ * INPUTS:
+ *    inKeyRecRep
+ *        The CMMFKeyRecRepContent to destroy.
+ * NOTES:
+ *    This function destroys all the memory associated with the
+ *    CMMFKeyRecRepContent passed in.
+ *
+ * RETURN:
+ *    SECSuccess if freeing all the memory is successful.  Any other return
+ *    value indicates an error in freeing the memory.
+ */
+extern SECStatus
+CMMF_DestroyKeyRecRepContent(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_DestroyCertifiedKeyPair
+ * INPUTS:
+ *    inCertKeyPair
+ *        The CMMFCertifiedKeyPair to operate on.
+ * NOTES:
+ *    This function frees up all the memory associated with 'inCertKeyPair'
+ *
+ * RETURN:
+ *    SECSuccess if freeing all the memory associated with 'inCertKeyPair'
+ *    is successful.  Any other return value indicates an error while trying
+ *    to free the memory.
+ */
+extern SECStatus
+CMMF_DestroyCertifiedKeyPair(CMMFCertifiedKeyPair *inCertKeyPair);
+
+/*
+ * FUNCTION: CMMF_DestroyPOPODecKeyRespContent
+ * INPUTS:
+ *    inDecKeyResp
+ *        The CMMFPOPODecKeyRespContent structure to free.
+ * NOTES:
+ *    This function frees up all the memory associate with the
+ *    CMMFPOPODecKeyRespContent.
+ *
+ * RETURN:
+ *    SECSuccess if freeing up all the memory associated with the
+ *    CMMFPOPODecKeyRespContent structure is successful.  Any other
+ *    return value indicates an error while freeing the memory.
+ */
+extern SECStatus
+CMMF_DestroyPOPODecKeyRespContent(CMMFPOPODecKeyRespContent *inDecKeyResp);
+
+/************************** Miscellaneous Functions *************************/
+
+/*
+ * FUNCTION: CMMF_CertifiedKeyPairUnwrapPrivKey
+ * INPUTS:
+ *    inCertKeyPair
+ *        The CMMFCertifiedKeyPair to operate on.
+ *    inPrivKey
+ *        The private key to use to un-wrap the private key
+ *    inNickName
+ *        This is the nickname that will be associated with the private key
+ *        to be unwrapped.
+ *    inSlot
+ *        The PKCS11 slot where the unwrapped private key should end up.
+ *    inCertdb
+ *        The Certificate database with which the new key will be associated.
+ *    destPrivKey
+ *        A pointer to memory where the library can place a pointer to the
+ *        private key after importing the key onto the specified slot.
+ *    wincx
+ *        An opaque pointer that the library will use in a callback function
+ *        to get the password if necessary.
+ *
+ * NOTES:
+ *    This function uses the private key passed in to unwrap the private key
+ *    contained within the CMMFCertifiedKeyPair structure. After this
+ *    function successfully returns, the private key has been unwrapped and
+ *    placed in the specified slot.
+ *
+ * RETURN:
+ *    SECSuccess if unwrapping the private key was successful.  Any other
+ *    return value indicates an error while trying to un-wrap the private key.
+ */
+extern SECStatus
+CMMF_CertifiedKeyPairUnwrapPrivKey(CMMFCertifiedKeyPair *inKeyPair,
+                                   SECKEYPrivateKey *inPrivKey,
+                                   SECItem *inNickName,
+                                   PK11SlotInfo *inSlot,
+                                   CERTCertDBHandle *inCertdb,
+                                   SECKEYPrivateKey **destPrivKey,
+                                   void *wincx);
+
+/*
+ * FUNCTION: CMMF_KeyRecRepContentHasCACerts
+ * INPUTS:
+ *    inKeyRecRecp
+ *        The CMMFKeyRecRepContent to operate on.
+ * RETURN:
+ *    This function returns PR_TRUE if there are one or more certificates in
+ *    the sequence KeyRecRepContent.caCerts within the CMMFKeyRecRepContent
+ *    structure.  The function will return PR_FALSE if there are 0 certificate
+ *    in the above mentioned sequence.
+ */
+extern PRBool
+CMMF_KeyRecRepContentHasCACerts(CMMFKeyRecRepContent *inKeyRecRep);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContDecryptChallenge
+ * INPUTS:
+ *    inChalCont
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ *    inIndex
+ *        The index of the Challenge to operate on.  The 1st Challenge is
+ *        at index 0, the second at index 1 and so forth.
+ *    inPrivKey
+ *        The private key to use to decrypt the witness field.
+ * NOTES:
+ *    This function uses the private key to decrypt the challenge field
+ *    contained in the appropriate challenge.  Make sure the private key matches
+ *    the public key that was used to encrypt the witness.  Use
+ *    CMMF_POPODecKeyChallContentGetPublicValue to get the public value of
+ *    the key used to encrypt the witness and then use that to determine the
+ *    appropriate private key.  This can be done by calling PK11_MakeIDFromPubKey
+ *    and then passing that return value to PK11_FindKeyByKeyID.  The creator of
+ *    the challenge will most likely be an RA that has the public key
+ *    from a Cert request.  So the private key should be the private key
+ *    associated with public key in that request.  This function will also
+ *    verify the witness field of the challenge.  This function also verifies
+ *    that the sender and witness hashes match within the challenge.
+ *
+ * RETURN:
+ *    SECSuccess if decrypting the witness field was successful.  This does
+ *    not indicate that the decrypted data is valid, since the private key
+ *    passed in may not be the actual key needed to properly decrypt the
+ *    witness field.  Meaning that there is a decrypted structure now, but
+ *    may be garbage because the private key was incorrect.
+ *    Any other return value indicates the function could not complete the
+ *    decryption process.
+ */
+extern SECStatus
+CMMF_POPODecKeyChallContDecryptChallenge(CMMFPOPODecKeyChallContent *inChalCont,
+                                         int inIndex,
+                                         SECKEYPrivateKey *inPrivKey);
+
+/*
+ * FUNCTION: CMMF_DestroyPOPODecKeyChallContent
+ * INPUTS:
+ *    inDecKeyCont
+ *        The CMMFPOPODecKeyChallContent to free
+ * NOTES:
+ *    This function frees up all the memory associated with the
+ *    CMMFPOPODecKeyChallContent
+ * RETURN:
+ *    SECSuccess if freeing up all the memory associatd with the
+ *    CMMFPOPODecKeyChallContent is successful.  Any other return value
+ *    indicates an error while freeing the memory.
+ *
+ */
+extern SECStatus
+CMMF_DestroyPOPODecKeyChallContent(CMMFPOPODecKeyChallContent *inDecKeyCont);
+
+SEC_END_PROTOS
+#endif /* _CMMF_H_ */
diff --git a/security/nss/lib/crmf/cmmfasn1.c b/security/nss/lib/crmf/cmmfasn1.c
new file mode 100644
index 0000000000..64915b3392
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfasn1.c
@@ -0,0 +1,131 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "secasn1.h"
+#include "secitem.h"
+
+SEC_ASN1_MKSUB(SEC_SignedCertificateTemplate)
+
+static const SEC_ASN1Template CMMFSequenceOfCertifiedKeyPairsTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF, 0, CMMFCertifiedKeyPairTemplate }
+};
+
+static const SEC_ASN1Template CMMFKeyRecRepContentTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CMMFKeyRecRepContent) },
+    { SEC_ASN1_INLINE, offsetof(CMMFKeyRecRepContent, status),
+      CMMFPKIStatusInfoTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 0,
+      offsetof(CMMFKeyRecRepContent, newSigCert),
+      SEC_ASN1_SUB(SEC_SignedCertificateTemplate) },
+    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 1,
+      offsetof(CMMFKeyRecRepContent, caCerts),
+      CMMFSequenceOfCertsTemplate },
+    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 2,
+      offsetof(CMMFKeyRecRepContent, keyPairHist),
+      CMMFSequenceOfCertifiedKeyPairsTemplate },
+    { 0 }
+};
+
+SECStatus
+CMMF_EncodeCertRepContent(CMMFCertRepContent *inCertRepContent,
+                          CRMFEncoderOutputCallback inCallback,
+                          void *inArg)
+{
+    return cmmf_user_encode(inCertRepContent, inCallback, inArg,
+                            CMMFCertRepContentTemplate);
+}
+
+SECStatus
+CMMF_EncodePOPODecKeyChallContent(CMMFPOPODecKeyChallContent *inDecKeyChall,
+                                  CRMFEncoderOutputCallback inCallback,
+                                  void *inArg)
+{
+    return cmmf_user_encode(inDecKeyChall, inCallback, inArg,
+                            CMMFPOPODecKeyChallContentTemplate);
+}
+
+CMMFPOPODecKeyRespContent *
+CMMF_CreatePOPODecKeyRespContentFromDER(const char *buf, long len)
+{
+    PLArenaPool *poolp;
+    CMMFPOPODecKeyRespContent *decKeyResp;
+    SECStatus rv;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    decKeyResp = PORT_ArenaZNew(poolp, CMMFPOPODecKeyRespContent);
+    if (decKeyResp == NULL) {
+        goto loser;
+    }
+    decKeyResp->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, decKeyResp, CMMFPOPODecKeyRespContentTemplate,
+                        buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return decKeyResp;
+
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+SECStatus
+CMMF_EncodeKeyRecRepContent(CMMFKeyRecRepContent *inKeyRecRep,
+                            CRMFEncoderOutputCallback inCallback,
+                            void *inArg)
+{
+    return cmmf_user_encode(inKeyRecRep, inCallback, inArg,
+                            CMMFKeyRecRepContentTemplate);
+}
+
+CMMFKeyRecRepContent *
+CMMF_CreateKeyRecRepContentFromDER(CERTCertDBHandle *db, const char *buf,
+                                   long len)
+{
+    PLArenaPool *poolp;
+    CMMFKeyRecRepContent *keyRecContent;
+    SECStatus rv;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    keyRecContent = PORT_ArenaZNew(poolp, CMMFKeyRecRepContent);
+    if (keyRecContent == NULL) {
+        goto loser;
+    }
+    keyRecContent->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, keyRecContent, CMMFKeyRecRepContentTemplate,
+                        buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (keyRecContent->keyPairHist != NULL) {
+        while (keyRecContent->keyPairHist[keyRecContent->numKeyPairs] != NULL) {
+            rv = cmmf_decode_process_certified_key_pair(poolp, db,
+                                                        keyRecContent->keyPairHist[keyRecContent->numKeyPairs]);
+            if (rv != SECSuccess) {
+                goto loser;
+            }
+            keyRecContent->numKeyPairs++;
+        }
+        keyRecContent->allocKeyPairs = keyRecContent->numKeyPairs;
+    }
+    keyRecContent->isDecoded = PR_TRUE;
+    return keyRecContent;
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
diff --git a/security/nss/lib/crmf/cmmfchal.c b/security/nss/lib/crmf/cmmfchal.c
new file mode 100644
index 0000000000..2fee983c96
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfchal.c
@@ -0,0 +1,289 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "sechash.h"
+#include "genname.h"
+#include "pk11func.h"
+#include "cert.h"
+#include "secitem.h"
+#include "secmod.h"
+#include "keyhi.h"
+
+static int
+cmmf_create_witness_and_challenge(PLArenaPool *poolp,
+                                  CMMFChallenge *challenge,
+                                  long inRandom,
+                                  SECItem *senderDER,
+                                  SECKEYPublicKey *inPubKey,
+                                  void *passwdArg)
+{
+    SECItem *encodedRandNum;
+    SECItem encodedRandStr = { siBuffer, NULL, 0 };
+    SECItem *dummy;
+    unsigned char *randHash, *senderHash, *encChal = NULL;
+    unsigned modulusLen = 0;
+    SECStatus rv = SECFailure;
+    CMMFRand randStr = { { siBuffer, NULL, 0 }, { siBuffer, NULL, 0 } };
+    PK11SlotInfo *slot;
+    PK11SymKey *symKey = NULL;
+    CERTSubjectPublicKeyInfo *spki = NULL;
+
+    encodedRandNum = SEC_ASN1EncodeInteger(poolp, &challenge->randomNumber,
+                                           inRandom);
+    if (!encodedRandNum) {
+        goto loser;
+    }
+    randHash = PORT_ArenaNewArray(poolp, unsigned char, SHA1_LENGTH);
+    senderHash = PORT_ArenaNewArray(poolp, unsigned char, SHA1_LENGTH);
+    if (randHash == NULL) {
+        goto loser;
+    }
+    rv = PK11_HashBuf(SEC_OID_SHA1, randHash, encodedRandNum->data,
+                      (PRUint32)encodedRandNum->len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = PK11_HashBuf(SEC_OID_SHA1, senderHash, senderDER->data,
+                      (PRUint32)senderDER->len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    challenge->witness.data = randHash;
+    challenge->witness.len = SHA1_LENGTH;
+
+    randStr.integer = *encodedRandNum;
+    randStr.senderHash.data = senderHash;
+    randStr.senderHash.len = SHA1_LENGTH;
+    dummy = SEC_ASN1EncodeItem(NULL, &encodedRandStr, &randStr,
+                               CMMFRandTemplate);
+    if (dummy != &encodedRandStr) {
+        rv = SECFailure;
+        goto loser;
+    }
+    /* XXXX Now I have to encrypt encodedRandStr and stash it away. */
+    modulusLen = SECKEY_PublicKeyStrength(inPubKey);
+    encChal = PORT_ArenaNewArray(poolp, unsigned char, modulusLen);
+    if (encChal == NULL) {
+        rv = SECFailure;
+        goto loser;
+    }
+    slot = PK11_GetBestSlotWithAttributes(CKM_RSA_PKCS, CKF_WRAP, 0, passwdArg);
+    if (slot == NULL) {
+        rv = SECFailure;
+        goto loser;
+    }
+    (void)PK11_ImportPublicKey(slot, inPubKey, PR_FALSE);
+    /* In order to properly encrypt the data, we import as a symmetric
+     * key, and then wrap that key.  That in essence encrypts the data.
+     * This is the method recommended in the PK11 world in order
+     * to prevent threading issues as well as breaking any other semantics
+     * the PK11 libraries depend on.
+     */
+    symKey = PK11_ImportSymKey(slot, CKM_RSA_PKCS, PK11_OriginGenerated,
+                               CKA_VALUE, &encodedRandStr, passwdArg);
+    if (symKey == NULL) {
+        rv = SECFailure;
+        goto loser;
+    }
+    challenge->challenge.data = encChal;
+    challenge->challenge.len = modulusLen;
+    rv = PK11_PubWrapSymKey(CKM_RSA_PKCS, inPubKey, symKey,
+                            &challenge->challenge);
+    PK11_FreeSlot(slot);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SECITEM_CopyItem(poolp, &challenge->senderDER, senderDER);
+    crmf_get_public_value(inPubKey, &challenge->key);
+/* Fall through */
+loser:
+    if (spki != NULL) {
+        SECKEY_DestroySubjectPublicKeyInfo(spki);
+    }
+    if (encodedRandStr.data != NULL) {
+        PORT_Free(encodedRandStr.data);
+    }
+    if (encodedRandNum != NULL) {
+        SECITEM_FreeItem(encodedRandNum, PR_TRUE);
+    }
+    if (symKey != NULL) {
+        PK11_FreeSymKey(symKey);
+    }
+    return rv;
+}
+
+static SECStatus
+cmmf_create_first_challenge(CMMFPOPODecKeyChallContent *challContent,
+                            long inRandom,
+                            SECItem *senderDER,
+                            SECKEYPublicKey *inPubKey,
+                            void *passwdArg)
+{
+    SECOidData *oidData;
+    CMMFChallenge *challenge;
+    SECAlgorithmID *algId;
+    PLArenaPool *poolp;
+    SECStatus rv;
+
+    oidData = SECOID_FindOIDByTag(SEC_OID_SHA1);
+    if (oidData == NULL) {
+        return SECFailure;
+    }
+    poolp = challContent->poolp;
+    challenge = PORT_ArenaZNew(poolp, CMMFChallenge);
+    if (challenge == NULL) {
+        return SECFailure;
+    }
+    algId = challenge->owf = PORT_ArenaZNew(poolp, SECAlgorithmID);
+    if (algId == NULL) {
+        return SECFailure;
+    }
+    rv = SECITEM_CopyItem(poolp, &algId->algorithm, &oidData->oid);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+    rv = cmmf_create_witness_and_challenge(poolp, challenge, inRandom,
+                                           senderDER, inPubKey, passwdArg);
+    challContent->challenges[0] = (rv == SECSuccess) ? challenge : NULL;
+    challContent->numChallenges++;
+    return rv;
+}
+
+CMMFPOPODecKeyChallContent *
+CMMF_CreatePOPODecKeyChallContent(void)
+{
+    PLArenaPool *poolp;
+    CMMFPOPODecKeyChallContent *challContent;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    challContent = PORT_ArenaZNew(poolp, CMMFPOPODecKeyChallContent);
+    if (challContent == NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+        return NULL;
+    }
+    challContent->poolp = poolp;
+    return challContent;
+}
+
+SECStatus
+CMMF_POPODecKeyChallContentSetNextChallenge(CMMFPOPODecKeyChallContent *inDecKeyChall,
+                                            long inRandom,
+                                            CERTGeneralName *inSender,
+                                            SECKEYPublicKey *inPubKey,
+                                            void *passwdArg)
+{
+    CMMFChallenge *curChallenge;
+    PLArenaPool *genNamePool = NULL, *poolp;
+    SECStatus rv;
+    SECItem *genNameDER;
+    void *mark;
+
+    PORT_Assert(inDecKeyChall != NULL &&
+                inSender != NULL &&
+                inPubKey != NULL);
+
+    if (inDecKeyChall == NULL ||
+        inSender == NULL || inPubKey == NULL) {
+        return SECFailure;
+    }
+    poolp = inDecKeyChall->poolp;
+    mark = PORT_ArenaMark(poolp);
+
+    genNamePool = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    genNameDER = CERT_EncodeGeneralName(inSender, NULL, genNamePool);
+    if (genNameDER == NULL) {
+        rv = SECFailure;
+        goto loser;
+    }
+    if (inDecKeyChall->challenges == NULL) {
+        inDecKeyChall->challenges =
+            PORT_ArenaZNewArray(poolp, CMMFChallenge *, (CMMF_MAX_CHALLENGES + 1));
+        inDecKeyChall->numAllocated = CMMF_MAX_CHALLENGES;
+    }
+
+    if (inDecKeyChall->numChallenges >= inDecKeyChall->numAllocated) {
+        rv = SECFailure;
+        goto loser;
+    }
+
+    if (inDecKeyChall->numChallenges == 0) {
+        rv = cmmf_create_first_challenge(inDecKeyChall, inRandom,
+                                         genNameDER, inPubKey, passwdArg);
+    } else {
+        curChallenge = PORT_ArenaZNew(poolp, CMMFChallenge);
+        if (curChallenge == NULL) {
+            rv = SECFailure;
+            goto loser;
+        }
+        rv = cmmf_create_witness_and_challenge(poolp, curChallenge, inRandom,
+                                               genNameDER, inPubKey,
+                                               passwdArg);
+        if (rv == SECSuccess) {
+            inDecKeyChall->challenges[inDecKeyChall->numChallenges] =
+                curChallenge;
+            inDecKeyChall->numChallenges++;
+        }
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    PORT_FreeArena(genNamePool, PR_FALSE);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    if (genNamePool != NULL) {
+        PORT_FreeArena(genNamePool, PR_FALSE);
+    }
+    PORT_Assert(rv != SECSuccess);
+    return rv;
+}
+
+SECStatus
+CMMF_DestroyPOPODecKeyRespContent(CMMFPOPODecKeyRespContent *inDecKeyResp)
+{
+    PORT_Assert(inDecKeyResp != NULL);
+    if (inDecKeyResp != NULL && inDecKeyResp->poolp != NULL) {
+        PORT_FreeArena(inDecKeyResp->poolp, PR_FALSE);
+    }
+    return SECSuccess;
+}
+
+int
+CMMF_POPODecKeyRespContentGetNumResponses(CMMFPOPODecKeyRespContent *inRespCont)
+{
+    int numResponses = 0;
+
+    PORT_Assert(inRespCont != NULL);
+    if (inRespCont == NULL) {
+        return 0;
+    }
+
+    while (inRespCont->responses[numResponses] != NULL) {
+        numResponses++;
+    }
+    return numResponses;
+}
+
+SECStatus
+CMMF_POPODecKeyRespContentGetResponse(CMMFPOPODecKeyRespContent *inRespCont,
+                                      int inIndex,
+                                      long *inDest)
+{
+    PORT_Assert(inRespCont != NULL);
+
+    if (inRespCont == NULL || inIndex < 0 ||
+        inIndex >= CMMF_POPODecKeyRespContentGetNumResponses(inRespCont)) {
+        return SECFailure;
+    }
+    *inDest = DER_GetInteger(inRespCont->responses[inIndex]);
+    return (*inDest == -1) ? SECFailure : SECSuccess;
+}
diff --git a/security/nss/lib/crmf/cmmfi.h b/security/nss/lib/crmf/cmmfi.h
new file mode 100644
index 0000000000..9336ccfc23
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfi.h
@@ -0,0 +1,92 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * These are the definitions needed by the library internally to implement
+ * CMMF.  Most of these will be helper utilities for manipulating internal
+ * data strucures.
+ */
+#ifndef _CMMFI_H_
+#define _CMMFI_H_
+#include "cmmfit.h"
+#include "crmfi.h"
+
+#define CMMF_MAX_CHALLENGES 10
+#define CMMF_MAX_KEY_PAIRS 50
+
+/*
+ * Some templates that the code will need to implement CMMF.
+ */
+extern const SEC_ASN1Template CMMFCertOrEncCertCertificateTemplate[];
+extern const SEC_ASN1Template CMMFCertOrEncCertEncryptedCertTemplate[];
+extern const SEC_ASN1Template CMMFPOPODecKeyRespContentTemplate[];
+extern const SEC_ASN1Template CMMFRandTemplate[];
+extern const SEC_ASN1Template CMMFSequenceOfCertsTemplate[];
+extern const SEC_ASN1Template CMMFPKIStatusInfoTemplate[];
+extern const SEC_ASN1Template CMMFCertifiedKeyPairTemplate[];
+
+/*
+ * Some utility functions that are shared by multiple files in this
+ * implementation.
+ */
+
+extern SECStatus cmmf_CopyCertResponse(PLArenaPool *poolp,
+                                       CMMFCertResponse *dest,
+                                       CMMFCertResponse *src);
+
+extern SECStatus cmmf_CopyPKIStatusInfo(PLArenaPool *poolp,
+                                        CMMFPKIStatusInfo *dest,
+                                        CMMFPKIStatusInfo *src);
+
+extern SECStatus cmmf_CopyCertifiedKeyPair(PLArenaPool *poolp,
+                                           CMMFCertifiedKeyPair *dest,
+                                           CMMFCertifiedKeyPair *src);
+
+extern SECStatus cmmf_DestroyPKIStatusInfo(CMMFPKIStatusInfo *info,
+                                           PRBool freeit);
+
+extern SECStatus cmmf_DestroyCertOrEncCert(CMMFCertOrEncCert *certOrEncCert,
+                                           PRBool freeit);
+
+extern SECStatus cmmf_PKIStatusInfoSetStatus(CMMFPKIStatusInfo *statusInfo,
+                                             PLArenaPool *poolp,
+                                             CMMFPKIStatus inStatus);
+
+extern SECStatus cmmf_ExtractCertsFromList(CERTCertList *inCertList,
+                                           PLArenaPool *poolp,
+                                           CERTCertificate ***certArray);
+
+extern SECStatus
+cmmf_CertOrEncCertSetCertificate(CMMFCertOrEncCert *certOrEncCert,
+                                 PLArenaPool *poolp,
+                                 CERTCertificate *inCert);
+
+extern CMMFPKIStatus
+cmmf_PKIStatusInfoGetStatus(CMMFPKIStatusInfo *inStatus);
+
+extern CERTCertList *
+cmmf_MakeCertList(CERTCertificate **inCerts);
+
+extern CERTCertificate *
+cmmf_CertOrEncCertGetCertificate(CMMFCertOrEncCert *certOrEncCert,
+                                 CERTCertDBHandle *certdb);
+
+extern SECStatus
+cmmf_decode_process_cert_response(PLArenaPool *poolp,
+                                  CERTCertDBHandle *db,
+                                  CMMFCertResponse *inCertResp);
+
+extern SECStatus
+cmmf_decode_process_certified_key_pair(PLArenaPool *poolp,
+                                       CERTCertDBHandle *db,
+                                       CMMFCertifiedKeyPair *inCertKeyPair);
+
+extern SECStatus
+cmmf_user_encode(void *src, CRMFEncoderOutputCallback inCallback, void *inArg,
+                 const SEC_ASN1Template *inTemplate);
+
+extern SECStatus
+cmmf_copy_secitem(PLArenaPool *poolp, SECItem *dest, SECItem *src);
+#endif /*_CMMFI_H_*/
diff --git a/security/nss/lib/crmf/cmmfit.h b/security/nss/lib/crmf/cmmfit.h
new file mode 100644
index 0000000000..014413f075
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfit.h
@@ -0,0 +1,115 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CMMFIT_H_
+#define _CMMFIT_H_
+
+/*
+ * All fields marked by a PKIStausInfo in comments is an integer
+ * with the following possible values.
+ *
+ *  Integer Value          Meaning
+ *  -------------          -------
+ *         0               granted- got exactly what you asked for.
+ *
+ *         1               grantedWithMods-got something like what you asked
+ *                          for;requester is responsible for ascertainging the
+ *                          differences.
+ *
+ *         2               rejection-you don't get what you asked for; more
+ *                          information elsewhere in the message
+ *
+ *         3               waiting-the request body part has not yet been
+ *                          processed, expect to hear more later.
+ *
+ *         4               revocationWarning-this message contains a warning
+ *                          that a revocation is imminent.
+ *
+ *         5               revocationNotification-notification that a
+ *                          revocation has occurred.
+ *
+ *         6               keyUpdateWarning-update already done for the
+ *                          oldCertId specified in FullCertTemplate.
+ */
+
+struct CMMFPKIStatusInfoStr {
+    SECItem status;
+    SECItem statusString;
+    SECItem failInfo;
+};
+
+struct CMMFCertOrEncCertStr {
+    union {
+        CERTCertificate *certificate;
+        CRMFEncryptedValue *encryptedCert;
+    } cert;
+    CMMFCertOrEncCertChoice choice;
+    SECItem derValue;
+};
+
+struct CMMFCertifiedKeyPairStr {
+    CMMFCertOrEncCert certOrEncCert;
+    CRMFEncryptedValue *privateKey;
+    SECItem derPublicationInfo; /* We aren't creating
+                                 * PKIPublicationInfo's, so
+                                 * we'll store away the der
+                                 * here if we decode one that
+                                 * does have pubInfo.
+                                 */
+    SECItem unwrappedPrivKey;
+};
+
+struct CMMFCertResponseStr {
+    SECItem certReqId;
+    CMMFPKIStatusInfo status; /*PKIStatusInfo*/
+    CMMFCertifiedKeyPair *certifiedKeyPair;
+};
+
+struct CMMFCertRepContentStr {
+    CERTCertificate **caPubs;
+    CMMFCertResponse **response;
+    PLArenaPool *poolp;
+    PRBool isDecoded;
+};
+
+struct CMMFChallengeStr {
+    SECAlgorithmID *owf;
+    SECItem witness;
+    SECItem senderDER;
+    SECItem key;
+    SECItem challenge;
+    SECItem randomNumber;
+};
+
+struct CMMFRandStr {
+    SECItem integer;
+    SECItem senderHash;
+    CERTGeneralName *sender;
+};
+
+struct CMMFPOPODecKeyChallContentStr {
+    CMMFChallenge **challenges;
+    PLArenaPool *poolp;
+    int numChallenges;
+    int numAllocated;
+};
+
+struct CMMFPOPODecKeyRespContentStr {
+    SECItem **responses;
+    PLArenaPool *poolp;
+};
+
+struct CMMFKeyRecRepContentStr {
+    CMMFPKIStatusInfo status; /* PKIStatusInfo */
+    CERTCertificate *newSigCert;
+    CERTCertificate **caCerts;
+    CMMFCertifiedKeyPair **keyPairHist;
+    PLArenaPool *poolp;
+    int numKeyPairs;
+    int allocKeyPairs;
+    PRBool isDecoded;
+};
+
+#endif /* _CMMFIT_H_ */
diff --git a/security/nss/lib/crmf/cmmfrec.c b/security/nss/lib/crmf/cmmfrec.c
new file mode 100644
index 0000000000..3c55350158
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfrec.c
@@ -0,0 +1,316 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This file will implement the functions related to key recovery in
+ * CMMF
+ */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "secitem.h"
+#include "keyhi.h"
+
+CMMFKeyRecRepContent *
+CMMF_CreateKeyRecRepContent(void)
+{
+    PLArenaPool *poolp;
+    CMMFKeyRecRepContent *keyRecContent;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    keyRecContent = PORT_ArenaZNew(poolp, CMMFKeyRecRepContent);
+    if (keyRecContent == NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+        return NULL;
+    }
+    keyRecContent->poolp = poolp;
+    return keyRecContent;
+}
+
+SECStatus
+CMMF_DestroyKeyRecRepContent(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    if (inKeyRecRep != NULL && inKeyRecRep->poolp != NULL) {
+        int i;
+
+        if (!inKeyRecRep->isDecoded && inKeyRecRep->newSigCert != NULL) {
+            CERT_DestroyCertificate(inKeyRecRep->newSigCert);
+        }
+        if (inKeyRecRep->caCerts != NULL) {
+            for (i = 0; inKeyRecRep->caCerts[i] != NULL; i++) {
+                CERT_DestroyCertificate(inKeyRecRep->caCerts[i]);
+            }
+        }
+        if (inKeyRecRep->keyPairHist != NULL) {
+            for (i = 0; inKeyRecRep->keyPairHist[i] != NULL; i++) {
+                if (inKeyRecRep->keyPairHist[i]->certOrEncCert.choice ==
+                    cmmfCertificate) {
+                    CERT_DestroyCertificate(inKeyRecRep->keyPairHist[i]->certOrEncCert.cert.certificate);
+                }
+            }
+        }
+        PORT_FreeArena(inKeyRecRep->poolp, PR_TRUE);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CMMF_KeyRecRepContentSetPKIStatusInfoStatus(CMMFKeyRecRepContent *inKeyRecRep,
+                                            CMMFPKIStatus inPKIStatus)
+{
+    PORT_Assert(inKeyRecRep != NULL && inPKIStatus >= cmmfGranted &&
+                inPKIStatus < cmmfNumPKIStatus);
+    if (inKeyRecRep == NULL) {
+        return SECFailure;
+    }
+
+    return cmmf_PKIStatusInfoSetStatus(&inKeyRecRep->status,
+                                       inKeyRecRep->poolp,
+                                       inPKIStatus);
+}
+
+SECStatus
+CMMF_KeyRecRepContentSetNewSignCert(CMMFKeyRecRepContent *inKeyRecRep,
+                                    CERTCertificate *inNewSignCert)
+{
+    PORT_Assert(inKeyRecRep != NULL && inNewSignCert != NULL);
+    if (inKeyRecRep == NULL || inNewSignCert == NULL) {
+        return SECFailure;
+    }
+    if (!inKeyRecRep->isDecoded && inKeyRecRep->newSigCert) {
+        CERT_DestroyCertificate(inKeyRecRep->newSigCert);
+    }
+    inKeyRecRep->isDecoded = PR_FALSE;
+    inKeyRecRep->newSigCert = CERT_DupCertificate(inNewSignCert);
+    return (inKeyRecRep->newSigCert == NULL) ? SECFailure : SECSuccess;
+}
+
+SECStatus
+CMMF_KeyRecRepContentSetCACerts(CMMFKeyRecRepContent *inKeyRecRep,
+                                CERTCertList *inCACerts)
+{
+    SECStatus rv;
+    void *mark;
+
+    PORT_Assert(inKeyRecRep != NULL && inCACerts != NULL);
+    if (inKeyRecRep == NULL || inCACerts == NULL) {
+        return SECFailure;
+    }
+    mark = PORT_ArenaMark(inKeyRecRep->poolp);
+    rv = cmmf_ExtractCertsFromList(inCACerts, inKeyRecRep->poolp,
+                                   &inKeyRecRep->caCerts);
+    if (rv != SECSuccess) {
+        PORT_ArenaRelease(inKeyRecRep->poolp, mark);
+    } else {
+        PORT_ArenaUnmark(inKeyRecRep->poolp, mark);
+    }
+    return rv;
+}
+
+SECStatus
+CMMF_KeyRecRepContentSetCertifiedKeyPair(CMMFKeyRecRepContent *inKeyRecRep,
+                                         CERTCertificate *inCert,
+                                         SECKEYPrivateKey *inPrivKey,
+                                         SECKEYPublicKey *inPubKey)
+{
+    CMMFCertifiedKeyPair *keyPair;
+    CRMFEncryptedValue *dummy;
+    PLArenaPool *poolp;
+    void *mark;
+    SECStatus rv;
+
+    PORT_Assert(inKeyRecRep != NULL &&
+                inCert != NULL &&
+                inPrivKey != NULL &&
+                inPubKey != NULL);
+    if (inKeyRecRep == NULL ||
+        inCert == NULL ||
+        inPrivKey == NULL ||
+        inPubKey == NULL) {
+        return SECFailure;
+    }
+    poolp = inKeyRecRep->poolp;
+    mark = PORT_ArenaMark(poolp);
+    if (inKeyRecRep->keyPairHist == NULL) {
+        inKeyRecRep->keyPairHist = PORT_ArenaNewArray(poolp,
+                                                      CMMFCertifiedKeyPair *,
+                                                      (CMMF_MAX_KEY_PAIRS + 1));
+        if (inKeyRecRep->keyPairHist == NULL) {
+            goto loser;
+        }
+        inKeyRecRep->allocKeyPairs = CMMF_MAX_KEY_PAIRS;
+        inKeyRecRep->numKeyPairs = 0;
+    }
+
+    if (inKeyRecRep->allocKeyPairs == inKeyRecRep->numKeyPairs) {
+        goto loser;
+    }
+
+    keyPair = PORT_ArenaZNew(poolp, CMMFCertifiedKeyPair);
+    if (keyPair == NULL) {
+        goto loser;
+    }
+    rv = cmmf_CertOrEncCertSetCertificate(&keyPair->certOrEncCert,
+                                          poolp, inCert);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    keyPair->privateKey = PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+    if (keyPair->privateKey == NULL) {
+        goto loser;
+    }
+    dummy = crmf_create_encrypted_value_wrapped_privkey(inPrivKey, inPubKey,
+                                                        keyPair->privateKey);
+    PORT_Assert(dummy == keyPair->privateKey);
+    if (dummy != keyPair->privateKey) {
+        crmf_destroy_encrypted_value(dummy, PR_TRUE);
+        goto loser;
+    }
+    inKeyRecRep->keyPairHist[inKeyRecRep->numKeyPairs] = keyPair;
+    inKeyRecRep->numKeyPairs++;
+    inKeyRecRep->keyPairHist[inKeyRecRep->numKeyPairs] = NULL;
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+CMMFPKIStatus
+CMMF_KeyRecRepContentGetPKIStatusInfoStatus(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    if (inKeyRecRep == NULL) {
+        return cmmfNoPKIStatus;
+    }
+    return cmmf_PKIStatusInfoGetStatus(&inKeyRecRep->status);
+}
+
+CERTCertificate *
+CMMF_KeyRecRepContentGetNewSignCert(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    if (inKeyRecRep == NULL ||
+        inKeyRecRep->newSigCert == NULL) {
+        return NULL;
+    }
+    /* newSigCert may not be a real certificate, it may be a hand decoded
+     * cert structure. This code makes sure we hand off a real, fully formed
+     * CERTCertificate to the caller. TODO: This should move into the decode
+     * portion so that we never wind up with a half formed CERTCertificate
+     * here. In this case the call would be to CERT_DupCertificate.
+     */
+    return CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
+                                   &inKeyRecRep->newSigCert->signatureWrap.data,
+                                   NULL, PR_FALSE, PR_TRUE);
+}
+
+CERTCertList *
+CMMF_KeyRecRepContentGetCACerts(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    if (inKeyRecRep == NULL || inKeyRecRep->caCerts == NULL) {
+        return NULL;
+    }
+    return cmmf_MakeCertList(inKeyRecRep->caCerts);
+}
+
+int
+CMMF_KeyRecRepContentGetNumKeyPairs(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    return (inKeyRecRep == NULL) ? 0 : inKeyRecRep->numKeyPairs;
+}
+
+PRBool
+cmmf_KeyRecRepContentIsValidIndex(CMMFKeyRecRepContent *inKeyRecRep,
+                                  int inIndex)
+{
+    int numKeyPairs = CMMF_KeyRecRepContentGetNumKeyPairs(inKeyRecRep);
+
+    return (PRBool)(inIndex >= 0 && inIndex < numKeyPairs);
+}
+
+CMMFCertifiedKeyPair *
+CMMF_KeyRecRepContentGetCertKeyAtIndex(CMMFKeyRecRepContent *inKeyRecRep,
+                                       int inIndex)
+{
+    CMMFCertifiedKeyPair *newKeyPair;
+    SECStatus rv;
+
+    PORT_Assert(inKeyRecRep != NULL &&
+                cmmf_KeyRecRepContentIsValidIndex(inKeyRecRep, inIndex));
+    if (inKeyRecRep == NULL ||
+        !cmmf_KeyRecRepContentIsValidIndex(inKeyRecRep, inIndex)) {
+        return NULL;
+    }
+    newKeyPair = PORT_ZNew(CMMFCertifiedKeyPair);
+    if (newKeyPair == NULL) {
+        return NULL;
+    }
+    rv = cmmf_CopyCertifiedKeyPair(NULL, newKeyPair,
+                                   inKeyRecRep->keyPairHist[inIndex]);
+    if (rv != SECSuccess) {
+        CMMF_DestroyCertifiedKeyPair(newKeyPair);
+        newKeyPair = NULL;
+    }
+    return newKeyPair;
+}
+
+SECStatus
+CMMF_CertifiedKeyPairUnwrapPrivKey(CMMFCertifiedKeyPair *inKeyPair,
+                                   SECKEYPrivateKey *inPrivKey,
+                                   SECItem *inNickName,
+                                   PK11SlotInfo *inSlot,
+                                   CERTCertDBHandle *inCertdb,
+                                   SECKEYPrivateKey **destPrivKey,
+                                   void *wincx)
+{
+    CERTCertificate *cert;
+    SECItem keyUsageValue = { siBuffer, NULL, 0 };
+    unsigned char keyUsage = 0x0;
+    SECKEYPublicKey *pubKey;
+    SECStatus rv;
+
+    PORT_Assert(inKeyPair != NULL &&
+                inPrivKey != NULL && inCertdb != NULL);
+    if (inKeyPair == NULL ||
+        inPrivKey == NULL ||
+        inKeyPair->privateKey == NULL ||
+        inCertdb == NULL) {
+        return SECFailure;
+    }
+
+    cert = CMMF_CertifiedKeyPairGetCertificate(inKeyPair, inCertdb);
+    CERT_FindKeyUsageExtension(cert, &keyUsageValue);
+    if (keyUsageValue.data != NULL) {
+        keyUsage = keyUsageValue.len ? keyUsageValue.data[0] : 0;
+        PORT_Free(keyUsageValue.data);
+    }
+    pubKey = CERT_ExtractPublicKey(cert);
+    rv = crmf_encrypted_value_unwrap_priv_key(NULL, inKeyPair->privateKey,
+                                              inPrivKey, pubKey,
+                                              inNickName, inSlot, keyUsage,
+                                              destPrivKey, wincx);
+    SECKEY_DestroyPublicKey(pubKey);
+    CERT_DestroyCertificate(cert);
+    return rv;
+}
+
+PRBool
+CMMF_KeyRecRepContentHasCACerts(CMMFKeyRecRepContent *inKeyRecRep)
+{
+    PORT_Assert(inKeyRecRep != NULL);
+    if (inKeyRecRep == NULL) {
+        return PR_FALSE;
+    }
+    return (PRBool)(inKeyRecRep->caCerts != NULL &&
+                    inKeyRecRep->caCerts[0] != NULL);
+}
diff --git a/security/nss/lib/crmf/cmmfresp.c b/security/nss/lib/crmf/cmmfresp.c
new file mode 100644
index 0000000000..c4b59b8e98
--- /dev/null
+++ b/security/nss/lib/crmf/cmmfresp.c
@@ -0,0 +1,280 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This file will contain all routines dealing with creating a
+ * CMMFCertRepContent structure through Create/Set functions.
+ */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "crmf.h"
+#include "crmfi.h"
+#include "secitem.h"
+#include "secder.h"
+
+CMMFCertRepContent *
+CMMF_CreateCertRepContent(void)
+{
+    CMMFCertRepContent *retCertRep;
+    PLArenaPool *poolp;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+    retCertRep = PORT_ArenaZNew(poolp, CMMFCertRepContent);
+    if (retCertRep == NULL) {
+        goto loser;
+    }
+    retCertRep->poolp = poolp;
+    return retCertRep;
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+SECStatus
+cmmf_CertOrEncCertSetCertificate(CMMFCertOrEncCert *certOrEncCert,
+                                 PLArenaPool *poolp,
+                                 CERTCertificate *inCert)
+{
+    SECItem *derDest = NULL;
+    SECStatus rv = SECFailure;
+
+    if (inCert->derCert.data == NULL) {
+        derDest = SEC_ASN1EncodeItem(NULL, NULL, inCert,
+                                     CMMFCertOrEncCertCertificateTemplate);
+        if (derDest == NULL) {
+            goto loser;
+        }
+    } else {
+        derDest = SECITEM_DupItem(&inCert->derCert);
+        if (derDest == NULL) {
+            goto loser;
+        }
+    }
+    PORT_Assert(certOrEncCert->cert.certificate == NULL);
+    certOrEncCert->cert.certificate = CERT_DupCertificate(inCert);
+    certOrEncCert->choice = cmmfCertificate;
+    if (poolp != NULL) {
+        rv = SECITEM_CopyItem(poolp, &certOrEncCert->derValue, derDest);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    } else {
+        certOrEncCert->derValue = *derDest;
+    }
+    PORT_Free(derDest);
+    return SECSuccess;
+loser:
+    if (derDest != NULL) {
+        SECITEM_FreeItem(derDest, PR_TRUE);
+    }
+    return rv;
+}
+
+SECStatus
+cmmf_ExtractCertsFromList(CERTCertList *inCertList,
+                          PLArenaPool *poolp,
+                          CERTCertificate ***certArray)
+{
+    CERTCertificate **arrayLocalCopy;
+    CERTCertListNode *node;
+    int numNodes = 0, i;
+
+    for (node = CERT_LIST_HEAD(inCertList); !CERT_LIST_END(node, inCertList);
+         node = CERT_LIST_NEXT(node)) {
+        numNodes++;
+    }
+
+    arrayLocalCopy = *certArray = (poolp == NULL) ? PORT_NewArray(CERTCertificate *, (numNodes + 1)) : PORT_ArenaNewArray(poolp, CERTCertificate *, (numNodes + 1));
+    if (arrayLocalCopy == NULL) {
+        return SECFailure;
+    }
+    for (node = CERT_LIST_HEAD(inCertList), i = 0;
+         !CERT_LIST_END(node, inCertList);
+         node = CERT_LIST_NEXT(node), i++) {
+        arrayLocalCopy[i] = CERT_DupCertificate(node->cert);
+        if (arrayLocalCopy[i] == NULL) {
+            int j;
+
+            for (j = 0; j < i; j++) {
+                CERT_DestroyCertificate(arrayLocalCopy[j]);
+            }
+            if (poolp == NULL) {
+                PORT_Free(arrayLocalCopy);
+            }
+            *certArray = NULL;
+            return SECFailure;
+        }
+    }
+    arrayLocalCopy[numNodes] = NULL;
+    return SECSuccess;
+}
+
+SECStatus
+CMMF_CertRepContentSetCertResponses(CMMFCertRepContent *inCertRepContent,
+                                    CMMFCertResponse **inCertResponses,
+                                    int inNumResponses)
+{
+    PLArenaPool *poolp;
+    CMMFCertResponse **respArr, *newResp;
+    void *mark;
+    SECStatus rv;
+    int i;
+
+    PORT_Assert(inCertRepContent != NULL &&
+                inCertResponses != NULL &&
+                inNumResponses > 0);
+    if (inCertRepContent == NULL ||
+        inCertResponses == NULL ||
+        inCertRepContent->response != NULL) {
+        return SECFailure;
+    }
+    poolp = inCertRepContent->poolp;
+    mark = PORT_ArenaMark(poolp);
+    respArr = inCertRepContent->response =
+        PORT_ArenaZNewArray(poolp, CMMFCertResponse *, (inNumResponses + 1));
+    if (respArr == NULL) {
+        goto loser;
+    }
+    for (i = 0; i < inNumResponses; i++) {
+        newResp = PORT_ArenaZNew(poolp, CMMFCertResponse);
+        if (newResp == NULL) {
+            goto loser;
+        }
+        rv = cmmf_CopyCertResponse(poolp, newResp, inCertResponses[i]);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+        respArr[i] = newResp;
+    }
+    respArr[inNumResponses] = NULL;
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+CMMFCertResponse *
+CMMF_CreateCertResponse(long inCertReqId)
+{
+    SECItem *dummy;
+    CMMFCertResponse *newResp;
+
+    newResp = PORT_ZNew(CMMFCertResponse);
+    if (newResp == NULL) {
+        goto loser;
+    }
+    dummy = SEC_ASN1EncodeInteger(NULL, &newResp->certReqId, inCertReqId);
+    if (dummy != &newResp->certReqId) {
+        goto loser;
+    }
+    return newResp;
+
+loser:
+    if (newResp != NULL) {
+        CMMF_DestroyCertResponse(newResp);
+    }
+    return NULL;
+}
+
+SECStatus
+CMMF_CertResponseSetPKIStatusInfoStatus(CMMFCertResponse *inCertResp,
+                                        CMMFPKIStatus inPKIStatus)
+{
+    PORT_Assert(inCertResp != NULL && inPKIStatus >= cmmfGranted &&
+                inPKIStatus < cmmfNumPKIStatus);
+
+    if (inCertResp == NULL) {
+        return SECFailure;
+    }
+    return cmmf_PKIStatusInfoSetStatus(&inCertResp->status, NULL,
+                                       inPKIStatus);
+}
+
+SECStatus
+CMMF_CertResponseSetCertificate(CMMFCertResponse *inCertResp,
+                                CERTCertificate *inCertificate)
+{
+    CMMFCertifiedKeyPair *keyPair = NULL;
+    SECStatus rv = SECFailure;
+
+    PORT_Assert(inCertResp != NULL && inCertificate != NULL);
+    if (inCertResp == NULL || inCertificate == NULL) {
+        return SECFailure;
+    }
+    if (inCertResp->certifiedKeyPair == NULL) {
+        keyPair = inCertResp->certifiedKeyPair =
+            PORT_ZNew(CMMFCertifiedKeyPair);
+    } else {
+        keyPair = inCertResp->certifiedKeyPair;
+    }
+    if (keyPair == NULL) {
+        goto loser;
+    }
+    rv = cmmf_CertOrEncCertSetCertificate(&keyPair->certOrEncCert, NULL,
+                                          inCertificate);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return SECSuccess;
+loser:
+    if (keyPair) {
+        if (keyPair->certOrEncCert.derValue.data) {
+            PORT_Free(keyPair->certOrEncCert.derValue.data);
+        }
+        PORT_Free(keyPair);
+    }
+    return rv;
+}
+
+SECStatus
+CMMF_CertRepContentSetCAPubs(CMMFCertRepContent *inCertRepContent,
+                             CERTCertList *inCAPubs)
+{
+    PLArenaPool *poolp;
+    void *mark;
+    SECStatus rv;
+
+    PORT_Assert(inCertRepContent != NULL &&
+                inCAPubs != NULL &&
+                inCertRepContent->caPubs == NULL);
+
+    if (inCertRepContent == NULL ||
+        inCAPubs == NULL || inCertRepContent == NULL) {
+        return SECFailure;
+    }
+
+    poolp = inCertRepContent->poolp;
+    mark = PORT_ArenaMark(poolp);
+
+    rv = cmmf_ExtractCertsFromList(inCAPubs, poolp,
+                                   &inCertRepContent->caPubs);
+
+    if (rv != SECSuccess) {
+        PORT_ArenaRelease(poolp, mark);
+    } else {
+        PORT_ArenaUnmark(poolp, mark);
+    }
+    return rv;
+}
+
+CERTCertificate *
+CMMF_CertifiedKeyPairGetCertificate(CMMFCertifiedKeyPair *inCertKeyPair,
+                                    CERTCertDBHandle *inCertdb)
+{
+    PORT_Assert(inCertKeyPair != NULL);
+    if (inCertKeyPair == NULL) {
+        return NULL;
+    }
+    return cmmf_CertOrEncCertGetCertificate(&inCertKeyPair->certOrEncCert,
+                                            inCertdb);
+}
diff --git a/security/nss/lib/crmf/cmmft.h b/security/nss/lib/crmf/cmmft.h
new file mode 100644
index 0000000000..e39f19ed3a
--- /dev/null
+++ b/security/nss/lib/crmf/cmmft.h
@@ -0,0 +1,73 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CMMFT_H_
+#define _CMMFT_H_
+
+#include "secasn1.h"
+
+/*
+ * These are the enumerations used to distinguish between the different
+ * choices available for the CMMFCertOrEncCert structure.
+ */
+typedef enum {
+    cmmfNoCertOrEncCert = 0,
+    cmmfCertificate = 1,
+    cmmfEncryptedCert = 2
+} CMMFCertOrEncCertChoice;
+
+/*
+ * This is the enumeration and the corresponding values used to
+ * represent the CMMF type PKIStatus
+ */
+typedef enum {
+    cmmfNoPKIStatus = -1,
+    cmmfGranted = 0,
+    cmmfGrantedWithMods = 1,
+    cmmfRejection = 2,
+    cmmfWaiting = 3,
+    cmmfRevocationWarning = 4,
+    cmmfRevocationNotification = 5,
+    cmmfKeyUpdateWarning = 6,
+    cmmfNumPKIStatus
+} CMMFPKIStatus;
+
+/*
+ * These enumerations are used to represent the corresponding values
+ * in PKIFailureInfo defined in CMMF.
+ */
+typedef enum {
+    cmmfBadAlg = 0,
+    cmmfBadMessageCheck = 1,
+    cmmfBadRequest = 2,
+    cmmfBadTime = 3,
+    cmmfBadCertId = 4,
+    cmmfBadDataFormat = 5,
+    cmmfWrongAuthority = 6,
+    cmmfIncorrectData = 7,
+    cmmfMissingTimeStamp = 8,
+    cmmfNoFailureInfo = 9
+} CMMFPKIFailureInfo;
+
+typedef struct CMMFPKIStatusInfoStr CMMFPKIStatusInfo;
+typedef struct CMMFCertOrEncCertStr CMMFCertOrEncCert;
+typedef struct CMMFCertifiedKeyPairStr CMMFCertifiedKeyPair;
+typedef struct CMMFCertResponseStr CMMFCertResponse;
+typedef struct CMMFCertResponseSeqStr CMMFCertResponseSeq;
+typedef struct CMMFPOPODecKeyChallContentStr CMMFPOPODecKeyChallContent;
+typedef struct CMMFChallengeStr CMMFChallenge;
+typedef struct CMMFRandStr CMMFRand;
+typedef struct CMMFPOPODecKeyRespContentStr CMMFPOPODecKeyRespContent;
+typedef struct CMMFKeyRecRepContentStr CMMFKeyRecRepContent;
+typedef struct CMMFCertRepContentStr CMMFCertRepContent;
+
+/* Export this so people can call SEC_ASN1EncodeItem instead of having to
+ * write callbacks that are passed in to the high level encode function
+ * for CMMFCertRepContent.
+ */
+extern const SEC_ASN1Template CMMFCertRepContentTemplate[];
+extern const SEC_ASN1Template CMMFPOPODecKeyChallContentTemplate[];
+
+#endif /*_CMMFT_H_*/
diff --git a/security/nss/lib/crmf/crmf.gyp b/security/nss/lib/crmf/crmf.gyp
new file mode 100644
index 0000000000..f8fa8a48d6
--- /dev/null
+++ b/security/nss/lib/crmf/crmf.gyp
@@ -0,0 +1,43 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'crmf',
+      'type': 'static_library',
+      'sources': [
+        'asn1cmn.c',
+        'challcli.c',
+        'cmmfasn1.c',
+        'cmmfchal.c',
+        'cmmfrec.c',
+        'cmmfresp.c',
+        'crmfcont.c',
+        'crmfdec.c',
+        'crmfenc.c',
+        'crmfget.c',
+        'crmfpop.c',
+        'crmfreq.c',
+        'crmftmpl.c',
+        'encutil.c',
+        'respcli.c',
+        'respcmn.c',
+        'servget.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ],
+      'variables': {
+        # This is purely for the use of the Mozilla build system.
+        'no_expand_libs': 1,
+      },
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
diff --git a/security/nss/lib/crmf/crmf.h b/security/nss/lib/crmf/crmf.h
new file mode 100644
index 0000000000..c56e28913b
--- /dev/null
+++ b/security/nss/lib/crmf/crmf.h
@@ -0,0 +1,1741 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CRMF_H_
+#define _CRMF_H_
+
+#include "seccomon.h"
+#include "cert.h"
+#include "crmft.h"
+#include "secoid.h"
+#include "secpkcs7.h"
+
+SEC_BEGIN_PROTOS
+
+/*
+ * FUNCTION: CRMF_EncodeCertReqMsg
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to be encoded.
+ *    fn
+ *        A Callback function that the ASN1 encoder calls whenever
+ *        the encoder wants to write out some DER encoded bytes.
+ *    arg
+ *        An opaque pointer that gets passed to the function fn
+ * OUTPUT:
+ *    The function fn will be called multiple times.  Look at the
+ *    comments in crmft.h where the CRMFEncoderOutputCallback type is
+ *    defined for information on proper behavior of the function fn.
+ * RETURN:
+ *    SECSuccess if encoding was successful.  Any other return value
+ *    indicates an error occurred during encoding.
+ */
+extern SECStatus
+CRMF_EncodeCertReqMsg(CRMFCertReqMsg *inCertReqMsg,
+                      CRMFEncoderOutputCallback fn,
+                      void *arg);
+
+/*
+ * FUNCTION: CRMF_EncoderCertRequest
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to be encoded.
+ *    fn
+ *        A Callback function that the ASN1 encoder calls whenever
+ *        the encoder wants to write out some DER encoded bytes.
+ *    arg
+ *        An opaque pointer that gets passed to the function fn.
+ * OUTPUT:
+ *    The function fn will be called, probably multiple times whenever
+ *    the ASN1 encoder wants to write out DER-encoded bytes.  Look at the
+ *    comments in crmft.h where the CRMFEncoderOutputCallback type is
+ *    defined for information on proper behavior of the function fn.
+ * RETURN:
+ *    SECSuccess if encoding was successful.  Any other return value
+ *    indicates an error occurred during encoding.
+ */
+extern SECStatus CRMF_EncodeCertRequest(CRMFCertRequest *inCertReq,
+                                        CRMFEncoderOutputCallback fn,
+                                        void *arg);
+/*
+ * FUNCTION: CRMF_EncodeCertReqMessages
+ * INPUTS:
+ *    inCertReqMsgs
+ *        An array of pointers to the Certificate Request Messages
+ *        to encode.  The user must place a NULL pointer in the index
+ *        after the last message to be encoded.  When the library runs
+ *        into the NULL pointer, the library assumes there are no more
+ *        messages to encode.
+ *    fn
+ *        A Callback function that the ASN1 encoder calls whenever
+ *        the encoder wants to write out some DER encoded byts.
+ *    arg
+ *        An opaque pointer that gets passed to the function fn.
+ *
+ * NOTES:
+ *    The parameter inCertReqMsgs needs to be an array with a NULL pointer
+ *    to signal the end of messages.  An array in the form of
+ *    {m1, m2, m3, NULL, m4, ...} will only encode the messages m1, m2, and
+ *    m3.  All messages from m4 on will not be looked at by the library.
+ *
+ * OUTPUT:
+ *    The function fn will be called, probably multiple times.  Look at the
+ *    comments in crmft.h where the CRMFEncoderOutputCallback type is
+ *    defined for information on proper behavior of the function fn.
+ *
+ * RETURN:
+ * SECSuccess if encoding the Certificate Request Messages was successful.
+ * Any other return value indicates an error occurred while encoding the
+ * certificate request messages.
+ */
+extern SECStatus
+CRMF_EncodeCertReqMessages(CRMFCertReqMsg **inCertReqMsgs,
+                           CRMFEncoderOutputCallback fn,
+                           void *arg);
+
+/*
+ * FUNCTION: CRMF_CreateCertReqMsg
+ * INPUTS:
+ *    NONE
+ * OUTPUT:
+ *    An empty CRMF Certificate Request Message.
+ *    Before encoding this message, the user must set
+ *    the ProofOfPossession field and the certificate
+ *    request which are necessary for the full message.
+ *    After the user no longer needs this CertReqMsg,
+ *    the user must call CRMF_DestroyCertReqMsg to free
+ *    all memory associated with the Certificate Request
+ *    Message.
+ * RETURN:
+ *    A pointer to a Certificate Request Message.  The user
+ *    must pass the return value of this function to
+ *    CRMF_DestroyCertReqMsg after the Certificate Request
+ *    Message is no longer necessary.
+ */
+extern CRMFCertReqMsg *CRMF_CreateCertReqMsg(void);
+
+/*
+ * FUNCTION: CRMF_DestroyCertReqMsg
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to destroy.
+ *  NOTES:
+ *    This function frees all the memory used for the Certificate
+ *    Request Message and all the memory used in making copies of
+ *    fields of elelments of the message, eg. the Proof Of Possession
+ *    filed and the Cetificate Request.
+ * RETURN:
+ *    SECSuccess if destruction was successful.  Any other return value
+ *    indicates an error while trying to free the memory associated
+ *    with inCertReqMsg.
+ *
+ */
+extern SECStatus CRMF_DestroyCertReqMsg(CRMFCertReqMsg *inCertReqMsg);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgSetCertRequest
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message that the function will set
+ *        the certificate request for.
+ *    inCertReq
+ *        The Certificate Request that will be added to the Certificate
+ *        Request Message.
+ * NOTES:
+ *    This function will make a copy of the Certificate Request passed in
+ *    and store it as part of the Certificate Request Message.  Therefore,
+ *    the user must not call this function until the Certificate Request
+ *    has been fully built and is ready to be encoded.
+ * RETURN:
+ *    SECSuccess
+ *        If copying the Certificate as a member of the Certificate
+ *        request message was successful.
+ *    Any other return value indicates a failure to copy the Certificate
+ *    Request and make it a part of the Certificate Request Message.
+ */
+extern SECStatus CRMF_CertReqMsgSetCertRequest(CRMFCertReqMsg *inCertReqMsg,
+                                               CRMFCertRequest *inCertReq);
+
+/*
+ * FUNCTION: CRMF_CreateCertRequest
+ * INPUTS:
+ *    inRequestID
+ *        The ID that will be associated with this certificate request.
+ * OUTPUTS:
+ *    A certificate request which only has the requestID set.
+ * NOTES:
+ *    The user must call the function CRMF_DestroyCertRequest when
+ *    the returned value is no longer needed.  This is usually the
+ *    case after fully constructing the Certificate Request and then
+ *    calling the function CRMF_CertReqMsgSetCertRequest.
+ * RETURN:
+ *    A pointer to the new Certificate Request.  A NULL return value
+ *    indicates an error in creating the Certificate Request.
+ */
+extern CRMFCertRequest *CRMF_CreateCertRequest(PRUint32 inRequestID);
+
+/*
+ * FUNCTION: CRMF_DestroyCertRequest
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request that will be destroyed.
+ * RETURN:
+ *    SECSuccess
+ *        If freeing the memory associated with the certificate request
+ *        was successful.
+ *    Any other return value indicates an error while trying to free the
+ *    memory.
+ */
+extern SECStatus CRMF_DestroyCertRequest(CRMFCertRequest *inCertReq);
+
+/*
+ * FUNCTION: CRMF_CreateCertExtension
+ * INPUTS:
+ *    id
+ *        The SECOidTag to associate with this CertExtension.  This must
+ *        correspond to a valid Certificate Extension, if not the function
+ *        will fail.
+ *    isCritical
+ *        A boolean value stating if the extension value is crtical.  PR_TRUE
+ *        means the value is crtical.  PR_FALSE indicates the value is not
+ *        critical.
+ *    data
+ *        This is the data associated with the extension.  The user of the
+ *        library is responsible for making sure the value passed in is a
+ *        valid interpretation of the certificate extension.
+ * NOTES:
+ * Use this function to create CRMFCertExtension Structures which will
+ * then be passed to CRMF_AddFieldToCertTemplate as part of the
+ * CRMFCertCreationInfo.extensions  The user must call
+ * CRMF_DestroyCertExtension after the extension has been added to a certifcate
+ * and the extension is no longer needed.
+ *
+ * RETURN:
+ * A pointer to a newly created CertExtension.  A return value of NULL
+ * indicates the id passed in was an invalid certificate extension.
+ */
+extern CRMFCertExtension *CRMF_CreateCertExtension(SECOidTag id,
+                                                   PRBool isCritical,
+                                                   SECItem *data);
+
+/*
+ * FUNCTION: CMRF_DestroyCertExtension
+ * INPUTS:
+ *    inExtension
+ *        The Cert Extension to destroy
+ * NOTES:
+ * Destroy a structure allocated by CRMF_CreateCertExtension.
+ *
+ * RETURN:
+ * SECSuccess if freeing the memory associated with the certificate extension
+ * was successful.  Any other error indicates an error while freeing the
+ * memory.
+ */
+extern SECStatus CRMF_DestroyCertExtension(CRMFCertExtension *inExtension);
+
+/*
+ * FUNCTION: CRMF_CertRequestSetTemplateField
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    inTemplateField
+ *        An enumeration that indicates which field of the Certificate
+ *        template to add.
+ *    data
+ *        A generic pointer that will be type cast according to the
+ *        table under NOTES and used as the key for adding to the
+ *        certificate template;
+ * NOTES:
+ *
+ * Below is a table that tells what type to pass in as data
+ * depending on the template field one wants to set.
+ *
+ * Look in crmft.h for the definition of CRMFCertTemplateField.
+ *
+ * In all cases, the library makes copies of the data passed in.
+ *
+ *   CRMFCertTemplateField    Type of data    What data means
+ *   ---------------------    ------------    ---------------
+ *   crmfVersion              long *          The version of
+ *                                            the certificate
+ *                                            to be created.
+ *
+ *   crmfSerialNumber         long *          The serial number
+ *                                            for the cert to be
+ *                                            created.
+ *
+ *   crmfSigningAlg           SECAlgorithm *  The ASN.1 object ID for
+ *                                            the algorithm used in encoding
+ *                                            the certificate.
+ *
+ *   crmfIssuer               CERTName *      Certificate Library
+ *                                            representation of the ASN1 type
+ *                                            Name from X.509
+ *
+ *   crmfValidity     CRMFValidityCreationInfo *  At least one of the two
+ *                                                fields in the structure must
+ *                                                be present.  A NULL pointer
+ *                                                in the structure indicates
+ *                                                that member should not be
+ *                                                added.
+ *
+ *   crmfSubject              CERTName *      Certificate Library
+ *                                            representation of the ASN1 type
+ *                                            Name from X.509
+ *
+ *   crmfPublicKey    CERTSubjectPublicKeyInfo *  The public key info for the
+ *                                                certificate being requested.
+ *
+ *   crmfIssuerUID            SECItem *           A bit string representation
+ *                                                of the issuer UID. NOTE: The
+ *                                                length is the number of bits
+ *                                                and not the number of bytes.
+ *
+ *   crmfSubjectUID           SECItem*            A bit string representation
+ *                                                of the subject UID. NOTE: The
+ *                                                length is the number of bits
+ *                                                and not the number of bytes.
+ *
+ *   crmfExtension   CRMFCertExtCreationInfo *     A pointer to the structure
+ *                                                 populated with an array of
+ *                                                 of certificate extensions
+ *                                                 and an integer that tells
+ *                                                 how many elements are in the
+ *                                                 array. Look in crmft.h for
+ *                                                 the definition of
+ *                                                 CRMFCertExtCreationInfo
+ * RETURN:
+ *    SECSuccess if adding the desired field to the template was successful.
+ *    Any other return value indicates failure when trying to add the field
+ *    to the template.
+ *
+ */
+extern SECStatus
+CRMF_CertRequestSetTemplateField(CRMFCertRequest *inCertReq,
+                                 CRMFCertTemplateField inTemplateField,
+                                 void *data);
+
+/*
+ * FUNCTION: CRMF_CertRequestIsFieldPresent
+ * INPUTS:
+ *    inCertReq
+ *        The certificate request to operate on.
+ *    inTemplateField
+ *        The enumeration for the template field the user wants to query
+ *        about.
+ * NOTES:
+ * This function checks to see if the the field associated with inTemplateField
+ * enumeration is already present in the certificate request passed in.
+ *
+ * RETURN:
+ * The function returns PR_TRUE if the field associated with inTemplateField
+ * is already present in the certificate request.  If the field is not present
+ * the function returns PR_FALSE.
+ */
+extern PRBool
+CRMF_CertRequestIsFieldPresent(CRMFCertRequest *inCertReq,
+                               CRMFCertTemplateField inTemplateField);
+
+/*
+ * FUNCTION: CRMF_CertRequestIsControlPresent
+ * INPUTS:
+ *    inCertReq
+ *        The certificate request to operate on.
+ *    inControlType
+ *        The type of control to look for.
+ * NOTES:
+ * This function looks at the control present in the certificate request
+ * and returns PR_TRUE iff a control of type inControlType already exists.
+ * The CRMF draft does not explicitly state that two controls of the same
+ * type can not exist within the same request.  So the library will not
+ * cause an error if you try to add a control and one of the same type
+ * already exists.  It is up to the application to ensure that multiple
+ * controls of the same type do not exist, if that is the desired behavior
+ * by the application.
+ *
+ * RETURN:
+ * The function returns PR_TRUE if a control of type inControlType already
+ * exists in the certificate request.  If a control of type inControlType
+ * does not exist, the function will return PR_FALSE.
+ */
+extern PRBool
+CRMF_CertRequestIsControlPresent(CRMFCertRequest *inCertReq,
+                                 CRMFControlType inControlType);
+
+/*
+ * FUNCTION: CRMF_CertRequestSetRegTokenControl
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    value
+ *        The UTF8 value which will be the Registration Token Control
+ *        for this Certificate Request.
+ * NOTES:
+ *    The library does no verification that the value passed in is
+ *    a valid UTF8 value.  The caller must make sure of this in order
+ *    to get an encoding that is valid.  The library will ultimately
+ *    encode this value as it was passed in.
+ * RETURN:
+ *    SECSucces on successful addition of the Registration Token Control.
+ *    Any other return value indicates an unsuccessful attempt to add the
+ *    control.
+ *
+ */
+extern SECStatus CRMF_CertRequestSetRegTokenControl(CRMFCertRequest *inCertReq,
+                                                    SECItem *value);
+
+/*
+ * FUNCTION: CRMF_CertRequestSetAuthenticatorControl
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    value
+ *        The UTF8 value that will become the Authenticator Control
+ *        for the passed in Certificate Request.
+ * NOTES:
+ *    The library does no verification that the value passed in is
+ *    a valid UTF8 value.  The caller must make sure of this in order
+ *    to get an encoding that is valid.  The library will ultimately
+ *    encode this value as it was passed in.
+ * RETURN:
+ *    SECSucces on successful addition of the Authenticator Control.
+ *    Any other return value indicates an unsuccessful attempt to add the
+ *    control.
+ */
+extern SECStatus
+CRMF_CertRequestSetAuthenticatorControl(CRMFCertRequest *inCertReq,
+                                        SECItem *value);
+
+/*
+ * FUNCTION: CRMF_CreateEncryptedKeyWithencryptedValue
+ * INPUTS:
+ *    inPrivKey
+ *        This is the private key associated with a certificate that is
+ *        being requested.  This structure will eventually wind up as
+ *        a part of the PKIArchiveOptions Control.
+ *    inCACert
+ *        This is the certificate for the CA that will be receiving the
+ *        certificate request for the private key passed in.
+ * OUTPUT:
+ *    A CRMFEncryptedKey that can ultimately be used as part of the
+ *    PKIArchiveOptions Control.
+ *
+ * RETURN:
+ *    A pointer to a CRMFEncyptedKey.  A NULL return value indicates an erro
+ *    during the creation of the encrypted key.
+ */
+extern CRMFEncryptedKey *
+CRMF_CreateEncryptedKeyWithEncryptedValue(SECKEYPrivateKey *inPrivKey,
+                                          CERTCertificate *inCACert);
+
+/*
+ * FUNCTION: CRMF_DestroyEncryptedKey
+ * INPUTS:
+ *    inEncrKey
+ *        The CRMFEncryptedKey to be destroyed.
+ * NOTES:
+ *    Frees all memory associated with the CRMFEncryptedKey passed in.
+ * RETURN:
+ *    SECSuccess if freeing the memory was successful.  Any other return
+ *    value indicates an error while freeig the memroy.
+ */
+extern SECStatus CRMF_DestroyEncryptedKey(CRMFEncryptedKey *inEncrKey);
+
+/*
+ * FUNCTION: CRMF_CreatePKIArchiveOptions
+ * INPUTS:
+ *    inType
+ *        An enumeration value indicating which option for
+ *        PKIArchiveOptions to use.
+ *    data
+ *        A pointer that will be type-cast and de-referenced according
+ *        to the table under NOTES.
+ * NOTES:
+ * A table listing what should be passed in as data
+ * ------------------------------------------------
+ *
+ * inType                            data
+ * ------                            ----
+ * crmfEncryptedPrivateKey           CRMFEncryptedKey*
+ * crmfKeyGenParameters              SECItem*(This needs to be an octet string)
+ * crmfArchiveRemGenPrivKey          PRBool*
+ *
+ * RETURN:
+ *    A pointer the a CRMFPKIArchiveOptions that can be added to a Certificate
+ *    Request.  A NULL pointer indicates an error occurred while creating
+ *    the CRMFPKIArchiveOptions Structure.
+ */
+extern CRMFPKIArchiveOptions *
+CRMF_CreatePKIArchiveOptions(CRMFPKIArchiveOptionsType inType,
+                             void *data);
+/*
+ * FUNCTION: CRMF_DestroyPKIArchiveOptions
+ * INPUTS:
+ *    inArchOpt
+ *        A pointer to the CRMFPKIArchiveOptions structure to free.
+ * NOTES:
+ *    Will free all memory associated with 'inArchOpt'.
+ * RETURN:
+ *    SECSuccess if successful in freeing the memory used by 'inArchOpt'
+ *    Any other return value indicates an error while freeing the memory.
+ */
+extern SECStatus
+CRMF_DestroyPKIArchiveOptions(CRMFPKIArchiveOptions *inArchOpt);
+
+/*
+ * FUNCTION: CRMF_CertRequestSetPKIArchiveOptions
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to add the the options to.
+ *    inOptions
+ *        The Archive Options to add to the Certificate Request.
+ * NOTES:
+ *    Adds the PKIArchiveOption to the Certificate Request.  This is what
+ *    enables Key Escrow to take place through CRMF.  The library makes
+ *    its own copy of the information.
+ * RETURN:
+ *    SECSuccess if successful in adding the ArchiveOptions to the Certificate
+ *    request.  Any other return value indicates an error when trying to add
+ *    the Archive Options  to the Certificate Request.
+ */
+extern SECStatus
+CRMF_CertRequestSetPKIArchiveOptions(CRMFCertRequest *inCertReq,
+                                     CRMFPKIArchiveOptions *inOptions);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetPOPType
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to operate on.
+ * NOTES:
+ *    Returns an enumeration value indicating the method of Proof
+ *    of Possession that was used for the passed in Certificate Request
+ *    Message.
+ * RETURN:
+ *    An enumeration indicating what method for Proof Of Possession is
+ *    being used in this Certificate Request Message.  Look in the file
+ *    crmft.h for the definition of CRMFPOPChoice for the possible return
+ *    values.
+ */
+extern CRMFPOPChoice CRMF_CertReqMsgGetPOPType(CRMFCertReqMsg *inCertReqMsg);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgSetRAVerifiedPOP
+ * INPUT:
+ *    InCertReqMsg
+ *        The Certificate Request Message to operate on.
+ * NOTES:
+ *    This function will set the method of Proof Of Possession to
+ *    crmfRAVerified which means the RA has already verified the
+ *    requester does possess the private key.
+ * RETURN:
+ *    SECSuccess if adding RAVerified to the message is successful.
+ *    Any other message indicates an error while trying to add RAVerified
+ *    as the Proof of Possession.
+ */
+extern SECStatus CRMF_CertReqMsgSetRAVerifiedPOP(CRMFCertReqMsg *inCertReqMsg);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgSetSignaturePOP
+ * INPUT:
+ *    inCertReqMsg
+ *        The Certificate Request Message to add the SignaturePOP to.
+ *    inPrivKey
+ *        The Private Key which corresponds to the the Certificate Request
+ *        Message.
+ *    inPubKey
+ *        The Public Key which corresponds to the Private Key passed in.
+ *    inCertForInput
+ *        A Certificate that in the future may be used to create
+ *        POPOSigningKeyInput.
+ *    fn
+ *        A callback for retrieving a password which may be used in the
+ *       future to generate POPOSigningKeyInput.
+ *    arg
+ *        An opaque pointer that would be passed to fn whenever it is
+ *        called.
+ * NOTES:
+ * Adds Proof Of Possession to the CertRequest using the signature field
+ * of the ProofOfPossession field.  NOTE: In order to use this option,
+ * the certificate template must contain the publicKey at the very minimum.
+ *
+ * If you don't want the function to generate POPOSigningKeyInput, then
+ * make sure the cert template already contains the subject and public key
+ * values.  Currently creating POPOSigningKeyInput is not supported, so
+ * a Message passed to this function must have the publicKey and the subject
+ * as part of the template
+ *
+ * This will take care of creating the entire POPOSigningKey structure
+ * that will become part of the message.
+ *
+ * inPrivKey is the key to be used in the signing operation when creating
+ * POPOSigningKey structure.  This should be the key corresponding to
+ * the certificate being requested.
+ *
+ * inCertForInput will be used if POPOSigningKeyInput needs to be generated.
+ * It will be used in generating the authInfo.sender field.  If the parameter
+ * is not passed in then authInfo.publicKeyMAC will be generated instead.
+ * If passed in, this certificate needs to be a valid certificate.
+ *
+ * The last 3 arguments are for future compatibility in case we ever want to
+ * support generating POPOSigningKeyInput.  Pass in NULL for all 3 if you
+ * definitely don't want the function to even try to generate
+ * POPOSigningKeyInput.  If you try to use POPOSigningKeyInput, the function
+ * will fail.
+ *
+ * RETURN:
+ *    SECSuccess if adding the Signature Proof Of Possession worked.
+ *    Any other return value indicates an error in trying to add
+ *    the Signature Proof Of Possession.
+ */
+extern SECStatus
+CRMF_CertReqMsgSetSignaturePOP(CRMFCertReqMsg *inCertReqMsg,
+                               SECKEYPrivateKey *inPrivKey,
+                               SECKEYPublicKey *inPubKey,
+                               CERTCertificate *inCertForInput,
+                               CRMFMACPasswordCallback fn,
+                               void *arg);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgSetKeyEnciphermentPOP
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to operate on.
+ *    inKeyChoice
+ *        An enumeration indicating which POPOPrivKey Choice to use
+ *        in constructing the KeyEnciphermentPOP.
+ *    subseqMess
+ *        This parameter must be provided iff inKeyChoice is
+ *        crmfSubsequentMessage.  This details how the RA is to respond
+ *        in order to perform Proof Of Possession.  Look in crmft.h under
+ *        the definition of CRMFSubseqMessOptions for possible values.
+ *    encPrivKey
+ *        This parameter only needs to be provided if inKeyChoice is
+ *        crmfThisMessage.  The item should contain the encrypted private
+ *        key.
+ *
+ * NOTES:
+ * Adds Proof Of Possession using the keyEncipherment field of
+ * ProofOfPossession.
+ *
+ * The function looks at the the inKeyChoice parameter and interprets it in
+ * in the following manner.
+ *
+ * If a parameter is not mentioned under interpretation, the function will not
+ * look at its value when implementing that case.
+ *
+ * inKeyChoice          Interpretation
+ * -----------          --------------
+ * crmfThisMessage      This options requires that the encrypted private key
+ *                      be included in the thisMessage field of POPOPrivKey.
+ *                      We don't support this yet, so any clients who want
+ *                      to use this feature have to implement a wrapping
+ *                      function and agree with the server on how to properly
+ *                      wrap the key.  That encrypted key must be passed in
+ *                      as the encPrivKey parameter.
+ *
+ * crmfSubequentMessage Must pass in a value for subseqMess.  The value must
+ *                      be either CRMFEncrCert or CRMFChallengeResp.  The
+ *                      parameter encPrivKey will not be looked at in this
+ *                      case.
+ *
+ * crmfDHMAC            This is not a valid option for this function.  Passing
+ *                      in this value will result in the function returning
+ *                      SECFailure.
+ * RETURN:
+ *    SECSuccess if adding KeyEnciphermentPOP was successful.  Any other return
+ *    value indicates an error in adding KeyEnciphermentPOP.
+ */
+extern SECStatus
+CRMF_CertReqMsgSetKeyEnciphermentPOP(CRMFCertReqMsg *inCertReqMsg,
+                                     CRMFPOPOPrivKeyChoice inKeyChoice,
+                                     CRMFSubseqMessOptions subseqMess,
+                                     SECItem *encPrivKey);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgSetKeyAgreementPOP
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to operate on.
+ *    inKeyChoice
+ *        An enumeration indicating which POPOPrivKey Choice to use
+ *        in constructing the KeyAgreementPOP.
+ *    subseqMess
+ *        This parameter must be provided iff inKeyChoice is
+ *        crmfSubsequentMessage.  This details how the RA is to respond
+ *        in order to perform Proof Of Possession.  Look in crmft.h under
+ *        the definition of CRMFSubseqMessOptions for possible values.
+ *    encPrivKey
+ *        This parameter only needs to be provided if inKeyChoice is
+ *        crmfThisMessage.  The item should contain the encrypted private
+ *        key.
+ * Adds Proof Of Possession using the keyAgreement field of
+ * ProofOfPossession.
+ *
+ * The function looks at the the inKeyChoice parameter and interprets it in
+ * in the following manner.
+ *
+ * If a parameter is not mentioned under interpretation, the function will not
+ * look at its value when implementing that case.
+ *
+ * inKeyChoice          Interpretation
+ * -----------          --------------
+ * crmfThisMessage      This options requires that the encrypted private key
+ *                      be included in the thisMessage field of POPOPrivKey.
+ *                      We don't support this yet, so any clients who want
+ *                      to use this feature have to implement a wrapping
+ *                      function and agree with the server on how to properly
+ *                      wrap the key.  That encrypted key must be passed in
+ *                      as the encPrivKey parameter.
+ *
+ * crmfSubequentMessage Must pass in a value for subseqMess.  The value must
+ *                      be either crmfEncrCert or crmfChallengeResp.  The
+ *                      parameter encPrivKey will not be looked at in this
+ *                      case.
+ *
+ * crmfDHMAC            This option is not supported.
+ */
+extern SECStatus
+CRMF_CertReqMsgSetKeyAgreementPOP(CRMFCertReqMsg *inCertReqMsg,
+                                  CRMFPOPOPrivKeyChoice inKeyChoice,
+                                  CRMFSubseqMessOptions subseqMess,
+                                  SECItem *encPrivKey);
+
+/*
+ * FUNCTION: CRMF_CreateCertReqMsgFromDER
+ * INPUTS:
+ *    buf
+ *        A buffer to the DER-encoded Certificate Request Message.
+ *    len
+ *        The length in bytes of the buffer 'buf'
+ * NOTES:
+ * This function passes the buffer to the ASN1 decoder and creates a
+ * CRMFCertReqMsg structure.  Do not try adding any fields to a message
+ * returned from this function.  Specifically adding more Controls or
+ * Extensions may cause your program to crash.
+ *
+ * RETURN:
+ *    A pointer to the Certificate Request Message structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CRMFCertReqMsg *CRMF_CreateCertReqMsgFromDER(const char *buf, long len);
+
+/*
+ * FUNCTION: CRMF_CreateCertReqMessagesFromDER
+ * INPUTS:
+ *    buf
+ *        A buffer to the DER-encoded Certificate Request Messages.
+ *    len
+ *        The length in bytes of buf
+ * NOTES:
+ * This function passes the buffer to the ASN1 decoder and creates a
+ * CRMFCertReqMessages structure.  Do not try adding any fields to a message
+ * derived from this function.  Specifically adding more Controls or
+ * Extensions may cause your program to crash.
+ * The user must call CRMF_DestroyCertReqMessages after the return value is
+ * no longer needed, ie when all individual messages have been extracted.
+ *
+ * RETURN:
+ *    A pointer to the Certificate Request Messages structure.  A NULL return
+ *    value indicates the library was unable to parse the DER.
+ */
+extern CRMFCertReqMessages *
+CRMF_CreateCertReqMessagesFromDER(const char *buf, long len);
+
+/*
+ * FUNCTION: CRMF_DestroyCertReqMessages
+ * INPUTS
+ *    inCertReqMsgs
+ *        The Messages to destroy.
+ * RETURN:
+ *    SECSuccess if freeing the memory was done successfully.  Any other
+ *    return value indicates an error in freeing up memory.
+ */
+extern SECStatus
+CRMF_DestroyCertReqMessages(CRMFCertReqMessages *inCertReqMsgs);
+
+/*
+ * FUNCTION: CRMF_CertReqMessagesGetNumMessages
+ * INPUTS:
+ *    inCertReqMsgs
+ *        The Request Messages to operate on.
+ * RETURN:
+ *    The number of messages contained in the in the Request Messages
+ *    strucure.
+ */
+extern int
+CRMF_CertReqMessagesGetNumMessages(CRMFCertReqMessages *inCertReqMsgs);
+
+/*
+ * FUNCTION: CRMF_CertReqMessagesGetCertReqMsgAtIndex
+ * INPUTS:
+ *    inReqMsgs
+ *        The Certificate Request Messages to operate on.
+ *    index
+ *        The index of the single message the user wants a copy of.
+ * NOTES:
+ * This function returns a copy of the request messages stored at the
+ * index corresponding to the parameter 'index'.  Indexing of the messages
+ * is done in the same manner as a C array.  Meaning the valid index are
+ * 0...numMessages-1.  User must call CRMF_DestroyCertReqMsg when done using
+ * the return value of this function.
+ *
+ * RETURN:
+ * SECSuccess if copying the message at the requested index was successful.
+ * Any other return value indicates an invalid index or error while copying
+ * the single request message.
+ */
+extern CRMFCertReqMsg *
+CRMF_CertReqMessagesGetCertReqMsgAtIndex(CRMFCertReqMessages *inReqMsgs,
+                                         int index);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetID
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to get the ID from.
+ *    destID
+ *        A pointer to where the library can place the ID of the Message.
+ * RETURN:
+ *    SECSuccess if the function was able to retrieve the ID and place it
+ *    at *destID.  Any other return value indicates an error meaning the value
+ *    in *destId is un-reliable and should not be used by the caller of this
+ *    function.
+ *
+ */
+extern SECStatus CRMF_CertReqMsgGetID(CRMFCertReqMsg *inCertReqMsg,
+                                      long *destID);
+
+/*
+ * FUNCTION: CRMF_DoesRequestHaveField
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    inField
+ *        An enumeration indicating which filed of the certificate template
+ *        to look for.
+ * NOTES:
+ * All the fields in a certificate template are optional.  This function
+ * checks to see if the requested field is present.  Look in crmft.h at the
+ * definition of CRMFCertTemplateField for possible values for possible
+ * querying.
+ *
+ * RETURN:
+ * PR_TRUE iff the field corresponding to 'inField' has been specified as part
+ *         of 'inCertReq'
+ * PR_FALSE iff the field corresponding to 'inField' has not been speicified
+ *          as part of 'inCertReq'
+ *
+ */
+extern PRBool CRMF_DoesRequestHaveField(CRMFCertRequest *inCertReq,
+                                        CRMFCertTemplateField inField);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetCertRequest
+ * INPUTS:
+ *    inCertReqMsg
+ *        The Certificate Request Message to operate on.
+ * NOTES:
+ *    This function returns a copy of the Certificate Request to the user.
+ *    The user can keep adding to this request and then making it a part
+ *    of another message.  After the user no longer wants to use the
+ *    returned request, the user must call CRMF_DestroyCertRequest and
+ *    pass it the request returned by this function.
+ * RETURN:
+ *    A pointer to a copy of the certificate request contained by the message.
+ *    A NULL return value indicates an error occurred while copying the
+ *   certificate request.
+ */
+extern CRMFCertRequest *
+CRMF_CertReqMsgGetCertRequest(CRMFCertReqMsg *inCertReqMsg);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateVersion
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    version
+ *        A pointer to where the library can store the version contatined
+ *        in the certificate template within the certifcate request.
+ * RETURN:
+ *    SECSuccess if the Certificate template contains the version field.  In
+ *    this case, *version will hold the value of the certificate template
+ *    version.
+ *    SECFailure indicates that version field was not present as part of
+ *    of the certificate template.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateVersion(CRMFCertRequest *inCertReq,
+                                       long *version);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateSerialNumber
+ * INPUTS:
+ *    inCertReq
+ *        The certificate request to operate on.
+ *    serialNumber
+ *        A pointer where the library can put the serial number contained
+ *        in the certificate request's certificate template.
+ * RETURN:
+ * If a serial number exists in the CertTemplate of the request, the function
+ * returns SECSuccess and the value at *serialNumber contains the serial
+ * number.
+ * If no serial number is present, then the function returns SECFailure and
+ * the value at *serialNumber is un-changed.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateSerialNumber(CRMFCertRequest *inCertReq,
+                                            long *serialNumber);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateSigningAlg
+ * INPUT:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    destAlg
+ *        A Pointer to where the library can place a copy of the signing alg
+ *        used in the cert request's cert template.
+ * RETURN:
+ * If the signingAlg is present in the CertRequest's CertTemplate, then
+ * the function returns SECSuccess and places a copy of sigingAlg in
+ * *destAlg.
+ * If no signingAlg is present, then the function returns SECFailure and
+ * the value at *destAlg is un-changed
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateSigningAlg(CRMFCertRequest *inCertReq,
+                                          SECAlgorithmID *destAlg);
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateIssuer
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    destIssuer
+ *        A pointer to where the library can place a copy of the cert
+ *        request's cert template issuer field.
+ * RETURN:
+ * If the issuer is present in the cert request cert template, the function
+ * returns SECSuccess and places a  copy of the issuer in *destIssuer.
+ * If there is no issuer present, the function returns SECFailure and the
+ * value at *destIssuer is unchanged.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateIssuer(CRMFCertRequest *inCertReq,
+                                      CERTName *destIssuer);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateValidity
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    destValdity
+ *        A pointer to where the library can place a copy of the validity
+ *        info in the cert request cert template.
+ * NOTES:
+ * Pass the pointer to
+ * RETURN:
+ * If there is an OptionalValidity field, the function will return SECSuccess
+ * and place the appropriate values in *destValidity->notBefore and
+ * *destValidity->notAfter. (Each field is optional, but at least one will
+ * be present if the function returns SECSuccess)
+ *
+ * If there is no OptionalValidity field, the function will return SECFailure
+ * and the values at *destValidity will be un-changed.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateValidity(CRMFCertRequest *inCertReq,
+                                        CRMFGetValidity *destValidity);
+/*
+ * FUNCTION: CRMF_DestroyGetValidity
+ * INPUTS:
+ *    inValidity
+ *        A pointer to the memroy to be freed.
+ * NOTES:
+ * The function will free the memory allocated by the function
+ * CRMF_CertRequestGetCertTemplateValidity.  That means only memory pointed
+ * to within the CRMFGetValidity structure.  Since
+ * CRMF_CertRequestGetCertTemplateValidity does not allocate memory for the
+ * structure passed into it, it will not free it.  Meaning this function will
+ * free the memory at inValidity->notBefore and inValidity->notAfter, but not
+ * the memory directly at inValdity.
+ *
+ * RETURN:
+ * SECSuccess if freeing the memory was successful.  Any other return value
+ * indicates an error while freeing the memory.
+ */
+extern SECStatus
+CRMF_DestroyGetValidity(CRMFGetValidity *inValidity);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateSubject
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ *    destSubject
+ *        A pointer to where the library can place a copy of the subject
+ *        contained in the request's cert template.
+ * RETURN:
+ * If there is a subject in the CertTemplate, then the function returns
+ * SECSuccess and a copy of the subject is placed in *destSubject.
+ *
+ * If there is no subject, the function returns SECFailure and the values at
+ * *destSubject is unchanged.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateSubject(CRMFCertRequest *inCertReq,
+                                       CERTName *destSubject);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplatePublicKey
+ * INPUTS:
+ *    inCertReq
+ *        The Cert request to operate on.
+ *    destPublicKey
+ *        A pointer to where the library can place a copy of the request's
+ *        cert template public key.
+ * RETURN:
+ * If there is a publicKey parameter in the CertRequest, the function returns
+ * SECSuccess, and places a copy of the publicKey in *destPublicKey.
+ *
+ * If there is no publicKey, the function returns SECFailure and the value
+ * at *destPublicKey is un-changed.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplatePublicKey(CRMFCertRequest *inCertReq,
+                                         CERTSubjectPublicKeyInfo *destPublicKey);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateIssuerUID
+ * INPUTS:
+ *    inCertReq
+ *        The Cert request to operate on.
+ *    destIssuerUID
+ *        A pointer to where the library can store a copy of the request's
+ *        cert template destIssuerUID.
+ *
+ * NOTES:
+ * destIssuerUID is a bit string and will be returned in a SECItem as
+ * a bit string.  Meaning the len field contains the number of valid bits as
+ * opposed to the number of bytes allocated.
+ *
+ * RETURN:
+ * If the CertTemplate has an issuerUID, the function returns SECSuccess and
+ * places a copy of the issuerUID in *destIssuerUID.
+ *
+ * If there is no issuerUID, the function returns SECFailure and the value
+ * *destIssuerUID is unchanged.
+ */
+extern SECStatus
+CRMF_CertRequestGetCertTemplateIssuerUID(CRMFCertRequest *inCertReq,
+                                         SECItem *destIssuerUID);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetCertTemplateSubjectUID
+ *    inCertReq
+ *        The Cert request to operate on.
+ *    destSubjectUID
+ *        A pointer to where the library can store a copy of the request's
+ *        cert template destIssuerUID.
+ *
+ * NOTES:
+ * destSubjectUID is a bit string and will be returned in a SECItem as
+ * a bit string.  Meaning the len field contains the number of valid bits as
+ * opposed to the number of bytes allocated.
+ *
+ * RETURN:
+ * If the CertTemplate has an issuerUID, the function returns SECSuccess and
+ * places a copy of the issuerUID in *destIssuerUID.
+ *
+ * If there is no issuerUID, the function returns SECSuccess and the value
+ * *destIssuerUID is unchanged.
+ */
+extern SECStatus CRMF_GetCertTemplateSubjectUID(CRMFCertRequest *inCertReq,
+                                                SECItem *destSubjectUID);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetNumberOfExtensions
+ * INPUTS:
+ *    inCertReq
+ *        The cert request to operate on.
+ * RETURN:
+ *    Returns the number of extensions contained by the Cert Request.
+ */
+extern int CRMF_CertRequestGetNumberOfExtensions(CRMFCertRequest *inCertReq);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetExtensionAtIndex
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate request to operate on.
+ *    index
+ *        The index of the extension array whihc the user wants to access.
+ * NOTES:
+ * This function retrieves the extension at the index corresponding to the
+ * parameter "index" indicates.  Indexing is done like a C array.
+ * (0 ... numElements-1)
+ *
+ * Call CRMF_DestroyCertExtension when done using the return value.
+ *
+ * RETURN:
+ *    A pointer to a copy of the extension at the desired index.  A NULL
+ *    return value indicates an invalid index or an error while copying
+ *    the extension.
+ */
+extern CRMFCertExtension *
+CRMF_CertRequestGetExtensionAtIndex(CRMFCertRequest *inCertReq,
+                                    int index);
+/*
+ * FUNCTION: CRMF_CertExtensionGetOidTag
+ * INPUTS:
+ *    inExtension
+
+ *        The extension to operate on.
+ * RETURN:
+ *    Returns the SECOidTag associated with the cert extension passed in.
+ */
+extern SECOidTag CRMF_CertExtensionGetOidTag(CRMFCertExtension *inExtension);
+
+/*
+ * FUNCTION: CRMF_CertExtensionGetIsCritical
+ * INPUT:
+ *    inExt
+ *        The cert extension to operate on.
+ *
+ * RETURN:
+ * PR_TRUE if the extension is critical.
+ * PR_FALSE if the extension is not critical.
+ */
+extern PRBool CRMF_CertExtensionGetIsCritical(CRMFCertExtension *inExt);
+
+/*
+ * FUNCTION: CRMF_CertExtensionGetValue
+ * INPUT:
+ *    inExtension
+ *        The extension to operate on.
+ * NOTES:
+ * Caller is responsible for freeing the memory associated with the return
+ * value.  Call SECITEM_FreeItem(retVal, PR_TRUE) when done using the return
+ * value.
+ *
+ * RETURN:
+ * A pointer to an item containig the value for the certificate extension.
+ * A NULL return value indicates an error in copying the information.
+ */
+extern SECItem *CRMF_CertExtensionGetValue(CRMFCertExtension *inExtension);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetPOPOSigningKey
+ * INPUTS:
+ *    inCertReqMsg
+ *        The certificate request message to operate on.
+ *    destKey
+ *        A pointer to where the library can place a pointer to
+ *        a copy of the Proof Of Possession Signing Key used
+ *        by the message.
+ *
+ * RETURN:
+ * Get the POPOSigningKey associated with this CRMFCertReqMsg.
+ * If the CertReqMsg does not have a pop, the function returns
+ * SECFailure and the value at *destKey is un-changed..
+ *
+ * If the CertReqMsg does have a pop, then the CertReqMsg's
+ * POPOSigningKey will be placed at *destKey.
+ */
+extern SECStatus
+CRMF_CertReqMsgGetPOPOSigningKey(CRMFCertReqMsg *inCertReqMsg,
+                                 CRMFPOPOSigningKey **destKey);
+
+/*
+ * FUNCTION: CRMF_DestroyPOPOSigningKey
+ * INPUTS:
+ *    inKey
+ *        The signing key to free.
+ *
+ * RETURN:
+ * SECSuccess if freeing the memory was successful.  Any other return value
+ * indicates an error while freeing memory.
+ */
+extern SECStatus CRMF_DestroyPOPOSigningKey(CRMFPOPOSigningKey *inKey);
+
+/*
+ * FUNCTION: CRMF_POPOSigningKeyGetAlgID
+ * INPUTS:
+ *    inSignKey
+ *        The Signing Key to operate on.
+ * RETURN:
+ * Return the algorithmID used by the CRMFPOPOSigningKey.  User must
+ * call SECOID_DestroyAlgorithmID(destID, PR_TRUE) when done using the
+ * return value.
+ */
+extern SECAlgorithmID *
+CRMF_POPOSigningKeyGetAlgID(CRMFPOPOSigningKey *inSignKey);
+
+/*
+ * FUNCTION: CRMF_POPOSigningKeyGetSignature
+ * INPUTS:
+ *    inSignKey
+ *        The Signing Key to operate on.
+ *
+ * RETURN:
+ * Get the actual signature stored away in the CRMFPOPOSigningKey.  SECItem
+ * returned is a BIT STRING, so the len field is the number of bits as opposed
+ * to the total number of bytes allocatd.  User must call
+ * SECITEM_FreeItem(retVal,PR_TRUE) when done using the return value.
+ */
+extern SECItem *CRMF_POPOSigningKeyGetSignature(CRMFPOPOSigningKey *inSignKey);
+
+/*
+ * FUNCTION: CRMF_POPOSigningKeyGetInput
+ * INPUTS:
+ *    inSignKey
+ *        The Signing Key to operate on.
+ * NOTES:
+ * This function will return the der encoded input that was read in while
+ * decoding.  The API does not support this option when creating, so you
+ * cannot add this field.
+ *
+ * RETURN:
+ * Get the poposkInput that is part of the of the POPOSigningKey. If the
+ * optional field is not part of the POPOSigningKey, the function returns
+ * NULL.
+ *
+ * If the optional field is part of the POPOSingingKey, the function will
+ * return a copy of the der encoded poposkInput.
+ */
+extern SECItem *CRMF_POPOSigningKeyGetInput(CRMFPOPOSigningKey *inSignKey);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetPOPKeyEncipherment
+ * INPUTS:
+ *    inCertReqMsg
+ *        The certificate request message to operate on.
+ *    destKey
+ *        A pointer to where the library can place a pointer to a
+ *        copy of the POPOPrivKey representing Key Encipherment
+ *        Proof of Possession.
+ *NOTES:
+ * This function gets the POPOPrivKey associated with this CRMFCertReqMsg
+ * for Key Encipherment.
+ *
+ * RETURN:
+ * If the CertReqMsg did not use Key Encipherment for Proof Of Possession, the
+ * function returns SECFailure and the value at *destKey is un-changed.
+ *
+ * If the CertReqMsg did use Key Encipherment for ProofOfPossession, the
+ * function returns SECSuccess and places the POPOPrivKey representing the
+ * Key Encipherment Proof Of Possessin at *destKey.
+ */
+extern SECStatus
+CRMF_CertReqMsgGetPOPKeyEncipherment(CRMFCertReqMsg *inCertReqMsg,
+                                     CRMFPOPOPrivKey **destKey);
+
+/*
+ * FUNCTION: CRMF_CertReqMsgGetPOPKeyAgreement
+ * INPUTS:
+ *    inCertReqMsg
+ *        The certificate request message to operate on.
+ *    destKey
+ *        A pointer to where the library can place a pointer to a
+ *        copy of the POPOPrivKey representing Key Agreement
+ *        Proof of Possession.
+ * NOTES:
+ * This function gets the POPOPrivKey associated with this CRMFCertReqMsg for
+ * Key Agreement.
+ *
+ * RETURN:
+ * If the CertReqMsg used Key Agreement for Proof Of Possession, the
+ * function returns SECSuccess and the POPOPrivKey for Key Agreement
+ * is placed at *destKey.
+ *
+ * If the CertReqMsg did not use Key Agreement for Proof Of Possession, the
+ * function return SECFailure and the value at *destKey is unchanged.
+ */
+extern SECStatus
+CRMF_CertReqMsgGetPOPKeyAgreement(CRMFCertReqMsg *inCertReqMsg,
+                                  CRMFPOPOPrivKey **destKey);
+
+/*
+ * FUNCTION: CRMF_DestroyPOPOPrivKey
+ * INPUTS:
+ *    inPrivKey
+ *        The POPOPrivKey to destroy.
+ * NOTES:
+ * Destroy a structure allocated by CRMF_GetPOPKeyEncipherment or
+ * CRMF_GetPOPKeyAgreement.
+ *
+ * RETURN:
+ * SECSuccess on successful destruction of the POPOPrivKey.
+ * Any other return value indicates an error in freeing the
+ * memory.
+ */
+extern SECStatus CRMF_DestroyPOPOPrivKey(CRMFPOPOPrivKey *inPrivKey);
+
+/*
+ * FUNCTION: CRMF_POPOPrivKeyGetChoice
+ * INPUT:
+ *    inKey
+ *        The POPOPrivKey to operate on.
+ * RETURN:
+ * Returns which choice was used in constructing the POPPOPrivKey. Look at
+ * the definition of CRMFPOPOPrivKeyChoice in crmft.h for the possible return
+ * values.
+ */
+extern CRMFPOPOPrivKeyChoice CRMF_POPOPrivKeyGetChoice(CRMFPOPOPrivKey *inKey);
+
+/*
+ * FUNCTION: CRMF_POPOPrivKeyGetThisMessage
+ * INPUTS:
+ *    inKey
+ *        The POPOPrivKey to operate on.
+ *    destString
+ *        A pointer to where the library can place a copy of the This Message
+ *        field stored in the POPOPrivKey
+ *
+ * RETURN:
+ * Returns the field thisMessage from the POPOPrivKey.
+ * If the POPOPrivKey did not use the field thisMessage, the function
+ * returns SECFailure and the value at *destString is unchanged.
+ *
+ * If the POPOPrivKey did use the field thisMessage, the function returns
+ * SECSuccess and the BIT STRING representing thisMessage is placed
+ * at *destString. BIT STRING representation means the len field is the
+ * number of valid bits as opposed to the total number of bytes.
+ */
+extern SECStatus CRMF_POPOPrivKeyGetThisMessage(CRMFPOPOPrivKey *inKey,
+                                                SECItem *destString);
+
+/*
+ * FUNCTION: CRMF_POPOPrivKeyGetSubseqMess
+ * INPUTS:
+ *    inKey
+ *        The POPOPrivKey to operate on.
+ *    destOpt
+ *        A pointer to where the library can place the value of the
+ *        Subsequent Message option used by POPOPrivKey.
+ *
+ * RETURN:
+ * Retrieves the field subsequentMessage from the POPOPrivKey.
+ * If the POPOPrivKey used the subsequentMessage option, the function
+ * returns SECSuccess and places the appropriate enumerated value at
+ * *destMessageOption.
+ *
+ * If the POPOPrivKey did not use the subsequenMessage option, the function
+ * returns SECFailure and the value at *destOpt is un-changed.
+ */
+extern SECStatus CRMF_POPOPrivKeyGetSubseqMess(CRMFPOPOPrivKey *inKey,
+                                               CRMFSubseqMessOptions *destOpt);
+
+/*
+ * FUNCTION: CRMF_POPOPrivKeyGetDHMAC
+ * INPUTS:
+ *    inKey
+ *        The POPOPrivKey to operate on.
+ *    destMAC
+ *        A pointer to where the library can place a copy of the dhMAC
+ *        field of the POPOPrivKey.
+ *
+ * NOTES:
+ * Returns the field dhMAC from the POPOPrivKey.  The populated SECItem
+ * is in BIT STRING format.
+ *
+ * RETURN:
+ * If the POPOPrivKey used the dhMAC option, the function returns SECSuccess
+ * and the BIT STRING for dhMAC will be placed at *destMAC.  The len field in
+ * destMAC (ie destMAC->len) will be the valid number of bits as opposed to
+ * the number of allocated bytes.
+ *
+ * If the POPOPrivKey did not use the dhMAC option, the function returns
+ * SECFailure and the value at *destMAC is unchanged.
+ *
+ */
+extern SECStatus CRMF_POPOPrivKeyGetDHMAC(CRMFPOPOPrivKey *inKey,
+                                          SECItem *destMAC);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetNumControls
+ * INPUTS:
+ *    inCertReq
+ *        The Certificate Request to operate on.
+ * RETURN:
+ * Returns the number of Controls registered with this CertRequest.
+ */
+extern int CRMF_CertRequestGetNumControls(CRMFCertRequest *inCertReq);
+
+/*
+ * FUNCTION: CRMF_CertRequestGetControlAtIndex
+ * INPUTS:
+ *    inCertReq
+ *        The certificate request to operate on.
+ *    index
+ *        The index of the control the user wants a copy of.
+ * NOTES:
+ * Function retrieves the Control at located at index.  The Controls
+ * are numbered like a traditional C array (0 ... numElements-1)
+ *
+ * RETURN:
+ * Returns a copy of the control at the index specified.  This is a copy
+ * so the user must call CRMF_DestroyControl after the return value is no
+ * longer needed.  A return value of NULL indicates an error while copying
+ * the control or that the index was invalid.
+ */
+extern CRMFControl *
+CRMF_CertRequestGetControlAtIndex(CRMFCertRequest *inCertReq,
+                                  int index);
+
+/*
+ * FUNCTION: CRMF_DestroyControl
+ * INPUTS:
+ *    inControl
+ *        The Control to destroy.
+ * NOTES:
+ * Destroy a CRMFControl allocated by CRMF_GetControlAtIndex.
+ *
+ * RETURN:
+ * SECSuccess if freeing the memory was successful.  Any other return
+ * value indicates an error while freeing the memory.
+ */
+extern SECStatus CRMF_DestroyControl(CRMFControl *inControl);
+
+/*
+ * FUNCTION: CRMF_ControlGetControlType
+ * INPUTS:
+ *    inControl
+ *        The control to operate on.
+ * NOTES:
+ * The function returns an enumertion which indicates the type of control
+ * 'inControl'.
+ *
+ * RETURN:
+ * Look in crmft.h at the definition of the enumerated type CRMFControlType
+ * for the possible return values.
+ */
+extern CRMFControlType CRMF_ControlGetControlType(CRMFControl *inControl);
+
+/*
+ * FUNCTION: CRMF_ControlGetRegTokenControlValue
+ * INPUTS:
+ *    inControl
+ *        The Control to operate on.
+ * NOTES:
+ * The user must call SECITEM_FreeItem passing in the return value
+ * after the returnvalue is no longer needed.
+
+ * RETURN:
+ * Return the value for a Registration Token Control.
+ * The SECItem returned should be in UTF8 format.  A NULL
+ * return value indicates there was no Registration Control associated
+ * with the Control.
+ * (This library will not verify format.  It assumes the client properly
+ * formatted the strings when adding it or the message decoded was properly
+ * formatted.  The library will just give back the bytes it was given.)
+ */
+extern SECItem *CRMF_ControlGetRegTokenControlValue(CRMFControl *inControl);
+
+/*
+ * FUNCTION: CRMF_ControlGetAuthenticatorControlValue
+ * INPUTS:
+ *    inControl
+ *        The Control to operate on.
+ * NOTES:
+ * The user must call SECITEM_FreeItem passing in the return value
+ * after the returnvalue is no longer needed.
+ *
+ * RETURN:
+ * Return the value for the Authenticator Control.
+ * The SECItem returned should be in UTF8 format.  A NULL
+ * return value indicates there was no Authenticator Control associated
+ * with the CRMFControl..
+ * (This library will not verify format.  It assumes the client properly
+ * formatted the strings when adding it or the message decoded was properly
+ * formatted.  The library will just give back the bytes it was given.)
+ */
+extern SECItem *CRMF_ControlGetAuthicatorControlValue(CRMFControl *inControl);
+
+/*
+ * FUNCTION: CRMF_ControlGetPKIArchiveOptions
+ * INPUTS:inControl
+ *    The Control tooperate on.
+ * NOTES:
+ * This function returns a copy of the PKIArchiveOptions.  The user must call
+ * the function CRMF_DestroyPKIArchiveOptions when the return value is no
+ * longer needed.
+ *
+ * RETURN:
+ * Get the PKIArchiveOptions associated with the Control.  A return
+ * value of NULL indicates the Control was not a PKIArchiveOptions
+ * Control.
+ */
+extern CRMFPKIArchiveOptions *
+CRMF_ControlGetPKIArchiveOptions(CRMFControl *inControl);
+
+/*
+ * FUNCTION: CMRF_DestroyPKIArchiveOptions
+ * INPUTS:
+ *    inOptions
+ *        The ArchiveOptions to destroy.
+ * NOTE:
+ * Destroy the CRMFPKIArchiveOptions structure.
+ *
+ * RETURN:
+ * SECSuccess if successful in freeing all the memory associated with
+ * the PKIArchiveOptions.  Any other return value indicates an error while
+ * freeing the PKIArchiveOptions.
+ */
+extern SECStatus
+CRMF_DestroyPKIArchiveOptions(CRMFPKIArchiveOptions *inOptions);
+
+/*
+ * FUNCTION: CRMF_PKIArchiveOptionsGetOptionType
+ * INPUTS:
+ *    inOptions
+ *        The PKIArchiveOptions to operate on.
+ * RETURN:
+ * Returns the choice used for the PKIArchiveOptions.  Look at the definition
+ * of CRMFPKIArchiveOptionsType in crmft.h for possible return values.
+ */
+extern CRMFPKIArchiveOptionsType
+CRMF_PKIArchiveOptionsGetOptionType(CRMFPKIArchiveOptions *inOptions);
+
+/*
+ * FUNCTION: CRMF_PKIArchiveOptionsGetEncryptedPrivKey
+ * INPUTS:
+ *    inOpts
+ *        The PKIArchiveOptions to operate on.
+ *
+ * NOTES:
+ * The user must call CRMF_DestroyEncryptedKey when done using this return
+ * value.
+ *
+ * RETURN:
+ * Get the encryptedPrivKey field of the PKIArchiveOptions structure.
+ * A return value of NULL indicates that encryptedPrivKey was not used as
+ * the choice for this PKIArchiveOptions.
+ */
+extern CRMFEncryptedKey *
+CRMF_PKIArchiveOptionsGetEncryptedPrivKey(CRMFPKIArchiveOptions *inOpts);
+
+/*
+ * FUNCTION: CRMF_EncryptedKeyGetChoice
+ * INPUTS:
+ *    inEncrKey
+ *        The EncryptedKey to operate on.
+ *
+ * NOTES:
+ * Get the choice used for representing the EncryptedKey.
+ *
+ * RETURN:
+ * Returns the Choice used in representing the EncryptedKey.  Look in
+ * crmft.h at the definition of CRMFEncryptedKeyChoice for possible return
+ * values.
+ */
+extern CRMFEncryptedKeyChoice
+CRMF_EncryptedKeyGetChoice(CRMFEncryptedKey *inEncrKey);
+
+/*
+ * FUNCTION: CRMF_EncryptedKeyGetEncryptedValue
+ * INPUTS:
+ *    inKey
+ *        The EncryptedKey to operate on.
+ *
+ * NOTES:
+ * The user must call CRMF_DestroyEncryptedValue passing in
+ * CRMF_GetEncryptedValue's return value.
+ *
+ * RETURN:
+ * A pointer to a copy of the EncryptedValue contained as a member of
+ * the EncryptedKey.
+ */
+extern CRMFEncryptedValue *
+CRMF_EncryptedKeyGetEncryptedValue(CRMFEncryptedKey *inKey);
+
+/*
+ * FUNCTION: CRMF_DestroyEncryptedValue
+ * INPUTS:
+ *    inEncrValue
+ *        The EncryptedValue to destroy.
+ *
+ * NOTES:
+ * Free up all memory associated with 'inEncrValue'.
+ *
+ * RETURN:
+ * SECSuccess if freeing up the memory associated with the EncryptedValue
+ * is successful. Any other return value indicates an error while freeing the
+ * memory.
+ */
+extern SECStatus CRMF_DestroyEncryptedValue(CRMFEncryptedValue *inEncrValue);
+
+/*
+ * FUNCTION: CRMF_EncryptedValueGetEncValue
+ * INPUTS:
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ * NOTES:
+ * Function retrieves the encValue from an EncryptedValue structure.
+ *
+ * RETURN:
+ * A poiner to a SECItem containing the encValue of the EncryptedValue
+ * structure.  The return value is in BIT STRING format, meaning the
+ * len field of the return structure represents the number of valid bits
+ * as opposed to the allocated number of bytes.
+ * ANULL return value indicates an error in copying the encValue field.
+ */
+extern SECItem *CRMF_EncryptedValueGetEncValue(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_EncryptedValueGetIntendedAlg
+ * INPUTS
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ * NOTES:
+ * Retrieve the IntendedAlg field from the EncryptedValue structure.
+ * Call SECOID_DestroyAlgorithmID (destAlgID, PR_TRUE) after done using
+ * the return value.  When present, this alogorithm is the alogrithm for
+ * which the private key will be used.
+ *
+ * RETURN:
+ * A Copy of the intendedAlg field.  A NULL return value indicates the
+ * optional field was not present in the structure.
+ */
+extern SECAlgorithmID *
+CRMF_EncryptedValueGetIntendedAlg(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_EncryptedValueGetSymmAlg
+ * INPUTS
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ * NOTES:
+ * Retrieve the symmAlg field from the EncryptedValue structure.
+ * Call SECOID_DestroyAlgorithmID (destAlgID, PR_TRUE) after done using
+ * the return value.  When present, this is algorithm used to
+ * encrypt the encValue of the EncryptedValue.
+ *
+ * RETURN:
+ * A Copy of the symmAlg field.  A NULL return value indicates the
+ * optional field was not present in the structure.
+ */
+extern SECAlgorithmID *
+CRMF_EncryptedValueGetSymmAlg(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_EncryptedValueGetKeyAlg
+ * INPUTS
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ * NOTES:
+ * Retrieve the keyAlg field from the EncryptedValue structure.
+ * Call SECOID_DestroyAlgorithmID (destAlgID, PR_TRUE) after done using
+ * the return value.  When present, this is the algorithm used to encrypt
+ * the symmetric key in the encSymmKey field of the EncryptedValue structure.
+ *
+ * RETURN:
+ * A Copy of the keyAlg field.  A NULL return value indicates the
+ * optional field was not present in the structure.
+ */
+extern SECAlgorithmID *
+CRMF_EncryptedValueGetKeyAlg(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_EncryptedValueGetValueHint
+ * INPUTS:
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ *
+ * NOTES:
+ * Return a copy of the der-encoded value hint.
+ * User must call SECITEM_FreeItem(retVal, PR_TRUE) when done using the
+ * return value.  When, present, this is a value that the client which
+ * originally issued a certificate request can use to reproduce any data
+ * it wants.  The RA does not know how to interpret this data.
+ *
+ * RETURN:
+ * A copy of the valueHint field of the EncryptedValue.  A NULL return
+ * value indicates the optional valueHint field is not present in the
+ * EncryptedValue.
+ */
+extern SECItem *
+CRMF_EncryptedValueGetValueHint(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_EncrypteValueGetEncSymmKey
+ * INPUTS:
+ *    inEncValue
+ *        The EncryptedValue to operate on.
+ *
+ * NOTES:
+ * Return a copy of the encSymmKey field. This field is the encrypted
+ * symmetric key that the client uses in doing Public Key wrap of a private
+ * key.  When present, this is the symmetric key that was used to wrap the
+ * private key.  (The encrypted private key will be stored in encValue
+ * of the same EncryptedValue structure.)  The user must call
+ * SECITEM_FreeItem(retVal, PR_TRUE) when the return value is no longer
+ * needed.
+ *
+ * RETURN:
+ * A copy of the optional encSymmKey field of the EncryptedValue structure.
+ * The return value will be in BIT STRING format, meaning the len field will
+ * be the number of valid bits as opposed to the number of bytes. A return
+ * value of NULL means the optional encSymmKey field was not present in
+ * the EncryptedValue structure.
+ */
+extern SECItem *
+CRMF_EncryptedValueGetEncSymmKey(CRMFEncryptedValue *inEncValue);
+
+/*
+ * FUNCTION: CRMF_PKIArchiveOptionsGetKeyGenParameters
+ * INPUTS:
+ *    inOptions
+ *        The PKiArchiveOptions to operate on.
+ *
+ * NOTES:
+ * User must call SECITEM_FreeItem(retVal, PR_TRUE) after the return
+ * value is no longer needed.
+ *
+ * RETURN:
+ * Get the keyGenParameters field of the PKIArchiveOptions.
+ * A NULL return value indicates that keyGenParameters was not
+ * used as the choice for this PKIArchiveOptions.
+ *
+ * The SECItem returned is in BIT STRING format (ie, the len field indicates
+ * number of valid bits as opposed to allocated number of bytes.)
+ */
+extern SECItem *
+CRMF_PKIArchiveOptionsGetKeyGenParameters(CRMFPKIArchiveOptions *inOptions);
+
+/*
+ * FUNCTION: CRMF_PKIArchiveOptionsGetArchiveRemGenPrivKey
+ * INPUTS:
+ *    inOpt
+ *        The PKIArchiveOptions to operate on.
+ *    destVal
+ *        A pointer to where the library can place the value for
+ *        arciveRemGenPrivKey
+ * RETURN:
+ * If the PKIArchiveOptions used the archiveRemGenPrivKey field, the
+ * function returns SECSuccess and fills the value at *destValue with either
+ * PR_TRUE or PR_FALSE, depending on what the PKIArchiveOptions has as a
+ * value.
+ *
+ * If the PKIArchiveOptions does not use the archiveRemGenPrivKey field, the
+ * function returns SECFailure and the value at *destValue is unchanged.
+ */
+extern SECStatus
+CRMF_PKIArchiveOptionsGetArchiveRemGenPrivKey(CRMFPKIArchiveOptions *inOpt,
+                                              PRBool *destVal);
+
+/* Helper functions that can be used by other libraries. */
+/*
+ * A quick helper function to get the best wrap mechanism.
+ */
+extern CK_MECHANISM_TYPE CRMF_GetBestWrapPadMechanism(PK11SlotInfo *slot);
+
+/*
+ * A helper function to get a randomly generated IV from a mechanism
+ * type.
+ */
+extern SECItem *CRMF_GetIVFromMechanism(CK_MECHANISM_TYPE mechType);
+
+SEC_END_PROTOS
+#endif /*_CRMF_H_*/
diff --git a/security/nss/lib/crmf/crmfcont.c b/security/nss/lib/crmf/crmfcont.c
new file mode 100644
index 0000000000..5df2bd8283
--- /dev/null
+++ b/security/nss/lib/crmf/crmfcont.c
@@ -0,0 +1,1161 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "pk11func.h"
+#include "keyhi.h"
+#include "secoid.h"
+
+static SECStatus
+crmf_modify_control_array(CRMFCertRequest *inCertReq, int count)
+{
+    if (count > 0) {
+        void *dummy = PORT_Realloc(inCertReq->controls,
+                                   sizeof(CRMFControl *) * (count + 2));
+        if (dummy == NULL) {
+            return SECFailure;
+        }
+        inCertReq->controls = dummy;
+    } else {
+        inCertReq->controls = PORT_ZNewArray(CRMFControl *, 2);
+    }
+    return (inCertReq->controls == NULL) ? SECFailure : SECSuccess;
+}
+
+static SECStatus
+crmf_add_new_control(CRMFCertRequest *inCertReq, SECOidTag inTag,
+                     CRMFControl **destControl)
+{
+    SECOidData *oidData;
+    SECStatus rv;
+    PLArenaPool *poolp;
+    int numControls = 0;
+    CRMFControl *newControl;
+    CRMFControl **controls;
+    void *mark;
+
+    poolp = inCertReq->poolp;
+    if (poolp == NULL) {
+        return SECFailure;
+    }
+    mark = PORT_ArenaMark(poolp);
+    if (inCertReq->controls != NULL) {
+        while (inCertReq->controls[numControls] != NULL)
+            numControls++;
+    }
+    rv = crmf_modify_control_array(inCertReq, numControls);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    controls = inCertReq->controls;
+    oidData = SECOID_FindOIDByTag(inTag);
+    newControl = *destControl = PORT_ArenaZNew(poolp, CRMFControl);
+    if (newControl == NULL) {
+        goto loser;
+    }
+    rv = SECITEM_CopyItem(poolp, &newControl->derTag, &oidData->oid);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    newControl->tag = inTag;
+    controls[numControls] = newControl;
+    controls[numControls + 1] = NULL;
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    *destControl = NULL;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_add_secitem_control(CRMFCertRequest *inCertReq, SECItem *value,
+                         SECOidTag inTag)
+{
+    SECStatus rv;
+    CRMFControl *newControl;
+    void *mark;
+
+    rv = crmf_add_new_control(inCertReq, inTag, &newControl);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    mark = PORT_ArenaMark(inCertReq->poolp);
+    rv = SECITEM_CopyItem(inCertReq->poolp, &newControl->derValue, value);
+    if (rv != SECSuccess) {
+        PORT_ArenaRelease(inCertReq->poolp, mark);
+        return rv;
+    }
+    PORT_ArenaUnmark(inCertReq->poolp, mark);
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_CertRequestSetRegTokenControl(CRMFCertRequest *inCertReq, SECItem *value)
+{
+    return crmf_add_secitem_control(inCertReq, value,
+                                    SEC_OID_PKIX_REGCTRL_REGTOKEN);
+}
+
+SECStatus
+CRMF_CertRequestSetAuthenticatorControl(CRMFCertRequest *inCertReq,
+                                        SECItem *value)
+{
+    return crmf_add_secitem_control(inCertReq, value,
+                                    SEC_OID_PKIX_REGCTRL_AUTHENTICATOR);
+}
+
+SECStatus
+crmf_destroy_encrypted_value(CRMFEncryptedValue *inEncrValue, PRBool freeit)
+{
+    if (inEncrValue != NULL) {
+        if (inEncrValue->intendedAlg) {
+            SECOID_DestroyAlgorithmID(inEncrValue->intendedAlg, PR_TRUE);
+            inEncrValue->intendedAlg = NULL;
+        }
+        if (inEncrValue->symmAlg) {
+            SECOID_DestroyAlgorithmID(inEncrValue->symmAlg, PR_TRUE);
+            inEncrValue->symmAlg = NULL;
+        }
+        if (inEncrValue->encSymmKey.data) {
+            PORT_Free(inEncrValue->encSymmKey.data);
+            inEncrValue->encSymmKey.data = NULL;
+        }
+        if (inEncrValue->keyAlg) {
+            SECOID_DestroyAlgorithmID(inEncrValue->keyAlg, PR_TRUE);
+            inEncrValue->keyAlg = NULL;
+        }
+        if (inEncrValue->valueHint.data) {
+            PORT_Free(inEncrValue->valueHint.data);
+            inEncrValue->valueHint.data = NULL;
+        }
+        if (inEncrValue->encValue.data) {
+            PORT_Free(inEncrValue->encValue.data);
+            inEncrValue->encValue.data = NULL;
+        }
+        if (freeit) {
+            PORT_Free(inEncrValue);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_DestroyEncryptedValue(CRMFEncryptedValue *inEncrValue)
+{
+    return crmf_destroy_encrypted_value(inEncrValue, PR_TRUE);
+}
+
+SECStatus
+crmf_copy_encryptedvalue_secalg(PLArenaPool *poolp,
+                                SECAlgorithmID *srcAlgId,
+                                SECAlgorithmID **destAlgId)
+{
+    SECAlgorithmID *newAlgId;
+    SECStatus rv;
+
+    newAlgId = (poolp != NULL) ? PORT_ArenaZNew(poolp, SECAlgorithmID) : PORT_ZNew(SECAlgorithmID);
+    if (newAlgId == NULL) {
+        return SECFailure;
+    }
+
+    rv = SECOID_CopyAlgorithmID(poolp, newAlgId, srcAlgId);
+    if (rv != SECSuccess) {
+        if (!poolp) {
+            SECOID_DestroyAlgorithmID(newAlgId, PR_TRUE);
+        }
+        return rv;
+    }
+    *destAlgId = newAlgId;
+
+    return rv;
+}
+
+SECStatus
+crmf_copy_encryptedvalue(PLArenaPool *poolp,
+                         CRMFEncryptedValue *srcValue,
+                         CRMFEncryptedValue *destValue)
+{
+    SECStatus rv;
+
+    if (srcValue->intendedAlg != NULL) {
+        rv = crmf_copy_encryptedvalue_secalg(poolp,
+                                             srcValue->intendedAlg,
+                                             &destValue->intendedAlg);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValue->symmAlg != NULL) {
+        rv = crmf_copy_encryptedvalue_secalg(poolp,
+                                             srcValue->symmAlg,
+                                             &destValue->symmAlg);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValue->encSymmKey.data != NULL) {
+        rv = crmf_make_bitstring_copy(poolp,
+                                      &destValue->encSymmKey,
+                                      &srcValue->encSymmKey);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValue->keyAlg != NULL) {
+        rv = crmf_copy_encryptedvalue_secalg(poolp,
+                                             srcValue->keyAlg,
+                                             &destValue->keyAlg);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValue->valueHint.data != NULL) {
+        rv = SECITEM_CopyItem(poolp,
+                              &destValue->valueHint,
+                              &srcValue->valueHint);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValue->encValue.data != NULL) {
+        rv = crmf_make_bitstring_copy(poolp,
+                                      &destValue->encValue,
+                                      &srcValue->encValue);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    return SECSuccess;
+loser:
+    if (poolp == NULL && destValue != NULL) {
+        crmf_destroy_encrypted_value(destValue, PR_FALSE);
+    }
+    return SECFailure;
+}
+
+SECStatus
+crmf_copy_encryptedkey(PLArenaPool *poolp,
+                       CRMFEncryptedKey *srcEncrKey,
+                       CRMFEncryptedKey *destEncrKey)
+{
+    SECStatus rv;
+    void *mark = NULL;
+
+    if (poolp != NULL) {
+        mark = PORT_ArenaMark(poolp);
+    }
+
+    switch (srcEncrKey->encKeyChoice) {
+        case crmfEncryptedValueChoice:
+            rv = crmf_copy_encryptedvalue(poolp,
+                                          &srcEncrKey->value.encryptedValue,
+                                          &destEncrKey->value.encryptedValue);
+            break;
+        case crmfEnvelopedDataChoice:
+            destEncrKey->value.envelopedData =
+                SEC_PKCS7CopyContentInfo(srcEncrKey->value.envelopedData);
+            rv = (destEncrKey->value.envelopedData != NULL) ? SECSuccess : SECFailure;
+            break;
+        default:
+            rv = SECFailure;
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    destEncrKey->encKeyChoice = srcEncrKey->encKeyChoice;
+    if (mark) {
+        PORT_ArenaUnmark(poolp, mark);
+    }
+    return SECSuccess;
+
+loser:
+    if (mark) {
+        PORT_ArenaRelease(poolp, mark);
+    }
+    return SECFailure;
+}
+
+static CRMFPKIArchiveOptions *
+crmf_create_encr_pivkey_option(CRMFEncryptedKey *inEncryptedKey)
+{
+    CRMFPKIArchiveOptions *newArchOpt;
+    SECStatus rv;
+
+    newArchOpt = PORT_ZNew(CRMFPKIArchiveOptions);
+    if (newArchOpt == NULL) {
+        goto loser;
+    }
+
+    rv = crmf_copy_encryptedkey(NULL, inEncryptedKey,
+                                &newArchOpt->option.encryptedKey);
+
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    newArchOpt->archOption = crmfEncryptedPrivateKey;
+    return newArchOpt;
+loser:
+    if (newArchOpt != NULL) {
+        CRMF_DestroyPKIArchiveOptions(newArchOpt);
+    }
+    return NULL;
+}
+
+static CRMFPKIArchiveOptions *
+crmf_create_keygen_param_option(SECItem *inKeyGenParams)
+{
+    CRMFPKIArchiveOptions *newArchOptions;
+    SECStatus rv;
+
+    newArchOptions = PORT_ZNew(CRMFPKIArchiveOptions);
+    if (newArchOptions == NULL) {
+        goto loser;
+    }
+    newArchOptions->archOption = crmfKeyGenParameters;
+    rv = SECITEM_CopyItem(NULL, &newArchOptions->option.keyGenParameters,
+                          inKeyGenParams);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newArchOptions;
+loser:
+    if (newArchOptions != NULL) {
+        CRMF_DestroyPKIArchiveOptions(newArchOptions);
+    }
+    return NULL;
+}
+
+static CRMFPKIArchiveOptions *
+crmf_create_arch_rem_gen_privkey(PRBool archiveRemGenPrivKey)
+{
+    unsigned char value;
+    SECItem *dummy;
+    CRMFPKIArchiveOptions *newArchOptions;
+
+    value = (archiveRemGenPrivKey) ? hexTrue : hexFalse;
+    newArchOptions = PORT_ZNew(CRMFPKIArchiveOptions);
+    if (newArchOptions == NULL) {
+        goto loser;
+    }
+    dummy = SEC_ASN1EncodeItem(NULL,
+                               &newArchOptions->option.archiveRemGenPrivKey,
+                               &value, SEC_ASN1_GET(SEC_BooleanTemplate));
+    PORT_Assert(dummy == &newArchOptions->option.archiveRemGenPrivKey);
+    if (dummy != &newArchOptions->option.archiveRemGenPrivKey) {
+        SECITEM_FreeItem(dummy, PR_TRUE);
+        goto loser;
+    }
+    newArchOptions->archOption = crmfArchiveRemGenPrivKey;
+    return newArchOptions;
+loser:
+    if (newArchOptions != NULL) {
+        CRMF_DestroyPKIArchiveOptions(newArchOptions);
+    }
+    return NULL;
+}
+
+CRMFPKIArchiveOptions *
+CRMF_CreatePKIArchiveOptions(CRMFPKIArchiveOptionsType inType, void *data)
+{
+    CRMFPKIArchiveOptions *retOptions;
+
+    PORT_Assert(data != NULL);
+    if (data == NULL) {
+        return NULL;
+    }
+    switch (inType) {
+        case crmfEncryptedPrivateKey:
+            retOptions = crmf_create_encr_pivkey_option((CRMFEncryptedKey *)data);
+            break;
+        case crmfKeyGenParameters:
+            retOptions = crmf_create_keygen_param_option((SECItem *)data);
+            break;
+        case crmfArchiveRemGenPrivKey:
+            retOptions = crmf_create_arch_rem_gen_privkey(*(PRBool *)data);
+            break;
+        default:
+            retOptions = NULL;
+    }
+    return retOptions;
+}
+
+static SECStatus
+crmf_destroy_encrypted_key(CRMFEncryptedKey *inEncrKey, PRBool freeit)
+{
+    PORT_Assert(inEncrKey != NULL);
+    if (inEncrKey != NULL) {
+        switch (inEncrKey->encKeyChoice) {
+            case crmfEncryptedValueChoice:
+                crmf_destroy_encrypted_value(&inEncrKey->value.encryptedValue,
+                                             PR_FALSE);
+                break;
+            case crmfEnvelopedDataChoice:
+                SEC_PKCS7DestroyContentInfo(inEncrKey->value.envelopedData);
+                break;
+            default:
+                break;
+        }
+        if (freeit) {
+            PORT_Free(inEncrKey);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+crmf_destroy_pkiarchiveoptions(CRMFPKIArchiveOptions *inArchOptions,
+                               PRBool freeit)
+{
+    PORT_Assert(inArchOptions != NULL);
+    if (inArchOptions != NULL) {
+        switch (inArchOptions->archOption) {
+            case crmfEncryptedPrivateKey:
+                crmf_destroy_encrypted_key(&inArchOptions->option.encryptedKey,
+                                           PR_FALSE);
+                break;
+            case crmfKeyGenParameters:
+            case crmfArchiveRemGenPrivKey:
+                /* This is a union, so having a pointer to one is like
+                 * having a pointer to both.
+                 */
+                SECITEM_FreeItem(&inArchOptions->option.keyGenParameters,
+                                 PR_FALSE);
+                break;
+            case crmfNoArchiveOptions:
+                break;
+        }
+        if (freeit) {
+            PORT_Free(inArchOptions);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_DestroyPKIArchiveOptions(CRMFPKIArchiveOptions *inArchOptions)
+{
+    return crmf_destroy_pkiarchiveoptions(inArchOptions, PR_TRUE);
+}
+
+static CK_MECHANISM_TYPE
+crmf_get_non_pad_mechanism(CK_MECHANISM_TYPE type)
+{
+    switch (type) {
+        case CKM_DES3_CBC_PAD:
+            return CKM_DES3_CBC;
+        case CKM_CAST5_CBC_PAD:
+            return CKM_CAST5_CBC;
+        case CKM_DES_CBC_PAD:
+            return CKM_DES_CBC;
+        case CKM_IDEA_CBC_PAD:
+            return CKM_IDEA_CBC;
+        case CKM_CAST3_CBC_PAD:
+            return CKM_CAST3_CBC;
+        case CKM_CAST_CBC_PAD:
+            return CKM_CAST_CBC;
+        case CKM_RC5_CBC_PAD:
+            return CKM_RC5_CBC;
+        case CKM_RC2_CBC_PAD:
+            return CKM_RC2_CBC;
+        case CKM_CDMF_CBC_PAD:
+            return CKM_CDMF_CBC;
+    }
+    return type;
+}
+
+static CK_MECHANISM_TYPE
+crmf_get_pad_mech_from_tag(SECOidTag oidTag)
+{
+    CK_MECHANISM_TYPE mechType;
+    SECOidData *oidData;
+
+    oidData = SECOID_FindOIDByTag(oidTag);
+    mechType = (CK_MECHANISM_TYPE)oidData->mechanism;
+    return PK11_GetPadMechanism(mechType);
+}
+
+static CK_MECHANISM_TYPE
+crmf_get_best_privkey_wrap_mechanism(PK11SlotInfo *slot)
+{
+    CK_MECHANISM_TYPE privKeyPadMechs[] = { CKM_DES3_CBC_PAD,
+                                            CKM_CAST5_CBC_PAD,
+                                            CKM_DES_CBC_PAD,
+                                            CKM_IDEA_CBC_PAD,
+                                            CKM_CAST3_CBC_PAD,
+                                            CKM_CAST_CBC_PAD,
+                                            CKM_RC5_CBC_PAD,
+                                            CKM_RC2_CBC_PAD,
+                                            CKM_CDMF_CBC_PAD };
+    int mechCount = sizeof(privKeyPadMechs) / sizeof(privKeyPadMechs[0]);
+    int i;
+
+    for (i = 0; i < mechCount; i++) {
+        if (PK11_DoesMechanism(slot, privKeyPadMechs[i])) {
+            return privKeyPadMechs[i];
+        }
+    }
+    return CKM_INVALID_MECHANISM;
+}
+
+CK_MECHANISM_TYPE
+CRMF_GetBestWrapPadMechanism(PK11SlotInfo *slot)
+{
+    return crmf_get_best_privkey_wrap_mechanism(slot);
+}
+
+static SECItem *
+crmf_get_iv(CK_MECHANISM_TYPE mechType)
+{
+    int iv_size = PK11_GetIVLength(mechType);
+    SECItem *iv;
+    SECStatus rv;
+
+    iv = PORT_ZNew(SECItem);
+    if (iv == NULL) {
+        return NULL;
+    }
+    if (iv_size == 0) {
+        iv->data = NULL;
+        iv->len = 0;
+        return iv;
+    }
+    iv->data = PORT_NewArray(unsigned char, iv_size);
+    if (iv->data == NULL) {
+        iv->len = 0;
+        return iv;
+    }
+    iv->len = iv_size;
+    rv = PK11_GenerateRandom(iv->data, iv->len);
+    if (rv != SECSuccess) {
+        PORT_Free(iv->data);
+        iv->data = NULL;
+        iv->len = 0;
+    }
+    return iv;
+}
+
+SECItem *
+CRMF_GetIVFromMechanism(CK_MECHANISM_TYPE mechType)
+{
+    return crmf_get_iv(mechType);
+}
+
+CK_MECHANISM_TYPE
+crmf_get_mechanism_from_public_key(SECKEYPublicKey *inPubKey)
+{
+    CERTSubjectPublicKeyInfo *spki = NULL;
+    SECOidTag tag;
+
+    spki = SECKEY_CreateSubjectPublicKeyInfo(inPubKey);
+    if (spki == NULL) {
+        return CKM_INVALID_MECHANISM;
+    }
+    tag = SECOID_FindOIDTag(&spki->algorithm.algorithm);
+    SECKEY_DestroySubjectPublicKeyInfo(spki);
+    spki = NULL;
+    return PK11_AlgtagToMechanism(tag);
+}
+
+SECItem *
+crmf_get_public_value(SECKEYPublicKey *pubKey, SECItem *dest)
+{
+    SECItem *src;
+
+    switch (pubKey->keyType) {
+        case dsaKey:
+            src = &pubKey->u.dsa.publicValue;
+            break;
+        case rsaKey:
+            src = &pubKey->u.rsa.modulus;
+            break;
+        case dhKey:
+            src = &pubKey->u.dh.publicValue;
+            break;
+        default:
+            src = NULL;
+            break;
+    }
+    if (!src) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return NULL;
+    }
+
+    if (dest != NULL) {
+        SECStatus rv = SECITEM_CopyItem(NULL, dest, src);
+        if (rv != SECSuccess) {
+            dest = NULL;
+        }
+    } else {
+        dest = SECITEM_ArenaDupItem(NULL, src);
+    }
+    return dest;
+}
+
+static SECItem *
+crmf_decode_params(SECItem *inParams)
+{
+    SECItem *params;
+    SECStatus rv = SECFailure;
+    PLArenaPool *poolp;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+
+    params = PORT_ArenaZNew(poolp, SECItem);
+    if (params) {
+        rv = SEC_ASN1DecodeItem(poolp, params,
+                                SEC_ASN1_GET(SEC_OctetStringTemplate),
+                                inParams);
+    }
+    params = (rv == SECSuccess) ? SECITEM_ArenaDupItem(NULL, params) : NULL;
+    PORT_FreeArena(poolp, PR_FALSE);
+    return params;
+}
+
+static int
+crmf_get_key_size_from_mech(CK_MECHANISM_TYPE mechType)
+{
+    CK_MECHANISM_TYPE keyGen = PK11_GetKeyGen(mechType);
+
+    switch (keyGen) {
+        case CKM_CDMF_KEY_GEN:
+        case CKM_DES_KEY_GEN:
+            return 8;
+        case CKM_DES2_KEY_GEN:
+            return 16;
+        case CKM_DES3_KEY_GEN:
+            return 24;
+    }
+    return 0;
+}
+
+SECStatus
+crmf_encrypted_value_unwrap_priv_key(PLArenaPool *poolp,
+                                     CRMFEncryptedValue *encValue,
+                                     SECKEYPrivateKey *privKey,
+                                     SECKEYPublicKey *newPubKey,
+                                     SECItem *nickname,
+                                     PK11SlotInfo *slot,
+                                     unsigned char keyUsage,
+                                     SECKEYPrivateKey **unWrappedKey,
+                                     void *wincx)
+{
+    PK11SymKey *wrappingKey = NULL;
+    CK_MECHANISM_TYPE wrapMechType;
+    SECOidTag oidTag;
+    SECItem *params = NULL, *publicValue = NULL;
+    int keySize, origLen;
+    CK_KEY_TYPE keyType;
+    CK_ATTRIBUTE_TYPE *usage = NULL;
+    CK_ATTRIBUTE_TYPE rsaUsage[] = {
+        CKA_UNWRAP, CKA_DECRYPT, CKA_SIGN, CKA_SIGN_RECOVER
+    };
+    CK_ATTRIBUTE_TYPE dsaUsage[] = { CKA_SIGN };
+    CK_ATTRIBUTE_TYPE dhUsage[] = { CKA_DERIVE };
+    int usageCount = 0;
+
+    oidTag = SECOID_GetAlgorithmTag(encValue->symmAlg);
+    wrapMechType = crmf_get_pad_mech_from_tag(oidTag);
+    keySize = crmf_get_key_size_from_mech(wrapMechType);
+    wrappingKey = PK11_PubUnwrapSymKey(privKey, &encValue->encSymmKey,
+                                       wrapMechType, CKA_UNWRAP, keySize);
+    if (wrappingKey == NULL) {
+        goto loser;
+    } /* Make the length a byte length instead of bit length*/
+    params = (encValue->symmAlg != NULL) ? crmf_decode_params(&encValue->symmAlg->parameters)
+                                         : NULL;
+    origLen = encValue->encValue.len;
+    encValue->encValue.len = CRMF_BITS_TO_BYTES(origLen);
+    publicValue = crmf_get_public_value(newPubKey, NULL);
+    switch (newPubKey->keyType) {
+        default:
+        case rsaKey:
+            keyType = CKK_RSA;
+            switch (keyUsage & (KU_KEY_ENCIPHERMENT | KU_DIGITAL_SIGNATURE)) {
+                case KU_KEY_ENCIPHERMENT:
+                    usage = rsaUsage;
+                    usageCount = 2;
+                    break;
+                case KU_DIGITAL_SIGNATURE:
+                    usage = &rsaUsage[2];
+                    usageCount = 2;
+                    break;
+                case KU_KEY_ENCIPHERMENT |
+                    KU_DIGITAL_SIGNATURE:
+                case 0: /* default to everything */
+                    usage = rsaUsage;
+                    usageCount = 4;
+                    break;
+            }
+            break;
+        case dhKey:
+            keyType = CKK_DH;
+            usage = dhUsage;
+            usageCount = sizeof(dhUsage) / sizeof(dhUsage[0]);
+            break;
+        case dsaKey:
+            keyType = CKK_DSA;
+            usage = dsaUsage;
+            usageCount = sizeof(dsaUsage) / sizeof(dsaUsage[0]);
+            break;
+    }
+    PORT_Assert(usage != NULL);
+    PORT_Assert(usageCount != 0);
+    *unWrappedKey = PK11_UnwrapPrivKey(slot, wrappingKey, wrapMechType, params,
+                                       &encValue->encValue, nickname,
+                                       publicValue, PR_TRUE, PR_TRUE,
+                                       keyType, usage, usageCount, wincx);
+    encValue->encValue.len = origLen;
+    if (*unWrappedKey == NULL) {
+        goto loser;
+    }
+    SECITEM_FreeItem(publicValue, PR_TRUE);
+    if (params != NULL) {
+        SECITEM_FreeItem(params, PR_TRUE);
+    }
+    PK11_FreeSymKey(wrappingKey);
+    return SECSuccess;
+loser:
+    *unWrappedKey = NULL;
+    return SECFailure;
+}
+
+CRMFEncryptedValue *
+crmf_create_encrypted_value_wrapped_privkey(SECKEYPrivateKey *inPrivKey,
+                                            SECKEYPublicKey *inCAKey,
+                                            CRMFEncryptedValue *destValue)
+{
+    SECItem wrappedPrivKey, wrappedSymKey;
+    SECItem encodedParam, *dummy;
+    SECStatus rv;
+    CK_MECHANISM_TYPE pubMechType, symKeyType;
+    unsigned char *wrappedSymKeyBits;
+    unsigned char *wrappedPrivKeyBits;
+    SECItem *iv = NULL;
+    SECOidTag tag;
+    PK11SymKey *symKey;
+    PK11SlotInfo *slot;
+    SECAlgorithmID *symmAlg;
+    CRMFEncryptedValue *myEncrValue = NULL;
+
+    encodedParam.data = NULL;
+    wrappedSymKeyBits = PORT_NewArray(unsigned char, MAX_WRAPPED_KEY_LEN);
+    wrappedPrivKeyBits = PORT_NewArray(unsigned char, MAX_WRAPPED_KEY_LEN);
+    if (wrappedSymKeyBits == NULL || wrappedPrivKeyBits == NULL) {
+        goto loser;
+    }
+    if (destValue == NULL) {
+        myEncrValue = destValue = PORT_ZNew(CRMFEncryptedValue);
+        if (destValue == NULL) {
+            goto loser;
+        }
+    }
+
+    pubMechType = crmf_get_mechanism_from_public_key(inCAKey);
+    if (pubMechType == CKM_INVALID_MECHANISM) {
+        /* XXX I should probably do something here for non-RSA
+         *     keys that are in certs. (ie DSA)
+         * XXX or at least SET AN ERROR CODE.
+         */
+        goto loser;
+    }
+    slot = inPrivKey->pkcs11Slot;
+    PORT_Assert(slot != NULL);
+    symKeyType = crmf_get_best_privkey_wrap_mechanism(slot);
+    symKey = PK11_KeyGen(slot, symKeyType, NULL, 0, NULL);
+    if (symKey == NULL) {
+        goto loser;
+    }
+
+    wrappedSymKey.data = wrappedSymKeyBits;
+    wrappedSymKey.len = MAX_WRAPPED_KEY_LEN;
+    rv = PK11_PubWrapSymKey(pubMechType, inCAKey, symKey, &wrappedSymKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    /* Make the length of the result a Bit String length. */
+    wrappedSymKey.len <<= 3;
+
+    wrappedPrivKey.data = wrappedPrivKeyBits;
+    wrappedPrivKey.len = MAX_WRAPPED_KEY_LEN;
+    iv = crmf_get_iv(symKeyType);
+    rv = PK11_WrapPrivKey(slot, symKey, inPrivKey, symKeyType, iv,
+                          &wrappedPrivKey, NULL);
+    PK11_FreeSymKey(symKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    /* Make the length of the result a Bit String length. */
+    wrappedPrivKey.len <<= 3;
+    rv = crmf_make_bitstring_copy(NULL,
+                                  &destValue->encValue,
+                                  &wrappedPrivKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_make_bitstring_copy(NULL,
+                                  &destValue->encSymmKey,
+                                  &wrappedSymKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    destValue->symmAlg = symmAlg = PORT_ZNew(SECAlgorithmID);
+    if (symmAlg == NULL) {
+        goto loser;
+    }
+
+    dummy = SEC_ASN1EncodeItem(NULL, &encodedParam, iv,
+                               SEC_ASN1_GET(SEC_OctetStringTemplate));
+    if (dummy != &encodedParam) {
+        SECITEM_FreeItem(dummy, PR_TRUE);
+        goto loser;
+    }
+
+    symKeyType = crmf_get_non_pad_mechanism(symKeyType);
+    tag = PK11_MechanismToAlgtag(symKeyType);
+    rv = SECOID_SetAlgorithmID(NULL, symmAlg, tag, &encodedParam);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    SECITEM_FreeItem(&encodedParam, PR_FALSE);
+    PORT_Free(wrappedPrivKeyBits);
+    PORT_Free(wrappedSymKeyBits);
+    SECITEM_FreeItem(iv, PR_TRUE);
+    return destValue;
+loser:
+    if (iv != NULL) {
+        SECITEM_FreeItem(iv, PR_TRUE);
+    }
+    if (myEncrValue != NULL) {
+        crmf_destroy_encrypted_value(myEncrValue, PR_TRUE);
+    }
+    if (wrappedSymKeyBits != NULL) {
+        PORT_Free(wrappedSymKeyBits);
+    }
+    if (wrappedPrivKeyBits != NULL) {
+        PORT_Free(wrappedPrivKeyBits);
+    }
+    if (encodedParam.data != NULL) {
+        SECITEM_FreeItem(&encodedParam, PR_FALSE);
+    }
+    return NULL;
+}
+
+CRMFEncryptedKey *
+CRMF_CreateEncryptedKeyWithEncryptedValue(SECKEYPrivateKey *inPrivKey,
+                                          CERTCertificate *inCACert)
+{
+    SECKEYPublicKey *caPubKey = NULL;
+    CRMFEncryptedKey *encKey = NULL;
+
+    PORT_Assert(inPrivKey != NULL && inCACert != NULL);
+    if (inPrivKey == NULL || inCACert == NULL) {
+        return NULL;
+    }
+
+    caPubKey = CERT_ExtractPublicKey(inCACert);
+    if (caPubKey == NULL) {
+        goto loser;
+    }
+
+    encKey = PORT_ZNew(CRMFEncryptedKey);
+    if (encKey == NULL) {
+        goto loser;
+    }
+#ifdef DEBUG
+    {
+        CRMFEncryptedValue *dummy =
+            crmf_create_encrypted_value_wrapped_privkey(
+                inPrivKey, caPubKey, &encKey->value.encryptedValue);
+        PORT_Assert(dummy == &encKey->value.encryptedValue);
+    }
+#else
+    crmf_create_encrypted_value_wrapped_privkey(
+        inPrivKey, caPubKey, &encKey->value.encryptedValue);
+#endif
+    /* We won't add the der value here, but rather when it
+     * becomes part of a certificate request.
+     */
+    SECKEY_DestroyPublicKey(caPubKey);
+    encKey->encKeyChoice = crmfEncryptedValueChoice;
+    return encKey;
+loser:
+    if (encKey != NULL) {
+        CRMF_DestroyEncryptedKey(encKey);
+    }
+    if (caPubKey != NULL) {
+        SECKEY_DestroyPublicKey(caPubKey);
+    }
+    return NULL;
+}
+
+SECStatus
+CRMF_DestroyEncryptedKey(CRMFEncryptedKey *inEncrKey)
+{
+    return crmf_destroy_encrypted_key(inEncrKey, PR_TRUE);
+}
+
+SECStatus
+crmf_copy_pkiarchiveoptions(PLArenaPool *poolp,
+                            CRMFPKIArchiveOptions *destOpt,
+                            CRMFPKIArchiveOptions *srcOpt)
+{
+    SECStatus rv;
+    destOpt->archOption = srcOpt->archOption;
+    switch (srcOpt->archOption) {
+        case crmfEncryptedPrivateKey:
+            rv = crmf_copy_encryptedkey(poolp,
+                                        &srcOpt->option.encryptedKey,
+                                        &destOpt->option.encryptedKey);
+            break;
+        case crmfKeyGenParameters:
+        case crmfArchiveRemGenPrivKey:
+            /* We've got a union, so having a pointer to one is just
+             * like having a pointer to the other one.
+             */
+            rv = SECITEM_CopyItem(poolp,
+                                  &destOpt->option.keyGenParameters,
+                                  &srcOpt->option.keyGenParameters);
+            break;
+        default:
+            rv = SECFailure;
+    }
+    return rv;
+}
+
+static SECStatus
+crmf_check_and_adjust_archoption(CRMFControl *inControl)
+{
+    CRMFPKIArchiveOptions *options;
+
+    options = &inControl->value.archiveOptions;
+    if (options->archOption == crmfNoArchiveOptions) {
+        /* It hasn't been set, so figure it out from the
+         * der.
+         */
+        switch (inControl->derValue.data[0] & 0x0f) {
+            case 0:
+                options->archOption = crmfEncryptedPrivateKey;
+                break;
+            case 1:
+                options->archOption = crmfKeyGenParameters;
+                break;
+            case 2:
+                options->archOption = crmfArchiveRemGenPrivKey;
+                break;
+            default:
+                /* We've got bad DER.  Return an error. */
+                return SECFailure;
+        }
+    }
+    return SECSuccess;
+}
+
+static const SEC_ASN1Template *
+crmf_get_pkiarchive_subtemplate(CRMFControl *inControl)
+{
+    const SEC_ASN1Template *retTemplate;
+    SECStatus rv;
+    /*
+     * We could be in the process of decoding, in which case the
+     * archOption field will not be set.  Let's check it and set
+     * it accordingly.
+     */
+
+    rv = crmf_check_and_adjust_archoption(inControl);
+    if (rv != SECSuccess) {
+        return NULL;
+    }
+
+    switch (inControl->value.archiveOptions.archOption) {
+        case crmfEncryptedPrivateKey:
+            retTemplate = CRMFEncryptedKeyWithEncryptedValueTemplate;
+            inControl->value.archiveOptions.option.encryptedKey.encKeyChoice =
+                crmfEncryptedValueChoice;
+            break;
+        default:
+            retTemplate = NULL;
+    }
+    return retTemplate;
+}
+
+const SEC_ASN1Template *
+crmf_get_pkiarchiveoptions_subtemplate(CRMFControl *inControl)
+{
+    const SEC_ASN1Template *retTemplate;
+
+    switch (inControl->tag) {
+        case SEC_OID_PKIX_REGCTRL_REGTOKEN:
+        case SEC_OID_PKIX_REGCTRL_AUTHENTICATOR:
+            retTemplate = SEC_ASN1_GET(SEC_UTF8StringTemplate);
+            break;
+        case SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS:
+            retTemplate = crmf_get_pkiarchive_subtemplate(inControl);
+            break;
+        case SEC_OID_PKIX_REGCTRL_PKIPUBINFO:
+        case SEC_OID_PKIX_REGCTRL_OLD_CERT_ID:
+        case SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY:
+            /* We don't support these controls, so we fail for now.*/
+            retTemplate = NULL;
+            break;
+        default:
+            retTemplate = NULL;
+    }
+    return retTemplate;
+}
+
+static SECStatus
+crmf_encode_pkiarchiveoptions(PLArenaPool *poolp, CRMFControl *inControl)
+{
+    const SEC_ASN1Template *asn1Template;
+
+    asn1Template = crmf_get_pkiarchiveoptions_subtemplate(inControl);
+    /* We've got a union, so passing a pointer to one element of the
+     * union, is the same as passing a pointer to any of the other
+     * members of the union.
+     */
+    SEC_ASN1EncodeItem(poolp, &inControl->derValue,
+                       &inControl->value.archiveOptions, asn1Template);
+
+    if (inControl->derValue.data == NULL) {
+        goto loser;
+    }
+    return SECSuccess;
+loser:
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestSetPKIArchiveOptions(CRMFCertRequest *inCertReq,
+                                     CRMFPKIArchiveOptions *inOptions)
+{
+    CRMFControl *newControl;
+    PLArenaPool *poolp;
+    SECStatus rv;
+    void *mark;
+
+    PORT_Assert(inCertReq != NULL && inOptions != NULL);
+    if (inCertReq == NULL || inOptions == NULL) {
+        return SECFailure;
+    }
+    poolp = inCertReq->poolp;
+    mark = PORT_ArenaMark(poolp);
+    rv = crmf_add_new_control(inCertReq,
+                              SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS,
+                              &newControl);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_copy_pkiarchiveoptions(poolp,
+                                     &newControl->value.archiveOptions,
+                                     inOptions);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_encode_pkiarchiveoptions(poolp, newControl);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+static SECStatus
+crmf_destroy_control(CRMFControl *inControl, PRBool freeit)
+{
+    PORT_Assert(inControl != NULL);
+    if (inControl != NULL) {
+        SECITEM_FreeItem(&inControl->derTag, PR_FALSE);
+        SECITEM_FreeItem(&inControl->derValue, PR_FALSE);
+        /* None of the other tags require special processing at
+         * the moment when freeing because they are not supported,
+         * but if/when they are, add the necessary routines here.
+         * If all controls are supported, then every member of the
+         * union inControl->value will have a case that deals with
+         * it in the following switch statement.
+         */
+        switch (inControl->tag) {
+            case SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS:
+                crmf_destroy_pkiarchiveoptions(&inControl->value.archiveOptions,
+                                               PR_FALSE);
+                break;
+            default:
+                /* Put this here to get rid of all those annoying warnings.*/
+                break;
+        }
+        if (freeit) {
+            PORT_Free(inControl);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_DestroyControl(CRMFControl *inControl)
+{
+    return crmf_destroy_control(inControl, PR_TRUE);
+}
+
+static SECOidTag
+crmf_controltype_to_tag(CRMFControlType inControlType)
+{
+    SECOidTag retVal;
+
+    switch (inControlType) {
+        case crmfRegTokenControl:
+            retVal = SEC_OID_PKIX_REGCTRL_REGTOKEN;
+            break;
+        case crmfAuthenticatorControl:
+            retVal = SEC_OID_PKIX_REGCTRL_AUTHENTICATOR;
+            break;
+        case crmfPKIPublicationInfoControl:
+            retVal = SEC_OID_PKIX_REGCTRL_PKIPUBINFO;
+            break;
+        case crmfPKIArchiveOptionsControl:
+            retVal = SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS;
+            break;
+        case crmfOldCertIDControl:
+            retVal = SEC_OID_PKIX_REGCTRL_OLD_CERT_ID;
+            break;
+        case crmfProtocolEncrKeyControl:
+            retVal = SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY;
+            break;
+        default:
+            retVal = SEC_OID_UNKNOWN;
+            break;
+    }
+    return retVal;
+}
+
+PRBool
+CRMF_CertRequestIsControlPresent(CRMFCertRequest *inCertReq,
+                                 CRMFControlType inControlType)
+{
+    SECOidTag controlTag;
+    int i;
+
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL || inCertReq->controls == NULL) {
+        return PR_FALSE;
+    }
+    controlTag = crmf_controltype_to_tag(inControlType);
+    for (i = 0; inCertReq->controls[i] != NULL; i++) {
+        if (inCertReq->controls[i]->tag == controlTag) {
+            return PR_TRUE;
+        }
+    }
+    return PR_FALSE;
+}
diff --git a/security/nss/lib/crmf/crmfdec.c b/security/nss/lib/crmf/crmfdec.c
new file mode 100644
index 0000000000..ac6e872686
--- /dev/null
+++ b/security/nss/lib/crmf/crmfdec.c
@@ -0,0 +1,360 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "secitem.h"
+
+static CRMFPOPChoice
+crmf_get_popchoice_from_der(SECItem *derPOP)
+{
+    CRMFPOPChoice retChoice;
+
+    switch (derPOP->data[0] & 0x0f) {
+        case 0:
+            retChoice = crmfRAVerified;
+            break;
+        case 1:
+            retChoice = crmfSignature;
+            break;
+        case 2:
+            retChoice = crmfKeyEncipherment;
+            break;
+        case 3:
+            retChoice = crmfKeyAgreement;
+            break;
+        default:
+            retChoice = crmfNoPOPChoice;
+            break;
+    }
+    return retChoice;
+}
+
+static SECStatus
+crmf_decode_process_raverified(CRMFCertReqMsg *inCertReqMsg)
+{
+    CRMFProofOfPossession *pop;
+    /* Just set up the structure so that the message structure
+     * looks like one that was created using the API
+     */
+    pop = inCertReqMsg->pop;
+    pop->popChoice.raVerified.data = NULL;
+    pop->popChoice.raVerified.len = 0;
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_decode_process_signature(CRMFCertReqMsg *inCertReqMsg)
+{
+    PORT_Assert(inCertReqMsg->poolp);
+    if (!inCertReqMsg->poolp) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
+    }
+    return SEC_ASN1Decode(inCertReqMsg->poolp,
+                          &inCertReqMsg->pop->popChoice.signature,
+                          CRMFPOPOSigningKeyTemplate,
+                          (const char *)inCertReqMsg->derPOP.data,
+                          inCertReqMsg->derPOP.len);
+}
+
+static CRMFPOPOPrivKeyChoice
+crmf_get_messagechoice_from_der(SECItem *derPOP)
+{
+    CRMFPOPOPrivKeyChoice retChoice;
+
+    switch (derPOP->data[2] & 0x0f) {
+        case 0:
+            retChoice = crmfThisMessage;
+            break;
+        case 1:
+            retChoice = crmfSubsequentMessage;
+            break;
+        case 2:
+            retChoice = crmfDHMAC;
+            break;
+        default:
+            retChoice = crmfNoMessage;
+    }
+    return retChoice;
+}
+
+static SECStatus
+crmf_decode_process_popoprivkey(CRMFCertReqMsg *inCertReqMsg)
+{
+    /* We've got a union, so a pointer to one POPOPrivKey
+     * struct is the same as having a pointer to the other
+     * one.
+     */
+    CRMFPOPOPrivKey *popoPrivKey =
+        &inCertReqMsg->pop->popChoice.keyEncipherment;
+    SECItem *derPOP, privKeyDer;
+    SECStatus rv;
+
+    derPOP = &inCertReqMsg->derPOP;
+    popoPrivKey->messageChoice = crmf_get_messagechoice_from_der(derPOP);
+    if (popoPrivKey->messageChoice == crmfNoMessage) {
+        return SECFailure;
+    }
+    /* If we ever encounter BER encodings of this, we'll get in trouble*/
+    switch (popoPrivKey->messageChoice) {
+        case crmfThisMessage:
+        case crmfDHMAC:
+            privKeyDer.type = derPOP->type;
+            privKeyDer.data = &derPOP->data[5];
+            privKeyDer.len = derPOP->len - 5;
+            break;
+        case crmfSubsequentMessage:
+            privKeyDer.type = derPOP->type;
+            privKeyDer.data = &derPOP->data[4];
+            privKeyDer.len = derPOP->len - 4;
+            break;
+        default:
+            return SECFailure;
+    }
+
+    rv = SECITEM_CopyItem(inCertReqMsg->poolp,
+                          &popoPrivKey->message.subsequentMessage,
+                          &privKeyDer);
+
+    if (rv != SECSuccess) {
+        return rv;
+    }
+
+    if (popoPrivKey->messageChoice == crmfThisMessage ||
+        popoPrivKey->messageChoice == crmfDHMAC) {
+
+        popoPrivKey->message.thisMessage.len =
+            CRMF_BYTES_TO_BITS(privKeyDer.len) - (int)derPOP->data[4];
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_decode_process_keyagreement(CRMFCertReqMsg *inCertReqMsg)
+{
+    return crmf_decode_process_popoprivkey(inCertReqMsg);
+}
+
+static SECStatus
+crmf_decode_process_keyencipherment(CRMFCertReqMsg *inCertReqMsg)
+{
+    SECStatus rv;
+
+    rv = crmf_decode_process_popoprivkey(inCertReqMsg);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    if (inCertReqMsg->pop->popChoice.keyEncipherment.messageChoice ==
+        crmfDHMAC) {
+        /* Key Encipherment can not use the dhMAC option for
+         * POPOPrivKey.
+         */
+        return SECFailure;
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_decode_process_pop(CRMFCertReqMsg *inCertReqMsg)
+{
+    SECItem *derPOP;
+    PLArenaPool *poolp;
+    CRMFProofOfPossession *pop;
+    void *mark;
+    SECStatus rv;
+
+    derPOP = &inCertReqMsg->derPOP;
+    poolp = inCertReqMsg->poolp;
+    if (derPOP->data == NULL) {
+        /* There is no Proof of Possession field in this message. */
+        return SECSuccess;
+    }
+    mark = PORT_ArenaMark(poolp);
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+    pop->popUsed = crmf_get_popchoice_from_der(derPOP);
+    if (pop->popUsed == crmfNoPOPChoice) {
+        /* A bad encoding of CRMF.  Not a valid tag was given to the
+         * Proof Of Possession field.
+         */
+        goto loser;
+    }
+    inCertReqMsg->pop = pop;
+    switch (pop->popUsed) {
+        case crmfRAVerified:
+            rv = crmf_decode_process_raverified(inCertReqMsg);
+            break;
+        case crmfSignature:
+            rv = crmf_decode_process_signature(inCertReqMsg);
+            break;
+        case crmfKeyEncipherment:
+            rv = crmf_decode_process_keyencipherment(inCertReqMsg);
+            break;
+        case crmfKeyAgreement:
+            rv = crmf_decode_process_keyagreement(inCertReqMsg);
+            break;
+        default:
+            rv = SECFailure;
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    inCertReqMsg->pop = NULL;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_decode_process_single_control(PLArenaPool *poolp,
+                                   CRMFControl *inControl)
+{
+    const SEC_ASN1Template *asn1Template = NULL;
+
+    inControl->tag = SECOID_FindOIDTag(&inControl->derTag);
+    asn1Template = crmf_get_pkiarchiveoptions_subtemplate(inControl);
+
+    PORT_Assert(asn1Template != NULL);
+    PORT_Assert(poolp != NULL);
+    if (!asn1Template || !poolp) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
+    }
+    /* We've got a union, so passing a pointer to one element of the
+     * union is the same as passing a pointer to any of the other
+     * members of the union.
+     */
+    return SEC_ASN1Decode(poolp, &inControl->value.archiveOptions,
+                          asn1Template, (const char *)inControl->derValue.data,
+                          inControl->derValue.len);
+}
+
+static SECStatus
+crmf_decode_process_controls(CRMFCertReqMsg *inCertReqMsg)
+{
+    int i, numControls;
+    SECStatus rv;
+    PLArenaPool *poolp;
+    CRMFControl **controls;
+
+    numControls = CRMF_CertRequestGetNumControls(inCertReqMsg->certReq);
+    controls = inCertReqMsg->certReq->controls;
+    poolp = inCertReqMsg->poolp;
+    for (i = 0; i < numControls; i++) {
+        rv = crmf_decode_process_single_control(poolp, controls[i]);
+        if (rv != SECSuccess) {
+            return SECFailure;
+        }
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_decode_process_single_reqmsg(CRMFCertReqMsg *inCertReqMsg)
+{
+    SECStatus rv;
+
+    rv = crmf_decode_process_pop(inCertReqMsg);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_decode_process_controls(inCertReqMsg);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    inCertReqMsg->certReq->certTemplate.numExtensions =
+        CRMF_CertRequestGetNumberOfExtensions(inCertReqMsg->certReq);
+    inCertReqMsg->isDecoded = PR_TRUE;
+    rv = SECSuccess;
+loser:
+    return rv;
+}
+
+CRMFCertReqMsg *
+CRMF_CreateCertReqMsgFromDER(const char *buf, long len)
+{
+    PLArenaPool *poolp;
+    CRMFCertReqMsg *certReqMsg;
+    SECStatus rv;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+    certReqMsg = PORT_ArenaZNew(poolp, CRMFCertReqMsg);
+    if (certReqMsg == NULL) {
+        goto loser;
+    }
+    certReqMsg->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, certReqMsg, CRMFCertReqMsgTemplate, buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_decode_process_single_reqmsg(certReqMsg);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    return certReqMsg;
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+CRMFCertReqMessages *
+CRMF_CreateCertReqMessagesFromDER(const char *buf, long len)
+{
+    long arenaSize;
+    int i;
+    SECStatus rv;
+    PLArenaPool *poolp;
+    CRMFCertReqMessages *certReqMsgs;
+
+    PORT_Assert(buf != NULL);
+    /* Wanna make sure the arena is big enough to store all of the requests
+     * coming in.  We'll guestimate according to the length of the buffer.
+     */
+    arenaSize = len + len / 2;
+    poolp = PORT_NewArena(arenaSize);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    certReqMsgs = PORT_ArenaZNew(poolp, CRMFCertReqMessages);
+    if (certReqMsgs == NULL) {
+        goto loser;
+    }
+    certReqMsgs->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, certReqMsgs, CRMFCertReqMessagesTemplate,
+                        buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    for (i = 0; certReqMsgs->messages[i] != NULL; i++) {
+        /* The sub-routines expect the individual messages to have
+         * an arena.  We'll give them one temporarily.
+         */
+        certReqMsgs->messages[i]->poolp = poolp;
+        rv = crmf_decode_process_single_reqmsg(certReqMsgs->messages[i]);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+        certReqMsgs->messages[i]->poolp = NULL;
+    }
+    return certReqMsgs;
+
+loser:
+    PORT_FreeArena(poolp, PR_FALSE);
+    return NULL;
+}
diff --git a/security/nss/lib/crmf/crmfenc.c b/security/nss/lib/crmf/crmfenc.c
new file mode 100644
index 0000000000..6d01a45cea
--- /dev/null
+++ b/security/nss/lib/crmf/crmfenc.c
@@ -0,0 +1,48 @@
+/* -*- Mode: C; tab-width: 8 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+
+SECStatus
+CRMF_EncodeCertReqMsg(CRMFCertReqMsg *inCertReqMsg,
+                      CRMFEncoderOutputCallback fn,
+                      void *arg)
+{
+    struct crmfEncoderOutput output;
+
+    output.fn = fn;
+    output.outputArg = arg;
+    return SEC_ASN1Encode(inCertReqMsg, CRMFCertReqMsgTemplate,
+                          crmf_encoder_out, &output);
+}
+
+SECStatus
+CRMF_EncodeCertRequest(CRMFCertRequest *inCertReq,
+                       CRMFEncoderOutputCallback fn,
+                       void *arg)
+{
+    struct crmfEncoderOutput output;
+
+    output.fn = fn;
+    output.outputArg = arg;
+    return SEC_ASN1Encode(inCertReq, CRMFCertRequestTemplate,
+                          crmf_encoder_out, &output);
+}
+
+SECStatus
+CRMF_EncodeCertReqMessages(CRMFCertReqMsg **inCertReqMsgs,
+                           CRMFEncoderOutputCallback fn,
+                           void *arg)
+{
+    struct crmfEncoderOutput output;
+    CRMFCertReqMessages msgs;
+
+    output.fn = fn;
+    output.outputArg = arg;
+    msgs.messages = inCertReqMsgs;
+    return SEC_ASN1Encode(&msgs, CRMFCertReqMessagesTemplate,
+                          crmf_encoder_out, &output);
+}
diff --git a/security/nss/lib/crmf/crmffut.h b/security/nss/lib/crmf/crmffut.h
new file mode 100644
index 0000000000..d6f9374384
--- /dev/null
+++ b/security/nss/lib/crmf/crmffut.h
@@ -0,0 +1,357 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * These functions to be implemented in the future if the features
+ * which these functions would implement wind up being needed.
+ */
+
+/*
+ * Use this function to create the CRMFSinglePubInfo* variables that will
+ * populate the inPubInfoArray parameter for the function
+ * CRMF_CreatePKIPublicationInfo.
+ *
+ * "inPubMethod" specifies which publication method will be used
+ * "pubLocation" is a representation of the location where
+ */
+extern CRMFSinglePubInfo *
+CRMF_CreateSinglePubInfo(CRMFPublicationMethod inPubMethod,
+                         CRMFGeneralName *pubLocation);
+
+/*
+ * Create a PKIPublicationInfo that can later be passed to the function
+ * CRMFAddPubInfoControl.
+ */
+extern CRMFPKIPublicationInfo *
+CRMF_CreatePKIPublicationInfo(CRMFPublicationAction inAction,
+                              CRMFSinglePubInfo **inPubInfoArray,
+                              int numPubInfo);
+
+/*
+ * Only call this function on a CRMFPublicationInfo that was created by
+ * CRMF_CreatePKIPublicationInfo that was passed in NULL for arena.
+ */
+
+extern SECStatus
+CRMF_DestroyPKIPublicationInfo(CRMFPKIPublicationInfo *inPubInfo);
+
+extern SECStatus CRMF_AddPubInfoControl(CRMFCertRequest *inCertReq,
+                                        CRMFPKIPublicationInfo *inPubInfo);
+
+/*
+ * This is to create a Cert ID Control which can later be added to
+ * a certificate request.
+ */
+extern CRMFCertID *CRMF_CreateCertID(CRMFGeneralName *issuer,
+                                     long serialNumber);
+
+extern SECStatus CRMF_DestroyCertID(CRMFCertID *certID);
+
+extern SECStatus CRMF_AddCertIDControl(CRMFCertRequest *inCertReq,
+                                       CRMFCertID *certID);
+
+extern SECStatus
+CRMF_AddProtocolEncryptioKeyControl(CRMFCertRequest *inCertReq,
+                                    CERTSubjectPublicKeyInfo *spki);
+
+/*
+ * Add the ASCII Pairs Registration Info to the Certificate Request.
+ * The SECItem must be an OCTET string representation.
+ */
+extern SECStatus
+CRMF_AddUTF8PairsRegInfo(CRMFCertRequest *inCertReq,
+                         SECItem *asciiPairs);
+
+/*
+ * This takes a CertRequest and adds it to another CertRequest.
+ */
+extern SECStatus
+CRMF_AddCertReqToRegInfo(CRMFCertRequest *certReqToAddTo,
+                         CRMFCertRequest *certReqBeingAdded);
+
+/*
+ * Returns which option was used for the authInfo field of POPOSigningKeyInput
+ */
+extern CRMFPOPOSkiInputAuthChoice
+CRMF_GetSignKeyInputAuthChoice(CRMFPOPOSigningKeyInput *inKeyInput);
+
+/*
+ * Gets the PKMACValue associated with the POPOSigningKeyInput.
+ * If the POPOSigningKeyInput did not use authInfo.publicKeyMAC
+ * the function returns SECFailure and the value at *destValue is unchanged.
+ *
+ * If the POPOSigningKeyInput did use authInfo.publicKeyMAC, the function
+ * returns SECSuccess and places the PKMACValue at *destValue.
+ */
+extern SECStatus
+CRMF_GetSignKeyInputPKMACValue(CRMFPOPOSigningKeyInput *inKeyInput,
+                               CRMFPKMACValue **destValue);
+/*
+ * Gets the SubjectPublicKeyInfo from the POPOSigningKeyInput
+ */
+extern CERTSubjectPublicKeyInfo *
+CRMF_GetSignKeyInputPublicKey(CRMFPOPOSigningKeyInput *inKeyInput);
+
+/*
+ * Return the value for the PKIPublicationInfo Control.
+ * A return value of NULL indicates that the Control was
+ * not a PKIPublicationInfo Control.  Call
+ * CRMF_DestroyPKIPublicationInfo on the return value when done
+ * using the pointer.
+ */
+extern CRMFPKIPublicationInfo *CRMF_GetPKIPubInfo(CRMFControl *inControl);
+
+/*
+ * Free up a CRMFPKIPublicationInfo structure.
+ */
+extern SECStatus
+CRMF_DestroyPKIPublicationInfo(CRMFPKIPublicationInfo *inPubInfo);
+
+/*
+ * Get the choice used for action in this PKIPublicationInfo.
+ */
+extern CRMFPublicationAction
+CRMF_GetPublicationAction(CRMFPKIPublicationInfo *inPubInfo);
+
+/*
+ * Get the number of pubInfos are stored in the PKIPubicationInfo.
+ */
+extern int CRMF_GetNumPubInfos(CRMFPKIPublicationInfo *inPubInfo);
+
+/*
+ * Get the pubInfo at index for the given PKIPubicationInfo.
+ * Indexing is done like a traditional C Array. (0 .. numElements-1)
+ */
+extern CRMFSinglePubInfo *
+CRMF_GetPubInfoAtIndex(CRMFPKIPublicationInfo *inPubInfo,
+                       int index);
+
+/*
+ * Destroy the CRMFSinglePubInfo.
+ */
+extern SECStatus CRMF_DestroySinglePubInfo(CRMFSinglePubInfo *inPubInfo);
+
+/*
+ * Get the pubMethod used by the SinglePubInfo.
+ */
+extern CRMFPublicationMethod
+CRMF_GetPublicationMethod(CRMFSinglePubInfo *inPubInfo);
+
+/*
+ * Get the pubLocation associated with the SinglePubInfo.
+ * A NULL return value indicates there was no pubLocation associated
+ * with the SinglePuInfo.
+ */
+extern CRMFGeneralName *CRMF_GetPubLocation(CRMFSinglePubInfo *inPubInfo);
+
+/*
+ * Get the authInfo.sender field out of the POPOSigningKeyInput.
+ * If the POPOSigningKeyInput did not use the authInfo the function
+ * returns SECFailure and the value at *destName is unchanged.
+ *
+ * If the POPOSigningKeyInput did use authInfo.sender, the function returns
+ * SECSuccess and puts the authInfo.sender at *destName/
+ */
+extern SECStatus CRMF_GetSignKeyInputSender(CRMFPOPOSigningKeyInput *keyInput,
+                                            CRMFGeneralName **destName);
+
+/**************** CMMF Functions that need to be added. **********************/
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentSetNextChallenge
+ * INPUTS:
+ *    inDecKeyChall
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ *    inRandom
+ *        The random number to use when generating the challenge,
+ *    inSender
+ *        The GeneralName representation of the sender of the challenge.
+ *    inPubKey
+ *        The public key to use when encrypting the challenge.
+ * NOTES:
+ *    This function adds a challenge to the end of the list of challenges
+ *    contained by 'inDecKeyChall'.  Refer to the CMMF draft on how the
+ *    the random number passed in and the sender's GeneralName are used
+ *    to generate the challenge and witness fields of the challenge.  This
+ *    library will use SHA1 as the one-way function for generating the
+ *    witess field of the challenge.
+ *
+ * RETURN:
+ *    SECSuccess if generating the challenge and adding to the end of list
+ *    of challenges was successful.  Any other return value indicates an error
+ *    while trying to generate the challenge.
+ */
+extern SECStatus
+CMMF_POPODecKeyChallContentSetNextChallenge(CMMFPOPODecKeyChallContent *inDecKeyChall,
+                                            long inRandom,
+                                            CERTGeneralName *inSender,
+                                            SECKEYPublicKey *inPubKey);
+
+/*
+ * FUNCTION: CMMF_POPODecKeyChallContentGetNumChallenges
+ * INPUTS:
+ *    inKeyChallCont
+ *        The CMMFPOPODecKeyChallContent to operate on.
+ * RETURN:
+ *    This function returns the number of CMMFChallenges are contained in
+ *    the CMMFPOPODecKeyChallContent structure.
+ */
+extern int CMMF_POPODecKeyChallContentGetNumChallenges(CMMFPOPODecKeyChallContent *inKeyChallCont);
+
+/*
+ * FUNCTION: CMMF_ChallengeGetRandomNumber
+ * INPUTS:
+ *    inChallenge
+ *        The CMMFChallenge to operate on.
+ *    inDest
+ *        A pointer to a user supplied buffer where the library
+ *        can place a copy of the random integer contatained in the
+ *        challenge.
+ * NOTES:
+ *    This function returns the value held in the decrypted Rand structure
+ *    corresponding to the random integer.  The user must call
+ *    CMMF_ChallengeDecryptWitness before calling this function.  Call
+ *    CMMF_ChallengeIsDecrypted to find out if the challenge has been
+ *    decrypted.
+ *
+ * RETURN:
+ *    SECSuccess indicates the witness field has been previously decrypted
+ *    and the value for the random integer was successfully placed at *inDest.
+ *    Any other return value indicates an error and that the value at *inDest
+ *    is not a valid value.
+ */
+extern SECStatus CMMF_ChallengeGetRandomNumber(CMMFChallenge *inChallenge,
+                                               long *inDest);
+
+/*
+ * FUNCTION: CMMF_ChallengeGetSender
+ * INPUTS:
+ *    inChallenge
+ *        the CMMFChallenge to operate on.
+ * NOTES:
+ *    This function returns the value held in the decrypted Rand structure
+ *    corresponding to the sender.  The user must call
+ *    CMMF_ChallengeDecryptWitness before calling this function.  Call
+ *    CMMF_ChallengeIsDecrypted to find out if the witness field has been
+ *    decrypted.  The user must call CERT_DestroyGeneralName after the return
+ *    value is no longer needed.
+ *
+ * RETURN:
+ *    A pointer to a copy of the sender CERTGeneralName.  A return value of
+ *    NULL indicates an error in trying to copy the information or that the
+ *    witness field has not been decrypted.
+ */
+extern CERTGeneralName *CMMF_ChallengeGetSender(CMMFChallenge *inChallenge);
+
+/*
+ * FUNCTION: CMMF_ChallengeGetAlgId
+ * INPUTS:
+ *    inChallenge
+ *        The CMMFChallenge to operate on.
+ *    inDestAlgId
+ *        A pointer to memory where a pointer to a copy of the algorithm
+ *        id can be placed.
+ * NOTES:
+ *    This function retrieves the one way function algorithm identifier
+ *    contained within the CMMFChallenge if the optional field is present.
+ *
+ * RETURN:
+ *    SECSucces indicates the function was able to place a pointer to a copy of
+ *    the alogrithm id at *inAlgId.  If the value at *inDestAlgId is NULL,
+ *    that means there was no algorithm identifier present in the
+ *    CMMFChallenge.  Any other return value indicates the function was not
+ *    able to make a copy of the algorithm identifier.  In this case the value
+ *    at *inDestAlgId is not valid.
+ */
+extern SECStatus CMMF_ChallengeGetAlgId(CMMFChallenge *inChallenge,
+                                        SECAlgorithmID *inAlgId);
+
+/*
+ * FUNCTION: CMMF_DestroyChallenge
+ * INPUTS:
+ *    inChallenge
+ *        The CMMFChallenge to free up.
+ * NOTES:
+ *    This function frees up all the memory associated with the CMMFChallenge
+ *    passed in.
+ * RETURN:
+ *    SECSuccess if freeing all the memory associated with the CMMFChallenge
+ *    passed in is successful.  Any other return value indicates an error
+ *    while freeing the memory.
+ */
+extern SECStatus CMMF_DestroyChallenge(CMMFChallenge *inChallenge);
+
+/*
+ * FUNCTION: CMMF_DestroyPOPODecKeyRespContent
+ * INPUTS:
+ *    inDecKeyResp
+ *        The CMMFPOPODecKeyRespContent structure to free.
+ * NOTES:
+ *    This function frees up all the memory associate with the
+ *    CMMFPOPODecKeyRespContent.
+ *
+ * RETURN:
+ *    SECSuccess if freeint up all the memory associated with the
+ *    CMMFPOPODecKeyRespContent structure is successful.  Any other
+ *    return value indicates an error while freeing the memory.
+ */
+extern SECStatus
+CMMF_DestroyPOPODecKeyRespContent(CMMFPOPODecKeyRespContent *inDecKeyResp);
+
+/*
+ * FUNCTION: CMMF_ChallengeDecryptWitness
+ * INPUTS:
+ *    inChallenge
+ *        The CMMFChallenge to operate on.
+ *    inPrivKey
+ *        The private key to use to decrypt the witness field.
+ * NOTES:
+ *    This function uses the private key to decrypt the challenge field
+ *    contained in the CMMFChallenge.  Make sure the private key matches the
+ *    public key that was used to encrypt the witness.  The creator of
+ *    the challenge will most likely be an RA that has the public key
+ *    from a Cert request.  So the private key should be the private key
+ *    associated with public key in that request.  This function will also
+ *    verify the witness field of the challenge.
+ *
+ * RETURN:
+ *    SECSuccess if decrypting the witness field was successful.  This does
+ *    not indicate that the decrypted data is valid, since the private key
+ *    passed in may not be the actual key needed to properly decrypt the
+ *    witness field.  Meaning that there is a decrypted structure now, but
+ *    may be garbage because the private key was incorrect.
+ *    Any other return value indicates the function could not complete the
+ *    decryption process.
+ */
+extern SECStatus CMMF_ChallengeDecryptWitness(CMMFChallenge *inChallenge,
+                                              SECKEYPrivateKey *inPrivKey);
+
+/*
+ * FUNCTION: CMMF_ChallengeIsDecrypted
+ * INPUTS:
+ *    inChallenge
+ *        The CMMFChallenge to operate on.
+ * RETURN:
+ *    This is a predicate function that returns PR_TRUE if the decryption
+ *    process has already been performed.  The function return PR_FALSE if
+ *    the decryption process has not been performed yet.
+ */
+extern PRBool CMMF_ChallengeIsDecrypted(CMMFChallenge *inChallenge);
+
+/*
+ * FUNCTION: CMMF_DestroyPOPODecKeyChallContent
+ * INPUTS:
+ *    inDecKeyCont
+ *        The CMMFPOPODecKeyChallContent to free
+ * NOTES:
+ *    This function frees up all the memory associated with the
+ *    CMMFPOPODecKeyChallContent
+ * RETURN:
+ *    SECSuccess if freeing up all the memory associatd with the
+ *    CMMFPOPODecKeyChallContent is successful.  Any other return value
+ *    indicates an error while freeing the memory.
+ *
+ */
+extern SECStatus
+CMMF_DestroyPOPODecKeyChallContent(CMMFPOPODecKeyChallContent *inDecKeyCont);
diff --git a/security/nss/lib/crmf/crmfget.c b/security/nss/lib/crmf/crmfget.c
new file mode 100644
index 0000000000..5c1d2aa192
--- /dev/null
+++ b/security/nss/lib/crmf/crmfget.c
@@ -0,0 +1,443 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "keyhi.h"
+#include "secder.h"
+
+CRMFPOPChoice
+CRMF_CertReqMsgGetPOPType(CRMFCertReqMsg *inCertReqMsg)
+{
+    PORT_Assert(inCertReqMsg != NULL);
+    if (inCertReqMsg != NULL && inCertReqMsg->pop != NULL) {
+        return inCertReqMsg->pop->popUsed;
+    }
+    return crmfNoPOPChoice;
+}
+
+static SECStatus
+crmf_destroy_validity(CRMFOptionalValidity *inValidity, PRBool freeit)
+{
+    if (inValidity != NULL) {
+        if (inValidity->notBefore.data != NULL) {
+            PORT_Free(inValidity->notBefore.data);
+        }
+        if (inValidity->notAfter.data != NULL) {
+            PORT_Free(inValidity->notAfter.data);
+        }
+        if (freeit) {
+            PORT_Free(inValidity);
+        }
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_copy_cert_request_validity(PLArenaPool *poolp,
+                                CRMFOptionalValidity **destValidity,
+                                CRMFOptionalValidity *srcValidity)
+{
+    CRMFOptionalValidity *myValidity = NULL;
+    SECStatus rv;
+
+    *destValidity = myValidity = (poolp == NULL) ? PORT_ZNew(CRMFOptionalValidity)
+                                                 : PORT_ArenaZNew(poolp, CRMFOptionalValidity);
+    if (myValidity == NULL) {
+        goto loser;
+    }
+    if (srcValidity->notBefore.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &myValidity->notBefore,
+                              &srcValidity->notBefore);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcValidity->notAfter.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &myValidity->notAfter,
+                              &srcValidity->notAfter);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    return SECSuccess;
+loser:
+    if (myValidity != NULL && poolp == NULL) {
+        crmf_destroy_validity(myValidity, PR_TRUE);
+    }
+    return SECFailure;
+}
+
+static SECStatus
+crmf_copy_extensions(PLArenaPool *poolp,
+                     CRMFCertTemplate *destTemplate,
+                     CRMFCertExtension **srcExt)
+{
+    int numExt = 0, i;
+    CRMFCertExtension **myExtArray = NULL;
+
+    while (srcExt[numExt] != NULL) {
+        numExt++;
+    }
+    if (numExt == 0) {
+        /*No extensions to copy.*/
+        destTemplate->extensions = NULL;
+        destTemplate->numExtensions = 0;
+        return SECSuccess;
+    }
+    destTemplate->extensions = myExtArray =
+        PORT_NewArray(CRMFCertExtension *, numExt + 1);
+    if (myExtArray == NULL) {
+        goto loser;
+    }
+
+    for (i = 0; i < numExt; i++) {
+        myExtArray[i] = crmf_copy_cert_extension(poolp, srcExt[i]);
+        if (myExtArray[i] == NULL) {
+            goto loser;
+        }
+    }
+    destTemplate->numExtensions = numExt;
+    myExtArray[numExt] = NULL;
+    return SECSuccess;
+loser:
+    if (myExtArray != NULL) {
+        if (poolp == NULL) {
+            for (i = 0; myExtArray[i] != NULL; i++) {
+                CRMF_DestroyCertExtension(myExtArray[i]);
+            }
+        }
+        PORT_Free(myExtArray);
+    }
+    destTemplate->extensions = NULL;
+    destTemplate->numExtensions = 0;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_copy_cert_request_template(PLArenaPool *poolp,
+                                CRMFCertTemplate *destTemplate,
+                                CRMFCertTemplate *srcTemplate)
+{
+    SECStatus rv;
+
+    if (srcTemplate->version.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &destTemplate->version,
+                              &srcTemplate->version);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->serialNumber.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &destTemplate->serialNumber,
+                              &srcTemplate->serialNumber);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->signingAlg != NULL) {
+        rv = crmf_template_copy_secalg(poolp, &destTemplate->signingAlg,
+                                       srcTemplate->signingAlg);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->issuer != NULL) {
+        rv = crmf_copy_cert_name(poolp, &destTemplate->issuer,
+                                 srcTemplate->issuer);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->validity != NULL) {
+        rv = crmf_copy_cert_request_validity(poolp, &destTemplate->validity,
+                                             srcTemplate->validity);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->subject != NULL) {
+        rv = crmf_copy_cert_name(poolp, &destTemplate->subject,
+                                 srcTemplate->subject);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->publicKey != NULL) {
+        rv = crmf_template_add_public_key(poolp, &destTemplate->publicKey,
+                                          srcTemplate->publicKey);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->issuerUID.data != NULL) {
+        rv = crmf_make_bitstring_copy(poolp, &destTemplate->issuerUID,
+                                      &srcTemplate->issuerUID);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->subjectUID.data != NULL) {
+        rv = crmf_make_bitstring_copy(poolp, &destTemplate->subjectUID,
+                                      &srcTemplate->subjectUID);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (srcTemplate->extensions != NULL) {
+        rv = crmf_copy_extensions(poolp, destTemplate,
+                                  srcTemplate->extensions);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    return SECSuccess;
+loser:
+    return SECFailure;
+}
+
+static CRMFControl *
+crmf_copy_control(PLArenaPool *poolp, CRMFControl *srcControl)
+{
+    CRMFControl *newControl;
+    SECStatus rv;
+
+    newControl = (poolp == NULL) ? PORT_ZNew(CRMFControl) : PORT_ArenaZNew(poolp, CRMFControl);
+    if (newControl == NULL) {
+        goto loser;
+    }
+    newControl->tag = srcControl->tag;
+    rv = SECITEM_CopyItem(poolp, &newControl->derTag, &srcControl->derTag);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SECITEM_CopyItem(poolp, &newControl->derValue, &srcControl->derValue);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    /* We only handle PKIArchiveOptions Control right now.  But if in
+     * the future, more controls that are part of the union are added,
+     * then they need to be handled here as well.
+     */
+    switch (newControl->tag) {
+        case SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS:
+            rv = crmf_copy_pkiarchiveoptions(poolp,
+                                             &newControl->value.archiveOptions,
+                                             &srcControl->value.archiveOptions);
+            break;
+        default:
+            rv = SECSuccess;
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newControl;
+
+loser:
+    if (poolp == NULL && newControl != NULL) {
+        CRMF_DestroyControl(newControl);
+    }
+    return NULL;
+}
+
+static SECStatus
+crmf_copy_cert_request_controls(PLArenaPool *poolp,
+                                CRMFCertRequest *destReq,
+                                CRMFCertRequest *srcReq)
+{
+    int numControls, i;
+    CRMFControl **myControls = NULL;
+
+    numControls = CRMF_CertRequestGetNumControls(srcReq);
+    if (numControls == 0) {
+        /* No Controls To Copy*/
+        return SECSuccess;
+    }
+    myControls = destReq->controls = PORT_NewArray(CRMFControl *,
+                                                   numControls + 1);
+    if (myControls == NULL) {
+        goto loser;
+    }
+    for (i = 0; i < numControls; i++) {
+        myControls[i] = crmf_copy_control(poolp, srcReq->controls[i]);
+        if (myControls[i] == NULL) {
+            goto loser;
+        }
+    }
+    myControls[numControls] = NULL;
+    return SECSuccess;
+loser:
+    if (myControls != NULL) {
+        if (poolp == NULL) {
+            for (i = 0; myControls[i] != NULL; i++) {
+                CRMF_DestroyControl(myControls[i]);
+            }
+        }
+        PORT_Free(myControls);
+    }
+    return SECFailure;
+}
+
+CRMFCertRequest *
+crmf_copy_cert_request(PLArenaPool *poolp, CRMFCertRequest *srcReq)
+{
+    CRMFCertRequest *newReq = NULL;
+    SECStatus rv;
+
+    if (srcReq == NULL) {
+        return NULL;
+    }
+    newReq = (poolp == NULL) ? PORT_ZNew(CRMFCertRequest) : PORT_ArenaZNew(poolp, CRMFCertRequest);
+    if (newReq == NULL) {
+        goto loser;
+    }
+    rv = SECITEM_CopyItem(poolp, &newReq->certReqId, &srcReq->certReqId);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = crmf_copy_cert_request_template(poolp, &newReq->certTemplate,
+                                         &srcReq->certTemplate);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = crmf_copy_cert_request_controls(poolp, newReq, srcReq);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newReq;
+loser:
+    if (newReq != NULL && poolp == NULL) {
+        CRMF_DestroyCertRequest(newReq);
+        PORT_Free(newReq);
+    }
+    return NULL;
+}
+
+SECStatus
+CRMF_DestroyGetValidity(CRMFGetValidity *inValidity)
+{
+    PORT_Assert(inValidity != NULL);
+    if (inValidity != NULL) {
+        if (inValidity->notAfter) {
+            PORT_Free(inValidity->notAfter);
+            inValidity->notAfter = NULL;
+        }
+        if (inValidity->notBefore) {
+            PORT_Free(inValidity->notBefore);
+            inValidity->notBefore = NULL;
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+crmf_make_bitstring_copy(PLArenaPool *arena, SECItem *dest, SECItem *src)
+{
+    int origLenBits;
+    int bytesToCopy;
+    SECStatus rv;
+
+    origLenBits = src->len;
+    bytesToCopy = CRMF_BITS_TO_BYTES(origLenBits);
+    src->len = bytesToCopy;
+    rv = SECITEM_CopyItem(arena, dest, src);
+    src->len = origLenBits;
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    dest->len = origLenBits;
+    return SECSuccess;
+}
+
+int
+CRMF_CertRequestGetNumberOfExtensions(CRMFCertRequest *inCertReq)
+{
+    CRMFCertTemplate *certTemplate;
+    int count = 0;
+
+    certTemplate = &inCertReq->certTemplate;
+    if (certTemplate->extensions) {
+        while (certTemplate->extensions[count] != NULL)
+            count++;
+    }
+    return count;
+}
+
+SECOidTag
+CRMF_CertExtensionGetOidTag(CRMFCertExtension *inExtension)
+{
+    PORT_Assert(inExtension != NULL);
+    if (inExtension == NULL) {
+        return SEC_OID_UNKNOWN;
+    }
+    return SECOID_FindOIDTag(&inExtension->id);
+}
+
+PRBool
+CRMF_CertExtensionGetIsCritical(CRMFCertExtension *inExt)
+{
+    PORT_Assert(inExt != NULL);
+    if (inExt == NULL) {
+        return PR_FALSE;
+    }
+    return inExt->critical.data != NULL;
+}
+
+SECItem *
+CRMF_CertExtensionGetValue(CRMFCertExtension *inExtension)
+{
+    PORT_Assert(inExtension != NULL);
+    if (inExtension == NULL) {
+        return NULL;
+    }
+
+    return SECITEM_DupItem(&inExtension->value);
+}
+
+SECStatus
+CRMF_DestroyPOPOSigningKey(CRMFPOPOSigningKey *inKey)
+{
+    PORT_Assert(inKey != NULL);
+    if (inKey != NULL) {
+        if (inKey->derInput.data != NULL) {
+            SECITEM_FreeItem(&inKey->derInput, PR_FALSE);
+        }
+        if (inKey->algorithmIdentifier != NULL) {
+            SECOID_DestroyAlgorithmID(inKey->algorithmIdentifier, PR_TRUE);
+        }
+        if (inKey->signature.data != NULL) {
+            SECITEM_FreeItem(&inKey->signature, PR_FALSE);
+        }
+        PORT_Free(inKey);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_DestroyPOPOPrivKey(CRMFPOPOPrivKey *inPrivKey)
+{
+    PORT_Assert(inPrivKey != NULL);
+    if (inPrivKey != NULL) {
+        SECITEM_FreeItem(&inPrivKey->message.thisMessage, PR_FALSE);
+        PORT_Free(inPrivKey);
+    }
+    return SECSuccess;
+}
+
+int
+CRMF_CertRequestGetNumControls(CRMFCertRequest *inCertReq)
+{
+    int count = 0;
+
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return 0;
+    }
+    if (inCertReq->controls) {
+        while (inCertReq->controls[count] != NULL)
+            count++;
+    }
+    return count;
+}
diff --git a/security/nss/lib/crmf/crmfi.h b/security/nss/lib/crmf/crmfi.h
new file mode 100644
index 0000000000..badfd2b053
--- /dev/null
+++ b/security/nss/lib/crmf/crmfi.h
@@ -0,0 +1,185 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CRMFI_H_
+#define _CRMFI_H_
+/* This file will contain all declarations common to both
+ * encoding and decoding of CRMF Cert Requests.  This header
+ * file should only be included internally by CRMF implementation
+ * files.
+ */
+#include "secasn1.h"
+#include "crmfit.h"
+#include "secerr.h"
+#include "blapit.h"
+
+#define CRMF_DEFAULT_ARENA_SIZE 1024
+
+/*
+ * Explanation for the definition of MAX_WRAPPED_KEY_LEN:
+ *
+ * It's used for internal buffers to transport a wrapped private key.
+ * The value is in BYTES.
+ * We want to define a reasonable upper bound for this value.
+ * Ideally this could be calculated, but in order to simplify the code
+ * we want to estimate the maximum requires size.
+ * See also bug 655850 for the full explanation.
+ *
+ * We know the largest wrapped keys are RSA keys.
+ * We'll estimate the maximum size needed for wrapped RSA keys,
+ * and assume it's sufficient for wrapped keys of any type we support.
+ *
+ * The maximum size of RSA keys in bits is defined elsewhere as
+ *   RSA_MAX_MODULUS_BITS
+ *
+ * The idea is to define MAX_WRAPPED_KEY_LEN based on the above.
+ *
+ * A wrapped RSA key requires about
+ *   ( ( RSA_MAX_MODULUS_BITS / 8 ) * 5.5) + 65
+ * bytes.
+ *
+ * Therefore, a safe upper bound is:
+ *   ( ( RSA_MAX_MODULUS_BITS / 8 ) *8 ) = RSA_MAX_MODULUS_BITS
+ *
+ */
+#define MAX_WRAPPED_KEY_LEN RSA_MAX_MODULUS_BITS
+
+#define CRMF_BITS_TO_BYTES(bits) (((bits) + 7) / 8)
+#define CRMF_BYTES_TO_BITS(bytes) ((bytes)*8)
+
+struct crmfEncoderArg {
+    SECItem *buffer;
+    unsigned long allocatedLen;
+};
+
+struct crmfEncoderOutput {
+    CRMFEncoderOutputCallback fn;
+    void *outputArg;
+};
+
+/*
+ * This function is used by the API for encoding functions that are
+ * exposed through the API, ie all of the CMMF_Encode* and CRMF_Encode*
+ * functions.
+ */
+extern void
+crmf_encoder_out(void *arg, const char *buf, unsigned long len,
+                 int depth, SEC_ASN1EncodingPart data_kind);
+
+/*
+ * This function is used when we want to encode something locally within
+ * the library, ie the CertRequest so that we can produce its signature.
+ */
+extern SECStatus
+crmf_init_encoder_callback_arg(struct crmfEncoderArg *encoderArg,
+                               SECItem *derDest);
+
+/*
+ * This is the callback function we feed to the ASN1 encoder when doing
+ * internal DER-encodings.  ie, encoding the cert request so we can
+ * produce a signature.
+ */
+extern void
+crmf_generic_encoder_callback(void *arg, const char *buf, unsigned long len,
+                              int depth, SEC_ASN1EncodingPart data_kind);
+
+/* The ASN1 templates that need to be seen by internal files
+ * in order to implement CRMF.
+ */
+extern const SEC_ASN1Template CRMFCertReqMsgTemplate[];
+extern const SEC_ASN1Template CRMFRAVerifiedTemplate[];
+extern const SEC_ASN1Template CRMFPOPOSigningKeyTemplate[];
+extern const SEC_ASN1Template CRMFPOPOKeyEnciphermentTemplate[];
+extern const SEC_ASN1Template CRMFPOPOKeyAgreementTemplate[];
+extern const SEC_ASN1Template CRMFThisMessageTemplate[];
+extern const SEC_ASN1Template CRMFSubsequentMessageTemplate[];
+extern const SEC_ASN1Template CRMFDHMACTemplate[];
+extern const SEC_ASN1Template CRMFEncryptedKeyWithEncryptedValueTemplate[];
+extern const SEC_ASN1Template CRMFEncryptedValueTemplate[];
+
+/*
+ * Use these two values for encoding Boolean values.
+ */
+extern const unsigned char hexTrue;
+extern const unsigned char hexFalse;
+/*
+ * Prototypes for helper routines used internally by multiple files.
+ */
+extern SECStatus crmf_encode_integer(PLArenaPool *poolp, SECItem *dest,
+                                     long value);
+extern SECStatus crmf_make_bitstring_copy(PLArenaPool *arena, SECItem *dest,
+                                          SECItem *src);
+
+extern SECStatus crmf_copy_pkiarchiveoptions(PLArenaPool *poolp,
+                                             CRMFPKIArchiveOptions *destOpt,
+                                             CRMFPKIArchiveOptions *srcOpt);
+extern SECStatus
+crmf_destroy_pkiarchiveoptions(CRMFPKIArchiveOptions *inArchOptions,
+                               PRBool freeit);
+extern const SEC_ASN1Template *
+crmf_get_pkiarchiveoptions_subtemplate(CRMFControl *inControl);
+
+extern SECStatus crmf_copy_encryptedkey(PLArenaPool *poolp,
+                                        CRMFEncryptedKey *srcEncrKey,
+                                        CRMFEncryptedKey *destEncrKey);
+extern SECStatus
+crmf_copy_encryptedvalue(PLArenaPool *poolp,
+                         CRMFEncryptedValue *srcValue,
+                         CRMFEncryptedValue *destValue);
+
+extern SECStatus
+crmf_copy_encryptedvalue_secalg(PLArenaPool *poolp,
+                                SECAlgorithmID *srcAlgId,
+                                SECAlgorithmID **destAlgId);
+
+extern SECStatus crmf_template_copy_secalg(PLArenaPool *poolp,
+                                           SECAlgorithmID **dest,
+                                           SECAlgorithmID *src);
+
+extern SECStatus crmf_copy_cert_name(PLArenaPool *poolp, CERTName **dest,
+                                     CERTName *src);
+
+extern SECStatus crmf_template_add_public_key(PLArenaPool *poolp,
+                                              CERTSubjectPublicKeyInfo **dest,
+                                              CERTSubjectPublicKeyInfo *pubKey);
+
+extern CRMFCertExtension *crmf_create_cert_extension(PLArenaPool *poolp,
+                                                     SECOidTag tag,
+                                                     PRBool isCritical,
+                                                     SECItem *data);
+extern CRMFCertRequest *
+crmf_copy_cert_request(PLArenaPool *poolp, CRMFCertRequest *srcReq);
+
+extern SECStatus crmf_destroy_encrypted_value(CRMFEncryptedValue *inEncrValue,
+                                              PRBool freeit);
+
+extern CRMFEncryptedValue *
+crmf_create_encrypted_value_wrapped_privkey(SECKEYPrivateKey *inPrivKey,
+                                            SECKEYPublicKey *inPubKey,
+                                            CRMFEncryptedValue *destValue);
+
+extern CK_MECHANISM_TYPE
+crmf_get_mechanism_from_public_key(SECKEYPublicKey *inPubKey);
+
+extern SECStatus
+crmf_encrypted_value_unwrap_priv_key(PLArenaPool *poolp,
+                                     CRMFEncryptedValue *encValue,
+                                     SECKEYPrivateKey *privKey,
+                                     SECKEYPublicKey *newPubKey,
+                                     SECItem *nickname,
+                                     PK11SlotInfo *slot,
+                                     unsigned char keyUsage,
+                                     SECKEYPrivateKey **unWrappedKey,
+                                     void *wincx);
+
+extern SECItem *
+crmf_get_public_value(SECKEYPublicKey *pubKey, SECItem *dest);
+
+extern CRMFCertExtension *
+crmf_copy_cert_extension(PLArenaPool *poolp, CRMFCertExtension *inExtension);
+
+extern SECStatus
+crmf_create_prtime(SECItem *src, PRTime **dest);
+#endif /*_CRMFI_H_*/
diff --git a/security/nss/lib/crmf/crmfit.h b/security/nss/lib/crmf/crmfit.h
new file mode 100644
index 0000000000..c5c4b96e90
--- /dev/null
+++ b/security/nss/lib/crmf/crmfit.h
@@ -0,0 +1,185 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _CRMFIT_H_
+#define _CRMFIT_H_
+
+struct CRMFCertReqMessagesStr {
+    CRMFCertReqMsg **messages;
+    PLArenaPool *poolp;
+};
+
+struct CRMFCertExtensionStr {
+    SECItem id;
+    SECItem critical;
+    SECItem value;
+};
+
+struct CRMFOptionalValidityStr {
+    SECItem notBefore;
+    SECItem notAfter;
+};
+
+struct CRMFCertTemplateStr {
+    SECItem version;
+    SECItem serialNumber;
+    SECAlgorithmID *signingAlg;
+    CERTName *issuer;
+    CRMFOptionalValidity *validity;
+    CERTName *subject;
+    CERTSubjectPublicKeyInfo *publicKey;
+    SECItem issuerUID;
+    SECItem subjectUID;
+    CRMFCertExtension **extensions;
+    int numExtensions;
+};
+
+struct CRMFCertIDStr {
+    SECItem issuer;       /* General Name */
+    SECItem serialNumber; /*INTEGER*/
+};
+
+struct CRMFEncryptedValueStr {
+    SECAlgorithmID *intendedAlg;
+    SECAlgorithmID *symmAlg;
+    SECItem encSymmKey; /*BIT STRING   */
+    SECAlgorithmID *keyAlg;
+    SECItem valueHint; /*OCTET STRING */
+    SECItem encValue;  /*BIT STRING   */
+};
+
+/*
+ * The field derValue will contain the actual der
+ * to include in the encoding or that was read in
+ * from a der blob.
+ */
+struct CRMFEncryptedKeyStr {
+    union {
+        SEC_PKCS7ContentInfo *envelopedData;
+        CRMFEncryptedValue encryptedValue;
+    } value;
+    CRMFEncryptedKeyChoice encKeyChoice;
+    SECItem derValue;
+};
+
+/* ASN1 must only have one of the following 3 options. */
+struct CRMFPKIArchiveOptionsStr {
+    union {
+        CRMFEncryptedKey encryptedKey;
+        SECItem keyGenParameters;
+        SECItem archiveRemGenPrivKey; /* BOOLEAN */
+    } option;
+    CRMFPKIArchiveOptionsType archOption;
+};
+
+struct CRMFPKIPublicationInfoStr {
+    SECItem action; /* Possible values                    */
+                    /* dontPublish (0), pleasePublish (1) */
+    CRMFSinglePubInfo **pubInfos;
+};
+
+struct CRMFControlStr {
+    SECOidTag tag;
+    SECItem derTag;
+    SECItem derValue;
+    /* These will be C structures used to represent the various
+     * options.  Values that can't be stored as der right away.
+     * After creating these structures, we'll place their der
+     * encoding in derValue so the encoder knows how to get to
+     * it.
+     */
+    union {
+        CRMFCertID oldCertId;
+        CRMFPKIArchiveOptions archiveOptions;
+        CRMFPKIPublicationInfo pubInfo;
+        CRMFProtocolEncrKey protEncrKey;
+    } value;
+};
+
+struct CRMFCertRequestStr {
+    SECItem certReqId;
+    CRMFCertTemplate certTemplate;
+    CRMFControl **controls;
+    /* The following members are used by the internal implementation, but
+     * are not part of the encoding.
+     */
+    PLArenaPool *poolp;
+    PRUint32 requestID; /* This is the value that will be encoded into
+                         * the certReqId field.
+                         */
+};
+
+struct CRMFAttributeStr {
+    SECItem derTag;
+    SECItem derValue;
+};
+
+struct CRMFCertReqMsgStr {
+    CRMFCertRequest *certReq;
+    CRMFProofOfPossession *pop;
+    CRMFAttribute **regInfo;
+    SECItem derPOP;
+    /* This arena will be used for allocating memory when decoding.
+     */
+    PLArenaPool *poolp;
+    PRBool isDecoded;
+};
+
+struct CRMFPOPOSigningKeyInputStr {
+    /* ASN1 must have only one of the next 2 options */
+    union {
+        SECItem sender; /*General Name*/
+        CRMFPKMACValue *publicKeyMAC;
+    } authInfo;
+    CERTSubjectPublicKeyInfo publicKey;
+};
+
+struct CRMFPOPOSigningKeyStr {
+    SECItem derInput; /*If in the future we support
+                       *POPOSigningKeyInput, this will
+                       *a C structure representation
+                       *instead.
+                       */
+    SECAlgorithmID *algorithmIdentifier;
+    SECItem signature; /* This is a BIT STRING. Remember */
+};                     /* that when interpreting.        */
+
+/* ASN1 must only choose one of these members */
+struct CRMFPOPOPrivKeyStr {
+    union {
+        SECItem thisMessage;       /* BIT STRING */
+        SECItem subsequentMessage; /*INTEGER*/
+        SECItem dhMAC;             /*BIT STRING*/
+    } message;
+    CRMFPOPOPrivKeyChoice messageChoice;
+};
+
+/* ASN1 must only have one of these options. */
+struct CRMFProofOfPossessionStr {
+    union {
+        SECItem raVerified;
+        CRMFPOPOSigningKey signature;
+        CRMFPOPOPrivKey keyEncipherment;
+        CRMFPOPOPrivKey keyAgreement;
+    } popChoice;
+    CRMFPOPChoice popUsed; /*Not part of encoding*/
+};
+
+struct CRMFPKMACValueStr {
+    SECAlgorithmID algID;
+    SECItem value; /*BIT STRING*/
+};
+
+struct CRMFSinglePubInfoStr {
+    SECItem pubMethod;            /* Possible Values:
+                                   *   dontCare (0)
+                                   *   x500     (1)
+                                   *   web      (2)
+                                   *   ldap     (3)
+                                   */
+    CERTGeneralName *pubLocation; /* General Name */
+};
+
+#endif /* _CRMFIT_H_ */
diff --git a/security/nss/lib/crmf/crmfpop.c b/security/nss/lib/crmf/crmfpop.c
new file mode 100644
index 0000000000..725f8c730e
--- /dev/null
+++ b/security/nss/lib/crmf/crmfpop.c
@@ -0,0 +1,598 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "secasn1.h"
+#include "keyhi.h"
+#include "cryptohi.h"
+
+#define CRMF_DEFAULT_ALLOC_SIZE 1024U
+
+SECStatus
+crmf_init_encoder_callback_arg(struct crmfEncoderArg *encoderArg,
+                               SECItem *derDest)
+{
+    derDest->data = PORT_ZNewArray(unsigned char, CRMF_DEFAULT_ALLOC_SIZE);
+    if (derDest->data == NULL) {
+        return SECFailure;
+    }
+    derDest->len = 0;
+    encoderArg->allocatedLen = CRMF_DEFAULT_ALLOC_SIZE;
+    encoderArg->buffer = derDest;
+    return SECSuccess;
+}
+
+/* Caller should release or unmark the pool, instead of doing it here.
+** But there are NO callers of this function at present...
+*/
+SECStatus
+CRMF_CertReqMsgSetRAVerifiedPOP(CRMFCertReqMsg *inCertReqMsg)
+{
+    CRMFProofOfPossession *pop;
+    PLArenaPool *poolp;
+    void *mark;
+
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->pop == NULL);
+    poolp = inCertReqMsg->poolp;
+    mark = PORT_ArenaMark(poolp);
+    if (CRMF_CertReqMsgGetPOPType(inCertReqMsg) != crmfNoPOPChoice) {
+        return SECFailure;
+    }
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+    pop->popUsed = crmfRAVerified;
+    pop->popChoice.raVerified.data = NULL;
+    pop->popChoice.raVerified.len = 0;
+    inCertReqMsg->pop = pop;
+    (void)SEC_ASN1EncodeItem(poolp, &(inCertReqMsg->derPOP),
+                             &(pop->popChoice.raVerified),
+                             CRMFRAVerifiedTemplate);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+static SECOidTag
+crmf_get_key_sign_tag(SECKEYPublicKey *inPubKey)
+{
+    /* maintain backward compatibility with older
+     * implementations */
+    if (inPubKey->keyType == rsaKey) {
+        return SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION;
+    }
+    return SEC_GetSignatureAlgorithmOidTag(inPubKey->keyType, SEC_OID_UNKNOWN);
+}
+
+static SECAlgorithmID *
+crmf_create_poposignkey_algid(PLArenaPool *poolp,
+                              SECKEYPublicKey *inPubKey)
+{
+    SECAlgorithmID *algID;
+    SECOidTag tag;
+    SECStatus rv;
+    void *mark;
+
+    mark = PORT_ArenaMark(poolp);
+    algID = PORT_ArenaZNew(poolp, SECAlgorithmID);
+    if (algID == NULL) {
+        goto loser;
+    }
+    tag = crmf_get_key_sign_tag(inPubKey);
+    if (tag == SEC_OID_UNKNOWN) {
+        goto loser;
+    }
+    rv = SECOID_SetAlgorithmID(poolp, algID, tag, NULL);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return algID;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return NULL;
+}
+
+static CRMFPOPOSigningKeyInput *
+crmf_create_poposigningkeyinput(PLArenaPool *poolp, CERTCertificate *inCert,
+                                CRMFMACPasswordCallback fn, void *arg)
+{
+    /* PSM isn't going to do this, so we'll fail here for now.*/
+    return NULL;
+}
+
+void
+crmf_generic_encoder_callback(void *arg, const char *buf, unsigned long len,
+                              int depth, SEC_ASN1EncodingPart data_kind)
+{
+    struct crmfEncoderArg *encoderArg = (struct crmfEncoderArg *)arg;
+    unsigned char *cursor;
+
+    if (encoderArg->buffer->len + len > encoderArg->allocatedLen) {
+        int newSize = encoderArg->buffer->len + CRMF_DEFAULT_ALLOC_SIZE;
+        void *dummy = PORT_Realloc(encoderArg->buffer->data, newSize);
+        if (dummy == NULL) {
+            /* I really want to return an error code here */
+            PORT_Assert(0);
+            return;
+        }
+        encoderArg->buffer->data = dummy;
+        encoderArg->allocatedLen = newSize;
+    }
+    cursor = &(encoderArg->buffer->data[encoderArg->buffer->len]);
+    if (len) {
+        PORT_Memcpy(cursor, buf, len);
+    }
+    encoderArg->buffer->len += len;
+}
+
+static SECStatus
+crmf_encode_certreq(CRMFCertRequest *inCertReq, SECItem *derDest)
+{
+    struct crmfEncoderArg encoderArg;
+    SECStatus rv;
+
+    rv = crmf_init_encoder_callback_arg(&encoderArg, derDest);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+    return SEC_ASN1Encode(inCertReq, CRMFCertRequestTemplate,
+                          crmf_generic_encoder_callback, &encoderArg);
+}
+
+static SECStatus
+crmf_sign_certreq(PLArenaPool *poolp,
+                  CRMFPOPOSigningKey *crmfSignKey,
+                  CRMFCertRequest *certReq,
+                  SECKEYPrivateKey *inKey,
+                  SECAlgorithmID *inAlgId)
+{
+    SECItem derCertReq = { siBuffer, NULL, 0 };
+    SECItem certReqSig = { siBuffer, NULL, 0 };
+    SECStatus rv = SECSuccess;
+
+    rv = crmf_encode_certreq(certReq, &derCertReq);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SEC_SignData(&certReqSig, derCertReq.data, derCertReq.len,
+                      inKey, SECOID_GetAlgorithmTag(inAlgId));
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    /* Now make it a part of the POPOSigningKey */
+    rv = SECITEM_CopyItem(poolp, &(crmfSignKey->signature), &certReqSig);
+    /* Convert this length to number of bits */
+    crmfSignKey->signature.len <<= 3;
+
+loser:
+    if (derCertReq.data != NULL) {
+        PORT_Free(derCertReq.data);
+    }
+    if (certReqSig.data != NULL) {
+        PORT_Free(certReqSig.data);
+    }
+    return rv;
+}
+
+static SECStatus
+crmf_create_poposignkey(PLArenaPool *poolp,
+                        CRMFCertReqMsg *inCertReqMsg,
+                        CRMFPOPOSigningKeyInput *signKeyInput,
+                        SECKEYPrivateKey *inPrivKey,
+                        SECAlgorithmID *inAlgID,
+                        CRMFPOPOSigningKey *signKey)
+{
+    CRMFCertRequest *certReq;
+    void *mark;
+    PRBool useSignKeyInput;
+    SECStatus rv;
+
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->certReq != NULL);
+    mark = PORT_ArenaMark(poolp);
+    if (signKey == NULL) {
+        goto loser;
+    }
+    certReq = inCertReqMsg->certReq;
+    useSignKeyInput = !(CRMF_DoesRequestHaveField(certReq, crmfSubject) &&
+                        CRMF_DoesRequestHaveField(certReq, crmfPublicKey));
+
+    if (useSignKeyInput) {
+        goto loser;
+    } else {
+        rv = crmf_sign_certreq(poolp, signKey, certReq, inPrivKey, inAlgID);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertReqMsgSetSignaturePOP(CRMFCertReqMsg *inCertReqMsg,
+                               SECKEYPrivateKey *inPrivKey,
+                               SECKEYPublicKey *inPubKey,
+                               CERTCertificate *inCertForInput,
+                               CRMFMACPasswordCallback fn,
+                               void *arg)
+{
+    SECAlgorithmID *algID;
+    PLArenaPool *poolp;
+    SECItem derTemp = { siBuffer, NULL, 0 };
+    void *mark;
+    SECStatus rv;
+    CRMFPOPOSigningKeyInput *signKeyInput = NULL;
+    CRMFCertRequest *certReq;
+    CRMFProofOfPossession *pop;
+    struct crmfEncoderArg encoderArg;
+
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->certReq != NULL &&
+                inCertReqMsg->pop == NULL);
+    certReq = inCertReqMsg->certReq;
+    if (CRMF_CertReqMsgGetPOPType(inCertReqMsg) != crmfNoPOPChoice ||
+        !CRMF_DoesRequestHaveField(certReq, crmfPublicKey)) {
+        return SECFailure;
+    }
+    poolp = inCertReqMsg->poolp;
+    mark = PORT_ArenaMark(poolp);
+    algID = crmf_create_poposignkey_algid(poolp, inPubKey);
+
+    if (!CRMF_DoesRequestHaveField(certReq, crmfSubject)) {
+        signKeyInput = crmf_create_poposigningkeyinput(poolp, inCertForInput,
+                                                       fn, arg);
+        if (signKeyInput == NULL) {
+            goto loser;
+        }
+    }
+
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+
+    rv = crmf_create_poposignkey(poolp, inCertReqMsg,
+                                 signKeyInput, inPrivKey, algID,
+                                 &(pop->popChoice.signature));
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    pop->popUsed = crmfSignature;
+    pop->popChoice.signature.algorithmIdentifier = algID;
+    inCertReqMsg->pop = pop;
+
+    rv = crmf_init_encoder_callback_arg(&encoderArg, &derTemp);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SEC_ASN1Encode(&pop->popChoice.signature,
+                        CRMFPOPOSigningKeyTemplate,
+                        crmf_generic_encoder_callback, &encoderArg);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    rv = SECITEM_CopyItem(poolp, &(inCertReqMsg->derPOP), &derTemp);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_Free(derTemp.data);
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    if (derTemp.data != NULL) {
+        PORT_Free(derTemp.data);
+    }
+    return SECFailure;
+}
+
+static const SEC_ASN1Template *
+crmf_get_popoprivkey_subtemplate(CRMFPOPOPrivKey *inPrivKey)
+{
+    const SEC_ASN1Template *retTemplate = NULL;
+
+    switch (inPrivKey->messageChoice) {
+        case crmfThisMessage:
+            retTemplate = CRMFThisMessageTemplate;
+            break;
+        case crmfSubsequentMessage:
+            retTemplate = CRMFSubsequentMessageTemplate;
+            break;
+        case crmfDHMAC:
+            retTemplate = CRMFDHMACTemplate;
+            break;
+        default:
+            retTemplate = NULL;
+    }
+    return retTemplate;
+}
+
+static SECStatus
+crmf_encode_popoprivkey(PLArenaPool *poolp,
+                        CRMFCertReqMsg *inCertReqMsg,
+                        CRMFPOPOPrivKey *popoPrivKey,
+                        const SEC_ASN1Template *privKeyTemplate)
+{
+    struct crmfEncoderArg encoderArg;
+    SECItem derTemp = { siBuffer, NULL, 0 };
+    SECStatus rv;
+    void *mark;
+    const SEC_ASN1Template *subDerTemplate;
+
+    mark = PORT_ArenaMark(poolp);
+    rv = crmf_init_encoder_callback_arg(&encoderArg, &derTemp);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    subDerTemplate = crmf_get_popoprivkey_subtemplate(popoPrivKey);
+    /* We've got a union, so a pointer to one item is a pointer to
+     * all the items in the union.
+     */
+    rv = SEC_ASN1Encode(&popoPrivKey->message.thisMessage,
+                        subDerTemplate,
+                        crmf_generic_encoder_callback, &encoderArg);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (encoderArg.allocatedLen > derTemp.len + 2) {
+        void *dummy = PORT_Realloc(derTemp.data, derTemp.len + 2);
+        if (dummy == NULL) {
+            goto loser;
+        }
+        derTemp.data = dummy;
+    }
+    PORT_Memmove(&derTemp.data[2], &derTemp.data[0], derTemp.len);
+    /* I couldn't figure out how to get the ASN1 encoder to implicitly
+     * tag an implicitly tagged der blob.  So I'm putting in the outter-
+     * most tag myself. -javi
+     */
+    derTemp.data[0] = (unsigned char)privKeyTemplate->kind;
+    derTemp.data[1] = (unsigned char)derTemp.len;
+    derTemp.len += 2;
+    rv = SECITEM_CopyItem(poolp, &inCertReqMsg->derPOP, &derTemp);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_Free(derTemp.data);
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    if (derTemp.data) {
+        PORT_Free(derTemp.data);
+    }
+    return SECFailure;
+}
+
+static const SEC_ASN1Template *
+crmf_get_template_for_privkey(CRMFPOPChoice inChoice)
+{
+    switch (inChoice) {
+        case crmfKeyAgreement:
+            return CRMFPOPOKeyAgreementTemplate;
+        case crmfKeyEncipherment:
+            return CRMFPOPOKeyEnciphermentTemplate;
+        default:
+            break;
+    }
+    return NULL;
+}
+
+static SECStatus
+crmf_add_privkey_thismessage(CRMFCertReqMsg *inCertReqMsg, SECItem *encPrivKey,
+                             CRMFPOPChoice inChoice)
+{
+    PLArenaPool *poolp;
+    void *mark;
+    CRMFPOPOPrivKey *popoPrivKey;
+    CRMFProofOfPossession *pop;
+    SECStatus rv;
+
+    PORT_Assert(inCertReqMsg != NULL && encPrivKey != NULL);
+    poolp = inCertReqMsg->poolp;
+    mark = PORT_ArenaMark(poolp);
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+    pop->popUsed = inChoice;
+    /* popChoice is a union, so getting a pointer to one
+     * field gives me a pointer to the other fields as
+     * well.  This in essence points to both
+     * pop->popChoice.keyEncipherment and
+     * pop->popChoice.keyAgreement
+     */
+    popoPrivKey = &pop->popChoice.keyEncipherment;
+
+    rv = SECITEM_CopyItem(poolp, &(popoPrivKey->message.thisMessage),
+                          encPrivKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    popoPrivKey->message.thisMessage.len <<= 3;
+    popoPrivKey->messageChoice = crmfThisMessage;
+    inCertReqMsg->pop = pop;
+    rv = crmf_encode_popoprivkey(poolp, inCertReqMsg, popoPrivKey,
+                                 crmf_get_template_for_privkey(inChoice));
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+static SECStatus
+crmf_add_privkey_dhmac(CRMFCertReqMsg *inCertReqMsg, SECItem *dhmac,
+                       CRMFPOPChoice inChoice)
+{
+    PLArenaPool *poolp;
+    void *mark;
+    CRMFPOPOPrivKey *popoPrivKey;
+    CRMFProofOfPossession *pop;
+    SECStatus rv;
+
+    PORT_Assert(inCertReqMsg != NULL && dhmac != NULL);
+    poolp = inCertReqMsg->poolp;
+    mark = PORT_ArenaMark(poolp);
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+    pop->popUsed = inChoice;
+    popoPrivKey = &pop->popChoice.keyAgreement;
+
+    rv = SECITEM_CopyItem(poolp, &(popoPrivKey->message.dhMAC),
+                          dhmac);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    popoPrivKey->message.dhMAC.len <<= 3;
+    popoPrivKey->messageChoice = crmfDHMAC;
+    inCertReqMsg->pop = pop;
+    rv = crmf_encode_popoprivkey(poolp, inCertReqMsg, popoPrivKey,
+                                 crmf_get_template_for_privkey(inChoice));
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+static SECStatus
+crmf_add_privkey_subseqmessage(CRMFCertReqMsg *inCertReqMsg,
+                               CRMFSubseqMessOptions subsequentMessage,
+                               CRMFPOPChoice inChoice)
+{
+    void *mark;
+    PLArenaPool *poolp;
+    CRMFProofOfPossession *pop;
+    CRMFPOPOPrivKey *popoPrivKey;
+    SECStatus rv;
+    const SEC_ASN1Template *privKeyTemplate;
+
+    if (subsequentMessage == crmfNoSubseqMess) {
+        return SECFailure;
+    }
+    poolp = inCertReqMsg->poolp;
+    mark = PORT_ArenaMark(poolp);
+    pop = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (pop == NULL) {
+        goto loser;
+    }
+
+    pop->popUsed = inChoice;
+    /*
+     * We have a union, so a pointer to one member of the union
+     * is also a member to another member of that same union.
+     */
+    popoPrivKey = &pop->popChoice.keyEncipherment;
+
+    switch (subsequentMessage) {
+        case crmfEncrCert:
+            rv = crmf_encode_integer(poolp,
+                                     &(popoPrivKey->message.subsequentMessage),
+                                     0);
+            break;
+        case crmfChallengeResp:
+            rv = crmf_encode_integer(poolp,
+                                     &(popoPrivKey->message.subsequentMessage),
+                                     1);
+            break;
+        default:
+            goto loser;
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    popoPrivKey->messageChoice = crmfSubsequentMessage;
+    privKeyTemplate = crmf_get_template_for_privkey(inChoice);
+    inCertReqMsg->pop = pop;
+    rv = crmf_encode_popoprivkey(poolp, inCertReqMsg, popoPrivKey,
+                                 privKeyTemplate);
+
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertReqMsgSetKeyEnciphermentPOP(CRMFCertReqMsg *inCertReqMsg,
+                                     CRMFPOPOPrivKeyChoice inKeyChoice,
+                                     CRMFSubseqMessOptions subseqMess,
+                                     SECItem *encPrivKey)
+{
+    SECStatus rv;
+
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->pop == NULL);
+    if (CRMF_CertReqMsgGetPOPType(inCertReqMsg) != crmfNoPOPChoice) {
+        return SECFailure;
+    }
+    switch (inKeyChoice) {
+        case crmfThisMessage:
+            rv = crmf_add_privkey_thismessage(inCertReqMsg, encPrivKey,
+                                              crmfKeyEncipherment);
+            break;
+        case crmfSubsequentMessage:
+            rv = crmf_add_privkey_subseqmessage(inCertReqMsg, subseqMess,
+                                                crmfKeyEncipherment);
+            break;
+        case crmfDHMAC:
+        default:
+            rv = SECFailure;
+    }
+    return rv;
+}
+
+SECStatus
+CRMF_CertReqMsgSetKeyAgreementPOP(CRMFCertReqMsg *inCertReqMsg,
+                                  CRMFPOPOPrivKeyChoice inKeyChoice,
+                                  CRMFSubseqMessOptions subseqMess,
+                                  SECItem *encPrivKey)
+{
+    SECStatus rv;
+
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->pop == NULL);
+    switch (inKeyChoice) {
+        case crmfThisMessage:
+            rv = crmf_add_privkey_thismessage(inCertReqMsg, encPrivKey,
+                                              crmfKeyAgreement);
+            break;
+        case crmfSubsequentMessage:
+            rv = crmf_add_privkey_subseqmessage(inCertReqMsg, subseqMess,
+                                                crmfKeyAgreement);
+            break;
+        case crmfDHMAC:
+            /* In this case encPrivKey should be the calculated dhMac
+             * as specified in RFC 2511 */
+            rv = crmf_add_privkey_dhmac(inCertReqMsg, encPrivKey,
+                                        crmfKeyAgreement);
+            break;
+        default:
+            rv = SECFailure;
+    }
+    return rv;
+}
diff --git a/security/nss/lib/crmf/crmfreq.c b/security/nss/lib/crmf/crmfreq.c
new file mode 100644
index 0000000000..e89f18228c
--- /dev/null
+++ b/security/nss/lib/crmf/crmfreq.c
@@ -0,0 +1,663 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "keyhi.h"
+#include "secder.h"
+
+/*
+ * Macro that returns PR_TRUE if the pointer is not NULL.
+ * If the pointer is NULL, then the macro will return PR_FALSE.
+ */
+#define IS_NOT_NULL(ptr) ((ptr) == NULL) ? PR_FALSE : PR_TRUE
+
+const unsigned char hexTrue = 0xff;
+const unsigned char hexFalse = 0x00;
+
+SECStatus
+crmf_encode_integer(PLArenaPool *poolp, SECItem *dest, long value)
+{
+    SECItem *dummy;
+
+    dummy = SEC_ASN1EncodeInteger(poolp, dest, value);
+    PORT_Assert(dummy == dest);
+    if (dummy == NULL) {
+        return SECFailure;
+    }
+    return SECSuccess;
+}
+
+SECStatus
+crmf_encode_unsigned_integer(PLArenaPool *poolp, SECItem *dest,
+                             unsigned long value)
+{
+    SECItem *dummy;
+
+    dummy = SEC_ASN1EncodeUnsignedInteger(poolp, dest, value);
+    PORT_Assert(dummy == dest);
+    if (dummy != dest) {
+        return SECFailure;
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_copy_secitem(PLArenaPool *poolp, SECItem *dest, SECItem *src)
+{
+    return SECITEM_CopyItem(poolp, dest, src);
+}
+
+PRBool
+CRMF_DoesRequestHaveField(CRMFCertRequest *inCertReq,
+                          CRMFCertTemplateField inField)
+{
+
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return PR_FALSE;
+    }
+    switch (inField) {
+        case crmfVersion:
+            return inCertReq->certTemplate.version.data != NULL;
+        case crmfSerialNumber:
+            return inCertReq->certTemplate.serialNumber.data != NULL;
+        case crmfSigningAlg:
+            return inCertReq->certTemplate.signingAlg != NULL;
+        case crmfIssuer:
+            return inCertReq->certTemplate.issuer != NULL;
+        case crmfValidity:
+            return inCertReq->certTemplate.validity != NULL;
+        case crmfSubject:
+            return inCertReq->certTemplate.subject != NULL;
+        case crmfPublicKey:
+            return inCertReq->certTemplate.publicKey != NULL;
+        case crmfIssuerUID:
+            return inCertReq->certTemplate.issuerUID.data != NULL;
+        case crmfSubjectUID:
+            return inCertReq->certTemplate.subjectUID.data != NULL;
+        case crmfExtension:
+            return CRMF_CertRequestGetNumberOfExtensions(inCertReq) != 0;
+    }
+    return PR_FALSE;
+}
+
+CRMFCertRequest *
+CRMF_CreateCertRequest(PRUint32 inRequestID)
+{
+    PLArenaPool *poolp;
+    CRMFCertRequest *certReq;
+    SECStatus rv;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+
+    certReq = PORT_ArenaZNew(poolp, CRMFCertRequest);
+    if (certReq == NULL) {
+        goto loser;
+    }
+
+    certReq->poolp = poolp;
+    certReq->requestID = inRequestID;
+
+    rv = crmf_encode_unsigned_integer(poolp, &(certReq->certReqId),
+                                      inRequestID);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    return certReq;
+loser:
+    if (poolp) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+SECStatus
+CRMF_DestroyCertRequest(CRMFCertRequest *inCertReq)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq != NULL) {
+        if (inCertReq->certTemplate.extensions) {
+            PORT_Free(inCertReq->certTemplate.extensions);
+        }
+        if (inCertReq->controls) {
+            /* Right now we don't support EnveloppedData option,
+             * so we won't go through and delete each occurrence of
+             * an EnveloppedData in the control.
+             */
+            PORT_Free(inCertReq->controls);
+        }
+        if (inCertReq->poolp) {
+            PORT_FreeArena(inCertReq->poolp, PR_TRUE);
+        }
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+crmf_template_add_version(PLArenaPool *poolp, SECItem *dest, long version)
+{
+    return (crmf_encode_integer(poolp, dest, version));
+}
+
+static SECStatus
+crmf_template_add_serialnumber(PLArenaPool *poolp, SECItem *dest, long serial)
+{
+    return (crmf_encode_integer(poolp, dest, serial));
+}
+
+SECStatus
+crmf_template_copy_secalg(PLArenaPool *poolp, SECAlgorithmID **dest,
+                          SECAlgorithmID *src)
+{
+    SECStatus rv;
+    void *mark = NULL;
+    SECAlgorithmID *mySecAlg;
+
+    if (!poolp) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
+    }
+
+    mark = PORT_ArenaMark(poolp);
+    *dest = mySecAlg = PORT_ArenaZNew(poolp, SECAlgorithmID);
+    if (mySecAlg == NULL) {
+        goto loser;
+    }
+    rv = SECOID_CopyAlgorithmID(poolp, mySecAlg, src);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (mark) {
+        PORT_ArenaUnmark(poolp, mark);
+    }
+    return SECSuccess;
+
+loser:
+    *dest = NULL;
+    if (mark) {
+        PORT_ArenaRelease(poolp, mark);
+    }
+    return SECFailure;
+}
+
+SECStatus
+crmf_copy_cert_name(PLArenaPool *poolp, CERTName **dest,
+                    CERTName *src)
+{
+    CERTName *newName;
+    SECStatus rv;
+    void *mark;
+
+    mark = PORT_ArenaMark(poolp);
+    *dest = newName = PORT_ArenaZNew(poolp, CERTName);
+    if (newName == NULL) {
+        goto loser;
+    }
+
+    rv = CERT_CopyName(poolp, newName, src);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    *dest = NULL;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_template_add_issuer(PLArenaPool *poolp, CERTName **dest,
+                         CERTName *issuerName)
+{
+    return crmf_copy_cert_name(poolp, dest, issuerName);
+}
+
+static SECStatus
+crmf_template_add_validity(PLArenaPool *poolp, CRMFOptionalValidity **dest,
+                           CRMFValidityCreationInfo *info)
+{
+    SECStatus rv;
+    void *mark;
+    CRMFOptionalValidity *myValidity;
+
+    /*First off, let's make sure at least one of the two fields is present*/
+    if (!info || (!info->notBefore && !info->notAfter)) {
+        return SECFailure;
+    }
+    mark = PORT_ArenaMark(poolp);
+    *dest = myValidity = PORT_ArenaZNew(poolp, CRMFOptionalValidity);
+    if (myValidity == NULL) {
+        goto loser;
+    }
+
+    if (info->notBefore) {
+        rv = DER_EncodeTimeChoice(poolp, &myValidity->notBefore,
+                                  *info->notBefore);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (info->notAfter) {
+        rv = DER_EncodeTimeChoice(poolp, &myValidity->notAfter,
+                                  *info->notAfter);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    *dest = NULL;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_template_add_subject(PLArenaPool *poolp, CERTName **dest,
+                          CERTName *subject)
+{
+    return crmf_copy_cert_name(poolp, dest, subject);
+}
+
+SECStatus
+crmf_template_add_public_key(PLArenaPool *poolp,
+                             CERTSubjectPublicKeyInfo **dest,
+                             CERTSubjectPublicKeyInfo *pubKey)
+{
+    CERTSubjectPublicKeyInfo *spki;
+    SECStatus rv;
+
+    *dest = spki = (poolp == NULL) ? PORT_ZNew(CERTSubjectPublicKeyInfo) : PORT_ArenaZNew(poolp, CERTSubjectPublicKeyInfo);
+    if (spki == NULL) {
+        goto loser;
+    }
+    rv = SECKEY_CopySubjectPublicKeyInfo(poolp, spki, pubKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return SECSuccess;
+loser:
+    if (poolp == NULL && spki != NULL) {
+        SECKEY_DestroySubjectPublicKeyInfo(spki);
+    }
+    *dest = NULL;
+    return SECFailure;
+}
+
+static SECStatus
+crmf_copy_bitstring(PLArenaPool *poolp, SECItem *dest, const SECItem *src)
+{
+    SECStatus rv;
+    SECItem byteSrc;
+
+    byteSrc = *src;
+    byteSrc.len = CRMF_BITS_TO_BYTES(byteSrc.len);
+    rv = crmf_copy_secitem(poolp, dest, &byteSrc);
+    dest->len = src->len;
+    return rv;
+}
+
+static SECStatus
+crmf_template_add_issuer_uid(PLArenaPool *poolp, SECItem *dest,
+                             const SECItem *issuerUID)
+{
+    return crmf_copy_bitstring(poolp, dest, issuerUID);
+}
+
+static SECStatus
+crmf_template_add_subject_uid(PLArenaPool *poolp, SECItem *dest,
+                              const SECItem *subjectUID)
+{
+    return crmf_copy_bitstring(poolp, dest, subjectUID);
+}
+
+static void
+crmf_zeroize_new_extensions(CRMFCertExtension **extensions,
+                            int numToZeroize)
+{
+    PORT_Memset((void *)extensions, 0, sizeof(CERTCertExtension *) * numToZeroize);
+}
+
+/*
+ * The strategy for adding templates will differ from all the other
+ * attributes in the template.  First, we want to allow the client
+ * of this API to set extensions more than just once.  So we will
+ * need the ability grow the array of extensions.  Since arenas don't
+ * give us the realloc function, we'll use the generic PORT_* functions
+ * to allocate the array of pointers *ONLY*.  Then we will allocate each
+ * individual extension from the arena that comes along with the certReq
+ * structure that owns this template.
+ */
+static SECStatus
+crmf_template_add_extensions(PLArenaPool *poolp, CRMFCertTemplate *inTemplate,
+                             CRMFCertExtCreationInfo *extensions)
+{
+    void *mark;
+    int newSize, oldSize, i;
+    SECStatus rv;
+    CRMFCertExtension **extArray;
+    CRMFCertExtension *newExt, *currExt;
+
+    mark = PORT_ArenaMark(poolp);
+    if (inTemplate->extensions == NULL) {
+        newSize = extensions->numExtensions;
+        extArray = PORT_ZNewArray(CRMFCertExtension *, newSize + 1);
+    } else {
+        newSize = inTemplate->numExtensions + extensions->numExtensions;
+        extArray = PORT_Realloc(inTemplate->extensions,
+                                sizeof(CRMFCertExtension *) * (newSize + 1));
+    }
+    if (extArray == NULL) {
+        goto loser;
+    }
+    oldSize = inTemplate->numExtensions;
+    inTemplate->extensions = extArray;
+    inTemplate->numExtensions = newSize;
+    for (i = oldSize; i < newSize; i++) {
+        newExt = PORT_ArenaZNew(poolp, CRMFCertExtension);
+        if (newExt == NULL) {
+            goto loser2;
+        }
+        currExt = extensions->extensions[i - oldSize];
+        rv = crmf_copy_secitem(poolp, &(newExt->id), &(currExt->id));
+        if (rv != SECSuccess) {
+            goto loser2;
+        }
+        rv = crmf_copy_secitem(poolp, &(newExt->critical),
+                               &(currExt->critical));
+        if (rv != SECSuccess) {
+            goto loser2;
+        }
+        rv = crmf_copy_secitem(poolp, &(newExt->value), &(currExt->value));
+        if (rv != SECSuccess) {
+            goto loser2;
+        }
+        extArray[i] = newExt;
+    }
+    extArray[newSize] = NULL;
+    PORT_ArenaUnmark(poolp, mark);
+    return SECSuccess;
+loser2:
+    crmf_zeroize_new_extensions(&(inTemplate->extensions[oldSize]),
+                                extensions->numExtensions);
+    inTemplate->numExtensions = oldSize;
+loser:
+    PORT_ArenaRelease(poolp, mark);
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestSetTemplateField(CRMFCertRequest *inCertReq,
+                                 CRMFCertTemplateField inTemplateField,
+                                 void *data)
+{
+    CRMFCertTemplate *certTemplate;
+    PLArenaPool *poolp;
+    SECStatus rv = SECFailure;
+    void *mark;
+
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+
+    certTemplate = &(inCertReq->certTemplate);
+
+    poolp = inCertReq->poolp;
+    mark = PORT_ArenaMark(poolp);
+    switch (inTemplateField) {
+        case crmfVersion:
+            rv = crmf_template_add_version(poolp, &(certTemplate->version),
+                                           *(long *)data);
+            break;
+        case crmfSerialNumber:
+            rv = crmf_template_add_serialnumber(poolp,
+                                                &(certTemplate->serialNumber),
+                                                *(long *)data);
+            break;
+        case crmfSigningAlg:
+            rv = crmf_template_copy_secalg(poolp, &(certTemplate->signingAlg),
+                                           (SECAlgorithmID *)data);
+            break;
+        case crmfIssuer:
+            rv = crmf_template_add_issuer(poolp, &(certTemplate->issuer),
+                                          (CERTName *)data);
+            break;
+        case crmfValidity:
+            rv = crmf_template_add_validity(poolp, &(certTemplate->validity),
+                                            (CRMFValidityCreationInfo *)data);
+            break;
+        case crmfSubject:
+            rv = crmf_template_add_subject(poolp, &(certTemplate->subject),
+                                           (CERTName *)data);
+            break;
+        case crmfPublicKey:
+            rv = crmf_template_add_public_key(poolp, &(certTemplate->publicKey),
+                                              (CERTSubjectPublicKeyInfo *)data);
+            break;
+        case crmfIssuerUID:
+            rv = crmf_template_add_issuer_uid(poolp, &(certTemplate->issuerUID),
+                                              (SECItem *)data);
+            break;
+        case crmfSubjectUID:
+            rv = crmf_template_add_subject_uid(poolp, &(certTemplate->subjectUID),
+                                               (SECItem *)data);
+            break;
+        case crmfExtension:
+            rv = crmf_template_add_extensions(poolp, certTemplate,
+                                              (CRMFCertExtCreationInfo *)data);
+            break;
+    }
+    if (rv != SECSuccess) {
+        PORT_ArenaRelease(poolp, mark);
+    } else {
+        PORT_ArenaUnmark(poolp, mark);
+    }
+    return rv;
+}
+
+SECStatus
+CRMF_CertReqMsgSetCertRequest(CRMFCertReqMsg *inCertReqMsg,
+                              CRMFCertRequest *inCertReq)
+{
+    PORT_Assert(inCertReqMsg != NULL && inCertReq != NULL);
+    if (inCertReqMsg == NULL || inCertReq == NULL) {
+        return SECFailure;
+    }
+    inCertReqMsg->certReq = crmf_copy_cert_request(inCertReqMsg->poolp,
+                                                   inCertReq);
+    return (inCertReqMsg->certReq == NULL) ? SECFailure : SECSuccess;
+}
+
+CRMFCertReqMsg *
+CRMF_CreateCertReqMsg(void)
+{
+    PLArenaPool *poolp;
+    CRMFCertReqMsg *reqMsg;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+    reqMsg = PORT_ArenaZNew(poolp, CRMFCertReqMsg);
+    if (reqMsg == NULL) {
+        goto loser;
+    }
+    reqMsg->poolp = poolp;
+    return reqMsg;
+
+loser:
+    if (poolp) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+SECStatus
+CRMF_DestroyCertReqMsg(CRMFCertReqMsg *inCertReqMsg)
+{
+    PORT_Assert(inCertReqMsg != NULL && inCertReqMsg->poolp != NULL);
+    if (!inCertReqMsg->isDecoded) {
+        if (inCertReqMsg->certReq->certTemplate.extensions != NULL) {
+            PORT_Free(inCertReqMsg->certReq->certTemplate.extensions);
+        }
+        if (inCertReqMsg->certReq->controls != NULL) {
+            PORT_Free(inCertReqMsg->certReq->controls);
+        }
+    }
+    PORT_FreeArena(inCertReqMsg->poolp, PR_TRUE);
+    return SECSuccess;
+}
+
+CRMFCertExtension *
+crmf_create_cert_extension(PLArenaPool *poolp,
+                           SECOidTag id,
+                           PRBool isCritical,
+                           SECItem *data)
+{
+    CRMFCertExtension *newExt;
+    SECOidData *oidData;
+    SECStatus rv;
+
+    newExt = (poolp == NULL) ? PORT_ZNew(CRMFCertExtension) : PORT_ArenaZNew(poolp, CRMFCertExtension);
+    if (newExt == NULL) {
+        goto loser;
+    }
+    oidData = SECOID_FindOIDByTag(id);
+    if (oidData == NULL ||
+        oidData->supportedExtension != SUPPORTED_CERT_EXTENSION) {
+        goto loser;
+    }
+
+    rv = SECITEM_CopyItem(poolp, &(newExt->id), &(oidData->oid));
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = SECITEM_CopyItem(poolp, &(newExt->value), data);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    if (isCritical) {
+        newExt->critical.data = (poolp == NULL) ? PORT_New(unsigned char)
+                                                : PORT_ArenaNew(poolp, unsigned char);
+        if (newExt->critical.data == NULL) {
+            goto loser;
+        }
+        newExt->critical.data[0] = hexTrue;
+        newExt->critical.len = 1;
+    }
+    return newExt;
+loser:
+    if (newExt != NULL && poolp == NULL) {
+        CRMF_DestroyCertExtension(newExt);
+    }
+    return NULL;
+}
+
+CRMFCertExtension *
+CRMF_CreateCertExtension(SECOidTag id,
+                         PRBool isCritical,
+                         SECItem *data)
+{
+    return crmf_create_cert_extension(NULL, id, isCritical, data);
+}
+
+static SECStatus
+crmf_destroy_cert_extension(CRMFCertExtension *inExtension, PRBool freeit)
+{
+    if (inExtension != NULL) {
+        SECITEM_FreeItem(&(inExtension->id), PR_FALSE);
+        SECITEM_FreeItem(&(inExtension->value), PR_FALSE);
+        SECITEM_FreeItem(&(inExtension->critical), PR_FALSE);
+        if (freeit) {
+            PORT_Free(inExtension);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_DestroyCertExtension(CRMFCertExtension *inExtension)
+{
+    return crmf_destroy_cert_extension(inExtension, PR_TRUE);
+}
+
+SECStatus
+CRMF_DestroyCertReqMessages(CRMFCertReqMessages *inCertReqMsgs)
+{
+    PORT_Assert(inCertReqMsgs != NULL);
+    if (inCertReqMsgs != NULL) {
+        PORT_FreeArena(inCertReqMsgs->poolp, PR_TRUE);
+    }
+    return SECSuccess;
+}
+
+static PRBool
+crmf_item_has_data(SECItem *item)
+{
+    if (item != NULL && item->data != NULL) {
+        return PR_TRUE;
+    }
+    return PR_FALSE;
+}
+
+PRBool
+CRMF_CertRequestIsFieldPresent(CRMFCertRequest *inCertReq,
+                               CRMFCertTemplateField inTemplateField)
+{
+    PRBool retVal;
+    CRMFCertTemplate *certTemplate;
+
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        /* This is probably some kind of error, but this is
+         * the safest return value for this function.
+         */
+        return PR_FALSE;
+    }
+    certTemplate = &inCertReq->certTemplate;
+    switch (inTemplateField) {
+        case crmfVersion:
+            retVal = crmf_item_has_data(&certTemplate->version);
+            break;
+        case crmfSerialNumber:
+            retVal = crmf_item_has_data(&certTemplate->serialNumber);
+            break;
+        case crmfSigningAlg:
+            retVal = IS_NOT_NULL(certTemplate->signingAlg);
+            break;
+        case crmfIssuer:
+            retVal = IS_NOT_NULL(certTemplate->issuer);
+            break;
+        case crmfValidity:
+            retVal = IS_NOT_NULL(certTemplate->validity);
+            break;
+        case crmfSubject:
+            retVal = IS_NOT_NULL(certTemplate->subject);
+            break;
+        case crmfPublicKey:
+            retVal = IS_NOT_NULL(certTemplate->publicKey);
+            break;
+        case crmfIssuerUID:
+            retVal = crmf_item_has_data(&certTemplate->issuerUID);
+            break;
+        case crmfSubjectUID:
+            retVal = crmf_item_has_data(&certTemplate->subjectUID);
+            break;
+        case crmfExtension:
+            retVal = IS_NOT_NULL(certTemplate->extensions);
+            break;
+        default:
+            retVal = PR_FALSE;
+    }
+    return retVal;
+}
diff --git a/security/nss/lib/crmf/crmft.h b/security/nss/lib/crmf/crmft.h
new file mode 100644
index 0000000000..8d83cf1e61
--- /dev/null
+++ b/security/nss/lib/crmf/crmft.h
@@ -0,0 +1,186 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Header file with all of the structures and types that will be exported
+ * by the security library for implementation of CRMF.
+ */
+
+#ifndef _CRMFT_H_
+#define _CRMFT_H_
+
+/* Use these enumerated values for adding fields to the certificate request */
+typedef enum {
+    crmfVersion = 0,
+    crmfSerialNumber = 1,
+    crmfSigningAlg = 2,
+    crmfIssuer = 3,
+    crmfValidity = 4,
+    crmfSubject = 5,
+    crmfPublicKey = 6,
+    crmfIssuerUID = 7,
+    crmfSubjectUID = 8,
+    crmfExtension = 9
+} CRMFCertTemplateField;
+
+/*
+ * An enumeration for the different types of controls.
+ */
+typedef enum {
+    crmfNoControl = 0,
+    crmfRegTokenControl = 1,
+    crmfAuthenticatorControl = 2,
+    crmfPKIPublicationInfoControl = 3,
+    crmfPKIArchiveOptionsControl = 4,
+    crmfOldCertIDControl = 5,
+    crmfProtocolEncrKeyControl = 6
+} CRMFControlType;
+
+/*
+ * The possible values that are passed into CRMF_CreatePKIPublicationInfo
+ */
+typedef enum {
+    crmfDontPublish = 0,
+    crmfPleasePublish = 1
+} CRMFPublicationAction;
+
+/*
+ * An enumeration for the possible for pubMethod which is a part of
+ * the SinglePubInfo ASN1 type.
+ */
+typedef enum {
+    crmfDontCare = 0,
+    crmfX500 = 1,
+    crmfWeb = 2,
+    crmfLdap = 3
+} CRMFPublicationMethod;
+
+/*
+ * An enumeration for the different options for PKIArchiveOptions type.
+ */
+typedef enum {
+    crmfNoArchiveOptions = 0,
+    crmfEncryptedPrivateKey = 1,
+    crmfKeyGenParameters = 2,
+    crmfArchiveRemGenPrivKey = 3
+} CRMFPKIArchiveOptionsType;
+
+/*
+ * An enumeration for the different options for ProofOfPossession
+ */
+typedef enum {
+    crmfNoPOPChoice = 0,
+    crmfRAVerified = 1,
+    crmfSignature = 2,
+    crmfKeyEncipherment = 3,
+    crmfKeyAgreement = 4
+} CRMFPOPChoice;
+
+/*
+ * An enumertion type for options for the authInfo field of the
+ * CRMFPOPOSigningKeyInput structure.
+ */
+typedef enum {
+    crmfSender = 0,
+    crmfPublicKeyMAC = 1
+} CRMFPOPOSkiInputAuthChoice;
+
+/*
+ * An enumeration for the SubsequentMessage Options.
+ */
+typedef enum {
+    crmfNoSubseqMess = 0,
+    crmfEncrCert = 1,
+    crmfChallengeResp = 2
+} CRMFSubseqMessOptions;
+
+/*
+ * An enumeration for the choice used by POPOPrivKey.
+ */
+typedef enum {
+    crmfNoMessage = 0,
+    crmfThisMessage = 1,
+    crmfSubsequentMessage = 2,
+    crmfDHMAC = 3
+} CRMFPOPOPrivKeyChoice;
+
+/*
+ * An enumeration for the choices for the EncryptedKey type.
+ */
+typedef enum {
+    crmfNoEncryptedKeyChoice = 0,
+    crmfEncryptedValueChoice = 1,
+    crmfEnvelopedDataChoice = 2
+} CRMFEncryptedKeyChoice;
+
+/*
+ * TYPE: CRMFEncoderOutputCallback
+ *     This function type defines a prototype for a function that the CRMF
+ *     library expects when encoding is performed.
+ *
+ * ARGUMENTS:
+ *     arg
+ *         This will be a pointer the user passed into an encoding function.
+ *         The user of the library is free to use this pointer in any way.
+ *         The most common use is to keep around a buffer for writing out
+ *         the DER encoded bytes.
+ *     buf
+ *         The DER encoded bytes that should be written out.
+ *     len
+ *         The number of DER encoded bytes to write out.
+ *
+ */
+typedef void (*CRMFEncoderOutputCallback)(void *arg,
+                                          const char *buf,
+                                          unsigned long len);
+
+/*
+ * Type for the function that gets a password.  Just in case we ever
+ * need to support publicKeyMAC for POPOSigningKeyInput
+ */
+typedef SECItem *(*CRMFMACPasswordCallback)(void *arg);
+
+typedef struct CRMFOptionalValidityStr CRMFOptionalValidity;
+typedef struct CRMFValidityCreationInfoStr CRMFGetValidity;
+typedef struct CRMFCertTemplateStr CRMFCertTemplate;
+typedef struct CRMFCertRequestStr CRMFCertRequest;
+typedef struct CRMFCertReqMsgStr CRMFCertReqMsg;
+typedef struct CRMFCertReqMessagesStr CRMFCertReqMessages;
+typedef struct CRMFProofOfPossessionStr CRMFProofOfPossession;
+typedef struct CRMFPOPOSigningKeyStr CRMFPOPOSigningKey;
+typedef struct CRMFPOPOSigningKeyInputStr CRMFPOPOSigningKeyInput;
+typedef struct CRMFPOPOPrivKeyStr CRMFPOPOPrivKey;
+typedef struct CRMFPKIPublicationInfoStr CRMFPKIPublicationInfo;
+typedef struct CRMFSinglePubInfoStr CRMFSinglePubInfo;
+typedef struct CRMFPKIArchiveOptionsStr CRMFPKIArchiveOptions;
+typedef struct CRMFEncryptedKeyStr CRMFEncryptedKey;
+typedef struct CRMFEncryptedValueStr CRMFEncryptedValue;
+typedef struct CRMFCertIDStr CRMFCertID;
+typedef struct CRMFCertIDStr CRMFOldCertID;
+typedef CERTSubjectPublicKeyInfo CRMFProtocolEncrKey;
+typedef struct CRMFValidityCreationInfoStr CRMFValidityCreationInfo;
+typedef struct CRMFCertExtCreationInfoStr CRMFCertExtCreationInfo;
+typedef struct CRMFPKMACValueStr CRMFPKMACValue;
+typedef struct CRMFAttributeStr CRMFAttribute;
+typedef struct CRMFControlStr CRMFControl;
+typedef CERTGeneralName CRMFGeneralName;
+typedef struct CRMFCertExtensionStr CRMFCertExtension;
+
+struct CRMFValidityCreationInfoStr {
+    PRTime *notBefore;
+    PRTime *notAfter;
+};
+
+struct CRMFCertExtCreationInfoStr {
+    CRMFCertExtension **extensions;
+    int numExtensions;
+};
+
+/*
+ * Some ASN1 Templates that may be needed.
+ */
+extern const SEC_ASN1Template CRMFCertReqMessagesTemplate[];
+extern const SEC_ASN1Template CRMFCertRequestTemplate[];
+
+#endif /*_CRMFT_H_*/
diff --git a/security/nss/lib/crmf/crmftmpl.c b/security/nss/lib/crmf/crmftmpl.c
new file mode 100644
index 0000000000..265a15dd5d
--- /dev/null
+++ b/security/nss/lib/crmf/crmftmpl.c
@@ -0,0 +1,240 @@
+/* -*- Mode: C; tab-width: 8 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "crmf.h"
+#include "crmfi.h"
+#include "secoid.h"
+#include "secasn1.h"
+
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+SEC_ASN1_MKSUB(SEC_AnyTemplate)
+SEC_ASN1_MKSUB(SEC_NullTemplate)
+SEC_ASN1_MKSUB(SEC_BitStringTemplate)
+SEC_ASN1_MKSUB(SEC_IntegerTemplate)
+SEC_ASN1_MKSUB(SEC_OctetStringTemplate)
+SEC_ASN1_MKSUB(CERT_TimeChoiceTemplate)
+SEC_ASN1_MKSUB(CERT_SubjectPublicKeyInfoTemplate)
+SEC_ASN1_MKSUB(CERT_NameTemplate)
+
+/*
+ * It's all implicit tagging.
+ */
+
+const SEC_ASN1Template CRMFControlTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFControl) },
+    { SEC_ASN1_OBJECT_ID, offsetof(CRMFControl, derTag) },
+    { SEC_ASN1_ANY, offsetof(CRMFControl, derValue) },
+    { 0 }
+};
+
+static const SEC_ASN1Template CRMFCertExtensionTemplate[] = {
+    { SEC_ASN1_SEQUENCE,
+      0, NULL, sizeof(CRMFCertExtension) },
+    { SEC_ASN1_OBJECT_ID,
+      offsetof(CRMFCertExtension, id) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_BOOLEAN,
+      offsetof(CRMFCertExtension, critical) },
+    { SEC_ASN1_OCTET_STRING,
+      offsetof(CRMFCertExtension, value) },
+    { 0 }
+};
+
+static const SEC_ASN1Template CRMFSequenceOfCertExtensionTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF, 0, CRMFCertExtensionTemplate }
+};
+
+static const SEC_ASN1Template CRMFOptionalValidityTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFOptionalValidity) },
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_NO_STREAM |
+          SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN | 0,
+      offsetof(CRMFOptionalValidity, notBefore),
+      SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_NO_STREAM |
+          SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN | 1,
+      offsetof(CRMFOptionalValidity, notAfter),
+      SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
+    { 0 }
+};
+
+static const SEC_ASN1Template crmfPointerToNameTemplate[] = {
+    { SEC_ASN1_POINTER | SEC_ASN1_XTRN, 0, SEC_ASN1_SUB(CERT_NameTemplate) },
+    { 0 }
+};
+
+static const SEC_ASN1Template CRMFCertTemplateTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFCertTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+      offsetof(CRMFCertTemplate, version),
+      SEC_ASN1_SUB(SEC_IntegerTemplate) },
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN | 1,
+      offsetof(CRMFCertTemplate, serialNumber),
+      SEC_ASN1_SUB(SEC_IntegerTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 2,
+      offsetof(CRMFCertTemplate, signingAlg),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
+          SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | 3,
+      offsetof(CRMFCertTemplate, issuer), crmfPointerToNameTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER | 4,
+      offsetof(CRMFCertTemplate, validity),
+      CRMFOptionalValidityTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
+          SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | 5,
+      offsetof(CRMFCertTemplate, subject), crmfPointerToNameTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 6,
+      offsetof(CRMFCertTemplate, publicKey),
+      SEC_ASN1_SUB(CERT_SubjectPublicKeyInfoTemplate) },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL |
+          SEC_ASN1_XTRN | 7,
+      offsetof(CRMFCertTemplate, issuerUID),
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL |
+          SEC_ASN1_XTRN | 8,
+      offsetof(CRMFCertTemplate, subjectUID),
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_OPTIONAL |
+          SEC_ASN1_CONTEXT_SPECIFIC | 9,
+      offsetof(CRMFCertTemplate, extensions),
+      CRMFSequenceOfCertExtensionTemplate },
+    { 0 }
+};
+
+static const SEC_ASN1Template CRMFAttributeTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFAttribute) },
+    { SEC_ASN1_OBJECT_ID, offsetof(CRMFAttribute, derTag) },
+    { SEC_ASN1_ANY, offsetof(CRMFAttribute, derValue) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFCertRequestTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFCertRequest) },
+    { SEC_ASN1_INTEGER, offsetof(CRMFCertRequest, certReqId) },
+    { SEC_ASN1_INLINE, offsetof(CRMFCertRequest, certTemplate),
+      CRMFCertTemplateTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF,
+      offsetof(CRMFCertRequest, controls),
+      CRMFControlTemplate }, /* SEQUENCE SIZE (1...MAX)*/
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFCertReqMsgTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFCertReqMsg) },
+    { SEC_ASN1_POINTER, offsetof(CRMFCertReqMsg, certReq),
+      CRMFCertRequestTemplate },
+    { SEC_ASN1_ANY | SEC_ASN1_OPTIONAL,
+      offsetof(CRMFCertReqMsg, derPOP) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF,
+      offsetof(CRMFCertReqMsg, regInfo),
+      CRMFAttributeTemplate }, /* SEQUENCE SIZE (1...MAX)*/
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFCertReqMessagesTemplate[] = {
+    { SEC_ASN1_SEQUENCE_OF, offsetof(CRMFCertReqMessages, messages),
+      CRMFCertReqMsgTemplate, sizeof(CRMFCertReqMessages) }
+};
+
+const SEC_ASN1Template CRMFRAVerifiedTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | 0 | SEC_ASN1_XTRN,
+      0,
+      SEC_ASN1_SUB(SEC_NullTemplate) },
+    { 0 }
+};
+
+/* This template will need to add POPOSigningKeyInput eventually, maybe*/
+static const SEC_ASN1Template crmfPOPOSigningKeyTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFPOPOSigningKey) },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
+          SEC_ASN1_XTRN | 0,
+      offsetof(CRMFPOPOSigningKey, derInput),
+      SEC_ASN1_SUB(SEC_AnyTemplate) },
+    { SEC_ASN1_POINTER | SEC_ASN1_XTRN,
+      offsetof(CRMFPOPOSigningKey, algorithmIdentifier),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_BIT_STRING | SEC_ASN1_XTRN,
+      offsetof(CRMFPOPOSigningKey, signature),
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFPOPOSigningKeyTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | 1,
+      0,
+      crmfPOPOSigningKeyTemplate },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFThisMessageTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+      0,
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFSubsequentMessageTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
+      0,
+      SEC_ASN1_SUB(SEC_IntegerTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFDHMACTemplate[] = {
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
+      0,
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFPOPOKeyEnciphermentTemplate[] = {
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED |
+          SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
+      0,
+      SEC_ASN1_SUB(SEC_AnyTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFPOPOKeyAgreementTemplate[] = {
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED |
+          SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 3,
+      0,
+      SEC_ASN1_SUB(SEC_AnyTemplate) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFEncryptedValueTemplate[] = {
+    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRMFEncryptedValue) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 0,
+      offsetof(CRMFEncryptedValue, intendedAlg),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 1,
+      offsetof(CRMFEncryptedValue, symmAlg),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_OPTIONAL |
+          SEC_ASN1_XTRN | 2,
+      offsetof(CRMFEncryptedValue, encSymmKey),
+      SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_POINTER |
+          SEC_ASN1_XTRN | 3,
+      offsetof(CRMFEncryptedValue, keyAlg),
+      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_NO_STREAM | SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
+          SEC_ASN1_XTRN | 4,
+      offsetof(CRMFEncryptedValue, valueHint),
+      SEC_ASN1_SUB(SEC_OctetStringTemplate) },
+    { SEC_ASN1_BIT_STRING, offsetof(CRMFEncryptedValue, encValue) },
+    { 0 }
+};
+
+const SEC_ASN1Template CRMFEncryptedKeyWithEncryptedValueTemplate[] = {
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED |
+          SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      0,
+      CRMFEncryptedValueTemplate },
+    { 0 }
+};
diff --git a/security/nss/lib/crmf/encutil.c b/security/nss/lib/crmf/encutil.c
new file mode 100644
index 0000000000..8ca7007b6c
--- /dev/null
+++ b/security/nss/lib/crmf/encutil.c
@@ -0,0 +1,33 @@
+/* -*- Mode: C; tab-width: 8 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "secasn1.h"
+#include "crmf.h"
+#include "crmfi.h"
+
+void
+crmf_encoder_out(void *arg, const char *buf, unsigned long len,
+                 int depth, SEC_ASN1EncodingPart data_kind)
+{
+    struct crmfEncoderOutput *output;
+
+    output = (struct crmfEncoderOutput *)arg;
+    output->fn(output->outputArg, buf, len);
+}
+
+SECStatus
+cmmf_user_encode(void *src, CRMFEncoderOutputCallback inCallback, void *inArg,
+                 const SEC_ASN1Template *inTemplate)
+{
+    struct crmfEncoderOutput output;
+
+    PORT_Assert(src != NULL);
+    if (src == NULL) {
+        return SECFailure;
+    }
+    output.fn = inCallback;
+    output.outputArg = inArg;
+    return SEC_ASN1Encode(src, inTemplate, crmf_encoder_out, &output);
+}
diff --git a/security/nss/lib/crmf/exports.gyp b/security/nss/lib/crmf/exports.gyp
new file mode 100644
index 0000000000..fca0097565
--- /dev/null
+++ b/security/nss/lib/crmf/exports.gyp
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_crmf_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'cmmf.h',
+            'cmmft.h',
+            'crmf.h',
+            'crmft.h'
+          ],
+          'destination': '<(nss_public_dist_dir)/<(module)'
+        },
+        {
+          'files': [
+            'cmmfi.h',
+            'cmmfit.h',
+            'crmfi.h',
+            'crmfit.h'
+          ],
+          'destination': '<(nss_private_dist_dir)/<(module)'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
diff --git a/security/nss/lib/crmf/manifest.mn b/security/nss/lib/crmf/manifest.mn
new file mode 100644
index 0000000000..8c687ea243
--- /dev/null
+++ b/security/nss/lib/crmf/manifest.mn
@@ -0,0 +1,47 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../..
+
+MODULE = nss
+
+EXPORTS = \
+	crmf.h	\
+	crmft.h	\
+	cmmf.h  \
+	cmmft.h \
+	$(NULL)
+
+PRIVATE_EXPORTS = \
+	crmfi.h   \
+	crmfit.h  \
+	cmmfi.h   \
+	cmmfit.h  \
+	$(NULL)
+
+CSRCS = crmfenc.c	\
+	crmftmpl.c	\
+	crmfreq.c	\
+	crmfpop.c	\
+	crmfdec.c	\
+	crmfget.c	\
+	crmfcont.c	\
+	cmmfasn1.c	\
+	cmmfresp.c	\
+	cmmfrec.c	\
+	cmmfchal.c	\
+	servget.c	\
+	encutil.c	\
+	respcli.c	\
+	respcmn.c	\
+	challcli.c	\
+	asn1cmn.c	\
+	$(NULL)
+
+LIBRARY_NAME = crmf
+SHARED_LIBRARY = $(NULL)
+
+# This part of the code, including all sub-dirs, can be optimized for size
+export ALLOW_OPT_CODE_SIZE = 1
diff --git a/security/nss/lib/crmf/respcli.c b/security/nss/lib/crmf/respcli.c
new file mode 100644
index 0000000000..aaec0136f1
--- /dev/null
+++ b/security/nss/lib/crmf/respcli.c
@@ -0,0 +1,136 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This file will contain all routines needed by a client that has
+ * to parse a CMMFCertRepContent structure and retirieve the appropriate
+ * data.
+ */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "crmf.h"
+#include "crmfi.h"
+#include "secitem.h"
+#include "secder.h"
+#include "secasn1.h"
+
+CMMFCertRepContent *
+CMMF_CreateCertRepContentFromDER(CERTCertDBHandle *db, const char *buf,
+                                 long len)
+{
+    PLArenaPool *poolp;
+    CMMFCertRepContent *certRepContent;
+    SECStatus rv;
+    int i;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    certRepContent = PORT_ArenaZNew(poolp, CMMFCertRepContent);
+    if (certRepContent == NULL) {
+        goto loser;
+    }
+    certRepContent->poolp = poolp;
+    rv = SEC_ASN1Decode(poolp, certRepContent, CMMFCertRepContentTemplate,
+                        buf, len);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (certRepContent->response != NULL) {
+        for (i = 0; certRepContent->response[i] != NULL; i++) {
+            rv = cmmf_decode_process_cert_response(poolp, db,
+                                                   certRepContent->response[i]);
+            if (rv != SECSuccess) {
+                goto loser;
+            }
+        }
+    }
+    certRepContent->isDecoded = PR_TRUE;
+    return certRepContent;
+loser:
+    PORT_FreeArena(poolp, PR_FALSE);
+    return NULL;
+}
+
+long
+CMMF_CertResponseGetCertReqId(CMMFCertResponse *inCertResp)
+{
+    PORT_Assert(inCertResp != NULL);
+    if (inCertResp == NULL) {
+        return -1;
+    }
+    return DER_GetInteger(&inCertResp->certReqId);
+}
+
+PRBool
+cmmf_CertRepContentIsIndexValid(CMMFCertRepContent *inCertRepContent,
+                                int inIndex)
+{
+    int numResponses;
+
+    PORT_Assert(inCertRepContent != NULL);
+    numResponses = CMMF_CertRepContentGetNumResponses(inCertRepContent);
+    return (PRBool)(inIndex >= 0 && inIndex < numResponses);
+}
+
+CMMFCertResponse *
+CMMF_CertRepContentGetResponseAtIndex(CMMFCertRepContent *inCertRepContent,
+                                      int inIndex)
+{
+    CMMFCertResponse *certResponse;
+    SECStatus rv;
+
+    PORT_Assert(inCertRepContent != NULL &&
+                cmmf_CertRepContentIsIndexValid(inCertRepContent, inIndex));
+    if (inCertRepContent == NULL ||
+        !cmmf_CertRepContentIsIndexValid(inCertRepContent, inIndex)) {
+        return NULL;
+    }
+    certResponse = PORT_ZNew(CMMFCertResponse);
+    if (certResponse) {
+        rv = cmmf_CopyCertResponse(NULL, certResponse,
+                                   inCertRepContent->response[inIndex]);
+        if (rv != SECSuccess) {
+            CMMF_DestroyCertResponse(certResponse);
+            certResponse = NULL;
+        }
+    }
+    return certResponse;
+}
+
+CMMFPKIStatus
+CMMF_CertResponseGetPKIStatusInfoStatus(CMMFCertResponse *inCertResp)
+{
+    PORT_Assert(inCertResp != NULL);
+    if (inCertResp == NULL) {
+        return cmmfNoPKIStatus;
+    }
+    return cmmf_PKIStatusInfoGetStatus(&inCertResp->status);
+}
+
+CERTCertificate *
+CMMF_CertResponseGetCertificate(CMMFCertResponse *inCertResp,
+                                CERTCertDBHandle *inCertdb)
+{
+    PORT_Assert(inCertResp != NULL);
+    if (inCertResp == NULL || inCertResp->certifiedKeyPair == NULL) {
+        return NULL;
+    }
+
+    return cmmf_CertOrEncCertGetCertificate(
+        &inCertResp->certifiedKeyPair->certOrEncCert, inCertdb);
+}
+
+CERTCertList *
+CMMF_CertRepContentGetCAPubs(CMMFCertRepContent *inCertRepContent)
+{
+    PORT_Assert(inCertRepContent != NULL);
+    if (inCertRepContent == NULL || inCertRepContent->caPubs == NULL) {
+        return NULL;
+    }
+    return cmmf_MakeCertList(inCertRepContent->caPubs);
+}
diff --git a/security/nss/lib/crmf/respcmn.c b/security/nss/lib/crmf/respcmn.c
new file mode 100644
index 0000000000..f9e4155a33
--- /dev/null
+++ b/security/nss/lib/crmf/respcmn.c
@@ -0,0 +1,399 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "secitem.h"
+#include "secder.h"
+
+SECStatus
+cmmf_DestroyPKIStatusInfo(CMMFPKIStatusInfo *info, PRBool freeit)
+{
+    if (info->status.data != NULL) {
+        PORT_Free(info->status.data);
+        info->status.data = NULL;
+    }
+    if (info->statusString.data != NULL) {
+        PORT_Free(info->statusString.data);
+        info->statusString.data = NULL;
+    }
+    if (info->failInfo.data != NULL) {
+        PORT_Free(info->failInfo.data);
+        info->failInfo.data = NULL;
+    }
+    if (freeit) {
+        PORT_Free(info);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CMMF_DestroyCertResponse(CMMFCertResponse *inCertResp)
+{
+    PORT_Assert(inCertResp != NULL);
+    if (inCertResp != NULL) {
+        if (inCertResp->certReqId.data != NULL) {
+            PORT_Free(inCertResp->certReqId.data);
+        }
+        cmmf_DestroyPKIStatusInfo(&inCertResp->status, PR_FALSE);
+        if (inCertResp->certifiedKeyPair != NULL) {
+            CMMF_DestroyCertifiedKeyPair(inCertResp->certifiedKeyPair);
+        }
+        PORT_Free(inCertResp);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CMMF_DestroyCertRepContent(CMMFCertRepContent *inCertRepContent)
+{
+    PORT_Assert(inCertRepContent != NULL);
+    if (inCertRepContent != NULL) {
+        CMMFCertResponse **pResponse = inCertRepContent->response;
+        if (pResponse != NULL) {
+            for (; *pResponse != NULL; pResponse++) {
+                CMMFCertifiedKeyPair *certKeyPair = (*pResponse)->certifiedKeyPair;
+                /* XXX Why not call CMMF_DestroyCertifiedKeyPair or
+                 ** XXX cmmf_DestroyCertOrEncCert ?
+                 */
+                if (certKeyPair != NULL &&
+                    certKeyPair->certOrEncCert.choice == cmmfCertificate &&
+                    certKeyPair->certOrEncCert.cert.certificate != NULL) {
+                    CERT_DestroyCertificate(certKeyPair->certOrEncCert.cert.certificate);
+                    certKeyPair->certOrEncCert.cert.certificate = NULL;
+                }
+            }
+        }
+        if (inCertRepContent->caPubs) {
+            CERTCertificate **caPubs = inCertRepContent->caPubs;
+            for (; *caPubs; ++caPubs) {
+                CERT_DestroyCertificate(*caPubs);
+                *caPubs = NULL;
+            }
+        }
+        if (inCertRepContent->poolp != NULL) {
+            PORT_FreeArena(inCertRepContent->poolp, PR_TRUE);
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CMMF_DestroyPOPODecKeyChallContent(CMMFPOPODecKeyChallContent *inDecKeyCont)
+{
+    PORT_Assert(inDecKeyCont != NULL);
+    if (inDecKeyCont != NULL && inDecKeyCont->poolp) {
+        PORT_FreeArena(inDecKeyCont->poolp, PR_FALSE);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+crmf_create_prtime(SECItem *src, PRTime **dest)
+{
+    *dest = PORT_ZNew(PRTime);
+    return DER_DecodeTimeChoice(*dest, src);
+}
+
+CRMFCertExtension *
+crmf_copy_cert_extension(PLArenaPool *poolp, CRMFCertExtension *inExtension)
+{
+    PRBool isCritical;
+    SECOidTag id;
+    SECItem *data;
+    CRMFCertExtension *newExt;
+
+    PORT_Assert(inExtension != NULL);
+    if (inExtension == NULL) {
+        return NULL;
+    }
+    id = CRMF_CertExtensionGetOidTag(inExtension);
+    isCritical = CRMF_CertExtensionGetIsCritical(inExtension);
+    data = CRMF_CertExtensionGetValue(inExtension);
+    newExt = crmf_create_cert_extension(poolp, id,
+                                        isCritical,
+                                        data);
+    SECITEM_FreeItem(data, PR_TRUE);
+    return newExt;
+}
+
+static SECItem *
+cmmf_encode_certificate(CERTCertificate *inCert)
+{
+    return SEC_ASN1EncodeItem(NULL, NULL, inCert,
+                              SEC_ASN1_GET(SEC_SignedCertificateTemplate));
+}
+
+CERTCertList *
+cmmf_MakeCertList(CERTCertificate **inCerts)
+{
+    CERTCertList *certList;
+    CERTCertificate *currCert;
+    SECItem *derCert, *freeCert = NULL;
+    SECStatus rv;
+    int i;
+
+    certList = CERT_NewCertList();
+    if (certList == NULL) {
+        return NULL;
+    }
+    for (i = 0; inCerts[i] != NULL; i++) {
+        derCert = &inCerts[i]->derCert;
+        if (derCert->data == NULL) {
+            derCert = freeCert = cmmf_encode_certificate(inCerts[i]);
+        }
+        currCert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
+                                           derCert, NULL, PR_FALSE, PR_TRUE);
+        if (freeCert != NULL) {
+            SECITEM_FreeItem(freeCert, PR_TRUE);
+            freeCert = NULL;
+        }
+        if (currCert == NULL) {
+            goto loser;
+        }
+        rv = CERT_AddCertToListTail(certList, currCert);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    return certList;
+loser:
+    CERT_DestroyCertList(certList);
+    return NULL;
+}
+
+CMMFPKIStatus
+cmmf_PKIStatusInfoGetStatus(CMMFPKIStatusInfo *inStatus)
+{
+    long derVal;
+
+    derVal = DER_GetInteger(&inStatus->status);
+    if (derVal == -1 || derVal < cmmfGranted || derVal >= cmmfNumPKIStatus) {
+        return cmmfNoPKIStatus;
+    }
+    return (CMMFPKIStatus)derVal;
+}
+
+int
+CMMF_CertRepContentGetNumResponses(CMMFCertRepContent *inCertRepContent)
+{
+    int numResponses = 0;
+    PORT_Assert(inCertRepContent != NULL);
+    if (inCertRepContent != NULL && inCertRepContent->response != NULL) {
+        while (inCertRepContent->response[numResponses] != NULL) {
+            numResponses++;
+        }
+    }
+    return numResponses;
+}
+
+SECStatus
+cmmf_DestroyCertOrEncCert(CMMFCertOrEncCert *certOrEncCert, PRBool freeit)
+{
+    switch (certOrEncCert->choice) {
+        case cmmfCertificate:
+            CERT_DestroyCertificate(certOrEncCert->cert.certificate);
+            certOrEncCert->cert.certificate = NULL;
+            break;
+        case cmmfEncryptedCert:
+            crmf_destroy_encrypted_value(certOrEncCert->cert.encryptedCert,
+                                         PR_TRUE);
+            certOrEncCert->cert.encryptedCert = NULL;
+            break;
+        default:
+            break;
+    }
+    if (freeit) {
+        PORT_Free(certOrEncCert);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+cmmf_copy_secitem(PLArenaPool *poolp, SECItem *dest, SECItem *src)
+{
+    SECStatus rv;
+
+    if (src->data != NULL) {
+        rv = SECITEM_CopyItem(poolp, dest, src);
+    } else {
+        dest->data = NULL;
+        dest->len = 0;
+        rv = SECSuccess;
+    }
+    return rv;
+}
+
+SECStatus
+CMMF_DestroyCertifiedKeyPair(CMMFCertifiedKeyPair *inCertKeyPair)
+{
+    PORT_Assert(inCertKeyPair != NULL);
+    if (inCertKeyPair != NULL) {
+        cmmf_DestroyCertOrEncCert(&inCertKeyPair->certOrEncCert, PR_FALSE);
+        if (inCertKeyPair->privateKey) {
+            crmf_destroy_encrypted_value(inCertKeyPair->privateKey, PR_TRUE);
+        }
+        if (inCertKeyPair->derPublicationInfo.data) {
+            PORT_Free(inCertKeyPair->derPublicationInfo.data);
+        }
+        PORT_Free(inCertKeyPair);
+    }
+    return SECSuccess;
+}
+
+SECStatus
+cmmf_CopyCertResponse(PLArenaPool *poolp,
+                      CMMFCertResponse *dest,
+                      CMMFCertResponse *src)
+{
+    SECStatus rv;
+
+    if (src->certReqId.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &dest->certReqId, &src->certReqId);
+        if (rv != SECSuccess) {
+            return rv;
+        }
+    }
+    rv = cmmf_CopyPKIStatusInfo(poolp, &dest->status, &src->status);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    if (src->certifiedKeyPair != NULL) {
+        CMMFCertifiedKeyPair *destKeyPair;
+
+        destKeyPair = (poolp == NULL) ? PORT_ZNew(CMMFCertifiedKeyPair) : PORT_ArenaZNew(poolp, CMMFCertifiedKeyPair);
+        if (!destKeyPair) {
+            return SECFailure;
+        }
+        rv = cmmf_CopyCertifiedKeyPair(poolp, destKeyPair,
+                                       src->certifiedKeyPair);
+        if (rv != SECSuccess) {
+            if (!poolp) {
+                CMMF_DestroyCertifiedKeyPair(destKeyPair);
+            }
+            return rv;
+        }
+        dest->certifiedKeyPair = destKeyPair;
+    }
+    return SECSuccess;
+}
+
+static SECStatus
+cmmf_CopyCertOrEncCert(PLArenaPool *poolp, CMMFCertOrEncCert *dest,
+                       CMMFCertOrEncCert *src)
+{
+    SECStatus rv = SECSuccess;
+    CRMFEncryptedValue *encVal;
+
+    dest->choice = src->choice;
+    rv = cmmf_copy_secitem(poolp, &dest->derValue, &src->derValue);
+    switch (src->choice) {
+        case cmmfCertificate:
+            dest->cert.certificate = CERT_DupCertificate(src->cert.certificate);
+            break;
+        case cmmfEncryptedCert:
+            encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) : PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+            if (encVal == NULL) {
+                return SECFailure;
+            }
+            rv = crmf_copy_encryptedvalue(poolp, src->cert.encryptedCert, encVal);
+            if (rv != SECSuccess) {
+                if (!poolp) {
+                    crmf_destroy_encrypted_value(encVal, PR_TRUE);
+                }
+                return rv;
+            }
+            dest->cert.encryptedCert = encVal;
+            break;
+        default:
+            rv = SECFailure;
+    }
+    return rv;
+}
+
+SECStatus
+cmmf_CopyCertifiedKeyPair(PLArenaPool *poolp, CMMFCertifiedKeyPair *dest,
+                          CMMFCertifiedKeyPair *src)
+{
+    SECStatus rv;
+
+    rv = cmmf_CopyCertOrEncCert(poolp, &dest->certOrEncCert,
+                                &src->certOrEncCert);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+
+    if (src->privateKey != NULL) {
+        CRMFEncryptedValue *encVal;
+
+        encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) : PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+        if (encVal == NULL) {
+            return SECFailure;
+        }
+        rv = crmf_copy_encryptedvalue(poolp, src->privateKey,
+                                      encVal);
+        if (rv != SECSuccess) {
+            if (!poolp) {
+                crmf_destroy_encrypted_value(encVal, PR_TRUE);
+            }
+            return rv;
+        }
+        dest->privateKey = encVal;
+    }
+    rv = cmmf_copy_secitem(poolp, &dest->derPublicationInfo,
+                           &src->derPublicationInfo);
+    return rv;
+}
+
+SECStatus
+cmmf_CopyPKIStatusInfo(PLArenaPool *poolp, CMMFPKIStatusInfo *dest,
+                       CMMFPKIStatusInfo *src)
+{
+    SECStatus rv;
+
+    rv = cmmf_copy_secitem(poolp, &dest->status, &src->status);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    rv = cmmf_copy_secitem(poolp, &dest->statusString, &src->statusString);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    rv = cmmf_copy_secitem(poolp, &dest->failInfo, &src->failInfo);
+    return rv;
+}
+
+CERTCertificate *
+cmmf_CertOrEncCertGetCertificate(CMMFCertOrEncCert *certOrEncCert,
+                                 CERTCertDBHandle *certdb)
+{
+    if (certOrEncCert->choice != cmmfCertificate ||
+        certOrEncCert->cert.certificate == NULL) {
+        return NULL;
+    }
+    return CERT_NewTempCertificate(certdb,
+                                   &certOrEncCert->cert.certificate->derCert,
+                                   NULL, PR_FALSE, PR_TRUE);
+}
+
+SECStatus
+cmmf_PKIStatusInfoSetStatus(CMMFPKIStatusInfo *statusInfo,
+                            PLArenaPool *poolp,
+                            CMMFPKIStatus inStatus)
+{
+    SECItem *dummy;
+
+    if (inStatus < cmmfGranted || inStatus >= cmmfNumPKIStatus) {
+        return SECFailure;
+    }
+
+    dummy = SEC_ASN1EncodeInteger(poolp, &statusInfo->status, inStatus);
+    PORT_Assert(dummy == &statusInfo->status);
+    if (dummy != &statusInfo->status) {
+        SECITEM_FreeItem(dummy, PR_TRUE);
+        return SECFailure;
+    }
+    return SECSuccess;
+}
diff --git a/security/nss/lib/crmf/servget.c b/security/nss/lib/crmf/servget.c
new file mode 100644
index 0000000000..6d576f8f10
--- /dev/null
+++ b/security/nss/lib/crmf/servget.c
@@ -0,0 +1,974 @@
+/* -*- Mode: C; tab-width: 8 -*-*/
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cmmf.h"
+#include "cmmfi.h"
+#include "secitem.h"
+#include "keyhi.h"
+#include "secder.h"
+
+CRMFEncryptedKeyChoice
+CRMF_EncryptedKeyGetChoice(CRMFEncryptedKey *inEncrKey)
+{
+    PORT_Assert(inEncrKey != NULL);
+    if (inEncrKey == NULL) {
+        return crmfNoEncryptedKeyChoice;
+    }
+    return inEncrKey->encKeyChoice;
+}
+
+CRMFEncryptedValue *
+CRMF_EncryptedKeyGetEncryptedValue(CRMFEncryptedKey *inEncrKey)
+{
+    CRMFEncryptedValue *newEncrValue = NULL;
+    SECStatus rv;
+
+    PORT_Assert(inEncrKey != NULL);
+    if (inEncrKey == NULL ||
+        CRMF_EncryptedKeyGetChoice(inEncrKey) != crmfEncryptedValueChoice) {
+        goto loser;
+    }
+    newEncrValue = PORT_ZNew(CRMFEncryptedValue);
+    if (newEncrValue == NULL) {
+        goto loser;
+    }
+    rv = crmf_copy_encryptedvalue(NULL, &inEncrKey->value.encryptedValue,
+                                  newEncrValue);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newEncrValue;
+loser:
+    if (newEncrValue != NULL) {
+        CRMF_DestroyEncryptedValue(newEncrValue);
+    }
+    return NULL;
+}
+
+static SECItem *
+crmf_get_encvalue_bitstring(SECItem *srcItem)
+{
+    SECItem *newItem = NULL;
+    SECStatus rv;
+
+    if (srcItem->data == NULL) {
+        return NULL;
+    }
+    newItem = PORT_ZNew(SECItem);
+    if (newItem == NULL) {
+        goto loser;
+    }
+    rv = crmf_make_bitstring_copy(NULL, newItem, srcItem);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newItem;
+loser:
+    if (newItem != NULL) {
+        SECITEM_FreeItem(newItem, PR_TRUE);
+    }
+    return NULL;
+}
+
+SECItem *
+CRMF_EncryptedValueGetEncSymmKey(CRMFEncryptedValue *inEncValue)
+{
+    if (inEncValue == NULL) {
+        return NULL;
+    }
+    return crmf_get_encvalue_bitstring(&inEncValue->encSymmKey);
+}
+
+SECItem *
+CRMF_EncryptedValueGetEncValue(CRMFEncryptedValue *inEncrValue)
+{
+    if (inEncrValue == NULL || inEncrValue->encValue.data == NULL) {
+        return NULL;
+    }
+    return crmf_get_encvalue_bitstring(&inEncrValue->encValue);
+}
+
+static SECAlgorithmID *
+crmf_get_encvalue_algid(SECAlgorithmID *srcAlg)
+{
+    SECStatus rv;
+    SECAlgorithmID *newAlgID;
+
+    if (srcAlg == NULL) {
+        return NULL;
+    }
+    rv = crmf_copy_encryptedvalue_secalg(NULL, srcAlg, &newAlgID);
+    if (rv != SECSuccess) {
+        return NULL;
+    }
+    return newAlgID;
+}
+
+SECAlgorithmID *
+CRMF_EncryptedValueGetIntendedAlg(CRMFEncryptedValue *inEncValue)
+{
+    if (inEncValue == NULL) {
+        return NULL;
+    }
+    return crmf_get_encvalue_algid(inEncValue->intendedAlg);
+}
+
+SECAlgorithmID *
+CRMF_EncryptedValueGetKeyAlg(CRMFEncryptedValue *inEncValue)
+{
+    if (inEncValue == NULL) {
+        return NULL;
+    }
+    return crmf_get_encvalue_algid(inEncValue->keyAlg);
+}
+
+SECAlgorithmID *
+CRMF_EncryptedValueGetSymmAlg(CRMFEncryptedValue *inEncValue)
+{
+    if (inEncValue == NULL) {
+        return NULL;
+    }
+    return crmf_get_encvalue_algid(inEncValue->symmAlg);
+}
+
+SECItem *
+CRMF_EncryptedValueGetValueHint(CRMFEncryptedValue *inEncValue)
+{
+    if (inEncValue == NULL || inEncValue->valueHint.data == NULL) {
+        return NULL;
+    }
+    return SECITEM_DupItem(&inEncValue->valueHint);
+}
+
+SECStatus
+CRMF_PKIArchiveOptionsGetArchiveRemGenPrivKey(CRMFPKIArchiveOptions *inOpt,
+                                              PRBool *destVal)
+{
+    if (inOpt == NULL || destVal == NULL ||
+        CRMF_PKIArchiveOptionsGetOptionType(inOpt) != crmfArchiveRemGenPrivKey) {
+        return SECFailure;
+    }
+    *destVal = (inOpt->option.archiveRemGenPrivKey.data[0] == hexFalse)
+                   ? PR_FALSE
+                   : PR_TRUE;
+    return SECSuccess;
+}
+
+CRMFEncryptedKey *
+CRMF_PKIArchiveOptionsGetEncryptedPrivKey(CRMFPKIArchiveOptions *inOpts)
+{
+    CRMFEncryptedKey *newEncrKey = NULL;
+    SECStatus rv;
+
+    PORT_Assert(inOpts != NULL);
+    if (inOpts == NULL ||
+        CRMF_PKIArchiveOptionsGetOptionType(inOpts) != crmfEncryptedPrivateKey) {
+        return NULL;
+    }
+    newEncrKey = PORT_ZNew(CRMFEncryptedKey);
+    if (newEncrKey == NULL) {
+        goto loser;
+    }
+    rv = crmf_copy_encryptedkey(NULL, &inOpts->option.encryptedKey,
+                                newEncrKey);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newEncrKey;
+loser:
+    if (newEncrKey != NULL) {
+        CRMF_DestroyEncryptedKey(newEncrKey);
+    }
+    return NULL;
+}
+
+SECItem *
+CRMF_PKIArchiveOptionsGetKeyGenParameters(CRMFPKIArchiveOptions *inOptions)
+{
+    if (inOptions == NULL ||
+        CRMF_PKIArchiveOptionsGetOptionType(inOptions) != crmfKeyGenParameters ||
+        inOptions->option.keyGenParameters.data == NULL) {
+        return NULL;
+    }
+    return SECITEM_DupItem(&inOptions->option.keyGenParameters);
+}
+
+CRMFPKIArchiveOptionsType
+CRMF_PKIArchiveOptionsGetOptionType(CRMFPKIArchiveOptions *inOptions)
+{
+    PORT_Assert(inOptions != NULL);
+    if (inOptions == NULL) {
+        return crmfNoArchiveOptions;
+    }
+    return inOptions->archOption;
+}
+
+static SECStatus
+crmf_extract_long_from_item(SECItem *intItem, long *destLong)
+{
+    *destLong = DER_GetInteger(intItem);
+    return (*destLong == -1) ? SECFailure : SECSuccess;
+}
+
+SECStatus
+CRMF_POPOPrivGetKeySubseqMess(CRMFPOPOPrivKey *inKey,
+                              CRMFSubseqMessOptions *destOpt)
+{
+    long value;
+    SECStatus rv;
+
+    PORT_Assert(inKey != NULL);
+    if (inKey == NULL ||
+        inKey->messageChoice != crmfSubsequentMessage) {
+        return SECFailure;
+    }
+    rv = crmf_extract_long_from_item(&inKey->message.subsequentMessage, &value);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+    switch (value) {
+        case 0:
+            *destOpt = crmfEncrCert;
+            break;
+        case 1:
+            *destOpt = crmfChallengeResp;
+            break;
+        default:
+            rv = SECFailure;
+    }
+    if (rv != SECSuccess) {
+        return rv;
+    }
+    return SECSuccess;
+}
+
+CRMFPOPOPrivKeyChoice
+CRMF_POPOPrivKeyGetChoice(CRMFPOPOPrivKey *inPrivKey)
+{
+    PORT_Assert(inPrivKey != NULL);
+    if (inPrivKey != NULL) {
+        return inPrivKey->messageChoice;
+    }
+    return crmfNoMessage;
+}
+
+SECStatus
+CRMF_POPOPrivKeyGetDHMAC(CRMFPOPOPrivKey *inKey, SECItem *destMAC)
+{
+    PORT_Assert(inKey != NULL);
+    if (inKey == NULL || inKey->message.dhMAC.data == NULL) {
+        return SECFailure;
+    }
+    return crmf_make_bitstring_copy(NULL, destMAC, &inKey->message.dhMAC);
+}
+
+SECStatus
+CRMF_POPOPrivKeyGetThisMessage(CRMFPOPOPrivKey *inKey,
+                               SECItem *destString)
+{
+    PORT_Assert(inKey != NULL);
+    if (inKey == NULL ||
+        inKey->messageChoice != crmfThisMessage) {
+        return SECFailure;
+    }
+
+    return crmf_make_bitstring_copy(NULL, destString,
+                                    &inKey->message.thisMessage);
+}
+
+SECAlgorithmID *
+CRMF_POPOSigningKeyGetAlgID(CRMFPOPOSigningKey *inSignKey)
+{
+    SECAlgorithmID *newAlgId = NULL;
+    SECStatus rv;
+
+    PORT_Assert(inSignKey != NULL);
+    if (inSignKey == NULL) {
+        return NULL;
+    }
+    newAlgId = PORT_ZNew(SECAlgorithmID);
+    if (newAlgId == NULL) {
+        goto loser;
+    }
+    rv = SECOID_CopyAlgorithmID(NULL, newAlgId,
+                                inSignKey->algorithmIdentifier);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newAlgId;
+
+loser:
+    if (newAlgId != NULL) {
+        SECOID_DestroyAlgorithmID(newAlgId, PR_TRUE);
+    }
+    return NULL;
+}
+
+SECItem *
+CRMF_POPOSigningKeyGetInput(CRMFPOPOSigningKey *inSignKey)
+{
+    PORT_Assert(inSignKey != NULL);
+    if (inSignKey == NULL || inSignKey->derInput.data == NULL) {
+        return NULL;
+    }
+    return SECITEM_DupItem(&inSignKey->derInput);
+}
+
+SECItem *
+CRMF_POPOSigningKeyGetSignature(CRMFPOPOSigningKey *inSignKey)
+{
+    SECItem *newSig = NULL;
+    SECStatus rv;
+
+    PORT_Assert(inSignKey != NULL);
+    if (inSignKey == NULL) {
+        return NULL;
+    }
+    newSig = PORT_ZNew(SECItem);
+    if (newSig == NULL) {
+        goto loser;
+    }
+    rv = crmf_make_bitstring_copy(NULL, newSig, &inSignKey->signature);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newSig;
+loser:
+    if (newSig != NULL) {
+        SECITEM_FreeItem(newSig, PR_TRUE);
+    }
+    return NULL;
+}
+
+static SECStatus
+crmf_copy_poposigningkey(PLArenaPool *poolp,
+                         CRMFPOPOSigningKey *inPopoSignKey,
+                         CRMFPOPOSigningKey *destPopoSignKey)
+{
+    SECStatus rv;
+
+    /* We don't support use of the POPOSigningKeyInput, so we'll only
+     * store away the DER encoding.
+     */
+    if (inPopoSignKey->derInput.data != NULL) {
+        rv = SECITEM_CopyItem(poolp, &destPopoSignKey->derInput,
+                              &inPopoSignKey->derInput);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    destPopoSignKey->algorithmIdentifier = (poolp == NULL) ? PORT_ZNew(SECAlgorithmID)
+                                                           : PORT_ArenaZNew(poolp, SECAlgorithmID);
+
+    if (destPopoSignKey->algorithmIdentifier == NULL) {
+        goto loser;
+    }
+    rv = SECOID_CopyAlgorithmID(poolp, destPopoSignKey->algorithmIdentifier,
+                                inPopoSignKey->algorithmIdentifier);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = crmf_make_bitstring_copy(poolp, &destPopoSignKey->signature,
+                                  &inPopoSignKey->signature);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return SECSuccess;
+loser:
+    if (poolp == NULL) {
+        CRMF_DestroyPOPOSigningKey(destPopoSignKey);
+    }
+    return SECFailure;
+}
+
+static SECStatus
+crmf_copy_popoprivkey(PLArenaPool *poolp,
+                      CRMFPOPOPrivKey *srcPrivKey,
+                      CRMFPOPOPrivKey *destPrivKey)
+{
+    SECStatus rv;
+
+    destPrivKey->messageChoice = srcPrivKey->messageChoice;
+    switch (destPrivKey->messageChoice) {
+        case crmfThisMessage:
+        case crmfDHMAC:
+            /* I've got a union, so taking the address of one, will also give
+             * me a pointer to the other (eg, message.dhMAC)
+             */
+            rv = crmf_make_bitstring_copy(poolp, &destPrivKey->message.thisMessage,
+                                          &srcPrivKey->message.thisMessage);
+            break;
+        case crmfSubsequentMessage:
+            rv = SECITEM_CopyItem(poolp, &destPrivKey->message.subsequentMessage,
+                                  &srcPrivKey->message.subsequentMessage);
+            break;
+        default:
+            rv = SECFailure;
+    }
+
+    if (rv != SECSuccess && poolp == NULL) {
+        CRMF_DestroyPOPOPrivKey(destPrivKey);
+    }
+    return rv;
+}
+
+static CRMFProofOfPossession *
+crmf_copy_pop(PLArenaPool *poolp, CRMFProofOfPossession *srcPOP)
+{
+    CRMFProofOfPossession *newPOP;
+    SECStatus rv;
+
+    /*
+     * Proof Of Possession structures are always part of the Request
+     * message, so there will always be an arena for allocating memory.
+     */
+    if (poolp == NULL) {
+        return NULL;
+    }
+    newPOP = PORT_ArenaZNew(poolp, CRMFProofOfPossession);
+    if (newPOP == NULL) {
+        return NULL;
+    }
+    switch (srcPOP->popUsed) {
+        case crmfRAVerified:
+            newPOP->popChoice.raVerified.data = NULL;
+            newPOP->popChoice.raVerified.len = 0;
+            break;
+        case crmfSignature:
+            rv = crmf_copy_poposigningkey(poolp, &srcPOP->popChoice.signature,
+                                          &newPOP->popChoice.signature);
+            if (rv != SECSuccess) {
+                goto loser;
+            }
+            break;
+        case crmfKeyEncipherment:
+        case crmfKeyAgreement:
+            /* We've got a union, so a pointer to one, is a pointer to the
+             * other one.
+             */
+            rv = crmf_copy_popoprivkey(poolp, &srcPOP->popChoice.keyEncipherment,
+                                       &newPOP->popChoice.keyEncipherment);
+            if (rv != SECSuccess) {
+                goto loser;
+            }
+            break;
+        default:
+            goto loser;
+    }
+    newPOP->popUsed = srcPOP->popUsed;
+    return newPOP;
+
+loser:
+    return NULL;
+}
+
+static CRMFCertReqMsg *
+crmf_copy_cert_req_msg(CRMFCertReqMsg *srcReqMsg)
+{
+    CRMFCertReqMsg *newReqMsg;
+    PLArenaPool *poolp;
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        return NULL;
+    }
+    newReqMsg = PORT_ArenaZNew(poolp, CRMFCertReqMsg);
+    if (newReqMsg == NULL) {
+        PORT_FreeArena(poolp, PR_TRUE);
+        return NULL;
+    }
+
+    newReqMsg->poolp = poolp;
+    newReqMsg->certReq = crmf_copy_cert_request(poolp, srcReqMsg->certReq);
+    if (newReqMsg->certReq == NULL) {
+        goto loser;
+    }
+    newReqMsg->pop = crmf_copy_pop(poolp, srcReqMsg->pop);
+    if (newReqMsg->pop == NULL) {
+        goto loser;
+    }
+    /* None of my set/get routines operate on the regInfo field, so
+     * for now, that won't get copied over.
+     */
+    return newReqMsg;
+
+loser:
+    CRMF_DestroyCertReqMsg(newReqMsg);
+    return NULL;
+}
+
+CRMFCertReqMsg *
+CRMF_CertReqMessagesGetCertReqMsgAtIndex(CRMFCertReqMessages *inReqMsgs,
+                                         int index)
+{
+    int numMsgs;
+
+    PORT_Assert(inReqMsgs != NULL && index >= 0);
+    if (inReqMsgs == NULL) {
+        return NULL;
+    }
+    numMsgs = CRMF_CertReqMessagesGetNumMessages(inReqMsgs);
+    if (index < 0 || index >= numMsgs) {
+        return NULL;
+    }
+    return crmf_copy_cert_req_msg(inReqMsgs->messages[index]);
+}
+
+int
+CRMF_CertReqMessagesGetNumMessages(CRMFCertReqMessages *inCertReqMsgs)
+{
+    int numMessages = 0;
+
+    PORT_Assert(inCertReqMsgs != NULL);
+    if (inCertReqMsgs == NULL) {
+        return 0;
+    }
+    while (inCertReqMsgs->messages[numMessages] != NULL) {
+        numMessages++;
+    }
+    return numMessages;
+}
+
+CRMFCertRequest *
+CRMF_CertReqMsgGetCertRequest(CRMFCertReqMsg *inCertReqMsg)
+{
+    PLArenaPool *poolp = NULL;
+    CRMFCertRequest *newCertReq = NULL;
+
+    PORT_Assert(inCertReqMsg != NULL);
+
+    poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    if (poolp == NULL) {
+        goto loser;
+    }
+    newCertReq = crmf_copy_cert_request(poolp, inCertReqMsg->certReq);
+    if (newCertReq == NULL) {
+        goto loser;
+    }
+    newCertReq->poolp = poolp;
+    return newCertReq;
+loser:
+    if (poolp != NULL) {
+        PORT_FreeArena(poolp, PR_FALSE);
+    }
+    return NULL;
+}
+
+SECStatus
+CRMF_CertReqMsgGetID(CRMFCertReqMsg *inCertReqMsg, long *destID)
+{
+    PORT_Assert(inCertReqMsg != NULL && destID != NULL);
+    if (inCertReqMsg == NULL || inCertReqMsg->certReq == NULL) {
+        return SECFailure;
+    }
+    return crmf_extract_long_from_item(&inCertReqMsg->certReq->certReqId,
+                                       destID);
+}
+
+SECStatus
+CRMF_CertReqMsgGetPOPKeyAgreement(CRMFCertReqMsg *inCertReqMsg,
+                                  CRMFPOPOPrivKey **destKey)
+{
+    PORT_Assert(inCertReqMsg != NULL && destKey != NULL);
+    if (inCertReqMsg == NULL || destKey == NULL ||
+        CRMF_CertReqMsgGetPOPType(inCertReqMsg) != crmfKeyAgreement) {
+        return SECFailure;
+    }
+    *destKey = PORT_ZNew(CRMFPOPOPrivKey);
+    if (*destKey == NULL) {
+        return SECFailure;
+    }
+    return crmf_copy_popoprivkey(NULL,
+                                 &inCertReqMsg->pop->popChoice.keyAgreement,
+                                 *destKey);
+}
+
+SECStatus
+CRMF_CertReqMsgGetPOPKeyEncipherment(CRMFCertReqMsg *inCertReqMsg,
+                                     CRMFPOPOPrivKey **destKey)
+{
+    PORT_Assert(inCertReqMsg != NULL && destKey != NULL);
+    if (inCertReqMsg == NULL || destKey == NULL ||
+        CRMF_CertReqMsgGetPOPType(inCertReqMsg) != crmfKeyEncipherment) {
+        return SECFailure;
+    }
+    *destKey = PORT_ZNew(CRMFPOPOPrivKey);
+    if (*destKey == NULL) {
+        return SECFailure;
+    }
+    return crmf_copy_popoprivkey(NULL,
+                                 &inCertReqMsg->pop->popChoice.keyEncipherment,
+                                 *destKey);
+}
+
+SECStatus
+CRMF_CertReqMsgGetPOPOSigningKey(CRMFCertReqMsg *inCertReqMsg,
+                                 CRMFPOPOSigningKey **destKey)
+{
+    CRMFProofOfPossession *pop;
+    PORT_Assert(inCertReqMsg != NULL);
+    if (inCertReqMsg == NULL) {
+        return SECFailure;
+    }
+    pop = inCertReqMsg->pop;
+    ;
+    if (pop->popUsed != crmfSignature) {
+        return SECFailure;
+    }
+    *destKey = PORT_ZNew(CRMFPOPOSigningKey);
+    if (*destKey == NULL) {
+        return SECFailure;
+    }
+    return crmf_copy_poposigningkey(NULL, &pop->popChoice.signature, *destKey);
+}
+
+static SECStatus
+crmf_copy_name(CERTName *destName, CERTName *srcName)
+{
+    PLArenaPool *poolp = NULL;
+    SECStatus rv;
+
+    if (destName->arena != NULL) {
+        poolp = destName->arena;
+    } else {
+        poolp = PORT_NewArena(CRMF_DEFAULT_ARENA_SIZE);
+    }
+    if (poolp == NULL) {
+        return SECFailure;
+    }
+    /* Need to do this so that CERT_CopyName doesn't free out
+     * the arena from underneath us.
+     */
+    destName->arena = NULL;
+    rv = CERT_CopyName(poolp, destName, srcName);
+    destName->arena = poolp;
+    return rv;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateIssuer(CRMFCertRequest *inCertReq,
+                                      CERTName *destIssuer)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfIssuer)) {
+        return crmf_copy_name(destIssuer,
+                              inCertReq->certTemplate.issuer);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateIssuerUID(CRMFCertRequest *inCertReq,
+                                         SECItem *destIssuerUID)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfIssuerUID)) {
+        return crmf_make_bitstring_copy(NULL, destIssuerUID,
+                                        &inCertReq->certTemplate.issuerUID);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplatePublicKey(CRMFCertRequest *inCertReq,
+                                         CERTSubjectPublicKeyInfo *destPublicKey)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfPublicKey)) {
+        return SECKEY_CopySubjectPublicKeyInfo(NULL, destPublicKey,
+                                               inCertReq->certTemplate.publicKey);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateSerialNumber(CRMFCertRequest *inCertReq,
+                                            long *serialNumber)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfSerialNumber)) {
+        return crmf_extract_long_from_item(&inCertReq->certTemplate.serialNumber,
+                                           serialNumber);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateSigningAlg(CRMFCertRequest *inCertReq,
+                                          SECAlgorithmID *destAlg)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfSigningAlg)) {
+        return SECOID_CopyAlgorithmID(NULL, destAlg,
+                                      inCertReq->certTemplate.signingAlg);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateSubject(CRMFCertRequest *inCertReq,
+                                       CERTName *destSubject)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfSubject)) {
+        return crmf_copy_name(destSubject, inCertReq->certTemplate.subject);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateSubjectUID(CRMFCertRequest *inCertReq,
+                                          SECItem *destSubjectUID)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfSubjectUID)) {
+        return crmf_make_bitstring_copy(NULL, destSubjectUID,
+                                        &inCertReq->certTemplate.subjectUID);
+    }
+    return SECFailure;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateVersion(CRMFCertRequest *inCertReq,
+                                       long *version)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfVersion)) {
+        return crmf_extract_long_from_item(&inCertReq->certTemplate.version,
+                                           version);
+    }
+    return SECFailure;
+}
+
+static SECStatus
+crmf_copy_validity(CRMFGetValidity *destValidity,
+                   CRMFOptionalValidity *src)
+{
+    SECStatus rv;
+
+    destValidity->notBefore = destValidity->notAfter = NULL;
+    if (src->notBefore.data != NULL) {
+        rv = crmf_create_prtime(&src->notBefore,
+                                &destValidity->notBefore);
+        if (rv != SECSuccess) {
+            return rv;
+        }
+    }
+    if (src->notAfter.data != NULL) {
+        rv = crmf_create_prtime(&src->notAfter,
+                                &destValidity->notAfter);
+        if (rv != SECSuccess) {
+            return rv;
+        }
+    }
+    return SECSuccess;
+}
+
+SECStatus
+CRMF_CertRequestGetCertTemplateValidity(CRMFCertRequest *inCertReq,
+                                        CRMFGetValidity *destValidity)
+{
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return SECFailure;
+    }
+    if (CRMF_DoesRequestHaveField(inCertReq, crmfValidity)) {
+        return crmf_copy_validity(destValidity,
+                                  inCertReq->certTemplate.validity);
+    }
+    return SECFailure;
+}
+
+CRMFControl *
+CRMF_CertRequestGetControlAtIndex(CRMFCertRequest *inCertReq, int index)
+{
+    CRMFControl *newControl, *srcControl;
+    int numControls;
+    SECStatus rv;
+
+    PORT_Assert(inCertReq != NULL);
+    if (inCertReq == NULL) {
+        return NULL;
+    }
+    numControls = CRMF_CertRequestGetNumControls(inCertReq);
+    if (index >= numControls || index < 0) {
+        return NULL;
+    }
+    newControl = PORT_ZNew(CRMFControl);
+    if (newControl == NULL) {
+        return NULL;
+    }
+    srcControl = inCertReq->controls[index];
+    newControl->tag = srcControl->tag;
+    rv = SECITEM_CopyItem(NULL, &newControl->derTag, &srcControl->derTag);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = SECITEM_CopyItem(NULL, &newControl->derValue,
+                          &srcControl->derValue);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    /* Copy over the PKIArchiveOptions stuff */
+    switch (srcControl->tag) {
+        case SEC_OID_PKIX_REGCTRL_REGTOKEN:
+        case SEC_OID_PKIX_REGCTRL_AUTHENTICATOR:
+            /* No further processing necessary for these types. */
+            rv = SECSuccess;
+            break;
+        case SEC_OID_PKIX_REGCTRL_OLD_CERT_ID:
+        case SEC_OID_PKIX_REGCTRL_PKIPUBINFO:
+        case SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY:
+            /* These aren't supported yet, so no post-processing will
+             * be done at this time.  But we don't want to fail in case
+             * we read in DER that has one of these options.
+             */
+            rv = SECSuccess;
+            break;
+        case SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS:
+            rv = crmf_copy_pkiarchiveoptions(NULL,
+                                             &newControl->value.archiveOptions,
+                                             &srcControl->value.archiveOptions);
+            break;
+        default:
+            rv = SECFailure;
+    }
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    return newControl;
+loser:
+    CRMF_DestroyControl(newControl);
+    return NULL;
+}
+
+static SECItem *
+crmf_copy_control_value(CRMFControl *inControl)
+{
+    return SECITEM_DupItem(&inControl->derValue);
+}
+
+SECItem *
+CRMF_ControlGetAuthenticatorControlValue(CRMFControl *inControl)
+{
+    PORT_Assert(inControl != NULL);
+    if (inControl == NULL ||
+        CRMF_ControlGetControlType(inControl) != crmfAuthenticatorControl) {
+        return NULL;
+    }
+    return crmf_copy_control_value(inControl);
+}
+
+CRMFControlType
+CRMF_ControlGetControlType(CRMFControl *inControl)
+{
+    CRMFControlType retType;
+
+    PORT_Assert(inControl != NULL);
+    switch (inControl->tag) {
+        case SEC_OID_PKIX_REGCTRL_REGTOKEN:
+            retType = crmfRegTokenControl;
+            break;
+        case SEC_OID_PKIX_REGCTRL_AUTHENTICATOR:
+            retType = crmfAuthenticatorControl;
+            break;
+        case SEC_OID_PKIX_REGCTRL_PKIPUBINFO:
+            retType = crmfPKIPublicationInfoControl;
+            break;
+        case SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS:
+            retType = crmfPKIArchiveOptionsControl;
+            break;
+        case SEC_OID_PKIX_REGCTRL_OLD_CERT_ID:
+            retType = crmfOldCertIDControl;
+            break;
+        case SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY:
+            retType = crmfProtocolEncrKeyControl;
+            break;
+        default:
+            retType = crmfNoControl;
+    }
+    return retType;
+}
+
+CRMFPKIArchiveOptions *
+CRMF_ControlGetPKIArchiveOptions(CRMFControl *inControl)
+{
+    CRMFPKIArchiveOptions *newOpt = NULL;
+    SECStatus rv;
+
+    PORT_Assert(inControl != NULL);
+    if (inControl == NULL ||
+        CRMF_ControlGetControlType(inControl) != crmfPKIArchiveOptionsControl) {
+        goto loser;
+    }
+    newOpt = PORT_ZNew(CRMFPKIArchiveOptions);
+    if (newOpt == NULL) {
+        goto loser;
+    }
+    rv = crmf_copy_pkiarchiveoptions(NULL, newOpt,
+                                     &inControl->value.archiveOptions);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+loser:
+    if (newOpt != NULL) {
+        CRMF_DestroyPKIArchiveOptions(newOpt);
+    }
+    return NULL;
+}
+
+SECItem *
+CRMF_ControlGetRegTokenControlValue(CRMFControl *inControl)
+{
+    PORT_Assert(inControl != NULL);
+    if (inControl == NULL ||
+        CRMF_ControlGetControlType(inControl) != crmfRegTokenControl) {
+        return NULL;
+    }
+    return crmf_copy_control_value(inControl);
+    ;
+}
+
+CRMFCertExtension *
+CRMF_CertRequestGetExtensionAtIndex(CRMFCertRequest *inCertReq,
+                                    int index)
+{
+    int numExtensions;
+
+    PORT_Assert(inCertReq != NULL);
+    numExtensions = CRMF_CertRequestGetNumberOfExtensions(inCertReq);
+    if (index >= numExtensions || index < 0) {
+        return NULL;
+    }
+    return crmf_copy_cert_extension(NULL,
+                                    inCertReq->certTemplate.extensions[index]);
+}