module dicrpkid;

extern (Windows):

/* GENERAL FUNCTIONS */
int  PKI_Version(void *reserved1, void *reserved2);
int  PKI_LicenceType(int reserved);
int  PKI_LastError(char *szErrMsg, int nMsgLen);
int  PKI_ErrorCode();
int  PKI_ErrorLookup(char *szErrMsg, int nMsgLen, int nErrCode);
int  PKI_CompileTime(char *szTimestamp, int nLen);
int  PKI_ModuleName(char *szTimestamp, int nLen, int reserved);
int  PKI_PowerUpTests(int nOptions);


/* RFC3369 CRYPTOGRAPHIC MESSAGE SYNTAX FUNCTIONS */
int  CMS_MakeEnvData(char *szFileOut, char *szFileIn, char *szCertList, char *sSeed, int nSeedLen, int nOptions);
int  CMS_MakeEnvDataFromString(char *szFileOut, char *szDataIn, char *szCertList, char *sSeed, int nSeedLen, int nOptions);
int  CMS_ReadEnvData(char *szFileOut, char *szFileIn, char *szX509File, char *szRSAPrivateKey, int nOptions);
int  CMS_ReadEnvDataToString(char *szDataOut, int nDataOutLen, char *szFileIn, char *szX509File, char *szRSAPrivateKey, int nOptions);
int  CMS_MakeSigData(char *szFileOut, char *szFileIn, char *szCertList, char *szRSAPrivateKey, int nOptions);
int  CMS_MakeSigDataFromString(char *szFileOut, char *szDataIn, char *szCertList, char *szRSAPrivateKey, int nOptions);
int  CMS_MakeDetachedSig(char *szFileOut, char *szHexDigest, char *szCertList, char *szRSAPrivateKey, int nOptions);
int  CMS_ReadSigData(char *szFileOut, char *szFileIn, int nOptions);
int  CMS_ReadSigDataToString(char *szDataOut, int nDataOutLen, char *szFileIn, int nOptions);
int  CMS_GetSigDataDigest(char *szHexDigestOut, int nDigestLen, char *szFileIn, char *szX509File, int nOptions);
int  CMS_VerifySigData(char *szFileIn, char *szX509File, char *szHexDigest, int nOptions);
int  CMS_QuerySigData(char *szDataOut, int nDataOutLen, char *szFileIn, char *szQuery, int nOptions);
int  CMS_MakeSigDataFromSigValue(char *szFileOut, ubyte *pSigValue, int nSigLen, ubyte *pData, int nDataLen, char *szCertList, int nOptions);

/* RSA KEY FUNCTIONS */
int  RSA_MakeKeys(char *szPubKeyFile, char *szPVKFile, int nBits, int nExpFermat, int nTests, int nCount, char *szPassword, char *sSeed, int nSeedLen, int nOptions);
int  RSA_ReadEncPrivateKey(char *szOutput, int nOutputLen, char *szPVKFile, char *szPassword, int nOptions);
int  RSA_ReadPrivateKeyInfo(char *szOutput, int nOutputLen, char *szKeyFile, int nOptions);
int  RSA_GetPrivateKeyFromPFX(char *szOutputFile, char *szPFXFile, int nOptions);
int  RSA_ReadPublicKey(char *szOutput, int nOutputLen, char *szKeyFile, int flags);
int  RSA_GetPublicKeyFromCert(char *szOutput, int nOutputLen, char *szCertFile, int flags);
int  RSA_SavePublicKey(char *szFileOut, char *szKeyString, int nOptions);
int  RSA_SavePrivateKeyInfo(char *szFileOut, char *szKeyString, int nOptions);
int  RSA_SaveEncPrivateKey(char *szFileOut, char *szKeyString, int nCount, char *szPassword, int nOptions);
int  RSA_KeyBits(char *szRsaKey64);
int  RSA_KeyBytes(char *szRsaKey64);
int  RSA_ToXMLString(char *szOutput, int nOutputLen, char *szKeyString, int nOptions);
int  RSA_FromXMLString(char *szOutput, int nOutputLen, char *szXmlString, int nOptions);
int  RSA_CheckKey(char *szKeyString, int nOptions);

/* 'RAW' RSA ENCRYPTION/DECRYPTION FUNCTIONS */
int  RSA_RawPublic(ubyte *abData, int nDataLen, char *szPublicKey64, int nOptions);
int  RSA_RawPrivate(ubyte *abData, int nDataLen, char *szPrivateKey64, int nOptions);
int  RSA_EncodeMsg(ubyte *abOutput, int nOutputLen, ubyte *abMessage, int nMsgLen, int nOptions);
int  RSA_DecodeMsg(ubyte *abOutput, int nOutputLen, ubyte *abInput, int nInputLen, int nOptions);

/* PKCS12 FILE FUNCTIONS */
int  PFX_MakeFile(char *szFileOut, char *szCertFile, char *szKeyFile, char *szPassword, char *szFriendlyName, int options);
int  PFX_VerifySig(char *szFileName, char *szPassword, int options);

/* X509 CERTIFICATE FUNCTIONS */
int  X509_MakeCert(char *certfile, char *issuerCert, char *subjectPubkeyFile, char *issuerPvkInfoFile, int certnum, int yearsvalid, char *distName, char *email, int keyUsageFlags, char *password, int optionFlags);
int  X509_MakeCertSelf(char *certfile, char *epkfile, int certnum, int yearsvalid, char *distName, char *email, int keyUsageFlags, char *password, int optionFlags);
int  X509_CertRequest(char *reqfile, char *epkfile, char *distName, char *reserved, char *password, int optionFlags);
int  X509_VerifyCert(char *szCertToVerify, char *szIssuerCert, int flags);
int  X509_CertThumb(char *szCertFile, char *szHash, int nHashLen, int flags);
int  X509_CertIsValidNow(char *szCertFile, int flags);
int  X509_CertIssuedOn(char *szCertFile, char *szOutput, int nOutputLen, int flags);
int  X509_CertExpiresOn(char *szCertFile, char *szOutput, int nOutputLen, int flags);
int  X509_CertSerialNumber(char *szCertFile, char *szOutput, int nOutputLen, int flags);
int  X509_HashIssuerAndSN(char *szCertFile, char *szOutput, int nOutputLen, int flags);
int  X509_CertIssuerName(char *szCertFile, char *szOutput, int nOutputLen, char *szDelim, int flags);
int  X509_CertSubjectName(char *szCertFile, char *szOutput, int nOutputLen, char *szDelim, int flags);
int  X509_GetCertFromP7Chain(char *szNewCertFile, char *szP7cFile, int nIndex, int nOptions);
int  X509_GetCertFromPFX(char *szNewCertFile, char *szPfxFile, char *szReserved, int nOptions);
int  X509_QueryCert(char *szDataOut, int nDataOutLen, char *szFileIn, char *szQuery, int nOptions);

/* TRIPLE DES FUNCTIONS */
int  TDEA_HexMode(char *output, char *input, char *szHexKey, int bEncrypt, char *szMode, char *sHexIV);
int  TDEA_B64Mode(char *output, char *input, char *szB64Key, int bEncrypt, char *szMode, char *sB64IV);
int  TDEA_BytesMode(ubyte *output, ubyte *input, int nbytes, ubyte *key, int bEncrypt, char *szMode, ubyte *iv);
int  TDEA_File(char *szFileOut, char *szFileIn, ubyte *key, int bEncrypt, char *szMode, ubyte *iv);

/* MESSAGE DIGEST HASH FUNCTIONS */
int  HASH_HexFromBytes(char *szHexDigest, int digLen, void *aMessage, int messageLen, int flags);
int  HASH_HexFromFile(char *szHexDigest, int digLen, char *szFileName, int flags);
int  HASH_Bytes(ubyte *digest, int digLen, void *aMessage, int messageLen, int flags);
int  HASH_File(ubyte *digest, int digLen, char *szFileName, int flags);

/* MISC UTILITIES */
int  WIPE_File(char *szFileName, int flags);
int  WIPE_Data(void *lpData, int datalen);
int  RNG_Bytes(ubyte *output, int out_len, char *seed, int seedlen);
int  RNG_Number(int lower, int upper);
int  PWD_Prompt(char *szPassword, int nPwdLen, char *szCaption);
int  PWD_PromptEx(char *szPassword, int nPwdLen, char *szCaption, char *szPrompt, int flags);

/* BASE64 AND HEX CONVERSION FUNCTIONS */
int  CNV_B64StrFromBytes(char *szOutput, int nOutChars, ubyte *input, int nbytes);
int  CNV_BytesFromB64Str(ubyte *output, int out_len, char *input);
int  CNV_B64Filter(char *szOutput, char *input, int len);
int  CNV_HexStrFromBytes(char *szOutput, int nOutChars, ubyte *input, int nbytes);
int  CNV_BytesFromHexStr(ubyte *output, int out_len, char *input);
int  CNV_HexFilter(char *szOutput, char *input, int len);

/* UTF-8 CONVERSION/CHECK FUNCTIONS */
int  CNV_UTF8FromLatin1(char *szOutput, int nOutChars, char *szInput);
int  CNV_Latin1FromUTF8(char *szOutput, int nOutChars, char *szInput);
int  CNV_CheckUTF8(char *szInput);



extern (D) :

  private import std.string;
  alias char[] String;

	public enum Mode
	{
		/// <summary>
		/// Electronic Code Book mode
		/// </summary>
		ECB,
		/// <summary>
		/// Cipher Block Chaining mode
		/// </summary>
		CBC,
		/// <summary>
		/// Cipher Feedback mode
		/// </summary>
		CFB,
		/// <summary>
		/// Output Feedback mode
		/// </summary>
		OFB,
		/// <summary>
		/// Counter mode
		/// </summary>
		CTR
	}

	/// <summary>
	/// Base for encoding methods
	/// </summary>
	public enum EncodingBase
	{
		/// <summary>
		/// Base64 encoding
		/// </summary>
		Base64,
		/// <summary>
		/// Base16 encoding (i.e. hexadecimal)
		/// </summary>
		Base16
	}

	/// <summary>
	/// Message Digest Hash Algorithm
	/// </summary>
	public enum HashAlgorithm
	{
		/// <summary>
		/// SHA-1 (as per FIPS PUB 180-2)
		/// </summary>
		Sha1 = 0,
		/// <summary>
		/// MD5 (as per RFC 1321)
		/// </summary>
		Md5 = 1,
		/// <summary>
		/// MD2 (as per RFC 1319)
		/// </summary>
		Md2 = 2,
		/// <summary>
		/// SHA-256 (as per FIPS PUB 180-2)
		/// </summary>
		Sha256 = 3
	}

	// Constants we use internally
	enum Direction
	{
		Encrypt = 1,
		Decrypt = 0
	}
	enum SignatureType
	{
		PKI_SIG_SHA1RSA = 0,
		PKI_SIG_MD5RSA = 1,
		PKI_SIG_MD2RSA = 2
	}
	enum Max
	{
		PKI_MAX_HASH_LEN = 64,
		PKI_MAX_HASH_BYTES = 32
	}
	enum Emsig
	{
		PKI_EMSIG_DEFAULT = 0x20,
		PKI_EMSIG_DIGESTONLY = 0x1000,
		PKI_EMSIG_DIGINFO = 0x2000
	}

	/// <summary>
	/// General functions
	/// </summary>
	public class General
	{
		public this() {}	// Static methods only, so hide constructor.

		/* GENERAL FUNCTIONS */
		/// <summary>
		/// Gets licence type.
		/// </summary>
		/// <returns>D=Developer P=Personal T=Trial</returns>
		public char LicenceType()
		{
			int n = PKI_LicenceType(0);
			return cast(char)n;
		}
		/// <summary>
		/// Retrieves the last error message set by the toolkit.
		/// </summary>
		/// <returns>Final error message from last call (may be empty)</returns>
		public String LastError()
		{
			String sb;
			int n = PKI_LastError(null, 0);
			sb.length = n;
			.PKI_LastError(sb, sb.length);
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Returns the error code of the <em>first</em> error that occurred when calling the last function
		/// </summary>
		/// <returns></returns>
		public int ErrorCode()
		{
			return PKI_ErrorCode();
		}
		/// <summary>
		/// Looks up error code
		/// </summary>
		/// <param name="errCode">Code number</param>
		/// <returns>Corresponding error message</returns>
		public String ErrorLookup(int errCode)
		{
			String sb;
			sb.length = 128;
			if (PKI_ErrorLookup(sb, sb.length, errCode)>0) {
			  sb = .toString(sb);
				return sb;
			}
			else
				return null;
		}
		/// <summary>
		/// Gets date and time the CryptoSys PKI DLL module was last compiled
		/// </summary>
		/// <returns>Date and time String</returns>
		public String CompileTime()
		{
			String sb;
			sb.length = 65;
			PKI_CompileTime(sb, sb.length);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Gets full path name of core CryptoSys PKI DLL module
		/// </summary>
		/// <returns>File name</returns>
		public String ModuleName()
		{
			String sb;
			int n = PKI_ModuleName(sb, 0, 0);
			sb.length = n;
			PKI_ModuleName(sb, sb.length, 0);
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Performs FIPS-140-2 start-up tests
		/// </summary>
		/// <returns>Zero on success</returns>
		public int PowerUpTests()
		{
			return PKI_PowerUpTests(0);
		}

		/// <summary>
		/// Returns version number of core CryptoSys PKI DLL.
		/// </summary>
		/// <returns>Version number in form Major * 100 + Minor * 10 + Release</returns>
		public int Version()
		{
			return PKI_Version(null, null);
		}
	}


	/// <summary>
	/// Cryptographic Message Syntax (CMS) Functions
	/// </summary>
	public class Cms
	{
		public this()	{}	// Static methods only, so hide constructor.

		private const int PKI_CMS_FORMAT_BASE64 = 0x10000;
		/// <summary>
		/// Options for CMS objects
		/// </summary>
		public enum Options
		{
			/// <summary>
			/// Default option
			/// </summary>
			Default = 0,
			/// <summary>
			/// Exclude X.509 certs from output
			/// </summary>
			ExcludeCerts = 0x0100,
			/// <summary>
			/// Exclude data from output
			/// </summary>
			ExcludeData = 0x0200,
			/// <summary>
			/// Include Signed Attributes
			/// </summary>
			IncludeAttributes = 0x0800,
			/// <summary>
			/// Add signing time
			/// </summary>
			AddSignTime = 0x1000,
			/// <summary>
			/// Add S/MIME capabilities
			/// </summary>
			AddSmimeCapabilities = 0x2000,
			/// <summary>
			/// Create output/expect input in base64 format
			/// </summary>
			FormatBase64 = 0x10000,
			/// <summary>
			/// Use MD5 hash digest algorithm (default is SHA-1)
			/// </summary>
			UseMD5 = 1,
			/// <summary>
			/// Create a "naked" SignedData object with no outerContentInfo as permitted by PKCS#7 v1.6
			/// </summary>
			NoOuter = 0x2000000,
			/// <summary>
			/// Use alternative signature algorithm identifiers in SignedData object, e.g. 'sha1withRSAEncryption' instead of 'rsaEncryption'
			/// </summary>
			AltAlgId = 0x4000000
		}

		/* RFC3852 CRYPTOGRAPHIC MESSAGE SYNTAX FUNCTIONS */
		/// <summary>
		/// Creates an encrypted CMS enveloped-data object for one or more recipients using their x.509 certificates
		/// </summary>
		/// <param name="outputFile">Output file to be created</param>
		/// <param name="inputFile">Input data file</param>
		/// <param name="certList">List of X509 certificate filename(s), separated by semi-colons</param>
		/// <param name="options"></param>
		/// <returns>Number of successful recipients or negative error code</returns>
		public int MakeEnvData(String outputFile, String inputFile,	String certList, Cms.Options options)	{
			return CMS_MakeEnvData(outputFile, inputFile, certList, "", 0, cast(int)options);
		}

		/// <summary>
		/// The same as Cms.MakeEnvData except the input data is in an ANSI String instead of a file
		/// </summary>
		/// <param name="outputFile">Output file to be created</param>
		/// <param name="inputData">Input data text</param>
		/// <param name="certList">List of X509 certificate filename(s), separated by semi-colons</param>
		/// <param name="options"></param>
		/// <returns>Number of successful recipients or negative error code</returns>
		public int MakeEnvDataFromString(String outputFile, String inputData,	String certList, Cms.Options options)	{
			return CMS_MakeEnvDataFromString(outputFile, inputData, certList, "", 0, cast(int)options);
		}

		/// <summary>
		/// Reads and decrypts CMS enveloped-data object using the recipient's private key.
		/// </summary>
		/// <param name="outputFile">Name of output file to be created</param>
		/// <param name="inputFile">File that contains the CMS-enveloped data</param>
		/// <param name="x509File">(optional) specifies the filename of the recipient's X.509 certificate</param>
		/// <param name="privateKey">Internal representation of private key</param>
		/// <param name="options"></param>
		/// <returns>Zero if successful; otherwise it returns an error code</returns>
		public int ReadEnvDataToFile(String outputFile, String inputFile,	String x509File, String privateKey, Cms.Options options) {
			return CMS_ReadEnvData(outputFile, inputFile, x509File, privateKey, cast(int)options);
		}

		/// <summary>
		/// Reads and decrypts CMS enveloped-data object using the recipient's private key
		/// </summary>
		/// <param name="inputFile">File that contains the CMS-enveloped data</param>
		/// <param name="x509File">(optional) specifies the filename of the recipient's X.509 certificate</param>
		/// <param name="privateKey">Internal representation of private key</param>
		/// <param name="options"></param>
		/// <returns>Message text or an empty String on error</returns>
		public String ReadEnvDataToString(String inputFile, String x509File, String privateKey, Cms.Options options)
		{
			String sb;
			int n = CMS_ReadEnvDataToString(sb, 0, inputFile, x509File, privateKey, cast(int)options);
			if (n <= 0) return null;
			sb.length = n;
			CMS_ReadEnvDataToString(sb, sb.length, inputFile, x509File, privateKey, cast(int)options);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// creates a CMS object of type SignedData from an input data file
		/// ready for sending as part of an S/MIME email
		/// </summary>
		/// <param name="outputFile">name of output file to be created</param>
		/// <param name="inputFile">name of file containing message data to be signed</param>
		/// <param name="certList">containing the filename of the signer's
		/// certificate and (optionally) a list of other certificates
		/// to be included in the output, separated by semi-colons(;)</param>
		/// <param name="privateKey">containing the private key data for the sender</param>
		/// <param name="options">option flags (default=0)</param>
		/// <returns>Zero if successful; otherwise it returns an error code</returns>
		public int MakeSigData(String outputFile, String inputFile,	String certList, String privateKey, Cms.Options options)
		{
			return CMS_MakeSigData(outputFile, inputFile, certList, privateKey, cast(int)options);
		}

		/// <summary>
		/// Creates a CMS object of type SignedData from an input String
		/// </summary>
		/// <param name="outputFile">name of output file to be created</param>
		/// <param name="inputData">String containing message data to be signed</param>
		/// <param name="certList">containing the filename of the signer's
		/// certificate and (optionally) a list of other certificates
		/// to be included in the output, separated by semi-colons(;)</param>
		/// <param name="privateKey">containing the private key data for the sender</param>
		/// <param name="options">option flags (default=0)</param>
		/// <returns>Zero if successful; otherwise it returns an error code</returns>
		public int MakeSigDataFromString(String outputFile, String inputData,	String certList, String privateKey, Cms.Options options)
		{
			return CMS_MakeSigDataFromString(outputFile, inputData, certList, privateKey, cast(int)options);
		}

		/// <summary>
		/// Creates a CMS object of type SignedData using a pre-computed signature
		/// </summary>
		/// <param name="outputFile">name of output file to be created</param>
		/// <param name="sigValue">signature value</param>
		/// <param name="contentData">String containing content data that has been signed</param>
		/// <param name="certList">containing the filename of the signer's
		/// certificate and (optionally) a list of other certificates
		/// to be included in the output, separated by semi-colons(;)</param>
		/// <param name="options">option flags (default=0)</param>
		/// <returns>Zero if successful; otherwise it returns an error code</returns>
		public int MakeSigDataFromSigValue(String outputFile, ubyte[] sigValue, ubyte[] contentData, String certList, Cms.Options options)
		{
			return CMS_MakeSigDataFromSigValue(outputFile, sigValue, sigValue.length, contentData, contentData.length, certList, cast(int)options);
		}

		/// <summary>
		/// Creates a "detached signature" CMS signed-data object file
		/// from a <b>message digest</b> of the content
		/// </summary>
		/// <param name="outputFile">name of output file to be created</param>
		/// <param name="hexDigest">String containing message digest in hex format</param>
		/// <param name="certList">containing the filename of the signer's
		/// certificate and (optionally) a list of other certificates
		/// to be included in the output, separated by semi-colons(;)</param>
		/// <param name="privateKey">containing the private key data for the sender</param>
		/// <param name="options">option flags (default=0)</param>
		/// <returns>Zero if successful; otherwise it returns an error code</returns>
		public int MakeDetachedSig(String outputFile, String hexDigest,	String certList, String privateKey, Cms.Options options)
		{
			return CMS_MakeDetachedSig(outputFile, hexDigest, certList, privateKey, cast(int)options);
		}

		/// <summary>
		/// Reads the content from a CMS signed-data object file
		/// </summary>
		/// <param name="outputFile">file to receive content</param>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>If successful, the return value is a positive number indicating the number of bytes in the content;
		/// otherwise it returns a negative error code.</returns>
		public int ReadSigDataToFile(String outputFile, String inputFile,	bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			return CMS_ReadSigData(outputFile, inputFile, flags);
		}

		/// <summary>
		/// Reads the content from a CMS signed-data object file directly into a String
		/// </summary>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>String containing the content or an empty String if error</returns>
		public String ReadSigDataToString(String inputFile, bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			String sb;
			int n = CMS_ReadSigDataToString(sb, 0, inputFile, flags);
			if (n <= 0) return null;
			sb.length = n;
			CMS_ReadSigDataToString(sb, sb.length, inputFile, flags);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// extracts the message digest from a signed-data CMS object file
		/// and verifies the signature
		/// </summary>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="certFile">an (optional) X.509 certificate file to be used to identify the signer</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>Hash value in hex format or an empty String if error</returns>
		public String GetSigDataDigest(String inputFile, String certFile, bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			// We know the max length of a hash digest
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			int n = CMS_GetSigDataDigest(sb, sb.length, inputFile, certFile, flags);
			// Return value is ID of hash algorithm or -ve error code
			if (n < 0) return null;
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Finds message digest hash algorithm used to make signature
		/// </summary>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="certFile">an (optional) X.509 certificate file to be used to identify the signer</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>0=SHA-1, 1=MD5, 2=MD2; or a negative error code</returns>
		public int GetSigHashAlgorithm(String inputFile, String certFile, bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			// We know the max length of a hash digest
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			int n = CMS_GetSigDataDigest(sb, sb.length, inputFile, certFile, flags);
			// Return value is ID of hash algorithm or -ve error code
			return n;
		}

		/// <summary>
		/// Verifies the signature and content of a signed-data CMS object file.
		/// </summary>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="certFile">an (optional) X.509 certificate file of the signer</param>
		/// <param name="hexDigest">(optional) digest of eContent to be verified</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>Zero if successfully verified; otherwise it returns an error code</returns>
		public int VerifySigData(String inputFile, String certFile, String hexDigest, bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			return CMS_VerifySigData(inputFile, certFile, hexDigest, flags);
		}

		/// <summary>
		/// Queries a CMS signed-data object file for selected information.
		/// </summary>
		/// <param name="inputFile">file containing CMS signed-data object</param>
		/// <param name="query">query String</param>
		/// <param name="inputIsBase64"><b>true</b> if input is in base64 encoding;
		/// <b>false</b> for binary BER-encoded</param>
		/// <returns>String containing the result or an empty String if not found or error</returns>
		public String QuerySigData(String inputFile, String query, bool inputIsBase64)
		{
			int flags = (inputIsBase64 ? PKI_CMS_FORMAT_BASE64 : 0);
			String sb;
			int n = CMS_QuerySigData(sb, 0, inputFile, query, flags);
			if (n <= 0) return null;
			sb.length = n;
			int x = CMS_QuerySigData(sb, sb.length, inputFile, query, flags);
			// CMS_QuerySigData either returns an integer result directly or sets the String
			sb = .toString(sb);
			if (sb.length == 0){	// Result is an integer returned in n, so set our return value as a String
				//sb.Append(n);
				sb ~= .toString(n);
			}
			return sb;
		}
	}

	/// <summary>
	/// RSA Encryption and Public Key Functions
	/// </summary>
	public class Rsa
	{
		public this(){}	// Static methods only, so hide constructor.

		private const int KEYGEN_INDICATE = 0x10;
		private const int PKI_KEY_FORMAT_PEM = 0x10000;
		private const int PKI_KEY_FORMAT_SSL = 0x20000;
		private const int PKI_XML_RSAKEYVALUE  = 0x0001;
		private const int PKI_XML_EXCLPRIVATE  = 0x0010;
		private const int PKI_XML_HEXBINARY   =  0x0100;

		/// <summary>
		/// Password-based Encryption options to indicate the algorithm to be used to encrypt the private key file
		/// </summary>
		/// <remarks>See PKCS#5 v2.0 or <a href="http://www.faqs.org/rfcs/rfc2898.html">RFC 2898</a></remarks>
		public enum PbeOptions
		{
			/// <summary>
			/// Default option (pbeWithSHAAnd3-KeyTripleDES-CBC)
			/// </summary>
			Default = 0,
			/// <summary>
			/// pbeWithSHAAnd3-KeyTripleDES-CBC
			/// </summary>
			PbeWithSHAAnd_KeyTripleDES_CBC = 0,
			/// <summary>
			/// pbeWithMD5AndDES-CBC
			/// </summary>
			PbeWithMD5AndDES_CBC = 1,
			/// <summary>
			/// pbeWithMD2AndDES-CBC
			/// </summary>
			PbeWithMD2AndDES_CBC = 2,
			/// <summary>
			/// pbeWithSHA1AndDES-CBC
			/// </summary>
			PbeWithSHA1AndDES_CBC = 3,
			/// <summary>
			/// "pkcs5PBES2" with "des-EDE3-CBC"
			/// </summary>
			Pkcs5PBES2_des_EDE3_CBC = 4
		}

		/// <summary>
		/// Choices for public exponent (e)
		/// </summary>
		/// <remarks>Fermat Number F(x) = 2^(2^x) + 1. F0 to F4 are prime.</remarks>
		public enum PublicExponent
		{
			/// <summary>
			/// Set exponent equal to 3 (F0)
			/// </summary>
			Exp_EQ_3 = 0,
			/// <summary>
			/// Set exponent equal to 5 (F1)
			/// </summary>
			Exp_EQ_5 = 1,
			/// <summary>
			/// Set exponent equal to 17 (F2)
			/// </summary>
			Exp_EQ_17 = 2,
			/// <summary>
			/// Set exponent equal to 257 (F3)
			/// </summary>
			Exp_EQ_257 = 3,
			/// <summary>
			/// Set exponent equal to 65537 (F4)
			/// </summary>
			Exp_EQ_65537 = 4
		}

		/// <summary>
		/// Format for saved RSA key
		/// </summary>
		public enum Format
		{
			/// <summary>
			/// Default = Binary
			/// </summary>
			Default = 0,
			/// <summary>
			/// Binary DER-encoded
			/// </summary>
			Binary = 0,
			/// <summary>
			/// PEM Format
			/// </summary>
			PEM = PKI_KEY_FORMAT_PEM,
			/// <summary>
			/// PEM format compatible with OpenSLL
			/// </summary>
			SSL = PKI_KEY_FORMAT_SSL
		}

		// No of Rabin-Miller primality tests to perform
		// - this gives a probablity of 2^-128 of a wrong answer.
		private const int PRIME_TESTS = 64;

		/* RSA KEY FUNCTIONS */
		/// <summary>
		/// Generate an RSA public/private key pair
		/// </summary>
		/// <param name="publicKeyFile">Output filename for public key</param>
		/// <param name="privateKeyFile">Output filename for (encrypted) private key</param>
		/// <param name="bits">Required key modulus size in bits (min 96)</param>
		/// <param name="exponent">Exponent (Fermat Prime)</param>
		/// <param name="iterCount">Iteration count for encrypted private key</param>
		/// <param name="password">Password String for encrypted private key</param>
		/// <param name="cryptOption">Option to specify encryption algorithm for private key</param>
		/// <param name="showProgress">Indicate progress in console</param>
		/// <returns>Zero if successful or non-zero error code</returns>
		public int MakeKeys(String publicKeyFile, String privateKeyFile, int bits, PublicExponent exponent, int iterCount, String password, Rsa.PbeOptions cryptOption, bool showProgress)
		{
			int flags = (showProgress ? KEYGEN_INDICATE : 0) | cast(int)cryptOption;
			return RSA_MakeKeys(publicKeyFile, privateKeyFile, bits, cast(int)exponent, PRIME_TESTS, iterCount, password, "", 0, flags);
		}

		/// <summary>
		/// Reads encrypted private key file into internal String format
		/// </summary>
		/// <param name="privateKeyFile">filename of a binary BER-encoded encrypted private key info file</param>
		/// <param name="password"></param>
		/// <returns>String containing an internal representation of the
		/// private key; or an empty String if error </returns>
		/// <remarks>This returns a String, not a String, so it can
		/// be properly wiped later.</remarks>
		public String ReadEncPrivateKey(String privateKeyFile, String password)
		{
			String sb;
			int n = RSA_ReadEncPrivateKey(sb, 0, privateKeyFile, password, 0);
			if (n <= 0) {
			  return null;
			}
			sb.length = n;
			RSA_ReadEncPrivateKey(sb, sb.length, privateKeyFile, password, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Reads from an (unencrypted) PKCS-8 private key info file into a private key String
		/// </summary>
		/// <param name="prikeyinfoFile">Name of file</param>
		/// <returns>String containing an internal representation of the
		/// private key; or an empty String if error </returns>
		/// <remarks>This returns a String, not a String, so it can
		/// be properly wiped later.</remarks>
		public String ReadPrivateKeyInfo(String prikeyinfoFile)
		{
			String sb;
			int n = RSA_ReadPrivateKeyInfo(sb, 0, prikeyinfoFile, 0);
			if (n <= 0) {
			  return null;
			}
			sb.length = n;
			RSA_ReadPrivateKeyInfo(sb, sb.length, prikeyinfoFile, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Extracts an encrypted private key from a PKCS-12 PKCS8ShroudedKeyBag,
		/// saving the output directly as a new file
		/// </summary>
		/// <param name="outputFile">Name of new file to create</param>
		/// <param name="pfxFile">PKCS-12 filename</param>
		/// <returns>If successful, it returns the number of bytes written to the output file;
		/// otherwise it returns a negative error code</returns>
		public int GetPrivateKeyFromPFX(String outputFile, String pfxFile)
		{
			return RSA_GetPrivateKeyFromPFX(outputFile, pfxFile, 0);
		}

		/// <summary>
		/// Reads public key file into internal String format
		/// </summary>
		/// <param name="keyFile">filename of BER-encoded public key data</param>
		/// <returns>String containing an internal representation of the
		/// public key; or an empty String if error </returns>
		/// <remarks>This returns a String, not a String, so it can
		/// be properly wiped later.</remarks>
		public String ReadPublicKey(String keyFile)
		{
			String sb;
			int n = RSA_ReadPublicKey(sb, 0, keyFile, 0);
			if (n <= 0) {
			  return null;
			}
			sb.length = n;
			RSA_ReadPublicKey(sb, sb.length, keyFile, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Gets public key from X.509 certificate into internal String format
		/// </summary>
		/// <param name="certFile"></param>
		/// <returns>String containing an internal representation of the
		/// public key; or an empty String if error </returns>
		/// <remarks>This returns a String, not a String, so it can
		/// be properly wiped later.</remarks>
		public String GetPublicKeyFromCert(String certFile)
		{
			String sb;
			int n = RSA_GetPublicKeyFromCert(sb, 0, certFile, 0);
			if (n <= 0) {
			  return null;
			}
			sb.length = n;
			RSA_GetPublicKeyFromCert(sb, sb.length, certFile, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Saves a public key String to PKCS-1 public key file
		/// </summary>
		/// <param name="outputFile">Name of file to create</param>
		/// <param name="publicKey">Public key in internal format</param>
		/// <param name="format">File format</param>
		/// <returns>If successful, the return value is zero; otherwise it returns an error cod</returns>
		public int SavePublicKey(String outputFile, String publicKey, Rsa.Format format)
		{
			return RSA_SavePublicKey(outputFile, publicKey, cast(int)format);
		}

		/// <summary>
		/// Saves a private key String to an (unencrypted) PKCS-8 private key info file
		/// </summary>
		/// <param name="outputFile">Name of file to create</param>
		/// <param name="privateKey">Private key in internal format</param>
		/// <param name="format">File format</param>
		/// <returns>If successful, the return value is zero; otherwise it returns an error cod</returns>
		public int SavePrivateKeyInfo(String outputFile, String privateKey, Rsa.Format format)
		{
			return RSA_SavePrivateKeyInfo(outputFile, privateKey, cast(int)format);
		}

		/// <summary>
		///
		/// </summary>
		/// <param name="outputFile">Name of file to create</param>
		/// <param name="privateKey">Private key in internal format</param>
		/// <param name="iterationCount">Count to be used when encrypting file</param>
		/// <param name="password"></param>
		/// <param name="pbeOption">Type of password-based encryption to use
		/// (default = pbeWithSHAAnd3-KeyTripleDES-CBC)</param>
		/// <param name="format">File format</param>
		/// <returns>If successful, the return value is zero; otherwise it returns an error cod</returns>
		public int SaveEncPrivateKey(String outputFile, String privateKey, int iterationCount, String password, Rsa.PbeOptions pbeOption, Rsa.Format format)
		{
			int flags = cast(int)pbeOption | cast(int)format;
			return RSA_SaveEncPrivateKey(outputFile, privateKey, iterationCount, password, flags);
		}

		/// <summary>
		/// Returns number of significant bits in RSA key modulus
		/// </summary>
		/// <param name="strRsaKey"></param>
		/// <returns>Number of significant bits</returns>
		public int KeyBits(String strRsaKey)
		{
			return RSA_KeyBits(strRsaKey);
		}

		/// <summary>
		/// Returns number of bytes (octets) in RSA key modulus
		/// </summary>
		/// <param name="strRsaKey"></param>
		/// <returns>Number of bytes</returns>
		public int KeyBytes(String strRsaKey)
		{
			return RSA_KeyBytes(strRsaKey);
		}


		/// <summary>
		/// Check the validity of an "internal" RSA public or private key
		/// </summary>
		/// <param name="intKeyString">Internal key String</param>
		/// <returns>0=valid private key, 1=valid publickey, or negative error code</returns>
		/// <remarks>A private key is also validated for consistency.</remarks>
		public int CheckKey(String intKeychar)
		{
			return RSA_CheckKey(intKeychar, 0);
		}

		/// <summary>
		/// Options when exporting RSA key to XML
		/// </summary>

		public enum XmlOptions
		{
			/// <summary>
			/// Exclude private key parameters
			/// </summary>
			ExcludePrivateParams = PKI_XML_EXCLPRIVATE,
			/// <summary>
			/// Create in .NET-compatible RSAKeyValue format
			/// </summary>
			ForceRSAKeyValue = PKI_XML_RSAKEYVALUE,
			/// <summary>
			/// Create in non-standard hex format
			/// </summary>
			HexBinaryFormat = PKI_XML_HEXBINARY
		}


		/// <summary>
		/// Creates an XML String representation of an RSA internal key String
		/// </summary>
		/// <param name="intKeyString"></param>
		/// <param name="options"></param>
		/// <returns>XML String or empty String on error</returns>
		public String ToXMLString(String intKeychar, XmlOptions options)
		{
			String sb;
			int n = RSA_ToXMLString(sb, 0, intKeychar, cast(int)options);
			if (n <= 0) return null;
			sb.length = n;
			RSA_ToXMLString(sb, sb.length, intKeychar, cast(int)options);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Creates an RSA key String in internal format from an XML String
		/// </summary>
		/// <param name="xmlString">The XML String to use to reconstruct the RSA key</param>
		/// <param name="excludePrivateParams">Reconstruct public key details only</param>
		/// <returns>Key String in internal format or empty String on error</returns>
		public String FromXMLString(String xmlchar, bool excludePrivateParams)
		{
			String sb;
			int option = (excludePrivateParams ? PKI_XML_EXCLPRIVATE : 0);
			int n = RSA_FromXMLString(sb, 0, xmlchar, option);
			if (n <= 0) return null;
			sb.length = n;
			RSA_FromXMLString(sb, sb.length, xmlchar, cast(int)option);
			sb = .toString(sb);
			return sb;
		}

		/* 'RAW' RSA ENCRYPTION/DECRYPTION FUNCTIONS */

		/// <summary>
		/// Carries out RSA transformation using public key
		/// </summary>
		/// <param name="data">Data (<b>must</b> be same byte length as key modulus)</param>
		/// <param name="publicKeyStr">Public key in internal String format</param>
		/// <returns>Transformed data</returns>
		public ubyte[] RawPublic(ubyte[] data, String publicKeyStr)
		{
			ubyte[] b;
			b.length = data.length;
			b = data;
			int r = RSA_RawPublic(b, b.length, publicKeyStr, 0);
			if (r != 0) return null;
			return b;
		}

		/// <summary>
		/// Carries out RSA transformation using private key
		/// </summary>
		/// <param name="data">Data (<b>must</b> be same byte length as key modulus)</param>
		/// <param name="privateKeyStr">Private key in internal String format</param>
		/// <returns>Transformed data</returns>
		public ubyte[] RawPrivate(ubyte[] data, String privateKeyStr)
		{
			ubyte[] b;
			b.length = data.length;
			b = data;
			int r = RSA_RawPrivate(b, b.length, privateKeyStr, 0);
			if (r != 0) return null;
			return b;
		}

		/// <summary>
		/// Type of encoding to apply (or use to decode). <em>Deprecated.</em>
		/// </summary>
		public enum EncodeFor
		{
			/// <summary>
			/// EME-PKCS1-V1_5
			/// </summary>
			Encryption = 0,
			/// <summary>
			/// EME-OAEP
			/// </summary>
			Encryption_OAEP = 0x10,
			/// <summary>
			/// EMSA-PKCS1-V1_5 (using SHA-1)
			/// </summary>
			Signature = 0x20
		}
		/// <summary>
		/// Encoding method for encryption
		/// </summary>
		/// <remarks>See PKCS#1 v2.1 or <a href="http://www.faqs.org/rfcs/rfc3447.html">RFC 3447</a></remarks>
		public enum EME
		{
			/// <summary>
			/// EME-PKCS1-v1_5 encoding method
			/// </summary>
			PKCSv1_5 = 0,
			/// <summary>
			/// EME-OAEP encoding method
			/// </summary>
			OAEP = 0x10
		}

		/// <summary>
		/// Encode a message ready for "raw" RSA encryption or signing. <em>Deprecated.</em>
		/// </summary>
		/// <param name="keyBytes">Size of RSA key in bytes</param>
		/// <param name="message">Message data</param>
		/// <param name="method">Method to use</param>
		/// <returns>Encoded message block</returns>
		/// <remarks><em>Deprecated</em>. Use <c>EncodeMsgForEncryption</c>
		/// or <c>EncodeMsgForSignature</c> or <c>EncodeDigestForSignature</c></remarks>
		public ubyte[] EncodeMsg(int keyBytes, ubyte[] message, Rsa.EncodeFor method)
		{
			if (keyBytes <= 0) return null;
			ubyte[] b;
			b.length = keyBytes;
			int r = RSA_EncodeMsg(b, b.length, message, message.length, cast(int)method);
			if (r != 0) return null;
			return b;
		}

		/// <summary>
		/// Decode a PKCS-1 encoded block. <em>Deprecated.</em>
		/// </summary>
		/// <param name="data"></param>
		/// <param name="method"></param>
		/// <returns>Decoded data</returns>
		/// <remarks><em>Deprecated</em>. Use <c>DecodeMsgForEncryption</c> or <c>DecodeDigestForSignature</c></remarks>
		public ubyte[] DecodeMsg(ubyte[] data, Rsa.EncodeFor method)
		{
			int n = RSA_DecodeMsg(null, 0, data, data.length, cast(int)method);
			if (n <= 0) return null;
			ubyte[] b;
			b.length = n;
			n = RSA_DecodeMsg(b, b.length, data, data.length, cast(int)method);
			if (n < 0) return null;
			return b;
		}
		// NEW PKCS1 ENCODING AND DECODING FUNCTIONS [2006-07-27]
		/// <summary>
		/// Encode a message for encryption
		/// </summary>
		/// <param name="keyBytes">Number of bytes in the key</param>
		/// <param name="message">Message to be encoded</param>
		/// <param name="method">Encoding method to use</param>
		/// <returns>Encoded message block</returns>
		public ubyte[] EncodeMsgForEncryption(int keyBytes, ubyte[] message, Rsa.EME method)
		{
			if (keyBytes <= 0) return null;
			ubyte[] b;
			b.length = keyBytes;
			int r = RSA_EncodeMsg(b, b.length, message, message.length, cast(int)method);
			if (r != 0) return null;
			return b;
		}
		/// <summary>
		/// Decode a message for encryption
		/// </summary>
		/// <param name="data">Encoded message</param>
		/// <param name="method">Encoding method used</param>
		/// <returns>Decoded message</returns>
		public ubyte[] DecodeMsgForEncryption(ubyte[] data, Rsa.EME method)
		{
			int n = RSA_DecodeMsg(null, 0, data, data.length, cast(int)method);
			if (n <= 0) return null;
			ubyte[] b;
			b.length = n;
			n = RSA_DecodeMsg(b, b.length, data, data.length, cast(int)method);
			if (n < 0) return null;
			return b;
		}
		/// <summary>
		/// Encode a message for signature
		/// </summary>
		/// <param name="keyBytes">Number of bytes in the key</param>
		/// <param name="message">Message to be encoded</param>
		/// <param name="hashAlg">Message digest algorithm to use</param>
		/// <returns>Encoded block</returns>
		/// <remarks>Only EMSA-PKCS1-v1_5 is supported.
		/// Note we can only ever recover the <em>digest</em> from the
		/// encoded block.</remarks>
		public ubyte[] EncodeMsgForSignature(int keyBytes, ubyte[] message, HashAlgorithm hashAlg)
		{
			int options = cast(int)hashAlg + cast(int)Emsig.PKI_EMSIG_DEFAULT;
			if (keyBytes <= 0) return null;
			ubyte[] b;
			b.length = keyBytes;
			int r = RSA_EncodeMsg(b, b.length, message, message.length, options);
			if (r != 0) return null;
			return b;
		}
		/// <summary>
		/// Encode a message digest for signature
		/// </summary>
		/// <param name="keyBytes">Number of bytes in the key</param>
		/// <param name="digest">Digest of message</param>
		/// <param name="hashAlg">Message digest algorithm used to create digest</param>
		/// <returns>Encoded block</returns>
		/// <remarks>Only EMSA-PKCS1-v1_5 is supported.</remarks>
		public ubyte[] EncodeDigestForSignature(int keyBytes, ubyte[] digest, HashAlgorithm hashAlg)
		{
			int options = cast(int)hashAlg + cast(int)Emsig.PKI_EMSIG_DEFAULT + cast(int)Emsig.PKI_EMSIG_DIGESTONLY;
			if (keyBytes <= 0) return null;
			ubyte[] b;
			b.length = keyBytes;
			int r = RSA_EncodeMsg(b, b.length, digest, digest.length, options);
			if (r != 0) return null;
			return b;
		}
		/// <summary>
		/// Decode an encoded message for signature
		/// </summary>
		/// <param name="data">Encoded message for signature</param>
		/// <returns>Decoded message digest or an empty array on error</returns>
		/// <remarks>Only EMSA-PKCS1-v1_5 is supported.</remarks>
		public ubyte[] DecodeDigestForSignature(ubyte[] data)
		{
			const int options = cast(int)Emsig.PKI_EMSIG_DEFAULT;
			int n = RSA_DecodeMsg(null, 0, data, data.length, options);
			if (n <= 0) return null;
			ubyte[] b;
			b.length = n;
			n = RSA_DecodeMsg(b, b.length, data, data.length, options);
			if (n < 0) return null;
			return b;
		}
		/// <summary>
		/// Decode an encoded message for signature
		/// </summary>
		/// <param name="data">Encoded message for signature</param>
		/// <param name="getFullDigestInfo">If true, extract the full <c>DigestInfo</c>;
		/// otherwise just extract the message digest itself</param>
		/// <returns>Decoded data or an empty array on error</returns>
		/// <remarks>Only EMSA-PKCS1-v1_5 is supported.</remarks>
		public ubyte[] DecodeDigestForSignature(ubyte[] data, bool getFullDigestInfo)
		{
			int options;
			if (getFullDigestInfo)
				options  = cast(int)Emsig.PKI_EMSIG_DEFAULT + cast(int)Emsig.PKI_EMSIG_DIGINFO;
			else
				options = cast(int)Emsig.PKI_EMSIG_DEFAULT;
			int n = RSA_DecodeMsg(null, 0, data, data.length, options);
			if (n <= 0) return null;
			ubyte[] b;
			b.length = n;
			n = RSA_DecodeMsg(b, b.length, data, data.length, options);
			if (n < 0) return null;
			return b;
		}
	}

	/// <summary>
	/// PKCS-12 (PFX) File Functions
	/// </summary>
	public class Pfx
	{
		private const int PKI_PFX_NO_PRIVKEY = 0x10;

		public this(){}	// Static methods only, so hide constructor.
		/* PKCS12 FILE FUNCTIONS */
		/// <summary>
		/// Creates a simple PFX (PKCS-12) file from an X.509 certificate and (optional) encrypted private key file
		/// </summary>
		/// <param name="fileToMake">name of output file to be created</param>
		/// <param name="certFile">filename of the subject's X.509 certificate (required in all cases)</param>
		/// <param name="privateKeyFile">filename of the subject's encrypted private key in pkcs-8 format</param>
		/// <param name="password"></param>
		/// <param name="friendlyName">friendly name identification for the subject (required)</param>
		/// <param name="excludePrivateKey"><b>true</b> to exclude the private key data (i.e. just include the certificate)</param>
		/// <returns></returns>
		public int MakeFile(String fileToMake, String certFile, String privateKeyFile, String password, String friendlyName, bool excludePrivateKey)
		{
			return PFX_MakeFile(fileToMake, certFile, privateKeyFile, password, friendlyName, (excludePrivateKey ? 1 : 0));
		}

		/// <summary>
		/// Verifies that the MacData signature in PKCS-12 file is OK
		/// </summary>
		/// <param name="fileName">Name of PKCS-12 file to be checked</param>
		/// <param name="password"></param>
		/// <returns><b>true</b> if signature is OK</returns>
		public bool SignatureIsValid(String fileName, String password)
		{
			int r = PFX_VerifySig(fileName, password, 0);
			return (0 == r ? true : false);
		}

	}

	/// <summary>
	/// X.509 Certificate Functions
	/// </summary>
	public class X509
	{
		public this(){}	// Static methods only, so hide constructor.

		/// <summary>
		/// Options to create X.509 certificate/certificate request
		/// </summary>
		public enum Options
		{
			/// <summary>
			/// Default options
			/// </summary>
			None = 0,
			/// <summary>
			/// Sign with sha1WithRSAEncryption
			/// </summary>
			SigAlg_Sha1WithRSAEncryption = 0,
			/// <summary>
			/// Sign with md5WithRSAEncryption
			/// </summary>
			SigAlg_Md5WithRSAEncryption = 1,
			/// <summary>
			/// Sign with md2WithRSAEncryption
			/// </summary>
			SigAlg_Md2WithRSAEncryption = 2,
			/// <summary>
			/// Create in PEM (base64) format (default for CSR request)
			/// </summary>
			FormatPem = 0x10000,
			/// <summary>
			/// Create in binary format (default for certificate)
			/// </summary>
			FormatBinary = 0x20000,
			/// <summary>
			/// Create a request with the "kludge" that omits the strictly mandatory attributes completely
			/// (default = include attributes with zero-length field)
			/// </summary>
			RequestKludge = 0x100000,
			/// <summary>
			/// Disable the BasicConstraints extension (default = include)
			/// </summary>
			NoBasicConstraints = 0x2000000,
			/// <summary>
			/// Set the BasicConstraints subject type to be a CA (default = End Entity)
			/// </summary>
			SetAsCA = 0x4000000,
			/// <summary>
			/// Create a Version 1 certificate, i.e. no extensions (default = Version 3)
			/// </summary>
			VersionOne = 0x8000000
		}

		/// <summary>
		/// Options for key usage in certificate
		/// </summary>
		/// <remarks>These should be self-explanatory</remarks>
		public enum KeyUsageOptions
		{
			/// <summary>
			///
			/// </summary>
			None = 0,
			/// <summary>
			///
			/// </summary>
			DigitalSignature = 0x0001,
			/// <summary>
			///
			/// </summary>
			NonRepudiation = 0x0002,
			/// <summary>
			///
			/// </summary>
			KeyEncipherment = 0x0004,
			/// <summary>
			///
			/// </summary>
			DataEncipherment = 0x0008,
			/// <summary>
			///
			/// </summary>
			KeyAgreement = 0x0010,
			/// <summary>
			///
			/// </summary>
			KeyCertSign = 0x0020,
			/// <summary>
			///
			/// </summary>
			CrlSign = 0x0040,
			/// <summary>
			///
			/// </summary>
			EncipherOnly = 0x0080,
			/// <summary>
			///
			/// </summary>
			DecipherOnly = 0x0100
		}

		/* X509 CERTIFICATE FUNCTIONS */
		/// <summary>
		/// Creates a new X.509 certificate using subject's public key and issuer's private key files.
		/// </summary>
		/// <param name="certFile">Name of file to be created</param>
		/// <param name="issuerCert"></param>
		/// <param name="subjectPubkeyFile">File containing subjects public key data</param>
		/// <param name="issuerPvkInfoFile">File containing issuer's private key data</param>
		/// <param name="certNum">Issue number for new certificate</param>
		/// <param name="yearsValid">How many years to be valid</param>
		/// <param name="distName">Distinguished name String</param>
		/// <param name="email">Optional RFC822 email address</param>
		/// <param name="keyUsageOptions">Key usage options</param>
		/// <param name="password">For issuer's private key</param>
		/// <param name="options"></param>
		/// <returns>Zero if successful or error code</returns>
		public int MakeCert(String certFile, String issuerCert,
			String subjectPubkeyFile, String issuerPvkInfoFile,
			int certNum, int yearsValid, String distName, String email,
			KeyUsageOptions keyUsageOptions, String password, Options options)
		{
			return X509_MakeCert(certFile, issuerCert,
				subjectPubkeyFile, issuerPvkInfoFile,
				certNum, yearsValid, distName, email,
				cast(int)keyUsageOptions, password, cast(int)options);
		}

		/// <summary>
		/// Creates a self-signed X.509 certificate
		/// </summary>
		/// <param name="certFile"></param>
		/// <param name="privateKeyFile"></param>
		/// <param name="certNum"></param>
		/// <param name="yearsValid"></param>
		/// <param name="distName"></param>
		/// <param name="email"></param>
		/// <param name="keyUsageOptions"></param>
		/// <param name="password"></param>
		/// <param name="options"></param>
		/// <returns>Zero if successful or error code</returns>
		public int MakeCertSelf(String certFile, String privateKeyFile,
			int certNum, int yearsValid, String distName, String email,
			KeyUsageOptions keyUsageOptions, String password, Options options)
		{
			return X509_MakeCertSelf(certFile, privateKeyFile,
				certNum, yearsValid, distName, email,
				cast(int)keyUsageOptions, password, cast(int)options);
		}

		/// <summary>
		/// Creates a PKCS #10 certificate signing request (CSR) using the subject's private key file
		/// </summary>
		/// <param name="reqFile">Name of Certificate Signing Request file to be created</param>
		/// <param name="privateKeyFile">Name of subject's encrypted private key file</param>
		/// <param name="distName">Specifying the subject's distinguished name as a set of attribute key=value pairs
		/// separated with semi-colons (;)</param>
		/// <param name="password">password for Subject's encrypted private key file</param>
		/// <param name="options"></param>
		/// <returns>Zero if successful or error code</returns>
		public int CertRequest(String reqFile, String privateKeyFile,
			String distName, String password, Options options)
		{
			return X509_CertRequest(reqFile, privateKeyFile,
				distName, "", password, cast(int)options);
		}

		/// <summary>
		/// Verifies that an X.509 certificate has been signed by its issuer
		/// </summary>
		/// <param name="certToVerify">Filename of certificate to verify</param>
		/// <param name="issuerCert">Filename of purported issuer's certificate</param>
		/// <returns>Zero if the certificate's signature is valid; -1 if the validation fails; otherwise an error code.</returns>
		public int VerifyCert(String certToVerify, String issuerCert)
		{
			return X509_VerifyCert(certToVerify, issuerCert, 0);
		}

		/// <summary>
		/// Calculates the thumbprint (message digest hash) of an X.509 certificate
		/// </summary>
		/// <param name="certFile">Path to file</param>
		/// <param name="hashAlg">HashAlgorithm</param>
		/// <returns>String containing the message digest in hexadecimal format</returns>
		public String CertThumb(String certFile, HashAlgorithm hashAlg)
		{
			String sb;
			int n = X509_CertThumb(certFile, sb, 0, cast(int)hashAlg);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertThumb(certFile, sb, sb.length, cast(int)hashAlg);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Verifies that an X.509 certificate is currently valid as per system clock
		/// </summary>
		/// <param name="certFile">Certificate filename</param>
		/// <returns>True if certificate is currently valid, otherwise false</returns>
		public bool CertIsValidNow(String certFile)
		{
			// We fudge the subtleties of time validity and invalid format
			int r = X509_CertIsValidNow(certFile, 0);
			return (r == 0);
		}

		/// <summary>
		/// Returns date and time certificate was issued
		/// </summary>
		/// <param name="certFile"></param>
		/// <returns>Date and time in ISO format or Empty String if error</returns>
		public String CertIssuedOn(String certFile)
		{
			String sb;
			int n = X509_CertIssuedOn(certFile, sb, 0, 0);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertIssuedOn(certFile, sb, sb.length, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Returns date and time certificate expires
		/// </summary>
		/// <param name="certFile"></param>
		/// <returns>Date and time in ISO format or Empty String if error</returns>
		public String CertExpiresOn(String certFile)
		{
			String sb;
			int n = X509_CertExpiresOn(certFile, sb, 0, 0);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertExpiresOn(certFile, sb, sb.length, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Returns serial number in hex format
		/// </summary>
		/// <param name="certFile"></param>
		/// <returns>Serial number in hex format or Empty String if error</returns>
		public String CertSerialNumber(String certFile)
		{
			String sb;
			int n = X509_CertSerialNumber(certFile, sb, 0, 0);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertSerialNumber(certFile, sb, sb.length, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Creates a message digest of the Issuer's name and the cert serial number
		/// </summary>
		/// <param name="certFile"></param>
		/// <param name="algorithm">Hash algorithm to use (default SHA-1)</param>
		/// <returns>Message digest in hex format or Empty String if error</returns>
		/// <remarks>This (should) give a unique identifier for any certificate</remarks>
		public String HashIssuerAndSN(String certFile, HashAlgorithm algorithm)
		{
			String sb;
			int n = X509_HashIssuerAndSN(certFile, sb, 0, cast(int)algorithm);
			if (n <= 0) return null;
			sb.length = n;
			X509_HashIssuerAndSN(certFile, sb, sb.length, cast(int)algorithm);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Gets the issuer name of an X.509 certificate
		/// </summary>
		/// <param name="certFile">Certificate filename</param>
		/// <param name="delimiter">Default is semicolon ";" </param>
		/// <returns>Issuer name or Empty String if error</returns>
		public String CertIssuerName(String certFile, String delimiter)
		{
			String sb;
			int n = X509_CertIssuerName(certFile, sb, 0, delimiter, 0);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertIssuerName(certFile, sb, sb.length, delimiter, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Gets the subject name of an X.509 certificate
		/// </summary>
		/// <param name="certFile">Certificate filename</param>
		/// <param name="delimiter">Default is semicolon ";" </param>
		/// <returns>Subject name or Empty String if error</returns>
		public String CertSubjectName(String certFile, String delimiter)
		{
			String sb;
			int n = X509_CertSubjectName(certFile, sb, 0, delimiter, 0);
			if (n <= 0) return null;
			sb.length = n;
			X509_CertSubjectName(certFile, sb, sb.length, delimiter, 0);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Extracts an X.509 certificate from a PKCS-7 "certs-only" certificate chain file,
		/// saving the output directly as a new file.
		/// </summary>
		/// <param name="outputFile">Name of output file to be created</param>
		/// <param name="inputFile">Name of the PKCS-7 "certs-only" file</param>
		/// <param name="index">specifying which certificate (1,2,...) in the chain to extract, or 0 to return the count of certificates in the set</param>
		/// <returns>If successful and <c>index</c> is greater than zero, it returns the number of bytes written to the output file,
		/// which may be zero if no certificate could be found at the given index.
		/// However, if <c>index</c> is zero, it returns the count of certificates found in the list.
		/// If an error occurred, it returns a negative error code.</returns>
		/// <remarks>Refer to the manual for further information and remarks on the use of this function.</remarks>
		public int GetCertFromP7Chain(String outputFile, String inputFile, int index)
		{
			return X509_GetCertFromP7Chain(outputFile, inputFile, index, 0);
		}

		/// <summary>
		/// Extracts an X.509 certificate from a PKCS-12 PFX/.p12 file,
		/// saving the output directly as a new file.
		/// </summary>
		/// <param name="outputFile">Name of output file to be created</param>
		/// <param name="inputFile">Name of the PKCS-12 file</param>
		/// <returns>If successful, it returns the number of bytes written to the output file; otherwise it returns a negative error code</returns>
		/// <remarks>Refer to the manual for further information and remarks on the use of this function.</remarks>
		public int GetCertFromPFX(String outputFile, String inputFile)
		{
			return X509_GetCertFromPFX(outputFile, inputFile, "", 0);
		}
	}

	/// <summary>
	/// Character conversion routines
	/// </summary>
	public class Cnv
	{
		public this(){}	// Static methods only, so hide constructor.

		// HEX CONVERSION PROTOTYPES
		/// <summary>
		/// Converts 8-bit binary data to equivalent hexadecimal String format
		/// </summary>
		/// <param name="binaryData"></param>
		/// <returns></returns>
		public String ToHex(ubyte[] binaryData)
		{
			int nBytes = binaryData.length;
			int nChars = 2 * nBytes;
			if (nBytes == 0) return null;
			String sb;
			sb.length = nChars;
			nChars = CNV_HexStrFromBytes(sb, nChars, binaryData, nBytes);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Converts the specified String representation of a value consisting of hexadecimal (base 16) digits to an equivalent array of 8-bit unsigned integers.
		/// </summary>
		/// <param name="s"></param>
		/// <returns></returns>
		public ubyte[] FromHex(String s)
		{
			if (s == null) return null;
			int nBytes = s.length / 2;
			ubyte[] Data;
			Data.length = nBytes;
			nBytes = CNV_BytesFromHexStr(Data, nBytes, s);
			if(Data.length != nBytes)
			{
				Data = Data[0..nBytes];
			}
			return Data;
		}

		/// <summary>
		/// Filters non-hexadecimal characters from a String
		/// </summary>
		/// <param name="s"></param>
		/// <returns>Filtered String</returns>
		public String HexFilter(String s)
		{
			int nChars;
			if (s == null) return null;
			String sb;
			sb.length = s.length;
			nChars = CNV_HexFilter(sb, s, s.length);
			if (nChars <= 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/* BASE64 CONVERSION FUNCTIONS */
		/// <summary>
		/// Filters non-base64 characters from a String
		/// </summary>
		/// <param name="s"></param>
		/// <returns>Filtered String</returns>
		public String Base64Filter(String s)
		{
			int nChars;
			if (s == null) return null;
			String sb;
			sb.length = s.length;
			nChars = CNV_B64Filter(sb, s, s.length);
			if (nChars <= 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/* UTF-8 FUNCTIONS */
		/// <summary>
		/// Checks that a String contains only valid UTF-8 encoded characters
		/// </summary>
		/// <param name="s">input String to check</param>
		/// <returns>Zero if the String is invalid UTF-8,
		/// or a positive number if the String is valid UTF-8, where the value of the
		/// number indicates the nature of the encoded characters:
		/// <list type="table">
		/// <item><term>0</term><description>Not valid UTF-8</description></item>
		/// <item><term>1</term><description>Valid UTF-8, all chars are 7-bit ASCII</description></item>
		/// <item><term>2</term><description>Valid UTF-8, contains at least one 8-bit ANSI character</description></item>
		/// <item><term>3</term><description>Valid UTF-8, contains at least one multi-byte character
		/// that cannot be represented in a single-byte character set</description></item>
		///</list>
		/// </returns>
		/// <remarks>
		///`Overlong' UTF-8 sequences and illegal surrogates are rejected as invalid.
		///</remarks>
		public int CheckUTF8(String s)
		{
			return CNV_CheckUTF8(s);
		}
	}



	/// <summary>
	/// Triple DES Cipher (3DES, TDEA)
	/// </summary>
	public class Tdea
	{
	  private Cnv cnv;
		public this(){
		  cnv = new Cnv;
		}
		public ~this(){
		  cnv = null;
		}

		/* TRIPLE DES FUNCTIONS */

		/// <summary>
		/// Block size in bytes
		/// </summary>
		public const int BlockSize = 8;

		// A common internal function to return the required String for the mode
		public String ModeString(Mode mode)	{
			switch(mode)
			{
				case Mode.CBC:
					return "CBC";
				case Mode.CFB:
					return "CFB";
				case Mode.OFB:
					return "OFB";
				case Mode.CTR:
					return "CTR";
				case Mode.ECB:
				default:
					return "ECB";
			}
		}

		/// <summary>
		/// Encrypt data in byte array
		/// </summary>
		/// <param name="input">Input data</param>
		/// <param name="key">Key of exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="iv">IV of exactly 8 bytes or <c>null</c> for ECB mode</param>
		/// <returns>Ciphertext in byte array or empty array on error</returns>
		/// <remarks>For ECB and CBC modes, input data length <b>must</b> be an exact multiple of the block length</remarks>
		/// <overloads>Three overloads: one for bytes, one for hex, one for general encoding</overloads>
		public ubyte[] Encrypt(ubyte[] input, ubyte[] key, Mode mode, ubyte[] iv)
		{
			String strMode = ModeString(mode);
			ubyte[] b;
			b.length = input.length;
			int r = TDEA_BytesMode(b, input, input.length, key, cast(int)Direction.Encrypt, strMode, iv);
			if (r != 0)
				b = null;
			return b;
		}

		/// <summary>
		/// Decrypt data in byte array
		/// </summary>
		/// <param name="input">Input data</param>
		/// <param name="key">Key of exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="iv">IV of exactly 8 bytes or <c>null</c> for ECB mode</param>
		/// <returns>Decrypted data in byte array or empty array on error</returns>
		/// <remarks>For ECB and CBC modes, input data length <b>must</b> be an exact multiple of the block length</remarks>
		/// <overloads>Three overloads: one for bytes, one for hex, one for general encoding</overloads>
		public ubyte[] Decrypt(ubyte[] input, ubyte[] key, Mode mode, ubyte[] iv)
		{
			String strMode = ModeString(mode);
			ubyte[] b;
			b.length = input.length;
			int r = TDEA_BytesMode(b, input, input.length, key, cast(int)Direction.Decrypt, strMode, iv);
			if (r != 0)
				b = null;
			return b;
		}

		/// <summary>
		/// Encrypt hex-encoded data String
		/// </summary>
		/// <param name="inputHex">Hex-encoded input data</param>
		/// <param name="keyHex">Hex-encoded key representing exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivHex">Hex-encoded IV representing exactly 8 bytes or <c>""</c> for ECB mode</param>
		/// <returns>Ciphertext in hex-encoded String or empty String on error</returns>
		/// <remarks>For ECB and CBC modes, the length of the decoded input bytes <b>must</b> be an exact multiple of the block length</remarks>
		public String Encrypt(String inputHex, String keyHex, Mode mode, String ivHex)
		{
			String strMode = ModeString(mode);
			String sb;
			sb.length = inputHex.length;
			int r = TDEA_HexMode(sb, inputHex, keyHex, cast(int)Direction.Encrypt, strMode, ivHex);
			if (r != 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Decrypt hex-encoded data String
		/// </summary>
		/// <param name="inputHex">Hex-encoded input data</param>
		/// <param name="keyHex">Hex-encoded key representing exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivHex">Hex-encoded IV representing exactly 8 bytes or <c>""</c> for ECB mode</param>
		/// <returns>Decrypted data in hex-encoded String or empty String on error</returns>
		/// <remarks>For ECB and CBC modes, the length of the decoded input bytes <b>must</b> be an exact multiple of the block length</remarks>
		public String Decrypt(String inputHex, String keyHex, Mode mode, String ivHex)
		{
			String strMode = ModeString(mode);
			String sb;
			sb.length = inputHex.length;
			int r = TDEA_HexMode(sb, inputHex, keyHex, cast(int)Direction.Decrypt, strMode, ivHex);
			if (r != 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Encrypt encoded data String
		/// </summary>
		/// <param name="inputStr">Encoded input data</param>
		/// <param name="keyStr">Encoded key representing exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivStr">Encoded IV representing exactly 8 bytes or <c>""</c> for ECB mode</param>
		/// <param name="encodingBase">Type of encoding used </param>
		/// <returns>Ciphertext in hex-encoded String or empty String on error</returns>
		/// <remarks>For ECB and CBC modes, the length of the decoded input bytes <b>must</b> be an exact multiple of the block length</remarks>
		public String Encrypt(String inputStr, String keyStr, Mode mode, String ivStr, EncodingBase encodingBase)
		{
			String strMode = ModeString(mode);
			String sb;
			sb.length = inputStr.length;
			int r = -999;
			switch(encodingBase)
			{
				case EncodingBase.Base16:
					r = TDEA_HexMode(sb, inputStr, keyStr, cast(int)Direction.Encrypt, strMode, ivStr);
					break;
				case EncodingBase.Base64:
					r = TDEA_B64Mode(sb, inputStr, keyStr, cast(int)Direction.Encrypt, strMode, ivStr);
					break;
			}
			if (r != 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Decrypt encoded data String
		/// </summary>
		/// <param name="inputStr">Encoded input data</param>
		/// <param name="keyStr">Encoded key representing exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivStr">Encoded IV representing exactly 8 bytes or <c>""</c> for ECB mode</param>
		/// <param name="encodingBase">Type of encoding used </param>
		/// <returns>Decrypted data in encoded String or empty String on error</returns>
		/// <remarks>For ECB and CBC modes, the length of the decoded input bytes <b>must</b> be an exact multiple of the block length</remarks>
		public String Decrypt(String inputStr, String keyStr, Mode mode, String ivStr, EncodingBase encodingBase)
		{
			String strMode = ModeString(mode);
			String sb;
			sb.length = inputStr.length;
			int r = -999;
			switch(encodingBase)
			{
				case EncodingBase.Base16:
					r = TDEA_HexMode(sb, inputStr, keyStr, cast(int)Direction.Decrypt, strMode, ivStr);
					break;
				case EncodingBase.Base64:
					r = TDEA_B64Mode(sb, inputStr, keyStr, cast(int)Direction.Decrypt, strMode, ivStr);
					break;
			}
			if (r != 0) return null;
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Encrypt a file
		/// </summary>
		/// <param name="fileOut">Name of output file to be created or overwritten</param>
		/// <param name="fileIn">Name of input file</param>
		/// <param name="key">Key of exactly 24 bytes (192 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="iv">IV of exactly 8 bytes or <c>null</c> for ECB mode</param>
		/// <returns>0 if successful or non-zero error code</returns>
		/// <remarks><c>fileOut</c> and <c>fileIn</c> must <b>not</b> be the same</remarks>
		/// <overloads>Two overloads: one for byte parameters, one for hex</overloads>
		public int FileEncrypt(String fileOut, String fileIn, ubyte[] key, Mode mode, ubyte[] iv)
		{
			String strMode = ModeString(mode);
			return TDEA_File(fileOut, fileIn, key, cast(int)Direction.Encrypt, strMode, iv);
		}
		/// <summary>
		/// Decrypt a file
		/// </summary>
		/// <param name="fileOut">Name of output file to be created or overwritten</param>
		/// <param name="fileIn">Name of input file</param>
		/// <param name="key">Key of exactly 8 bytes (64 bits)</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="iv">IV of exactly 8 bytes or <c>null</c> for ECB mode</param>
		/// <returns>0 if successful or non-zero error code</returns>
		/// <remarks><c>fileOut</c> and <c>fileIn</c> must <b>not</b> be the same</remarks>
		/// <overloads>Two overloads: one for byte parameters, one for hex</overloads>
		public int FileDecrypt(String fileOut, String fileIn, ubyte[] key, Mode mode, ubyte[] iv)
		{
			String strMode = ModeString(mode);
			return TDEA_File(fileOut, fileIn, key, cast(int)Direction.Decrypt, strMode, iv);
		}

		/// <summary>
		/// Encrypt a file passing key and IV as hex Strings
		/// </summary>
		/// <param name="fileOut">Name of output file to be created or overwritten</param>
		/// <param name="fileIn">Name of input file</param>
		/// <param name="keyHex">Hex-encoded key of exact length</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivHex">Hex-encoded IV or <c>""</c> for ECB mode</param>
		/// <returns>0 if successful or non-zero error code</returns>
		/// <remarks><c>fileOut</c> and <c>fileIn</c> must <b>not</b> be the same.
		/// The output file is in binary format.</remarks>
		public int FileEncrypt(String fileOut, String fileIn, String keyHex, Mode mode, String ivHex)
		{
			String strMode = ModeString(mode);
			return TDEA_File(fileOut, fileIn, cnv.FromHex(keyHex), cast(int)Direction.Encrypt, strMode, cnv.FromHex(ivHex));
		}
		/// <summary>
		/// Decrypt a file passing key and IV as hex Strings
		/// </summary>
		/// <param name="fileOut">Name of output file to be created or overwritten</param>
		/// <param name="fileIn">Name of input file</param>
		/// <param name="keyHex">Hex-encoded key of exact length</param>
		/// <param name="mode">Cipher Mode</param>
		/// <param name="ivHex">Hex-encoded IV or <c>""</c> for ECB mode</param>
		/// <returns>0 if successful or non-zero error code</returns>
		/// <remarks><c>fileOut</c> and <c>fileIn</c> must <b>not</b> be the same.
		/// The output file is in binary format.</remarks>
		public int FileDecrypt(String fileOut, String fileIn, String keyHex,
			Mode mode, String ivHex)
		{
			String strMode = ModeString(mode);
			return TDEA_File(fileOut, fileIn, cnv.FromHex(keyHex), cast(int)Direction.Decrypt, strMode, cnv.FromHex(ivHex));
		}
	}

	/// <summary>
	/// Message Digest Hash Functions
	/// </summary>
	public class Hash
	{
		public this(){}	// Static methods only, so hide constructor.

		private const int HASH_MODE_TEXT = 0x10000;

		/* MESSAGE DIGEST HASH FUNCTIONS */
		/// <summary>
		/// Creates hash digest of byte input in byte format
		/// </summary>
		/// <param name="message"></param>
		/// <param name="hashAlg"></param>
		/// <returns></returns>
		public ubyte[] BytesFromBytes(ubyte[] message, HashAlgorithm hashAlg)
		{
			ubyte[] digest;
			digest.length = cast(int)Max.PKI_MAX_HASH_BYTES;
			HASH_Bytes(digest, digest.length, message, message.length, cast(int)hashAlg);
			return digest;
		}
		/// <summary>
		/// Creates hash digest of byte input in hex format
		/// </summary>
		/// <param name="message"></param>
		/// <param name="hashAlg"></param>
		/// <returns></returns>
		public String HexFromBytes(ubyte[] message, HashAlgorithm hashAlg)
		{
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			HASH_HexFromBytes(sb, sb.length, message, message.length, cast(int)hashAlg);
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Creates hash digest of String input in hex format
		/// </summary>
		/// <param name="message"></param>
		/// <param name="hashAlg"></param>
		/// <returns></returns>
		public String HexFromString(String message, HashAlgorithm hashAlg)
		{
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			//ubyte[] b = System.Text.Encoding.Default.GetBytes(message);
			HASH_HexFromBytes(sb, sb.length, message, message.length, cast(int)hashAlg);
			sb = .toString(sb);
			return sb;
		}

		/// <summary>
		/// Creates hash digest of a binary file
		/// </summary>
		/// <param name="fileName"></param>
		/// <param name="hashAlg"></param>
		/// <returns>Message digest in byte format</returns>
		public ubyte[] BytesFromFile(String fileName, HashAlgorithm hashAlg)
		{
			ubyte[] digest;
			digest.length = cast(int)Max.PKI_MAX_HASH_BYTES;
			HASH_File(digest, digest.length, fileName, cast(int)hashAlg);
			return digest;
		}
		/// <summary>
		/// Creates hash digest in hex format of a binary file
		/// </summary>
		/// <param name="fileName"></param>
		/// <param name="hashAlg"></param>
		/// <returns>Message digest in hex format</returns>
		public String HexFromFile(String fileName, HashAlgorithm hashAlg)
		{
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			HASH_HexFromFile(sb, sb.length, fileName, cast(int)hashAlg);
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Creates hash digest in hex format of a text file, treating CR-LF pairs as a single LF
		/// </summary>
		/// <param name="fileName"></param>
		/// <param name="hashAlg"></param>
		/// <returns>Message digest in hex format</returns>
		public String HexFromTextFile(String fileName, HashAlgorithm hashAlg)
		{
			String sb;
			sb.length = cast(int)Max.PKI_MAX_HASH_LEN;
			HASH_HexFromFile(sb, sb.length, fileName, cast(int)hashAlg | HASH_MODE_TEXT);
			sb = .toString(sb);
			return sb;
		}
	}

	/// <summary>
	/// Data Wiping Functions
	/// </summary>
	public class Wipe
	{
		public this(){}	// Static methods only, so hide constructor.

		/* MISC UTILITIES */
		// NB You can't use this to wipe a C# String.

		/// <summary>
		/// Securely wipes and deletes a file using 7-pass DOD standards
		/// </summary>
		/// <param name="fileName">Name of file to be wiped</param>
		/// <returns><b>true</b> if successful; <b>false</b> if fails</returns>
		public bool File(String fileName)
		{
			int r = WIPE_File(fileName, 0);
			return (r == 0);
		}
		/// <summary>
		/// Zeroises data in memory
		/// </summary>
		/// <param name="data">data to be wiped</param>
		/// <returns><b>true</b> if successful; <b>false</b> if fails</returns>
		public bool Data(ubyte[] data)
		{
			int r = WIPE_Data(data, data.length);
			return (r == 0);
		}
		/// <summary>
		/// Zeroises a String
		/// </summary>
		/// <param name="sb">String to be wiped</param>
		/// <returns><b>true</b> if successful; <b>false</b> if fails</returns>
		/// <remarks>NB You can't wipe an ordinary String as they are immutable in C#</remarks>
		public bool WIPE_String(String sb)
		{
			int r = WIPE_Data(sb, sb.length);
			return (r == 0);
		}
	}

	/// <summary>
	/// Random Number Generator to ANSI X9.17/X9.31
	/// </summary>
	public class Rng
	{
		public this(){}	// Static methods only, so hide constructor.

		/// <summary>
		/// Generates an array of random bytes
		/// </summary>
		/// <param name="numBytes">Required number</param>
		/// <returns>Array of bytes</returns>
		public ubyte[] Bytes(int numBytes)
		{
			ubyte[] b;
			b.length = numBytes;
			RNG_Bytes(b, b.length, "", 0);
			return b;
		}
		/// <summary>
		/// Generates a single random octet (byte)
		/// </summary>
		/// <returns>Single byte value</returns>
		public byte Octet()
		{
			ubyte[] b;
			b.length = 1;
			RNG_Bytes(b, b.length, "", 0);
			return b[0];
		}
		/// <summary>
		/// Generates a random number (integer) in a given range
		/// </summary>
		/// <param name="lower">lower value of range</param>
		/// <param name="upper">upper value of range</param>
		/// <returns>Random integer</returns>
		public int Number(int lower, int upper)
		{
			return RNG_Number(lower, upper);
		}
	}

	/// <summary>
	/// Password Dialog Functions
	/// </summary>
	public class Pwd
	{
		public this(){}	// Static methods only, so hide constructor.

		/// <summary>
		/// Opens a dialog box to receive a password
		/// </summary>
		/// <param name="maxChars">Maximum characters expected in password</param>
		/// <param name="caption">Caption for dialog window</param>
		/// <returns>String containing password or Empty String if user cancels</returns>
		/// <overloads>Opens a dialog box to receive a password.</overloads>
		public String Prompt(int maxChars, String caption)
		{
			String sb;
			sb.length = maxChars;
			int r = PWD_Prompt(sb, sb.length, caption);
			if (r < 0)
				return null;
			sb = .toString(sb);
			return sb;
		}
		/// <summary>
		/// Opens a dialog box to receive a password
		/// </summary>
		/// <param name="maxChars">Maximum characters expected in password</param>
		/// <param name="caption">Caption for dialog window</param>
		/// <param name="prompt">Wording for prompt</param>
		/// <returns>String containing password or Empty String if user cancels</returns>
		public String Prompt(int maxChars, String caption, String prompt)
		{
			String sb;
			sb.length = maxChars;
			int r = PWD_PromptEx(sb, sb.length, caption, prompt, 0);
			if (r < 0)
				return null;
			sb = .toString(sb);
			return sb;
		}
	}