nss-3.28.1nss-3.28.1

1 files changed, 674 insertions, 673 deletions

diff --git a/nss/lib/pk11wrap/pk11pbe.c b/nss/lib/pk11wrap/pk11pbe.c
index cc72faf..7837bfe 100644
--- a/nss/lib/pk11wrap/pk11pbe.c
+++ b/nss/lib/pk11wrap/pk11pbe.c
@@ -26,80 +26,78 @@
 
 typedef struct SEC_PKCS5PBEParameterStr SEC_PKCS5PBEParameter;
 struct SEC_PKCS5PBEParameterStr {
-    PLArenaPool     *poolp;
-    SECItem         salt;           /* octet string */
-    SECItem         iteration;      /* integer */
-    SECItem         keyLength;	/* PKCS5v2 only */
-    SECAlgorithmID  *pPrfAlgId;	/* PKCS5v2 only */
-    SECAlgorithmID  prfAlgId;	/* PKCS5v2 only */
+    PLArenaPool *poolp;
+    SECItem salt;              /* octet string */
+    SECItem iteration;         /* integer */
+    SECItem keyLength;         /* PKCS5v2 only */
+    SECAlgorithmID *pPrfAlgId; /* PKCS5v2 only */
+    SECAlgorithmID prfAlgId;   /* PKCS5v2 only */
 };
 
-/* PKCS5 V2 has an algorithm ID for the encryption and for 
- * the key generation. This is valid for SEC_OID_PKCS5_PBES2 
+/* PKCS5 V2 has an algorithm ID for the encryption and for
+ * the key generation. This is valid for SEC_OID_PKCS5_PBES2
  * and SEC_OID_PKCS5_PBMAC1
  */
 struct sec_pkcs5V2ParameterStr {
-    PLArenaPool    *poolp;
-    SECAlgorithmID pbeAlgId;   /* real pbe algorithms */
+    PLArenaPool *poolp;
+    SECAlgorithmID pbeAlgId;    /* real pbe algorithms */
     SECAlgorithmID cipherAlgId; /* encryption/mac */
 };
 
 typedef struct sec_pkcs5V2ParameterStr sec_pkcs5V2Parameter;
 
-
 /* template for PKCS 5 PBE Parameter.  This template has been expanded
  * based upon the additions in PKCS 12.  This should eventually be moved
  * if RSA updates PKCS 5.
  */
 const SEC_ASN1Template SEC_PKCS5PBEParameterTemplate[] =
-{
-    { SEC_ASN1_SEQUENCE, 
-	0, NULL, sizeof(SEC_PKCS5PBEParameter) },
-    { SEC_ASN1_OCTET_STRING, 
-	offsetof(SEC_PKCS5PBEParameter, salt) },
-    { SEC_ASN1_INTEGER,
-	offsetof(SEC_PKCS5PBEParameter, iteration) },
-    { 0 }
-};
+    {
+      { SEC_ASN1_SEQUENCE,
+        0, NULL, sizeof(SEC_PKCS5PBEParameter) },
+      { SEC_ASN1_OCTET_STRING,
+        offsetof(SEC_PKCS5PBEParameter, salt) },
+      { SEC_ASN1_INTEGER,
+        offsetof(SEC_PKCS5PBEParameter, iteration) },
+      { 0 }
+    };
 
 const SEC_ASN1Template SEC_V2PKCS12PBEParameterTemplate[] =
-{   
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
-    { SEC_ASN1_OCTET_STRING, offsetof(SEC_PKCS5PBEParameter, salt) },
-    { SEC_ASN1_INTEGER, offsetof(SEC_PKCS5PBEParameter, iteration) },
-    { 0 }
-};
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
+      { SEC_ASN1_OCTET_STRING, offsetof(SEC_PKCS5PBEParameter, salt) },
+      { SEC_ASN1_INTEGER, offsetof(SEC_PKCS5PBEParameter, iteration) },
+      { 0 }
+    };
 
 SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
 
 /* SECOID_PKCS5_PBKDF2 */
 const SEC_ASN1Template SEC_PKCS5V2PBEParameterTemplate[] =
-{   
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
-    /* This is really a choice, but since we only understand this
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
+      /* This is really a choice, but since we only understand this
      * choice, just inline it */
-    { SEC_ASN1_OCTET_STRING, offsetof(SEC_PKCS5PBEParameter, salt) },
-    { SEC_ASN1_INTEGER, offsetof(SEC_PKCS5PBEParameter, iteration) },
-    { SEC_ASN1_INTEGER|SEC_ASN1_OPTIONAL, 
-		      offsetof(SEC_PKCS5PBEParameter, keyLength) },
-    { SEC_ASN1_POINTER | SEC_ASN1_XTRN | SEC_ASN1_OPTIONAL, 
-	offsetof(SEC_PKCS5PBEParameter, pPrfAlgId),
-	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { 0 }
-};
+      { SEC_ASN1_OCTET_STRING, offsetof(SEC_PKCS5PBEParameter, salt) },
+      { SEC_ASN1_INTEGER, offsetof(SEC_PKCS5PBEParameter, iteration) },
+      { SEC_ASN1_INTEGER | SEC_ASN1_OPTIONAL,
+        offsetof(SEC_PKCS5PBEParameter, keyLength) },
+      { SEC_ASN1_POINTER | SEC_ASN1_XTRN | SEC_ASN1_OPTIONAL,
+        offsetof(SEC_PKCS5PBEParameter, pPrfAlgId),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { 0 }
+    };
 
 /* SEC_OID_PKCS5_PBES2, SEC_OID_PKCS5_PBMAC1 */
 const SEC_ASN1Template SEC_PKCS5V2ParameterTemplate[] =
-{   
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
-    { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(sec_pkcs5V2Parameter, pbeAlgId),
-	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
-	offsetof(sec_pkcs5V2Parameter, cipherAlgId),
-	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { 0 }
-};
-
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SEC_PKCS5PBEParameter) },
+      { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(sec_pkcs5V2Parameter, pbeAlgId),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(sec_pkcs5V2Parameter, cipherAlgId),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { 0 }
+    };
 
 /*
  * maps a PBE algorithm to a crypto algorithm. for PKCS12 and PKCS5v1
@@ -108,32 +106,31 @@ const SEC_ASN1Template SEC_PKCS5V2ParameterTemplate[] =
 SECOidTag
 sec_pkcs5GetCryptoFromAlgTag(SECOidTag algorithm)
 {
-    switch(algorithm)
-    {
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC:
-	    return SEC_OID_DES_EDE3_CBC;
-	case SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC:
-	case SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC:
-	case SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC:
-	    return SEC_OID_DES_CBC;
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
-	    return SEC_OID_RC2_CBC;
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
-	    return SEC_OID_RC4;
-	case SEC_OID_PKCS5_PBKDF2:
-	case SEC_OID_PKCS5_PBES2:
-	case SEC_OID_PKCS5_PBMAC1:
-	    return SEC_OID_PKCS5_PBKDF2;
-	default:
-	    break;
+    switch (algorithm) {
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC:
+            return SEC_OID_DES_EDE3_CBC;
+        case SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC:
+        case SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC:
+        case SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC:
+            return SEC_OID_DES_CBC;
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
+            return SEC_OID_RC2_CBC;
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
+            return SEC_OID_RC4;
+        case SEC_OID_PKCS5_PBKDF2:
+        case SEC_OID_PKCS5_PBES2:
+        case SEC_OID_PKCS5_PBMAC1:
+            return SEC_OID_PKCS5_PBKDF2;
+        default:
+            break;
     }
 
     return SEC_OID_UNKNOWN;
@@ -151,27 +148,27 @@ sec_pkcs5_v2_get_v2_param(PLArenaPool *arena, SECAlgorithmID *algid)
     SECStatus rv;
 
     if (arena == NULL) {
-	localArena = arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
-	if (arena == NULL) {
-	    return NULL;
-	}
+        localArena = arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
+        if (arena == NULL) {
+            return NULL;
+        }
     }
     pbeV2_param = PORT_ArenaZNew(arena, sec_pkcs5V2Parameter);
     if (pbeV2_param == NULL) {
-	goto loser;
+        goto loser;
     }
-	
+
     rv = SEC_ASN1DecodeItem(arena, pbeV2_param,
-		SEC_PKCS5V2ParameterTemplate, &algid->parameters);
+                            SEC_PKCS5V2ParameterTemplate, &algid->parameters);
     if (rv == SECFailure) {
-	goto loser;
+        goto loser;
     }
 
     pbeV2_param->poolp = arena;
     return pbeV2_param;
 loser:
     if (localArena) {
-	PORT_FreeArena(arena, PR_FALSE);
+        PORT_FreeArena(arena, PR_FALSE);
     }
     return NULL;
 }
@@ -179,50 +176,49 @@ loser:
 void
 sec_pkcs5_v2_destroy_v2_param(sec_pkcs5V2Parameter *param)
 {
-   if (param && param->poolp) {
-	PORT_FreeArena(param->poolp, PR_TRUE);
-   }
+    if (param && param->poolp) {
+        PORT_FreeArena(param->poolp, PR_TRUE);
+    }
 }
-	
 
 /* maps crypto algorithm from PBE algorithm.
  */
-SECOidTag 
+SECOidTag
 SEC_PKCS5GetCryptoAlgorithm(SECAlgorithmID *algid)
 {
 
     SECOidTag pbeAlg;
     SECOidTag cipherAlg;
 
-    if(algid == NULL)
-	return SEC_OID_UNKNOWN;
+    if (algid == NULL)
+        return SEC_OID_UNKNOWN;
 
     pbeAlg = SECOID_GetAlgorithmTag(algid);
     cipherAlg = sec_pkcs5GetCryptoFromAlgTag(pbeAlg);
-    if ((cipherAlg == SEC_OID_PKCS5_PBKDF2)  &&
-	 (pbeAlg != SEC_OID_PKCS5_PBKDF2)) {
-	sec_pkcs5V2Parameter *pbeV2_param;
-	cipherAlg = SEC_OID_UNKNOWN;
+    if ((cipherAlg == SEC_OID_PKCS5_PBKDF2) &&
+        (pbeAlg != SEC_OID_PKCS5_PBKDF2)) {
+        sec_pkcs5V2Parameter *pbeV2_param;
+        cipherAlg = SEC_OID_UNKNOWN;
 
-	pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
-	if (pbeV2_param != NULL) {
-	    cipherAlg = SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId);
-	    sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
-	}
+        pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
+        if (pbeV2_param != NULL) {
+            cipherAlg = SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId);
+            sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
+        }
     }
 
     return cipherAlg;
 }
 
 /* check to see if an oid is a pbe algorithm
- */ 
-PRBool 
+ */
+PRBool
 SEC_PKCS5IsAlgorithmPBEAlg(SECAlgorithmID *algid)
 {
     return (PRBool)(SEC_PKCS5GetCryptoAlgorithm(algid) != SEC_OID_UNKNOWN);
 }
 
-PRBool 
+PRBool
 SEC_PKCS5IsAlgorithmPBEAlgTag(SECOidTag algtag)
 {
     return (PRBool)(sec_pkcs5GetCryptoFromAlgTag(algtag) != SEC_OID_UNKNOWN);
@@ -237,70 +233,69 @@ sec_pkcs5v2_get_pbe(SECOidTag algTag)
 {
     /* if it's a valid hash oid... */
     if (HASH_GetHashOidTagByHMACOidTag(algTag) != SEC_OID_UNKNOWN) {
-	/* use the MAC tag */
-	return SEC_OID_PKCS5_PBMAC1;
+        /* use the MAC tag */
+        return SEC_OID_PKCS5_PBMAC1;
     }
     if (HASH_GetHashTypeByOidTag(algTag) != HASH_AlgNULL) {
-	/* eliminate Hash algorithms */
-	return SEC_OID_UNKNOWN;
+        /* eliminate Hash algorithms */
+        return SEC_OID_UNKNOWN;
     }
     if (PK11_AlgtagToMechanism(algTag) != CKM_INVALID_MECHANISM) {
-	/* it's not a hash, if it has a PKCS #11 mechanism associated
-	 * with it, assume it's a cipher. (NOTE this will generate
-	 * some false positives). */
-	return SEC_OID_PKCS5_PBES2;
+        /* it's not a hash, if it has a PKCS #11 mechanism associated
+         * with it, assume it's a cipher. (NOTE this will generate
+         * some false positives). */
+        return SEC_OID_PKCS5_PBES2;
     }
     return SEC_OID_UNKNOWN;
 }
 
-/* 
+/*
  * maps PBE algorithm from crypto algorithm, assumes SHA1 hashing.
  *  input keyLen in bits.
  */
-SECOidTag 
+SECOidTag
 SEC_PKCS5GetPBEAlgorithm(SECOidTag algTag, int keyLen)
 {
-    switch(algTag)
-    {
-	case SEC_OID_DES_EDE3_CBC:
-	    switch(keyLen) {
-		case 168:
-		case 192:
-		case 0:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC;
-		case 128:
-		case 92:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC;
-		default:
-		    break;
-	    }
-	    break;
-	case SEC_OID_DES_CBC:
-	    return SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC;
-	case SEC_OID_RC2_CBC:
-	    switch(keyLen) {
-		case 40:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC;
-		case 128:
-		case 0:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC;
-		default:
-		    break;
-	    }
-	    break;
-	case SEC_OID_RC4:
-	    switch(keyLen) {
-		case 40:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4;
-		case 128:
-		case 0:
-		    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4;
-		default:
-		    break;
-	    }
-	    break;
-	default:
-	    return sec_pkcs5v2_get_pbe(algTag);
+    switch (algTag) {
+        case SEC_OID_DES_EDE3_CBC:
+            switch (keyLen) {
+                case 168:
+                case 192:
+                case 0:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC;
+                case 128:
+                case 92:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC;
+                default:
+                    break;
+            }
+            break;
+        case SEC_OID_DES_CBC:
+            return SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC;
+        case SEC_OID_RC2_CBC:
+            switch (keyLen) {
+                case 40:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC;
+                case 128:
+                case 0:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC;
+                default:
+                    break;
+            }
+            break;
+        case SEC_OID_RC4:
+            switch (keyLen) {
+                case 40:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4;
+                case 128:
+                case 0:
+                    return SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4;
+                default:
+                    break;
+            }
+            break;
+        default:
+            return sec_pkcs5v2_get_pbe(algTag);
     }
 
     return SEC_OID_UNKNOWN;
@@ -321,18 +316,18 @@ sec_pkcs5v2_key_length(SECAlgorithmID *algid)
     algorithm = SECOID_GetAlgorithmTag(algid);
     /* sanity check, they should all be PBKDF2 here */
     if (algorithm != SEC_OID_PKCS5_PBKDF2) {
-	return -1;
+        return -1;
     }
 
     arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
     if (arena == NULL) {
-	goto loser;
+        goto loser;
     }
     PORT_Memset(&p5_param, 0, sizeof(p5_param));
-    rv = SEC_ASN1DecodeItem(arena,&p5_param,
-			 SEC_PKCS5V2PBEParameterTemplate, &algid->parameters);
+    rv = SEC_ASN1DecodeItem(arena, &p5_param,
+                            SEC_PKCS5V2PBEParameterTemplate, &algid->parameters);
     if (rv != SECSuccess) {
-	goto loser;
+        goto loser;
     }
 
     if (p5_param.keyLength.data != NULL) {
@@ -341,7 +336,7 @@ sec_pkcs5v2_key_length(SECAlgorithmID *algid)
 
 loser:
     if (arena) {
-	PORT_FreeArena(arena, PR_FALSE);
+        PORT_FreeArena(arena, PR_FALSE);
     }
     return length;
 }
@@ -349,76 +344,72 @@ loser:
 /*
  *  get the key length in bytes needed for the PBE algorithm
  */
-int 
+int
 SEC_PKCS5GetKeyLength(SECAlgorithmID *algid)
 {
 
     SECOidTag algorithm;
 
-    if(algid == NULL)
-	return SEC_OID_UNKNOWN;
+    if (algid == NULL)
+        return SEC_OID_UNKNOWN;
 
     algorithm = SECOID_GetAlgorithmTag(algid);
 
-    switch(algorithm)
-    {
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
-	    return 24;
-	case SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC:
-	case SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC:
-	case SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC:
-	    return 8;
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
-	    return 5;
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
-	    return 16;
-	case SEC_OID_PKCS5_PBKDF2:
-	    return sec_pkcs5v2_key_length(algid);
-	case SEC_OID_PKCS5_PBES2:
-	case SEC_OID_PKCS5_PBMAC1:
-	    {
-		sec_pkcs5V2Parameter *pbeV2_param;
-		int length = -1;
-		pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
-		if (pbeV2_param != NULL) {
-	    	    length = sec_pkcs5v2_key_length(&pbeV2_param->pbeAlgId);
-		    sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
-		}
-		return length;
-	    }
-	
-	default:
-	    break;
+    switch (algorithm) {
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
+            return 24;
+        case SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC:
+        case SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC:
+        case SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC:
+            return 8;
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
+            return 5;
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
+            return 16;
+        case SEC_OID_PKCS5_PBKDF2:
+            return sec_pkcs5v2_key_length(algid);
+        case SEC_OID_PKCS5_PBES2:
+        case SEC_OID_PKCS5_PBMAC1: {
+            sec_pkcs5V2Parameter *pbeV2_param;
+            int length = -1;
+            pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
+            if (pbeV2_param != NULL) {
+                length = sec_pkcs5v2_key_length(&pbeV2_param->pbeAlgId);
+                sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
+            }
+            return length;
+        }
+
+        default:
+            break;
     }
     return -1;
 }
 
-
 /* the PKCS12 V2 algorithms only encode the salt, there is no iteration
  * count so we need a check for V2 algorithm parameters.
  */
 static PRBool
 sec_pkcs5_is_algorithm_v2_pkcs12_algorithm(SECOidTag algorithm)
 {
-    switch(algorithm) 
-    {
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
-	case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
-	    return PR_TRUE;
-	default:
-	    break;
+    switch (algorithm) {
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC:
+        case SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC:
+            return PR_TRUE;
+        default:
+            break;
     }
 
     return PR_FALSE;
@@ -427,28 +418,27 @@ sec_pkcs5_is_algorithm_v2_pkcs12_algorithm(SECOidTag algorithm)
 static PRBool
 sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(SECOidTag algorithm)
 {
-    switch(algorithm) 
-    {
-	case SEC_OID_PKCS5_PBES2:
-	case SEC_OID_PKCS5_PBMAC1:
-	case SEC_OID_PKCS5_PBKDF2:
-	    return PR_TRUE;
-	default:
-	    break;
+    switch (algorithm) {
+        case SEC_OID_PKCS5_PBES2:
+        case SEC_OID_PKCS5_PBMAC1:
+        case SEC_OID_PKCS5_PBKDF2:
+            return PR_TRUE;
+        default:
+            break;
     }
 
     return PR_FALSE;
 }
 
-/* destroy a pbe parameter.  it assumes that the parameter was 
+/* destroy a pbe parameter.  it assumes that the parameter was
  * generated using the appropriate create function and therefor
  * contains an arena pool.
  */
-static void 
+static void
 sec_pkcs5_destroy_pbe_param(SEC_PKCS5PBEParameter *pbe_param)
 {
-    if(pbe_param != NULL)
-	PORT_FreeArena(pbe_param->poolp, PR_TRUE);
+    if (pbe_param != NULL)
+        PORT_FreeArena(pbe_param->poolp, PR_TRUE);
 }
 
 /* creates a PBE parameter based on the PBE algorithm.  the only required
@@ -460,84 +450,84 @@ sec_pkcs5_destroy_pbe_param(SEC_PKCS5PBEParameter *pbe_param)
  *   iteration - number of iterations to perform hashing.
  *   keyLength - only used in variable key length algorithms. if specified,
  *            should be in bytes.
- * once a parameter is allocated, it should be destroyed calling 
+ * once a parameter is allocated, it should be destroyed calling
  * sec_pkcs5_destroy_pbe_parameter or SEC_PKCS5DestroyPBEParameter.
  */
 #define DEFAULT_SALT_LENGTH 16
 static SEC_PKCS5PBEParameter *
-sec_pkcs5_create_pbe_parameter(SECOidTag algorithm, 
-			SECItem *salt, 
-			int iteration,
-			int keyLength,
-			SECOidTag prfAlg)
+sec_pkcs5_create_pbe_parameter(SECOidTag algorithm,
+                               SECItem *salt,
+                               int iteration,
+                               int keyLength,
+                               SECOidTag prfAlg)
 {
     PLArenaPool *poolp = NULL;
     SEC_PKCS5PBEParameter *pbe_param = NULL;
-    SECStatus rv= SECSuccess; 
+    SECStatus rv = SECSuccess;
     void *dummy = NULL;
 
-    if(iteration < 0) {
-	return NULL;
+    if (iteration < 0) {
+        return NULL;
     }
 
     poolp = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
-    if(poolp == NULL)
-	return NULL;
+    if (poolp == NULL)
+        return NULL;
 
     pbe_param = (SEC_PKCS5PBEParameter *)PORT_ArenaZAlloc(poolp,
-	sizeof(SEC_PKCS5PBEParameter));
-    if(!pbe_param) {
-	PORT_FreeArena(poolp, PR_TRUE);
-	return NULL;
+                                                          sizeof(SEC_PKCS5PBEParameter));
+    if (!pbe_param) {
+        PORT_FreeArena(poolp, PR_TRUE);
+        return NULL;
     }
 
     pbe_param->poolp = poolp;
 
     rv = SECFailure;
     if (salt && salt->data) {
-    	rv = SECITEM_CopyItem(poolp, &pbe_param->salt, salt);
+        rv = SECITEM_CopyItem(poolp, &pbe_param->salt, salt);
     } else {
-	/* sigh, the old interface generated salt on the fly, so we have to
-	 * preserve the semantics */
-	pbe_param->salt.len = DEFAULT_SALT_LENGTH;
-	pbe_param->salt.data = PORT_ArenaZAlloc(poolp,DEFAULT_SALT_LENGTH);
-	if (pbe_param->salt.data) {
-	   rv = PK11_GenerateRandom(pbe_param->salt.data,DEFAULT_SALT_LENGTH);
-	}
+        /* sigh, the old interface generated salt on the fly, so we have to
+         * preserve the semantics */
+        pbe_param->salt.len = DEFAULT_SALT_LENGTH;
+        pbe_param->salt.data = PORT_ArenaZAlloc(poolp, DEFAULT_SALT_LENGTH);
+        if (pbe_param->salt.data) {
+            rv = PK11_GenerateRandom(pbe_param->salt.data, DEFAULT_SALT_LENGTH);
+        }
     }
 
-    if(rv != SECSuccess) {
-	PORT_FreeArena(poolp, PR_TRUE);
-	return NULL;
+    if (rv != SECSuccess) {
+        PORT_FreeArena(poolp, PR_TRUE);
+        return NULL;
     }
 
     /* encode the integer */
-    dummy = SEC_ASN1EncodeInteger(poolp, &pbe_param->iteration, 
-		iteration);
+    dummy = SEC_ASN1EncodeInteger(poolp, &pbe_param->iteration,
+                                  iteration);
     rv = (dummy) ? SECSuccess : SECFailure;
 
-    if(rv != SECSuccess) {
-	PORT_FreeArena(poolp, PR_FALSE);
-	return NULL;
+    if (rv != SECSuccess) {
+        PORT_FreeArena(poolp, PR_FALSE);
+        return NULL;
     }
 
     /*
      * for PKCS5 v2 Add the keylength and the prf
      */
     if (algorithm == SEC_OID_PKCS5_PBKDF2) {
-	dummy = SEC_ASN1EncodeInteger(poolp, &pbe_param->keyLength, 
-		keyLength);
-	rv = (dummy) ? SECSuccess : SECFailure;
-	if (rv != SECSuccess) {
-	    PORT_FreeArena(poolp, PR_FALSE);
-	    return NULL;
-	}
-	rv = SECOID_SetAlgorithmID(poolp, &pbe_param->prfAlgId, prfAlg, NULL);
-	if (rv != SECSuccess) {
-	    PORT_FreeArena(poolp, PR_FALSE);
-	    return NULL;
-	}
-	pbe_param->pPrfAlgId = &pbe_param->prfAlgId;
+        dummy = SEC_ASN1EncodeInteger(poolp, &pbe_param->keyLength,
+                                      keyLength);
+        rv = (dummy) ? SECSuccess : SECFailure;
+        if (rv != SECSuccess) {
+            PORT_FreeArena(poolp, PR_FALSE);
+            return NULL;
+        }
+        rv = SECOID_SetAlgorithmID(poolp, &pbe_param->prfAlgId, prfAlg, NULL);
+        if (rv != SECSuccess) {
+            PORT_FreeArena(poolp, PR_FALSE);
+            return NULL;
+        }
+        pbe_param->pPrfAlgId = &pbe_param->prfAlgId;
     }
 
     return pbe_param;
@@ -545,19 +535,19 @@ sec_pkcs5_create_pbe_parameter(SECOidTag algorithm,
 
 /* creates a algorithm ID containing the PBE algorithm and appropriate
  * parameters.  the required parameter is the algorithm.  if salt is
- * not specified, it is generated randomly.  
+ * not specified, it is generated randomly.
  *
- * the returned SECAlgorithmID should be destroyed using 
+ * the returned SECAlgorithmID should be destroyed using
  * SECOID_DestroyAlgorithmID
  */
 SECAlgorithmID *
-sec_pkcs5CreateAlgorithmID(SECOidTag algorithm, 
-			   SECOidTag cipherAlgorithm,
-			   SECOidTag prfAlg,
-			   SECOidTag *pPbeAlgorithm,
-			   int keyLength,
-			   SECItem *salt, 
-			   int iteration)
+sec_pkcs5CreateAlgorithmID(SECOidTag algorithm,
+                           SECOidTag cipherAlgorithm,
+                           SECOidTag prfAlg,
+                           SECOidTag *pPbeAlgorithm,
+                           int keyLength,
+                           SECItem *salt,
+                           int iteration)
 {
     PLArenaPool *poolp = NULL;
     SECAlgorithmID *algid, *ret_algid = NULL;
@@ -568,174 +558,173 @@ sec_pkcs5CreateAlgorithmID(SECOidTag algorithm,
     SEC_PKCS5PBEParameter *pbe_param = NULL;
     sec_pkcs5V2Parameter pbeV2_param;
 
-    if(iteration <= 0) {
-	return NULL;
+    if (iteration <= 0) {
+        return NULL;
     }
 
     poolp = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
-    if(!poolp) {
-	goto loser;
+    if (!poolp) {
+        goto loser;
     }
 
     if (!SEC_PKCS5IsAlgorithmPBEAlgTag(algorithm) ||
-    	 	sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(algorithm)) {
-	/* use PKCS 5 v2 */
-	SECItem *cipherParams;
-
-	/*
-	 * if we ask for pkcs5 Algorithms directly, then the
-	 * application needs to supply the cipher algorithm,
-	 * otherwise we are implicitly using pkcs5 v2 and the
-	 * passed in algorithm is the encryption algorithm.
-	 */
-	if (sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(algorithm)) {
-	    if (cipherAlgorithm == SEC_OID_UNKNOWN) {
-		goto loser;
-	    }
-	} else {
-	    cipherAlgorithm = algorithm;
-	    /* force algorithm to be chosen below */
-	    algorithm = SEC_OID_PKCS5_PBKDF2;
-	}
-	
-	pbeAlgorithm = SEC_OID_PKCS5_PBKDF2;
-	/*
-	 * 'algorithm' is the overall algorithm oid tag used to wrap the 
-	 * entire algoithm ID block. For PKCS5v1 and PKCS12, this 
-	 * algorithm OID has encoded in it both the PBE KDF function 
-	 * and the encryption algorithm. For PKCS 5v2, PBE KDF and
-	 * encryption/macing oids are encoded as parameters in
-	 * the algorithm ID block. 
-	 *
-	 * Thus in PKCS5 v1 and PKCS12, this algorithm maps to a pkcs #11
-	 * mechanism, where as in PKCS 5v2, this alogithm tag does not map
-	 * directly to a PKCS #11 mechanim, instead the 2 oids in the 
-	 * algorithm ID block map the the actual PKCS #11 mechanism.
-	 * gorithm is). We use choose this algorithm oid based on the 
-	 * cipherAlgorithm to determine what this should be (MAC1 or PBES2).
-	 */
-	if (algorithm == SEC_OID_PKCS5_PBKDF2) {
-	     /* choose mac or pbes */
-	     algorithm = sec_pkcs5v2_get_pbe(cipherAlgorithm);
-	}
-
-	/* set the PKCS5v2 specific parameters */
-	if (keyLength == 0) {
-	    SECOidTag hashAlg = HASH_GetHashOidTagByHMACOidTag(cipherAlgorithm);
-    	    if (hashAlg != SEC_OID_UNKNOWN) {
-	        keyLength = HASH_ResultLenByOidTag(hashAlg);
-	    } else {
-		CK_MECHANISM_TYPE cryptoMech;
-		cryptoMech = PK11_AlgtagToMechanism(cipherAlgorithm);
-		if (cryptoMech == CKM_INVALID_MECHANISM) {
-		    goto loser;
-		}
-	        keyLength = PK11_GetMaxKeyLength(cryptoMech);
-	    }
-	    if (keyLength == 0) {
-		goto loser;
-	    }
-	}
-	/* currently only SEC_OID_HMAC_SHA1 is defined */
-	if (prfAlg == SEC_OID_UNKNOWN) {
-	    prfAlg = SEC_OID_HMAC_SHA1;
-	}
-
-	/* build the PKCS5v2 cipher algorithm id */
-	cipherParams = pk11_GenerateNewParamWithKeyLen(	
-			PK11_AlgtagToMechanism(cipherAlgorithm), keyLength);
-	if (!cipherParams) {
-	    goto loser;
-	}
-
-	PORT_Memset(&pbeV2_param, 0, sizeof (pbeV2_param));
-
-	rv = PK11_ParamToAlgid(cipherAlgorithm, cipherParams, 
-				poolp, &pbeV2_param.cipherAlgId);
-	SECITEM_FreeItem(cipherParams, PR_TRUE);
-	if (rv != SECSuccess) {
-	    goto loser;
-	}
-    }
-	
+        sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(algorithm)) {
+        /* use PKCS 5 v2 */
+        SECItem *cipherParams;
+
+        /*
+         * if we ask for pkcs5 Algorithms directly, then the
+         * application needs to supply the cipher algorithm,
+         * otherwise we are implicitly using pkcs5 v2 and the
+         * passed in algorithm is the encryption algorithm.
+         */
+        if (sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(algorithm)) {
+            if (cipherAlgorithm == SEC_OID_UNKNOWN) {
+                goto loser;
+            }
+        } else {
+            cipherAlgorithm = algorithm;
+            /* force algorithm to be chosen below */
+            algorithm = SEC_OID_PKCS5_PBKDF2;
+        }
+
+        pbeAlgorithm = SEC_OID_PKCS5_PBKDF2;
+        /*
+         * 'algorithm' is the overall algorithm oid tag used to wrap the
+         * entire algoithm ID block. For PKCS5v1 and PKCS12, this
+         * algorithm OID has encoded in it both the PBE KDF function
+         * and the encryption algorithm. For PKCS 5v2, PBE KDF and
+         * encryption/macing oids are encoded as parameters in
+         * the algorithm ID block.
+         *
+         * Thus in PKCS5 v1 and PKCS12, this algorithm maps to a pkcs #11
+         * mechanism, where as in PKCS 5v2, this alogithm tag does not map
+         * directly to a PKCS #11 mechanim, instead the 2 oids in the
+         * algorithm ID block map the the actual PKCS #11 mechanism.
+         * gorithm is). We use choose this algorithm oid based on the
+         * cipherAlgorithm to determine what this should be (MAC1 or PBES2).
+         */
+        if (algorithm == SEC_OID_PKCS5_PBKDF2) {
+            /* choose mac or pbes */
+            algorithm = sec_pkcs5v2_get_pbe(cipherAlgorithm);
+        }
+
+        /* set the PKCS5v2 specific parameters */
+        if (keyLength == 0) {
+            SECOidTag hashAlg = HASH_GetHashOidTagByHMACOidTag(cipherAlgorithm);
+            if (hashAlg != SEC_OID_UNKNOWN) {
+                keyLength = HASH_ResultLenByOidTag(hashAlg);
+            } else {
+                CK_MECHANISM_TYPE cryptoMech;
+                cryptoMech = PK11_AlgtagToMechanism(cipherAlgorithm);
+                if (cryptoMech == CKM_INVALID_MECHANISM) {
+                    goto loser;
+                }
+                keyLength = PK11_GetMaxKeyLength(cryptoMech);
+            }
+            if (keyLength == 0) {
+                goto loser;
+            }
+        }
+        /* currently SEC_OID_HMAC_SHA1 is the default */
+        if (prfAlg == SEC_OID_UNKNOWN) {
+            prfAlg = SEC_OID_HMAC_SHA1;
+        }
+
+        /* build the PKCS5v2 cipher algorithm id */
+        cipherParams = pk11_GenerateNewParamWithKeyLen(
+            PK11_AlgtagToMechanism(cipherAlgorithm), keyLength);
+        if (!cipherParams) {
+            goto loser;
+        }
+
+        PORT_Memset(&pbeV2_param, 0, sizeof(pbeV2_param));
+
+        rv = PK11_ParamToAlgid(cipherAlgorithm, cipherParams,
+                               poolp, &pbeV2_param.cipherAlgId);
+        SECITEM_FreeItem(cipherParams, PR_TRUE);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
 
     /* generate the parameter */
     pbe_param = sec_pkcs5_create_pbe_parameter(pbeAlgorithm, salt, iteration,
-			keyLength, prfAlg);
-    if(!pbe_param) {
-	goto loser;
+                                               keyLength, prfAlg);
+    if (!pbe_param) {
+        goto loser;
     }
 
     /* generate the algorithm id */
     algid = (SECAlgorithmID *)PORT_ArenaZAlloc(poolp, sizeof(SECAlgorithmID));
-    if(algid == NULL) {
-	goto loser;
+    if (algid == NULL) {
+        goto loser;
     }
 
     der_param.data = NULL;
     der_param.len = 0;
     if (sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(algorithm)) {
-	/* first encode the PBE algorithm ID */
-	dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
-					SEC_PKCS5V2PBEParameterTemplate);
-	if (dummy == NULL) {
-	    goto loser;
-	}
-	rv = SECOID_SetAlgorithmID(poolp, &pbeV2_param.pbeAlgId, 
-				   pbeAlgorithm, &der_param);
-	if (rv != SECSuccess) {
-	    goto loser;
-	}
-
-	/* now encode the Full PKCS 5 parameter */
-	der_param.data = NULL;
-	der_param.len = 0;
-	dummy = SEC_ASN1EncodeItem(poolp, &der_param, &pbeV2_param,
-					SEC_PKCS5V2ParameterTemplate);
-    } else if(!sec_pkcs5_is_algorithm_v2_pkcs12_algorithm(algorithm)) {
-	dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
-					SEC_PKCS5PBEParameterTemplate);
+        /* first encode the PBE algorithm ID */
+        dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
+                                   SEC_PKCS5V2PBEParameterTemplate);
+        if (dummy == NULL) {
+            goto loser;
+        }
+        rv = SECOID_SetAlgorithmID(poolp, &pbeV2_param.pbeAlgId,
+                                   pbeAlgorithm, &der_param);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+
+        /* now encode the Full PKCS 5 parameter */
+        der_param.data = NULL;
+        der_param.len = 0;
+        dummy = SEC_ASN1EncodeItem(poolp, &der_param, &pbeV2_param,
+                                   SEC_PKCS5V2ParameterTemplate);
+    } else if (!sec_pkcs5_is_algorithm_v2_pkcs12_algorithm(algorithm)) {
+        dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
+                                   SEC_PKCS5PBEParameterTemplate);
     } else {
-	dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
-	    				SEC_V2PKCS12PBEParameterTemplate);
+        dummy = SEC_ASN1EncodeItem(poolp, &der_param, pbe_param,
+                                   SEC_V2PKCS12PBEParameterTemplate);
     }
     if (dummy == NULL) {
-	goto loser;
+        goto loser;
     }
 
     rv = SECOID_SetAlgorithmID(poolp, algid, algorithm, &der_param);
     if (rv != SECSuccess) {
-	goto loser;
+        goto loser;
     }
 
     ret_algid = (SECAlgorithmID *)PORT_ZAlloc(sizeof(SECAlgorithmID));
     if (ret_algid == NULL) {
-	goto loser;
+        goto loser;
     }
 
     rv = SECOID_CopyAlgorithmID(NULL, ret_algid, algid);
     if (rv != SECSuccess) {
-	SECOID_DestroyAlgorithmID(ret_algid, PR_TRUE);
-	ret_algid = NULL;
+        SECOID_DestroyAlgorithmID(ret_algid, PR_TRUE);
+        ret_algid = NULL;
     } else if (pPbeAlgorithm) {
-	*pPbeAlgorithm = pbeAlgorithm;
+        *pPbeAlgorithm = pbeAlgorithm;
     }
 
 loser:
     if (poolp != NULL) {
-	PORT_FreeArena(poolp, PR_TRUE);
-	algid = NULL;
+        PORT_FreeArena(poolp, PR_TRUE);
+        algid = NULL;
     }
 
     if (pbe_param) {
-	sec_pkcs5_destroy_pbe_param(pbe_param);
+        sec_pkcs5_destroy_pbe_param(pbe_param);
     }
 
     return ret_algid;
 }
 
 SECStatus
-pbe_PK11AlgidToParam(SECAlgorithmID *algid,SECItem *mech)
+pbe_PK11AlgidToParam(SECAlgorithmID *algid, SECItem *mech)
 {
     SEC_PKCS5PBEParameter p5_param;
     SECItem *salt = NULL;
@@ -747,14 +736,12 @@ pbe_PK11AlgidToParam(SECAlgorithmID *algid,SECItem *mech)
     CK_ULONG iterations;
     int paramLen = 0;
     int iv_len;
-    
 
     arena = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
     if (arena == NULL) {
-	goto loser;
+        goto loser;
     }
 
-
     /*
      * decode the algid based on the pbe type
      */
@@ -762,131 +749,145 @@ pbe_PK11AlgidToParam(SECAlgorithmID *algid,SECItem *mech)
     if (sec_pkcs5_is_algorithm_v2_pkcs12_algorithm(algorithm)) {
         iv_len = PK11_GetIVLength(PK11_AlgtagToMechanism(algorithm));
         rv = SEC_ASN1DecodeItem(arena, &p5_param,
-			 SEC_V2PKCS12PBEParameterTemplate, &algid->parameters);
+                                SEC_V2PKCS12PBEParameterTemplate, &algid->parameters);
     } else if (algorithm == SEC_OID_PKCS5_PBKDF2) {
-	iv_len = 0;
-        rv = SEC_ASN1DecodeItem(arena,&p5_param,
-			 SEC_PKCS5V2PBEParameterTemplate, &algid->parameters);
+        iv_len = 0;
+        rv = SEC_ASN1DecodeItem(arena, &p5_param,
+                                SEC_PKCS5V2PBEParameterTemplate, &algid->parameters);
     } else {
         iv_len = PK11_GetIVLength(PK11_AlgtagToMechanism(algorithm));
-        rv = SEC_ASN1DecodeItem(arena,&p5_param,SEC_PKCS5PBEParameterTemplate, 
-						&algid->parameters);
+        rv = SEC_ASN1DecodeItem(arena, &p5_param, SEC_PKCS5PBEParameterTemplate,
+                                &algid->parameters);
     }
 
     if (iv_len < 0) {
-	goto loser;
+        goto loser;
     }
 
     if (rv != SECSuccess) {
-	goto loser;
+        goto loser;
     }
-        
+
     /* get salt */
     salt = &p5_param.salt;
-    iterations = (CK_ULONG) DER_GetInteger(&p5_param.iteration);
+    iterations = (CK_ULONG)DER_GetInteger(&p5_param.iteration);
 
     /* allocate and fill in the PKCS #11 parameters
      * based on the algorithm. */
     if (algorithm == SEC_OID_PKCS5_PBKDF2) {
-	SECOidTag prfAlgTag;
-    	CK_PKCS5_PBKD2_PARAMS *pbeV2_params = 
-		(CK_PKCS5_PBKD2_PARAMS *)PORT_ZAlloc(
-			sizeof(CK_PKCS5_PBKD2_PARAMS)+ salt->len);
-
-	if (pbeV2_params == NULL) {
-	    goto loser;
-	}
-	paramData = (unsigned char *)pbeV2_params;
-	paramLen = sizeof(CK_PKCS5_PBKD2_PARAMS);
-
-	/* set the prf */
-	prfAlgTag = SEC_OID_HMAC_SHA1;
- 	if (p5_param.pPrfAlgId &&
- 	    p5_param.pPrfAlgId->algorithm.data != 0) {
- 	    prfAlgTag = SECOID_GetAlgorithmTag(p5_param.pPrfAlgId);
-	}
-	if (prfAlgTag == SEC_OID_HMAC_SHA1) {
-	    pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA1;
-	} else {
-	    /* only SHA1_HMAC is currently supported by PKCS #11 */
-	    PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
-	    goto loser;
-	}
-	
-	/* probably should fetch these from the prfAlgid */
-	pbeV2_params->pPrfData = NULL;
-	pbeV2_params->ulPrfDataLen = 0;
-	pbeV2_params->saltSource = CKZ_SALT_SPECIFIED;
-	pSalt = ((CK_CHAR_PTR) pbeV2_params)+sizeof(CK_PKCS5_PBKD2_PARAMS);
+        SECOidTag prfAlgTag;
+        CK_PKCS5_PBKD2_PARAMS *pbeV2_params =
+            (CK_PKCS5_PBKD2_PARAMS *)PORT_ZAlloc(
+                sizeof(CK_PKCS5_PBKD2_PARAMS) + salt->len);
+
+        if (pbeV2_params == NULL) {
+            goto loser;
+        }
+        paramData = (unsigned char *)pbeV2_params;
+        paramLen = sizeof(CK_PKCS5_PBKD2_PARAMS);
+
+        /* set the prf */
+        prfAlgTag = SEC_OID_HMAC_SHA1;
+        if (p5_param.pPrfAlgId &&
+            p5_param.pPrfAlgId->algorithm.data != 0) {
+            prfAlgTag = SECOID_GetAlgorithmTag(p5_param.pPrfAlgId);
+        }
+        switch (prfAlgTag) {
+            case SEC_OID_HMAC_SHA1:
+                pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA1;
+                break;
+            case SEC_OID_HMAC_SHA224:
+                pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA224;
+                break;
+            case SEC_OID_HMAC_SHA256:
+                pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA256;
+                break;
+            case SEC_OID_HMAC_SHA384:
+                pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA384;
+                break;
+            case SEC_OID_HMAC_SHA512:
+                pbeV2_params->prf = CKP_PKCS5_PBKD2_HMAC_SHA512;
+                break;
+            default:
+                PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
+                goto loser;
+        }
+
+        /* probably should fetch these from the prfAlgid */
+        pbeV2_params->pPrfData = NULL;
+        pbeV2_params->ulPrfDataLen = 0;
+        pbeV2_params->saltSource = CKZ_SALT_SPECIFIED;
+        pSalt = ((CK_CHAR_PTR)pbeV2_params) + sizeof(CK_PKCS5_PBKD2_PARAMS);
         PORT_Memcpy(pSalt, salt->data, salt->len);
-	pbeV2_params->pSaltSourceData = pSalt;
-	pbeV2_params->ulSaltSourceDataLen = salt->len;
-	pbeV2_params->iterations = iterations;
+        pbeV2_params->pSaltSourceData = pSalt;
+        pbeV2_params->ulSaltSourceDataLen = salt->len;
+        pbeV2_params->iterations = iterations;
     } else {
-	CK_PBE_PARAMS *pbe_params = NULL;
-    	pbe_params = (CK_PBE_PARAMS *)PORT_ZAlloc(sizeof(CK_PBE_PARAMS)+
-						salt->len+iv_len);
-	if (pbe_params == NULL) {
-	    goto loser;
-	}
-	paramData = (unsigned char *)pbe_params;
-	paramLen = sizeof(CK_PBE_PARAMS);
-
-	pSalt = ((CK_CHAR_PTR) pbe_params)+sizeof(CK_PBE_PARAMS);
-    	pbe_params->pSalt = pSalt;
+        CK_PBE_PARAMS *pbe_params = NULL;
+        pbe_params = (CK_PBE_PARAMS *)PORT_ZAlloc(sizeof(CK_PBE_PARAMS) +
+                                                  salt->len + iv_len);
+        if (pbe_params == NULL) {
+            goto loser;
+        }
+        paramData = (unsigned char *)pbe_params;
+        paramLen = sizeof(CK_PBE_PARAMS);
+
+        pSalt = ((CK_CHAR_PTR)pbe_params) + sizeof(CK_PBE_PARAMS);
+        pbe_params->pSalt = pSalt;
         PORT_Memcpy(pSalt, salt->data, salt->len);
-	pbe_params->ulSaltLen = salt->len;
-	if (iv_len) {
-	    pbe_params->pInitVector = 
-		((CK_CHAR_PTR) pbe_params)+ sizeof(CK_PBE_PARAMS)+salt->len;
-	}
-	pbe_params->ulIteration = iterations;
+        pbe_params->ulSaltLen = salt->len;
+        if (iv_len) {
+            pbe_params->pInitVector =
+                ((CK_CHAR_PTR)pbe_params) + sizeof(CK_PBE_PARAMS) + salt->len;
+        }
+        pbe_params->ulIteration = iterations;
     }
 
     /* copy into the mechanism sec item */
     mech->data = paramData;
     mech->len = paramLen;
     if (arena) {
-	PORT_FreeArena(arena,PR_TRUE);
+        PORT_FreeArena(arena, PR_TRUE);
     }
     return SECSuccess;
 
 loser:
     if (paramData) {
-	PORT_Free(paramData);
+        PORT_Free(paramData);
     }
     if (arena) {
-	PORT_FreeArena(arena,PR_TRUE);
+        PORT_FreeArena(arena, PR_TRUE);
     }
     return SECFailure;
 }
 
 /*
- * public, deprecated, not valid for pkcs5 v2 
- * 
+ * public, deprecated, not valid for pkcs5 v2
+ *
  * use PK11_CreatePBEV2AlgorithmID or PK11_CreatePBEAlgorithmID to create
  * PBE algorithmID's directly.
  */
 SECStatus
 PBE_PK11ParamToAlgid(SECOidTag algTag, SECItem *param, PLArenaPool *arena,
-		     SECAlgorithmID *algId)
+                     SECAlgorithmID *algId)
 {
     CK_PBE_PARAMS *pbe_param;
     SECItem pbeSalt;
     SECAlgorithmID *pbeAlgID = NULL;
     SECStatus rv;
 
-    if(!param || !algId) {
-	return SECFailure;
+    if (!param || !algId) {
+        return SECFailure;
     }
 
     pbe_param = (CK_PBE_PARAMS *)param->data;
     pbeSalt.data = (unsigned char *)pbe_param->pSalt;
     pbeSalt.len = pbe_param->ulSaltLen;
-    pbeAlgID = sec_pkcs5CreateAlgorithmID(algTag, SEC_OID_UNKNOWN, 
-	SEC_OID_UNKNOWN, NULL, 0, &pbeSalt, (int)pbe_param->ulIteration);
-    if(!pbeAlgID) {
-	return SECFailure;
+    pbeAlgID = sec_pkcs5CreateAlgorithmID(algTag, SEC_OID_UNKNOWN,
+                                          SEC_OID_UNKNOWN, NULL, 0,
+                                          &pbeSalt, (int)pbe_param->ulIteration);
+    if (!pbeAlgID) {
+        return SECFailure;
     }
 
     rv = SECOID_CopyAlgorithmID(arena, algId, pbeAlgID);
@@ -895,7 +896,7 @@ PBE_PK11ParamToAlgid(SECOidTag algTag, SECItem *param, PLArenaPool *arena,
 }
 
 /*
- * public, Deprecated, This function is only for binary compatibility with 
+ * public, Deprecated, This function is only for binary compatibility with
  * older applications. Does not support PKCS5v2.
  *
  * Applications should use PK11_PBEKeyGen() for keys and PK11_GetPBEIV() for
@@ -903,8 +904,8 @@ PBE_PK11ParamToAlgid(SECOidTag algTag, SECItem *param, PLArenaPool *arena,
  */
 PBEBitGenContext *
 PBE_CreateContext(SECOidTag hashAlgorithm, PBEBitGenID bitGenPurpose,
-	SECItem *pwitem, SECItem *salt, unsigned int bitsNeeded,
-	unsigned int iterations)
+                  SECItem *pwitem, SECItem *salt, unsigned int bitsNeeded,
+                  unsigned int iterations)
 {
     SECItem *context = NULL;
     SECItem mechItem;
@@ -913,57 +914,56 @@ PBE_CreateContext(SECOidTag hashAlgorithm, PBEBitGenID bitGenPurpose,
     PK11SlotInfo *slot;
     PK11SymKey *symKey = NULL;
     unsigned char ivData[8];
-    
 
     /* use the purpose to select the low level keygen algorithm */
     switch (bitGenPurpose) {
-    case pbeBitGenIntegrityKey:
-	switch (hashAlgorithm) {
-	case SEC_OID_SHA1:
-	    mechanism = CKM_PBA_SHA1_WITH_SHA1_HMAC;
-	    break;
-	case SEC_OID_MD2:
-	    mechanism = CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN;
-	    break;
-	case SEC_OID_MD5:
-	    mechanism = CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN;
-	    break;
-	default:
-	    break;
-	}
-	break;
-    case pbeBitGenCipherIV:
-	if (bitsNeeded > 64) {
-	    break;
-	}
-	if (hashAlgorithm != SEC_OID_SHA1) {
-	    break;
-	}
-	mechanism = CKM_PBE_SHA1_DES3_EDE_CBC;
-	break;
-    case pbeBitGenCipherKey:
-	if (hashAlgorithm != SEC_OID_SHA1) {
-	    break;
-	}
-	switch (bitsNeeded) {
-	case 40:
-	    mechanism = CKM_PBE_SHA1_RC4_40;
-	    break;
-	case 128:
-	    mechanism = CKM_PBE_SHA1_RC4_128;
-	    break;
-	default:
-	    break;
-	}
-    case pbeBitGenIDNull:
-	break;
+        case pbeBitGenIntegrityKey:
+            switch (hashAlgorithm) {
+                case SEC_OID_SHA1:
+                    mechanism = CKM_PBA_SHA1_WITH_SHA1_HMAC;
+                    break;
+                case SEC_OID_MD2:
+                    mechanism = CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN;
+                    break;
+                case SEC_OID_MD5:
+                    mechanism = CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN;
+                    break;
+                default:
+                    break;
+            }
+            break;
+        case pbeBitGenCipherIV:
+            if (bitsNeeded > 64) {
+                break;
+            }
+            if (hashAlgorithm != SEC_OID_SHA1) {
+                break;
+            }
+            mechanism = CKM_PBE_SHA1_DES3_EDE_CBC;
+            break;
+        case pbeBitGenCipherKey:
+            if (hashAlgorithm != SEC_OID_SHA1) {
+                break;
+            }
+            switch (bitsNeeded) {
+                case 40:
+                    mechanism = CKM_PBE_SHA1_RC4_40;
+                    break;
+                case 128:
+                    mechanism = CKM_PBE_SHA1_RC4_128;
+                    break;
+                default:
+                    break;
+            }
+        case pbeBitGenIDNull:
+            break;
     }
 
     if (mechanism == CKM_INVALID_MECHANISM) {
-	/* we should set an error, but this is a deprecated function, and
-	 * we are keeping bug for bug compatibility;)... */
-	    return NULL;
-    } 
+        /* we should set an error, but this is a deprecated function, and
+         * we are keeping bug for bug compatibility;)... */
+        return NULL;
+    }
 
     pbe_params.pInitVector = ivData;
     pbe_params.pPassword = pwitem->data;
@@ -971,42 +971,41 @@ PBE_CreateContext(SECOidTag hashAlgorithm, PBEBitGenID bitGenPurpose,
     pbe_params.pSalt = salt->data;
     pbe_params.ulSaltLen = salt->len;
     pbe_params.ulIteration = iterations;
-    mechItem.data = (unsigned char *) &pbe_params;
+    mechItem.data = (unsigned char *)&pbe_params;
     mechItem.len = sizeof(pbe_params);
 
-
     slot = PK11_GetInternalSlot();
-    symKey = PK11_RawPBEKeyGen(slot,mechanism,
-					&mechItem, pwitem, PR_FALSE, NULL);
+    symKey = PK11_RawPBEKeyGen(slot, mechanism,
+                               &mechItem, pwitem, PR_FALSE, NULL);
     PK11_FreeSlot(slot);
     if (symKey != NULL) {
-	if (bitGenPurpose == pbeBitGenCipherIV) {
-	    /* NOTE: this assumes that bitsNeeded is a multiple of 8! */
-	    SECItem ivItem;
-
-	    ivItem.data = ivData;
-	    ivItem.len = bitsNeeded/8;
-	    context = SECITEM_DupItem(&ivItem);
-	} else {
-	    SECItem *keyData;
-	    PK11_ExtractKeyValue(symKey);
-	    keyData = PK11_GetKeyData(symKey);
-
-	    /* assert bitsNeeded with length? */
-	    if (keyData) {
-	    	context = SECITEM_DupItem(keyData);
-	    }
-	}
-	PK11_FreeSymKey(symKey);
+        if (bitGenPurpose == pbeBitGenCipherIV) {
+            /* NOTE: this assumes that bitsNeeded is a multiple of 8! */
+            SECItem ivItem;
+
+            ivItem.data = ivData;
+            ivItem.len = bitsNeeded / 8;
+            context = SECITEM_DupItem(&ivItem);
+        } else {
+            SECItem *keyData;
+            PK11_ExtractKeyValue(symKey);
+            keyData = PK11_GetKeyData(symKey);
+
+            /* assert bitsNeeded with length? */
+            if (keyData) {
+                context = SECITEM_DupItem(keyData);
+            }
+        }
+        PK11_FreeSymKey(symKey);
     }
 
     return (PBEBitGenContext *)context;
 }
 
 /*
- * public, Deprecated, This function is only for binary compatibility with 
+ * public, Deprecated, This function is only for binary compatibility with
  * older applications. Does not support PKCS5v2.
- * 
+ *
  * Applications should use PK11_PBEKeyGen() for keys and PK11_GetIV() for
  * iv values rather than generating PBE bits directly.
  */
@@ -1017,16 +1016,16 @@ PBE_GenerateBits(PBEBitGenContext *context)
 }
 
 /*
- * public, Deprecated, This function is only for binary compatibility with 
+ * public, Deprecated, This function is only for binary compatibility with
  * older applications. Does not support PKCS5v2.
- * 
+ *
  * Applications should use PK11_PBEKeyGen() for keys and PK11_GetPBEIV() for
  * iv values rather than generating PBE bits directly.
  */
 void
 PBE_DestroyContext(PBEBitGenContext *context)
 {
-    SECITEM_FreeItem((SECItem *)context,PR_TRUE);
+    SECITEM_FreeItem((SECItem *)context, PR_TRUE);
 }
 
 /*
@@ -1044,48 +1043,48 @@ SEC_PKCS5GetIV(SECAlgorithmID *algid, SECItem *pwitem, PRBool faulty3DES)
     PK11SymKey *symKey;
     PK11SlotInfo *slot;
     CK_PBE_PARAMS_PTR pPBEparams;
-    SECOidTag	pbeAlg;
+    SECOidTag pbeAlg;
 
     pbeAlg = SECOID_GetAlgorithmTag(algid);
     if (sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(pbeAlg)) {
-	unsigned char *ivData;
-	sec_pkcs5V2Parameter *pbeV2_param = NULL;
-
-	/* can only return the IV if the crypto Algorithm exists */
-	if (pbeAlg == SEC_OID_PKCS5_PBKDF2) {
-	    PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
-	    goto loser;
-	}
-	pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
-	if (pbeV2_param == NULL) {
-	    goto loser;
-	}
-	/* extract the IV from the cipher algid portion of our pkcs 5 v2
-	 * algorithm id */
-    	type = PK11_AlgtagToMechanism(
-    		SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId));
-	param = PK11_ParamFromAlgid(&pbeV2_param->cipherAlgId);
-	sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
-	if (!param) {
-	    goto loser;
-	}
-	/* NOTE: NULL is a permissible return here */
-	ivData = PK11_IVFromParam(type, param, &iv_len);
-	src.data = ivData;
-	src.len = iv_len;
-	goto done;
+        unsigned char *ivData;
+        sec_pkcs5V2Parameter *pbeV2_param = NULL;
+
+        /* can only return the IV if the crypto Algorithm exists */
+        if (pbeAlg == SEC_OID_PKCS5_PBKDF2) {
+            PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
+            goto loser;
+        }
+        pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
+        if (pbeV2_param == NULL) {
+            goto loser;
+        }
+        /* extract the IV from the cipher algid portion of our pkcs 5 v2
+         * algorithm id */
+        type = PK11_AlgtagToMechanism(
+            SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId));
+        param = PK11_ParamFromAlgid(&pbeV2_param->cipherAlgId);
+        sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
+        if (!param) {
+            goto loser;
+        }
+        /* NOTE: NULL is a permissible return here */
+        ivData = PK11_IVFromParam(type, param, &iv_len);
+        src.data = ivData;
+        src.len = iv_len;
+        goto done;
     }
 
     type = PK11_AlgtagToMechanism(pbeAlg);
     param = PK11_ParamFromAlgid(algid);
     if (param == NULL) {
-	goto done;
+        goto done;
     }
     slot = PK11_GetInternalSlot();
     symKey = PK11_RawPBEKeyGen(slot, type, param, pwitem, faulty3DES, NULL);
     PK11_FreeSlot(slot);
     if (symKey == NULL) {
-	goto loser;
+        goto loser;
     }
     PK11_FreeSymKey(symKey);
     pPBEparams = (CK_PBE_PARAMS_PTR)param->data;
@@ -1099,7 +1098,7 @@ done:
 
 loser:
     if (param) {
-	SECITEM_ZfreeItem(param, PR_TRUE);
+        SECITEM_ZfreeItem(param, PR_TRUE);
     }
     return iv;
 }
@@ -1109,8 +1108,8 @@ loser:
  */
 PBEBitGenContext *
 __PBE_CreateContext(SECOidTag hashAlgorithm, PBEBitGenID bitGenPurpose,
-	SECItem *pwitem, SECItem *salt, unsigned int bitsNeeded,
-	unsigned int iterations)
+                    SECItem *pwitem, SECItem *salt, unsigned int bitsNeeded,
+                    unsigned int iterations)
 {
     PORT_Assert("__PBE_CreateContext is Deprecated" == NULL);
     return NULL;
@@ -1147,29 +1146,29 @@ static void
 pk11_destroy_ck_pbe_params(CK_PBE_PARAMS *pbe_params)
 {
     if (pbe_params) {
-	if (pbe_params->pPassword)
-	    PORT_ZFree(pbe_params->pPassword, pbe_params->ulPasswordLen);
-	if (pbe_params->pSalt)
-	    PORT_ZFree(pbe_params->pSalt, pbe_params->ulSaltLen);
-	PORT_ZFree(pbe_params, sizeof(CK_PBE_PARAMS));
+        if (pbe_params->pPassword)
+            PORT_ZFree(pbe_params->pPassword, pbe_params->ulPasswordLen);
+        if (pbe_params->pSalt)
+            PORT_ZFree(pbe_params->pSalt, pbe_params->ulSaltLen);
+        PORT_ZFree(pbe_params, sizeof(CK_PBE_PARAMS));
     }
 }
 
 /*
- * public, deprecated.  use PK11_CreatePBEAlgorithmID or 
- * PK11_CreatePBEV2AlgorithmID instead. If you needthe pkcs #11 parameters, 
- * use PK11_ParamFromAlgid from the algorithm id you created using 
+ * public, deprecated.  use PK11_CreatePBEAlgorithmID or
+ * PK11_CreatePBEV2AlgorithmID instead. If you needthe pkcs #11 parameters,
+ * use PK11_ParamFromAlgid from the algorithm id you created using
  * PK11_CreatePBEAlgorithmID or PK11_CreatePBEV2AlgorithmID.
  */
-SECItem * 
+SECItem *
 PK11_CreatePBEParams(SECItem *salt, SECItem *pwd, unsigned int iterations)
 {
     CK_PBE_PARAMS *pbe_params = NULL;
     SECItem *paramRV = NULL;
 
     paramRV = SECITEM_AllocItem(NULL, NULL, sizeof(CK_PBE_PARAMS));
-    if (!paramRV ) {
-	goto loser;
+    if (!paramRV) {
+        goto loser;
     }
     /* init paramRV->data with zeros. SECITEM_AllocItem does not do it */
     PORT_Memset(paramRV->data, 0, sizeof(CK_PBE_PARAMS));
@@ -1184,7 +1183,7 @@ PK11_CreatePBEParams(SECItem *salt, SECItem *pwd, unsigned int iterations)
 
     pbe_params->pSalt = (CK_CHAR_PTR)PORT_ZAlloc(salt->len);
     if (!pbe_params->pSalt) {
-	goto loser;
+        goto loser;
     }
     PORT_Memcpy(pbe_params->pSalt, salt->data, salt->len);
     pbe_params->ulSaltLen = salt->len;
@@ -1195,8 +1194,8 @@ PK11_CreatePBEParams(SECItem *salt, SECItem *pwd, unsigned int iterations)
 loser:
     if (pbe_params)
         pk11_destroy_ck_pbe_params(pbe_params);
-    if (paramRV) 
-    	PORT_ZFree(paramRV, sizeof(SECItem));
+    if (paramRV)
+        PORT_ZFree(paramRV, sizeof(SECItem));
     return NULL;
 }
 
@@ -1207,10 +1206,10 @@ void
 PK11_DestroyPBEParams(SECItem *pItem)
 {
     if (pItem) {
-	CK_PBE_PARAMS * params = (CK_PBE_PARAMS *)(pItem->data);
-	if (params)
-	    pk11_destroy_ck_pbe_params(params);
-	PORT_ZFree(pItem, sizeof(SECItem));
+        CK_PBE_PARAMS *params = (CK_PBE_PARAMS *)(pItem->data);
+        if (params)
+            pk11_destroy_ck_pbe_params(params);
+        PORT_ZFree(pItem, sizeof(SECItem));
     }
 }
 
@@ -1224,7 +1223,8 @@ PK11_CreatePBEAlgorithmID(SECOidTag algorithm, int iteration, SECItem *salt)
 {
     SECAlgorithmID *algid = NULL;
     algid = sec_pkcs5CreateAlgorithmID(algorithm,
-		 SEC_OID_UNKNOWN, SEC_OID_UNKNOWN, NULL, 0, salt, iteration);
+                                       SEC_OID_UNKNOWN, SEC_OID_UNKNOWN, NULL,
+                                       0, salt, iteration);
     return algid;
 }
 
@@ -1233,12 +1233,12 @@ PK11_CreatePBEAlgorithmID(SECOidTag algorithm, int iteration, SECItem *salt)
  */
 SECAlgorithmID *
 PK11_CreatePBEV2AlgorithmID(SECOidTag pbeAlgTag, SECOidTag cipherAlgTag,
-			    SECOidTag prfAlgTag, int keyLength, int iteration, 
-			    SECItem *salt)
+                            SECOidTag prfAlgTag, int keyLength, int iteration,
+                            SECItem *salt)
 {
     SECAlgorithmID *algid = NULL;
     algid = sec_pkcs5CreateAlgorithmID(pbeAlgTag, cipherAlgTag, prfAlgTag,
-					NULL, keyLength, salt, iteration);
+                                       NULL, keyLength, salt, iteration);
     return algid;
 }
 
@@ -1246,48 +1246,49 @@ PK11_CreatePBEV2AlgorithmID(SECOidTag pbeAlgTag, SECOidTag cipherAlgTag,
  * private.
  */
 PK11SymKey *
-pk11_RawPBEKeyGenWithKeyType(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, 
-			SECItem *params, CK_KEY_TYPE keyType, int keyLen,
-			SECItem *pwitem, void *wincx)
+pk11_RawPBEKeyGenWithKeyType(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
+                             SECItem *params, CK_KEY_TYPE keyType, int keyLen,
+                             SECItem *pwitem, void *wincx)
 {
     CK_ULONG pwLen;
     /* do some sanity checks */
     if ((params == NULL) || (params->data == NULL)) {
-	PORT_SetError(SEC_ERROR_INVALID_ARGS);
-	return NULL;
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return NULL;
     }
 
     if (type == CKM_INVALID_MECHANISM) {
-	PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
-	return NULL;
+        PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
+        return NULL;
     }
 
     /* set the password pointer in the parameters... */
     if (type == CKM_PKCS5_PBKD2) {
-    	CK_PKCS5_PBKD2_PARAMS *pbev2_params;
-	if (params->len < sizeof(CK_PKCS5_PBKD2_PARAMS)) {
-	    PORT_SetError(SEC_ERROR_INVALID_ARGS);
-	    return NULL;
-	}
-	pbev2_params = (CK_PKCS5_PBKD2_PARAMS *)params->data;
-	pbev2_params->pPassword = pwitem->data;
-	pwLen = pwitem->len;
-	pbev2_params->ulPasswordLen = &pwLen;
+        CK_PKCS5_PBKD2_PARAMS *pbev2_params;
+        if (params->len < sizeof(CK_PKCS5_PBKD2_PARAMS)) {
+            PORT_SetError(SEC_ERROR_INVALID_ARGS);
+            return NULL;
+        }
+        pbev2_params = (CK_PKCS5_PBKD2_PARAMS *)params->data;
+        pbev2_params->pPassword = pwitem->data;
+        pwLen = pwitem->len;
+        pbev2_params->ulPasswordLen = &pwLen;
     } else {
-    	CK_PBE_PARAMS *pbe_params;
-	if (params->len < sizeof(CK_PBE_PARAMS)) {
-	    PORT_SetError(SEC_ERROR_INVALID_ARGS);
-	    return NULL;
-	}
-	pbe_params = (CK_PBE_PARAMS *)params->data;
-	pbe_params->pPassword = pwitem->data;
-	pbe_params->ulPasswordLen = pwitem->len;
+        CK_PBE_PARAMS *pbe_params;
+        if (params->len < sizeof(CK_PBE_PARAMS)) {
+            PORT_SetError(SEC_ERROR_INVALID_ARGS);
+            return NULL;
+        }
+        pbe_params = (CK_PBE_PARAMS *)params->data;
+        pbe_params->pPassword = pwitem->data;
+        pbe_params->ulPasswordLen = pwitem->len;
     }
 
     /* generate the key (and sometimes the IV as a side effect...) */
-    return pk11_TokenKeyGenWithFlagsAndKeyType(slot, type, params, keyType, 
-	   keyLen, NULL, CKF_SIGN|CKF_ENCRYPT|CKF_DECRYPT|CKF_UNWRAP|CKF_WRAP, 
-	   0, wincx);
+    return pk11_TokenKeyGenWithFlagsAndKeyType(slot, type, params, keyType,
+                                               keyLen, NULL,
+                                               CKF_SIGN | CKF_ENCRYPT | CKF_DECRYPT | CKF_UNWRAP | CKF_WRAP,
+                                               0, wincx);
 }
 
 /*
@@ -1295,10 +1296,10 @@ pk11_RawPBEKeyGenWithKeyType(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
  */
 PK11SymKey *
 PK11_RawPBEKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *mech,
-			 SECItem *pwitem, PRBool faulty3DES, void *wincx)
+                  SECItem *pwitem, PRBool faulty3DES, void *wincx)
 {
-    if(faulty3DES && (type == CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC)) {
-	type = CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC;
+    if (faulty3DES && (type == CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC)) {
+        type = CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC;
     }
     return pk11_RawPBEKeyGenWithKeyType(slot, type, mech, -1, 0, pwitem, wincx);
 }
@@ -1312,12 +1313,12 @@ PK11_RawPBEKeyGen(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *mech,
  */
 PK11SymKey *
 PK11_PBEKeyGen(PK11SlotInfo *slot, SECAlgorithmID *algid, SECItem *pwitem,
-	       					PRBool faulty3DES, void *wincx)
+               PRBool faulty3DES, void *wincx)
 {
     CK_MECHANISM_TYPE type;
     SECItem *param = NULL;
     PK11SymKey *symKey = NULL;
-    SECOidTag	pbeAlg;
+    SECOidTag pbeAlg;
     CK_KEY_TYPE keyType = -1;
     int keyLen = 0;
 
@@ -1325,45 +1326,45 @@ PK11_PBEKeyGen(PK11SlotInfo *slot, SECAlgorithmID *algid, SECItem *pwitem,
     /* if we're using PKCS5v2, extract the additional information we need
      * (key length, key type, and pbeAlg). */
     if (sec_pkcs5_is_algorithm_v2_pkcs5_algorithm(pbeAlg)) {
-	CK_MECHANISM_TYPE cipherMech;
-	sec_pkcs5V2Parameter *pbeV2_param;
-
-	pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
-	if (pbeV2_param == NULL) {
-	    return NULL;
-	}
-	cipherMech = PK11_AlgtagToMechanism(
-		SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId));
-	pbeAlg = SECOID_GetAlgorithmTag(&pbeV2_param->pbeAlgId);
-	param = PK11_ParamFromAlgid(&pbeV2_param->pbeAlgId);
-	sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
-	keyLen = SEC_PKCS5GetKeyLength(algid);
-	if (keyLen == -1) {
-	    keyLen = 0;
-	}
-	keyType = PK11_GetKeyType(cipherMech, keyLen);
+        CK_MECHANISM_TYPE cipherMech;
+        sec_pkcs5V2Parameter *pbeV2_param;
+
+        pbeV2_param = sec_pkcs5_v2_get_v2_param(NULL, algid);
+        if (pbeV2_param == NULL) {
+            return NULL;
+        }
+        cipherMech = PK11_AlgtagToMechanism(
+            SECOID_GetAlgorithmTag(&pbeV2_param->cipherAlgId));
+        pbeAlg = SECOID_GetAlgorithmTag(&pbeV2_param->pbeAlgId);
+        param = PK11_ParamFromAlgid(&pbeV2_param->pbeAlgId);
+        sec_pkcs5_v2_destroy_v2_param(pbeV2_param);
+        keyLen = SEC_PKCS5GetKeyLength(algid);
+        if (keyLen == -1) {
+            keyLen = 0;
+        }
+        keyType = PK11_GetKeyType(cipherMech, keyLen);
     } else {
-	param = PK11_ParamFromAlgid(algid);
+        param = PK11_ParamFromAlgid(algid);
     }
 
-    if(param == NULL) {
-	goto loser;
+    if (param == NULL) {
+        goto loser;
     }
 
-    type = PK11_AlgtagToMechanism(pbeAlg);	
+    type = PK11_AlgtagToMechanism(pbeAlg);
     if (type == CKM_INVALID_MECHANISM) {
-	PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
-	goto loser;
+        PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
+        goto loser;
     }
-    if(faulty3DES && (type == CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC)) {
-	type = CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC;
+    if (faulty3DES && (type == CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC)) {
+        type = CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC;
     }
-    symKey = pk11_RawPBEKeyGenWithKeyType(slot, type, param, keyType, keyLen, 
-					pwitem, wincx);
+    symKey = pk11_RawPBEKeyGenWithKeyType(slot, type, param, keyType, keyLen,
+                                          pwitem, wincx);
 
 loser:
     if (param) {
-	SECITEM_ZfreeItem(param, PR_TRUE);
+        SECITEM_ZfreeItem(param, PR_TRUE);
     }
     return symKey;
 }
@@ -1378,8 +1379,8 @@ PK11_GetPBEIV(SECAlgorithmID *algid, SECItem *pwitem)
 }
 
 CK_MECHANISM_TYPE
-pk11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **param, 
-			   SECItem *pbe_pwd, PRBool faulty3DES)
+pk11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **param,
+                           SECItem *pbe_pwd, PRBool faulty3DES)
 {
     int keyLen = 0;
     SECOidTag algTag = SEC_PKCS5GetCryptoAlgorithm(algid);
@@ -1388,27 +1389,27 @@ pk11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **param,
     SECItem *iv = NULL;
 
     if (mech == CKM_INVALID_MECHANISM) {
-	PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
-	goto loser;
+        PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
+        goto loser;
     }
     if (PK11_GetIVLength(mech)) {
-	iv = SEC_PKCS5GetIV(algid, pbe_pwd, faulty3DES);
-	if (iv == NULL) {
-	    goto loser;
-	}
+        iv = SEC_PKCS5GetIV(algid, pbe_pwd, faulty3DES);
+        if (iv == NULL) {
+            goto loser;
+        }
     }
 
     keyLen = SEC_PKCS5GetKeyLength(algid);
 
     *param = pk11_ParamFromIVWithLen(mech, iv, keyLen);
     if (*param == NULL) {
-	goto loser;
+        goto loser;
     }
     returnedMechanism = mech;
 
 loser:
     if (iv) {
-	SECITEM_FreeItem(iv,PR_TRUE);
+        SECITEM_FreeItem(iv, PR_TRUE);
     }
     return returnedMechanism;
 }
@@ -1425,8 +1426,8 @@ loser:
  * The caller is responsible for freeing the parameter.
  */
 CK_MECHANISM_TYPE
-PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **param, 
-			   SECItem *pbe_pwd)
+PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **param,
+                           SECItem *pbe_pwd)
 {
     return pk11_GetPBECryptoMechanism(algid, param, pbe_pwd, PR_FALSE);
 }