[security] Add new API (up to beta 6) and unit tests

src/Security/Certificate.cs

@@ -658,6 +658,206 @@ public SecStatusCode Decrypt (SecPadding padding, byte [] cipherText, out byte [
 			return _Decrypt (padding, cipherText, ref plainText);
 		}
 
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern IntPtr /* SecKeyRef _Nullable */ SecKeyCreateRandomKey (IntPtr /* CFDictionaryRef* */ parameters, out IntPtr /* CFErrorRef** */ error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		static public SecKey CreateRandomKey (NSDictionary parameters, out NSError error)
+		{
+			if (parameters == null)
+				throw new ArgumentNullException (nameof (parameters));
+
+			IntPtr err;
+			var key = SecKeyCreateRandomKey (parameters.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return key == IntPtr.Zero ? null : new SecKey (key, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		static public SecKey CreateRandomKey (SecKeyType keyType, int keySizeInBits, NSDictionary parameters, out NSError error)
+		{
+			using (var ks = new NSNumber (keySizeInBits))
+			using (var md = parameters == null ? new NSMutableDictionary () : new NSMutableDictionary (parameters)) {
+				md.LowlevelSetObject (keyType.GetConstant (), SecAttributeKey.KeyType);
+				md.LowlevelSetObject (ks, SecAttributeKey.KeySizeInBits);
+				return CreateRandomKey (md, out error);
+			}
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern IntPtr /* SecKeyRef _Nullable */ SecKeyCreateWithData (IntPtr /* CFDataRef* */ keyData, IntPtr /* CFDictionaryRef* */ attributes, out IntPtr /* CFErrorRef** */ error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		static public SecKey Create (NSData keyData, NSDictionary parameters, out NSError error)
+		{
+			if (keyData == null)
+				throw new ArgumentNullException (nameof (keyData));
+			if (parameters == null)
+				throw new ArgumentNullException (nameof (parameters));
+
+			IntPtr err;
+			var key = SecKeyCreateWithData (keyData.Handle, parameters.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return key == IntPtr.Zero ? null : new SecKey (key, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		static public SecKey Create (NSData keyData, SecKeyType keyType, SecKeyClass keyClass, int keySizeInBits, NSDictionary parameters, out NSError error)
+		{
+			using (var ks = new NSNumber (keySizeInBits))
+			using (var md = parameters == null ? new NSMutableDictionary () : new NSMutableDictionary (parameters)) {
+				md.LowlevelSetObject (keyType.GetConstant (), SecAttributeKey.KeyType);
+				md.LowlevelSetObject (keyClass.GetConstant (), SecAttributeKey.KeyClass);
+				md.LowlevelSetObject (ks, SecAttributeKey.KeySizeInBits);
+				return Create (keyData, md, out error);
+			}
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern IntPtr /* CFDataRef _Nullable */ SecKeyCopyExternalRepresentation (IntPtr /* SecKeyRef* */ key, out IntPtr /* CFErrorRef** */ error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData GetExternalRepresentation (out NSError error)
+		{
+			IntPtr err;
+			var data = SecKeyCopyExternalRepresentation (handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData GetExternalRepresentation ()
+		{
+			IntPtr err;
+			var data = SecKeyCopyExternalRepresentation (handle, out err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern IntPtr /* CFDictionaryRef _Nullable */ SecKeyCopyAttributes (IntPtr /* SecKeyRef* */ key);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSDictionary GetAttributes ()
+		{
+			var dict = SecKeyCopyAttributes (handle);
+			return Runtime.GetNSObject<NSDictionary> (dict, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern IntPtr /* SecKeyRef* */ SecKeyCopyPublicKey (IntPtr /* SecKeyRef* */ key);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public SecKey GetPublicKey ()
+		{
+			var key = SecKeyCopyPublicKey (handle);
+			return key == IntPtr.Zero ? null : new SecKey (key, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern bool /* Boolean */ SecKeyIsAlgorithmSupported (IntPtr /* SecKeyRef* */ key, /* SecKeyOperationType */ nint operation, IntPtr /* SecKeyAlgorithm* */ algorithm);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public bool IsAlgorithmSupported (SecKeyOperationType operation, SecKeyAlgorithm algorithm)
+		{
+			return SecKeyIsAlgorithmSupported (handle, (int) operation, algorithm.GetConstant ().Handle);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern /* CFDataRef _Nullable */ IntPtr SecKeyCreateSignature (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr dataToSign, /* CFErrorRef* */ out IntPtr error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData CreateSignature (SecKeyAlgorithm algorithm, NSData dataToSign, out NSError error)
+		{
+			if (dataToSign == null)
+				throw new ArgumentNullException (nameof (dataToSign));
+
+			IntPtr err;
+			var data = SecKeyCreateSignature (Handle, algorithm.GetConstant ().Handle, dataToSign.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern /* Boolean */ bool SecKeyVerifySignature (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr signedData, /* CFDataRef */ IntPtr signature, /* CFErrorRef* */ out IntPtr error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public bool VerifySignature (SecKeyAlgorithm algorithm, NSData signedData, NSData signature, out NSError error)
+		{
+			if (signedData == null)
+				throw new ArgumentNullException (nameof (signedData));
+			if (signature == null)
+				throw new ArgumentNullException (nameof (signature));
+
+			IntPtr err;
+			var result = SecKeyVerifySignature (Handle, algorithm.GetConstant ().Handle, signedData.Handle, signature.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return result;
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern /* CFDataRef _Nullable */ IntPtr SecKeyCreateEncryptedData (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr plaintext, /* CFErrorRef* */ out IntPtr error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData CreateEncryptedData (SecKeyAlgorithm algorithm, NSData plaintext, out NSError error)
+		{
+			if (plaintext == null)
+				throw new ArgumentNullException (nameof (plaintext));
+
+			IntPtr err;
+			var data = SecKeyCreateEncryptedData (Handle, algorithm.GetConstant ().Handle, plaintext.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern /* CFDataRef _Nullable */ IntPtr SecKeyCreateDecryptedData (/* SecKeyRef */ IntPtr key, /* SecKeyAlgorithm */ IntPtr algorithm, /* CFDataRef */ IntPtr ciphertext, /* CFErrorRef* */ out IntPtr error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData CreateDecryptedData (SecKeyAlgorithm algorithm, NSData ciphertext, out NSError error)
+		{
+			if (ciphertext == null)
+				throw new ArgumentNullException (nameof (ciphertext));
+
+			IntPtr err;
+			var data = SecKeyCreateDecryptedData (Handle, algorithm.GetConstant ().Handle, ciphertext.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		[DllImport (Constants.SecurityLibrary)]
+		static extern /* CFDataRef _Nullable */ IntPtr SecKeyCopyKeyExchangeResult (/* SecKeyRef */ IntPtr privateKey, /* SecKeyAlgorithm */ IntPtr algorithm, /* SecKeyRef */ IntPtr publicKey, /* CFDictionaryRef */ IntPtr parameters, /* CFErrorRef* */ out IntPtr error);
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData GetKeyExchangeResult (SecKeyAlgorithm algorithm, SecKey publicKey, NSDictionary parameters, out NSError error)
+		{
+			if (publicKey == null)
+				throw new ArgumentNullException (nameof (publicKey));
+			if (parameters == null)
+				throw new ArgumentNullException (nameof (parameters));
+
+			IntPtr err;
+			var data = SecKeyCopyKeyExchangeResult (Handle, algorithm.GetConstant ().Handle, publicKey.Handle, parameters.Handle, out err);
+			error = err == IntPtr.Zero ? null : new NSError (err);
+			return Runtime.GetNSObject<NSData> (data, true);
+		}
+
+		[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+		public NSData GetKeyExchangeResult (SecKeyAlgorithm algorithm, SecKey publicKey, SecKeyKeyExchangeParameter parameters, out NSError error)
+		{
+			return GetKeyExchangeResult (algorithm, publicKey, parameters?.Dictionary, out error);
+		}
+
 		~SecKey ()
 		{
 			Dispose (false);

src/Security/Enums.cs

@@ -293,7 +293,9 @@ public enum SecStatusCode {
 		MissingAttributeWrappedKeyFormat	= -67805,	/* A wrapped key format attribute was missing. */
 		StagedOperationInProgress			= -67806,	/* A staged operation is in progress. */
 		StagedOperationNotStarted			= -67807,	/* A staged operation was not started. */
+#endif
 		VerifyFailed						= -67808,	/* A cryptographic verification failure has occurred. */
+#if MONOMAC
 		QuerySizeUnknown					= -67809,	/* The query size is unknown. */
 		BlockSizeMismatch					= -67810,	/* A block size mismatch occurred. */
 		PublicKeyInconsistent				= -67811,	/* The public key was inconsistent. */
@@ -410,7 +412,7 @@ public enum SecTrustResult {
 		Invalid,
 		Proceed,
 
-		[Availability (Deprecated = Platform.iOS_7_0)]
+		[Availability (Deprecated = Platform.iOS_7_0 | Platform.Mac_10_9)]
 		Confirm,
 		Deny,
 		Unspecified,
@@ -441,4 +443,14 @@ public enum SecTokenID {
 		[Field ("kSecAttrTokenIDSecureEnclave")]
 		SecureEnclave,
 	}
+
+	[Watch (3,0)][TV (10,0)][Mac (10,12)][iOS (10,0)]
+	[Native]
+	public enum SecKeyOperationType : nint {
+		Sign = 0,
+		Verify = 1,
+		Encrypt = 2,
+		Decrypt = 3,
+		KeyExchange = 4
+	}
 }

src/Security/Items.cs

@@ -73,16 +73,6 @@ public enum SecAuthenticationType {
 		Ntlm, Msn, Dpa, Rpa, HttpBasic, HttpDigest, HtmlForm, Default
 	}
 
-	public enum SecKeyClass {
-		Invalid = -1,
-		Public, Private, Symmetric
-	}
-
-	public enum SecKeyType {
-		Invalid = -1,
-		RSA, EC
-	}
-
 #if XAMCORE_2_0
 	public class SecKeyChain : INativeObject {
 
@@ -1206,17 +1196,14 @@ public SecKeyClass KeyClass {
 				var k = Fetch (SecAttributeKey.KeyClass);
 				if (k == IntPtr.Zero)
 					return SecKeyClass.Invalid;
-				if (CFType.Equal (k, ClassKeys.Public))
-					return SecKeyClass.Public;
-				else if (CFType.Equal (k, ClassKeys.Private))
-					return SecKeyClass.Private;
-				else if (CFType.Equal (k, ClassKeys.Symmetric))
-					return SecKeyClass.Symmetric;
-				else
-					return SecKeyClass.Invalid;
+				using (var s = new NSString (k))
+					return SecKeyClassExtensions.GetValue (s);
 			}
 			set {
-				SetValue (value == SecKeyClass.Public ? ClassKeys.Public : value == SecKeyClass.Private ? ClassKeys.Private : ClassKeys.Symmetric, SecAttributeKey.KeyClass);
+				var k = value.GetConstant ();
+				if (k == null)
+					throw new ArgumentException ("Unknown value");
+				SetValue ((NSObject) k, SecAttributeKey.KeyClass);
 			}
 		}
 
@@ -1257,16 +1244,15 @@ public SecKeyType KeyType {
 				var k = Fetch (SecAttributeKey.KeyType);
 				if (k == IntPtr.Zero)
 					return SecKeyType.Invalid;
-				if (CFType.Equal (k, KeyTypeKeys.RSA))
-					return SecKeyType.RSA;
-				else if (CFType.Equal (k, KeyTypeKeys.EC))
-					return SecKeyType.EC;
-				else
-					return SecKeyType.Invalid;
+				using (var s = new NSString (k))
+					return SecKeyTypeExtensions.GetValue (s);
 			}
 
 			set {
-				SetValue (value == SecKeyType.RSA ? KeyTypeKeys.RSA : KeyTypeKeys.EC, SecAttributeKey.KeyType);
+				var k = value.GetConstant ();
+				if (k == null)
+					throw new ArgumentException ("Unknown value");
+				SetValue ((NSObject) k, SecAttributeKey.KeyType);
 			}
 		}
 

src/Security/SecAccessControl.cs

@@ -20,10 +20,15 @@
 
 namespace XamCore.Security {
 
-	// CFIndex -> SecAccessControl.h
 	[Flags]
 	[Native]
+#if XAMCORE_4_0
+	// changed to CFOptionFlags in Xcode 8 SDK
+	public enum SecAccessControlCreateFlags : nuint {
+#else
+	// CFOptionFlags -> SecAccessControl.h
 	public enum SecAccessControlCreateFlags : nint {
+#endif
 		UserPresence        = 1 << 0,
 		TouchIDAny          = 1 << 1,
 		TouchIDCurrentSet   = 1 << 3,

src/Security/SecPolicy.cs

@@ -34,27 +34,29 @@ public partial class SecPolicy {
 
 		[iOS (7,0)]
 		[DllImport (Constants.SecurityLibrary)]
-		extern static IntPtr /* CFDictionaryRef */ SecPolicyCopyProperties (IntPtr /* SecPolicyRef */ policyRef);
+		extern static IntPtr /* __nullable CFDictionaryRef */ SecPolicyCopyProperties (IntPtr /* SecPolicyRef */ policyRef);
 
 		[iOS (7,0)]
 		public NSDictionary GetProperties ()
 		{
-			return new NSDictionary (SecPolicyCopyProperties (Handle), true);
+			var dict = SecPolicyCopyProperties (Handle);
+			return Runtime.GetNSObject<NSDictionary> (dict, true);
 		}
 
 		[Mac (10,9)]
 		[DllImport (Constants.SecurityLibrary)]
-		extern static IntPtr /* SecPolicyRef */ SecPolicyCreateRevocation (/* CFOptionFlags */ nuint revocationFlags);
+		extern static IntPtr /* __nullable SecPolicyRef */ SecPolicyCreateRevocation (/* CFOptionFlags */ nuint revocationFlags);
 
 		[Mac (10,9)][iOS (7,0)]
 		static public SecPolicy CreateRevocationPolicy (SecRevocation revocationFlags)
 		{
-			return new SecPolicy (SecPolicyCreateRevocation ((nuint)(ulong) revocationFlags), true);
+			var policy = SecPolicyCreateRevocation ((nuint)(ulong) revocationFlags);
+			return policy == IntPtr.Zero ? null : new SecPolicy (policy, true);
 		}
 
 		[Mac (10,9)][iOS (7,0)]
 		[DllImport (Constants.SecurityLibrary)]
-		extern static IntPtr /* SecPolicyRef */ SecPolicyCreateWithProperties (IntPtr /* CFTypeRef */ policyIdentifier, IntPtr /* CFDictionaryRef */ properties);
+		extern static IntPtr /* __nullable SecPolicyRef */ SecPolicyCreateWithProperties (IntPtr /* CFTypeRef */ policyIdentifier, IntPtr /* CFDictionaryRef */ properties);
 
 		[Mac (10,9)][iOS (7,0)]
 		static public SecPolicy CreatePolicy (NSString policyIdentifier, NSDictionary properties)

src/Security/SecSharedCredential.cs

@@ -136,4 +136,4 @@ public static string CreateSharedWebCredentialPassword ()
 
 }
 
-#endif  //!MONOMAC && !WATCH
+#endif  // IOS