((keyLength == 0) || (keyLength > 16)) ? 512 : 256;
(symKeyLength > 28 || symKeyLength == 0) ? 512 : 256;
pk11_KeyExchange(PK11SlotInfo *slot,CK_MECHANISM_TYPE type,		 	CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey){    PK11SymKey *newSymKey = NULL;    SECStatus rv;    /* performance improvement can go here --- use a generated key to as a     * per startup wrapping key. If it exists, use it, otherwise do a full     * key exchange. */    /* find a common Key Exchange algorithm */    /* RSA */    if (PK11_DoesMechanism(symKey->slot, CKM_RSA_PKCS) && 				PK11_DoesMechanism(slot,CKM_RSA_PKCS)) {	CK_OBJECT_HANDLE pubKeyHandle = CK_INVALID_KEY;	CK_OBJECT_HANDLE privKeyHandle = CK_INVALID_KEY;	SECKEYPublicKey *pubKey = NULL;	SECKEYPrivateKey *privKey = NULL;	SECItem wrapData;	wrapData.data = NULL;	/* find RSA Public Key on target */	pubKeyHandle = pk11_FindRSAPubKey(slot);	if (pubKeyHandle != CK_INVALID_KEY) {	    privKeyHandle = PK11_MatchItem(slot,pubKeyHandle,CKO_PRIVATE_KEY);	}	/* if no key exits, generate a key pair */	if (privKeyHandle == CK_INVALID_KEY) {	    unsigned int     keyLength = PK11_GetKeyLength(symKey);	    PK11RSAGenParams rsaParams;	    rsaParams.keySizeInBits = 		((keyLength == 0) || (keyLength > 16)) ? 512 : 256;	    rsaParams.pe  = 0x10001;	    privKey = PK11_GenerateKeyPair(slot,CKM_RSA_PKCS_KEY_PAIR_GEN, 		&rsaParams, &pubKey,PR_FALSE,PR_TRUE,symKey->cx);	} else {	    /* if key's exist, build SECKEY data structures for them */	    privKey = PK11_MakePrivKey(slot,nullKey, PR_TRUE, privKeyHandle,					symKey->cx);	    if (privKey != NULL) {    		pubKey = PK11_ExtractPublicKey(slot, rsaKey, pubKeyHandle);		if (pubKey && pubKey->pkcs11Slot) {		    PK11_FreeSlot(pubKey->pkcs11Slot);		    pubKey->pkcs11Slot = NULL;		    pubKey->pkcs11ID = CK_INVALID_KEY;		}	    }	}	if (privKey == NULL) goto rsa_failed;	if (pubKey == NULL)  goto rsa_failed;        wrapData.len  = SECKEY_PublicKeyStrength(pubKey);        if (!wrapData.len) goto rsa_failed;        wrapData.data = PORT_Alloc(wrapData.len);        if (wrapData.data == NULL) goto rsa_failed;	/* now wrap the keys in and out */	rv = PK11_PubWrapSymKey(CKM_RSA_PKCS, pubKey, symKey, &wrapData);	if (rv == SECSuccess) {	    newSymKey = PK11_PubUnwrapSymKey(privKey,&wrapData,type,operation,							symKey->size);	}rsa_failed:	if (wrapData.data != NULL) PORT_Free(wrapData.data);	if (privKey != NULL) SECKEY_DestroyPrivateKey(privKey);	if (pubKey != NULL) SECKEY_DestroyPublicKey(pubKey);	return  newSymKey;    }    /* KEA */    if (PK11_DoesMechanism(symKey->slot, CKM_KEA_KEY_DERIVE) && 				PK11_DoesMechanism(slot,CKM_KEA_KEY_DERIVE)) {	CERTCertificate *certSource = NULL;	CERTCertificate *certTarget = NULL;	SECKEYPublicKey *pubKeySource = NULL;	SECKEYPublicKey *pubKeyTarget = NULL;	SECKEYPrivateKey *privKeySource = NULL;	SECKEYPrivateKey *privKeyTarget = NULL;	PK11SymKey *tekSource = NULL;	PK11SymKey *tekTarget = NULL;	SECItem Ra,wrap;	/* can only exchange skipjack keys */	if (type != CKM_SKIPJACK_CBC64) {    	    PORT_SetError( SEC_ERROR_NO_MODULE );	    goto kea_failed;	}	/* find a pair of certs we can use */	rv = PK11_GetKEAMatchedCerts(symKey->slot,slot,&certSource,&certTarget);	if (rv != SECSuccess) goto kea_failed;	/* get all the key pairs */	pubKeyTarget = CERT_ExtractPublicKey(certSource);	pubKeySource = CERT_ExtractPublicKey(certTarget);	privKeySource = 		PK11_FindKeyByDERCert(symKey->slot,certSource,symKey->cx);	privKeyTarget = 		PK11_FindKeyByDERCert(slot,certTarget,symKey->cx);	if ((pubKeySource == NULL) || (pubKeyTarget == NULL) ||	  (privKeySource == NULL) || (privKeyTarget == NULL)) goto kea_failed;	/* generate the wrapping TEK's */	Ra.data = (unsigned char*)PORT_Alloc(128 /* FORTEZZA RA MAGIC */);	Ra.len = 128;	if (Ra.data == NULL) goto kea_failed;	tekSource = PK11_PubDerive(privKeySource,pubKeyTarget,PR_TRUE,&Ra,NULL,		CKM_SKIPJACK_WRAP, CKM_KEA_KEY_DERIVE,CKA_WRAP,0,symKey->cx);	tekTarget = PK11_PubDerive(privKeyTarget,pubKeySource,PR_FALSE,&Ra,NULL,		CKM_SKIPJACK_WRAP, CKM_KEA_KEY_DERIVE,CKA_WRAP,0,symKey->cx);	PORT_Free(Ra.data);	if ((tekSource == NULL) || (tekTarget == NULL)) { goto kea_failed; }	/* wrap the key out of Source into target */	wrap.data = (unsigned char*)PORT_Alloc(12); /* MAGIC SKIPJACK LEN */	wrap.len = 12;	/* paranoia to prevent infinite recursion on bugs */	PORT_Assert(tekSource->slot == symKey->slot);	if (tekSource->slot != symKey->slot) {    	    PORT_SetError( SEC_ERROR_NO_MODULE );	    goto kea_failed;	}	rv = PK11_WrapSymKey(CKM_SKIPJACK_WRAP,NULL,tekSource,symKey,&wrap);	if (rv == SECSuccess) {	    newSymKey = PK11_UnwrapSymKey(tekTarget, CKM_SKIPJACK_WRAP, NULL,			&wrap, type, operation, symKey->size);	}	PORT_Free(wrap.data);kea_failed:	if (certSource == NULL) CERT_DestroyCertificate(certSource);	if (certTarget == NULL) CERT_DestroyCertificate(certTarget);	if (pubKeySource == NULL) SECKEY_DestroyPublicKey(pubKeySource);	if (pubKeyTarget == NULL) SECKEY_DestroyPublicKey(pubKeyTarget);	if (privKeySource == NULL) SECKEY_DestroyPrivateKey(privKeySource);	if (privKeyTarget == NULL) SECKEY_DestroyPrivateKey(privKeyTarget);	if (tekSource == NULL) PK11_FreeSymKey(tekSource);	if (tekTarget == NULL) PK11_FreeSymKey(tekTarget);	return newSymKey;    }    PORT_SetError( SEC_ERROR_NO_MODULE );    return NULL;}