private ASN1BitString rebuildASN1BitString(byte[] array) throws IOException {
    return (ASN1BitString) rebuildASN1Primitive(BERTags.BIT_STRING,array);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * BasicConstraints := SEQUENCE {
 *    cA                  BOOLEAN DEFAULT FALSE,*    pathLenConstraint   INTEGER (0..MAX) OPTIONAL
 * }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    if (cA != null)
    {
        v.add(cA);
    }

    if (pathLenConstraint != null)  // yes some people actually do this when cA is false...
    {
        v.add(pathLenConstraint);
    }

    return new DERSequence(v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <p/>
 * Returns:
 * <p/>
 * <pre>
 *             NamingAuthority ::= SEQUENCE
 *             {
 *               namingAuthorityId OBJECT IDENTIFIER OPTIONAL,*               namingAuthorityUrl IA5String OPTIONAL,*               namingAuthorityText DirectoryString(SIZE(1..128)) OPTIONAL
 *             }
 * </pre>
 *
 * @return a DERObject
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector vec = new ASN1encodableVector();
    if (namingAuthorityId != null)
    {
        vec.add(namingAuthorityId);
    }
    if (namingAuthorityUrl != null)
    {
        vec.add(new DERIA5String(namingAuthorityUrl,true));
    }
    if (namingAuthorityText != null)
    {
        vec.add(namingAuthorityText);
    }
    return new DERSequence(vec);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 *  Curve ::= SEQUENCE {
 *      a               FieldElement,*      b               FieldElement,*      seed            BIT STRING      OPTIONAL
 *  }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    if (fieldIdentifier.equals(prime_field)) 
    { 
        v.add(new X9FieldElement(curve.getA()).toASN1Primitive());
        v.add(new X9FieldElement(curve.getB()).toASN1Primitive());
    } 
    else if (fieldIdentifier.equals(characteristic_two_field)) 
    {
        v.add(new X9FieldElement(curve.getA()).toASN1Primitive());
        v.add(new X9FieldElement(curve.getB()).toASN1Primitive());
    }

    if (seed != null)
    {
        v.add(new DERBitString(seed));
    }

    return new DERSequence(v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <p/>
 * Returns:
 * <p/>
 * <pre>
 *               ProcurationSyntax ::= SEQUENCE {
 *                 country [1] EXPLICIT PrintableString(SIZE(2)) OPTIONAL,*                 typeOfSubstitution [2] EXPLICIT DirectoryString (SIZE(1..128)) OPTIONAL,*                 signingFor [3] EXPLICIT SigningFor
 *               }
 * <p/>
 *               SigningFor ::= CHOICE
 *               {
 *                 thirdPerson GeneralName,*                 certRef IssuerSerial
 *               }
 * </pre>
 *
 * @return a DERObject
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector vec = new ASN1encodableVector();
    if (country != null)
    {
        vec.add(new DERTaggedobject(true,1,new DERPrintableString(country,true)));
    }
    if (typeOfSubstitution != null)
    {
        vec.add(new DERTaggedobject(true,2,typeOfSubstitution));
    }
    if (thirdPerson != null)
    {
        vec.add(new DERTaggedobject(true,3,thirdPerson));
    }
    else
    {
        vec.add(new DERTaggedobject(true,certRef));
    }

    return new DERSequence(vec);
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    if (namedCurve != null)
    {
        v.add(namedCurve);
    }
    else
    {
        v.add(ecbinary);
    }

    if (!org.bouncycastle.util.Arrays.areEqual(dke,DEFAULT_DKE))
    {
        v.add(new DEROctetString(dke));
    }

    return new DERSequence(v);
}

/** 
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * OriginatorInfo ::= SEQUENCE {
 *     certs [0] IMPLICIT CertificateSet OPTIONAL,*     crls [1] IMPLICIT CertificateRevocationLists OPTIONAL 
 * }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    if (certs != null)
    {
        v.add(new DERTaggedobject(false,certs));
    }

    if (crls != null)
    {
        v.add(new DERTaggedobject(false,crls));
    }

    return new DERSequence(v);
}

public netscapecertrequest(
    String challenge,AlgorithmIdentifier signing_alg,PublicKey pub_key) throws NoSuchAlgorithmException,InvalidKeySpecException,NoSuchProviderException
{

    this.challenge = challenge;
    sigalg = signing_alg;
    pubkey = pub_key;

    ASN1encodableVector content_der = new ASN1encodableVector();
    content_der.add(getKeySpec());
    //content_der.add(new SubjectPublicKeyInfo(sigalg,new RSAPublicKeyStructure(pubkey.getModulus(),pubkey.getPublicExponent()).getDERObject()));
    content_der.add(new DERIA5String(challenge));

    try
    {
        content = new DERBitString(new DERSequence(content_der));
    }
    catch (IOException e)
    {
        throw new InvalidKeySpecException("exception encoding key: " + e.toString());
    }
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector spkac = new ASN1encodableVector();
    ASN1encodableVector pkac = new ASN1encodableVector();

    try
    {
        pkac.add(getKeySpec());
    }
    catch (Exception e)
    {
        //ignore
    }

    pkac.add(new DERIA5String(challenge));

    spkac.add(new DERSequence(pkac));
    spkac.add(sigalg);
    spkac.add(new DERBitString(sigBits));

    return new DERSequence(spkac);
}

/**
 * @see org.bouncycastle.asn1.ASN1Object#toASN1Primitive()
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    if (valid != (signValid | bodyValid))
    {
        return null;
    }
    v.add(certificateBody);

    try
    {
        v.add(new DERApplicationSpecific(false,EACTags.STATIC_INTERNAL_AUTHENTIFICATION_ONE_STEP,new DEROctetString(signature)));
    }
    catch (IOException e)
    {
        throw new IllegalStateException("unable to convert signature!");
    }

    return new DERApplicationSpecific(EACTags.CARDHOLDER_CERTIFICATE,v);
}

/** 
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * EnvelopedData ::= SEQUENCE {
 *     version CMsversion,*     originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,*     recipientInfos RecipientInfos,*     encryptedContentInfo EncryptedContentInfo,*     unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL 
 * }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(version);

    if (originatorInfo != null)
    {
        v.add(new DERTaggedobject(false,originatorInfo));
    }

    v.add(recipientInfos);
    v.add(encryptedContentInfo);

    if (unprotectedAttrs != null)
    {
        v.add(new DERTaggedobject(false,unprotectedAttrs));
    }

    return new BERSequence(v);
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(certificateBody);

    try
    {
        v.add(new DERApplicationSpecific(false,new DEROctetString(innerSignature)));
    }
    catch (IOException e)
    {
        throw new IllegalStateException("unable to convert signature!");
    }

    return new DERApplicationSpecific(EACTags.CARDHOLDER_CERTIFICATE,v);
}

public int generateBytes(byte[] out,int outOff,int len)
    throws DataLengthException,IllegalArgumentException
{
    // Todo Create an ASN.1 class for this (RFC3278)
    // ECC-CMS-SharedInfo
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(new AlgorithmIdentifier(algorithm,DERNull.INSTANCE));
    v.add(new DERTaggedobject(true,new DEROctetString(Pack.intToBigEndian(keySize))));

    try
    {
        kdf.init(new KDFParameters(z,new DERSequence(v).getEncoded(ASN1Encoding.DER)));
    }
    catch (IOException e)
    {
        throw new IllegalArgumentException("unable to initialise kdf: " + e.getMessage());
    }

    return kdf.generateBytes(out,outOff,len);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * ContentInfo ::= SEQUENCE {
 *          contentType ContentType,*          content
 *          [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(contentType);

    if (content != null)
    {
        v.add(new BERTaggedobject(true,content));
    }

    if (isBer)
    {
        return new BERSequence(v);
    }
    else
    {
        return new DLSequence(v);
    }
}

/** 
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * PasswordRecipientInfo ::= SEQUENCE {
 *   version CMsversion,-- Always set to 0
 *   keyDerivationAlgorithm [0] KeyDerivationAlgorithmIdentifier
 *                             OPTIONAL,*  keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,*  encryptedKey EncryptedKey }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(version);

    if (keyDerivationAlgorithm != null)
    {
        v.add(new DERTaggedobject(false,keyDerivationAlgorithm));
    }
    v.add(keyEncryptionAlgorithm);
    v.add(encryptedKey);

    return new DERSequence(v);
}

/**
 * <pre>
 * RevAnnContent ::= SEQUENCE {
 *       status              PKIStatus,*       certId              CertId,*       willBeRevokedAt     GeneralizedTime,*       badSinceDate        GeneralizedTime,*       crlDetails          Extensions  OPTIONAL
 *        -- extra CRL details (e.g.,crl number,reason,location,etc.)
 * }
 * </pre>
 * @return a basic ASN.1 object representation.
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(status);
    v.add(certId);
    v.add(willBeRevokedAt);
    v.add(badSinceDate);

    if (crlDetails != null)
    {
        v.add(crlDetails);
    }

    return new DERSequence(v);
}

/**
 * <pre>
 * CertResponse ::= SEQUENCE {
 *                            certreqId           INTEGER,*                            -- to match this response with corresponding request (a value
 *                            -- of -1 is to be used if certreqId is not specified in the
 *                            -- corresponding request)
 *                            status              PKIStatusInfo,*                            certifiedKeyPair    CertifiedKeyPair    OPTIONAL,*                            rspInfo             OCTET STRING        OPTIONAL
 *                            -- analogous to the id-regInfo-utf8Pairs string defined
 *                            -- for regInfo in certreqMsg [CRMF]
 *             }
 * </pre> 
 * @return a basic ASN.1 object representation.
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(certreqId);
    v.add(status);

    if (certifiedKeyPair != null)
    {
        v.add(certifiedKeyPair);
    }

    if (rspInfo != null)
    {
        v.add(rspInfo);
    }

    return new DERSequence(v);
}

/**
 * <pre>
 * CertifiedKeyPair ::= SEQUENCE {
 *                                  certOrEncCert       CertOrEncCert,*                                  privateKey      [0] EncryptedValue      OPTIONAL,*                                  -- see [CRMF] for comment on encoding
 *                                  publicationInfo [1] PKIPublicationInfo  OPTIONAL
 *       }
 * </pre>
 * @return a basic ASN.1 object representation.
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(certOrEncCert);

    if (privateKey != null)
    {
        v.add(new DERTaggedobject(true,privateKey));
    }

    if (publicationInfo != null)
    {
        v.add(new DERTaggedobject(true,publicationInfo));
    }

    return new DERSequence(v);
}

/**
 * <pre>
 *     Extensions        ::=   SEQUENCE SIZE (1..MAX) OF Extension
 *
 *     Extension         ::=   SEQUENCE {
 *        extnId            EXTENSION.&amp;id ({ExtensionSet}),*        critical          BOOLEAN DEFAULT FALSE,*        extnValue         OCTET STRING }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector vec = new ASN1encodableVector();
    Enumeration e = ordering.elements();

    while (e.hasMoreElements())
    {
        ASN1ObjectIdentifier oid = (ASN1ObjectIdentifier)e.nextElement();
        Extension ext = (Extension)extensions.get(oid);

        vec.add(ext);
    }

    return new DERSequence(vec);
}

private OutputStream doOpen(
    ASN1ObjectIdentifier dataType,OutputStream         out,OutputEncryptor      encryptor)
    throws IOException,CMSException
{
    ASN1encodableVector recipientInfos = new ASN1encodableVector();
    GenericKey encKey = encryptor.getKey();
    Iterator it = recipientInfoGenerators.iterator();

    while (it.hasNext())
    {
        RecipientInfoGenerator recipient = (RecipientInfoGenerator)it.next();

        recipientInfos.add(recipient.generate(encKey));
    }

    return open(dataType,out,recipientInfos,encryptor);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 *  SignerInfo ::= SEQUENCE {
 *      version Version,*      SignerIdentifier sid,*      digestAlgorithm DigestAlgorithmIdentifier,*      authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL,*      digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,*      encryptedDigest EncryptedDigest,*      unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL
 *  }
 *
 *  EncryptedDigest ::= OCTET STRING
 *
 *  DigestAlgorithmIdentifier ::= AlgorithmIdentifier
 *
 *  DigestEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(version);
    v.add(sid);
    v.add(digalgorithm);

    if (authenticatedAttributes != null)
    {
        v.add(new DERTaggedobject(false,authenticatedAttributes));
    }

    v.add(digEncryptionAlgorithm);
    v.add(encryptedDigest);

    if (unauthenticatedAttributes != null)
    {
        v.add(new DERTaggedobject(false,unauthenticatedAttributes));
    }

    return new DERSequence(v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 *      AlgorithmIdentifier ::= SEQUENCE {
 *                            algorithm OBJECT IDENTIFIER,*                            parameters ANY DEFINED BY algorithm OPTIONAL }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(objectId);

    if (parametersDefined)
    {
        if (parameters != null)
        {
            v.add(parameters);
        }
        else
        {
            v.add(DERNull.INSTANCE);
        }
    }

    return new DERSequence(v);
}

public ASN1encodableVector toASN1encodableVector()
{
    ASN1encodableVector  v = new ASN1encodableVector();
    Enumeration          e = attributes.elements();

    while (e.hasMoreElements())
    {
        Object value = e.nextElement();

        if (value instanceof Vector)
        {
            Enumeration en = ((Vector)value).elements();

            while (en.hasMoreElements())
            {
                v.add(Attribute.getInstance(en.nextElement()));
            }
        }
        else
        {
            v.add(Attribute.getInstance(value));
        }
    }

    return v;
}

/** 
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * RecipientKeyIdentifier ::= SEQUENCE {
 *     subjectKeyIdentifier SubjectKeyIdentifier,*     date GeneralizedTime OPTIONAL,*     other OtherKeyAttribute OPTIONAL 
 * }
 *
 * SubjectKeyIdentifier ::= OCTET STRING
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(subjectKeyIdentifier);

    if (date != null)
    {
        v.add(date);
    }

    if (other != null)
    {
        v.add(other);
    }

    return new DERSequence(v);
}

/**
 * <pre>
 *     Extensions        ::=   SEQUENCE SIZE (1..MAX) OF Extension
 *
 *     Extension         ::=   SEQUENCE {
 *        extnId            EXTENSION.&amp;id ({ExtensionSet}),*        extnValue         OCTET STRING }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector     vec = new ASN1encodableVector();
    Enumeration             e = ordering.elements();

    while (e.hasMoreElements())
    {
        ASN1ObjectIdentifier    oid = (ASN1ObjectIdentifier)e.nextElement();
        X509Extension           ext = (X509Extension)extensions.get(oid);
        ASN1encodableVector     v = new ASN1encodableVector();

        v.add(oid);

        if (ext.isCritical())
        {
            v.add(DERBoolean.TRUE);
        }

        v.add(ext.getValue());

        vec.add(new DERSequence(v));
    }

    return new DERSequence(vec);
}

/**
 * @deprecated use KeyPurposeId[] constructor.
 */
public ExtendedKeyUsage(
    Vector usages)
{
    ASN1encodableVector v = new ASN1encodableVector();
    Enumeration         e = usages.elements();

    while (e.hasMoreElements())
    {
        ASN1Primitive  o = (ASN1Primitive)e.nextElement();

        v.add(o);
        this.usageTable.put(o,o);
    }

    this.seq = new DERSequence(v);
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(algid);
    v.add(new DEROctetString(digest));

    return new DERSequence(v);
}

public byte[] encode(
    BigInteger r,BigInteger s)
    throws IOException
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(new ASN1Integer(r));
    v.add(new ASN1Integer(s));

    return new DERSequence(v).getEncoded(ASN1Encoding.DER);
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(version);
    v.add(digestAlgorithm);
    v.add(encapContentInfo);
    v.add(digest);

    return new BERSequence(v);
}

public DERObject toASN1Object()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    for (int i = 0; i != info.length; i++)
    {
        v.add(info[i]);
    }

    return new BERSequence(v);
}

/**
 * Returns a DER-encodable representation of this instance. 
 *
 * @return a <code>ASN1Primitive</code> value
 */
public ASN1Primitive toASN1Primitive()
{
   ASN1encodableVector dev = new ASN1encodableVector();
   dev.add(commitmentTypeIdentifier);
   if (qualifier != null)
   {
       dev.add(qualifier);
   }

   return new DERSequence(dev);
}

public RevReqContent(RevDetails[] revDetailsArray)
{
    ASN1encodableVector v = new ASN1encodableVector();

    for (int i = 0; i != revDetailsArray.length; i++)
    {
        v.add(revDetailsArray[i]);
    }

    this.content = new DERSequence(v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * OCSPResponse ::= SEQUENCE {
 *     responseStatus         OCSPResponseStatus,*     responseBytes          [0] EXPLICIT ResponseBytes OPTIONAL }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector    v = new ASN1encodableVector();

    v.add(responseStatus);

    if (responseBytes != null)
    {
        v.add(new DERTaggedobject(true,responseBytes));
    }

    return new DERSequence(v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * TBSRequest      ::=     SEQUENCE {
 *     version             [0]     EXPLICIT Version DEFAULT v1,*     requestorName       [1]     EXPLICIT GeneralName OPTIONAL,*     requestList                 SEQUENCE OF Request,*     requestExtensions   [2]     EXPLICIT Extensions OPTIONAL }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector    v = new ASN1encodableVector();

    //
    // if default don't include - unless explicitly provided. Not strictly correct
    // but required for some requests
    //
    if (!version.equals(V1) || versionSet)
    {
        v.add(new DERTaggedobject(true,version));
    }

    if (requestorName != null)
    {
        v.add(new DERTaggedobject(true,requestorName));
    }

    v.add(requestList);

    if (requestExtensions != null)
    {
        v.add(new DERTaggedobject(true,requestExtensions));
    }

    return new DERSequence(v);
}

static ASN1Set createDerSetFromList(List derObjects)
{
    ASN1encodableVector v = new ASN1encodableVector();

    for (Iterator it = derObjects.iterator(); it.hasNext();)
    {
        v.add((ASN1encodable)it.next());
    }

    return new DERSet(v);
}

private void addOptional(ASN1encodableVector v,int tagNo,ASN1encodable obj)
{
    if (obj != null)
    {
        v.add(new DERTaggedobject(true,tagNo,obj));
    }
}

@Override
public ASN1Primitive toASN1Primitive() {
    ASN1encodableVector vector = new ASN1encodableVector();
    vector.add(new Asn1P11SlotIdentifier(slotId));
    vector.add(new DERUTF8String(objectLabel));
    return new DERSequence(vector);
}

private static CertificateList generateCRLStructure(TBSCertList tbsCertList,AlgorithmIdentifier sigAlgid,byte[] signature)
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(tbsCertList);
    v.add(sigAlgid);
    v.add(new DERBitString(signature));

    return CertificateList.getInstance(new DERSequence(v));
}

public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector v = new ASN1encodableVector();
    v.add(requestinformation);
    v.add(data);
    if (transactionIdentifier != null)
    {
        v.add(transactionIdentifier);
    }
    return new DERSequence(v);
}

/**
 * create a request type Iso7816CertificateBody.
 *
 * @return return the "request" type certificate body.
 * @throws IOException if the DERApplicationSpecific cannot be created.
 */
private ASN1Primitive requestToASN1Object()
    throws IOException
{
    ASN1encodableVector v = new ASN1encodableVector();

    v.add(certificateProfileIdentifier);
    v.add(new DERApplicationSpecific(false,EACTags.CARDHOLDER_PUBLIC_KEY_TEMPLATE,publicKey));
    v.add(certificateHolderReference);
    return new DERApplicationSpecific(EACTags.CERTIFICATE_CONTENT_TEMPLATE,v);
}

/**
 * Produce an object suitable for an ASN1OutputStream.
 * <pre>
 * ContentInfo ::= SEQUENCE {
 *          contentType ContentType,*          content
 *          [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }
 * </pre>
 */
public ASN1Primitive toASN1Primitive()
{
    ASN1encodableVector  v = new ASN1encodableVector();

    v.add(contentType);

    if (content != null)
    {
        v.add(new BERTaggedobject(0,content));
    }

    return new BERSequence(v);
}

public ASN1SetParser getUnprotectedAttrs()
    throws IOException
{
    if (_nextObject == null)
    {
        _nextObject = _seq.readobject();
    }


    if (_nextObject != null)
    {
        ASN1encodable o = _nextObject;
        _nextObject = null;
        return (ASN1SetParser)((ASN1TaggedobjectParser)o).getobjectParser(BERTags.SET,false);
    }

    return null;
}

public static AlgorithmIdentifier extractDigesetAlgFromSigalg( AlgorithmIdentifier sigAlgid)
        throws NoSuchAlgorithmException {
    ASN1ObjectIdentifier algOid = sigAlgid.getAlgorithm();

    ASN1ObjectIdentifier digestAlgOid;
    if (PKCSObjectIdentifiers.id_RSASSA_PSS.equals(algOid)) {
        ASN1encodable asn1encodable = sigAlgid.getParameters();
        RSASSAPssparams param = RSASSAPssparams.getInstance(asn1encodable);
        digestAlgOid = param.getHashAlgorithm().getAlgorithm();
    } else {
        HashAlgoType digestAlg = sigalgOidToDigestMap.get(algOid);
        if (digestAlg == null) {
            throw new NoSuchAlgorithmException("unkNown signature algorithm " + algOid.getId());
        }
        digestAlgOid = digestAlg.oid();
    }

    return new AlgorithmIdentifier(digestAlgOid,DERNull.INSTANCE);
}

private boolean matchesDN(X500Principal subject,GeneralNames targets)
{
    GeneralName[] names = targets.getNames();

    for (int i = 0; i != names.length; i++)
    {
        GeneralName gn = names[i];

        if (gn.getTagNo() == GeneralName.directoryName)
        {
            try
            {
                if (new X500Principal(((ASN1encodable)gn.getName()).toASN1Primitive().getEncoded()).equals(subject))
                {
                    return true;
                }
            }
            catch (IOException e)
            {
            }
        }
    }

    return false;
}

private boolean matchesDN(X509Principal subject,GeneralNames targets)
{
    GeneralName[] names = targets.getNames();

    for (int i = 0; i != names.length; i++)
    {
        GeneralName gn = names[i];

        if (gn.getTagNo() == GeneralName.directoryName)
        {
            try
            {
                if (new X509Principal(((ASN1encodable)gn.getName()).toASN1Primitive()
                    .getEncoded()).equals(subject))
                {
                    return true;
                }
            }
            catch (IOException e)
            {
            }
        }
    }

    return false;
}

private Object[] getNames(GeneralName[] names)
{
    List l = new ArrayList(names.length);

    for (int i = 0; i != names.length; i++)
    {
        if (names[i].getTagNo() == GeneralName.directoryName)
        {
            try
            {
                l.add(new X500Principal(
                    ((ASN1encodable)names[i].getName()).toASN1Primitive().getEncoded()));
            }
            catch (IOException e)
            {
                throw new RuntimeException("badly formed Name object");
            }
        }
    }

    return l.toArray(new Object[l.size()]);
}

/**
 * add a given extension field for the standard extensions tag (tag 3)
 * copying the extension value from another certificate.
 * @throws CertificateParsingException if the extension cannot be extracted.
 */
public void copyAndAddExtension(
    String          oid,boolean         critical,X509Certificate cert) 
    throws CertificateParsingException
{
    byte[] extValue = cert.getExtensionValue(oid);

    if (extValue == null)
    {
        throw new CertificateParsingException("extension " + oid + " not present");
    }

    try
    {
        ASN1encodable value = X509ExtensionUtil.fromExtensionValue(extValue);

        this.addExtension(oid,critical,value);
    }
    catch (IOException e)
    {
        throw new CertificateParsingException(e.toString());
    }
}

public static X500PrivateCredential generateServerCertificate(KeyPair caKeyPair) throws NoSuchAlgorithmException,CertificateException,OperatorCreationException,CertIOException {
    X500Name issuerName = new X500Name("CN=bouncrca");
    X500Name subjectName = new X500Name("CN=bouncr");
    BigInteger serial = BigInteger.valueOf(2);
    long t1 = System.currentTimeMillis();
    KeyPairGenerator rsa = KeyPairGenerator.getInstance("RSA");
    rsa.initialize(2048,SecureRandom.getInstance("NativePRNGNonBlocking"));
    KeyPair kp = rsa.generateKeyPair();
    System.out.println(System.currentTimeMillis() - t1);

    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName,serial,NOT_BEFORE,NOT_AFTER,subjectName,kp.getPublic());
    DERSequence subjectAlternativeNames = new DERSequence(new ASN1encodable[] {
            new GeneralName(GeneralName.dNSName,"localhost"),new GeneralName(GeneralName.dNSName,"127.0.0.1")
    });
    builder.addExtension(Extension.subjectAlternativeName,false,subjectAlternativeNames);
    X509Certificate cert = signCertificate(builder,caKeyPair.getPrivate());

    return new X500PrivateCredential(cert,kp.getPrivate());
}

AlgorithmIdentifier getAlgorithmIdentifier(ASN1ObjectIdentifier encryptionOID,AlgorithmParameters params)
    throws CRMFException
{
    ASN1encodable asn1Params;
    if (params != null)
    {
        try
        {
            asn1Params = ASN1Primitive.fromByteArray(params.getEncoded("ASN.1"));
        }
        catch (IOException e)
        {
            throw new CRMFException("cannot encode parameters: " + e.getMessage(),e);
        }
    }
    else
    {
        asn1Params = DERNull.INSTANCE;
    }

    return new AlgorithmIdentifier(
        encryptionOID,asn1Params);
}

/**
 * Add the CRLEntry objects contained in a prevIoUs CRL.
 * 
 * @param other the X509CRLHolder to source the other entries from.
 * @return the current builder.
 */
public X509v2CRLBuilder addCRL(X509CRLHolder other)
{
    TBSCertList revocations = other.toASN1Structure().getTBSCertList();

    if (revocations != null)
    {
        for (Enumeration en = revocations.getRevokedCertificateEnumeration(); en.hasMoreElements();)
        {
            tbsGen.addCRLEntry(ASN1Sequence.getInstance(((ASN1encodable)en.nextElement()).toASN1Primitive()));
        }
    }

    return this;
}

private EncKeyWithID(ASN1Sequence seq)
{
    this.privKeyInfo = PrivateKeyInfo.getInstance(seq.getobjectAt(0));

    if (seq.size() > 1)
    {
        if (!(seq.getobjectAt(1) instanceof DERUTF8String))
        {
            this.identifier = GeneralName.getInstance(seq.getobjectAt(1));
        }
        else
        {
            this.identifier = (ASN1encodable)seq.getobjectAt(1);
        }
    }
    else
    {
        this.identifier = null;
    }
}

/**
 * Add a given extension field for the standard extensions tag (tag 3)
 *
 * @param oid the OID defining the extension type.
 * @param isCritical true if the extension is critical,false otherwise.
 * @param value the ASN.1 structure that forms the extension's value.
 * @return this builder object.
 */
public X509v3CertificateBuilder addExtension(
    ASN1ObjectIdentifier oid,boolean isCritical,ASN1encodable value)
    throws CertIOException
{
    CertUtils.addExtension(extGenerator,oid,isCritical,value);

    return this;
}

/**
 * Extract extensions from CSR object
 */
public static Extensions getExtensionsFromCSR(JcaPKCS10CertificationRequest csr) {
    Attribute[] attributess = csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest);
    for (Attribute attribute : attributess) {
        ASN1Set attValue = attribute.getAttrValues();
        if (attValue != null) {
            ASN1encodable extension = attValue.getobjectAt(0);
            if (extension instanceof Extensions) {
                return (Extensions) extension;
            } else if (extension instanceof DERSequence) {
                return Extensions.getInstance(extension);
            }
        }
    }
    return null;
}

private void checkSignature(
    PublicKey key,Signature signature) 
    throws CertificateException,NoSuchAlgorithmException,SignatureException,InvalidKeyException
{
    if (!isAlgidEqual(c.getSignatureAlgorithm(),c.getTBSCertificate().getSignature()))
    {
        throw new CertificateException("signature algorithm in TBS cert not same as outer cert");
    }

    ASN1encodable params = c.getSignatureAlgorithm().getParameters();

    // Todo This should go after the initVerify?
    X509SignatureUtil.setSignatureParameters(signature,params);

    signature.initVerify(key);

    signature.update(this.getTBSCertificate());

    if (!signature.verify(this.getSignature()))
    {
        throw new SignatureException("certificate does not verify with supplied key");
    }
}

Store getCertificates(ASN1Set certSet)
{
    if (certSet != null)
    {
        List certList = new ArrayList(certSet.size());

        for (Enumeration en = certSet.getobjects(); en.hasMoreElements();)
        {
            ASN1Primitive obj = ((ASN1encodable)en.nextElement()).toASN1Primitive();

            if (obj instanceof ASN1Sequence)
            {
                certList.add(new X509CertificateHolder(Certificate.getInstance(obj)));
            }
        }

        return new CollectionStore(certList);
    }

    return new CollectionStore(new ArrayList());
}

public ASN1SetParser getAuthAttrs()
    throws IOException
{
    if (nextObject == null)
    {
        nextObject = seq.readobject();
    }

    if (nextObject instanceof ASN1TaggedobjectParser)
    {
        ASN1encodable o = nextObject;
        nextObject = null;
        return (ASN1SetParser)((ASN1TaggedobjectParser)o).getobjectParser(BERTags.SET,false);
    }

    // Todo
    // "The authAttrs MUST be present if the content type carried in
    // EncryptedContentInfo is not id-data."

    return null;
}

private ASN1Primitive getobjectInTag(int tagNo)
{
    Enumeration e = seq.getobjects();

    while (e.hasMoreElements())
    {
        ASN1encodable obj = (ASN1encodable)e.nextElement();

        if (obj instanceof ASN1Taggedobject)
        {
            ASN1Taggedobject tag = (ASN1Taggedobject)obj;
            if (tag.getTagNo() == tagNo)
            {
                return (ASN1Primitive)((ASN1encodable)tag.getobject()).toASN1Primitive();
            }
        }
    }
    return null;
}

/**
 * Return the certificates stored in the underlying OriginatorInfo object.
 *
 * @return a Store of X509CertificateHolder objects.
 */
public Store getCertificates()
{
    ASN1Set certSet = originatorInfo.getCertificates();

    if (certSet != null)
    {
        List certList = new ArrayList(certSet.size());

        for (Enumeration en = certSet.getobjects(); en.hasMoreElements();)
        {
            ASN1Primitive obj = ((ASN1encodable)en.nextElement()).toASN1Primitive();

            if (obj instanceof ASN1Sequence)
            {
                certList.add(new X509CertificateHolder(Certificate.getInstance(obj)));
            }
        }

        return new CollectionStore(certList);
    }

    return new CollectionStore(new ArrayList());
}

/**
 * Dump out the object as a string.
 *
 * @param obj  the object to be dumped
 * @param verbose  if true,dump out the contents of octet and bit strings.
 * @return  the resulting string.
 */
public static String dumpAsstring(
    Object   obj,boolean  verbose)
{
    StringBuffer buf = new StringBuffer();

    if (obj instanceof ASN1Primitive)
    {
        _dumpAsstring("",verbose,(ASN1Primitive)obj,buf);
    }
    else if (obj instanceof ASN1encodable)
    {
        _dumpAsstring("",((ASN1encodable)obj).toASN1Primitive(),buf);
    }
    else
    {
        return "unkNown object type " + obj.toString();
    }

    return buf.toString();
}

Store getCRLs(ASN1Set crlSet)
{
    if (crlSet != null)
    {
        List crlList = new ArrayList(crlSet.size());

        for (Enumeration en = crlSet.getobjects(); en.hasMoreElements();)
        {
            ASN1Primitive obj = ((ASN1encodable)en.nextElement()).toASN1Primitive();

            if (obj instanceof ASN1Sequence)
            {
                crlList.add(new X509CRLHolder(CertificateList.getInstance(obj)));
            }
        }

        return new CollectionStore(crlList);
    }

    return new CollectionStore(new ArrayList());
}

/**
 * Gets the role authority as a <code>String[]</code> object.
 * @return the role authority of this RoleSyntax represented as a
 * <code>String[]</code> array.
 */
public String[] getRoleAuthorityAsstring() 
{
    if(roleAuthority == null) 
    {
        return new String[0];
    }

    GeneralName[] names = roleAuthority.getNames();
    String[] namesstring = new String[names.length];
    for(int i = 0; i < names.length; i++) 
    {
        ASN1encodable value = names[i].getName();
        if(value instanceof ASN1String)
        {
            namesstring[i] = ((ASN1String)value).getString();
        }
        else
        {
            namesstring[i] = value.toString();
        }
    }
    return namesstring;
}

public ASN1SetParser getUnauthAttrs()
    throws IOException
{
    if (nextObject == null)
    {
        nextObject = seq.readobject();
    }

    if (nextObject != null)
    {
        ASN1encodable o = nextObject;
        nextObject = null;
        return (ASN1SetParser)((ASN1TaggedobjectParser)o).getobjectParser(BERTags.SET,false);
    }

    return null;
}

/**
 * Add a given extension field.
 *
 * @param oid the OID defining the extension type.
 * @param isCritical true if the extension is critical,false otherwise.
 * @param value the ASN.1 structure that forms the extension's value.
 * @return this builder object.
 * @throws DVCSException if there is an issue encoding the extension for adding.
 */
public void addExtension(
    ASN1ObjectIdentifier oid,ASN1encodable value)
    throws DVCSException
{
    try
    {
        extGenerator.addExtension(oid,value);
    }
    catch (IOException e)
    {
        throw new DVCSException("cannot encode extension: " + e.getMessage(),e);
    }
}

private Asn1NewKeyControl(ASN1Sequence seq) throws BadAsn1ObjectException {
    control = new P11NewKeyControl();
    final int size = seq.size();
    for (int i = 0; i < size; i++) {
        ASN1encodable obj = seq.getobjectAt(i);
        if (obj instanceof ASN1Taggedobject) {
            continue;
        }

        ASN1Taggedobject tagObj = (ASN1Taggedobject) obj;
        int tagNo = tagObj.getTagNo();
        if (tagNo == 0) {
            boolean bv = ((ASN1Boolean) tagObj.getobject()).isTrue();
            control.setExtractable(bv);
        }
    }
}

private ExtendedKeyUsage(
    ASN1Sequence  seq)
{
    this.seq = seq;

    Enumeration e = seq.getobjects();

    while (e.hasMoreElements())
    {
        ASN1encodable o = (ASN1encodable)e.nextElement();
        if (!(o.toASN1Primitive() instanceof ASN1ObjectIdentifier))
        {
            throw new IllegalArgumentException("Only ASN1ObjectIdentifiers allowed in ExtendedKeyUsage.");
        }
        this.usageTable.put(o,o);
    }
}

public static byte[] getoctetStringBytes(ASN1encodable object) throws BadAsn1ObjectException {
    try {
        return DEROctetString.getInstance(object).getoctets();
    } catch (IllegalArgumentException ex) {
        throw new BadAsn1ObjectException("invalid object OctetString: " + ex.getMessage(),ex);
    }
}

public X509Attribute[] getAttributes()
{
    ASN1Sequence    seq = cert.getAcinfo().getAttributes();
    X509Attribute[] attrs = new X509Attribute[seq.size()];

    for (int i = 0; i != seq.size(); i++)
    {
        attrs[i] = new X509Attribute((ASN1encodable)seq.getobjectAt(i));
    }

    return attrs;
}

public ASN1encodable getId()
{
    if (id instanceof ASN1Taggedobject)
    {
        return ASN1OctetString.getInstance((ASN1Taggedobject)id,false);
    }

    return IssuerAndSerialNumber.getInstance(id);
}

/**
 * add a given extension field for the standard extensions tag (tag 3)
 */
public void addExtension(
    String          oid,ASN1encodable    value)
{
    this.addExtension(new DERObjectIdentifier(oid),value);
}

private void addOptional(ASN1encodableVector v,int tagNo,ASN1encodable obj)
{
    if (obj != null)
    {
        v.add(new DERTaggedobject(true,tagNo,obj));
    }
}

static void addExtension(ExtensionsGenerator extGenerator,ASN1ObjectIdentifier oid,ASN1encodable value)
    throws CertIOException
{
    try
    {
        extGenerator.addExtension(oid,value);
    }
    catch (IOException e)
    {
        throw new CertIOException("cannot encode extension: " + e.getMessage(),e);
    }
}

public static BigInteger getInteger(ASN1encodable object) throws BadAsn1ObjectException {
    try {
        return ASN1Integer.getInstance(object).getValue();
    } catch (IllegalArgumentException ex) {
        throw new BadAsn1ObjectException("invalid object ASN1Integer: " + ex.getMessage(),ex);
    }
}

static void derEncodetoStream(ASN1encodable obj,OutputStream stream)
{
    DEROutputStream dOut = new DEROutputStream(stream);

    try
    {
        dOut.writeObject(obj);

        dOut.close();
    }
    catch (IOException e)
    {
        throw new CRMFRuntimeException("unable to DER encode object: " + e.getMessage(),e);
    }
}

public OtherKeyAttribute(
    ASN1ObjectIdentifier keyAttrId,ASN1encodable        keyAttr)
{
    this.keyAttrId = keyAttrId;
    this.keyAttr = keyAttr;
}

public ContentInfo(
    ASN1ObjectIdentifier contentType,ASN1encodable        content)
{
    this.contentType = contentType;
    this.content = content;
}

/**
 * Add a given extension field for the standard extensions tag
 *
 * @param oid the OID defining the extension type.
 * @param isCritical true if the extension is critical,false otherwise.
 * @param value the ASN.1 structure that forms the extension's value.
 * @return this builder object.
 */
public X509v2AttributeCertificateBuilder addExtension(
    ASN1ObjectIdentifier oid,value);

    return this;
}

private void addOptional(ASN1encodableVector v,ASN1encodable obj)
{
    if (obj != null)
    {
        v.add(obj);
    }
}

public static byte[] getEncodedPrivateKeyInfo(AlgorithmIdentifier algid,ASN1encodable privKey)
{
     try
     {
         PrivateKeyInfo info = new PrivateKeyInfo(algid,privKey.toASN1Primitive());

         return getEncodedPrivateKeyInfo(info);
     }
     catch (Exception e)
     {
         return null;
     }
}

private byte[] toDEREncoded(ASN1encodable obj)
    throws CertificateEncodingException
{
    try
    {
        return obj.toASN1Primitive().getEncoded(ASN1Encoding.DER);
    }
    catch (IOException e)
    {
        throw new CertificateEncodingException("Exception thrown: " + e);
    }
}

private void addOptional(ASN1encodableVector v,ASN1encodable obj)
{
    if (obj != null)
    {
        v.add(new DERTaggedobject(false,obj));
    }
}

public OtherRecipientInfo(
    ASN1ObjectIdentifier     oriType,ASN1encodable            oriValue)
{
    this.oriType = oriType;
    this.oriValue = oriValue;
}