xref: /aoo4110/main/libxmlsec/xmlsec1-nssmangleciphers.patch (revision b1cdbd2c)

--- misc/xmlsec1-1.2.14/src/nss/ciphers.c	2009-09-10 05:16:27.000000000 -0400
+++ misc/build/xmlsec1-1.2.14/src/nss/ciphers.c	2009-09-10 06:59:39.000000000 -0400
@@ -11,180 +11,421 @@

 #include <string.h>

-#include <nspr.h>
 #include <nss.h>
-#include <secoid.h>
 #include <pk11func.h>

 #include <xmlsec/xmlsec.h>
+#include <xmlsec/xmltree.h>
+#include <xmlsec/base64.h>
 #include <xmlsec/keys.h>
 #include <xmlsec/transforms.h>
 #include <xmlsec/errors.h>

 #include <xmlsec/nss/crypto.h>
-
-#define XMLSEC_NSS_MAX_KEY_SIZE		32
-#define XMLSEC_NSS_MAX_IV_SIZE		32
-#define XMLSEC_NSS_MAX_BLOCK_SIZE	32
+#include <xmlsec/nss/ciphers.h>

 /**************************************************************************
  *
- * Internal Nss Block cipher CTX
+ * Internal Nss Block Cipher Context
+ * This context is designed for repositing a block cipher for transform
  *
  *****************************************************************************/
-typedef struct _xmlSecNssBlockCipherCtx		xmlSecNssBlockCipherCtx,
-							*xmlSecNssBlockCipherCtxPtr;
+typedef struct _xmlSecNssBlockCipherCtx                xmlSecNssBlockCipherCtx ;
+typedef struct _xmlSecNssBlockCipherCtx*       xmlSecNssBlockCipherCtxPtr ;
+
 struct _xmlSecNssBlockCipherCtx {
     CK_MECHANISM_TYPE	cipher;
+    PK11SymKey*         symkey ;
     PK11Context*	cipherCtx;
     xmlSecKeyDataId	keyId;
-    int			keyInitialized;
-    int			ctxInitialized;
-    xmlSecByte		key[XMLSEC_NSS_MAX_KEY_SIZE];
-    xmlSecSize		keySize;
-    xmlSecByte		iv[XMLSEC_NSS_MAX_IV_SIZE];
-    xmlSecSize		ivSize;
 };
-static int 	xmlSecNssBlockCipherCtxInit		(xmlSecNssBlockCipherCtxPtr ctx,
-							 xmlSecBufferPtr in,
-							 xmlSecBufferPtr out,
-							 int encrypt,
-							 const xmlChar* cipherName,
-							 xmlSecTransformCtxPtr transformCtx);
-static int 	xmlSecNssBlockCipherCtxUpdate	(xmlSecNssBlockCipherCtxPtr ctx,
-							 xmlSecBufferPtr in,
-							 xmlSecBufferPtr out,
-							 int encrypt,
-							 const xmlChar* cipherName,
-							 xmlSecTransformCtxPtr transformCtx);
-static int 	xmlSecNssBlockCipherCtxFinal		(xmlSecNssBlockCipherCtxPtr ctx,
-							 xmlSecBufferPtr in,
-							 xmlSecBufferPtr out,
-							 int encrypt,
-							 const xmlChar* cipherName,
-							 xmlSecTransformCtxPtr transformCtx);
+
+#define xmlSecNssBlockCipherSize       \
+       ( sizeof( xmlSecTransform ) + sizeof( xmlSecNssBlockCipherCtx ) )
+
+#define xmlSecNssBlockCipherGetCtx( transform ) \
+       ( ( xmlSecNssBlockCipherCtxPtr )( ( ( xmlSecByte* )( transform ) ) + sizeof( xmlSecTransform ) ) )
+
+static int
+xmlSecNssBlockCipherCheckId(
+       xmlSecTransformPtr transform
+) {
+       #ifndef XMLSEC_NO_DES
+       if( xmlSecTransformCheckId( transform, xmlSecNssTransformDes3CbcId ) ) {
+               return 1 ;
+       }
+       #endif /* XMLSEC_NO_DES */
+
+       #ifndef XMLSEC_NO_AES
+       if( xmlSecTransformCheckId( transform, xmlSecNssTransformAes128CbcId ) ||
+               xmlSecTransformCheckId( transform, xmlSecNssTransformAes192CbcId ) ||
+               xmlSecTransformCheckId( transform, xmlSecNssTransformAes256CbcId ) ) {
+
+               return 1 ;
+    }
+       #endif /* XMLSEC_NO_AES */
+
+    return 0 ;
+}
+
+static int
+xmlSecNssBlockCipherFetchCtx(
+       xmlSecNssBlockCipherCtxPtr              context ,
+       xmlSecTransformId                               id
+) {
+       xmlSecAssert2( context != NULL, -1 ) ;
+
+       #ifndef XMLSEC_NO_DES
+       if( id == xmlSecNssTransformDes3CbcId ) {
+               context->cipher = CKM_DES3_CBC ;
+               context->keyId = xmlSecNssKeyDataDesId ;
+       } else
+       #endif          /* XMLSEC_NO_DES */
+
+       #ifndef XMLSEC_NO_AES
+       if( id == xmlSecNssTransformAes128CbcId ) {
+               context->cipher = CKM_AES_CBC ;
+               context->keyId = xmlSecNssKeyDataAesId ;
+       } else
+       if( id == xmlSecNssTransformAes192CbcId ) {
+               context->cipher = CKM_AES_CBC ;
+               context->keyId = xmlSecNssKeyDataAesId ;
+       } else
+       if( id == xmlSecNssTransformAes256CbcId ) {
+               context->cipher = CKM_AES_CBC ;
+               context->keyId = xmlSecNssKeyDataAesId ;
+       } else
+       #endif          /* XMLSEC_NO_AES */
+
+       if( 1 ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   NULL ,
+                   NULL ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       return 0 ;
+}
+
+/**
+ * xmlSecTransformInitializeMethod:
+ * @transform:                 the pointer to transform object.
+ *
+ * The transform specific initialization method.
+ *
+ * Returns 0 on success or a negative value otherwise.
+ */
+static int
+xmlSecNssBlockCipherInitialize(
+       xmlSecTransformPtr transform
+) {
+       xmlSecNssBlockCipherCtxPtr context = NULL ;
+
+       xmlSecAssert2( xmlSecNssBlockCipherCheckId( transform ), -1 ) ;
+       xmlSecAssert2( xmlSecTransformCheckSize( transform, xmlSecNssBlockCipherSize ), -1 ) ;
+
+       context = xmlSecNssBlockCipherGetCtx( transform ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                   "xmlSecNssBlockCipherGetCtx" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( xmlSecNssBlockCipherFetchCtx( context , transform->id ) < 0 ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                   "xmlSecNssBlockCipherFetchCtx" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       context->symkey = NULL ;
+       context->cipherCtx = NULL ;
+
+       return 0 ;
+}
+
+/**
+ * xmlSecTransformFinalizeMethod:
+ * @transform:                 the pointer to transform object.
+ *
+ * The transform specific destroy method.
+ */
+static void
+xmlSecNssBlockCipherFinalize(
+       xmlSecTransformPtr transform
+) {
+       xmlSecNssBlockCipherCtxPtr context = NULL ;
+
+       xmlSecAssert( xmlSecNssBlockCipherCheckId( transform ) ) ;
+       xmlSecAssert( xmlSecTransformCheckSize( transform, xmlSecNssBlockCipherSize ) ) ;
+
+       context = xmlSecNssBlockCipherGetCtx( transform ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                   "xmlSecNssBlockCipherGetCtx" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return ;
+       }
+
+       if( context->cipherCtx != NULL ) {
+               PK11_DestroyContext( context->cipherCtx, PR_TRUE ) ;
+               context->cipherCtx = NULL ;
+       }
+
+       if( context->symkey != NULL ) {
+               PK11_FreeSymKey( context->symkey ) ;
+               context->symkey = NULL ;
+       }
+
+       context->cipher = CKM_INVALID_MECHANISM ;
+       context->keyId = NULL ;
+}
+
+/**
+ * xmlSecTransformSetKeyRequirementsMethod:
+ * @transform:                 the pointer to transform object.
+ * @keyReq:                            the pointer to key requirements structure.
+ *
+ * Transform specific method to set transform's key requirements.
+ *
+ * Returns 0 on success or a negative value otherwise.
+ */
+static int
+xmlSecNssBlockCipherSetKeyReq(
+       xmlSecTransformPtr transform ,
+       xmlSecKeyReqPtr keyReq
+) {
+       xmlSecNssBlockCipherCtxPtr context = NULL ;
+       xmlSecSize cipherSize = 0 ;
+
+       xmlSecAssert2( xmlSecNssBlockCipherCheckId( transform ), -1 ) ;
+       xmlSecAssert2( xmlSecTransformCheckSize( transform, xmlSecNssBlockCipherSize ), -1 ) ;
+       xmlSecAssert2( keyReq != NULL , -1 ) ;
+       xmlSecAssert2( ( transform->operation == xmlSecTransformOperationEncrypt ) || ( transform->operation == xmlSecTransformOperationDecrypt ), -1 ) ;
+
+       context = xmlSecNssBlockCipherGetCtx( transform ) ;
+       if( context == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                   "xmlSecNssBlockCipherGetCtx" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       keyReq->keyId = context->keyId ;
+       keyReq->keyType = xmlSecKeyDataTypeSymmetric ;
+
+       if( transform->operation == xmlSecTransformOperationEncrypt ) {
+               keyReq->keyUsage = xmlSecKeyUsageEncrypt ;
+       } else {
+               keyReq->keyUsage = xmlSecKeyUsageDecrypt ;
+       }
+
+       /*
+       if( context->symkey != NULL )
+               cipherSize = PK11_GetKeyLength( context->symkey ) ;
+
+       keyReq->keyBitsSize = cipherSize * 8 ;
+       */
+
+       return 0 ;
+}
+
+/**
+ * xmlSecTransformSetKeyMethod:
+ * @transform:                 the pointer to transform object.
+ * @key:                               the pointer to key.
+ *
+ * The transform specific method to set the key for use.
+ *
+ * Returns 0 on success or a negative value otherwise.
+ */
+static int
+xmlSecNssBlockCipherSetKey(
+       xmlSecTransformPtr transform ,
+       xmlSecKeyPtr key
+) {
+       xmlSecNssBlockCipherCtxPtr context = NULL ;
+       xmlSecKeyDataPtr        keyData = NULL ;
+       PK11SymKey*                     symkey = NULL ;
+       CK_ATTRIBUTE_TYPE       operation ;
+       int                                     ivLen ;
+
+       xmlSecAssert2( xmlSecNssBlockCipherCheckId( transform ), -1 ) ;
+       xmlSecAssert2( xmlSecTransformCheckSize( transform, xmlSecNssBlockCipherSize ), -1 ) ;
+       xmlSecAssert2( key != NULL , -1 ) ;
+    xmlSecAssert2( ( transform->operation == xmlSecTransformOperationEncrypt ) || ( transform->operation == xmlSecTransformOperationDecrypt ), -1 ) ;
+
+       context = xmlSecNssBlockCipherGetCtx( transform ) ;
+       if( context == NULL || context->keyId == NULL || context->symkey != NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                   "xmlSecNssBlockCipherGetCtx" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+       xmlSecAssert2( xmlSecKeyCheckId( key, context->keyId ), -1 ) ;
+
+       keyData = xmlSecKeyGetValue( key ) ;
+       if( keyData == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecKeyGetName( key ) ) ,
+                   "xmlSecKeyGetValue" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       if( ( symkey = xmlSecNssSymKeyDataGetKey( keyData ) ) == NULL ) {
+               xmlSecError( XMLSEC_ERRORS_HERE ,
+                   xmlSecErrorsSafeString( xmlSecKeyDataGetName( keyData ) ) ,
+                   "xmlSecNssSymKeyDataGetKey" ,
+                   XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                   XMLSEC_ERRORS_NO_MESSAGE ) ;
+               return -1 ;
+       }
+
+       context->symkey = symkey ;
+
+       return 0 ;
+}
+
 static int
 xmlSecNssBlockCipherCtxInit(xmlSecNssBlockCipherCtxPtr ctx,
 				xmlSecBufferPtr in, xmlSecBufferPtr out,
 				int encrypt,
 				const xmlChar* cipherName,
 				xmlSecTransformCtxPtr transformCtx) {
-    SECItem keyItem;
     SECItem ivItem;
-    PK11SlotInfo* slot;
-    PK11SymKey* symKey;
+    SECItem* secParam = NULL ;
+    xmlSecBufferPtr ivBuf = NULL ;
     int ivLen;
-    SECStatus rv;
-    int ret;

     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(ctx->cipher != 0, -1);
+    xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+    xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
     xmlSecAssert2(ctx->cipherCtx == NULL, -1);
-    xmlSecAssert2(ctx->keyInitialized != 0, -1);
-    xmlSecAssert2(ctx->ctxInitialized == 0, -1);
+    xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
     xmlSecAssert2(in != NULL, -1);
     xmlSecAssert2(out != NULL, -1);
     xmlSecAssert2(transformCtx != NULL, -1);

     ivLen = PK11_GetIVLength(ctx->cipher);
-    xmlSecAssert2(ivLen > 0, -1);
-    xmlSecAssert2((xmlSecSize)ivLen <= sizeof(ctx->iv), -1);
+    if( ivLen < 0 ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    NULL ,
+                    "PK11_GetIVLength" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return -1 ;
+    }
+
+    if( ( ivBuf = xmlSecBufferCreate( ivLen ) ) == NULL ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    NULL ,
+                    "xmlSecBufferCreate" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return -1 ;
+    }

     if(encrypt) {
-        /* generate random iv */
-        rv = PK11_GenerateRandom(ctx->iv, ivLen);
-	if(rv != SECSuccess) {
+	if( PK11_GenerateRandom( ivBuf->data , ivLen ) != SECSuccess ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
 			"PK11_GenerateRandom",
 			XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			"size=%d", ivLen);
+			XMLSEC_ERRORS_NO_MESSAGE);
+	    xmlSecBufferDestroy( ivBuf ) ;
 	    return(-1);
 	}
+        if( xmlSecBufferSetSize( ivBuf , ivLen ) < 0 ) {
+                xmlSecError( XMLSEC_ERRORS_HERE ,
+                        NULL ,
+                        "xmlSecBufferSetSize" ,
+                        XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                        XMLSEC_ERRORS_NO_MESSAGE ) ;
+                xmlSecBufferDestroy( ivBuf ) ;
+                return -1 ;
+        }

-	/* write iv to the output */
-	ret = xmlSecBufferAppend(out, ctx->iv, ivLen);
-	if(ret < 0) {
+	if( xmlSecBufferAppend( out , ivBuf->data , ivLen ) < 0 ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
 			"xmlSecBufferAppend",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"size=%d", ivLen);
+			XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			XMLSEC_ERRORS_NO_MESSAGE);
+	    xmlSecBufferDestroy( ivBuf ) ;
 	    return(-1);
 	}

     } else {
-	/* if we don't have enough data, exit and hope that
-	 * we'll have iv next time */
-	if(xmlSecBufferGetSize(in) < (xmlSecSize)ivLen) {
-	    return(0);
-	}
-
-	/* copy iv to our buffer*/
-	xmlSecAssert2(xmlSecBufferGetData(in) != NULL, -1);
-	memcpy(ctx->iv, xmlSecBufferGetData(in), ivLen);
-
-	/* and remove from input */
-	ret = xmlSecBufferRemoveHead(in, ivLen);
-	if(ret < 0) {
+	if( xmlSecBufferSetData( ivBuf , in->data , ivLen ) < 0 ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
-			"xmlSecBufferRemoveHead",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"size=%d", ivLen);
+			"xmlSecBufferSetData",
+			XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			XMLSEC_ERRORS_NO_MESSAGE);
+	    xmlSecBufferDestroy( ivBuf ) ;
 	    return(-1);
 	}
     }

-    memset(&keyItem, 0, sizeof(keyItem));
-    keyItem.data = ctx->key;
-    keyItem.len  = ctx->keySize;
-    memset(&ivItem, 0, sizeof(ivItem));
-    ivItem.data = ctx->iv;
-    ivItem.len  = ctx->ivSize;
-
-    slot = PK11_GetBestSlot(ctx->cipher, NULL);
-    if(slot == NULL) {
+    if( xmlSecBufferRemoveHead( in , ivLen ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
-		    "PK11_GetBestSlot",
+		    "xmlSecBufferRemoveHead",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
 		    XMLSEC_ERRORS_NO_MESSAGE);
+	xmlSecBufferDestroy( ivBuf ) ;
 	return(-1);
     }

-    symKey = PK11_ImportSymKey(slot, ctx->cipher, PK11_OriginDerive,
-			       CKA_SIGN, &keyItem, NULL);
-    if(symKey == NULL) {
+    ivItem.data = xmlSecBufferGetData( ivBuf ) ;
+    ivItem.len = xmlSecBufferGetSize( ivBuf ) ;
+    if( ( secParam = PK11_ParamFromIV( ctx->cipher , &ivItem ) ) == NULL ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
-		    "PK11_ImportSymKey",
+		    "PK11_ParamFromIV",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
 		    XMLSEC_ERRORS_NO_MESSAGE);
-        PK11_FreeSlot(slot);
+        xmlSecBufferDestroy( ivBuf ) ;
 	return(-1);
     }

     ctx->cipherCtx = PK11_CreateContextBySymKey(ctx->cipher,
 			(encrypt) ? CKA_ENCRYPT : CKA_DECRYPT,
-			symKey, &ivItem);
+			ctx->symkey, secParam);
     if(ctx->cipherCtx == NULL) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
-		    "PK11_CreateContextBySymKey",
+		    "xmlSecBufferRemoveHead",
 		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
 		    XMLSEC_ERRORS_NO_MESSAGE);
-	PK11_FreeSymKey(symKey);
-        PK11_FreeSlot(slot);
+	SECITEM_FreeItem( secParam , PR_TRUE ) ;
+        xmlSecBufferDestroy( ivBuf ) ;
 	return(-1);
     }

-    ctx->ctxInitialized = 1;
-    PK11_FreeSymKey(symKey);
-    PK11_FreeSlot(slot);
+    SECITEM_FreeItem( secParam , PR_TRUE ) ;
+    xmlSecBufferDestroy( ivBuf ) ;
     return(0);
 }

+/**
+ * Block cipher transform update
+ */
 static int
 xmlSecNssBlockCipherCtxUpdate(xmlSecNssBlockCipherCtxPtr ctx,
 				  xmlSecBufferPtr in, xmlSecBufferPtr out,
@@ -192,54 +433,49 @@
 				  const xmlChar* cipherName,
 				  xmlSecTransformCtxPtr transformCtx) {
     xmlSecSize inSize, inBlocks, outSize;
-    int blockLen;
+    int blockSize;
     int outLen = 0;
     xmlSecByte* outBuf;
-    SECStatus rv;
-    int ret;

     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(ctx->cipher != 0, -1);
+    xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+    xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
     xmlSecAssert2(ctx->cipherCtx != NULL, -1);
-    xmlSecAssert2(ctx->ctxInitialized != 0, -1);
+    xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
     xmlSecAssert2(in != NULL, -1);
     xmlSecAssert2(out != NULL, -1);
     xmlSecAssert2(transformCtx != NULL, -1);

-    blockLen = PK11_GetBlockSize(ctx->cipher, NULL);
-    xmlSecAssert2(blockLen > 0, -1);
+    if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString( cipherName ) ,
+            "PK11_GetBlockSize" ,
+            XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+        return -1 ;
+    }

     inSize = xmlSecBufferGetSize(in);
     outSize = xmlSecBufferGetSize(out);
-
-    if(inSize < (xmlSecSize)blockLen) {
-	return(0);
+
+    inBlocks = ( encrypt != 0 ? inSize : ( inSize - 1 ) ) / blockSize ;
+    inSize = inBlocks * blockSize ;
+
+    if( inSize < blockSize ) {
+        return 0 ;
     }

-    if(encrypt) {
-        inBlocks = inSize / ((xmlSecSize)blockLen);
-    } else {
-	/* we want to have the last block in the input buffer
-	 * for padding check */
-        inBlocks = (inSize - 1) / ((xmlSecSize)blockLen);
-    }
-    inSize = inBlocks * ((xmlSecSize)blockLen);
-
-    /* we write out the input size plus may be one block */
-    ret = xmlSecBufferSetMaxSize(out, outSize + inSize + blockLen);
-    if(ret < 0) {
+    if( xmlSecBufferSetMaxSize( out , outSize + inSize + blockSize ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "xmlSecBufferSetMaxSize",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", outSize + inSize + blockLen);
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }
     outBuf = xmlSecBufferGetData(out) + outSize;

-    rv = PK11_CipherOp(ctx->cipherCtx, outBuf, &outLen, inSize + blockLen,
-			xmlSecBufferGetData(in), inSize);
-    if(rv != SECSuccess) {
+    if(PK11_CipherOp( ctx->cipherCtx , outBuf , &outLen , inSize + blockSize , xmlSecBufferGetData( in ) , inSize ) != SECSuccess ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "PK11_CipherOp",
@@ -247,27 +483,22 @@
 		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }
-    xmlSecAssert2((xmlSecSize)outLen == inSize, -1);

-    /* set correct output buffer size */
-    ret = xmlSecBufferSetSize(out, outSize + outLen);
-    if(ret < 0) {
+    if( xmlSecBufferSetSize( out , outSize + outLen ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "xmlSecBufferSetSize",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", outSize + outLen);
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }

-    /* remove the processed block from input */
-    ret = xmlSecBufferRemoveHead(in, inSize);
-    if(ret < 0) {
+    if( xmlSecBufferRemoveHead( in , inSize ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "xmlSecBufferRemoveHead",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", inSize);
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }
     return(0);
@@ -281,81 +512,82 @@
 				 const xmlChar* cipherName,
 				 xmlSecTransformCtxPtr transformCtx) {
     xmlSecSize inSize, outSize;
-    int blockLen, outLen = 0;
+    int blockSize, outLen = 0;
     xmlSecByte* inBuf;
     xmlSecByte* outBuf;
-    SECStatus rv;
-    int ret;

     xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(ctx->cipher != 0, -1);
+    xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ;
+    xmlSecAssert2( ctx->symkey != NULL , -1 ) ;
     xmlSecAssert2(ctx->cipherCtx != NULL, -1);
-    xmlSecAssert2(ctx->ctxInitialized != 0, -1);
+    xmlSecAssert2( ctx->keyId != NULL , -1 ) ;
     xmlSecAssert2(in != NULL, -1);
     xmlSecAssert2(out != NULL, -1);
     xmlSecAssert2(transformCtx != NULL, -1);

-    blockLen = PK11_GetBlockSize(ctx->cipher, NULL);
-    xmlSecAssert2(blockLen > 0, -1);
+    if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) {
+        xmlSecError( XMLSEC_ERRORS_HERE ,
+            xmlSecErrorsSafeString( cipherName ) ,
+            "PK11_GetBlockSize" ,
+            XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+            XMLSEC_ERRORS_NO_MESSAGE ) ;
+        return -1 ;
+    }

     inSize = xmlSecBufferGetSize(in);
     outSize = xmlSecBufferGetSize(out);

+    /******************************************************************/
     if(encrypt != 0) {
-        xmlSecAssert2(inSize < (xmlSecSize)blockLen, -1);
+        xmlSecAssert2( inSize < blockSize, -1 ) ;

 	/* create padding */
-        ret = xmlSecBufferSetMaxSize(in, blockLen);
-	if(ret < 0) {
+	if( xmlSecBufferSetMaxSize( in , blockSize ) < 0 ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
 			"xmlSecBufferSetMaxSize",
-			XMLSEC_ERRORS_R_XMLSEC_FAILED,
-			"size=%d", blockLen);
+			XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			XMLSEC_ERRORS_NO_MESSAGE);
 	    return(-1);
 	}
 	inBuf = xmlSecBufferGetData(in);

-        /* generate random padding */
-	if((xmlSecSize)blockLen > (inSize + 1)) {
-	    rv = PK11_GenerateRandom(inBuf + inSize, blockLen - inSize - 1);
-	    if(rv != SECSuccess) {
+        /* generate random */
+	if( blockSize > ( inSize + 1 ) ) {
+	    if( PK11_GenerateRandom( inBuf + inSize, blockSize - inSize - 1 ) != SECSuccess ) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(cipherName),
 			    "PK11_GenerateRandom",
 			    XMLSEC_ERRORS_R_CRYPTO_FAILED,
-			    "size=%d", blockLen - inSize - 1);
+			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
 	    }
 	}
-	inBuf[blockLen - 1] = blockLen - inSize;
-	inSize = blockLen;
+	inBuf[blockSize-1] = blockSize - inSize ;
+	inSize = blockSize ;
     } else {
-	if(inSize != (xmlSecSize)blockLen) {
+	if( inSize != blockSize ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
 			NULL,
-			XMLSEC_ERRORS_R_INVALID_DATA,
-			"data=%d;block=%d", inSize, blockLen);
+			XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			XMLSEC_ERRORS_NO_MESSAGE);
 	    return(-1);
 	}
     }

-    /* process last block */
-    ret = xmlSecBufferSetMaxSize(out, outSize + 2 * blockLen);
-    if(ret < 0) {
+    /* process the last block */
+    if( xmlSecBufferSetMaxSize( out , outSize + inSize + blockSize ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "xmlSecBufferSetMaxSize",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", outSize + 2 * blockLen);
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
+		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }
     outBuf = xmlSecBufferGetData(out) + outSize;

-    rv = PK11_CipherOp(ctx->cipherCtx, outBuf, &outLen, 2 * blockLen,
-			xmlSecBufferGetData(in), inSize);
-    if(rv != SECSuccess) {
+    if( PK11_CipherOp( ctx->cipherCtx , outBuf , &outLen , inSize + blockSize , xmlSecBufferGetData( in ) , inSize ) != SECSuccess ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
 		    "PK11_CipherOp",
@@ -363,300 +595,169 @@
 		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
     }
-    xmlSecAssert2((xmlSecSize)outLen == inSize, -1);

     if(encrypt == 0) {
 	/* check padding */
-	if(outLen < outBuf[blockLen - 1]) {
+	if( outLen < outBuf[blockSize-1] ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(cipherName),
 			NULL,
-			XMLSEC_ERRORS_R_INVALID_DATA,
-			"padding=%d;buffer=%d",
-			outBuf[blockLen - 1], outLen);
+			XMLSEC_ERRORS_R_CRYPTO_FAILED,
+			XMLSEC_ERRORS_NO_MESSAGE);
 	    return(-1);
 	}
-	outLen -= outBuf[blockLen - 1];
+	outLen -= outBuf[blockSize-1] ;
     }

-    /* set correct output buffer size */
-    ret = xmlSecBufferSetSize(out, outSize + outLen);
-    if(ret < 0) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    xmlSecErrorsSafeString(cipherName),
-		    "xmlSecBufferSetSize",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", outSize + outLen);
-	return(-1);
-    }
+    /******************************************************************/

-    /* remove the processed block from input */
-    ret = xmlSecBufferRemoveHead(in, inSize);
-    if(ret < 0) {
+    /******************************************************************
+    if( xmlSecBufferSetMaxSize( out , outSize + blockSize ) < 0 ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(cipherName),
-		    "xmlSecBufferRemoveHead",
-		    XMLSEC_ERRORS_R_XMLSEC_FAILED,
-		    "size=%d", inSize);
-	return(-1);
-    }
-
-    return(0);
-}
-
-
-/******************************************************************************
- *
- * EVP Block Cipher transforms
- *
- * xmlSecNssBlockCipherCtx block is located after xmlSecTransform structure
- *
- *****************************************************************************/
-#define xmlSecNssBlockCipherSize	\
-    (sizeof(xmlSecTransform) + sizeof(xmlSecNssBlockCipherCtx))
-#define xmlSecNssBlockCipherGetCtx(transform) \
-    ((xmlSecNssBlockCipherCtxPtr)(((xmlSecByte*)(transform)) + sizeof(xmlSecTransform)))
-
-static int	xmlSecNssBlockCipherInitialize	(xmlSecTransformPtr transform);
-static void	xmlSecNssBlockCipherFinalize		(xmlSecTransformPtr transform);
-static int  	xmlSecNssBlockCipherSetKeyReq	(xmlSecTransformPtr transform,
-							 xmlSecKeyReqPtr keyReq);
-static int	xmlSecNssBlockCipherSetKey		(xmlSecTransformPtr transform,
-							 xmlSecKeyPtr key);
-static int	xmlSecNssBlockCipherExecute		(xmlSecTransformPtr transform,
-							 int last,
-							 xmlSecTransformCtxPtr transformCtx);
-static int	xmlSecNssBlockCipherCheckId		(xmlSecTransformPtr transform);
-
-
-
-static int
-xmlSecNssBlockCipherCheckId(xmlSecTransformPtr transform) {
-#ifndef XMLSEC_NO_DES
-    if(xmlSecTransformCheckId(transform, xmlSecNssTransformDes3CbcId)) {
-	return(1);
-    }
-#endif /* XMLSEC_NO_DES */
-
-#ifndef XMLSEC_NO_AES
-    if(xmlSecTransformCheckId(transform, xmlSecNssTransformAes128CbcId) ||
-       xmlSecTransformCheckId(transform, xmlSecNssTransformAes192CbcId) ||
-       xmlSecTransformCheckId(transform, xmlSecNssTransformAes256CbcId)) {
-
-       return(1);
-    }
-#endif /* XMLSEC_NO_AES */
-
-    return(0);
-}
-
-static int
-xmlSecNssBlockCipherInitialize(xmlSecTransformPtr transform) {
-    xmlSecNssBlockCipherCtxPtr ctx;
-
-    xmlSecAssert2(xmlSecNssBlockCipherCheckId(transform), -1);
-    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssBlockCipherSize), -1);
-
-    ctx = xmlSecNssBlockCipherGetCtx(transform);
-    xmlSecAssert2(ctx != NULL, -1);
-
-    memset(ctx, 0, sizeof(xmlSecNssBlockCipherCtx));
-
-#ifndef XMLSEC_NO_DES
-    if(transform->id == xmlSecNssTransformDes3CbcId) {
-	ctx->cipher 	= CKM_DES3_CBC;
-	ctx->keyId 	= xmlSecNssKeyDataDesId;
-	ctx->keySize	= 24;
-    } else
-#endif /* XMLSEC_NO_DES */
-
-#ifndef XMLSEC_NO_AES
-    if(transform->id == xmlSecNssTransformAes128CbcId) {
-	ctx->cipher 	= CKM_AES_CBC;
-	ctx->keyId 	= xmlSecNssKeyDataAesId;
-	ctx->keySize	= 16;
-    } else if(transform->id == xmlSecNssTransformAes192CbcId) {
-	ctx->cipher 	= CKM_AES_CBC;
-	ctx->keyId 	= xmlSecNssKeyDataAesId;
-	ctx->keySize	= 24;
-    } else if(transform->id == xmlSecNssTransformAes256CbcId) {
-	ctx->cipher 	= CKM_AES_CBC;
-	ctx->keyId 	= xmlSecNssKeyDataAesId;
-	ctx->keySize	= 32;
-    } else
-#endif /* XMLSEC_NO_AES */
-
-    if(1) {
-	xmlSecError(XMLSEC_ERRORS_HERE,
-		    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
-		    NULL,
-		    XMLSEC_ERRORS_R_INVALID_TRANSFORM,
+		    "xmlSecBufferSetMaxSize",
+		    XMLSEC_ERRORS_R_CRYPTO_FAILED,
 		    XMLSEC_ERRORS_NO_MESSAGE);
 	return(-1);
-    }
-
-    return(0);
-}
-
-static void
-xmlSecNssBlockCipherFinalize(xmlSecTransformPtr transform) {
-    xmlSecNssBlockCipherCtxPtr ctx;
-
-    xmlSecAssert(xmlSecNssBlockCipherCheckId(transform));
-    xmlSecAssert(xmlSecTransformCheckSize(transform, xmlSecNssBlockCipherSize));
-
-    ctx = xmlSecNssBlockCipherGetCtx(transform);
-    xmlSecAssert(ctx != NULL);
-
-    if(ctx->cipherCtx != NULL) {
-        PK11_DestroyContext(ctx->cipherCtx, PR_TRUE);
     }
-
-    memset(ctx, 0, sizeof(xmlSecNssBlockCipherCtx));
-}

-static int
-xmlSecNssBlockCipherSetKeyReq(xmlSecTransformPtr transform,  xmlSecKeyReqPtr keyReq) {
-    xmlSecNssBlockCipherCtxPtr ctx;
-
-    xmlSecAssert2(xmlSecNssBlockCipherCheckId(transform), -1);
-    xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1);
-    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssBlockCipherSize), -1);
-    xmlSecAssert2(keyReq != NULL, -1);
-
-    ctx = xmlSecNssBlockCipherGetCtx(transform);
-    xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(ctx->keyId != NULL, -1);
+    outBuf = xmlSecBufferGetData( out ) + outSize ;
+    if( PK11_DigestFinal( ctx->cipherCtx , outBuf , &outLen , blockSize ) != SECSuccess ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    xmlSecErrorsSafeString( cipherName ) ,
+                    "PK11_DigestFinal" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return -1 ;
+    }
+    ******************************************************************/
+
+    if( xmlSecBufferSetSize( out , outSize + outLen ) < 0 ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    xmlSecErrorsSafeString( cipherName ) ,
+                    "xmlSecBufferSetSize" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return -1 ;
+    }
+
+    if( xmlSecBufferRemoveHead( in , inSize ) < 0 ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    xmlSecErrorsSafeString( cipherName ) ,
+                    "xmlSecBufferRemoveHead" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
+            return -1 ;
+    }
+
+/*    PK11_Finalize( ctx->cipherCtx ) ;*/
+    PK11_DestroyContext(ctx->cipherCtx, PR_TRUE);
+    ctx->cipherCtx = NULL ;

-    keyReq->keyId 	= ctx->keyId;
-    keyReq->keyType 	= xmlSecKeyDataTypeSymmetric;
-    if(transform->operation == xmlSecTransformOperationEncrypt) {
-	keyReq->keyUsage = xmlSecKeyUsageEncrypt;
-    } else {
-	keyReq->keyUsage = xmlSecKeyUsageDecrypt;
-    }
-    keyReq->keyBitsSize = 8 * ctx->keySize;
     return(0);
 }

-static int
-xmlSecNssBlockCipherSetKey(xmlSecTransformPtr transform, xmlSecKeyPtr key) {
-    xmlSecNssBlockCipherCtxPtr ctx;
-    xmlSecBufferPtr buffer;
+/**
+ * xmlSecTransformExecuteMethod:
+ * @transform:                 the pointer to transform object.
+ * @last:                      the flag: if set to 1 then it's the last data chunk.
+ * @transformCtx:              the pointer to transform context object.
+ *
+ * Transform specific method to process a chunk of data.
+ *
+ * Returns 0 on success or a negative value otherwise.
+ */
+xmlSecNssBlockCipherExecute(
+    xmlSecTransformPtr transform ,
+    int last ,
+    xmlSecTransformCtxPtr transformCtx
+) {
+    xmlSecNssBlockCipherCtxPtr context = NULL ;
+    xmlSecBufferPtr inBuf = NULL ;
+    xmlSecBufferPtr outBuf = NULL ;
+    const xmlChar* cipherName ;
+    int operation ;
+    int rtv ;

     xmlSecAssert2(xmlSecNssBlockCipherCheckId(transform), -1);
-    xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1);
     xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssBlockCipherSize), -1);
-    xmlSecAssert2(key != NULL, -1);
-
-    ctx = xmlSecNssBlockCipherGetCtx(transform);
-    xmlSecAssert2(ctx != NULL, -1);
-    xmlSecAssert2(ctx->cipher != 0, -1);
-    xmlSecAssert2(ctx->keyInitialized == 0, -1);
-    xmlSecAssert2(ctx->keyId != NULL, -1);
-    xmlSecAssert2(xmlSecKeyCheckId(key, ctx->keyId), -1);
-
-    xmlSecAssert2(ctx->keySize > 0, -1);
-    xmlSecAssert2(ctx->keySize <= sizeof(ctx->key), -1);

-    buffer = xmlSecKeyDataBinaryValueGetBuffer(xmlSecKeyGetValue(key));
-    xmlSecAssert2(buffer != NULL, -1);
+    xmlSecAssert2( ( transform->operation == xmlSecTransformOperationEncrypt ) || ( transform->operation == xmlSecTransformOperationDecrypt ), -1 ) ;
+    xmlSecAssert2( transformCtx != NULL , -1 ) ;

-    if(xmlSecBufferGetSize(buffer) < ctx->keySize) {
+    context = xmlSecNssBlockCipherGetCtx( transform ) ;
+    if( context == NULL ) {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
-		    NULL,
-		    XMLSEC_ERRORS_R_INVALID_KEY_DATA_SIZE,
-		    "keySize=%d;expected=%d",
-		    xmlSecBufferGetSize(buffer), ctx->keySize);
-	return(-1);
+                    "xmlSecNssBlockCipherGetCtx" ,
+                    XMLSEC_ERRORS_R_CRYPTO_FAILED ,
+                    XMLSEC_ERRORS_NO_MESSAGE ) ;
     }
-
-    xmlSecAssert2(xmlSecBufferGetData(buffer) != NULL, -1);
-    memcpy(ctx->key, xmlSecBufferGetData(buffer), ctx->keySize);
-
-    ctx->keyInitialized = 1;
-    return(0);
-}
-
-static int
-xmlSecNssBlockCipherExecute(xmlSecTransformPtr transform, int last, xmlSecTransformCtxPtr transformCtx) {
-    xmlSecNssBlockCipherCtxPtr ctx;
-    xmlSecBufferPtr in, out;
-    int ret;
-
-    xmlSecAssert2(xmlSecNssBlockCipherCheckId(transform), -1);
-    xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1);
-    xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssBlockCipherSize), -1);
-    xmlSecAssert2(transformCtx != NULL, -1);

-    in = &(transform->inBuf);
-    out = &(transform->outBuf);
-
-    ctx = xmlSecNssBlockCipherGetCtx(transform);
-    xmlSecAssert2(ctx != NULL, -1);
+    inBuf = &( transform->inBuf ) ;
+    outBuf = &( transform->outBuf ) ;

     if(transform->status == xmlSecTransformStatusNone) {
 	transform->status = xmlSecTransformStatusWorking;
     }

+    operation = ( transform->operation == xmlSecTransformOperationEncrypt ) ? 1 : 0 ;
+    cipherName = xmlSecTransformGetName( transform ) ;
+
     if(transform->status == xmlSecTransformStatusWorking) {
-	if(ctx->ctxInitialized == 0) {
-	    ret = xmlSecNssBlockCipherCtxInit(ctx, in, out,
-			(transform->operation == xmlSecTransformOperationEncrypt) ? 1 : 0,
-			xmlSecTransformGetName(transform), transformCtx);
-	    if(ret < 0) {
+	if( context->cipherCtx == NULL ) {
+	    rtv = xmlSecNssBlockCipherCtxInit( context, inBuf , outBuf , operation , cipherName , transformCtx ) ;
+	    if( rtv < 0 ) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
 			    "xmlSecNssBlockCipherCtxInit",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_R_INVALID_STATUS,
 			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
 	    }
 	}
-	if((ctx->ctxInitialized == 0) && (last != 0)) {
+	if( context->cipherCtx == NULL && last != 0 ) {
 	    xmlSecError(XMLSEC_ERRORS_HERE,
 			xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
 			NULL,
-			XMLSEC_ERRORS_R_INVALID_DATA,
+			XMLSEC_ERRORS_R_INVALID_STATUS,
 			"not enough data to initialize transform");
 	    return(-1);
 	}

-	if(ctx->ctxInitialized != 0) {
-	    ret = xmlSecNssBlockCipherCtxUpdate(ctx, in, out,
-			(transform->operation == xmlSecTransformOperationEncrypt) ? 1 : 0,
-			xmlSecTransformGetName(transform), transformCtx);
-	    if(ret < 0) {
+	if( context->cipherCtx != NULL ) {
+	    rtv = xmlSecNssBlockCipherCtxUpdate( context, inBuf , outBuf , operation , cipherName , transformCtx ) ;
+	    if( rtv < 0 ) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
 			    "xmlSecNssBlockCipherCtxUpdate",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_R_INVALID_STATUS,
 			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
 	    }
 	}

 	if(last) {
-	    ret = xmlSecNssBlockCipherCtxFinal(ctx, in, out,
-			(transform->operation == xmlSecTransformOperationEncrypt) ? 1 : 0,
-			xmlSecTransformGetName(transform), transformCtx);
-	    if(ret < 0) {
+	    rtv = xmlSecNssBlockCipherCtxFinal( context, inBuf , outBuf , operation , cipherName , transformCtx ) ;
+	    if( rtv < 0 ) {
 		xmlSecError(XMLSEC_ERRORS_HERE,
 			    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),
 			    "xmlSecNssBlockCipherCtxFinal",
-			    XMLSEC_ERRORS_R_XMLSEC_FAILED,
+			    XMLSEC_ERRORS_R_INVALID_STATUS,
 			    XMLSEC_ERRORS_NO_MESSAGE);
 		return(-1);
 	    }
 	    transform->status = xmlSecTransformStatusFinished;
 	}
     } else if(transform->status == xmlSecTransformStatusFinished) {
-	/* the only way we can get here is if there is no input */
-	xmlSecAssert2(xmlSecBufferGetSize(in) == 0, -1);
-    } else if(transform->status == xmlSecTransformStatusNone) {
-	/* the only way we can get here is if there is no enough data in the input */
-	xmlSecAssert2(last == 0, -1);
+        if( xmlSecBufferGetSize( inBuf ) != 0 ) {
+            xmlSecError( XMLSEC_ERRORS_HERE ,
+                    xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) ,
+                    NULL ,
+                    XMLSEC_ERRORS_R_INVALID_STATUS ,
+                    "status=%d", transform->status ) ;
+            return -1 ;
+        }
     } else {
 	xmlSecError(XMLSEC_ERRORS_HERE,
 		    xmlSecErrorsSafeString(xmlSecTransformGetName(transform)),