// Copyright (C) 2002 IAIK
// https://sic.tech/
//
// Copyright (C) 2003 - 2025 Stiftung Secure Information and 
//                           Communication Technologies SIC
// https://sic.tech/
//
// All rights reserved.
//
// This source is provided for inspection purposes and recompilation only,
// unless specified differently in a contract with IAIK. This source has to
// be kept in strict confidence and must not be disclosed to any third party
// under any circumstances. Redistribution in source and binary forms, with
// or without modification, are <not> permitted in any case!
//
// THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
// ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
// OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
// HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
// LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
// OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
// SUCH DAMAGE.
//
// $Header: /IAIK-CMS/current/src/demo/smime/ecc/SMimeV4EccDemo.java 10    12.02.25 17:59 Dbratko $
// $Revision: 10 $
//

package demo.smime.ecc;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.util.Date;

import jakarta.activation.DataHandler;
import jakarta.activation.FileDataSource;
import jakarta.mail.Message;
import jakarta.mail.MessagingException;
import jakarta.mail.Multipart;
import jakarta.mail.Session;
import jakarta.mail.internet.InternetAddress;
import jakarta.mail.internet.MimeBodyPart;
import jakarta.mail.internet.MimeMessage;

import demo.DemoSMimeUtil;
import demo.DemoUtil;
import demo.cms.ecc.ECCDemoUtil;
import demo.cms.ecc.keystore.CMSEccKeyStore;
import demo.smime.DumpMessage;
import iaik.asn1.structures.AlgorithmID;
import iaik.cms.CMSAlgorithmID;
import iaik.smime.AuthEncryptedContent;
import iaik.smime.EncryptedContent;
import iaik.smime.SMimeBodyPart;
import iaik.smime.SMimeException;
import iaik.smime.SMimeMultipart;
import iaik.smime.SignedContent;
import iaik.utils.KeyAndCertificate;
import iaik.x509.X509Certificate;

/**
 * This class demonstrates the usage of the IAIK S/MIME implementation. It shows how to create
 * signed and/or (authenticated) encrypted S/MIMEv4 messages using ECC keys and how to parse them and verify the signatures 
 * and decrypt the content, respectively.
 * <p>
 * This demo uses several combinations of cryptographic algorithms that may not used in this
 * way in practice. For a simple demos using only one set of algorithms see the {@link SimpleSMimeV4EcDemo SimpleSMimeV4EcDemo}
 * and  {@link SimpleSMimeV4EdDemo SimpleSMimeV4EdDemo}.
 * <p>
 * Additionally to <code>iaik_cms.jar</code> you also must have 
 * <code>iaik_jce_(full).jar</code> (IAIK-JCE, <a href =
 * "https://sic.tech/products/core-crypto-toolkits/jca-jce/" target="_blank">
 * https://sic.tech/products/core-crypto-toolkits/jca-jce/</a>),
 * and <code>iaik_eccelarate.jar</code> (IAIK-ECCelerate<sup><small>TM</small></sup>, <a href =
 * "https://sic.tech/products/core-crypto-toolkits/eccelerate/" target="_blank">
 * https://sic.tech/products/core-crypto-toolkits/eccelerate/</a>)
 * in your classpath.
 * <p>
 * To run this demo the following packages are required:
 * <ul>
 *    <li>
 *       <code>iaik_cms.jar</code>
 *    </li>
 *    <li>
 *       <code>iaik_jce(_full).jar</code> (<a href="https://sic.tech/products/core-crypto-toolkits/jca-jce/" target="_blank">IAIK-JCE Core Crypto Library</a>).
 *    </li>
 *    <li>
 *       <code>iaik_eccelerate.jar</code> (<a href="https://sic.tech/products/core-crypto-toolkits/eccelerate/" target="_blank">IAIK ECC Library</a>).
 *    </li>   
 *    <li>
 *       <a href="https://jakarta.ee/specifications/mail/" target="_blank">Jakarta</a>/<a href="https://eclipse-ee4j.github.io/angus-mail/" target="_blank">Angus</a> Mail
 *    </li>   
 *    <li>
 *       <a href="https://jakarta.ee/specifications/activation/" target="_blank">Jakarta Activation Framework</a>
 *    </li> 
 * </ul>
 * 
 */
public class SMimeV4EccDemo {
    
  // whether to print dump all generates test messages to System.out
  final static boolean PRINT_MESSAGES = false; 
  
  /**
   * Cretaes a Multipart for the demo messages.
   * 
   * @return the Multipart
   * 
   * @throws MessagingException if an error occurs when creating the Mulitpart
   */
  static DataHandler createMultipart() throws MessagingException {
    // Create a demo Multipart
    MimeBodyPart mbp1 = new SMimeBodyPart();
    mbp1.setText("This is a Test of the IAIK S/MIME implementation!\n\n");
    // attachment
    MimeBodyPart attachment = new SMimeBodyPart();
    attachment.setDataHandler(new DataHandler(new FileDataSource("test.html")));
    attachment.setFileName("test.html");

    Multipart mp = new SMimeMultipart();
    mp.addBodyPart(mbp1);
    mp.addBodyPart(attachment);
    DataHandler multipart = new DataHandler(mp, mp.getContentType());
    return multipart;
  }
  

  String firstName_ = "John";
  String lastName_ = "SMime";
  String to_ = "smimetest@iaik.tugraz.at";     // email recipient
  String from_ = "smimetest@iaik.tugraz.at";   // email sender
  String host_ = "mailhost";                   // name of the mailhost

  /**
   * Default constructor.
   */
  public SMimeV4EccDemo() {
    
    System.out.println();
    System.out.println("********************************************************************************************");
    System.out.println("*                                SMimeV4EccDemo demo                                       *");
    System.out.println("* (shows how to create and parse (verify, decrypt) signed and encrypted S/MIMEv4 messages) *");
    System.out.println("********************************************************************************************");
    System.out.println();

  }
  
   
  /**
   * Starts the demo.
   *
   * @throws Exception if an error occurs
   */
  public void start() throws Exception {
    
    // get the default Session
    Session session = DemoSMimeUtil.getSession();

    // Create a demo Multipart
    DataHandler multipart = createMultipart();
    
    // get signer key and certs
    KeyAndCertificate[] signerKeyAndCerts = {
        // P-256
        new KeyAndCertificate(
            CMSEccKeyStore.getPrivateKey(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_256_SIGN),
            CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_256_SIGN)),
        // P-384
        new KeyAndCertificate(
            CMSEccKeyStore.getPrivateKey(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_384_SIGN),
            CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_384_SIGN)),
        // P-521
        new KeyAndCertificate(
            CMSEccKeyStore.getPrivateKey(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_521_SIGN),
            CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDSA,
                CMSEccKeyStore.SZ_521_SIGN)),
        // ed25519  
        new KeyAndCertificate(CMSEccKeyStore.getPrivateKey(CMSEccKeyStore.ECDSA, CMSEccKeyStore.SZ_ED25519),
                              CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDSA, CMSEccKeyStore.SZ_ED25519)),
        // ed448  
        new KeyAndCertificate(CMSEccKeyStore.getPrivateKey(CMSEccKeyStore.ECDSA, CMSEccKeyStore.SZ_ED448),
                              CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDSA, CMSEccKeyStore.SZ_ED448)),

     };
     
     // the digest and signature algorithms to be used
     AlgorithmID[][] digestAndSignatureAlgorithms = new AlgorithmID[][] {
       { CMSAlgorithmID.sha256, CMSAlgorithmID.ecdsa_With_SHA256 },
       { CMSAlgorithmID.sha384, CMSAlgorithmID.ecdsa_With_SHA384 },
       { CMSAlgorithmID.sha512, CMSAlgorithmID.ecdsa_With_SHA512 },
       { CMSAlgorithmID.sha512, CMSAlgorithmID.ed25519},
       { CMSAlgorithmID.shake256Len, CMSAlgorithmID.ed448 },
     };

    
     /**************************************************************************/
     /*                                                                        */
     /*                               Signing Demo                             */
     /*                                                                        */
     /**************************************************************************/
     
     final int DIGEST_ALG = 0;
     final int SIGNATURE_ALG = 1;
     for (int i = 0; i < digestAndSignatureAlgorithms.length; i++) {
       AlgorithmID digestAlg = digestAndSignatureAlgorithms[i][DIGEST_ALG];
       AlgorithmID signatureAlg = digestAndSignatureAlgorithms[i][SIGNATURE_ALG];
       PrivateKey signerKey = signerKeyAndCerts[i].getPrivateKey();
       X509Certificate[] signerCerts = signerKeyAndCerts[i].getCertificateChain();
       System.out.println("Running signing demo for " + signatureAlg.getName());
       startSigningDemo(session, 
                        multipart, 
                        digestAlg, 
                        signatureAlg, 
                        signerKey,
                        signerCerts);
    }
     
    // (authenticated) encryption demos
     
    // get recipient certs
    X509Certificate[] recipientCerts = {
       // P-256
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_256_CRYPT_1)[0],
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_256_CRYPT_2)[0],
       // P-384
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_384_CRYPT_1)[0],
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_384_CRYPT_2)[0],
       // P-521
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_521_CRYPT_1)[0],
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH,
               CMSEccKeyStore.SZ_521_CRYPT_2)[0],
       // x25519  
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH, 
               CMSEccKeyStore.SZ_X25519)[0],
       // x448  
       CMSEccKeyStore.getCertificateChain(CMSEccKeyStore.ECDH, 
               CMSEccKeyStore.SZ_X448)[0]

    };
     
    //  the key encryption algorithms to be used
    AlgorithmID[] keyEAs = {
        AlgorithmID.dhSinglePass_stdDH_sha256kdf_scheme, 
        AlgorithmID.dhSinglePass_stdDH_sha384kdf_scheme, 
        AlgorithmID.dhSinglePass_stdDH_hkdf_sha256_scheme, 
        AlgorithmID.dhSinglePass_stdDH_hkdf_sha384_scheme,
        AlgorithmID.dhSinglePass_stdDH_hkdf_sha512_scheme, 
    };
    // key wrap algorithms
    AlgorithmID[] keyWrapAlgs = {
        CMSAlgorithmID.cms_aes128_wrap, 
        CMSAlgorithmID.cms_aes192_wrap, 
        CMSAlgorithmID.cms_aes256_wrap, 
    };
    // whether to encrypt or authenticated encrypt
    boolean[] doAuthEncrypt = { false, true };
    for (int h = 0; h < doAuthEncrypt.length; h++) {
      boolean authEncrypt = doAuthEncrypt[h]; 
      for (int i = 0; i < keyEAs.length; i++) {
        AlgorithmID[] contentEAs;
        AlgorithmID keyEA = keyEAs[i];
        for (int j = 0; j < keyWrapAlgs.length; j++) {
          AlgorithmID keyWrapAlg = keyWrapAlgs[j];
          int kekLength;
          int keyLength;
          if (keyWrapAlg.equals(CMSAlgorithmID.cms_aes192_wrap)) {
            kekLength = 192;
            keyLength = 192;
            contentEAs = (authEncrypt) ? 
                new AlgorithmID[]  { AlgorithmID.aes192_GCM, AlgorithmID.aes192_CCM } :
                new AlgorithmID[]  { AlgorithmID.aes192_CBC };
          } else if (keyWrapAlg.equals(CMSAlgorithmID.cms_aes128_wrap)) {
            kekLength = 128;
            keyLength = 128;
            contentEAs = (authEncrypt) ? 
                new AlgorithmID[]  { AlgorithmID.aes128_GCM, AlgorithmID.aes128_CCM  } :
                new AlgorithmID[]  { AlgorithmID.aes128_CBC };
          } else {
            kekLength = 256;
            keyLength = 256;
            contentEAs = (authEncrypt) ? 
                new AlgorithmID[]  { AlgorithmID.aes256_GCM, AlgorithmID.aes256_CCM, AlgorithmID.chacha20Poly1305 } :
                new AlgorithmID[]  { AlgorithmID.aes256_CBC };
          }
          
          for (int k = 0; k < contentEAs.length; k++) {
            
            /**************************************************************************/
            /*                                                                        */
            /*                  (Authenticated) Encryption Demo                       */
            /*                                                                        */
            /**************************************************************************/
            
            AlgorithmID contentEA = contentEAs[k];
            // in practice we may not create one message for recipients with different strength;
            // however, for simplicity we use all recipients here
            System.out.println("Running " + (authEncrypt ? "authenticated" : "") + "encryption demo for " + 
                                keyEA.getName() + " with " + keyWrapAlg.getName() +" and " + contentEA.getName());
            startEncryptionDemo(session,
                                contentEA, 
                                keyLength, 
                                keyEA,
                                keyWrapAlg,
                                kekLength,
                                authEncrypt, 
                                recipientCerts);
            
            
            /**************************************************************************/
            /*                                                                        */
            /*             Signing and (Authenticated) Encryption Demo                */
            /*                                                                        */
            /**************************************************************************/
            
            for (int l = 0; l < digestAndSignatureAlgorithms.length; l++) {
              AlgorithmID digestAlg = digestAndSignatureAlgorithms[l][DIGEST_ALG];
              AlgorithmID signatureAlg = digestAndSignatureAlgorithms[l][SIGNATURE_ALG];
              PrivateKey signerKey = signerKeyAndCerts[l].getPrivateKey();
              X509Certificate[] signerCerts = signerKeyAndCerts[l].getCertificateChain();
              System.out.println("Running signing and " + (authEncrypt ? "authenticated" : "") + "encryption and demo for " + signatureAlg.getName());
              startSigningAndEncryptionDemo(session,
                  multipart,
                  digestAlg,
                  signatureAlg,
                  contentEA, 
                  keyLength, 
                  keyEA,
                  keyWrapAlg,
                  kekLength,
                  authEncrypt,  
                  signerKey, 
                  signerCerts,
                  recipientCerts);
            }
          }
        }
      }
    } 
  } 
 
  /**
   * Starts the signing demo.
   * 
   * @param session the mail session
   * @param multipart the multipart content of the message to be signed
   * @param digestAlgorithm the digest algorithm to be used
   * @param signatureAlgorithm the signature algorithm to be used 
   * @param signerKey the private key of the signer
   * @param signerCerts the certificate chain of the signer     
   *
   * @throws Exception if an error occurs
   */
  public void startSigningDemo(Session session,
                               DataHandler multipart, 
                               AlgorithmID digestAlgorithm, 
                               AlgorithmID signatureAlgorithm,
                               PrivateKey signerKey, 
                               X509Certificate[] signerCerts) throws Exception {
    
    Message msg;    // the message to send
    ByteArrayOutputStream baos = new ByteArrayOutputStream(); // we write to a stream
    ByteArrayInputStream bais;  // we read from a stream

    // This is an explicitly signed message
    System.out.println("creating explicitly signed message...");
    msg = createSignedMessage(session, multipart, false, digestAlgorithm, signatureAlgorithm, signerKey, signerCerts);
    baos.reset();
    msg.saveChanges();
    msg.writeTo(baos);
    bais = new ByteArrayInputStream(baos.toByteArray());
    msg = new MimeMessage(session, bais);
    if (PRINT_MESSAGES) {
      printMessage(msg);
    }
    DumpMessage.dumpMsg(msg);
    
    System.out.println("\n\n*****************************************\n\n");


    // This is an implicitly signed message
    System.out.println("creating implicitly signed message...");
    msg = createSignedMessage(session, multipart, true, digestAlgorithm, signatureAlgorithm, signerKey, signerCerts);
    baos.reset();
    msg.saveChanges();
    msg.writeTo(baos);
    bais = new ByteArrayInputStream(baos.toByteArray());
    msg = new MimeMessage(session, bais);
    if (PRINT_MESSAGES) {
      printMessage(msg);
    }
    DumpMessage.dumpMsg(msg);
    
    System.out.println("\n\n*****************************************\n\n");

  }
  
  /**
   * Starts the (maybe authenticated) encryption demo.
   * 
   * @param session the mail session
   * @param contentEA the content encryption algorithm to be used
   * @param keyLength the length of the secret content encryption key to be created and used
   * @param keyEA the (key agreement) algorithm to use for creating a shared secret
   *              key encryption key for encrypting the symmetric key
   *              (e.g. AlgorithmID.esdhKeyAgreement)
   * @param keyWrapAlgorithm the key wrap algorithm to be used for encrypting (wrapping)
   *                   the content-encryption key with the shared key-encryption
   *                   created according to the requested key agreement protocol
   * @param kekLength the length of the shared key encryption key to be generated
   * @param authEncrypt whether to create an authenticated encrypted message 
   * @param recipientCerts the certificates of the recipients       
   *
   * @throws Exception if an error occurs
   */
  public void startEncryptionDemo(Session session,
                                  AlgorithmID contentEA, 
                                  int keyLength, 
                                  AlgorithmID keyEA,
                                  AlgorithmID keyWrapAlgorithm,
                                  int kekLength,
                                  boolean authEncrypt, 
                                  X509Certificate[] recipientCerts) throws Exception {

 
    Message msg;    // the message to send
    ByteArrayOutputStream baos = new ByteArrayOutputStream(); // we write to a stream
    ByteArrayInputStream bais;  // we read from a stream

    System.out.println("creating encrypted message " + contentEA.getName());
    msg = createEncryptedMessage(session, (AlgorithmID)contentEA.clone(), keyLength,
      (AlgorithmID)keyEA.clone(), (AlgorithmID)keyWrapAlgorithm.clone(), kekLength, authEncrypt,
       recipientCerts);

    baos.reset();
    msg.saveChanges();
    msg.writeTo(baos);
    bais = new ByteArrayInputStream(baos.toByteArray());
    msg = new MimeMessage(session, bais);
    if (PRINT_MESSAGES) {
      printMessage(msg);
    }
    DumpMessage.dumpEncryptedMessage(msg);
    
    System.out.println("\n\n*****************************************\n\n");

    
  }
  
  
  /**
   * Starts the signing + (maybe authenticated) encryption demo.
   * 
   * @param session the mail session
   * @param multipart the Multipart content to be signed and encrypted
   * @param digestAlgorithm the digest algorithm to be used for signing
   * @param signatureAlgorithm the signature algorithm to be used 
   * @param contentEA the content encryption algorithm to be used
   * @param keyLength the length of the secret content encryption key to be created and used
   * @param keyEA the (key agreement) algorithm to use for creating a shared secret
   *              key encryption key for encrypting the symmetric key
   *              (e.g. AlgorithmID.esdhKeyAgreement)
   * @param keyWrapAlgorithm the key wrap algorithm to be used for encrypting (wrapping)
   *                   the content-encryption key with the shared key-encryption
   *                   created according to the requested key agreement protocol
   * @param kekLength the length of the shared key encryption key to be generated
   * @param authEncrypt whether to create an authenticated encrypted message 
   * @param signerKey the private key of the signer
   * @param signerCerts the certificate chain of the signer 
   * @param recipientCerts the certificates of the recipients       
   *
   * @throws Exception if an error occurs
   */
  public void startSigningAndEncryptionDemo(Session session,
                                            DataHandler multipart,
                                            AlgorithmID digestAlgorithm,
                                            AlgorithmID signatureAlgorithm,
                                            AlgorithmID contentEA, 
                                            int keyLength, 
                                            AlgorithmID keyEA,
                                            AlgorithmID keyWrapAlgorithm,
                                            int kekLength,
                                            boolean authEncrypt, 
                                            PrivateKey signerKey, 
                                            X509Certificate[] signerCerts,
                                            X509Certificate[] recipientCerts) throws Exception {

 
    Message msg;    // the message to send
    ByteArrayOutputStream baos = new ByteArrayOutputStream(); // we write to a stream
    ByteArrayInputStream bais;  // we read from a stream

   // Create an implicitly signed and authenticated encrypted message with attachment
    System.out.println("creating implicitly signed and authenticated encrypted message  " + contentEA.getName());
    msg = createSignedAndEncryptedMessage(session, digestAlgorithm, signatureAlgorithm, contentEA, keyLength,
        keyEA, keyWrapAlgorithm, kekLength, multipart, true, authEncrypt,
        signerKey, signerCerts, recipientCerts);
    baos.reset();
    msg.saveChanges();
    msg.writeTo(baos);
    bais = new ByteArrayInputStream(baos.toByteArray());
    msg = new MimeMessage(session, bais);
    if (PRINT_MESSAGES) {
      printMessage(msg);
    }
    DumpMessage.dumpEncryptedMessage(msg);
    
    System.out.println("\n\n*****************************************\n\n");

    // Create an explicitly signed and authenticated encrypted message with attachment
    System.out.println("creating explicitly signed and authenticated encrypted message " + contentEA.getName());
    msg = createSignedAndEncryptedMessage(session, digestAlgorithm, signatureAlgorithm, contentEA, keyLength,
        keyEA, keyWrapAlgorithm, kekLength, multipart, true, authEncrypt,
        signerKey, signerCerts, recipientCerts);
    baos.reset();
    msg.saveChanges();
    msg.writeTo(baos);
    bais = new ByteArrayInputStream(baos.toByteArray());
    msg = new MimeMessage(session, bais);
    if (PRINT_MESSAGES) {
      printMessage(msg);
    }
    DumpMessage.dumpEncryptedMessage(msg);

  }
  
  /**
   * Creates a MIME message container with the given subject for the given session.
   * 
   * @param session the mail sesion
   * @param subject the subject of the message
   *
   * @return the MIME message with FROM, TO, DATE and SUBJECT headers (without content)
   *
   * @throws MessagingException if the message cannot be created
   */
  public Message createMessage(Session session, String subject) throws MessagingException {
    MimeMessage msg = new MimeMessage(session);
    msg.setFrom(new InternetAddress(from_));
        msg.setRecipients(Message.RecipientType.TO,     InternetAddress.parse(to_, false));
        msg.setSentDate(new Date());
    msg.setSubject(subject);
    return msg;
  }
  
 
  /**
   * Creates a signed message.
   *
   * @param session the mail session
   * @param dataHandler the content of the message to be signed
   * @param implicit whether to use implicit (application/pkcs7-mime) or explicit
   *                 (multipart/signed) signing
   * @param digestAlgorithm the digest algorithm to be used
   * @param signatureAlgorithm the signature algorithm to be used 
   * @param signerKey the private key of the signer
   * @param signerCertificates the certificate chain of the signer               
   * 
   * @return the signed message
   *
   * @throws MessagingException if an error occurs when creating the message
   */
  public Message createSignedMessage(Session session, 
                                     DataHandler dataHandler,
                                     boolean implicit,
                                     AlgorithmID digestAlgorithm,
                                     AlgorithmID signatureAlgorithm,
                                     PrivateKey signerKey,
                                     X509Certificate[] signerCertificates)
      throws MessagingException {

    String subject = null;
    StringBuffer buf = new StringBuffer();
    
    if (implicit) {
      subject = "IAIK-S/MIME: Implicitly Signed";
      buf.append("This message is implicitly signed!\n");
      buf.append("You need an S/MIME aware mail client to view this message.\n");
      buf.append("\n\n");
    } else {
      subject = "IAIK-S/MIME: Explicitly Signed";
      buf.append("This message is explicitly signed!\n");
      buf.append("Every mail client can view this message.\n");
      buf.append("Non S/MIME mail clients will show the signature as attachment.\n");
      buf.append("\n\n");
    }
    
    Message msg = createMessage(session, subject);
    
    SignedContent sc = new SignedContent(implicit);
    if (dataHandler != null) {
      sc.setDataHandler(dataHandler);
    } else {
      sc.setText(buf.toString());
    }
    sc.setCertificates(signerCertificates);

    try {
      sc.addSigner(signerKey, 
                   signerCertificates[0],
                   (AlgorithmID)digestAlgorithm.clone(),
                   (AlgorithmID)signatureAlgorithm.clone());
    } catch (NoSuchAlgorithmException ex) {
      throw new MessagingException("Algorithm not supported: " + ex.getMessage(), ex);
    }

    msg.setContent(sc, sc.getContentType());
    // let the SignedContent update some message headers
    sc.setHeaders(msg);
    return msg;
  }
  
  /**
   * Creates an (maybe authenticated) encrypted message.
   *
   * @param session the mail session
   * @param contentEA the content encryption algorithm to be used
   * @param keyLength the length of the secret content encryption key to be created and used
   * @param keyEA the (key agreement) algorithm to use for creating a shared secret
   *              key encryption key for encrypting the symmetric key
   *              (e.g. AlgorithmID.esdhKeyAgreement)
   * @param keyWrapAlgorithm the key wrap algorithm to be used for encrypting (wrapping)
   *                   the content-encryption key with the shared key-encryption
   *                   created according to the requested key agreement protocol
   * @param kekLength the length of the shared key encryption key to be generated
   * @param authEncrypt whether to create an authenticated encrypted message
   * @param recipientCerts the certificates of the recipients
   * 
   * @return the (maybe authenticated) encrypted message
   *
   * @throws MessagingException if an error occurs when creating the message
   */
  public Message createEncryptedMessage(Session session, AlgorithmID contentEA, int keyLength,
    AlgorithmID keyEA, AlgorithmID keyWrapAlgorithm, int kekLength, boolean authEncrypt,
    X509Certificate[] recipientCerts)
      throws MessagingException {
    
    AlgorithmID algorithm = (AlgorithmID)contentEA.clone();
    AlgorithmID keyAgreeAlg = (AlgorithmID)keyEA.clone();
    AlgorithmID keyWrapAlg = (AlgorithmID)keyWrapAlgorithm.clone();
    
    StringBuffer subject = new StringBuffer();
    subject.append("IAIK-S/MIME: " + (authEncrypt ? "Authenticated " : "") + " Encrypted ["+algorithm.getName());
    if (keyLength > 0) {
      subject.append("/"+keyLength);
    }  
    subject.append("]");
    Message msg = createMessage(session, subject.toString());

    EncryptedContent ec = null;
    if (authEncrypt) {
      ec = new AuthEncryptedContent();
    } else {
      ec = new EncryptedContent();
    }

    StringBuffer buf = new StringBuffer();
    buf.append("This is the " + (authEncrypt ? "authenticated " : "") + " encrypted content!\n");
    buf.append("Content encryption algorithm: "+algorithm.getName());
    buf.append("\n\n");

    ec.setText(buf.toString());
    
    // we use ephemeral-static ECDH
    for (int i = 0; i < recipientCerts.length; i++) {
      try {
        ec.addRecipient(recipientCerts[i], keyAgreeAlg, keyWrapAlg, kekLength);
      } catch (SMimeException ex) {
        throw new MessagingException("Error adding ECDH recipient: " + ex.getMessage());   
      } 
    }  
   
    try {
      ec.setEncryptionAlgorithm(algorithm, keyLength);
    } catch (NoSuchAlgorithmException ex) {
      throw new MessagingException("Content encryption algorithm not supported: " + ex.getMessage());   
    }    

    msg.setContent(ec, ec.getContentType());
    // let the EncryptedContent update some message headers
    ec.setHeaders(msg);

    return msg;
  }
  
  /**
   * Creates a signed and (maybe authenticated) encrypted message.
   *
   * @param session the mail session
   * @param digestAlgorithm the digest algorithm to be used for signing
   * @param signatureAlgorithm the signature algorithm to be used 
   * @param contentEA the content encryption algorithm to be used
   * @param keyLength the length of the secret content encryption key to be created and used
   * @param keyEA the (key agreement) algorithm to use for creating a shared secret
   *              key encryption key for encrypting the symmetric key
   *              (e.g. AlgorithmID.esdhKeyAgreement)
   * @param keyWrapAlgorithm the key wrap algorithm to be used for encrypting (wrapping)
   *                   the content-encryption key with the shared key-encryption
   *                   created according to the requested key agreement protocol
   * @param kekLength the length of the shared key encryption key to be generated
   * @param dataHandler the content of the message to be signed and encrypted
   * @param implicit whether to use implicit (application/pkcs7-mime) or explicit
   *                 (multipart/signed) signing
   * @param authEncrypt whether to create an authenticated encrypted message 
   * @param signerKey the private key of the signer
   * @param signerCerts the certificate chain of the signer 
   * @param recipientCerts the certificates of the recipients      
   * 
   * @return the signed and (maybe authenticated) encrypted message
   *
   * @throws MessagingException if an error occurs when creating the message
   */
  public Message createSignedAndEncryptedMessage(Session session,
    AlgorithmID digestAlgorithm, AlgorithmID signatureAlgorithm,
    AlgorithmID contentEA, int keyLength,
    AlgorithmID keyEA, AlgorithmID keyWrapAlgorithm, int kekLength,
    DataHandler dataHandler, boolean implicit, boolean authEncrypt,
    PrivateKey signerKey, X509Certificate[] signerCerts,
    X509Certificate[] recipientCerts)
    throws MessagingException {

    String subject = null;
    String text = null;
    if (implicit) {
      subject = "IAIK-S/MIME: Implicitly signed and " + (authEncrypt ? "authenticated " : "") + "encrypted";
      text = "This message is implicitly signed and " + (authEncrypt ? "authenticated " : "") + "encrypted!\n\n\n";
    } else {
      subject = "IAIK-S/MIME: explicitly signed and " + (authEncrypt ? "authenticated " : "") + " encrypted";
      text = "This message is explicitly signed and " + (authEncrypt ? "authenticated " : "") + " encrypted!\n\n\n";
    }
    Message msg = createMessage(session, subject);

    SignedContent sc = new SignedContent(implicit);
    if (dataHandler != null) {
      sc.setDataHandler(dataHandler);
    } else {
      sc.setText(text);
    }
    sc.setCertificates(signerCerts);
    try {
      sc.addSigner(signerKey, 
                   signerCerts[0],
                   (AlgorithmID)digestAlgorithm.clone(),
                   (AlgorithmID)signatureAlgorithm.clone());
    } catch (NoSuchAlgorithmException ex) {
      throw new MessagingException("Algorithm not supported: " + ex.getMessage(), ex);
    }

    EncryptedContent ec = null;
    if (authEncrypt) {
      ec = new AuthEncryptedContent(sc);
    } else {
      ec = new EncryptedContent(sc);
    }

    
    AlgorithmID algorithm = (AlgorithmID)contentEA.clone();
    AlgorithmID keyAgreeAlg = (AlgorithmID)keyEA.clone();
    AlgorithmID keyWrapAlg = (AlgorithmID)keyWrapAlgorithm.clone();
    
    // we use ephemeral-static DH
    for (int i = 0; i < recipientCerts.length; i++) {
      try {
        ec.addRecipient(recipientCerts[i], keyAgreeAlg, keyWrapAlg, kekLength);
      } catch (SMimeException ex) {
        throw new MessagingException("Error adding ESDH recipient: " + ex.getMessage());   
      } 
    }  
 
    // set the encryption algorithm
    try {
      ec.setEncryptionAlgorithm(algorithm, keyLength);
    } catch (NoSuchAlgorithmException ex) {
      throw new MessagingException("Content encryption algorithm not supported: " + ex.getMessage());   
    }   
    msg.setContent(ec, ec.getContentType());
    // let the EncryptedContent update some message headers
    ec.setHeaders(msg);

    return msg;
  }
  
  

  /** 
   * Prints a dump of the given message to System.out.
   *
   * @param msg the message to be dumped to System.out
   *
   * @throws IOException if an I/O error occurs
   */
  static void printMessage(Message msg) throws IOException {
    System.out.println("------------------------------------------------------------------");
    System.out.println("Message dump: \n");
    try {
      msg.writeTo(System.out);
    } catch (MessagingException ex) {
      throw new IOException(ex.getMessage());   
    }    
    System.out.println("\n------------------------------------------------------------------");
  }  
  

  /**
   * The main method.
   */
  public static void main(String[] argv) throws Exception {
     
    DemoSMimeUtil.initDemos();
    //  add ECC provider    
    ECCDemoUtil.installIaikEccProvider();
    
        (new SMimeV4EccDemo()).start();
    System.out.println("\nReady!");
    DemoUtil.waitKey();
  }
}