anchor.diff:  				auth_keys.
   -type rsa_padding()          :: 'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding' 
   			      | 'rsa_no_padding'.
  +-type rsa_sign_padding()     :: 'rsa_pkcs1_padding' | 'rsa_pkcs1_pss_padding'.
   -type public_crypt_options() :: [{rsa_pad, rsa_padding()}].
  --type rsa_digest_type()      :: 'md5' | 'sha'| 'sha224' | 'sha256' | 'sha384' | 'sha512'.
  --type dss_digest_type()      :: 'none' | 'sha'. %% None is for backwards compatibility
  --type ecdsa_digest_type()    :: 'sha'| 'sha224' | 'sha256' | 'sha384' | 'sha512'.
  +-type rsa_digest_type()      :: 'md5' | 'ripemd160' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'.
  +-type dss_digest_type()      :: 'none' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'. %% None is for backwards compatibility
  +-type ecdsa_digest_type()    :: 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'.
  +-type public_sign_options()  :: [{rsa_pad, rsa_sign_padding()} | {rsa_pss_saltlen, integer()}].
   -type digest_type()          :: rsa_digest_type() |  dss_digest_type() | ecdsa_digest_type().
   -type crl_reason()           ::  unspecified | keyCompromise | cACompromise | affiliationChanged | superseded
   			       | cessationOfOperation | certificateHold | privilegeWithdrawn |  aACompromise.
  
positive.code:     {sha512, ecdsa}.
  
  %%--------------------------------------------------------------------
  -spec sign(binary() | {digest, binary()},  rsa_digest_type() | dss_digest_type() | ecdsa_digest_type(),
  	   rsa_private_key() |
  	   dsa_private_key() | ec_private_key()) -> Signature :: binary().
  %% Description: Create digital signature.
  %%--------------------------------------------------------------------
  sign(DigestOrPlainText, DigestType, Key = #'RSAPrivateKey'{}) ->
      crypto:sign(rsa, DigestType, DigestOrPlainText, format_rsa_private_key(Key));
  
  sign(DigestOrPlainText, sha, #'DSAPrivateKey'{p = P, q = Q, g = G, x = X}) ->
      crypto:sign(dss, sha, DigestOrPlainText, [P, Q, G, X]);
  
  sign(DigestOrPlainText, DigestType, #'ECPrivateKey'{privateKey = PrivKey,
  						    parameters = Param}) ->
      ECCurve = ec_curve_spec(Param),
      crypto:sign(ecdsa, DigestType, DigestOrPlainText, [PrivKey, ECCurve]);
  
  %% Backwards compatible
  sign(Digest, none, #'DSAPrivateKey'{} = Key) ->
      sign({digest,Digest}, sha, Key).
  
  %%--------------------------------------------------------------------
  -spec verify(binary() | {digest, binary()}, rsa_digest_type() | dss_digest_type() | ecdsa_digest_type(),
  	     Signature :: binary(), rsa_public_key()
  	     | dsa_public_key() | ec_public_key()) -> boolean().
  %% Description: Verifies a digital signature.
  %%--------------------------------------------------------------------
  verify(DigestOrPlainText, DigestType, Signature, Key) when is_binary(Signature) ->
      do_verify(DigestOrPlainText, DigestType, Signature, Key);
  verify(_,_,_,_) -> 
      %% If Signature is a bitstring and not a binary we know already at this
      %% point that the signature is invalid.
      false.
  
negative.code: 	 decrypt_public/2, decrypt_public/3,
  	 dh_gex_group/4,
  	 dh_gex_group_sizes/0,
  	 sign/3, sign/4, verify/4, verify/5,
  	 generate_key/1,
  	 compute_key/2, compute_key/3,
  	 pkix_sign/2, pkix_verify/2,	 
  