libsecurity_keychain/lib/SecKeychainItem.h

   1 /*
   2  * Copyright (c) 2000-2008 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25         @header SecKeychainItem
  26         SecKeychainItem implements an item which may be stored in a SecKeychain, with publicly
  27         visible attributes and encrypted data. Access to the data of an item is protected
  28         using strong cryptographic algorithms.
  29 */
  30
  31 #ifndef _SECURITY_SECKEYCHAINITEM_H_
  32 #define _SECURITY_SECKEYCHAINITEM_H_
  33
  34 #include <CoreFoundation/CFData.h>
  35 #include <Security/SecBase.h>
  36 #include <Security/cssmapple.h>
  37
  38 #if defined(__cplusplus)
  39 extern "C" {
  40 #endif
  41
  42 /*!
  43         @typedef SecItemClass
  44         @abstract Represents a keychain item's class.
  45 */
  46 typedef FourCharCode    SecItemClass;
  47
  48 /*!
  49         @enum ItemClassConstants
  50         @abstract Specifies a keychain item's class code.
  51         @constant kSecInternetPasswordItemClass Indicates that the item is an Internet password.
  52         @constant kSecGenericPasswordItemClass Indicates that the item is a generic password.
  53         @constant kSecAppleSharePasswordItemClass Indicates that the item is an AppleShare password.
  54         @constant kSecCertificateItemClass Indicates that the item is a digital certificate.
  55         @constant kSecPublicKeyItemClass Indicates that the item is a public key.
  56         @constant kSecPrivateKeyItemClass Indicates that the item is a private key.
  57         @constant kSecSymmetricKeyItemClass Indicates that the item is a symmetric key.
  58         @discussion The SecItemClass enumeration defines constants your application can use to specify the type of the keychain item you wish to create, dispose, add, delete, update, copy, or locate. You can also use these constants with the tag constant SecItemAttr.
  59 */
  60 enum
  61 {
  62     kSecInternetPasswordItemClass   = 'inet',
  63     kSecGenericPasswordItemClass    = 'genp',
  64     kSecAppleSharePasswordItemClass = 'ashp',
  65     kSecCertificateItemClass        = CSSM_DL_DB_RECORD_X509_CERTIFICATE,
  66     kSecPublicKeyItemClass          = CSSM_DL_DB_RECORD_PUBLIC_KEY,
  67     kSecPrivateKeyItemClass         = CSSM_DL_DB_RECORD_PRIVATE_KEY,
  68     kSecSymmetricKeyItemClass       = CSSM_DL_DB_RECORD_SYMMETRIC_KEY
  69 };
  70
  71 /*!
  72         @typedef SecItemAttr
  73         @abstract Represents a keychain item's attributes.
  74
  75 */
  76 typedef FourCharCode SecItemAttr;
  77
  78 /*!
  79         @enum ItemAttributeConstants
  80         @abstract Specifies keychain item attributes.
  81         @constant kSecCreationDateItemAttr (read-only) Identifies the creation date attribute. You use this tag to get a value of type string that represents the date the item was created, expressed in Zulu Time format ("YYYYMMDDhhmmSSZ"). This format is identical to CSSM_DB_ATTRIBUTE_FORMAT_TIME_DATE (cssmtype.h). When specifying the creation date as input to a function (e.g. SecKeychainSearchCreateFromAttributes), you may alternatively provide a numeric value of type UInt32 or SInt64, expressed as seconds since 1/1/1904 (DateTimeUtils.h).
  82         @constant kSecModDateItemAttr (read-only) Identifies the modification date attribute. You use this tag to get a value of type string that represents the last time the item was updated, expressed in Zulu Time format ("YYYYMMDDhhmmSSZ"). This format is identical to CSSM_DB_ATTRIBUTE_FORMAT_TIME_DATE (cssmtype.h). When specifying the modification date as input to a function (e.g. SecKeychainSearchCreateFromAttributes), you may alternatively provide a numeric value of type UInt32 or SInt64, expressed as seconds since 1/1/1904 (DateTimeUtils.h).
  83         @constant kSecDescriptionItemAttr Identifies the description attribute. You use this tag to set or get a value of type string that represents a user-visible string describing this particular kind of item (e.g. "disk image password").
  84         @constant kSecCommentItemAttr Identifies the comment attribute. You use this tag to set or get a value of type string that represents a user-editable string containing comments for this item.
  85         @constant kSecCreatorItemAttr Identifies the creator attribute. You use this tag to set or get a value of type FourCharCode that represents the item's creator.
  86         @constant kSecTypeItemAttr Identifies the type attribute. You use this tag to set or get a value of type FourCharCode that represents the item's type.
  87         @constant kSecScriptCodeItemAttr Identifies the script code attribute. You use this tag to set or get a value of type ScriptCode that represents the script code for all strings. (Note: use of this attribute is deprecated; string attributes should always be stored in UTF-8 encoding.)
  88         @constant kSecLabelItemAttr Identifies the label attribute. You use this tag to set or get a value of type string that represents a user-editable string containing the label for this item.
  89         @constant kSecInvisibleItemAttr Identifies the invisible attribute. You use this tag to set or get a value of type Boolean that indicates whether the item is invisible (i.e. should not be displayed).
  90         @constant kSecNegativeItemAttr Identifies the negative attribute. You use this tag to set or get a value of type Boolean that indicates whether there is a valid password associated with this keychain item. This is useful if your application doesn't want a password for some particular service to be stored in the keychain, but prefers that it always be entered by the user. The item (typically invisible and with zero-length data) acts as a placeholder to say "don't use me."
  91         @constant kSecCustomIconItemAttr Identifies the custom icon attribute. You use this tag to set or get a value of type Boolean that indicates whether the item has an application-specific icon. To do this, you must also set the attribute value identified by the tag kSecTypeItemAttr to a file type for which there is a corresponding icon in the desktop database, and set the attribute value identified by the tag kSecCreatorItemAttr to an appropriate application creator type. If a custom icon corresponding to the item's type and creator can be found in the desktop database, it will be displayed by Keychain Access. Otherwise, default icons are used. (Note: use of this attribute is deprecated; custom icons for keychain items are not supported in Mac OS X.)
  92         @constant kSecAccountItemAttr Identifies the account attribute. You use this tag to set or get a string that represents the user account. This attribute applies to generic, Internet, and AppleShare password items.
  93         @constant kSecServiceItemAttr Identifies the service attribute. You use this tag to set or get a string that represents the service associated with this item. This attribute is unique to generic password items.
  94         @constant kSecGenericItemAttr Identifies the generic attribute. You use this tag to set or get a value of untyped bytes that represents a user-defined attribute.  This attribute is unique to generic password items.
  95         @constant kSecSecurityDomainItemAttr Identifies the security domain attribute. You use this tag to set or get a value that represents the Internet security domain. This attribute is unique to Internet password items.
  96         @constant kSecServerItemAttr Identifies the server attribute. You use this tag to set or get a value of type string that represents the Internet server's domain name or IP address. This attribute is unique to Internet password items.
  97         @constant kSecAuthenticationTypeItemAttr Identifies the authentication type attribute. You use this tag to set or get a value of type SecAuthenticationType that represents the Internet authentication scheme. This attribute is unique to Internet password items.
  98         @constant kSecPortItemAttr Identifies the port attribute. You use this tag to set or get a value of type UInt32 that represents the Internet port number. This attribute is unique to Internet password items.
  99         @constant kSecPathItemAttr Identifies the path attribute. You use this tag to set or get a string value that represents the path. This attribute is unique to Internet password items.
 100         @constant kSecVolumeItemAttr Identifies the volume attribute. You use this tag to set or get a string value that represents the AppleShare volume. This attribute is unique to AppleShare password items.
 101         @constant kSecAddressItemAttr Identifies the address attribute. You use this tag to set or get a string value that represents the AppleTalk zone name, or the IP or domain name that represents the server address. This attribute is unique to AppleShare password items.
 102         @constant kSecSignatureItemAttr Identifies the server signature attribute. You use this tag to set or get a value of type SecAFPServerSignature that represents the server signature block. This attribute is unique to AppleShare password items.
 103         @constant kSecProtocolItemAttr Identifies the protocol attribute. You use this tag to set or get a value of type SecProtocolType that represents the Internet protocol. This attribute applies to AppleShare and Internet password items.
 104         @constant kSecCertificateType Indicates a CSSM_CERT_TYPE type.
 105         @constant kSecCertificateEncoding Indicates a CSSM_CERT_ENCODING type.
 106         @constant kSecCrlType Indicates a CSSM_CRL_TYPE type.
 107         @constant kSecCrlEncoding Indicates a CSSM_CRL_ENCODING type.
 108         @constant kSecAlias Indicates an alias.
 109         @discussion To obtain information about a certificate, use the CDSA Certificate Library (CL) API. To obtain information about a key, use the SecKeyGetCSSMKey function and the CDSA Cryptographic Service Provider (CSP) API.
 110 */
 111 enum
 112 {
 113     kSecCreationDateItemAttr            = 'cdat',
 114     kSecModDateItemAttr                         = 'mdat',
 115     kSecDescriptionItemAttr                     = 'desc',
 116     kSecCommentItemAttr                         = 'icmt',
 117     kSecCreatorItemAttr                         = 'crtr',
 118     kSecTypeItemAttr                            = 'type',
 119     kSecScriptCodeItemAttr                      = 'scrp',
 120     kSecLabelItemAttr                           = 'labl',
 121     kSecInvisibleItemAttr                       = 'invi',
 122     kSecNegativeItemAttr                        = 'nega',
 123     kSecCustomIconItemAttr                      = 'cusi',
 124     kSecAccountItemAttr                         = 'acct',
 125     kSecServiceItemAttr                         = 'svce',
 126     kSecGenericItemAttr                         = 'gena',
 127     kSecSecurityDomainItemAttr          = 'sdmn',
 128     kSecServerItemAttr                          = 'srvr',
 129     kSecAuthenticationTypeItemAttr      = 'atyp',
 130     kSecPortItemAttr                            = 'port',
 131     kSecPathItemAttr                            = 'path',
 132     kSecVolumeItemAttr                          = 'vlme',
 133     kSecAddressItemAttr                         = 'addr',
 134     kSecSignatureItemAttr                       = 'ssig',
 135     kSecProtocolItemAttr                        = 'ptcl',
 136         kSecCertificateType                             = 'ctyp',
 137         kSecCertificateEncoding                 = 'cenc',
 138         kSecCrlType                                             = 'crtp',
 139         kSecCrlEncoding                                 = 'crnc',
 140         kSecAlias                                               = 'alis'
 141 };
 142
 143 /*!
 144         @typedef SecAFPServerSignature
 145         @abstract Represents a 16-byte Apple File Protocol server signature block.
 146 */
 147 typedef UInt8   SecAFPServerSignature[16];
 148
 149 /*!
 150         @typedef SecPublicKeyHash
 151         @abstract Represents a 20-byte public key hash.
 152 */
 153 typedef UInt8   SecPublicKeyHash[20];
 154
 155 #pragma mark ---- Keychain Item Management ----
 156 /*!
 157         @function SecKeychainItemGetTypeID
 158         @abstract Returns the type identifier of SecKeychainItem instances.
 159         @result The CFTypeID of SecKeychainItem instances.
 160 */
 161 CFTypeID SecKeychainItemGetTypeID(void);
 162
 163 /*!
 164         @function SecKeychainItemModifyAttributesAndData
 165         @abstract Updates an existing keychain item after changing its attributes or data.
 166         @param itemRef A reference to the keychain item to modify.
 167         @param attrList The list of attributes to modify, along with their new values. Pass NULL if you don't need to modify any attributes.
 168         @param length The length of the buffer pointed to by data.
 169         @param data Pointer to a buffer containing the data to store. Pass NULL if you don't need to modify the data.
 170     @result A result code. See "Security Error Codes" (SecBase.h).
 171         @discussion The keychain item is written to the keychain's permanent data store. If the keychain item has not previously been added to a keychain, a call to the SecKeychainItemModifyContent function does nothing and returns noErr.
 172 */
 173 OSStatus SecKeychainItemModifyAttributesAndData(SecKeychainItemRef itemRef, const SecKeychainAttributeList *attrList, UInt32 length, const void *data);
 174
 175 /*!
 176         @function SecKeychainItemCreateFromContent
 177         @abstract Creates a new keychain item from the supplied parameters.
 178         @param itemClass A constant identifying the class of item to create.
 179         @param attrList The list of attributes of the item to create.
 180         @param length The length of the buffer pointed to by data.
 181         @param data A pointer to a buffer containing the data to store.
 182         @param initialAccess A reference to the access for this keychain item.
 183     @param keychainRef A reference to the keychain in which to add the item.
 184         @param itemRef On return, a pointer to a reference to the newly created keychain item (optional). When the item reference is no longer required, call CFRelease to deallocate memory occupied by the item.
 185     @result A result code. See "Security Error Codes" (SecBase.h). In addition, paramErr (-50) may be returned if not enough valid parameters are supplied, or memFullErr (-108) if there is not enough memory in the current heap zone to create the object.
 186 */
 187 OSStatus SecKeychainItemCreateFromContent(SecItemClass itemClass, SecKeychainAttributeList *attrList,
 188                 UInt32 length, const void *data, SecKeychainRef keychainRef,
 189                 SecAccessRef initialAccess, SecKeychainItemRef *itemRef);
 190
 191 /*!
 192         @function SecKeychainItemModifyContent
 193         @abstract Updates an existing keychain item after changing its attributes or data. This call should only be used in conjunction with SecKeychainItemCopyContent().
 194         @param itemRef A reference to the keychain item to modify.
 195         @param attrList The list of attributes to modify, along with their new values. Pass NULL if you don't need to modify any attributes.
 196         @param length The length of the buffer pointed to by data.
 197         @param data A pointer to a buffer containing the data to store. Pass NULL if you don't need to modify the data.
 198     @result A result code.  See "Security Error Codes" (SecBase.h).
 199 */
 200 OSStatus SecKeychainItemModifyContent(SecKeychainItemRef itemRef, const SecKeychainAttributeList *attrList, UInt32 length, const void *data);
 201
 202 /*!
 203         @function SecKeychainItemCopyContent
 204         @abstract Copies the data and/or attributes stored in the given keychain item. It is recommended that you use SecKeychainItemCopyAttributesAndData(). You must call SecKeychainItemFreeContent when you no longer need the attributes and data. If you want to modify the attributes returned here, use SecKeychainModifyContent().
 205         @param itemRef A reference to the keychain item to modify.
 206         @param itemClass On return, the item's class. Pass NULL if you don't require this information.
 207         @param attrList On input, the list of attributes to retrieve. On output, the attributes are filled in. Pass NULL if you don't need to retrieve any attributes. You must call SecKeychainItemFreeContent when you no longer need the attributes.
 208         @param length On return, the length of the buffer pointed to by outData.
 209         @param outData On return, a pointer to a buffer containing the data in this item. Pass NULL if you don't need to retrieve the data. You must call SecKeychainItemFreeContent when you no longer need the data.
 210     @result A result code. See "Security Error Codes" (SecBase.h). In addition, paramErr (-50) may be returned if not enough valid parameters are supplied.
 211 */
 212 OSStatus SecKeychainItemCopyContent(SecKeychainItemRef itemRef, SecItemClass *itemClass, SecKeychainAttributeList *attrList, UInt32 *length, void **outData);
 213
 214 /*!
 215         @function SecKeychainItemFreeContent
 216         @abstract Releases the memory used by the keychain attribute list and the keychain data retrieved in a previous call to SecKeychainItemCopyContent.
 217         @param attrList A pointer to the attribute list to release. Pass NULL to ignore this parameter.
 218     @param data A pointer to the data buffer to release. Pass NULL to ignore this parameter.
 219 */
 220 OSStatus SecKeychainItemFreeContent(SecKeychainAttributeList *attrList, void *data);
 221
 222 /*!
 223         @function SecKeychainItemCopyAttributesAndData
 224         @abstract Copies the data and/or attributes stored in the given keychain item. You must call SecKeychainItemFreeAttributesAndData when you no longer need the attributes and data. If you want to modify the attributes returned here, use SecKeychainModifyAttributesAndData.
 225         @param itemRef A reference to the keychain item to copy.
 226         @param info A list of tags and formats of the attributes you wish to retrieve. Pass NULL if you don't need to retrieve any attributes. You can call SecKeychainAttributeInfoForItemID to obtain a list with all possible attribute tags and formats for the item's class.
 227         @param itemClass On return, the item's class. Pass NULL if you don't require this information.
 228         @param attrList On return, a pointer to the list of retrieved attributes. Pass NULL if you don't need to retrieve any attributes. You must call SecKeychainItemFreeAttributesAndData when you no longer need this list.
 229         @param length On return, the length of the buffer pointed to by outData.
 230         @param outData On return, a pointer to a buffer containing the data in this item. Pass NULL if you don't need to retrieve the data. You must call SecKeychainItemFreeAttributesAndData when you no longer need the data.
 231     @result A result code. See "Security Error Codes" (SecBase.h). In addition, paramErr (-50) may be returned if not enough valid parameters are supplied.
 232 */
 233 OSStatus SecKeychainItemCopyAttributesAndData(SecKeychainItemRef itemRef, SecKeychainAttributeInfo *info, SecItemClass *itemClass, SecKeychainAttributeList **attrList, UInt32 *length, void **outData);
 234
 235 /*!
 236         @function SecKeychainItemFreeAttributesAndData
 237         @abstract Releases the memory used by the keychain attribute list and the keychain data retrieved in a previous call to SecKeychainItemCopyAttributesAndData.
 238         @param attrList A pointer to the attribute list to release. Pass NULL to ignore this parameter.
 239     @param data A pointer to the data buffer to release. Pass NULL to ignore this parameter.
 240     @result A result code. See "Security Error Codes" (SecBase.h).
 241 */
 242 OSStatus SecKeychainItemFreeAttributesAndData(SecKeychainAttributeList *attrList, void *data);
 243
 244 /*!
 245         @function SecKeychainItemDelete
 246         @abstract Deletes a keychain item from the default keychain's permanent data store.
 247         @param itemRef A keychain item reference of the item to delete.
 248     @result A result code. See "Security Error Codes" (SecBase.h).
 249         @discussion If itemRef has not previously been added to the keychain, SecKeychainItemDelete does nothing and returns noErr. IMPORTANT: SecKeychainItemDelete does not dispose the memory occupied by the item reference itself; use the CFRelease function when you are completely finished with an item.
 250 */
 251 OSStatus SecKeychainItemDelete(SecKeychainItemRef itemRef);
 252
 253 /*!
 254         @function SecKeychainItemCopyKeychain
 255         @abstract Copies an existing keychain reference from a keychain item.
 256         @param itemRef A keychain item reference.
 257         @param keychainRef On return, the keychain reference for the specified item. Release this reference by calling the CFRelease function.
 258     @result A result code. See "Security Error Codes" (SecBase.h).
 259 */
 260 OSStatus SecKeychainItemCopyKeychain(SecKeychainItemRef itemRef, SecKeychainRef *keychainRef);
 261
 262 /*!
 263         @function SecKeychainItemCreateCopy
 264         @abstract Copies a keychain item.
 265         @param itemRef A reference to the keychain item to copy.
 266         @param destKeychainRef A reference to the keychain in which to insert the copied keychain item.
 267         @param initialAccess The initial access for the copied keychain item.
 268         @param itemCopy On return, a reference to the copied keychain item.
 269     @result A result code. See "Security Error Codes" (SecBase.h).
 270 */
 271 OSStatus SecKeychainItemCreateCopy(SecKeychainItemRef itemRef, SecKeychainRef destKeychainRef,
 272         SecAccessRef initialAccess, SecKeychainItemRef *itemCopy);
 273
 274 /*!
 275     @function SecKeychainItemCreatePersistentReference
 276     @abstract Returns a CFDataRef which can be used as a persistent reference to the given keychain item. The data obtained can be turned back into a SecKeychainItemRef later by calling SecKeychainItemCopyFromPersistentReference().
 277     @param itemRef A reference to a keychain item.
 278     @param persistentItemRef On return, a CFDataRef containing a persistent reference. You must release this data reference by calling the CFRelease function.
 279     @result A result code. See "Security Error Codes" (SecBase.h).
 280 */
 281 OSStatus SecKeychainItemCreatePersistentReference(SecKeychainItemRef itemRef, CFDataRef *persistentItemRef);
 282
 283
 284 /*!
 285     @function SecKeychainItemCopyFromPersistentReference
 286     @abstract Returns a SecKeychainItemRef, given a persistent reference previously obtained by calling SecKeychainItemCreatePersistentReference().
 287     @param persistentItemRef A CFDataRef containing a persistent reference to a keychain item.
 288     @param itemRef On return, a SecKeychainItemRef for the keychain item described by the persistent reference. You must release this item reference by calling the CFRelease function.
 289     @result A result code. See "Security Error Codes" (SecBase.h).
 290 */
 291 OSStatus SecKeychainItemCopyFromPersistentReference(CFDataRef persistentItemRef, SecKeychainItemRef *itemRef);
 292
 293
 294 #pragma mark ---- CSSM Bridge Functions ----
 295 /*!
 296     @function SecKeychainItemGetDLDBHandle
 297     @abstract Returns the CSSM_DL_DB_HANDLE for a given keychain item reference.
 298     @param keyItemRef A keychain item reference.
 299     @param dldbHandle On return, a CSSM_DL_DB_HANDLE for the keychain database containing the given item. The handle is valid until the keychain reference is released.
 300     @result A result code. See "Security Error Codes" (SecBase.h).
 301         @discussion This API is deprecated for 10.7. It should no longer be needed.
 302 */
 303 OSStatus SecKeychainItemGetDLDBHandle(SecKeychainItemRef keyItemRef, CSSM_DL_DB_HANDLE *dldbHandle)
 304         DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER;
 305
 306 /*!
 307         @function SecKeychainItemGetUniqueRecordID
 308         @abstract Returns a CSSM_DB_UNIQUE_RECORD for the given keychain item reference.
 309         @param itemRef A keychain item reference.
 310     @param uniqueRecordID On return, a pointer to a CSSM_DB_UNIQUE_RECORD structure for the given item. The unique record is valid until the item reference is released.
 311     @result A result code. See "Security Error Codes" (SecBase.h).
 312         @discussion This API is deprecated for 10.7. It should no longer be needed.
 313 */
 314 OSStatus SecKeychainItemGetUniqueRecordID(SecKeychainItemRef itemRef, const CSSM_DB_UNIQUE_RECORD **uniqueRecordID)
 315         DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER;
 316
 317 #pragma mark ---- Keychain Item Access Management ----
 318 /*!
 319         @function SecKeychainItemCopyAccess
 320         @abstract Copies the access of a given keychain item.
 321         @param itemRef A reference to a keychain item.
 322     @param access On return, a reference to the keychain item's access.
 323     @result A result code. See "Security Error Codes" (SecBase.h).
 324 */
 325 OSStatus SecKeychainItemCopyAccess(SecKeychainItemRef itemRef, SecAccessRef *access);
 326
 327 /*!
 328         @function SecKeychainItemSetAccess
 329         @abstract Sets the access of a given keychain item.
 330         @param itemRef A reference to a keychain item.
 331     @param access A reference to an access to replace the keychain item's current access.
 332     @result A result code. See "Security Error Codes" (SecBase.h).
 333 */
 334 OSStatus SecKeychainItemSetAccess(SecKeychainItemRef itemRef, SecAccessRef access);
 335
 336 #if defined(__cplusplus)
 337 }
 338 #endif
 339
 340 #endif /* !_SECURITY_SECKEYCHAINITEM_H_ */