public DefaultTlsAgreementCredentials(Certificate certificate, AsymmetricKeyParameter privateKey)
        {
            if (certificate == null)
                throw new ArgumentNullException("certificate");
            if (certificate.IsEmpty)
                throw new ArgumentException("cannot be empty", "certificate");
            if (privateKey == null)
                throw new ArgumentNullException("privateKey");
            if (!privateKey.IsPrivate)
                throw new ArgumentException("must be private", "privateKey");

            if (privateKey is DHPrivateKeyParameters)
            {
                mBasicAgreement = new DHBasicAgreement();
                mTruncateAgreement = true;
            }
            else if (privateKey is ECPrivateKeyParameters)
            {
                mBasicAgreement = new ECDHBasicAgreement();
                mTruncateAgreement = false;
            }
            else
            {
                throw new ArgumentException("type not supported: " + privateKey.GetType().FullName, "privateKey");
            }

            this.mCertificate = certificate;
            this.mPrivateKey = privateKey;
        }

		public virtual byte[] CalculateRawSignature(SecureRandom random,
			AsymmetricKeyParameter privateKey, byte[] md5andsha1)
		{
			ISigner s = MakeSigner(new NullDigest(), true, new ParametersWithRandom(privateKey, random));
			s.BlockUpdate(md5andsha1, 0, md5andsha1.Length);
			return s.GenerateSignature();
		}

		public virtual bool VerifyRawSignature(byte[] sigBytes, AsymmetricKeyParameter publicKey,
			byte[] md5andsha1)
		{
			ISigner s = MakeSigner(new NullDigest(), false, publicKey);
			s.BlockUpdate(md5andsha1, 0, md5andsha1.Length);
			return s.VerifySignature(sigBytes);
		}

		public bool VerifyRawSignature(byte[] sigBytes, AsymmetricKeyParameter publicKey, byte[] md5andsha1)
		{
			ISigner s = MakeSigner(new NullDigest(), false, publicKey);
			// Note: Only use the SHA1 part of the hash
			s.BlockUpdate(md5andsha1, 16, 20);
			return s.VerifySignature(sigBytes);
		}

 public override bool VerifyRawSignature(SignatureAndHashAlgorithm algorithm, byte[] sigBytes,
     AsymmetricKeyParameter publicKey, byte[] hash)
 {
     ISigner signer = MakeSigner(algorithm, true, false, publicKey);
     signer.BlockUpdate(hash, 0, hash.Length);
     return signer.VerifySignature(sigBytes);
 }

 public virtual byte[] GenerateRawSignature(SecureRandom random,
     AsymmetricKeyParameter privateKey, byte[] md5AndSha1)
 {
     IAsymmetricBlockCipher engine = CreateRsaImpl();
     engine.Init(true, new ParametersWithRandom(privateKey, random));
     return engine.ProcessBlock(md5AndSha1, 0, md5AndSha1.Length);
 }

 public virtual bool VerifyRawSignature(byte[] sigBytes, AsymmetricKeyParameter publicKey,
     byte[] md5AndSha1)
 {
     IAsymmetricBlockCipher engine = CreateRsaImpl();
     engine.Init(false, publicKey);
     byte[] signed = engine.ProcessBlock(sigBytes, 0, sigBytes.Length);
     return Arrays.ConstantTimeAreEqual(signed, md5AndSha1);
 }

 public virtual byte[] CalculateRawSignature(SecureRandom random,
     AsymmetricKeyParameter privateKey, byte[] md5andsha1)
 {
     ISigner sig = new GenericSigner(new Pkcs1Encoding(new RsaBlindedEngine()), new NullDigest());
     sig.Init(true, new ParametersWithRandom(privateKey, random));
     sig.BlockUpdate(md5andsha1, 0, md5andsha1.Length);
     return sig.GenerateSignature();
 }

		public virtual byte[] CalculateRawSignature(SecureRandom random,
			AsymmetricKeyParameter privateKey, byte[] md5andsha1)
		{
			ISigner s = MakeSigner(new NullDigest(), true, new ParametersWithRandom(privateKey, random));
			// Note: Only use the SHA1 part of the hash
			s.BlockUpdate(md5andsha1, 16, 20);
			return s.GenerateSignature();
		}

 public override byte[] GenerateRawSignature(SignatureAndHashAlgorithm algorithm,
     AsymmetricKeyParameter privateKey, byte[] hash)
 {
     ISigner signer = MakeSigner(algorithm, true, true,
         new ParametersWithRandom(privateKey, this.mContext.SecureRandom));
     signer.BlockUpdate(hash, 0, hash.Length);
     return signer.GenerateSignature();
 }

        /// <exception cref="IOException"></exception>
        public override byte[] GenerateAgreement(AsymmetricKeyParameter peerPublicKey)
        {
            mBasicAgreement.Init(mPrivateKey);
            BigInteger agreementValue = mBasicAgreement.CalculateAgreement(peerPublicKey);

            if (mTruncateAgreement)
            {
                return BigIntegers.AsUnsignedByteArray(agreementValue);
            }

            return BigIntegers.AsUnsignedByteArray(mBasicAgreement.GetFieldSize(), agreementValue);
        }

        public virtual byte[] GenerateAgreement(AsymmetricKeyParameter serverPublicKey)
        {
            basicAgreement.Init(clientPrivateKey);
            BigInteger agreementValue = basicAgreement.CalculateAgreement(serverPublicKey);

            if (truncateAgreement)
            {
                return BigIntegers.AsUnsignedByteArray(agreementValue);
            }

            return BigIntegers.AsUnsignedByteArray(basicAgreement.GetFieldSize(), agreementValue);
        }

 public override bool VerifyRawSignature(SignatureAndHashAlgorithm algorithm, byte[] sigBytes,
     AsymmetricKeyParameter publicKey, byte[] hash)
 {
     ISigner signer = MakeSigner(algorithm, true, false, publicKey);
     if (algorithm == null)
     {
         // Note: Only use the SHA1 part of the (MD5/SHA1) hash
         signer.BlockUpdate(hash, 16, 20);
     }
     else
     {
         signer.BlockUpdate(hash, 0, hash.Length);
     }
     return signer.VerifySignature(sigBytes);
 }

 public override byte[] GenerateRawSignature(SignatureAndHashAlgorithm algorithm,
     AsymmetricKeyParameter privateKey, byte[] hash)
 {
     ISigner signer = MakeSigner(algorithm, true, true,
         new ParametersWithRandom(privateKey, this.mContext.SecureRandom));
     if (algorithm == null)
     {
         // Note: Only use the SHA1 part of the (MD5/SHA1) hash
         signer.BlockUpdate(hash, 16, 20);
     }
     else
     {
         signer.BlockUpdate(hash, 0, hash.Length);
     }
     return signer.GenerateSignature();
 }

        public DefaultTlsSignerCredentials(TlsClientContext context,
            Certificate clientCertificate, AsymmetricKeyParameter clientPrivateKey)
        {
            if (clientCertificate == null)
            {
                throw new ArgumentNullException("clientCertificate");
            }
            if (clientCertificate.Length == 0)
            {
                throw new ArgumentException("cannot be empty", "clientCertificate");
            }
            if (clientPrivateKey == null)
            {
                throw new ArgumentNullException("clientPrivateKey");
            }
            if (!clientPrivateKey.IsPrivate)
            {
                throw new ArgumentException("must be private", "clientPrivateKey");
            }

            if (clientPrivateKey is RsaKeyParameters)
            {
                clientSigner = new TlsRsaSigner();
            }
            else if (clientPrivateKey is DsaPrivateKeyParameters)
            {
                clientSigner = new TlsDssSigner();
            }
            else if (clientPrivateKey is ECPrivateKeyParameters)
            {
                clientSigner = new TlsECDsaSigner();
            }
            else
            {
                throw new ArgumentException("type not supported: "
                    + clientPrivateKey.GetType().FullName, "clientPrivateKey");
            }

            this.context = context;
            this.clientCert = clientCertificate;
            this.clientPrivateKey = clientPrivateKey;
        }

        public DefaultTlsAgreementCredentials(Certificate clientCertificate, AsymmetricKeyParameter clientPrivateKey)
        {
            if (clientCertificate == null)
            {
                throw new ArgumentNullException("clientCertificate");
            }
            if (clientCertificate.Length == 0)
            {
                throw new ArgumentException("cannot be empty", "clientCertificate");
            }
            if (clientPrivateKey == null)
            {
                throw new ArgumentNullException("clientPrivateKey");
            }
            if (!clientPrivateKey.IsPrivate)
            {
                throw new ArgumentException("must be private", "clientPrivateKey");
            }

            if (clientPrivateKey is DHPrivateKeyParameters)
            {
                basicAgreement = new DHBasicAgreement();
                truncateAgreement = true;
            }
            else if (clientPrivateKey is ECPrivateKeyParameters)
            {
                basicAgreement = new ECDHBasicAgreement();
                truncateAgreement = false;
            }
            else
            {
                throw new ArgumentException("type not supported: "
                    + clientPrivateKey.GetType().FullName, "clientPrivateKey");
            }

            this.clientCert = clientCertificate;
            this.clientPrivateKey = clientPrivateKey;
        }

        public DefaultTlsSignerCredentials(TlsContext context, Certificate certificate, AsymmetricKeyParameter privateKey,
            SignatureAndHashAlgorithm signatureAndHashAlgorithm)
        {
            if (certificate == null)
                throw new ArgumentNullException("certificate");
            if (certificate.IsEmpty)
                throw new ArgumentException("cannot be empty", "clientCertificate");
            if (privateKey == null)
                throw new ArgumentNullException("privateKey");
            if (!privateKey.IsPrivate)
                throw new ArgumentException("must be private", "privateKey");
            if (TlsUtilities.IsTlsV12(context) && signatureAndHashAlgorithm == null)
                throw new ArgumentException("cannot be null for (D)TLS 1.2+", "signatureAndHashAlgorithm");

            if (privateKey is RsaKeyParameters)
            {
                mSigner = new TlsRsaSigner();
            }
            else if (privateKey is DsaPrivateKeyParameters)
            {
                mSigner = new TlsDssSigner();
            }
            else if (privateKey is ECPrivateKeyParameters)
            {
                mSigner = new TlsECDsaSigner();
            }
            else
            {
                throw new ArgumentException("type not supported: " + privateKey.GetType().FullName, "privateKey");
            }

            this.mSigner.Init(context);

            this.mContext = context;
            this.mCertificate = certificate;
            this.mPrivateKey = privateKey;
            this.mSignatureAndHashAlgorithm = signatureAndHashAlgorithm;
        }

        public DefaultTlsEncryptionCredentials(TlsContext context, Certificate certificate,
            AsymmetricKeyParameter privateKey)
        {
            if (certificate == null)
                throw new ArgumentNullException("certificate");
            if (certificate.IsEmpty)
                throw new ArgumentException("cannot be empty", "certificate");
            if (privateKey == null)
                throw new ArgumentNullException("'privateKey' cannot be null");
            if (!privateKey.IsPrivate)
                throw new ArgumentException("must be private", "privateKey");

            if (privateKey is RsaKeyParameters)
            {
            }
            else
            {
                throw new ArgumentException("type not supported: " + Platform.GetTypeName(privateKey), "privateKey");
            }

            this.mContext = context;
            this.mCertificate = certificate;
            this.mPrivateKey = privateKey;
        }

 /// <exception cref="IOException"></exception>
 public abstract byte[] GenerateAgreement(AsymmetricKeyParameter peerPublicKey);

 public override bool IsValidPublicKey(AsymmetricKeyParameter publicKey)
 {
     return publicKey is DsaPublicKeyParameters;
 }