static size_t der_sizeof_pbkdf2_params(size_t saltLen, const uint8_t *salt,
                                       unsigned long iterationCount,
                                       unsigned long keyLength)
{
    size_t body_size = ccder_sizeof_raw_octet_string(saltLen)
                     + ccder_sizeof_uint64(iterationCount)
                     + ccder_sizeof_uint64(keyLength)
                     + der_sizeof_SecAsn1Oid(&CSSMOID_PKCS5_HMAC_SHA1);

    return ccder_sizeof(CCDER_CONSTRUCTED_SEQUENCE, body_size);
}
size_t der_sizeof_RecoveryKeyBag(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error) {
    size_t result = 0;
    if(RecoveryKeyBag && RecoveryKeyBag->recoveryKeyBag && RecoveryKeyBag->accountDSID && RecoveryKeyBag->generation) {
        size_t partSize = der_sizeof_string(RecoveryKeyBag->accountDSID, NULL);
        partSize += SOSGenCountGetDEREncodedSize(RecoveryKeyBag->generation, NULL);
        partSize += ccder_sizeof_uint64(RecoveryKeyBag->rkbVersion);
        partSize += der_sizeof_data(RecoveryKeyBag->recoveryKeyBag, NULL);
        result = ccder_sizeof(CCDER_CONSTRUCTED_SEQUENCE, partSize);
    } else {
        SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Null RecoveryKeyBag"), NULL, error);
    }
    return result;
}