Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AES support for PKCS12StoreBuilder #596

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

bb-froggy
Copy link

@bb-froggy bb-froggy commented Jan 28, 2025

Describe your changes

The PKCS12StoreBuilder lacks support and documented examples for creating PKCS#12 with modern algorithms, e.g. AES. This is described in #234 .

Specifically, the key encryption with AES (e.g. PBES2 with AES + PBKDF2 with SHA) works, but has no test, while the certificate encryption seems to require legacy algorithms and seemingly doesn't support using no encryption. The latest OpenSSL versions prohibit the use of legacy cryptography, so I believe they cannot open these PKCS#12 files.

The code change founds on another PR, #595 to allow testing the new code. PR #595 comprises the first Commit 728e80d.

This change adds a test for creating a PKCS#12 with AES. This is commit 4c60183.

Finally, commit 67f6e1a removes the requirement to encrypt certificates, which only supports legacy algorithms. This way, BC supports creating a PKCS#12 without any legacy algorithms. This is actually a regression fix, as it used to work with a previous version of BC that allowed construction AlgorithmIdentifier with a null OID. Commit e2544b0 prevent this, so it wasn't possibly anymore.

It is probably still not possible to encrypt certificates with modern algorithms, but I don't actually need this, so I consider my work done. I am not sure whether it is sufficient for #234.

How has this been tested?

There is a new test for AES. It succeeds on my Windows system with Visual Studio 17.12.3.

Checklist before requesting a review

  • I have performed a self-review of my code
  • I have kept the patch limited to only change the parts related to the patch
  • This change requires a documentation update

See also Contributing Guidelines.

@bb-froggy bb-froggy marked this pull request as ready for review January 28, 2025 08:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant