Add AES support for PKCS12StoreBuilder #596
Open
+331
−272
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Describe your changes
The PKCS12StoreBuilder lacks support and documented examples for creating PKCS#12 with modern algorithms, e.g. AES. This is described in #234 .
Specifically, the key encryption with AES (e.g. PBES2 with AES + PBKDF2 with SHA) works, but has no test, while the certificate encryption seems to require legacy algorithms and seemingly doesn't support using no encryption. The latest OpenSSL versions prohibit the use of legacy cryptography, so I believe they cannot open these PKCS#12 files.
The code change founds on another PR, #595 to allow testing the new code. PR #595 comprises the first Commit 728e80d.
This change adds a test for creating a PKCS#12 with AES. This is commit 4c60183.
Finally, commit 67f6e1a removes the requirement to encrypt certificates, which only supports legacy algorithms. This way, BC supports creating a PKCS#12 without any legacy algorithms. This is actually a regression fix, as it used to work with a previous version of BC that allowed construction AlgorithmIdentifier with a null OID. Commit e2544b0 prevent this, so it wasn't possibly anymore.
It is probably still not possible to encrypt certificates with modern algorithms, but I don't actually need this, so I consider my work done. I am not sure whether it is sufficient for #234.
How has this been tested?
There is a new test for AES. It succeeds on my Windows system with Visual Studio 17.12.3.
Checklist before requesting a review
See also Contributing Guidelines.