Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Documentation for Pkcs12::builder is incorrect for OpenSSL 3 #1552

Closed
kazk opened this issue Nov 5, 2021 · 1 comment
Closed

Documentation for Pkcs12::builder is incorrect for OpenSSL 3 #1552

kazk opened this issue Nov 5, 2021 · 1 comment

Comments

@kazk
Copy link

kazk commented Nov 5, 2021

PKCS#12 API updates

The default algorithms for pkcs12 creation with the PKCS12_create() function were changed to more modern PBKDF2 and AES based algorithms. The default MAC iteration count was changed to PKCS12_DEFAULT_ITER to make it equal with the password-based encryption iteration count. The default digest algorithm for the MAC computation was changed to SHA-256. The pkcs12 application now supports -legacy option that restores the previous default algorithms to support interoperability with legacy systems.
https://www.openssl.org/docs/man3.0/man7/migration_guide.html#PKCS-12-API-updates

OpenSSL 3 changed the default encryption algorithms to Nid::AES_256_CBC. openssl/openssl@762970b

/// Creates a new builder for a protected pkcs12 certificate.
///
/// This uses the defaults from the OpenSSL library:
///
/// * `nid_key` - `nid::PBE_WITHSHA1AND3_KEY_TRIPLEDES_CBC`
/// * `nid_cert` - `nid::PBE_WITHSHA1AND40BITRC2_CBC`

A user reported a problem on macOS after a recent patch bump, and apparently the Security Framework fails to import modern PKCS#12. https://openradar.appspot.com/FB8988319

@sfackler
Copy link
Owner

sfackler commented Nov 5, 2021

Fixed in db2b0d7. I'm also adding support to load providers (like the legacy provider that would support the old algorithms), but need to figure out what to do about openssl/openssl#16970 first.

@sfackler sfackler closed this as completed Nov 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants