[gnutls-devel] GnuTLS | gnutls certtool pkcs12 export doesn't let selecting a PRF (#1682)

[Read-only notification of GnuTLS library development activities]

Zoltán Fridrich created an issue: https://gitlab.com/gnutls/gnutls/-/issues/1682



certtool --to-p12 always uses hmacWithSHA256
How reproducible: always

Steps to Reproduce:
1. openssl req -x509 -newkey rsa -keyout localhost.key -out localhost.crt -subj /CN=localhost -nodes -batch
2. certtool --to-p12 --outder --p12-name localhost --load-certificate localhost.crt --load-privkey localhost.key --outfile p12 --password pass --hash SHA512
3. openssl pkcs12 -in p12 -info -nodes -noout -passin pass:pass

Actual results:
MAC: sha512, Iteration 600000
MAC length: 64, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA256
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA256

Expected results:
MAC: sha512, Iteration 600000
MAC length: 64, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA512
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-128-CBC, Iteration 600000, PRF hmacWithSHA512

Additional info:

    maybe the control doesn't have to be --hash
    int gnutls_pkcs12_bag_encrypt(gnutls_pkcs12_bag_t bag, const char * pass, unsigned int /gnutls_pkcs_encrypt_flags_t/ flags)
    doesn't have a readily available avenue to pass a choice of a PRF, so this might entail quite some work
    code reference: https://gitlab.com/gnutls/gnutls/-/blob/c87f5aa5fd5a807a4444e428063db3f8635d378d/lib/x509/pkcs7-crypt.c#L1579
    wishlist-grade, as this should be workaroundable

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1682
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20250311/0a5b5dd2/attachment-0001.html>