Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pkcs5: allow empty algId prf parameter for PBES2 params #1521

Merged
merged 5 commits into from
Sep 17, 2024

Conversation

ancwrd1
Copy link
Contributor

@ancwrd1 ancwrd1 commented Sep 16, 2024

Rationale: some applications and libraries produce PBES2/PBKDF2 structures without the terminating NULL value specified in the prf algorithm field.
This PR relaxes the decoding requirements.

According to RFC4231 the NULL parameter should be present but is not an absolute requirement.

See for example this issue: ancwrd1/p12-keystore#2

@tarcieri
Copy link
Member

some applications and libraries produce PBES2/PBKDF2 structures without the terminating NULL value specified in the prf algorithm field.

Which ones? Can you include a reference as to how the test vector you're providing was generated, at least in the comments?

@ancwrd1
Copy link
Contributor Author

ancwrd1 commented Sep 17, 2024

Specifically, this: https://github.com/smallstep/cli
It produces PKCS#12 file without the algorithm parameter value. It works fine with e.g. openssl or Java KeyStore API, but fails with my p12-keystore crate which is based on RustCrypto.

I have added a note in the comments.

@tarcieri tarcieri merged commit 895dbdf into RustCrypto:master Sep 17, 2024
10 checks passed
@tarcieri tarcieri changed the title Allow PBES2 encoding without NULL value for the algId prf parameter pkcs5: allow empty algId prf parameter for PBES2 params Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants