Skip to content

Commit 05ff129

Browse files
authored
Merge pull request #8864 from kojiws/improve_pkcs12_export_params
Apply 16 bytes salt length for PBES2 key encryption on wc_PKCS12_create()
2 parents e74214d + ff1baf0 commit 05ff129

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

wolfcrypt/src/pkcs12.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1830,6 +1830,8 @@ static int wc_PKCS12_shroud_key(WC_PKCS12* pkcs12, WC_RNG* rng,
18301830
word32 totalSz = 0;
18311831
int ret;
18321832
byte* pkcs8Key = NULL;
1833+
byte salt[PKCS5V2_SALT_SZ]; /* PKCS5V2_SALT_SZ > PKCS5_SALT_SZ */
1834+
word32 saltSz = 0;
18331835

18341836
int vPKCS = -1;
18351837
int outAlgo = -1;
@@ -1875,9 +1877,13 @@ static int wc_PKCS12_shroud_key(WC_PKCS12* pkcs12, WC_RNG* rng,
18751877
&hmacOid)) < 0) {
18761878
return ret;
18771879
}
1880+
saltSz = (outAlgo != PBES2) ? PKCS5_SALT_SZ : PKCS5V2_SALT_SZ;
1881+
if ((ret = wc_RNG_GenerateBlock(rng, salt, saltSz)) < 0) {
1882+
return ret;
1883+
}
18781884

18791885
ret = TraditionalEnc_ex(key, keySz, pkcs8Key, &sz, pass, passSz,
1880-
vPKCS, outAlgo, blkOid, NULL, 0, itt, hmacOid, rng, heap);
1886+
vPKCS, outAlgo, blkOid, salt, saltSz, itt, hmacOid, rng, heap);
18811887
}
18821888
if (ret == WC_NO_ERR_TRACE(LENGTH_ONLY_E)) {
18831889
*outSz = sz + MAX_LENGTH_SZ + 1;

0 commit comments

Comments
 (0)