Skip to content

pkcs5: allow empty algId prf parameter for PBES2 params #1521

Merged
tarcieri merged 5 commits intoRustCrypto:masterfrom
ancwrd1:master
Sep 17, 2024
Merged

pkcs5: allow empty algId prf parameter for PBES2 params #1521
tarcieri merged 5 commits intoRustCrypto:masterfrom
ancwrd1:master

Conversation

@ancwrd1
Copy link
Copy Markdown
Contributor

@ancwrd1 ancwrd1 commented Sep 16, 2024

Rationale: some applications and libraries produce PBES2/PBKDF2 structures without the terminating NULL value specified in the prf algorithm field.
This PR relaxes the decoding requirements.

According to RFC4231 the NULL parameter should be present but is not an absolute requirement.

See for example this issue: ancwrd1/p12-keystore#2

@tarcieri
Copy link
Copy Markdown
Member

some applications and libraries produce PBES2/PBKDF2 structures without the terminating NULL value specified in the prf algorithm field.

Which ones? Can you include a reference as to how the test vector you're providing was generated, at least in the comments?

@ancwrd1
Copy link
Copy Markdown
Contributor Author

ancwrd1 commented Sep 17, 2024

Specifically, this: https://github.com/smallstep/cli
It produces PKCS#12 file without the algorithm parameter value. It works fine with e.g. openssl or Java KeyStore API, but fails with my p12-keystore crate which is based on RustCrypto.

I have added a note in the comments.

@tarcieri tarcieri merged commit 895dbdf into RustCrypto:master Sep 17, 2024
@tarcieri tarcieri changed the title Allow PBES2 encoding without NULL value for the algId prf parameter pkcs5: allow empty algId prf parameter for PBES2 params Sep 17, 2024
@tarcieri tarcieri mentioned this pull request Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants