<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div></div>
<h2 dir="auto">
<a id="user-content-description-of-problem" class="anchor" href="#description-of-problem" aria-hidden="true"></a>Description of problem:</h2>
<p dir="auto">in PKCS#12 files, PBES2 with PBKDF2 with hmacWithSHA512, hmacWithSHA384, hmacWithSHA224 or hmacWithMD5 PRF does not work</p>
<h2 dir="auto">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true"></a>Version of gnutls used:</h2>
<p dir="auto">gnutls-3.6.5-1.el8.x86_64</p>
<h2 dir="auto">
<a id="user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" class="anchor" href="#distributor-of-gnutls-eg-ubuntu-fedora-rhel" aria-hidden="true"></a>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)</h2>
<p dir="auto">RHEL</p>
<h2 dir="auto">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true"></a>How reproducible:</h2>
<ul dir="auto">
<li>download <a href="https://github.com/redhat-qe-security/keyfile-corpus" rel="nofollow noreferrer noopener" target="_blank">https://github.com/redhat-qe-security/keyfile-corpus</a>
</li>
<li>run <code>certtool --p12-info --inder --infile 'keyfile-corpus-keyfiles-0.1.3/rsa(2048,sha256),cert&key(PBES2(PBKDF2(salt(64),iter(1000000),keyLen(default),prf(hmacWithSHA512)),aes-256-cbc(IV(16)))),mac(sha512,salt(64),iter(1000000)),pass(ascii).p12' --password 'Red Hat Enterprise Linux 7.4'</code>
</li>
<li>run <code>certtool --p12-info --inder --infile 'keyfile-corpus-keyfiles-0.1.3/rsa(2048,sha256),cert&key(PBES2(PBKDF2(salt(8),iter(2048),keyLen(default),prf(hmacWithMD5)),aes-128-cbc(IV(16)))),mac(sha1,salt(8),iter(2048)),pass(ascii).p12' --password 'Red Hat Enterprise Linux 7.4'</code>
</li>
<li>run <code>certtool --p12-info --inder --infile 'keyfile-corpus-keyfiles-0.1.3/rsa(2048,sha256),cert&key(PBES2(PBKDF2(salt(8),iter(2048),keyLen(default),prf(hmacWithSHA224)),aes-128-cbc(IV(16)))),mac(sha1,salt(8),iter(2048)),pass(ascii).p12' --password 'Red Hat Enterprise Linux 7.4'</code>
</li>
<li>etc.</li>
</ul>
<h2 dir="auto">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true"></a>Actual results:</h2>
<pre class="code highlight js-syntax-highlight plaintext" lang="plaintext" v-pre="true"><code><span id="LC1" class="line" lang="plaintext">bag_decrypt: The hash algorithm is unknown.</span>
<span id="LC2" class="line" lang="plaintext">There were errors parsing the structure</span>
<span id="LC3" class="line" lang="plaintext">MAC info:</span>
<span id="LC4" class="line" lang="plaintext"> MAC: SHA1 (1.3.14.3.2.26)</span>
<span id="LC5" class="line" lang="plaintext"> Salt: a9e4a4ff82fcc30b</span>
<span id="LC6" class="line" lang="plaintext"> Salt size: 8</span>
<span id="LC7" class="line" lang="plaintext"> Iteration count: 2048</span>
<span id="LC8" class="line" lang="plaintext"></span>
<span id="LC9" class="line" lang="plaintext">BAG #0</span>
<span id="LC10" class="line" lang="plaintext"> Type: Encrypted</span>
<span id="LC11" class="line" lang="plaintext"> Cipher: AES-128-CBC</span>
<span id="LC12" class="line" lang="plaintext"> Schema: PBES2-AES128-CBC (2.16.840.1.101.3.4.1.2)</span>
<span id="LC13" class="line" lang="plaintext"> Salt: 38cc590051f7c4e4</span>
<span id="LC14" class="line" lang="plaintext"> Salt size: 8</span>
<span id="LC15" class="line" lang="plaintext"> Iteration count: 2048</span>
<span id="LC16" class="line" lang="plaintext"></span>
<span id="LC17" class="line" lang="plaintext"> Decrypting...</span>
<span id="LC18" class="line" lang="plaintext"></span>
<span id="LC19" class="line" lang="plaintext">BAG #1</span>
<span id="LC20" class="line" lang="plaintext"> Elements: 1</span>
<span id="LC21" class="line" lang="plaintext"> Type: PKCS #8 Encrypted key</span>
<span id="LC22" class="line" lang="plaintext"> PKCS #8 information:</span>
<span id="LC23" class="line" lang="plaintext"> Cipher: AES-128-CBC</span>
<span id="LC24" class="line" lang="plaintext"> Schema: PBES2-AES128-CBC (2.16.840.1.101.3.4.1.2)</span>
<span id="LC25" class="line" lang="plaintext"> Salt: 5369a4e334531320</span>
<span id="LC26" class="line" lang="plaintext"> Salt size: 8</span>
<span id="LC27" class="line" lang="plaintext"> Iteration count: 2048</span>
<span id="LC28" class="line" lang="plaintext"></span>
<span id="LC29" class="line" lang="plaintext"> Friendly name: localhost</span>
<span id="LC30" class="line" lang="plaintext"> Key ID: E3:76:B4:62:05:2B:2F:D4:B9:12:5B:B0:EA:E0:4F:10:C8:C0:C5:B0</span>
<span id="LC31" class="line" lang="plaintext">-----BEGIN ENCRYPTED PRIVATE KEY-----</span>
<span id="LC32" class="line" lang="plaintext">MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIU2mk4zRTEyACAggA</span>
<span id="LC33" class="line" lang="plaintext">MAwGCCqGSIb3DQIIBQAwHQYJYIZIAWUDBAECBBAgdxbvUGAApqxH2FVPOldABIIE</span>
<span id="LC34" class="line" lang="plaintext">0JJ4SXh8mxEk0MA+zVhfW9y2PXyL3vm2/3SI7U0hc9d3OCZtgFu3al1CN9PbfqZ9</span>
<span id="LC35" class="line" lang="plaintext">DcG0ddTY3WY8wpNlWErPeYlRuNVFCpK++pWCrFjZAftRVaJlQQS0okf+idmfSv8E</span>
<span id="LC36" class="line" lang="plaintext">5fSo8RoyXzPOmzgh0YUpaYT0iSE1YeJ0LTIjk1ZYeNoZbQFMUgoQZgRE04i9pCBX</span>
<span id="LC37" class="line" lang="plaintext">UdlXlGjJeGSykNEcRFFBpr6yA+kkWJecjQeGbk8dnUO9nyN10UzJ0Ly7v9pR7Eaq</span>
<span id="LC38" class="line" lang="plaintext">jJTk3dqusCn4ViPWxmj3fY+/+GEhe9+sVgxVhtBanb0NAXc3HQ8Dcz2vyPLI1rfJ</span>
<span id="LC39" class="line" lang="plaintext">wTxDyGLD/6sVQAZYhYh5BVOaWCIRUOPkxtXfH990+1pTN90ySvVxMuIypJvvPULW</span>
<span id="LC40" class="line" lang="plaintext">Ik+w94xOiYMSuxe1DFQjRRBxOjVXZLGHmgzUREevti81g80FCOnKO0Nivg/WcLKq</span>
<span id="LC41" class="line" lang="plaintext">2AhOQv3TvnTfu3WbFF7Ddyp56IXynUaxhyqxGstMZ/0+PL0To1zfPnWY88BJn0co</span>
<span id="LC42" class="line" lang="plaintext">TPRIiuFC8Ggt7IirrXm8MvuShvEeh9V1X0UOhOXZEZTFu+xlLNaaT6LcIJ0xuRtn</span>
<span id="LC43" class="line" lang="plaintext">R90sSqra4hzyG0HlqjA/fqmO2wExDZGyou3ghpGczx7VEFlLxDUPTsANC63Z+EIs</span>
<span id="LC44" class="line" lang="plaintext">WeVrXfpYt1J+5WzNSYCAopLKisCaamKVO9n0SO0Bm9nBglRvNmXi9OBtBE5ZX0/J</span>
<span id="LC45" class="line" lang="plaintext">VYF3QzgiU0rItUqszVM5Rzkdc1pdc1zCs/G+W+F0G3OmfhsHE9RLS31g9YzAEFSW</span>
<span id="LC46" class="line" lang="plaintext">nMMVsFQ1GpyIV2ajl4wiP7+KJ4eniX1xJ7mM9toMY6ZUmmY6Qopg2TueWxXB3hm6</span>
<span id="LC47" class="line" lang="plaintext">6eETjutu5pCnZIJ49CH111OgGS5jMt17Lv8fAWHpHOwHUOMX/csTOir9GXfTo0HV</span>
<span id="LC48" class="line" lang="plaintext">PA2dLDwK+f8Vl+BsgBiKqRlgMYYOiZPM7Op3JJS9gTgf4T1dQiy5j4Uq0PWvAfof</span>
<span id="LC49" class="line" lang="plaintext">A10hK/Y6ESJvHojrDrN/c5dKfT+qrAlQJR1T8jCanGWxf4DLcbM68pdiJM89WSBb</span>
<span id="LC50" class="line" lang="plaintext">Xa+zJdnYXZdt3XkoxGwjfsvJfd51ho2A0E6E4wIrLo1/w32Vnhza/Kb2icN/pMTA</span>
<span id="LC51" class="line" lang="plaintext">kIaU81XTXwPjvI70yqlHM6Qakam1mXvjVXS923XPOMa/0mlX/L7uh6zlm3AYwXJa</span>
<span id="LC52" class="line" lang="plaintext">cFoxAkrWea0baa6nnT77rEJUwm3yYfTLAop8zdnjr2TJyspptA1dcqBSDsFRZWCU</span>
<span id="LC53" class="line" lang="plaintext">hU1hSMk71dUSuBtwNevwF9hRY4DT3CTfG8cDADA7At3Z4UcbXH61d4M4seyqew52</span>
<span id="LC54" class="line" lang="plaintext">1OulIa0sQGlDJKt2h2rglwpwMHkZszSA5Yu4iG20HODXZVPe6qApTUWd4YXIj1xy</span>
<span id="LC55" class="line" lang="plaintext">uLRVF/jubWOXfXI11r1UACEQnfZvqNL7Y3+EP41dOO5yu8IIBAtM+ESg69MqfDQc</span>
<span id="LC56" class="line" lang="plaintext">mA+4Tr3C7H8bw66cyek8+zq0uXQPBxFv2c4CUkxmzSPmtkwhjnlxAo7GeBcN+Dk0</span>
<span id="LC57" class="line" lang="plaintext">ic8MiCFTr/WFCsI3taVcRdkOPDlEhGMvoSPDGkx4hlMMXWrBIF2SwqMBi9k3wl5y</span>
<span id="LC58" class="line" lang="plaintext">nl5hxmCd8WnSTsWHdx5T6Ki+iblYUIus7x475mrzTdfZwoGX3+yacjCsgUwxjAvO</span>
<span id="LC59" class="line" lang="plaintext">OnEMJN1p36UGzgEk7cZ/rKPqFGcxvTt+IBrrtFH8Kdiz</span>
<span id="LC60" class="line" lang="plaintext">-----END ENCRYPTED PRIVATE KEY-----</span></code></pre>
<h2 dir="auto">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true"></a>Expected results:</h2>
<p dir="auto">files can be processed just like other PKCS#12 files in the set</p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/723">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/a98352cd521629bbe7f421bc0e954b4f/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/723"}}</script>
</p>
</div>
</body>
</html>