Bug 1380642 – Cannot read encrypted PKCS#8 from OpenSSL

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1380642 - Cannot read encrypted PKCS#8 from OpenSSL

Summary:	Cannot read encrypted PKCS#8 from OpenSSL

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	gnutls (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Nikos Mavrogiannopoulos
QA Contact:	Hubert Kario
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:	1369484
Blocks:
	Show dependency tree / graph

Reported:	2016-09-30 04:50 EDT by Nikos Mavrogiannopoulos
Modified:	2017-08-01 04:48 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	gnutls-3.3.26-1.el7
Doc Type:	Enhancement
Doc Text:	Feature: This adds support for decoding private keys encrypted using openssl version 1.1.0. Reason: OpenSSL 1.1.0 changed its default encoding format for PKCS#8 private keys, involving HMAC algorithms not handled in GnuTLS for PKCS#8 private key decoding. Result: This change ensures keys generated using OpenSSL 1.1.0 will be decoded by gnutls applications.
Story Points:	---
Clone Of:	1369484
Environment:
Last Closed:	2017-08-01 04:48:22 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:2292	normal	SHIPPED_LIVE	Moderate: gnutls security, bug fix, and enhancement update	2017-08-01 08:39:15 EDT

Groups: None (edit)

Description Nikos Mavrogiannopoulos 2016-09-30 04:50:27 EDT

+++ This bug was initially created as a clone of Bug #1369484 +++

GnuTLS (for example openconnect) can read PKCS#8 files generated by Fedora's OpenSSL 1.1.

It started at OpenSSL commit 8fc06e8860:
https://github.com/openssl/openssl/commit/8fc06e8860

Specifically, changing the PRF to use SHA256. So this works:

$ apps/openssl pkcs8 -topk8 -in ~/privkey.pem -out ~/pk8-test.pem -v2 aes256 -passout pass:asdf -v2prf hmacWithSHA1

... and GnuTLS fails to parse this one:

$ apps/openssl pkcs8 -topk8 -in ~/privkey.pem -out ~/pk8-test.pem -v2 aes256 -passout pass:asdf -v2prf hmacWithSHA256



https://gitlab.com/gnutls/gnutls/commit/13893550aa266d55bd5ec6ef395ae48f528b24d5

Comment 5 errata-xmlrpc 2017-08-01 04:48:22 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:2292

Note You need to log in before you can comment on or make changes to this bug.