Red Hat Bugzilla – Bug 1384147
PKCS#12 export illogically fails with some PBE algorithms [rhel-7]
Last modified: 2018-03-22 13:36:52 EDT
+++ This bug was initially created as a clone of Bug #1384107 +++ Description of problem: While doing export with pk12util with algorithm specification for key/overall encryption (-c/-C), some algorithms fail for some types (key/overall) of encryption. Version-Release number of selected component (if applicable): nss-tools-3.21.0-17.el7 How reproducible: always Steps to Reproduce: cat >ciphers <<_EOF RC2-CBC RC5-CBCPad DES-EDE3-CBC AES-128-CBC AES-192-CBC AES-256-CBC CAMELLIA-128-CBC CAMELLIA-192-CBC CAMELLIA-256-CBC PKCS #12 PBE with Sha1 and 128 Bit RC4 PKCS #12 PBE with Sha1 and 40 Bit RC4 PKCS #12 PBE with Sha1 and Triple DES CBC PKCS #12 PBE with Sha1 and 128 Bit RC2 CBC PKCS #12 PBE with Sha1 and 40 Bit RC2 CBC PKCS12 V2 PBE with SHA1 and 128 Bit RC4 PKCS12 V2 PBE with SHA1 and 40 Bit RC4 PKCS12 V2 PBE with SHA1 and 3KEY Triple DES-cbc PKCS12 V2 PBE with SHA1 and 2KEY Triple DES-cbc PKCS12 V2 PBE with SHA1 and 128 Bit RC2 CBC PKCS12 V2 PBE with SHA1 and 40 Bit RC2 CBC PKCS #5 Password Based Encryption with MD2 and DES CBC PKCS #5 Password Based Encryption with MD5 and DES CBC PKCS #5 Password Based Encryption with SHA1 and DES CBC _EOF echo ".V3rysecu43pass" >pwfile mkdir nssdb certutil -N -f pwfile -d sql:nssdb/ printf "123456789012345678901234567890123456789012345678901234567890\n0\n5\n6\n9\ny\ny\n-1\ny\n5\n6\n7\n9\ny\n" |certutil -S -n ca -s 'CN=Test CA, O=Test Org, L=Test Loc, ST=Test State, C=TS' -t 'C,C,C' -x -w -3 -v 99 -1 -2 -5 -f pwfile -d sql:nssdb/ echo -n >good echo -n >good-key echo -n >good-overall i=0 while read x; do echo "$i: cipher: '$x'" echo "Key encryption:" pk12util -o x${i}.p12 -n ca -w pwfile -k pwfile -d sql:nssdb/ -c "$x" res1=$? echo echo "RESULT: $res1" [[ $res1 = 0 ]] && echo "$x" >>good-key echo "Overall encryption:" pk12util -o x${i}.p12 -n ca -w pwfile -k pwfile -d sql:nssdb/ -C "$x" res2=$? echo echo "RESULT: $res2" [[ $res2 = 0 ]] && echo "$x" >>good-overall if [[ $res1 = 0 && $res2 = 0 ]]; then echo "$x" >>good fi echo "---------------------------" i=$((i+1)) done <ciphers cat good cat good-key cat good-overall Actual results: # cat good RC2-CBC DES-EDE3-CBC # cat good-key RC2-CBC DES-EDE3-CBC AES-128-CBC AES-192-CBC AES-256-CBC CAMELLIA-128-CBC CAMELLIA-192-CBC CAMELLIA-256-CBC # cat good-overall RC2-CBC DES-EDE3-CBC PKCS #12 PBE with Sha1 and 128 Bit RC4 PKCS #12 PBE with Sha1 and 40 Bit RC4 PKCS #12 PBE with Sha1 and Triple DES CBC PKCS #12 PBE with Sha1 and 128 Bit RC2 CBC PKCS #12 PBE with Sha1 and 40 Bit RC2 CBC PKCS12 V2 PBE with SHA1 and 128 Bit RC4 PKCS12 V2 PBE with SHA1 and 40 Bit RC4 PKCS12 V2 PBE with SHA1 and 3KEY Triple DES-cbc PKCS12 V2 PBE with SHA1 and 2KEY Triple DES-cbc PKCS12 V2 PBE with SHA1 and 128 Bit RC2 CBC PKCS12 V2 PBE with SHA1 and 40 Bit RC2 CBC PKCS #5 Password Based Encryption with MD2 and DES CBC PKCS #5 Password Based Encryption with MD5 and DES CBC PKCS #5 Password Based Encryption with SHA1 and DES CBC Expected results: Everything supported.
Using: cat >ciphers <<_EOF SEED-CBC IDEA_CBC RC2-40-CBC DES-40-CBC DES-ECB DES-CBC RC4 RC4-40 RC4-56 NULL cipher ChaCha20-Poly1305 _EOF I'm getting: # cat good DES-CBC # cat good-key SEED-CBC RC4 # cat good-overall IDEA-CBC NULL cipher But with -C 'DES-CBC', OpenSSL can't perform decryption (-c 'DES-CBC' works) With -C 'RC4', pk12util crashes.
with IDEA-CBC and all the names staring with "PKCS", the certificate is actually NOT encrypted
Softoken code should be in nss-softokn-3.28.3-4.el7
Daiki, do you think it's still possible to get this fixed for 7.4.0 ?
(In reply to Hubert Kario from comment #7) > with IDEA-CBC and all the names staring with "PKCS", the certificate is > actually NOT encrypted The latter is a problem in the test itself; the cipher names do not match any of the defined ones and thus encryption is skipped. The correct names of those ciphers are: PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4 PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4 PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC PKCS #5 Password Based Encryption with MD2 and DES-CBC PKCS #5 Password Based Encryption with MD5 and DES-CBC PKCS #5 Password Based Encryption with SHA-1 and DES-CBC Also, IDEA-CBC is not allowed in: https://dxr.mozilla.org/mozilla-central/source/security/nss/lib/pkcs12/p12plcy.c#20
(In reply to Daiki Ueno from comment #11) > (In reply to Hubert Kario from comment #7) > > with IDEA-CBC and all the names staring with "PKCS", the certificate is > > actually NOT encrypted > > The latter is a problem in the test itself; the cipher names do not match > any of the defined ones and thus encryption is skipped. > > The correct names of those ciphers are: > > PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4 > PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4 > PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC > PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC > PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC > PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC > PKCS #5 Password Based Encryption with MD2 and DES-CBC > PKCS #5 Password Based Encryption with MD5 and DES-CBC > PKCS #5 Password Based Encryption with SHA-1 and DES-CBC those are not the names in pk12util man page and I'm quite sure those were the names that did work previously, so that change would indicate a regression... > Also, IDEA-CBC is not allowed in: > https://dxr.mozilla.org/mozilla-central/source/security/nss/lib/pkcs12/ > p12plcy.c#20 then it should report it as such and not continue with file creation
Speaking of man page, - DES-CBC - RC2-CBC - DES-EDE3-CBC - AES-128-CBC are described as "Symmetric CBC ciphers for PKCS#5 V2". Now, use of AES-128-CBC will create a file that uses PBES2 encryption with PBKDF2 and AES-128-CBC cipher. Use of DES-EDE3-CBC will create a file that uses PBES1 scheme with OID of pbeWithSHA1And3-KeyTripleDES-CBC. That is _not_ a cipher that was defined in PKCS#5 v2.0. PBES1 with 3DES was defined in PKCS#12 v1.1 not PKCS#12 v2.0 (I don't think v2.0 exists...). So, honestly, I'm quite confused about both the naming, the actual meaning of those names and their explanation...
(In reply to Hubert Kario from comment #13) > Speaking of man page, > - DES-CBC > - RC2-CBC > - DES-EDE3-CBC > - AES-128-CBC > are described as "Symmetric CBC ciphers for PKCS#5 V2". > > Now, use of AES-128-CBC will create a file that uses PBES2 encryption with > PBKDF2 and AES-128-CBC cipher. Use of DES-EDE3-CBC will create a file that > uses PBES1 scheme with OID of pbeWithSHA1And3-KeyTripleDES-CBC. That is > _not_ a cipher that was defined in PKCS#5 v2.0. PBES1 with 3DES was defined > in PKCS#12 v1.1 not PKCS#12 v2.0 (I don't think v2.0 exists...). Talking only about the protocols (rfc2898,rfc7292) it is a bit confusing. You can use 3DES with PKCS#12 under the PKCS#5 (PBES2) OIDs or under the PKCS#12 OIDs.
So NSS does not support IDEA, but you should not get the key in pkcs #12 files on export. pk12util should return an error.
Export with SHA-2 PBKDF2 and low iteration counts is tracked in bug 1462312.
Issues with exporting using obsolete algorithms in tracked in bug 1462318.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1977