RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1384147 - PKCS#12 export illogically fails with some PBE algorithms [rhel-7]
Summary: PKCS#12 export illogically fails with some PBE algorithms [rhel-7]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nss
Version: 7.3
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Daiki Ueno
QA Contact: Alicja Kario
URL:
Whiteboard:
Depends On: 1384107
Blocks: 1020868 rhel7-nss-pkcs12
TreeView+ depends on / blocked
 
Reported: 2016-10-12 16:24 UTC by Stanislav Zidek
Modified: 2018-03-22 17:36 UTC (History)
8 users (show)

Fixed In Version: nss-3.28.3-5.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1384107
Environment:
Last Closed: 2017-08-01 16:47:42 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Mozilla Foundation 1268141 0 None None None 2016-10-12 16:24:51 UTC
Mozilla Foundation 1268143 0 None None None 2016-10-12 16:24:51 UTC
Mozilla Foundation 1350281 0 None None None 2017-03-24 13:08:43 UTC
Mozilla Foundation 1350332 0 None None None 2017-03-24 13:59:30 UTC
Red Hat Bugzilla 1220573 0 low CLOSED NSS can't handle PKCS#12 files with keys or certificates encrypted using strong PKCS#5 v2.0 ciphers or ones that use SHA... 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1384511 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Bugzilla 1462312 0 unspecified CLOSED PKCS#12 export uses low iteration counts 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1462318 0 unspecified CLOSED The pk12util man page shouldn't list algorithms that cannot be used for exporting PKCS#12 files 2021-02-22 00:41:40 UTC
Red Hat Product Errata RHEA-2017:1977 0 normal SHIPPED_LIVE nss bug fix and enhancement update 2017-08-01 17:57:47 UTC

Internal Links: 1220573 1384511 1462312 1462318

Description Stanislav Zidek 2016-10-12 16:24:52 UTC 
+++ This bug was initially created as a clone of Bug #1384107 +++

Description of problem:
While doing export with pk12util with algorithm specification for key/overall encryption (-c/-C), some algorithms fail for some types (key/overall) of encryption.

Version-Release number of selected component (if applicable):
nss-tools-3.21.0-17.el7

How reproducible:
always

Steps to Reproduce:
cat >ciphers <<_EOF
RC2-CBC
RC5-CBCPad
DES-EDE3-CBC
AES-128-CBC
AES-192-CBC
AES-256-CBC
CAMELLIA-128-CBC
CAMELLIA-192-CBC
CAMELLIA-256-CBC
PKCS #12 PBE with Sha1 and 128 Bit RC4
PKCS #12 PBE with Sha1 and 40 Bit RC4
PKCS #12 PBE with Sha1 and Triple DES CBC
PKCS #12 PBE with Sha1 and 128 Bit RC2 CBC
PKCS #12 PBE with Sha1 and 40 Bit RC2 CBC
PKCS12 V2 PBE with SHA1 and 128 Bit RC4
PKCS12 V2 PBE with SHA1 and 40 Bit RC4
PKCS12 V2 PBE with SHA1 and 3KEY Triple DES-cbc
PKCS12 V2 PBE with SHA1 and 2KEY Triple DES-cbc
PKCS12 V2 PBE with SHA1 and 128 Bit RC2 CBC
PKCS12 V2 PBE with SHA1 and 40 Bit RC2 CBC
PKCS #5 Password Based Encryption with MD2 and DES CBC
PKCS #5 Password Based Encryption with MD5 and DES CBC
PKCS #5 Password Based Encryption with SHA1 and DES CBC
_EOF
echo ".V3rysecu43pass" >pwfile
mkdir nssdb
certutil -N -f pwfile -d sql:nssdb/
printf "123456789012345678901234567890123456789012345678901234567890\n0\n5\n6\n9\ny\ny\n-1\ny\n5\n6\n7\n9\ny\n" |certutil -S -n ca -s 'CN=Test CA, O=Test Org, L=Test Loc, ST=Test State, C=TS' -t 'C,C,C' -x -w -3 -v 99 -1 -2 -5 -f pwfile -d sql:nssdb/
echo -n >good
echo -n >good-key
echo -n >good-overall
i=0
while read x; do
  echo "$i: cipher: '$x'"
  echo "Key encryption:"
  pk12util -o x${i}.p12 -n ca -w pwfile -k pwfile -d sql:nssdb/ -c "$x"
  res1=$?
  echo
  echo "RESULT: $res1"
  [[ $res1 = 0 ]] && echo "$x" >>good-key
  echo "Overall encryption:"
  pk12util -o x${i}.p12 -n ca -w pwfile -k pwfile -d sql:nssdb/ -C "$x"
  res2=$?
  echo
  echo "RESULT: $res2"
  [[ $res2 = 0 ]] && echo "$x" >>good-overall
  if [[ $res1 = 0 && $res2 = 0 ]]; then
    echo "$x" >>good
  fi
  echo "---------------------------"
  i=$((i+1))
done <ciphers
cat good
cat good-key
cat good-overall

Actual results:

# cat good
RC2-CBC
DES-EDE3-CBC

# cat good-key
RC2-CBC
DES-EDE3-CBC
AES-128-CBC
AES-192-CBC
AES-256-CBC
CAMELLIA-128-CBC
CAMELLIA-192-CBC
CAMELLIA-256-CBC

# cat good-overall
RC2-CBC
DES-EDE3-CBC
PKCS #12 PBE with Sha1 and 128 Bit RC4
PKCS #12 PBE with Sha1 and 40 Bit RC4
PKCS #12 PBE with Sha1 and Triple DES CBC
PKCS #12 PBE with Sha1 and 128 Bit RC2 CBC
PKCS #12 PBE with Sha1 and 40 Bit RC2 CBC
PKCS12 V2 PBE with SHA1 and 128 Bit RC4
PKCS12 V2 PBE with SHA1 and 40 Bit RC4
PKCS12 V2 PBE with SHA1 and 3KEY Triple DES-cbc
PKCS12 V2 PBE with SHA1 and 2KEY Triple DES-cbc
PKCS12 V2 PBE with SHA1 and 128 Bit RC2 CBC
PKCS12 V2 PBE with SHA1 and 40 Bit RC2 CBC
PKCS #5 Password Based Encryption with MD2 and DES CBC
PKCS #5 Password Based Encryption with MD5 and DES CBC
PKCS #5 Password Based Encryption with SHA1 and DES CBC

Expected results:
Everything supported.
Comment 6 Alicja Kario 2017-03-23 15:26:07 UTC 
Using:

cat >ciphers <<_EOF
SEED-CBC
IDEA_CBC
RC2-40-CBC
DES-40-CBC
DES-ECB
DES-CBC
RC4
RC4-40
RC4-56
NULL cipher
ChaCha20-Poly1305
_EOF

I'm getting:

# cat good
DES-CBC

# cat good-key
SEED-CBC
RC4

# cat good-overall
IDEA-CBC
NULL cipher


But with -C 'DES-CBC', OpenSSL can't perform decryption (-c 'DES-CBC' works)
With -C 'RC4', pk12util crashes.
Comment 7 Alicja Kario 2017-03-23 15:39:44 UTC 
with IDEA-CBC and all the names staring with "PKCS", the certificate is actually NOT encrypted
Comment 8 Bob Relyea 2017-03-24 00:35:20 UTC 
Softoken code should be in nss-softokn-3.28.3-4.el7
Comment 9 Kai Engert (:kaie) (inactive account) 2017-03-24 12:23:41 UTC 
Daiki, do you think it's still possible to get this fixed for 7.4.0 ?
Comment 11 Daiki Ueno 2017-03-24 13:05:00 UTC 
(In reply to Hubert Kario from comment #7)
> with IDEA-CBC and all the names staring with "PKCS", the certificate is
> actually NOT encrypted

The latter is a problem in the test itself; the cipher names do not match any of the defined ones and thus encryption is skipped.

The correct names of those ciphers are:

PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4
PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4
PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC
PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC
PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC
PKCS #5 Password Based Encryption with MD2 and DES-CBC
PKCS #5 Password Based Encryption with MD5 and DES-CBC
PKCS #5 Password Based Encryption with SHA-1 and DES-CBC

Also, IDEA-CBC is not allowed in:
https://dxr.mozilla.org/mozilla-central/source/security/nss/lib/pkcs12/p12plcy.c#20
Comment 12 Alicja Kario 2017-03-24 13:09:59 UTC 
(In reply to Daiki Ueno from comment #11)
> (In reply to Hubert Kario from comment #7)
> > with IDEA-CBC and all the names staring with "PKCS", the certificate is
> > actually NOT encrypted
> 
> The latter is a problem in the test itself; the cipher names do not match
> any of the defined ones and thus encryption is skipped.
> 
> The correct names of those ciphers are:
> 
> PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4
> PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4
> PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC
> PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC
> PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC
> PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC
> PKCS #5 Password Based Encryption with MD2 and DES-CBC
> PKCS #5 Password Based Encryption with MD5 and DES-CBC
> PKCS #5 Password Based Encryption with SHA-1 and DES-CBC

those are not the names in pk12util man page and I'm quite sure those were the names that did work previously, so that change would indicate a regression...
 
> Also, IDEA-CBC is not allowed in:
> https://dxr.mozilla.org/mozilla-central/source/security/nss/lib/pkcs12/
> p12plcy.c#20

then it should report it as such and not continue with file creation
Comment 13 Alicja Kario 2017-03-24 13:26:30 UTC 
Speaking of man page, 
 - DES-CBC
 - RC2-CBC
 - DES-EDE3-CBC
 - AES-128-CBC
are described as "Symmetric CBC ciphers for PKCS#5 V2".

Now, use of AES-128-CBC will create a file that uses PBES2 encryption with PBKDF2 and AES-128-CBC cipher. Use of DES-EDE3-CBC will create a file that uses PBES1 scheme with OID of pbeWithSHA1And3-KeyTripleDES-CBC. That is _not_ a cipher that was defined in PKCS#5 v2.0. PBES1 with 3DES was defined in PKCS#12 v1.1 not PKCS#12 v2.0 (I don't think v2.0 exists...).

So, honestly, I'm quite confused about both the naming, the actual meaning of those names and their explanation...
Comment 14 Nikos Mavrogiannopoulos 2017-03-24 16:24:39 UTC 
(In reply to Hubert Kario from comment #13)
> Speaking of man page, 
>  - DES-CBC
>  - RC2-CBC
>  - DES-EDE3-CBC
>  - AES-128-CBC
> are described as "Symmetric CBC ciphers for PKCS#5 V2".
> 
> Now, use of AES-128-CBC will create a file that uses PBES2 encryption with
> PBKDF2 and AES-128-CBC cipher. Use of DES-EDE3-CBC will create a file that
> uses PBES1 scheme with OID of pbeWithSHA1And3-KeyTripleDES-CBC. That is
> _not_ a cipher that was defined in PKCS#5 v2.0. PBES1 with 3DES was defined
> in PKCS#12 v1.1 not PKCS#12 v2.0 (I don't think v2.0 exists...).

Talking only about the protocols (rfc2898,rfc7292) it is a bit confusing. You can use 3DES with PKCS#12 under the PKCS#5 (PBES2) OIDs or under the PKCS#12 OIDs.
Comment 15 Bob Relyea 2017-03-29 16:12:47 UTC 
So NSS does not support IDEA, but you should not get the key in pkcs #12 files on export. pk12util should return an error.
Comment 18 Alicja Kario 2017-06-16 17:38:17 UTC 
Export with SHA-2 PBKDF2 and low iteration counts is tracked in bug 1462312.
Comment 19 Alicja Kario 2017-06-16 17:43:10 UTC 
Issues with exporting using obsolete algorithms in tracked in bug 1462318.
Comment 21 errata-xmlrpc 2017-08-01 16:47:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1977
Note You need to log in before you can comment on or make changes to this bug.