Bug 1559989 - PKCS#12 files created by NSS are incompatible with Microsoft Windows [rhel-7]
Summary: PKCS#12 files created by NSS are incompatible with Microsoft Windows [rhel-7]
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nss
Version: 7.5
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Daiki Ueno
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks: 1559993 1564989
TreeView+ depends on / blocked
 
Reported: 2018-03-23 16:44 UTC by Hubert Kario
Modified: 2018-11-09 14:46 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1559993 1564989 (view as bug list)
Environment:
Last Closed: 2018-11-09 14:46:48 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Priority Status Summary Last Updated
Mozilla Foundation 1278071 None None None 2019-02-05 03:41:47 UTC
Mozilla Foundation 1436873 None None None 2019-02-05 03:41:47 UTC
Red Hat Bugzilla 1462312 None CLOSED PKCS#12 export uses low iteration counts 2019-02-05 03:41:47 UTC

Internal Links: 1462312

Description Hubert Kario 2018-03-23 16:44:03 UTC 
Description of problem:
PKCS#12 files exported by NSS use 1000000 (1M) iterations for the key derivation function. Microsoft Windows does not support higher iteration count than 600000 (600k), aborting the import with invalid password error message.
The Event Viewer includes "PFX operation failed as Iteration count doesn't lie in expected range. Maximum permissible value: 600000. Erroneous value: 1000000"

Version-Release number of selected component (if applicable):
nss-3.34.0-1.el7

How reproducible:
Always

Steps to Reproduce:
1. Export key from nssdb to a PKCS#12 files
2. try importing the file to Microsoft key store

Actual results:
Invalid password error message

Expected results:
Key and certificates from PKCS#12 file imported successfully.

Additional info:
Issue introduced as a result of fixing bug 1462312.
Note You need to log in before you can comment on or make changes to this bug.