[lamps] Proposal for PBMAC1 in PKCS#12

[Hubert Kario <[e-mail]>]

Hello everybody,

The work on the new NIST FIPS 140-3 implementations made us aware that the
current PKCS #12 specification uses a legacy PBKDF for the calculation
of the whole-file MAC value: PBKDF1. The PKCS #12 standard also doesn't
provide a way to specify any alternative KDF. Since PBKDF1 isn't an 
approved mechanism in FIPS, the whole file becomes FIPS non-compliant.

While deciding how to modify the PFX structure we considered two options:
change the structure completely, so that the whole macData is extensible
and allows for use of PBMAC1, or by placing the PBMAC1 as as "hash"
in the existing structure. The first option is much cleaner, but it has
the unintended consequence of making the file completely unreadable by
any of the popular software able to process PKCS#12 files that exists now.
The second option does on the other hand create files that even
old versions of OpenSSL (like 1.0.1) can read when the user specifies the
-nomacver option. Allowing for a relatively easy workaround for 
interoperability with old systems.

With those two things in mind I'd like to propose the following I-D
to specify use of PBMAC1 in PKCS#12:
https://datatracker.ietf.org/doc/draft-kario-pkcs12-pbmac1/
-- 
Regards,
Hubert Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic