Re: [Spasm] [saag] Best practices for applications using X.509 client certificates

[David Woodhouse <[e-mail]>]

On Mon, 2016-09-26 at 12:55 -0700, Sean Leonard wrote:
> On 9/26/2016 12:48 PM, David Woodhouse wrote:
> >
> >> For interoperable private key formats, I favor PKCS #8 PrivateKeyInfo
> >> (as .p8) and PKCS #8 EncryptedPrivateKeyInfo (as .p8e). They are
> >> standardized, widely-supported, and algorithm-agile.
> > They are also non-portable, because even when RFC5958 was published in
> > 2010, FFS, it didn't mandate the conversion of the password to UTF-8
> > (let alone any mention of Unicode normalisation) for the purpose of the
> > key derivation.
> >
> > PKCS#12 at least gets *part* of that right, by mandating UTF16BE (BMP).
> 
> draft-seantek-pkcs8-encrypted-01

OK... so now we have can say

Content-Type: application/pkcs8-encrypted; password-mapping=UTF-8

(Did you intend '*pkcs12' to mean UTF16-BE which is BMP, not UTF-16LE?)

But I've *never* seen an application make use of certs/files from any
container where that Content-Type: header might be present. It's not
even permitted to put it in PEM files, is it? So does this really buy
me anything in practice? 

And it still doesn't cover Unicode normalisation. :)

> Glad to see someone else cares about password mapping.

Mostly when it breaks :)

-- 
dwmw2