Re: [lamps] Proposal for PBMAC1 in PKCS#12

Hubert:

Please point to the text in RFC 7292 that is causing your concern.

The PFX structure is:

   PFX ::= SEQUENCE {
       version     INTEGER {v3(3)}(v3,...),
       authSafe    ContentInfo,
       macData     MacData OPTIONAL
   }

   MacData ::= SEQUENCE {
       mac         DigestInfo,
       macSalt     OCTET STRING,
       iterations  INTEGER DEFAULT 1
       -- Note: The default is for historical reasons and its
       --       use is deprecated.
   }

  -- IMPORT FROM RFC 2315

   DigestInfo ::= SEQUENCE {
     digestAlgorithm DigestAlgorithmIdentifier,
     digest Digest }

   Digest ::= OCTET STRING

It seems to me that DigestInfo would be better named macInfo.  It carries the MAC algorithm identifier (and optional parameters) as the MAC itself.

Russ

> On Jun 22, 2022, at 6:35 AM, Hubert Kario <hkario@redhat.com> wrote:
> 
> Hello everybody,
> 
> The work on the new NIST FIPS 140-3 implementations made us aware that the
> current PKCS #12 specification uses a legacy PBKDF for the calculation
> of the whole-file MAC value: PBKDF1. The PKCS #12 standard also doesn't
> provide a way to specify any alternative KDF. Since PBKDF1 isn't an approved mechanism in FIPS, the whole file becomes FIPS non-compliant.
> 
> While deciding how to modify the PFX structure we considered two options:
> change the structure completely, so that the whole macData is extensible
> and allows for use of PBMAC1, or by placing the PBMAC1 as as "hash"
> in the existing structure. The first option is much cleaner, but it has
> the unintended consequence of making the file completely unreadable by
> any of the popular software able to process PKCS#12 files that exists now.
> The second option does on the other hand create files that even
> old versions of OpenSSL (like 1.0.1) can read when the user specifies the
> -nomacver option. Allowing for a relatively easy workaround for interoperability with old systems.
> 
> With those two things in mind I'd like to propose the following I-D
> to specify use of PBMAC1 in PKCS#12:
> https://datatracker.ietf.org/doc/draft-kario-pkcs12-pbmac1/
> -- 
> Regards,
> Hubert Kario
> Principal Quality Engineer, RHEL Crypto team
> Web: www.cz.redhat.com
> Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
> 
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm