Commit b7d135b3 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Two new functions to write out PKCS#8 private keys. Also fixes for some of 

the the PBE code and a new constant PKCS5_DEFAULT_ITER for the default
iteration count if it is passed as zero.
parent d58d092b

CHANGES

+6 −0
Original line number Diff line number Diff line
@@ -4,6 +4,12 @@ 


 Changes between 0.9.3a and 0.9.4



  *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and 

     PEM_write_bio_PKCS8PrivateKey() that are equivalent to

     PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more

     secure PKCS#8 private key format with a high iteration count.

     [Steve Henson]



  *) Fix determination of Perl interpreter: A perl or perl5

     _directory_ in $PATH was also accepted as the interpreter.

     [Ralf S. Engelschall]

crypto/asn1/p5_pbe.c

+1 −0
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt, 
		ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);

		return NULL;

	}

	if(iter <= 0) iter = PKCS5_DEFAULT_ITER;

	ASN1_INTEGER_set (pbe->iter, iter);

	if (!saltlen) saltlen = PKCS5_SALT_LEN;

	if (!(pbe->salt->data = Malloc (saltlen))) {

crypto/asn1/p5_pbev2.c

+1 −0
Original line number Diff line number Diff line
@@ -206,6 +206,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, 
	if (salt) memcpy (osalt->data, salt, saltlen);

	else RAND_bytes (osalt->data, saltlen);



	if(iter <= 0) iter = PKCS5_DEFAULT_ITER;

	if(!ASN1_INTEGER_set(kdf->iter, iter)) goto merr;



	/* Now include salt in kdf structure */

crypto/evp/evp.h

+2 −0
Original line number Diff line number Diff line
@@ -110,6 +110,8 @@ extern "C" { 
#define EVP_MAX_IV_LENGTH		8



#define PKCS5_SALT_LEN			8

/* Default PKCS#5 iteration count */

#define PKCS5_DEFAULT_ITER		2048



#ifndef NO_RSA

#include <openssl/rsa.h>

crypto/evp/p5_crpt.c

+1 −1
Original line number Diff line number Diff line
@@ -100,7 +100,7 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen, 


	/* Extract useful info from parameter */

	pbuf = param->value.sequence->data;

	if (!param || (param->type = V_ASN1_SEQUENCE) ||

	if (!param || (param->type != V_ASN1_SEQUENCE) ||

	   !(pbe = d2i_PBEPARAM (NULL, &pbuf, param->value.sequence->length))) {

		EVPerr(EVP_F_PKCS5_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);

		return 0;