aboutsummaryrefslogtreecommitdiffstats
path: root/lib/public_key
diff options
context:
space:
mode:
Diffstat (limited to 'lib/public_key')
-rw-r--r--lib/public_key/asn1/OTP-PKIX.asn18
-rw-r--r--lib/public_key/doc/src/notes.xml15
-rw-r--r--lib/public_key/doc/src/public_key.xml119
-rw-r--r--lib/public_key/src/pubkey_pbe.erl30
-rw-r--r--lib/public_key/src/pubkey_pem.erl4
-rw-r--r--lib/public_key/src/public_key.erl2
-rw-r--r--lib/public_key/test/pbe_SUITE.erl38
-rw-r--r--lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc.pem (renamed from lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc_enc_key.pem)0
-rw-r--r--lib/public_key/test/pbe_SUITE_data/old_aes_256_cbc.pem30
-rw-r--r--lib/public_key/vsn.mk2
10 files changed, 154 insertions, 94 deletions
diff --git a/lib/public_key/asn1/OTP-PKIX.asn1 b/lib/public_key/asn1/OTP-PKIX.asn1
index 9bcd99fba3..ff3250b383 100644
--- a/lib/public_key/asn1/OTP-PKIX.asn1
+++ b/lib/public_key/asn1/OTP-PKIX.asn1
@@ -233,9 +233,13 @@ countryName ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
-- regarding how to handle and sometimes accept incorrect certificates
-- we define and use the type below instead of X520countryName
+ -- We accept utf8String encoding of the US-ASCII
+ -- country name code and the mix up with other country code systems
+ -- that uses three characters instead of two.
+
OTP-X520countryname ::= CHOICE {
- printableString PrintableString (SIZE (2)),
- utf8String UTF8String (SIZE (2))
+ printableString PrintableString (SIZE (2..3)),
+ utf8String UTF8String (SIZE (2..3))
}
serialNumber ATTRIBUTE-TYPE-AND-VALUE-CLASS ::= {
diff --git a/lib/public_key/doc/src/notes.xml b/lib/public_key/doc/src/notes.xml
index b3e6023c41..f6bc0dc797 100644
--- a/lib/public_key/doc/src/notes.xml
+++ b/lib/public_key/doc/src/notes.xml
@@ -35,6 +35,21 @@
<file>notes.xml</file>
</header>
+<section><title>Public_Key 1.6.5</title>
+
+ <section><title>Improvements and New Features</title>
+ <list>
+ <item>
+ <p>
+ Add export of dialyzer type</p>
+ <p>
+ Own Id: OTP-15624</p>
+ </item>
+ </list>
+ </section>
+
+</section>
+
<section><title>Public_Key 1.6.4</title>
<section><title>Improvements and New Features</title>
diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index ee3877ddd0..8db5620686 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -31,7 +31,7 @@
<date></date>
<rev></rev>
</header>
- <module>public_key</module>
+ <module since="">public_key</module>
<modulesummary>API module for public-key infrastructure.</modulesummary>
<description>
<p>Provides functions to handle public-key infrastructure,
@@ -176,7 +176,7 @@
<funcs>
<func>
- <name name="compute_key" arity="2"/>
+ <name name="compute_key" arity="2" since="OTP R16B01"/>
<fsummary>Computes shared secret.</fsummary>
<desc>
<p>Computes shared secret.</p>
@@ -184,7 +184,7 @@
</func>
<func>
- <name name="compute_key" arity="3"/>
+ <name name="compute_key" arity="3" since="OTP R16B01"/>
<fsummary>Computes shared secret.</fsummary>
<desc>
<p>Computes shared secret.</p>
@@ -192,8 +192,8 @@
</func>
<func>
- <name name="decrypt_private" arity="2"/>
- <name name="decrypt_private" arity="3"/>
+ <name name="decrypt_private" arity="2" since="OTP R14B"/>
+ <name name="decrypt_private" arity="3" since="OTP R14B"/>
<fsummary>Public-key decryption.</fsummary>
<desc>
<p>Public-key decryption using the private key. See also <seealso
@@ -202,8 +202,8 @@
</func>
<func>
- <name name="decrypt_public" arity="2"/>
- <name name="decrypt_public" arity="3"/>
+ <name name="decrypt_public" arity="2" since="OTP R14B"/>
+ <name name="decrypt_public" arity="3" since="OTP R14B"/>
<fsummary>Public-key decryption.</fsummary>
<desc>
<p>Public-key decryption using the public key. See also <seealso
@@ -212,7 +212,7 @@
</func>
<func>
- <name name="der_decode" arity="2"/>
+ <name name="der_decode" arity="2" since="OTP R14B"/>
<fsummary>Decodes a public-key ASN.1 DER encoded entity.</fsummary>
<desc>
<p>Decodes a public-key ASN.1 DER encoded entity.</p>
@@ -220,7 +220,7 @@
</func>
<func>
- <name name="der_encode" arity="2"/>
+ <name name="der_encode" arity="2" since="OTP R14B"/>
<fsummary>Encodes a public-key entity with ASN.1 DER encoding.</fsummary>
<desc>
<p>Encodes a public-key entity with ASN.1 DER encoding.</p>
@@ -228,7 +228,7 @@
</func>
<func>
- <name name="dh_gex_group" arity="4"/>
+ <name name="dh_gex_group" arity="4" since="OTP 18.2"/>
<fsummary>Selects a group for Diffie-Hellman key exchange</fsummary>
<desc>
<p>Selects a group for Diffie-Hellman key exchange with the key size in the range <c>MinSize...MaxSize</c>
@@ -249,8 +249,8 @@
</func>
<func>
- <name name="encrypt_private" arity="2"/>
- <name name="encrypt_private" arity="3"/>
+ <name name="encrypt_private" arity="2" since="OTP R14B"/>
+ <name name="encrypt_private" arity="3" since="OTP 21.1"/>
<fsummary>Public-key encryption using the private key.</fsummary>
<desc>
<p>Public-key encryption using the private key.
@@ -260,8 +260,8 @@
</func>
<func>
- <name name="encrypt_public" arity="2"/>
- <name name="encrypt_public" arity="3"/>
+ <name name="encrypt_public" arity="2" since="OTP R14B"/>
+ <name name="encrypt_public" arity="3" since="OTP 21.1"/>
<fsummary>Public-key encryption using the public key.</fsummary>
<desc>
<p>Public-key encryption using the public key. See also <seealso
@@ -270,7 +270,7 @@
</func>
<func>
- <name name="generate_key" arity="1"/>
+ <name name="generate_key" arity="1" since="OTP R16B01"/>
<fsummary>Generates a new keypair.</fsummary>
<desc>
<p>Generates a new keypair. Note that except for Diffie-Hellman
@@ -281,7 +281,7 @@
</func>
<func>
- <name name="pem_decode" arity="1"/>
+ <name name="pem_decode" arity="1" since="OTP R14B"/>
<fsummary>Decodes PEM binary data and returns
entries as ASN.1 DER encoded entities.</fsummary>
<desc>
@@ -291,7 +291,7 @@
</func>
<func>
- <name name="pem_encode" arity="1"/>
+ <name name="pem_encode" arity="1" since="OTP R14B"/>
<fsummary>Creates a PEM binary.</fsummary>
<desc>
<p>Creates a PEM binary.</p>
@@ -299,8 +299,8 @@
</func>
<func>
- <name name="pem_entry_decode" arity="1"/>
- <name name="pem_entry_decode" arity="2"/>
+ <name name="pem_entry_decode" arity="1" since="OTP R14B"/>
+ <name name="pem_entry_decode" arity="2" since="OTP R14B"/>
<fsummary>Decodes a PEM entry.</fsummary>
<desc>
<p>Decodes a PEM entry. <c>pem_decode/1</c> returns a list of PEM
@@ -311,8 +311,8 @@
</func>
<func>
- <name name="pem_entry_encode" arity="2"/>
- <name name="pem_entry_encode" arity="3"/>
+ <name name="pem_entry_encode" arity="2" since="OTP R14B"/>
+ <name name="pem_entry_encode" arity="3" since="OTP R14B"/>
<fsummary>Creates a PEM entry that can be fed to <c>pem_encode/1</c>.</fsummary>
<desc>
<p>Creates a PEM entry that can be feed to <c>pem_encode/1</c>.</p>
@@ -326,7 +326,7 @@
</func>
<func>
- <name name="pkix_decode_cert" arity="2"/>
+ <name name="pkix_decode_cert" arity="2" since=""/>
<fsummary>Decodes an ASN.1 DER-encoded PKIX x509 certificate.</fsummary>
<desc>
<p>Decodes an ASN.1 DER-encoded PKIX certificate. Option <c>otp</c>
@@ -337,7 +337,7 @@
</func>
<func>
- <name name="pkix_encode" arity="3"/>
+ <name name="pkix_encode" arity="3" since="OTP R14B"/>
<fsummary>DER encodes a PKIX x509 certificate or part of such a
certificate.</fsummary>
<desc>
@@ -349,7 +349,7 @@
</func>
<func>
- <name name="pkix_is_issuer" arity="2"/>
+ <name name="pkix_is_issuer" arity="2" since="OTP R14B"/>
<fsummary>Checks if <c>IssuerCert</c> issued <c>Cert</c>.</fsummary>
<desc>
<p>Checks if <c>IssuerCert</c> issued <c>Cert</c>.</p>
@@ -357,7 +357,7 @@
</func>
<func>
- <name name="pkix_is_fixed_dh_cert" arity="1"/>
+ <name name="pkix_is_fixed_dh_cert" arity="1" since="OTP R14B"/>
<fsummary>Checks if a certificate is a fixed Diffie-Hellman certificate.</fsummary>
<desc>
<p>Checks if a certificate is a fixed Diffie-Hellman certificate.</p>
@@ -365,7 +365,7 @@
</func>
<func>
- <name name="pkix_is_self_signed" arity="1"/>
+ <name name="pkix_is_self_signed" arity="1" since="OTP R14B"/>
<fsummary>Checks if a certificate is self-signed.</fsummary>
<desc>
<p>Checks if a certificate is self-signed.</p>
@@ -373,7 +373,7 @@
</func>
<func>
- <name name="pkix_issuer_id" arity="2"/>
+ <name name="pkix_issuer_id" arity="2" since="OTP R14B"/>
<fsummary>Returns the issuer id.</fsummary>
<desc>
<p>Returns the issuer id.</p>
@@ -381,7 +381,7 @@
</func>
<func>
- <name name="pkix_normalize_name" arity="1"/>
+ <name name="pkix_normalize_name" arity="1" since="OTP R14B"/>
<fsummary>Normalizes an issuer name so that it can be easily
compared to another issuer name.</fsummary>
<desc>
@@ -391,7 +391,7 @@
</func>
<func>
- <name>pkix_path_validation(TrustedCert, CertChain, Options) -> {ok, {PublicKeyInfo, PolicyTree}} | {error, {bad_cert, Reason}} </name>
+ <name since="OTP R16B">pkix_path_validation(TrustedCert, CertChain, Options) -> {ok, {PublicKeyInfo, PolicyTree}} | {error, {bad_cert, Reason}} </name>
<fsummary>Performs a basic path validation according to RFC 5280.</fsummary>
<type>
<v>TrustedCert = #'OTPCertificate'{} | der_encoded() | atom()</v>
@@ -423,7 +423,7 @@
<p>Available options:</p>
<taglist>
- <tag>{verify_fun, fun()}</tag>
+ <tag>{verify_fun, {fun(), InitialUserState::term()}</tag>
<item>
<p>The fun must be defined as:</p>
@@ -491,7 +491,7 @@ fun(OtpCert :: #'OTPCertificate'{},
</func>
<func>
- <name name="pkix_crl_issuer" arity="1"/>
+ <name name="pkix_crl_issuer" arity="1" since="OTP 17.5"/>
<fsummary>Returns the issuer of the <c>CRL</c>.</fsummary>
<desc>
<p>Returns the issuer of the <c>CRL</c>.</p>
@@ -499,7 +499,7 @@ fun(OtpCert :: #'OTPCertificate'{},
</func>
<func>
- <name name="pkix_crls_validate" arity="3"/>
+ <name name="pkix_crls_validate" arity="3" since="OTP R16B"/>
<fsummary>Performs CRL validation.</fsummary>
<desc>
<p>Performs CRL validation. It is intended to be called from
@@ -541,7 +541,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
<tag>{undetermined_details, boolean()}</tag>
<item>
- <p>Defaults to false. When revocation status can not be
+ <p>Defaults to false. When revocation status cannot be
determined, and this option is set to true, details of why no
CRLs where accepted are included in the return value.</p>
</item>
@@ -551,7 +551,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_crl_verify" arity="2"/>
+ <name name="pkix_crl_verify" arity="2" since="OTP 17.5"/>
<fsummary> Verify that <c>Cert</c> is the <c> CRL</c> signer. </fsummary>
<desc>
<p>Verify that <c>Cert</c> is the <c>CRL</c> signer.</p>
@@ -559,7 +559,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_dist_point" arity="1"/>
+ <name name="pkix_dist_point" arity="1" since="OTP 17.5"/>
<fsummary>Creates a distribution point for CRLs issued by the same issuer as <c>Cert</c>.</fsummary>
<desc>
<p>Creates a distribution point for CRLs issued by the same issuer as <c>Cert</c>.
@@ -570,7 +570,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_dist_points" arity="1"/>
+ <name name="pkix_dist_points" arity="1" since="OTP 17.5"/>
<fsummary> Extracts distribution points from the certificates extensions.</fsummary>
<desc>
<p> Extracts distribution points from the certificates extensions.</p>
@@ -578,7 +578,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_match_dist_point" arity="2"/>
+ <name name="pkix_match_dist_point" arity="2" since="OTP 19.0"/>
<fsummary>Checks whether the given distribution point matches the
Issuing Distribution Point of the CRL.</fsummary>
<desc>
@@ -590,7 +590,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_sign" arity="2"/>
+ <name name="pkix_sign" arity="2" since="OTP R14B"/>
<fsummary>Signs certificate.</fsummary>
<desc>
<p>Signs an 'OTPTBSCertificate'. Returns the corresponding
@@ -599,7 +599,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_sign_types" arity="1"/>
+ <name name="pkix_sign_types" arity="1" since="OTP R16B01"/>
<fsummary>Translates signature algorithm OID to Erlang digest and signature algorithm types.</fsummary>
<desc>
<p>Translates signature algorithm OID to Erlang digest and signature types.
@@ -609,8 +609,8 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name>pkix_test_data(Options) -> Config </name>
- <name>pkix_test_data([chain_opts()]) -> [conf_opt()]</name>
+ <name since="OTP 20.1">pkix_test_data(Options) -> Config </name>
+ <name since="OTP 20.1">pkix_test_data([chain_opts()]) -> [conf_opt()]</name>
<fsummary>Creates certificate test data.</fsummary>
<type>
<v>Options = #{chain_type() := chain_opts()} </v>
@@ -644,7 +644,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
<v>conf_opt() = {cert, der_encoded()} | {key, PrivateKey} |{cacerts, [der_encoded()]}</v>
<d>
This is a subset of the type
- <seealso marker="ssl:ssl#type-ssloption"> ssl:ssl_option()</seealso>.
+ <seealso marker="ssl:ssl#type-tls_option"> ssl:tls_option()</seealso>.
<c>PrivateKey</c> is what
<seealso marker="#generate_key-1">generate_key/1</seealso>
returns.
@@ -736,13 +736,13 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
<note><p>
Note that the generated certificates and keys does not provide a formally correct PKIX-trust-chain
- and they can not be used to achieve real security. This function is provided for testing purposes only.
+ and they cannot be used to achieve real security. This function is provided for testing purposes only.
</p></note>
</desc>
</func>
<func>
- <name>pkix_test_root_cert(Name, Options) -> RootCert</name>
+ <name since="OTP 20.2">pkix_test_root_cert(Name, Options) -> RootCert</name>
<fsummary>Generates a test data root cert.</fsummary>
<type>
<v>Name = string()</v>
@@ -772,7 +772,7 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name name="pkix_verify" arity="2"/>
+ <name name="pkix_verify" arity="2" since="OTP R14B"/>
<fsummary>Verifies PKIX x.509 certificate signature.</fsummary>
<desc>
<p>Verifies PKIX x.509 certificate signature.</p>
@@ -780,8 +780,8 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
</func>
<func>
- <name>pkix_verify_hostname(Cert, ReferenceIDs) -> boolean()</name>
- <name>pkix_verify_hostname(Cert, ReferenceIDs, Opts) -> boolean()</name>
+ <name since="OTP 19.3">pkix_verify_hostname(Cert, ReferenceIDs) -> boolean()</name>
+ <name since="OTP 19.3">pkix_verify_hostname(Cert, ReferenceIDs, Opts) -> boolean()</name>
<fsummary>Verifies that a PKIX x.509 certificate <i>presented identifier</i> (e.g hostname) is
an expected one.</fsummary>
<type>
@@ -813,7 +813,8 @@ fun(#'DistributionPoint'{}, #'CertificateList'{},
<p>The <c>{OtherRefId,term()}</c> is defined by the user and is passed to the <c>match_fun</c>, if defined.
If the term in <c>OtherRefId</c> is a binary, it will be converted to a string.
</p>
- <p>The <c>ip</c> Reference ID takes an <seealso marker="inet:inet#type-ip_address">inet:ip_address()</seealso>
+ <p>The <c>ip</c> Reference ID takes an
+ <seealso marker="kernel:inet#type-ip_address">inet:ip_address()</seealso>
or an ip address in string format (E.g "10.0.1.1" or "1234::5678:9012") as second element.
</p>
<p>The options are:</p>
@@ -864,7 +865,7 @@ end
</func>
<func>
- <name>pkix_verify_hostname_match_fun(Protcol) -> fun(RefId | FQDN::string(), PresentedID) -> boolean() | default</name>
+ <name since="OTP 21.0">pkix_verify_hostname_match_fun(Protcol) -> fun(RefId | FQDN::string(), PresentedID) -> boolean() | default</name>
<fsummary>Returns a fun that is intendended as argument to the match_fun option in pkix_verify_hostname/3.
</fsummary>
<type>
@@ -889,8 +890,8 @@ end
<func>
- <name name="sign" arity="3"/>
- <name name="sign" arity="4"/>
+ <name name="sign" arity="3" since=""/>
+ <name name="sign" arity="4" since="OTP 20.1"/>
<fsummary>Creates a digital signature.</fsummary>
<desc>
<p>Creates a digital signature.</p>
@@ -901,7 +902,7 @@ end
</func>
<func>
- <name name="ssh_decode" arity="2"/>
+ <name name="ssh_decode" arity="2" since="OTP R14B03"/>
<fsummary>Decodes an SSH file-binary.</fsummary>
<desc>
<p>Decodes an SSH file-binary. In the case of <c>known_hosts</c> or
@@ -933,7 +934,7 @@ end
</func>
<func>
- <name name="ssh_encode" arity="2"/>
+ <name name="ssh_encode" arity="2" since="OTP R14B03"/>
<fsummary>Encodes a list of SSH file entries to a binary.</fsummary>
<desc>
<p>Encodes a list of SSH file entries (public keys and attributes) to a binary. Possible
@@ -947,9 +948,9 @@ end
</func>
<func>
- <name>ssh_hostkey_fingerprint(HostKey) -> string()</name>
- <name>ssh_hostkey_fingerprint(DigestType, HostKey) -> string()</name>
- <name>ssh_hostkey_fingerprint([DigestType], HostKey) -> [string()]</name>
+ <name since="OTP 19.2">ssh_hostkey_fingerprint(HostKey) -> string()</name>
+ <name since="OTP 19.2">ssh_hostkey_fingerprint(DigestType, HostKey) -> string()</name>
+ <name since="OTP 19.2">ssh_hostkey_fingerprint([DigestType], HostKey) -> [string()]</name>
<fsummary>Calculates a ssh fingerprint for a hostkey.</fsummary>
<type>
<v>HostKey = <seealso marker="#type-public_key">public_key()</seealso></v>
@@ -982,8 +983,8 @@ end
</func>
<func>
- <name name="verify" arity="4"/>
- <name name="verify" arity="5"/>
+ <name name="verify" arity="4" since="OTP R14B"/>
+ <name name="verify" arity="5" since="OTP 20.1"/>
<fsummary>Verifies a digital signature.</fsummary>
<desc>
<p>Verifies a digital signature.</p>
@@ -993,7 +994,7 @@ end
</func>
<func>
- <name name="short_name_hash" arity="1"/>
+ <name name="short_name_hash" arity="1" since="OTP 19.0"/>
<fsummary>Generates a short hash of an issuer name.</fsummary>
<desc>
<p>Generates a short hash of an issuer name. The hash is
diff --git a/lib/public_key/src/pubkey_pbe.erl b/lib/public_key/src/pubkey_pbe.erl
index 806f7c5b0f..e6bcedd1b1 100644
--- a/lib/public_key/src/pubkey_pbe.erl
+++ b/lib/public_key/src/pubkey_pbe.erl
@@ -42,15 +42,14 @@
encode(Data, Password, "DES-CBC" = Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
crypto:block_encrypt(des_cbc, Key, IV, pbe_pad(Data, KeyDevParams));
-
encode(Data, Password, "DES-EDE3-CBC" = Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
<<Key1:8/binary, Key2:8/binary, Key3:8/binary>> = Key,
crypto:block_encrypt(des3_cbc, [Key1, Key2, Key3], IV, pbe_pad(Data));
-
encode(Data, Password, "RC2-CBC" = Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
crypto:block_encrypt(rc2_cbc, Key, IV, pbe_pad(Data, KeyDevParams)).
+
%%--------------------------------------------------------------------
-spec decode(binary(), string(), string(), term()) -> binary().
%%
@@ -59,21 +58,20 @@ encode(Data, Password, "RC2-CBC" = Cipher, KeyDevParams) ->
decode(Data, Password,"DES-CBC"= Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
crypto:block_decrypt(des_cbc, Key, IV, Data);
-
decode(Data, Password,"DES-EDE3-CBC" = Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
<<Key1:8/binary, Key2:8/binary, Key3:8/binary>> = Key,
crypto:block_decrypt(des3_cbc, [Key1, Key2, Key3], IV, Data);
-
decode(Data, Password,"RC2-CBC"= Cipher, KeyDevParams) ->
{Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
crypto:block_decrypt(rc2_cbc, Key, IV, Data);
+decode(Data, Password,"AES-128-CBC"= Cipher, KeyDevParams) ->
+ {Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
+ crypto:block_decrypt(aes_cbc128, Key, IV, Data);
+decode(Data, Password,"AES-256-CBC"= Cipher, KeyDevParams) ->
+ {Key, IV} = password_to_key_and_iv(Password, Cipher, KeyDevParams),
+ crypto:block_decrypt(aes_cbc256, Key, IV, Data).
-decode(Data, Password,"AES-128-CBC"= Cipher, IV) ->
- %% PKCS5_SALT_LEN is 8 bytes
- <<Salt:8/binary,_/binary>> = IV,
- {Key, _} = password_to_key_and_iv(Password, Cipher, Salt),
- crypto:block_decrypt(aes_cbc128, Key, IV, Data).
%%--------------------------------------------------------------------
-spec pbdkdf1(string(), iodata(), integer(), atom()) -> binary().
@@ -131,13 +129,15 @@ password_to_key_and_iv(Password, _Cipher, {#'PBEParameter'{salt = Salt,
<<Key:8/binary, IV:8/binary, _/binary>>
= pbdkdf1(Password, Salt, Count, Hash),
{Key, IV};
-password_to_key_and_iv(Password, Cipher, Salt) ->
- KeyLen = derived_key_length(Cipher, undefined),
+password_to_key_and_iv(Password, Cipher, KeyDevParams) ->
+ %% PKCS5_SALT_LEN is 8 bytes
+ <<Salt:8/binary,_/binary>> = KeyDevParams,
+ KeyLen = derived_key_length(Cipher, undefined),
<<Key:KeyLen/binary, _/binary>> =
pem_encrypt(<<>>, Password, Salt, ceiling(KeyLen div 16), <<>>, md5),
%% Old PEM encryption does not use standard encryption method
- %% pbdkdf1 and uses then salt as IV
- {Key, Salt}.
+ %% pbdkdf1
+ {Key, KeyDevParams}.
pem_encrypt(_, _, _, 0, Acc, _) ->
Acc;
pem_encrypt(Prev, Password, Salt, Count, Acc, Hash) ->
@@ -267,7 +267,9 @@ derived_key_length(Cipher,_) when (Cipher == ?'des-EDE3-CBC') or
(Cipher == "DES-EDE3-CBC") ->
24;
derived_key_length(Cipher,_) when (Cipher == "AES-128-CBC") ->
- 16.
+ 16;
+derived_key_length(Cipher,_) when (Cipher == "AES-256-CBC") ->
+ 32.
cipher(#'PBES2-params_encryptionScheme'{algorithm = ?'desCBC'}) ->
"DES-CBC";
diff --git a/lib/public_key/src/pubkey_pem.erl b/lib/public_key/src/pubkey_pem.erl
index d7e5bc3ad8..0fd1453f7c 100644
--- a/lib/public_key/src/pubkey_pem.erl
+++ b/lib/public_key/src/pubkey_pem.erl
@@ -101,10 +101,10 @@ encode_pem_entry({'PrivateKeyInfo', Der, EncParams}) ->
EncDer = encode_encrypted_private_keyinfo(Der, EncParams),
StartStr = pem_start('EncryptedPrivateKeyInfo'),
[StartStr, "\n", b64encode_and_split(EncDer), "\n", pem_end(StartStr) ,"\n\n"];
-encode_pem_entry({Type, Der, {Cipher, Salt}}) ->
+encode_pem_entry({Type, Decrypted, {Cipher, Salt}}) ->
StartStr = pem_start(Type),
[StartStr,"\n", pem_decrypt(),"\n", pem_decrypt_info(Cipher, Salt),"\n\n",
- b64encode_and_split(Der), "\n", pem_end(StartStr) ,"\n\n"].
+ b64encode_and_split(Decrypted), "\n", pem_end(StartStr) ,"\n\n"].
decode_pem_entries([], Entries) ->
lists:reverse(Entries);
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 75d40d2e8a..47c5dbb95a 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -66,7 +66,7 @@
-export_type([public_key/0, private_key/0, pem_entry/0,
pki_asn1_type/0, asn1_type/0, ssh_file/0, der_encoded/0,
- key_params/0, digest_type/0]).
+ key_params/0, digest_type/0, issuer_name/0, oid/0]).
-type public_key() :: rsa_public_key() | dsa_public_key() | ec_public_key() | ed_public_key() .
-type private_key() :: rsa_private_key() | dsa_private_key() | ec_private_key() | ed_private_key() .
diff --git a/lib/public_key/test/pbe_SUITE.erl b/lib/public_key/test/pbe_SUITE.erl
index 523c9e2515..1136267411 100644
--- a/lib/public_key/test/pbe_SUITE.erl
+++ b/lib/public_key/test/pbe_SUITE.erl
@@ -37,7 +37,7 @@ all() ->
[
pbdkdf1,
pbdkdf2,
- old_enc,
+ old_pbe,
pbes1,
pbes2].
@@ -197,23 +197,11 @@ pbdkdf2(Config) when is_list(Config) ->
= pubkey_pbe:pbdkdf2("pass\0word",
"sa\0lt", 4096, 16, fun crypto:hmac/4, sha, 20).
-old_enc() ->
- [{doc,"Tests encode/decode RSA key encrypted with different ciphers using old PEM encryption scheme"}].
-old_enc(Config) when is_list(Config) ->
- Datadir = proplists:get_value(data_dir, Config),
- %% key generated with ssh-keygen -N hello_aes -f old_aes_128_cbc_enc_key.pem
- {ok, PemAesCbc} = file:read_file(filename:join(Datadir, "old_aes_128_cbc_enc_key.pem")),
-
- PemAesCbcEntry = public_key:pem_decode(PemAesCbc),
- ct:print("Pem entry: ~p" , [PemAesCbcEntry]),
- [{'RSAPrivateKey', _, {"AES-128-CBC",_}} = PubAesCbcEntry] = PemAesCbcEntry,
- #'RSAPrivateKey'{} = public_key:pem_entry_decode(PubAesCbcEntry, "hello_aes").
-
pbes1() ->
[{doc,"Tests encode/decode EncryptedPrivateKeyInfo encrypted with different ciphers using PBES1"}].
pbes1(Config) when is_list(Config) ->
decode_encode_key_file("pbes1_des_cbc_md5_enc_key.pem", "password", "DES-CBC", Config).
-
+
pbes2() ->
[{doc,"Tests encode/decode EncryptedPrivateKeyInfo encrypted with different ciphers using PBES2"}].
pbes2(Config) when is_list(Config) ->
@@ -225,13 +213,33 @@ pbes2(Config) when is_list(Config) ->
false ->
ok
end.
+old_pbe() ->
+ [{doc,"Tests encode/decode with old format used before PBE"}].
+old_pbe(Config) when is_list(Config) ->
+ Datadir = proplists:get_value(data_dir, Config),
+ % key generated with ssh-keygen -N hello_aes -f old_aes_128_cbc.pem
+ {ok, PemAes128Cbc} = file:read_file(filename:join(Datadir, "old_aes_128_cbc.pem")),
+
+ PemAes128CbcEntries = public_key:pem_decode(PemAes128Cbc),
+ ct:print("Pem entry: ~p" , [PemAes128CbcEntries]),
+ [{'RSAPrivateKey', _, {"AES-128-CBC",_}} = Aes128CbcEntry] = PemAes128CbcEntries,
+ #'RSAPrivateKey'{} = Key = public_key:pem_entry_decode(Aes128CbcEntry, "hello_aes"),
+
+ %% Converted with openssl rsa -in old_aes_128_cbc.pem -out old_aes_256_cbc.pem -aes256
+ {ok, PemAes256Cbc} = file:read_file(filename:join(Datadir, "old_aes_256_cbc.pem")),
+
+ PemAes256CbcEntries = public_key:pem_decode(PemAes256Cbc),
+ ct:print("Pem entry: ~p" , [PemAes256CbcEntries]),
+ [{'RSAPrivateKey', _, {"AES-256-CBC",_}} = Aes256CbcEntry] = PemAes256CbcEntries,
+ Key = public_key:pem_entry_decode(Aes256CbcEntry, "hello_aes").
+
decode_encode_key_file(File, Password, Cipher, Config) ->
Datadir = proplists:get_value(data_dir, Config),
{ok, PemKey} = file:read_file(filename:join(Datadir, File)),
PemEntry = public_key:pem_decode(PemKey),
- ct:print("Pem entry: ~p" , [PemEntry]),
+ ct:pal("Pem entry: ~p" , [PemEntry]),
[{Asn1Type, _, {Cipher,_} = CipherInfo} = PubEntry] = PemEntry,
#'RSAPrivateKey'{} = KeyInfo = public_key:pem_entry_decode(PubEntry, Password),
PemKey1 = public_key:pem_encode([public_key:pem_entry_encode(Asn1Type, KeyInfo, {CipherInfo, Password})]),
diff --git a/lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc_enc_key.pem b/lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc.pem
index 34c7543f30..34c7543f30 100644
--- a/lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc_enc_key.pem
+++ b/lib/public_key/test/pbe_SUITE_data/old_aes_128_cbc.pem
diff --git a/lib/public_key/test/pbe_SUITE_data/old_aes_256_cbc.pem b/lib/public_key/test/pbe_SUITE_data/old_aes_256_cbc.pem
new file mode 100644
index 0000000000..e6aec2869d
--- /dev/null
+++ b/lib/public_key/test/pbe_SUITE_data/old_aes_256_cbc.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,ABDA22398E511E9465983E1A50706044
+
+XhIcPOb6pTWL++pgeeTH5rsx0tackhllVqyXyOfbYMBJnVFRhQ/V/1MDg3Jt4wD1
+Nerhcv5srHeiwmf+vwXwDFOzvFzLVM1jFMUJe/2XloYFX4TBiLZAF/zekQA3uPY6
+DKJuBuO5vVSZ0VlxGpu3jphIAwxbssfZkZmryCP3b1/oX5Y3Em/wEWW3RduaeWFu
+Z2nTsPH3yNmHkuqFF3cq0aZs+VxtjcuYo0gbkN5hNVgOoOVxIBzw7DsgBAkdXvr3
+LRCMGg7Y2pVthA963s0xkN37XtZEiYbydoLnzHlW/Kx5QSvED8/Fn94Lcdy5NsQN
+7nYWWgYZRH39Wnsi0BrTZv399U5rBe7DnpStKWPn2Sa8Bdu3CX2oLajM1cZjAp1X
+y6vuasK7SoZ8rWpcsHQpV1HyNBTl/uRU5nrYc/KGD8l2x7tdNidGx2Hey/6O4H5v
+rxL1TB4PlzDYwCsReuyLbEjyuZQ10j0SK/SFzikHuvD2IEpM/oUaPdVFqcW8/sjw
+VhcsupAf4EXfsi2dJBylmDjI2W7h9XwBDLzQN+69DtkBmvimE5CguTITf8MAHQQ6
+Q1vYF2ij7W675tj9ulksRPaMxSsI03luai/Jrieh0mPqGEenGEEC5QU0XPOvsfyw
+GMYaBUbdYrMpbHM3wFPxM2wRlXf4gX5BhZKRGZX7OaEs54pfglyQtTPuZmD0VcAp
+EWHq70G9mbuBlhbMX1rKAomuDmIvgLeLRUpAFf59Qr8KoJSLD1S8TJB3uEPk6i39
+4GnylbpmqS4gv/OIc6WTeOeUZTAD3A77HBwSlELPk3/s1d/MLyfciYClOBEuZ6NB
+FXEKCGCEC786zJA678gLEaa2XPNkEM+2gjzNFqtYMIn5ehAq/HRRsFvW+wkTbee4
+z+qe5HbVKAQ3EOfbidvYrDaGd7HvHVG8zosl+O61iIFs04lLEMDFXBIdvIgEncOK
+Rq3yXdpBKMg89aoZLniaPobSvuvdjNOMzW6EKlb5FKZduCiR68MEZ+rLHYHTwE3W
+Z5+TCbrbV2F6WQpq3zqnB14wGu8igEb5Veq+N2vMkx4iTMTUyCty1SwIjj4NidM1
+dJM7Ighdal6tQ6hIwbDfpIPsY4eGH/UrdVZ0SkxuDR2s76cZ8nFX3lJ/BNwTZLKo
+IqAC4NjUOv3ID+0Q6Lz+sxLCi5pLYUf0E+s4pgi1BYAOu+BF3GwxyqnqVoq/Fs5D
+LXxuY0946YM+WcrYzke4mq3MPx6QQYj04H5KJ2mzxtnbZJrfLF23PVRVhvgKSjyV
+I3/zgJ16fV2H/fb26oCpTNbb11pQvhorkLwdvpwtM+go7dJGebAi1762Nbj/CqnW
+fbBPxPRvNPZn6pEodJ/L/APhvGv1K7eC9THj66H7Kmeoq8Lz74idhywP9I3QS0ZO
+15ORbTDjuiRYNJPxxu79A3/tWMUlprJ9ljhI/0DXRB0M3UGic52D/32Q64I7eewy
+qRNS/3C3ejDShIRBDFTdDkM3s/42LySXJjmjU9bpZY4POQ3kOaJb3EzSvbzTyXzu
+3FiHvDQY+b8XwbxtE/kTMaAPQZ7TtWOao7SRi7J94MvCQ5/tbakFP2suM8psnigC
+-----END RSA PRIVATE KEY-----
diff --git a/lib/public_key/vsn.mk b/lib/public_key/vsn.mk
index 5e2643f0ea..11c06fb158 100644
--- a/lib/public_key/vsn.mk
+++ b/lib/public_key/vsn.mk
@@ -1 +1 @@
-PUBLIC_KEY_VSN = 1.6.4
+PUBLIC_KEY_VSN = 1.6.5
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-25 06:07:18 +0000