Skip to content

Commit d0e172b

Browse files
jmagnejmagne
committed
Fix: Add support to PBMAC1 in pkcs 12 [JSS]
Add PBMAC1 (RFC 9579) support for PKCS#12 files Implement modern password-based MAC algorithm as defined in RFC 9579. Supports HMAC-SHA256/384/512 with PBKDF2 key derivation. Maintains full backward compatibility with legacy PKCS#12 v1.0 MAC. Includes comprehensive test suite and NSS interoperability validation. Coding assitant aided. Address review bot issues.
1 parent bd994f9 commit d0e172b

8 files changed

Lines changed: 938 additions & 8 deletions

File tree

‎base/src/main/java/org/mozilla/jss/netscape/security/pkcs/PKCS12Util.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,13 +67,21 @@
6767
import org.mozilla.jss.pkix.primitive.Attribute;
6868
import org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo;
6969
import org.mozilla.jss.util.Password;
70+
import org.mozilla.jss.crypto.DigestAlgorithm;
7071
import org.slf4j.Logger;
7172
import org.slf4j.LoggerFactory;
7273

7374
public class PKCS12Util {
7475

7576
private static Logger logger = LoggerFactory.getLogger(PKCS12Util.class);
7677

78+
79+
//Differentiate between newer PBMAC1 and older algs
80+
public static enum MacType {
81+
LEGACY,
82+
PBMAC1
83+
}
84+
7785
public final static String NO_ENCRYPTION = "none";
7886

7987
public final static List<PBEAlgorithm> SUPPORTED_CERT_ENCRYPTIONS = Arrays.asList(new PBEAlgorithm[] {
@@ -97,6 +105,26 @@ public class PKCS12Util {
97105
PBEAlgorithm keyEncryption = DEFAULT_KEY_ENCRYPTION;
98106
boolean trustFlagsEnabled = true;
99107

108+
// MAC configuration (separate from encryption)
109+
private MacType macType = MacType.LEGACY; // default for backward compatibility
110+
private DigestAlgorithm macDigest = DigestAlgorithm.SHA1; // default digest
111+
112+
public void setMacType(MacType type) {
113+
this.macType = type;
114+
}
115+
116+
public MacType getMacType() {
117+
return macType;
118+
}
119+
120+
public void setMacDigest(DigestAlgorithm digest) {
121+
this.macDigest = digest;
122+
}
123+
124+
public DigestAlgorithm getMacDigest() {
125+
return macDigest;
126+
}
127+
100128
public PKCS12Util() throws Exception {
101129
random = SecureRandom.getInstance("pkcs11prng", "Mozilla-JSS");
102130
}
@@ -603,6 +631,10 @@ public PFX generatePFX(PKCS12 pkcs12, Password password) throws Exception {
603631

604632
byte[] salt = new byte[16];
605633
random.nextBytes(salt);
634+
635+
pfx.setMacType(macType);
636+
pfx.setMacDigest(macDigest);
637+
606638
pfx.computeMacData(password, salt, 100000);
607639

608640
return pfx;

‎base/src/main/java/org/mozilla/jss/pkcs12/MacData.java‎

Lines changed: 135 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
import java.io.IOException;
99
import java.io.InputStream;
1010
import java.io.OutputStream;
11+
import java.io.ByteArrayInputStream;
12+
import java.io.ByteArrayOutputStream;
1113
import java.security.DigestException;
1214
import java.security.InvalidAlgorithmParameterException;
1315
import java.security.InvalidKeyException;
@@ -22,6 +24,8 @@
2224
import org.mozilla.jss.asn1.OCTET_STRING;
2325
import org.mozilla.jss.asn1.SEQUENCE;
2426
import org.mozilla.jss.asn1.Tag;
27+
import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;
28+
import org.mozilla.jss.asn1.ANY;
2529
import org.mozilla.jss.crypto.CryptoToken;
2630
import org.mozilla.jss.crypto.DigestAlgorithm;
2731
import org.mozilla.jss.crypto.HMACAlgorithm;
@@ -32,8 +36,11 @@
3236
import org.mozilla.jss.crypto.PBEKeyGenParams;
3337
import org.mozilla.jss.crypto.SymmetricKey;
3438
import org.mozilla.jss.crypto.TokenException;
39+
import org.mozilla.jss.crypto.PBEAlgorithm;
40+
import org.mozilla.jss.pkix.primitive.PBMAC1Params;
3541
import org.mozilla.jss.pkcs7.DigestInfo;
3642
import org.mozilla.jss.pkix.primitive.AlgorithmIdentifier;
43+
import org.mozilla.jss.pkix.primitive.PBKDF2Params;
3744
import org.mozilla.jss.util.Password;
3845

3946
public class MacData implements ASN1Value {
@@ -137,13 +144,28 @@ public MacData( Password password, byte[] macSalt,
137144
rand.nextBytes(macSalt);
138145
}
139146

140-
PBEKeyGenParams params = new PBEKeyGenParams(password, macSalt, iterations);
147+
// Handle null algID - default to SHA1 for backward compatibility
141148

142149
try {
143-
// generate key from password and salt
144-
if(algID == null) {
150+
if (algID == null) {
145151
algID = new AlgorithmIdentifier(DigestAlgorithm.SHA1.toOID());
146152
}
153+
154+
// Check if this is PBMAC1 - route to new implementation
155+
if (algID.getOID().equals(PBEAlgorithm.PBE_PKCS5_PBMAC1.toOID())) {
156+
computePBMAC1(token,password, macSalt, iterations, toBeMACed, algID);
157+
return; // Early return - skip legacy code below
158+
}
159+
} catch (NoSuchAlgorithmException e) {
160+
throw new TokenException("Algorithm OID error: " + e.getMessage(), e);
161+
} catch (Exception e) {
162+
throw new TokenException("Failed to compute PBMAC1: " + e.getMessage(), e);
163+
}
164+
165+
PBEKeyGenParams params = new PBEKeyGenParams(password, macSalt, iterations);
166+
167+
try {
168+
// generate key from password and salt
147169
KeyGenerator kg = null;
148170
JSSMessageDigest digest = null;
149171
if(DigestAlgorithm.SHA1.toOID().equals(algID.getOID())){
@@ -176,7 +198,7 @@ public MacData( Password password, byte[] macSalt,
176198
// put everything into a DigestInfo
177199
this.mac = new DigestInfo(algID, new OCTET_STRING(digestBytes));
178200
this.macSalt = new OCTET_STRING(macSalt);
179-
this.macIterationCount = new INTEGER(iterations);
201+
this.macIterationCount = new INTEGER(1);
180202

181203
} catch (NoSuchAlgorithmException e) {
182204
throw new RuntimeException("HMAC algorithm not found on internal " +
@@ -196,6 +218,115 @@ public MacData( Password password, byte[] macSalt,
196218
}
197219
}
198220

221+
private void computePBMAC1(CryptoToken token, Password password, byte[] salt, int iterations,
222+
byte[] data, AlgorithmIdentifier algID)
223+
throws Exception
224+
{
225+
// Parse PBMAC1 parameters to extract KDF and MAC algorithms
226+
227+
PBMAC1Params pbmac1Params;
228+
ASN1Value params = algID.getParameters();
229+
230+
if (params instanceof PBMAC1Params) {
231+
// Already decoded (create/write path)
232+
pbmac1Params = (PBMAC1Params) params;
233+
} else if (params instanceof ANY) {
234+
// Needs decoding (read from file path)
235+
pbmac1Params = (PBMAC1Params) ((ANY) params).decodeWith(PBMAC1Params.getTemplate());
236+
} else {
237+
throw new Exception("Unexpected PBMAC1 parameter type: " + params.getClass().getName());
238+
}
239+
240+
ByteArrayOutputStream bos = new ByteArrayOutputStream();
241+
242+
algID.encode(bos);
243+
byte[] pbmac1AlgIDBytes = bos.toByteArray();
244+
245+
AlgorithmIdentifier kdfAlg = pbmac1Params.getKeyDerivationFunc();
246+
AlgorithmIdentifier macAlg = pbmac1Params.getMessageAuthScheme();
247+
248+
ASN1Value kdfParams = kdfAlg.getParameters();
249+
250+
//Extract PBKDF2 parameters
251+
PBKDF2Params pbkdf2Params;
252+
253+
if (kdfParams instanceof SEQUENCE) {
254+
// Need to decode SEQUENCE bytes to PBKDF2Params
255+
ByteArrayOutputStream bosForDecode = new ByteArrayOutputStream();
256+
kdfParams.encode(bosForDecode);
257+
pbkdf2Params = (PBKDF2Params) PBKDF2Params.getTemplate().decode(
258+
new ByteArrayInputStream(bosForDecode.toByteArray()));
259+
260+
} else if (kdfParams instanceof ANY) {
261+
// Create template that knows PBKDF2 structure
262+
pbkdf2Params = (PBKDF2Params) ((ANY) kdfParams).decodeWith(PBKDF2Params.getTemplate());
263+
} else {
264+
throw new Exception("Unexpected PBKDF2 parameter type: " + kdfParams.getClass().getName());
265+
}
266+
267+
byte[] kdfSalt = pbkdf2Params.getSalt();
268+
int kdfIterations = pbkdf2Params.getIterations();
269+
270+
// Get HMAC OID from MAC AlgorithmIdentifier
271+
OBJECT_IDENTIFIER macOID = macAlg.getOID();
272+
273+
HMACAlgorithm hmacAlgorithm;
274+
if (macOID.equals(HMACAlgorithm.SHA256.toOID())) {
275+
hmacAlgorithm = HMACAlgorithm.SHA256;
276+
} else if (macOID.equals(HMACAlgorithm.SHA384.toOID())) {
277+
hmacAlgorithm = HMACAlgorithm.SHA384;
278+
} else if (macOID.equals(HMACAlgorithm.SHA512.toOID())) {
279+
hmacAlgorithm = HMACAlgorithm.SHA512;
280+
} else {
281+
throw new NoSuchAlgorithmException("Unsupported HMAC algorithm for PBMAC1: " + macOID.toString());
282+
}
283+
284+
// Call native JSS code to perform PBKDF2 + HMAC
285+
// This uses certified NSS crypto (PK11_PBEKeyGen + PK11_DigestOp)
286+
// The OID will be mapped to the appropriate NSS HMAC mechanism
287+
288+
289+
char[] passwordChars = password.getCharCopy();
290+
byte[] passwordBytes = Password.charToByte(passwordChars);
291+
292+
try {
293+
byte[] macValue = nativeComputePBMAC1(
294+
token,
295+
passwordBytes,
296+
data,
297+
pbmac1AlgIDBytes,
298+
hmacAlgorithm
299+
);
300+
301+
this.mac = new DigestInfo(algID, new OCTET_STRING(macValue));
302+
this.macSalt = new OCTET_STRING(kdfSalt);
303+
this.macIterationCount = new INTEGER(kdfIterations);
304+
} finally {
305+
Password.wipeBytes(passwordBytes);
306+
if (passwordChars != null) {
307+
Password.wipeChars(passwordChars);
308+
}
309+
}
310+
}
311+
312+
/**
313+
* Native method to compute PBMAC1 MAC using NSS.
314+
*
315+
* @param password Password bytes
316+
* @param salt PBKDF2 salt
317+
* @param iterations PBKDF2 iteration count
318+
* @param data Data to MAC
319+
* @param hmacOID HMAC algorithm OID (e.g., hmacWithSHA256)
320+
* @return HMAC value
321+
*/
322+
private native byte[] nativeComputePBMAC1(
323+
CryptoToken token,
324+
byte[] password,
325+
byte[] data,
326+
byte[] pbmac1AlgID,
327+
HMACAlgorithm hmacAlgorithm
328+
) throws Exception;
329+
199330
///////////////////////////////////////////////////////////////////////
200331
// DER encoding
201332
///////////////////////////////////////////////////////////////////////

‎base/src/main/java/org/mozilla/jss/pkcs12/PFX.java‎

Lines changed: 90 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,23 @@
2828
import org.mozilla.jss.asn1.SEQUENCE;
2929
import org.mozilla.jss.asn1.SET;
3030
import org.mozilla.jss.asn1.Tag;
31+
import org.mozilla.jss.asn1.NULL;
32+
import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;
3133
import org.mozilla.jss.crypto.JSSSecureRandom;
3234
import org.mozilla.jss.crypto.PBEAlgorithm;
3335
import org.mozilla.jss.crypto.DigestAlgorithm;
3436
import org.mozilla.jss.crypto.TokenException;
37+
import org.mozilla.jss.crypto.HMACAlgorithm;
3538
import org.mozilla.jss.pkcs7.ContentInfo;
3639
import org.mozilla.jss.pkcs7.DigestInfo;
3740
import org.mozilla.jss.pkix.cert.Certificate;
3841
import org.mozilla.jss.pkix.primitive.AlgorithmIdentifier;
3942
import org.mozilla.jss.pkix.primitive.Attribute;
4043
import org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo;
4144
import org.mozilla.jss.pkix.primitive.PrivateKeyInfo;
45+
import org.mozilla.jss.pkix.primitive.PBMAC1Params;
4246
import org.mozilla.jss.util.Password;
47+
import org.mozilla.jss.netscape.security.pkcs.PKCS12Util.MacType;
4348

4449
/**
4550
* The top level ASN.1 structure for a PKCS #12 blob.
@@ -94,12 +99,23 @@ public class PFX implements ASN1Value {
9499
// currently we are on version 3 of the standard
95100
private static final INTEGER VERSION = new INTEGER(3);
96101

102+
// MAC configuration
103+
private MacType macType = MacType.LEGACY; // default
104+
private DigestAlgorithm macDigest = DigestAlgorithm.SHA256; // default
105+
97106
/**
98107
* The default number of iterations to use when generating the MAC.
99108
* Currently, it is 1.
100109
*/
101110
public static final int DEFAULT_ITERATIONS = 1;
102111

112+
public void setMacType(MacType type) {
113+
this.macType = type;
114+
}
115+
116+
public void setMacDigest(DigestAlgorithm digest) {
117+
this.macDigest = digest;
118+
}
103119

104120
public INTEGER getVersion() {
105121
return version;
@@ -219,12 +235,82 @@ public void computeMacData(Password password,
219235
TokenException, CharConversionException
220236
{
221237

222-
//Make this alg the default mac alg.
223-
AlgorithmIdentifier algID = new AlgorithmIdentifier(DigestAlgorithm.SHA256.toOID());
224-
macData = new MacData( password, salt, iterationCount,
225-
ASN1Util.encode(authSafes), algID );
238+
AlgorithmIdentifier algID;
239+
240+
if (salt == null) {
241+
CryptoManager cm = CryptoManager.getInstance();
242+
JSSSecureRandom rand = cm.createPseudoRandomNumberGenerator();
243+
salt = new byte[20]; // SALT_LENGTH from MacData
244+
rand.nextBytes(salt);
245+
}
246+
247+
if (macType == MacType.PBMAC1) {
248+
// Create PBMAC1 AlgorithmIdentifier with PBKDF2 parameters
249+
algID = createPBMAC1AlgorithmID(salt, iterationCount, macDigest);
250+
} else {
251+
// Legacy: Use digest algorithm directly for HMAC
252+
// Hard code the MAC for legacy behavior.
253+
algID = new AlgorithmIdentifier(DigestAlgorithm.SHA1.toOID());
254+
}
255+
256+
macData = new MacData(password, salt, iterationCount,
257+
ASN1Util.encode(authSafes), algID);
226258
}
227259

260+
private AlgorithmIdentifier createPBMAC1AlgorithmID(
261+
byte[] salt, int iterationCount, DigestAlgorithm digest)
262+
throws NoSuchAlgorithmException
263+
{
264+
// Determine HMAC OID and key length from digest algorithm
265+
// Use existing HMACAlgorithm constants instead of hardcoded OIDs
266+
267+
int keyLength = digest.getOutputSize();
268+
// Get the corresponding HMAC algorithm
269+
HMACAlgorithm hmacAlg;
270+
271+
if (digest.equals(DigestAlgorithm.SHA256)) {
272+
hmacAlg = HMACAlgorithm.SHA256;
273+
} else if (digest.equals(DigestAlgorithm.SHA384)) {
274+
hmacAlg = HMACAlgorithm.SHA384;
275+
} else if (digest.equals(DigestAlgorithm.SHA512)) {
276+
hmacAlg = HMACAlgorithm.SHA512;
277+
} else {
278+
throw new NoSuchAlgorithmException(
279+
"Unsupported PBMAC1 digest: " + digest);
280+
}
281+
282+
OBJECT_IDENTIFIER hmacOID = hmacAlg.toOID();
283+
284+
// Construct PBKDF2 parameters
285+
// PBKDF2-params ::= SEQUENCE {
286+
// salt OCTET STRING,
287+
// iterationCount INTEGER,
288+
// keyLength INTEGER OPTIONAL,
289+
// prf AlgorithmIdentifier DEFAULT hmacWithSHA1
290+
// }
291+
SEQUENCE pbkdf2Params = new SEQUENCE();
292+
pbkdf2Params.addElement(new OCTET_STRING(salt));
293+
pbkdf2Params.addElement(new INTEGER(iterationCount));
294+
pbkdf2Params.addElement(new INTEGER(keyLength));
295+
296+
// PRF algorithm for PBKDF2 (same HMAC algorithm)
297+
AlgorithmIdentifier prfAlg = new AlgorithmIdentifier(hmacOID);
298+
pbkdf2Params.addElement(prfAlg);
299+
300+
// Construct PBKDF2 AlgorithmIdentifier
301+
AlgorithmIdentifier kdfAlg = new AlgorithmIdentifier(
302+
PBEAlgorithm.PBE_PKCS5_PBKDF2.toOID(), pbkdf2Params);
303+
304+
// Construct HMAC AlgorithmIdentifier for MAC scheme
305+
AlgorithmIdentifier macAlg = new AlgorithmIdentifier(hmacOID);
306+
307+
// Construct PBMAC1 parameters using dedicated ASN.1 type
308+
PBMAC1Params pbmac1Params = new PBMAC1Params(kdfAlg, macAlg);
309+
310+
// Construct final PBMAC1 AlgorithmIdentifier
311+
return new AlgorithmIdentifier(
312+
PBEAlgorithm.PBE_PKCS5_PBMAC1.toOID(), pbmac1Params);
313+
}
228314

229315
///////////////////////////////////////////////////////////////////////
230316
// DER encoding

0 commit comments

Comments
 (0)