Open fscheiner opened 1 year ago
OpenSSL version | 1.1.1f |
---|---|
Command | Use openssl pkcs12 -export [...] -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg SHA256 to use the same encryption and MAC as OpenSSL 3.0's default |
Result | MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256 Certificate bag PKCS7 Data Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256 |
Command | Use openssl pkcs12 -export [...] -certpbe PBE-SHA1-3DES to use the defaults of OpenSSL 1.1.1f but also encrypt the cert with 3-Key-TripleDES allowing OpenSSL 3.0 to work with this keystore without the need for -legacy |
Result | MAC: sha1, Iteration 2048 MAC length: 20, salt length: 8 PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048 Certificate bag PKCS7 Data Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048 |
OpenSSL version | 1.0.2k |
---|---|
Command | Use openssl pkcs12 -export [...] -keypbe AES-256-CBC -certpbe AES-256-CBC -macalg SHA256 to use the same encryption and MAC as OpenSSL 3.0's default except for the HMAC which is still done with SHA1 |
Result | MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA1 Certificate bag PKCS7 Data Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA1 |
Problem
On Rocky Linux 9 a PKCS#12 keystore produced with either OpenSSL 1.1.1f or Firefox 106.0.2 (both on Ubuntu 20.04) cannot be processed by
grid-proxy-init
:This is due to:
[johndoe@rockylinux-9 .globus]$ openssl pkcs12 -in usercred-from-openssl-1.1.1f.p12 -info -nokeys -nocerts -legacy Enter Import Password: MAC: sha1, Iteration 2048 MAC length: 20, salt length: 8 PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048 Certificate bag PKCS7 Data Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048