search

kaikramer / keystore-explorer

KeyStore Explorer is a free GUI replacement for the Java command-line utilities keytool and jarsigner.
https://keystore-explorer.org/
GNU General Public License v3.0
1.67k stars 271 forks source link

[feature request] choice between PBES2 and PBE when using alias password in a keystore #384

Closed arendvogtlaender closed 1 year ago

arendvogtlaender commented 2 years ago

Hi, first again many thanks for this very good piece of software!

but... :-) it would be very nice, if it was possible to choose the encryption algorithm, which is used encrypting private keys inside the keystore (when setting the alias password) formerly the algorithm was PBE, in recent versions (not quite sure exactly which) it was changed to PBES2. when working with legacy-systems, this causes a problem, as for example windows server 2016 and older can't handle PBES2 and will prompt that the password is wrong. this applies also to some older JDK / cryptoprovider combinations on other operating systems.

there is a manual workaround using openssl and repacking the keys in a new keystore, but it would be far better, if it was possible to be able to choose between PBES2 and PBE.

also, if i have a "fixed" PBE keystore and use KSE to change the alias name and save the keystore again, it will switch from PBE back to PBES2.

as legacy systems hang around for a long time (like the blank lightbulb in the kitchen, after moving in a new flat) it would be very nice to have this option.

kaikramer commented 2 years ago

Well, this is not something that is controlled by KSE. The code that was changed is in the Java runtime itself.

Fortunately they have provided a workaround by setting an evironment variable, see this comment for details.

As so many KSE users are complaining about this, I am considerung setting this environment variable (resp. the system property) in the code, controlled by a checkbox in the UI. From a users standpoint this is exactly your feature request, but in reality it's a hack and I am rather reluctant to implement this...

arendvogtlaender commented 2 years ago

Hi Kai,

thanks for the tip, I seem to have missed that one before posting the request. It’s at least better then re-tinkering the Keystores with openssl ;-)

Viele Grüße, Arend Vogtländer Solution Engineer Multimessenger

Governikus GmbH & Co. KG Hochschulring 4 28359 Bremen, Germany

Telefon: +49 421 204 95 - 933 Mobil: +49 151 74215702 Fax: +49 421 204 95 - 11 E-Mail: @.*** www.governikus.dehttp://www.governikus.de/

Von: Kai Kramer @.> Gesendet: Freitag, 19. August 2022 22:08 An: kaikramer/keystore-explorer @.> Cc: Vogtländer, Arend @.>; Author @.> Betreff: Re: [kaikramer/keystore-explorer] [feature request] choice between PBES2 and PBE when using alias password in a keystore (Issue #384)

Well, this is not something that is controlled by KSE. The code that was changed is in the Java runtime itself.

Fortunately they have provided a workaround by setting an evironment variable, see this commenthttps://github.com/kaikramer/keystore-explorer/issues/318#issuecomment-1100439267 for details.

As so many KSE users are complaining about this, I am considerung setting this environment variable in the code, controlled by a checkbox in the UI. From a users standpoint this is exactly your feature request, but in reality it's a really ugly hack and I am very reluctant to implement this...

— Reply to this email directly, view it on GitHubhttps://github.com/kaikramer/keystore-explorer/issues/384#issuecomment-1221054874, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMPFK3GGAVEZT2665N6RXYLVZ7SSFANCNFSM57AWIL5Q. You are receiving this because you authored the thread.Message ID: @.**@.>>