Use PKCS5 v2 in PKCS8 encrypted export

Change-Id: Ia8f28768aca7b669e44b8b61c84625e5c811c033

diff --git a/api/yaca/yaca_key.h b/api/yaca/yaca_key.h
index 8cf4b93219a1a81e63ea1c027e77b833ce7438d7..b9bf0b104d762ce7f75999b9b818ca823373bec8 100755 (executable)
--- a/api/yaca/yaca_key.h
+++ b/api/yaca/yaca_key.h
@@ -172,7 +172,8 @@ int yaca_key_import(yaca_key_type_e key_type,
  *
  * @remarks  Encryption is obligatory for #YACA_KEY_FORMAT_PKCS8 format (for both, PEM and DER
  *           file formats). If no password is provided the #YACA_ERROR_INVALID_PARAMETER will
- *           be returned. The encryption algorithm used in this case is PBE with DES-CBC.
+ *           be returned. The encryption algorithm used in this case is AES-256-CBC. The key is
+ *           generated from password using PBKDF2 with HMAC-SHA1 function and 2048 iterations.
  *
  * @remarks  Encryption is not supported for the symmetric, public keys and key generation
  *           parameters in all their supported formats. If a password is provided in such

diff --git a/src/key.c b/src/key.c
index 92bc8a338e126899441ed2d8fa91696940aa8171..35ca37e59ad302481aac03d7435ef28001ea5960 100644 (file)
--- a/src/key.c
+++ b/src/key.c
@@ -809,7 +809,7 @@ static int export_evp_pkcs8_bio(struct yaca_key_evp_s *evp_key,
        assert(mem != NULL);
 
        int ret;
-       int nid = NID_pbeWithMD5AndDES_CBC;
+       const EVP_CIPHER *enc = EVP_aes_256_cbc();;
 
        /* PKCS8 export requires a password */
        if (password == NULL)
@@ -824,8 +824,8 @@ static int export_evp_pkcs8_bio(struct yaca_key_evp_s *evp_key,
                case YACA_KEY_TYPE_DSA_PRIV:
                case YACA_KEY_TYPE_DH_PRIV:
                case YACA_KEY_TYPE_EC_PRIV:
-                       ret = PEM_write_bio_PKCS8PrivateKey_nid(mem, evp_key->evp, nid,
-                                                               NULL, 0, NULL, (void*)password);
+                       ret = PEM_write_bio_PKCS8PrivateKey(mem, evp_key->evp, enc,
+                                                           NULL, 0, NULL, (void*)password);
                        break;
 
                default:
@@ -841,8 +841,8 @@ static int export_evp_pkcs8_bio(struct yaca_key_evp_s *evp_key,
                case YACA_KEY_TYPE_DSA_PRIV:
                case YACA_KEY_TYPE_DH_PRIV:
                case YACA_KEY_TYPE_EC_PRIV:
-                       ret = i2d_PKCS8PrivateKey_nid_bio(mem, evp_key->evp, nid,
-                                                         NULL, 0, NULL, (void*)password);
+                       ret = i2d_PKCS8PrivateKey_bio(mem, evp_key->evp, enc,
+                                                     NULL, 0, NULL, (void*)password);
                        break;
 
                default:

diff --git a/todo.txt b/todo.txt
index c33b5d7464af77eee272e9eeb0a6c1a40ed692a3..99c60cecd297789e8a1c393c8a509d059aa89813 100644 (file)
--- a/todo.txt
+++ b/todo.txt
@@ -8,4 +8,3 @@ Global:
 - We need a way to import keys encrypted with hw (or other) keys. New
   function like yaca_key_load or sth?
 - Add extended description and examples in documentation.
-- Check PKCS8 with PKCS5 2.0 (EVP cipher instead of PBE)