QuasarApp/openssl
4
0
Fork 0
mirror of https://github.com/QuasarApp/openssl.git synced 2025-04-28 02:34:40 +00:00
Code Issues Projects Releases Wiki Activity

apps/pkcs12: Properly detect MAC setup failure

Browse Source 
The MAC requires PKCS12KDF support which is not present
in FIPS provider as it is not an approved KDF algorithm.
Suggest using -nomac if MAC is not required.

Fixes #14057

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14445)
This commit is contained in:
Tomas Mraz 2021-03-05 17:22:35 +01:00 committed by Pauli
parent 31e2e6e0b1
commit 913f9d5e52
2 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
apps/pkcs12.c
View File

@ -655,7 +655,11 @@ int pkcs12_main(int argc, char **argv)
}
if (maciter != -1)
PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd);
if (!PKCS12_set_mac(p12, mpass, -1, NULL, 0, maciter, macmd)) {
BIO_printf(bio_err, "Error creating PKCS12 MAC; no PKCS12KDF support?\n");
BIO_printf(bio_err, "Use -nomac if MAC not required and PKCS12KDF support not available.\n");
goto export_end;
}
assert(private);

6
doc/man1/openssl-pkcs12.pod.in
View File

@ -333,7 +333,7 @@ then both, the private key and the certificates are encrypted using triple DES.
=item B<-macalg> I<digest>
Specify the MAC digest algorithm. If not included them SHA1 will be used.
Specify the MAC digest algorithm. If not included SHA1 will be used.
=item B<-iter> I<count>
@ -362,7 +362,9 @@ to be needed to use MAC iterations counts but they are now used by default.
=item B<-nomac>
Don't attempt to provide the MAC integrity.
Do not attempt to provide the MAC integrity. This can be useful with the FIPS
provider as the PKCS12 MAC requires PKCS12KDF which is not an approved FIPS
algorithm and cannot be supported by the FIPS provider.
=back