WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Apply stronger salt length for PBES2

pull/8864/head
Koji Takeda 2025-06-09 16:08:22 +09:00
parent e74214ded0
commit ff1baf0ae7
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wolfcrypt/src/pkcs12.c
View File

@ -1830,6 +1830,8 @@ static int wc_PKCS12_shroud_key(WC_PKCS12* pkcs12, WC_RNG* rng,
word32 totalSz = 0; word32 totalSz = 0;
int ret; int ret;
byte* pkcs8Key = NULL; byte* pkcs8Key = NULL;
byte salt[PKCS5V2_SALT_SZ]; /* PKCS5V2_SALT_SZ > PKCS5_SALT_SZ */
word32 saltSz = 0;
int vPKCS = -1; int vPKCS = -1;
int outAlgo = -1; int outAlgo = -1;
@ -1875,9 +1877,13 @@ static int wc_PKCS12_shroud_key(WC_PKCS12* pkcs12, WC_RNG* rng,
&hmacOid)) < 0) { &hmacOid)) < 0) {
return ret; return ret;
} }
saltSz = (outAlgo != PBES2) ? PKCS5_SALT_SZ : PKCS5V2_SALT_SZ;
if ((ret = wc_RNG_GenerateBlock(rng, salt, saltSz)) < 0) {
return ret;
}
ret = TraditionalEnc_ex(key, keySz, pkcs8Key, &sz, pass, passSz, ret = TraditionalEnc_ex(key, keySz, pkcs8Key, &sz, pass, passSz,
vPKCS, outAlgo, blkOid, NULL, 0, itt, hmacOid, rng, heap); vPKCS, outAlgo, blkOid, salt, saltSz, itt, hmacOid, rng, heap);
} }
if (ret == WC_NO_ERR_TRACE(LENGTH_ONLY_E)) { if (ret == WC_NO_ERR_TRACE(LENGTH_ONLY_E)) {
*outSz = sz + MAX_LENGTH_SZ + 1; *outSz = sz + MAX_LENGTH_SZ + 1;