9d0e7fb6e7
Avoid the X509_ALGOR dependency entirely. The public API is still using the legacy ASN.1 structures for now, but the conversions are lifted to the API boundary. Once we resolve that and the OID table dependency, this module will no longer block unshipping crypto/asn1 and friends from Chromium. This changes the calling convention around the two kinds of PBE suites we support. Each PBE suite provides a free-form encrypt_init function to setup an EVP_CIPHER_CTX and write the AlgorithmIdentifer to a CBB. It then provides a common decrypt_init function which sets up an EVP_CIPHER_CTX given a CBS of the parameter. The common encrypt code determines how to call which encrypt_init function. The common decrypt code parses the OID out of the AlgorithmIdentifer and then dispatches to decrypt_init. Note this means the encryption codepath no longer involves parsing back out a AlgorithmIdentifier it just serialized. We don't have a good story to access an already serialized piece of a CBB in progress (reallocs can invalidate the pointer in a CBS), so it's easier to cut this step out entirely. Also note this renames the "PBES1" schemes from PKCS#5 to PKCS#12. This makes it easier to get at the PKCS#12 key derivation hooks. Although PKCS#12 claims these are variants of PKCS#5's PBES1, they're not very related. PKCS#12 swaps out the key derivation and even defines its own AlgorithmIdentifier parameter structure (identical to the PKCS#5 PBES1 one). The only thing of PBES1 that survives is the CBC mode padding scheme, which is deep in EVP_CIPHER for us. (Of course, all this musing on layering is moot because we don't implement non-PKCS#12 PBES1 schemes anyway.) This also moves some of the random API features (default iteration count, default salt generation) out of the PBE suites and into the common code. BUG=54 Change-Id: Ie96924c73a229be2915be98eab680cadd17326db Reviewed-on: https://boringssl-review.googlesource.com/13069 Reviewed-by: Adam Langley <alangley@gmail.com>
30 lines
378 B
CMake
30 lines
378 B
CMake
include_directories(../../include)
|
|
|
|
add_library(
|
|
pkcs8_lib
|
|
|
|
OBJECT
|
|
|
|
pkcs8.c
|
|
p8_pkey.c
|
|
p5_pbev2.c
|
|
)
|
|
|
|
add_executable(
|
|
pkcs12_test
|
|
|
|
pkcs12_test.cc
|
|
|
|
$<TARGET_OBJECTS:test_support>
|
|
)
|
|
|
|
add_executable(
|
|
pkcs8_test
|
|
|
|
pkcs8_test.cc
|
|
)
|
|
|
|
target_link_libraries(pkcs8_test crypto)
|
|
target_link_libraries(pkcs12_test crypto)
|
|
add_dependencies(all_tests pkcs8_test pkcs12_test)
|