feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Use DER-specified hash algorithm for PEM decryption

Browse Source 
The PemToDer function was using a hardcoded MD5 hash for key derivation.
This change extracts the hash algorithm from the PBES2 parameters in the
DER buffer, returning an error if the hash algorithm cannot be determined.

Co-Authored-By: lealem@wolfssl.com <lealem@wolfssl.com>
This commit is contained in:
Devin AI
2025-02-14 18:10:05 +00:00
parent 29f2767b88
commit 20643226b6
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
wolfcrypt/src/asn.c
View File

@ -25785,8 +25785,27 @@ int PemToDer(const unsigned char* buff, long longSz, int type,
int padVal = 0;
#endif
ret = wc_BufferKeyDecrypt(info, der->buffer, der->length,
(byte*)password, passwordSz, WC_MD5);
/* Extract hash type from PBES2 parameters */
word32 idx = 0;
int hashType;
DECL_ASNGETDATA(dataASN, pbes2ParamsASN_Length);
CALLOC_ASNGETDATA(dataASN, pbes2ParamsASN_Length, ret, NULL);
if (ret == 0) {
GetASN_OID(&dataASN[PBES2PARAMSASN_IDX_PBKDF2_PARAMS_PRF_OID], oidHmacType);
ret = GetASN_Items(pbes2ParamsASN, dataASN, pbes2ParamsASN_Length,
0, der->buffer, &idx, der->length);
if (ret == 0) {
hashType = wc_OidGetHash(dataASN[PBES2PARAMSASN_IDX_PBKDF2_PARAMS_PRF_OID].data.oid.sum);
if (hashType == WC_HASH_TYPE_NONE) {
WOLFSSL_MSG("Hash algorithm not supported");
ret = ASN_PARSE_E;
}
}
}
FREE_ASNGETDATA(dataASN, NULL);
if (ret == 0)
ret = wc_BufferKeyDecrypt(info, der->buffer, der->length,
(byte*)password, passwordSz, hashType);
#ifndef NO_WOLFSSL_SKIP_TRAILING_PAD
#ifndef NO_DES3