From e2d0935792f9bae6ecea753d1ded93e3ed2aa1ec Mon Sep 17 00:00:00 2001 From: Steffen Jaeckel Date: Tue, 28 Oct 2025 15:49:57 +0100 Subject: [PATCH] Add SHA3-HMAC support to PKCS#8 This also enables testing of PKCS#8 keys using modern hash algos with LTC_EASY. Signed-off-by: Steffen Jaeckel --- src/headers/tomcrypt_custom.h | 2 ++ src/misc/pbes/pbes2.c | 4 ++++ tests/rsa-pkcs8/README.txt | 4 ++++ .../key_pkcs8_pbkdf2_sha3_224_aes256_cbc.der | Bin 0 -> 746 bytes .../key_pkcs8_pbkdf2_sha3_256_aes256_cbc.der | Bin 0 -> 746 bytes .../key_pkcs8_pbkdf2_sha3_384_aes256_cbc.der | Bin 0 -> 746 bytes .../key_pkcs8_pbkdf2_sha3_512_aes256_cbc.der | Bin 0 -> 746 bytes .../rsa-pkcs8/{ => old}/key_pkcs8_pbe_md2_des.der | Bin .../{ => old}/key_pkcs8_pbe_md2_rc2_64.der | Bin .../rsa-pkcs8/{ => old}/key_pkcs8_pbe_md5_des.der | Bin .../{ => old}/key_pkcs8_pbe_md5_rc2_64.der | Bin .../{ => old}/key_pkcs8_pbe_sha1_rc2_64.der | Bin .../{ => old}/key_pkcs8_pbkdf2_rc2_cbc.der | Bin .../key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der | Bin .../key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der | Bin .../key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der | Bin .../key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der | Bin tests/rsa_test.c | 5 +++-- 18 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_224_aes256_cbc.der create mode 100644 tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_256_aes256_cbc.der create mode 100644 tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_384_aes256_cbc.der create mode 100644 tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_512_aes256_cbc.der rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbe_md2_des.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbe_md2_rc2_64.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbe_md5_des.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbe_md5_rc2_64.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbe_sha1_rc2_64.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbkdf2_rc2_cbc.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der (100%) rename tests/rsa-pkcs8/{ => old}/key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der (100%) diff --git a/src/headers/tomcrypt_custom.h b/src/headers/tomcrypt_custom.h index 31440b45..685a57bf 100644 --- a/src/headers/tomcrypt_custom.h +++ b/src/headers/tomcrypt_custom.h @@ -91,6 +91,8 @@ #define LTC_SHA1 #define LTC_SHA3 #define LTC_SHA512 + #define LTC_SHA512_256 + #define LTC_SHA512_224 #define LTC_SHA384 #define LTC_SHA256 #define LTC_SHA224 diff --git a/src/misc/pbes/pbes2.c b/src/misc/pbes/pbes2.c index 75d17d31..a8db5bd4 100644 --- a/src/misc/pbes/pbes2.c +++ b/src/misc/pbes/pbes2.c @@ -20,6 +20,10 @@ static const oid_id_st s_hmac_oid_names[] = { { "1.2.840.113549.2.11", "sha512" }, { "1.2.840.113549.2.12", "sha512-224" }, { "1.2.840.113549.2.13", "sha512-256" }, + { "2.16.840.1.101.3.4.2.13", "sha3-224" }, + { "2.16.840.1.101.3.4.2.14", "sha3-256" }, + { "2.16.840.1.101.3.4.2.15", "sha3-384" }, + { "2.16.840.1.101.3.4.2.16", "sha3-512" }, }; static int s_pkcs_5_alg2_wrap(const struct password *pwd, diff --git a/tests/rsa-pkcs8/README.txt b/tests/rsa-pkcs8/README.txt index 5051775a..b70cc161 100644 --- a/tests/rsa-pkcs8/README.txt +++ b/tests/rsa-pkcs8/README.txt @@ -27,3 +27,7 @@ openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.k openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 rc2-40 -v2prf hmacWithSHA512-256 -out key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 rc2-64 -v2prf hmacWithSHA512 -out key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 rc2-64 -v2prf hmacWithSHA512-256 -out key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der +openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 aes256 -v2prf id-hmacWithSHA3-224 -out key_pkcs8_pbkdf2_sha3_224_aes256_cbc.der +openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 aes256 -v2prf id-hmacWithSHA3-256 -out key_pkcs8_pbkdf2_sha3_256_aes256_cbc.der +openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 aes256 -v2prf id-hmacWithSHA3-384 -out key_pkcs8_pbkdf2_sha3_384_aes256_cbc.der +openssl pkcs8 -topk8 -inform PEM -outform DER -passout pass:secret -in ../test.key -v2 aes256 -v2prf id-hmacWithSHA3-512 -out key_pkcs8_pbkdf2_sha3_512_aes256_cbc.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_224_aes256_cbc.der b/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_224_aes256_cbc.der new file mode 100644 index 0000000000000000000000000000000000000000..d5d5b45f39f4dc1ba9e43d7618ef26cbf0d66a4e GIT binary patch literal 746 zcmV&LNQU&B?J(*wik~2ravrx zgx4hE5WI5&0tf&w4F(BdhDZTr0|WvM1pqJ|1_@w>NC9O71OX}p5Ja$R-8m4=X?7jE z_`|sy+XR9FfXTk92h%5tF;_5Iii`i1Et=a09?50xZZf*AQ13m-1_Z$A2BCL|!!kD{ zBP2l+mAeMPAEz0K5}Yt2lvCPpV+*qYZYHo`l=8!_H84Y>xs9i*o>!*0hYctTW{@Z8 zBUOBo8Rj5|Rs)N*zxDAb5Wtxu<%AJBSNi+#y1C5K*}b?PGDJ@Yqj>*LILwwz>%_K- zEW;I=BD=g}tEjmz&&B(bKiClQUkq?4Sk>V~L+;yNw21W6=JUZydGwx8pq+xTaoX_` zMl)qq0dATItD2qv=hH=(aILup3arQ~&oE<)V}3jW6BNQH{Xms2=w7q|Q!)HAly@ju zPr2_-Z|#81ih77=rs9G&e+KoUb@Iv_Fq?GyB8;JLT_tMReFC}*{f#o~|8udD*e}$q z1(krJ8Gv5hS{zT~Tyu^|Bn(n`)Htc+Zn&LIHiREQ0~d@U;~34Otl~|RG$7fu5n_{nZ_#sP!+37$a zB6^$ewmIBekUInq(kVH9FIfx;%aD|RTDMocf6L2#lO{)L23tXo-E;Fa|!%5IwvFk2H;H6^%w_;CCq>iM~GTy}peJnayHc zlQ!r;R6(hGpQ@gVj1EB$;e&eIL!~SU;?K4e(mJ}NMx^c-)rv^dbY(vVb1dbM-E3QA clMzZ{f0<&pzPMek#Zi~5&WgjB2db{p@gj~{x&QzG literal 0 HcmV?d00001 diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_256_aes256_cbc.der b/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_256_aes256_cbc.der new file mode 100644 index 0000000000000000000000000000000000000000..c518e7339f2174007ca38a95e1c9c1c1b404ce38 GIT binary patch literal 746 zcmV&LNQU&B?J)4Lou?2M9cC- z*aiwWex?@!0tf&w4F(BdhDZTr0|WvN1pqJ|1_@w>NC9O71OX}p5a_CLw^YlI>&Mx| z#*sFRMg)QafHcI^p=tFV+$VP?xO*$2_Y=e%gRgZ}g$!e1*^MH_Kh2Ur1XaJ`3gH4> z@@ni(Wyoc-;$7oWJb#B|l5?Un>OEJ`cEw8u0E}2hj70tq|7mBTR}Nsqw|G%cYof(o zKA5?$)neCt4DA*0I$#I9Cn`^M4|aG7pXYf>Igp(EMo!2H_fhd|y{{Qy{5|ZkJ^~k^ zFt6}(dKdRrvgHj6w+d|LVna2Xs&!_c>%y^~!R6brlrc=m-Dv4OqFE0Q4C9sqqpb@7 zjOR`6%m%Oiq*i+G%(&s@f*!~&7jl_u&Kd*~7fH!TF@#wEz=_*X8mQatC77$m3~_Fj zXc&;6sa^}mG0xWCaq=Mus^_s$TB*V(lZFKsX_DXn>Y_AmPox&uN9^ZUzzFn^j!yF! zN&EME;9GbQ&7%3Oz2v~%E=w*SXAaUu_Nw6(4tt6oqwv9*kRMCJ@WVRY*T$YxNTm?FVXi>`(Z$MY(ATt2KeXZX?`qP}i`Z*5!CdS#G}irB3KW=f{|N zGVr5Myu(du5PqvtjCa4&fBSVrfGN;f0C0s?HFu#|?_`%GL~DKz1&xsrr|(CFe%rEL zG!Cc@R$P&tX}TOCqI^|~SaiOB9n5(P1WQ#QIwol*MdB2biTx(uyS`X<)x%|>-5oHJ cS2U6TNM6k;V5mwt*X2$O%fljUWR6Z*5A4QUpa1{> literal 0 HcmV?d00001 diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_384_aes256_cbc.der b/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_384_aes256_cbc.der new file mode 100644 index 0000000000000000000000000000000000000000..d58667438f0a9b91ace808efac832e305a77d63b GIT binary patch literal 746 zcmV&LNQU&B?J&MArt}_69<@Y zavL`NC9O71OX}p5cCtrP}6~pMveV= zrv%(aq6C5hfWTU95xqdZm9*aH52sgXU(EC~9%}ge!d0$4?IaU>o#e&saXOROrdZFV z%3-$j!FkHS1Qgr)ZpX-C`|CPi9!+nkQKxcfZ6Nof zHPPlyVWJ@P0m5;s0daTeK)@4CVRlJj4tJAHmDpx>vHGrpo8A9}|DVrUuf!MMk!zU)?o}|3SKEeBNU1b>(pnwb0To! zrL!jK2MT(txF1x@Q7~|+ZvXGJuy_jzmRxpE-)y3HT6w(Z#*4x^fhGmzY{_N9NsIh3 zVhI0DYJ%Q6V<Tack=_C^OD#}nn=yd*F;$1hm*|f5#;!=0ojYq zU0-c0%SM5bp)m4pcuJz1WN+U1Cj*uqPPp+DqQYh|QFDLM2<0W}A5ae?qrvqO;@^-M$^ z+#||+c>4m=R;#8mhQ_93-RFb`&{sIrW$bOgQ>iP`XHcxE?w46rZ<~CR2!MTU;Kran c37MKec1|rl-tY|Oxml5U=c#o)xg$~LmcEW;m;e9( literal 0 HcmV?d00001 diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_512_aes256_cbc.der b/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha3_512_aes256_cbc.der new file mode 100644 index 0000000000000000000000000000000000000000..1aec2c97c5dd364db9c706d87d52e78bb3364270 GIT binary patch literal 746 zcmV&LNQU&B?J(#&u#w6tNC9O71OX}p5R+Q&rWX4_9E%3g zBFmQK^8|tdfYvv~dRbB?PNQyH+zWu%OB zRAO*mqTBEpZOlkqC+)7fpCEB}2MVNe20J(8J7~h>1R1G&{nB#mS^^V~cDX}7YWtLHK4NG)oFS#kUTVdMJ?NY;_KyNg(ixHKKF8DDSX`hXs(h!cqnn?NSfieEnG3>ZWX z{#BqVy8ix7Cqk=V#88^@l)NbQ=PmyDDuGM5j;>6MyPf}o85dDfkBWKkbA?WI(-Jmh zD~wB=Nn&HqIoYfcgF7KF5|y01k!C29{T^DYPc~RSk5skXZGa?5O*Z5-V6w{6ElL|6m~=Cc{qG$-FFvnP-L@A_QB{p=3An zae6PS)`uJ39iXZSalH|Xj74cTS68D#CQu(-AB`16v|_##6@&W!AlV0Xz^J1IC8`~H z1z0!bRq6)WvBt?+3e`^q`+^YQ1AZB!M|R&SLfWV+Z0GQJX5VrYGF7gkg*L@VY!#<7 z2Rn<-S_xwn^`vjf`KJrkYbAluLeV07Ji1LSXZ6;bK03NRG`pVskM$}lL+E)^&227u czHV^^k$argHhkcW&IAAT4&65d+{jtI&a9eIApigX literal 0 HcmV?d00001 diff --git a/tests/rsa-pkcs8/key_pkcs8_pbe_md2_des.der b/tests/rsa-pkcs8/old/key_pkcs8_pbe_md2_des.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbe_md2_des.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbe_md2_des.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbe_md2_rc2_64.der b/tests/rsa-pkcs8/old/key_pkcs8_pbe_md2_rc2_64.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbe_md2_rc2_64.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbe_md2_rc2_64.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbe_md5_des.der b/tests/rsa-pkcs8/old/key_pkcs8_pbe_md5_des.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbe_md5_des.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbe_md5_des.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbe_md5_rc2_64.der b/tests/rsa-pkcs8/old/key_pkcs8_pbe_md5_rc2_64.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbe_md5_rc2_64.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbe_md5_rc2_64.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbe_sha1_rc2_64.der b/tests/rsa-pkcs8/old/key_pkcs8_pbe_sha1_rc2_64.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbe_sha1_rc2_64.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbe_sha1_rc2_64.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_rc2_cbc.der b/tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_rc2_cbc.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbkdf2_rc2_cbc.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_rc2_cbc.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der b/tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_256_rc2_40_cbc.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der b/tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_256_rc2_64_cbc.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der b/tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_rc2_40_cbc.der diff --git a/tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der b/tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der similarity index 100% rename from tests/rsa-pkcs8/key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der rename to tests/rsa-pkcs8/old/key_pkcs8_pbkdf2_sha512_rc2_64_cbc.der diff --git a/tests/rsa_test.c b/tests/rsa_test.c index 568e70fc..c1cfbb2b 100644 --- a/tests/rsa_test.c +++ b/tests/rsa_test.c @@ -431,7 +431,7 @@ static int s_rsa_import_x509(const void *in, unsigned long inlen, void *key) return rsa_import_x509(in, inlen, key); } -#if defined(LTC_MD2) && defined(LTC_MD5) && defined(LTC_RC2) +#if defined(LTC_TEST_READDIR) static int password_get(void **p, unsigned long *l, void *u) { LTC_UNUSED_PARAM(u); @@ -476,8 +476,9 @@ int rsa_test(void) #ifdef LTC_TEST_READDIR DO(test_process_dir("tests/rsa", &key, s_rsa_import_x509, NULL, (dir_cleanup_cb)rsa_free, "rsa_test")); #if defined(LTC_MD2) && defined(LTC_MD5) && defined(LTC_RC2) - DO(test_process_dir("tests/rsa-pkcs8", &key, s_rsa_import_pkcs8, NULL, (dir_cleanup_cb)rsa_free, "rsa_pkcs8_test")); + DO(test_process_dir("tests/rsa-pkcs8/old", &key, s_rsa_import_pkcs8, NULL, (dir_cleanup_cb)rsa_free, "rsa_pkcs8_test")); #endif + DO(test_process_dir("tests/rsa-pkcs8", &key, s_rsa_import_pkcs8, NULL, (dir_cleanup_cb)rsa_free, "rsa_pkcs8_test")); #endif DO(s_rsa_cryptx_issue_69());