Paul Meyer
c8b9e6388e
Package pkcs12 provides some Go implementations of PKCS#12. This implementation is distilled from https://tools.ietf.org/html/rfc7292 and referenced documents. It is intented for decoding P12/PFX-stored certificate+key for use with the crypto/tls package. Package includes @dgryski's RC2 implementation as a sub package as requested in https://github.com/golang/go/issues/10621. Change-Id: I78401241e39cd0099e9082a3a227cf0a3a36e6d1 Reviewed-on: https://go-review.googlesource.com/11986 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org>
46 lines
1.0 KiB
Go
46 lines
1.0 KiB
Go
// Copyright 2015 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package pkcs12
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha1"
|
|
"crypto/x509/pkix"
|
|
"encoding/asn1"
|
|
)
|
|
|
|
type macData struct {
|
|
Mac digestInfo
|
|
MacSalt []byte
|
|
Iterations int `asn1:"optional,default:1"`
|
|
}
|
|
|
|
// from PKCS#7:
|
|
type digestInfo struct {
|
|
Algorithm pkix.AlgorithmIdentifier
|
|
Digest []byte
|
|
}
|
|
|
|
var (
|
|
oidSHA1 = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
|
|
)
|
|
|
|
func verifyMac(macData *macData, message, password []byte) error {
|
|
if !macData.Mac.Algorithm.Algorithm.Equal(oidSHA1) {
|
|
return NotImplementedError("unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
|
|
}
|
|
|
|
key := pbkdf(sha1Sum, 20, 64, macData.MacSalt, password, macData.Iterations, 3, 20)
|
|
|
|
mac := hmac.New(sha1.New, key)
|
|
mac.Write(message)
|
|
expectedMAC := mac.Sum(nil)
|
|
|
|
if !hmac.Equal(macData.Mac.Digest, expectedMAC) {
|
|
return ErrIncorrectPassword
|
|
}
|
|
return nil
|
|
}
|