PKCS12_gen_mac3ssl

Usage

 #include <openssl/pkcs12.h>
 int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                    unsigned char *mac, unsigned int *maclen);
 int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen);
 int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
                    unsigned char *salt, int saltlen, int iter,
                    const EVP_MD *md_type);
 int PKCS12_set_pbmac1_pbkdf2(PKCS12 *p12, const char *pass, int passlen,
                                   unsigned char *salt, int saltlen, int iter,
                                   const EVP_MD *md_type,
                                   const char *prf_md_name);
 int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt,
                      int saltlen, const EVP_MD *md_type);
 void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
                      const X509_ALGOR **pmacalg,
                      const ASN1_OCTET_STRING **psalt,
                      const ASN1_INTEGER **piter,
                      const PKCS12 *p12);

Overview

PKCS12_gen_mac() generates an HMAC over the entire PKCS#12 object using the supplied password along with a set of already configured parameters. The default key generation mechanism used is PKCS12KDF.

PKCS12_verify_mac() verifies the PKCS#12 object's HMAC using the supplied password.

PKCS12_setup_mac() sets the MAC part of the PKCS#12 structure with the supplied parameters.

PKCS12_set_mac() sets the MAC and MAC parameters into the PKCS#12 object. PKCS12_set_pbmac1_pbkdf2() sets the MAC and MAC parameters into the PKCS#12 object when PBMAC1 with PBKDF2 is used for protection of the PKCS#12 object.

pass is the passphrase to use in the HMAC. salt is the salt value to use, iter is the iteration count and md_type is the message digest function to use. prf_md_name specifies the digest used for the PBKDF2 in PBMAC1 KDF.

PKCS12_get0_mac() retrieves any included MAC value, X509_ALGOR object, salt, and iter count from the PKCS12 object.

Notes

If salt is NULL then a suitable salt will be generated and used.

If iter is 1 then an iteration count will be omitted from the PKCS#12 structure.

PKCS12_gen_mac(), PKCS12_verify_mac(), PKCS12_set_mac() and PKCS12_set_pbmac1_pbkdf2() make assumptions regarding the encoding of the given passphrase. See passphrase-encoding(7) for more information.

Return values

All functions returning an integer return 1 on success and 0 if an error occurred.

Environment

LEGACY_GOST_PKCS12

If this environment variable is set, MAC generation that utilises GOST R 34.11-94 or GOST 34.11-2012 hashing algorithms is performed the usual way and not in accordance with the specification provided in the methodical recommendation MP 26.2.002-2012 (or in its later versions, standardisation recommendation P 50.1.112-2016 or P 1323565.1.041-2022) of Technical Committee 26, that specifies that the key used for MAC generation should be the last 32 bytes of the 96-byte sequence generated by PKCS5_PBKDF2_HMAC(3) and not the whole sequence.