The_Great_Archive/xca
1
0
Fork 0
mirror of https://github.com/chris2511/xca.git synced 2026-09-12 19:51:05 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Drop support of encrypted PVK files.

Browse Source 
The RC4 "encryption" is insecure.

The unencrypted PVK key is also insecure, but it does
not give users a false sense of security.
This commit is contained in:
Christian Hohnstaedt 2024-08-18 10:28:44 +02:00
parent 8193988b01
commit 39da47c217
5 changed files with 4 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/db_key.cpp
View File

@ -237,7 +237,7 @@ void db_key::exportItem(const QModelIndex &index, const pki_export *xport,
else if (xport->match_all(F_SSH2))
key->writeSSH2public(file);
else if (privkey && xport->match_all(F_PVK))
privkey->writePVKprivate(file, pwCallback);
privkey->writePVKprivate(file);
else
throw errorEx(tr("Internal error"));
}

5
lib/pki_evp.cpp
View File

@ -838,11 +838,10 @@ void pki_evp::writePKCS8(XFile &file, const EVP_CIPHER *enc,
file.write(b);
}
void pki_evp::writePVKprivate(XFile &file, pem_password_cb *cb) const
void pki_evp::writePVKprivate(XFile &file) const
{
pass_info p(XCA_TITLE, tr("Please enter the password protecting the Microsoft PVK key '%1'").arg(getIntName()));
int enc = cb ? 2 /* pvk-strong */ : 0 /* pvk-none */;
EVP_PKEY *pkey = decryptKey();
if (!pkey) {
pki_openssl_error();
@ -852,7 +851,7 @@ void pki_evp::writePVKprivate(XFile &file, pem_password_cb *cb) const
* PEMerr(PEM_F_I2B_PVK_BIO, PEM_R_BIO_WRITE_FAILURE)
* is set. Workaround this behavior */
BioByteArray b;
if (i2b_PVK_bio(b, pkey, enc, cb, &p) == -1) {
if (i2b_PVK_bio(b, pkey, 0, nullptr, &p) == -1) {
pki_openssl_error();
PEMerr(PEM_F_I2B_PVK_BIO, PEM_R_BIO_WRITE_FAILURE);
pki_openssl_error();

2
lib/pki_evp.h
View File

@ -70,7 +70,7 @@ class pki_evp: public pki_key
pem_password_cb *cb, bool pem) const;
void writePKCS8(XFile &file, const EVP_CIPHER *enc,
pem_password_cb *cb, bool pem) const;
void writePVKprivate(XFile &file, pem_password_cb *cb) const;
void writePVKprivate(XFile &file) const;
bool verify(EVP_PKEY *pkey) const;
QVariant getIcon(const dbheader *hd) const;
bool sqlUpdatePrivateKey();

1
lib/pki_export.cpp
View File

@ -87,7 +87,6 @@ new pki_export(23, asym_key, "pub" ,tr("SSH2 public"), F_SSH2,
new pki_export(24, asym_key, "der", tr("DER public"), F_DER | F_SINGLE, tr("Binary DER format of the public key")),
new pki_export(25, asym_key, "der", tr("DER private"), F_DER | F_PRIVATE | F_SINGLE, tr("Unencrypted private key in binary DER format")),
new pki_export(26, asym_key, "pvk", tr("PVK private"), F_PVK | F_PRIVATE | F_SINGLE, tr("Private key in Microsoft PVK format not encrypted")),
new pki_export(27, asym_key, "pvk", tr("PVK encrypted"), F_PVK | F_PRIVATE | F_CRYPT | F_SINGLE, tr("Encrypted private key in Microsoft PVK format")),
new pki_export(28, asym_key, "pk8", tr("PKCS #8 encrypted"), F_PKCS8 | F_PRIVATE | F_CRYPT | F_USUAL | F_SINGLE, tr("Encrypted private key in PKCS#8 text format")),
new pki_export(29, asym_key, "pk8", tr("PKCS #8"), F_PKCS8 | F_PRIVATE | F_CLIPBOARD | F_SINGLE, tr("Unencrypted private key in PKCS#8 text format")),

10
test/export.cpp
View File

@ -304,16 +304,6 @@ void test_main::exportFormat()
verify_key(file, QList<unsigned> { ENDKEY_HASH }, true);
check_pems(file, 0);
// Private PVK Key encrypted
file = AUTOFILE(PVK)
pwdialog->setExpectations(QList<pw_expect*>{
new pw_expect("pass", pw_ok),
new pw_expect("pass", pw_ok),
});
export_by_id(27, file, list, keys);
verify_key(file, QList<unsigned> { ENDKEY_HASH }, true);
check_pems(file, 0);
} catch (...) {
QString m = QString("Exception thrown L %1").arg(l);
QVERIFY2(false, m.toUtf8().constData());