safebags.go

Documentation: github.com/tjfoc/gmsm/pkcs12

     1  // Copyright 2015 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package pkcs12
     6  
     7  import (
     8  	"crypto/rand"
     9  	"encoding/asn1"
    10  	"errors"
    11  )
    12  
    13  var (
    14  	// see https://tools.ietf.org/html/rfc7292#appendix-D
    15  	oidCertTypeX509Certificate = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 22, 1})
    16  	oidPKCS8ShroundedKeyBag    = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 2})
    17  	oidCertBag                 = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 3})
    18  )
    19  
    20  type certBag struct {
    21  	Id   asn1.ObjectIdentifier
    22  	Data []byte `asn1:"tag:0,explicit"`
    23  }
    24  
    25  func decodePkcs8ShroudedKeyBag(asn1Data, password []byte) (privateKey interface{}, err error) {
    26  	pkinfo := new(encryptedPrivateKeyInfo)
    27  	if err = unmarshal(asn1Data, pkinfo); err != nil {
    28  		return nil, errors.New("go-pkcs12: error decoding PKCS#8 shrouded key bag: " + err.Error())
    29  	}
    30  
    31  	pkData, err := pbDecrypt(pkinfo, password)
    32  	if err != nil {
    33  		return nil, errors.New("go-pkcs12: error decrypting PKCS#8 shrouded key bag: " + err.Error())
    34  	}
    35  
    36  	ret := new(asn1.RawValue)
    37  	if err = unmarshal(pkData, ret); err != nil {
    38  		return nil, errors.New("go-pkcs12: error unmarshaling decrypted private key: " + err.Error())
    39  	}
    40  
    41  	if privateKey, err = ParsePKCS8PrivateKey(pkData); err != nil {
    42  		return nil, errors.New("go-pkcs12: error parsing PKCS#8 private key: " + err.Error())
    43  	}
    44  
    45  	return privateKey, nil
    46  }
    47  
    48  func encodePkcs8ShroudedKeyBag(privateKey interface{}, password []byte) (asn1Data []byte, err error) {
    49  	var pkData []byte
    50  	if pkData, err = marshalPKCS8PrivateKey(privateKey); err != nil {
    51  		return nil, errors.New("go-pkcs12: error encoding PKCS#8 private key: " + err.Error())
    52  	}
    53  
    54  	randomSalt := make([]byte, 8)
    55  	if _, err = rand.Read(randomSalt); err != nil {
    56  		return nil, errors.New("go-pkcs12: error reading random salt: " + err.Error())
    57  	}
    58  	var paramBytes []byte
    59  	if paramBytes, err = asn1.Marshal(pbeParams{Salt: randomSalt, Iterations: 2048}); err != nil {
    60  		return nil, errors.New("go-pkcs12: error encoding params: " + err.Error())
    61  	}
    62  
    63  	var pkinfo encryptedPrivateKeyInfo
    64  	pkinfo.AlgorithmIdentifier.Algorithm = oidPBEWithSHAAnd3KeyTripleDESCBC
    65  	pkinfo.AlgorithmIdentifier.Parameters.FullBytes = paramBytes
    66  
    67  	if err = pbEncrypt(&pkinfo, pkData, password); err != nil {
    68  		return nil, errors.New("go-pkcs12: error encrypting PKCS#8 shrouded key bag: " + err.Error())
    69  	}
    70  
    71  	if asn1Data, err = asn1.Marshal(pkinfo); err != nil {
    72  		return nil, errors.New("go-pkcs12: error encoding PKCS#8 shrouded key bag: " + err.Error())
    73  	}
    74  
    75  	return asn1Data, nil
    76  }
    77  
    78  func decodeCertBag(asn1Data []byte) (x509Certificates []byte, err error) {
    79  	bag := new(certBag)
    80  	if err := unmarshal(asn1Data, bag); err != nil {
    81  		return nil, errors.New("go-pkcs12: error decoding cert bag: " + err.Error())
    82  	}
    83  	if !bag.Id.Equal(oidCertTypeX509Certificate) {
    84  		return nil, NotImplementedError("only X509 certificates are supported")
    85  	}
    86  	return bag.Data, nil
    87  }
    88  
    89  func encodeCertBag(x509Certificates []byte) (asn1Data []byte, err error) {
    90  	var bag certBag
    91  	bag.Id = oidCertTypeX509Certificate
    92  	bag.Data = x509Certificates
    93  	if asn1Data, err = asn1.Marshal(bag); err != nil {
    94  		return nil, errors.New("go-pkcs12: error encoding cert bag: " + err.Error())
    95  	}
    96  	return asn1Data, nil
    97  }
    98
View as plain text