Re: Error setting CRYPT_KEYINFO_QUERY attribute string
Fred MAISON <[email protected]> Wed, 20 Mar 2013 10:08:28 +0100
| Newsgroups | gmane.comp.encryption.cryptlib |
|---|---|
| Message-ID | <1363770508.1905.32.camel@T410FMA> |
Hi Peter,
Thanks for your answer.
I did not noticed this was not applicable to file keysets, I realized
this later by further testing code and re-reading manual and parts of
cryptlib sources. So, for now, I have been able to retrieve the private
CA key from the p12 using "[none]" as the keyid name :
status = cryptGetPrivateKey( CAkeyset, &CAContext, CRYPT_KEYID_NAME,
"[none]", "mypasswd" );
but I am still unable to retrieve the public part of the CA in the p12
(CA cert), on which I want make some checks (keyUsage, and so on ...)
cryptGetPublicKey, always return CRYPT_ERROR_NOTFOUND (-43) :
status = cryptGetPublicKey( CAkeyset, &CApubKeyHandle
CRYPT_KEYID_NAME,"[none]");
status = cryptGetPublicKey( CAkeyset, &CApubKeyHandle,
CRYPT_KEYID_NAME,"PMUlabXCA2048");
status = cryptGetPublicKey( CAkeyset, &CApubKeyHandle,
CRYPT_KEYID_NAME,"$CN='PMUlabXCA2048");
Can you explain if the problem is with matching the correct KEYID_NAME
format or if this is not the right way to proceed ?
I am also confused with p12 enveloppe password and private key
password ...
Here follow asn1 dump of the p12, which mail help :
dumpasn1 certs/PMUlabXCA2048.p12
0 2520: SEQUENCE {
4 1: INTEGER 3
7 2466: SEQUENCE {
11 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
22 2451: [0] {
26 2447: OCTET STRING, encapsulates {
30 2443: SEQUENCE {
34 1047: SEQUENCE {
38 9: OBJECT IDENTIFIER encryptedData (1 2 840 113549 1
7 6)
49 1032: [0] {
53 1028: SEQUENCE {
57 1: INTEGER 0
60 1021: SEQUENCE {
64 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7
1)
75 28: SEQUENCE {
77 10: OBJECT IDENTIFIER
: pbeWithSHAAnd40BitRC2-CBC (1 2 840
113549 1 12 1 6)
89 14: SEQUENCE {
91 8: OCTET STRING 79 D9 F6 98 E6 8D B8 21
101 2: INTEGER 2048
: }
: }
105 976: [0]
: AB 26 22 48 51 47 63 38 CD 11 8B 4F B8 7F
2E E1
: 13 98 BF 4F 4E C8 98 52 96 46 9C 52 A4 7F
89 56
: 32 01 49 23 D0 CF EB CC A4 4D F3 2D 3A 96
87 0F
: 52 0A B1 EA D9 15 E6 CD 21 99 39 8C 38 02
24 2F
: 80 0B 59 EF 1B 19 B9 8E 19 9F 01 5D AD DA
15 FA
: 9B 9C 2C AF C2 53 3D 9D 4F FC F7 18 8A 7C
16 F5
: AD F3 06 F1 F3 84 43 0D B1 5A 74 C1 66 FE
CD A5
: 7C 46 3E BB 8F 88 DB FA 82 B5 BF 30 47 83
E5 66
: [ Another 848 bytes skipped ]
: }
: }
: }
: }
1085 1388: SEQUENCE {
1089 9: OBJECT IDENTIFIER data (1 2 840 113549 1 7 1)
1100 1373: [0] {
1104 1369: OCTET STRING, encapsulates {
1108 1365: SEQUENCE {
1112 1361: SEQUENCE {
1116 11: OBJECT IDENTIFIER
: pkcs-12-pkcs-8ShroudedKeyBag (1 2 840
113549 1 12 10 1 2)
1129 1262: [0] {
1133 1258: SEQUENCE {
1137 28: SEQUENCE {
1139 10: OBJECT IDENTIFIER
: pbeWithSHAAnd3-KeyTripleDES-CBC
(1 2 840 113549 1 12 1 3)
1151 14: SEQUENCE {
1153 8: OCTET STRING C4 F7 74 7C F4 7A 9F
57
1163 2: INTEGER 2048
: }
: }
1167 1224: OCTET STRING
: 0C 66 25 F4 AF 0A 81 26 6E D3 71 F0 E3 02
A1 86
: E3 F1 23 44 27 05 7E 3A 08 A7 76 AC B9 5D
76 C4
: 18 33 E9 90 C5 9C 8C 3B 89 EB 3E AC 97 9A
03 7D
: 42 4B C9 C5 87 55 1A 73 88 11 76 77 4D 76
CD 7B
: 35 76 93 1A 47 92 56 11 DD 0A 4E C0 01 18
0F EE
: 06 44 C8 48 96 2B 72 C5 36 04 8B AC 0D 62
25 EA
: B3 D9 58 C1 FB 25 77 16 7D A9 80 92 27 D4
EB D7
: 5C 3D 89 22 D4 76 F8 53 AB FB 2D AF 4E 86
44 95
: [ Another 1096 bytes skipped ]
: }
: }
2395 80: SET {
2397 35: SEQUENCE {
2399 9: OBJECT IDENTIFIER
: localKeyID (for PKCS #12) (1 2 840
113549 1 9 21)
2410 22: SET {
2412 20: OCTET STRING
: 9A D6 EA 99 E3 CA 92 DF EA 8A 3F C9 28 09
61 52
: 10 F4 AE 06
: }
: }
2434 41: SEQUENCE {
2436 9: OBJECT IDENTIFIER
: friendlyName (for PKCS #12) (1 2
840 113549 1 9 20)
2447 28: SET {
2449 26: BMPString 'PMUlabXCA2048'
: }
: }
: }
: }
: }
: }
: }
: }
: }
: }
: }
: }
2477 45: SEQUENCE {
2479 33: SEQUENCE {
2481 9: SEQUENCE {
2483 5: OBJECT IDENTIFIER sha1 (1 3 14 3 2 26)
2490 0: NULL
: }
2492 20: OCTET STRING 1E 82 6C 24 6C 21 B8 CD EC D1 1C B8 A8 F2
18 DD AE 18 D6 74
: }
2514 8: OCTET STRING F0 03 80 C1 C4 14 22 5A
: }
: }
0 warnings, 0 errors.
Best regards,
Fred MAISON
Le mercredi 20 mars 2013 à 15:11 +1300, Peter Gutmann a écrit :
> Fred MAISON <[email protected]> writes:
>
> >While trying to load a pkcs12 file keyset, I got a param2 error while
> >setting CRYPT_KEYINFO_QUERY attribute string.
> >
> >Can you tell what is incorrect ?
>
> CRYPT_KEYINFO_QUERY is only valid for database keysets. cryptlib is returning
> CRYPT_ERROR_PARAM2 to tell you that this attribute isn't valid for the given
> keyset type.
>
> Peter.
_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.