Re: Error setting CRYPT_KEYINFO_QUERY attribute string

Peter,

I understand p12 export of my original CA key/cert is done using weak
crypto parameters (cypher, key len, hash, ...).
Unfortunately, I don't have access to P12 export parameters on the
original CA binaries (http://xca.sourceforge.net/).
I have found p12 export routines in xca source, the weakness seems to
come from there, it also appears weak crypto are also used in different
parts of this software ...

As a resume, I seems I have the following choices :

1° try to find another export/import method to re-use my original CA
key/cert pair, knowing only PKC8 for keys (unsupported by cryptlib) and
PKCS7 for certs are available and not yest tested ...
I will keep the CA key recovered using P12 import and first try cert
import from PKCS#7...

2° try to patch/rebuild xca.

3° re-create from scratch a new CA using cryptlib.
Even if this should be the best choice regarding security, this will be
my last choice, as this also means I will have to change ALL my LAB
devices certs and cert chains ...

Thanks for your help

Best regards,
Fred

Le mercredi 20 mars 2013 à 22:35 +1300, Peter Gutmann a écrit :
> Fred MAISON <[email protected]> writes:
> 
> >but I am still unable to retrieve the public part of the CA in the p12 (CA
> >cert), on which I want make some checks (keyUsage, and so on ...)
> 
> Well since PKCS #12 isn't an officially supported format in cryptlib (because
> of its numerous security problems - presumably you read the warnings about
> this when you enabled the define in config.h) it's really just coincidence if
> it works or not.  For example if you look at the ASN.1 dump you sent me:
> 
>          :             pbeWithSHAAnd40BitRC2-CBC (1 2 840 113549 1 12 1 6)
> 
> that's a quarter-century-old old obsolete cipher using a key size that was too
> weak to be used fifteen years ago, so it's not too surprising that that, or
> any one of numerous other issues, is preventing it from being read.
> 
> Peter.



_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.