Re: why does the pkcs12 tool use such short mac salts?
Viktor Dukhovni <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Jun 07, 2025 at 01:56:24PM -0500, Thomas Anderson wrote:
> My question is... why is OpenSSL using such a short salt? I know the
> PKCS12 standard leaves a lot to be desired, as elaborated by
> https://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html . Maybe the RFC's
> recommendations for salt length are best just ignored?
Perhaps not the answer you're looking for, but the best available reason
is that this is the length chosen in:
commit 8d8c7266d4de9887fb0190a0770df9dc254a16a3
Date: Sun Mar 28 23:17:34 1999 +0000
and it hasn't changed since.
$ git grep PKCS12_SALT_LEN
crypto/pkcs12/p12_mutl.c: saltlen = PKCS12_SALT_LEN;
include/openssl/pkcs12.h.in:# define PKCS12_SALT_LEN 8
If you'd like to see it updated, perhaps you're willing to open a github
issue?
--
Viktor.
--
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aEUSe5HABa6csoQg%40chardros.imrryr.org.