FW: PKCS-12 (open-ssl)

-----Original Message-----
From: Colestock, Robert 
Sent: Tuesday, May 01, 2001 9:02 AM
To: '[email protected]'
Cc: Pawling, John
Subject: RE: PKCS-12 (open-ssl)


Eric:

Piece of cake.

The existing CertificateBuilder project demonstrates how to generate a DSA,
RSA and DH public/private keys.  It also demonstrates how to save the
private keys and built certificates for DSA and RSA as PKCS12 packets using
the sm_free3 CTIL routines.  The following excerpt demonstrates just the
PKCS12 wrapping component (it is not in your release, I have just finished
modifying the CertificateBuilder logic to allow Linux to build PKCS12
packets, not just the MS Windows GUI based CertificateBuilder).  If you can
follows the convoluted logic in CertificateBuilder (it isn't too difficult,
check the OnOk() and GenerateKeys button logic), you will find that key
generation and PKCS12 wrapping are part of the sm_free3 CTIL class set.

All of this logic deals with file names (as per the open ssl logic).

// THIS method handles the previously created private key and wraps the key
//  in a PKCS12 formatted file along with the newly created/signed
certificate.
//  This private key may have been generated, or specified directly by the 
//  user.
void CCL_Certificate::CreatePkcs12PrivateKey(char *pPrvKey, //IN, private
key file name
                                             char *pOperation, //IN,
"DSA","RSA"
                                             char *pPassword,  //IN
         CSM_Buffer *pP, CSM_Buffer *pQ, CSM_Buffer *pG)
{
   CSM_CryptoKeysDsa *pCryptoDSA = NULL;
   CSM_CryptoKeysF3Rsa *pCryptoF3RSA = NULL;
   char *pencPrvKeyFilename = NULL; //Encrypted Private Key Storage
filename.
   char *pKeyFilename = NULL;
   char *pCertFilename = NULL;
   char *pPubKeyFilename = NULL;
   long status = 0;

   SME_SETUP("CCL_Certificate::CreatePkcs12PrivateKey()");

   if (pPrvKey)
   {
	   // get name for filename creation
	   pKeyFilename = strdup(pPrvKey);
	   char *tmpPos;
       tmpPos = strrchr /*strcspn*/(pKeyFilename, '.');
       if (tmpPos)
	     *tmpPos = '\0';

      // wrapping with pks12 format is done after the cert is built

      // create file name for pkcs12 wrapped encrypted private key
      pencPrvKeyFilename = (char *) calloc(1,strlen(pKeyFilename) + 9);
      strcpy(pencPrvKeyFilename,pKeyFilename);
      strcat(pencPrvKeyFilename,"X_12.pfx");
    
      // create the certificate filename
      pCertFilename = (char *) calloc(1,strlen(pKeyFilename) + 5);
      strcpy(pCertFilename,pKeyFilename);
      strcat(pCertFilename,".sig"); 
      pPubKeyFilename = (char *) calloc(1,strlen(pKeyFilename) + 5);
      strcpy(pPubKeyFilename ,pKeyFilename);
      strcat(pPubKeyFilename ,".pub"); 


      if (strcmp(pOperation, "DSA") == 0)
      {
         pCryptoDSA = SM_BuildCryptoKeysDSA(NULL, pPassword);
          // call will write the EncryptedPrivateKeyInfo to output file
pencPrvKeyFilename
         if (pP == NULL)
         {
             SME_THROW(22, "ISSUER DID NOT HAVE PARAMS EITHER, MUST UPDATE
to get issuer's issuer.", 
                 NULL);
         }
         CSM_Buffer *pPKCS12Buf=pCryptoDSA->WrapPkcs12(pPrvKey, 
           pPubKeyFilename, pCertFilename, pPassword, *pP, 
           *pQ, *pG, pencPrvKeyFilename);
         delete pPKCS12Buf;  // RESULT already stored in optional
"pencPrvKeyFilename".
      }
      else
      if (strcmp(pOperation, "RSA") == 0)
      {
         PrivateKeyInfo snaccPKI;
         CSM_Buffer bufPKIPrivateKey(pPrvKey);
         pCryptoF3RSA = SM_BuildCryptoKeysF3Rsa(NULL, pPassword);
          // call will write the EncryptedPrivateKeyInfo to output file
pencPrvKeyFilename
#ifndef CRYPTOPP_3_2
         // The newer version changed the returned format of the RSA key by
wrapping in
         //  a PrivateKeyInfo, not just the raw RSA private key.  We must
re-extract
         //  in order for the open SSL logic to properly recognize the RSA
key.
         DECODE_BUF((&snaccPKI), &bufPKIPrivateKey);
         char *ptr=(char *)calloc(1, strlen(pPrvKey)+5);
         strcpy(ptr, pPrvKey);
         strcat(ptr, "RAW");
         CSM_Buffer bufRawPKI((char *)snaccPKI.privateKey, 
             snaccPKI.privateKey.Len());
         bufRawPKI.ConvertMemoryToFile (ptr);
         CSM_Buffer
*pPKCS12Buf=pCryptoF3RSA->WrapPkcs12(ptr/*this->m_pPrvKey*/, 
             pCertFilename, pPassword, pencPrvKeyFilename);
#else
         CSM_Buffer *pPKCS12Buf=pCryptoF3RSA->WrapPkcs12(pPrvKey, 
             pCertFilename, pPassword, pencPrvKeyFilename);
#endif
         free(ptr);
         if (pPKCS12Buf)
           delete pPKCS12Buf;  // RESULT already stored in optional
"pencPrvKeyFilename".
      }

   }


   if(pCertFilename)
      free(pCertFilename);
   if(pencPrvKeyFilename)
      free(pencPrvKeyFilename);
   if(pKeyFilename)
      free(pKeyFilename);

   SME_FINISH
   SME_CATCH_SETUP
 
   SME_CATCH_FINISH
}



Bob Colestock
VDA.

-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Monday, April 30, 2001 3:19 PM
To: [email protected]
Subject: PKCS-12 (open-ssl)


Hi,

I am able to decode a PKCS-12 file with theOpen-SSL library included in
SM_Free3DLL.dll.  But now, i want to create one.  Can you tell me if i can
made it with this library ??

If not, How can i made it ?


Thanks.

**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: [email protected]
**************************************************************************