pkcs12.h
mbedtls/build_info.h
mbedtls/md.h
mbedtls/cipher.h
mbedtls/asn1.h
stddef.h
mbedtls/asn1.h
mbedtls/bignum.h
mbedtls/build_info.h
mbedtls/check_config.h
mbedtls/cipher.h
mbedtls/config_adjust_legacy_crypto.h
mbedtls/config_adjust_psa_from_legacy.h
mbedtls/config_adjust_psa_superset_legacy.h
mbedtls/config_adjust_ssl.h
mbedtls/config_adjust_x509.h
mbedtls/config_psa.h
mbedtls/mbedtls_config.h
mbedtls/md.h
pkcs12.h
mbedtls/platform_time.h
mbedtls/platform_util.h
mbedtls/private_access.h
psa/crypto_adjust_auto_enabled.h
psa/crypto_adjust_config_dependencies.h
psa/crypto_adjust_config_key_pair_types.h
psa/crypto_adjust_config_synonyms.h
psa/crypto_legacy.h
inttypes.h
limits.h
stddef.h
stdint.h
stdio.h
time.h
MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA
-0x1F80

Bad input parameters to function.

MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE
-0x1F00

Feature not available, e.g. unsupported encryption scheme.

MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT
-0x1E80

PBE ASN.1 data not as expected.

MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH
-0x1E00

Given private key password does not allow for correct decryption.

MBEDTLS_PKCS12_DERIVE_KEY
1

encryption/decryption key

MBEDTLS_PKCS12_DERIVE_IV
2

initialization vector

MBEDTLS_PKCS12_DERIVE_MAC_KEY
3

integrity / MAC key

MBEDTLS_PKCS12_PBE_DECRYPT
MBEDTLS_DECRYPT
MBEDTLS_PKCS12_PBE_ENCRYPT
MBEDTLS_ENCRYPT
int MBEDTLS_DEPRECATED int MBEDTLS_DEPRECATED mbedtls_pkcs12_pbe (mbedtls_asn1_buf *pbe_params, int mode, mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t len, unsigned char *output) mbedtls_pkcs12_pbe mbedtls_asn1_buf * pbe_params int mode mbedtls_cipher_type_t cipher_type mbedtls_md_type_t md_type const unsigned char * pwd size_t pwdlen const unsigned char * data size_t len unsigned char * output

PKCS12 Password Based function (encryption / decryption) for cipher-based and mbedtls_md-based PBE's.

When encrypting, MBEDTLS_CIPHER_PADDING_PKCS7 must be enabled at compile time.

Deprecated

This function is deprecated and will be removed in a future version of the library. Please use mbedtls_pkcs12_pbe_ext() instead.

When decrypting:

- if MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile time, this function validates the CBC padding and returns MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is invalid. Note that this can help active adversaries attempting to brute-forcing the password. Note also that there is no guarantee that an invalid password will be detected (the chances of a valid padding with a random password are about 1/255).

- if MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile time, this function does not validate the CBC padding.

pbe_params

an ASN1 buffer containing the pkcs-12 PbeParams structure

mode

either MBEDTLS_PKCS12_PBE_ENCRYPT or MBEDTLS_PKCS12_PBE_DECRYPT

cipher_type

the cipher used

md_type

the mbedtls_md used

pwd

Latin1-encoded password used. This may only be `NULL` when `pwdlen` is 0. No null terminator should be used.

pwdlen

length of the password (may be 0)

data

the input data

len

data length

output

Output buffer. On success, it contains the encrypted or decrypted data, possibly followed by the CBC padding. On failure, the content is indeterminate. For decryption, there must be enough room for `len` bytes. For encryption, there must be enough room for `len` + 1 bytes, rounded up to the block size of the block cipher identified by `pbe_params`.

0 if successful, or a MBEDTLS_ERR_XXX code

MBEDTLS_DEPRECATED
int int mbedtls_pkcs12_pbe_ext (mbedtls_asn1_buf *pbe_params, int mode, mbedtls_cipher_type_t cipher_type, mbedtls_md_type_t md_type, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t len, unsigned char *output, size_t output_size, size_t *output_len) mbedtls_pkcs12_pbe_ext mbedtls_asn1_buf * pbe_params int mode mbedtls_cipher_type_t cipher_type mbedtls_md_type_t md_type const unsigned char * pwd size_t pwdlen const unsigned char * data size_t len unsigned char * output size_t output_size size_t * output_len

PKCS12 Password Based function (encryption / decryption) for cipher-based and mbedtls_md-based PBE's.

When decrypting:

- This function validates the CBC padding and returns MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is invalid. Note that this can help active adversaries attempting to brute-forcing the password. Note also that there is no guarantee that an invalid password will be detected (the chances of a valid padding with a random password are about 1/255).

pbe_params

an ASN1 buffer containing the pkcs-12 PbeParams structure

mode

either MBEDTLS_PKCS12_PBE_ENCRYPT or MBEDTLS_PKCS12_PBE_DECRYPT

cipher_type

the cipher used

md_type

the mbedtls_md used

pwd

Latin1-encoded password used. This may only be `NULL` when `pwdlen` is 0. No null terminator should be used.

pwdlen

length of the password (may be 0)

data

the input data

len

data length

output

Output buffer. On success, it contains the encrypted or decrypted data, possibly followed by the CBC padding. On failure, the content is indeterminate. For decryption, there must be enough room for `len` bytes. For encryption, there must be enough room for `len` + 1 bytes, rounded up to the block size of the block cipher identified by `pbe_params`.

output_size

size of output buffer. This must be big enough to accommodate for output plus padding data.

output_len

On success, length of actual data written to the output buffer.

0 if successful, or a MBEDTLS_ERR_XXX code

int int mbedtls_pkcs12_derivation (unsigned char *data, size_t datalen, const unsigned char *pwd, size_t pwdlen, const unsigned char *salt, size_t saltlen, mbedtls_md_type_t mbedtls_md, int id, int iterations) mbedtls_pkcs12_derivation unsigned char * data size_t datalen const unsigned char * pwd size_t pwdlen const unsigned char * salt size_t saltlen mbedtls_md_type_t mbedtls_md int id int iterations

The PKCS#12 derivation function uses a password and a salt to produce pseudo-random bits for a particular "purpose".

Depending on the given id, this function can produce an encryption/decryption key, an initialization vector or an integrity key.

data

buffer to store the derived data in

datalen

length of buffer to fill

pwd

The password to use. For compliance with PKCS#12 §B.1, this should be a BMPString, i.e. a Unicode string where each character is encoded as 2 bytes in big-endian order, with no byte order mark and with a null terminator (i.e. the last two bytes should be 0x00 0x00).

pwdlen

length of the password (may be 0).

salt

Salt buffer to use. This may only be `NULL` when `saltlen` is 0.

saltlen

length of the salt (may be zero)

mbedtls_md

mbedtls_md type to use during the derivation

id

id that describes the purpose (can be MBEDTLS_PKCS12_DERIVE_KEY, MBEDTLS_PKCS12_DERIVE_IV or MBEDTLS_PKCS12_DERIVE_MAC_KEY)

iterations

number of iterations

0 if successful, or a MD, BIGNUM type error.

mbedtls_md

PKCS#12 Personal Information Exchange Syntax.

    /*
    *CopyrightTheMbedTLSContributors
    *SPDX-License-Identifier:Apache-2.0ORGPL-2.0-or-later
    */
    #ifndefMBEDTLS_PKCS12_H
    #defineMBEDTLS_PKCS12_H

    #include"mbedtls/build_info.h"

    #include"mbedtls/md.h"
    #include"mbedtls/cipher.h"
    #include"mbedtls/asn1.h"

    #include<stddef.h>

    #defineMBEDTLS_ERR_PKCS12_BAD_INPUT_DATA-0x1F80
    #defineMBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE-0x1F00
    #defineMBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT-0x1E80
    #defineMBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH-0x1E00

    #defineMBEDTLS_PKCS12_DERIVE_KEY1
    #defineMBEDTLS_PKCS12_DERIVE_IV2
    #defineMBEDTLS_PKCS12_DERIVE_MAC_KEY3

    #defineMBEDTLS_PKCS12_PBE_DECRYPTMBEDTLS_DECRYPT
    #defineMBEDTLS_PKCS12_PBE_ENCRYPTMBEDTLS_ENCRYPT

    #ifdef__cplusplus
    extern"C"{
    #endif

    #ifdefined(MBEDTLS_ASN1_PARSE_C)&&defined(MBEDTLS_CIPHER_C)

    #if!defined(MBEDTLS_DEPRECATED_REMOVED)
    intMBEDTLS_DEPRECATEDmbedtls_pkcs12_pbe(mbedtls_asn1_buf*pbe_params,intmode,
    mbedtls_cipher_type_tcipher_type,
    mbedtls_md_type_tmd_type,
    constunsignedchar*pwd,size_tpwdlen,
    constunsignedchar*data,size_tlen,
    unsignedchar*output);
    #endif/*MBEDTLS_DEPRECATED_REMOVED*/

    #ifdefined(MBEDTLS_CIPHER_PADDING_PKCS7)

    intmbedtls_pkcs12_pbe_ext(mbedtls_asn1_buf*pbe_params,intmode,
    mbedtls_cipher_type_tcipher_type,mbedtls_md_type_tmd_type,
    constunsignedchar*pwd,size_tpwdlen,
    constunsignedchar*data,size_tlen,
    unsignedchar*output,size_toutput_size,
    size_t*output_len);

    #endif/*MBEDTLS_CIPHER_PADDING_PKCS7*/

    #endif/*MBEDTLS_ASN1_PARSE_C&&MBEDTLS_CIPHER_C*/

    intmbedtls_pkcs12_derivation(unsignedchar*data,size_tdatalen,
    constunsignedchar*pwd,size_tpwdlen,
    constunsignedchar*salt,size_tsaltlen,
    mbedtls_md_type_tmbedtls_md,intid,intiterations);

    #ifdef__cplusplus
    }
    #endif

    #endif/*pkcs12.h*/