Support FIPS-compliant PKCS#12 files and create them by default in FIPS mode
Open
Nobody has claimed this yet.
triaged: feature
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
The PKCS12KDF is not FIPS approved, so it's missing from the fips provider. Therefore it's not possible to create a PKCS #12 file that only uses FIPS approved algorithms in currently released versions of OpenSSL.
I've just published RFC 9579 that documents how to use PBMAC1 and therefore the FIPS approved PBKDF2 for the purpose of whole file integrity check.
I'd like to ask for:
- support for RFC 9579 (PBMAC1 in
PKCS #12) - use of it by default when OpenSSL is operating in FIPS mode
Related:
- #19997
- #20072
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading RFC 9579 and the related issues #19997 and #20072 to understand the proposed PBMAC1 support and existing context. Done means OpenSSL supports RFC 9579 for PKCS #12 files and uses it by default when operating in FIPS mode.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100