Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for encrypted PEM keys #318

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Conversation

ptoffy
Copy link
Contributor

@ptoffy ptoffy commented Dec 29, 2024

Add support for creating keys from encrypted PEM files

Checklist

  • I've run tests to see all new and existing tests pass
  • I've followed the code style of the rest of the project
  • I've read the Contribution Guidelines
  • I've updated the documentation if necessary

If you've made changes to gyb files

  • I've run .script/generate_boilerplate_files_with_gyb and included updated generated files in a commit of this pull request

Motivation:

See #264

Modifications:

For now the PR provides encrypted PEM initialisers for RSA using the following encryption algorithms:

  • PBES2 with AES{128, 192, 256}_CBC and hmacWithSHA256
  • PBES2 with 3DES_CBC (via BoringSSL) and hmacWithSHA256
  • PBES2 with AES_GCM
  • PBE_MD5_DES_CBC
  • PBE_MD5_RC2_CBC
  • PBE_SHA1_DES_CBC
  • PBE_SHA1_RC2_CBC
  • Scrypt
  • PBKDF2 with SHA1
  • PBKDF2 with SHA512

This list is not final and algorithms can be both added and removed.
The aim is to add support for the rest of the keys and as many encryption algorithms as possible (where appropriate), and as the PR evolves I'll update this comment with the current state.
The current strategy is to use SwiftASN1 to parse the provided PEM file and decrypt it depending on which encryption algorithm is found.
The PR still has a long way to got and while this approach works, for now it's mainly still a proof of concept and I'm open to discussing different/better strategies

Result:

Keys can be created from encrypted PEM files

@ptoffy
Copy link
Contributor Author

ptoffy commented Dec 30, 2024

FYI I've also tried making specific ASN.1 structures for the various enc/kdf algorithms however I'm not sure if it's worth adding ptoffy/swift-crypto@encrypted-pem...ptoffy:swift-crypto:encrypted-pem-types

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant