Add support for encrypted PEM keys #318
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for creating keys from encrypted PEM files
Checklist
If you've made changes to
gyb
files.script/generate_boilerplate_files_with_gyb
and included updated generated files in a commit of this pull requestMotivation:
See #264
Modifications:
For now the PR provides encrypted PEM initialisers for RSA using the following encryption algorithms:
PBES2
withAES{128, 192, 256}_CBC
andhmacWithSHA256
PBES2
with3DES_CBC
(via BoringSSL) andhmacWithSHA256
PBES2
withAES_GCM
PBE_MD5_DES_CBC
PBE_MD5_RC2_CBC
PBE_SHA1_DES_CBC
PBE_SHA1_RC2_CBC
Scrypt
PBKDF2
withSHA1
PBKDF2
withSHA512
This list is not final and algorithms can be both added and removed.
The aim is to add support for the rest of the keys and as many encryption algorithms as possible (where appropriate), and as the PR evolves I'll update this comment with the current state.
The current strategy is to use SwiftASN1 to parse the provided PEM file and decrypt it depending on which encryption algorithm is found.
The PR still has a long way to got and while this approach works, for now it's mainly still a proof of concept and I'm open to discussing different/better strategies
Result:
Keys can be created from encrypted PEM files