PKCS#12 PBE doesn't convert to UTF-16BE correctly about mbed-crypto

[magnumripper]

(See below) Please note that I haven't yet checked how OpenSSL handles this. I wouldn't be too surprised if they do the same, and in that case you are bug compatible with them.

The software we've seen so far that does the correct conversion happens to be running on Windows.

[ciarmcom]

Internal Jira reference: https://jira.arm.com/browse/IOTCRYPT-1032

[magnumripper]

Apparently OpenSSL doesn't have this bug if used correctly: It has functions like OPENSSL_asc2uni() which works just like your code but it also has OPENSSL_utf82uni() and as long as the latter is used, caller is bug free in this aspect. The UTF-8 functions were added in November 2015.

Edit:
https://mta.openssl.org/pipermail/openssl-dev/2016-August/008371.html

[gilles-peskine-arm]

Mbed TLS mostly focuses on embedded devices where code size is at a premium and non-ASCII character encodings are rarely used, and we try to avoid breaking backward compatibility. So I favor:

• Documenting that pkcs12_pbe_derive_key_iv expects its argument pwd to be encoded in latin1.
• Adding a new function that supports Unicode. I don't know what the argument type should be: wchar_t? (Would create a dependency on that type, which freestanding C implementations might not have.) uint16_t? (Would this be useful in practice?) And should it be documented as taking a BMPString per RFC 7292 or UTF-16 (allowing characters outside the basic plane)?