wc_PKCS12_parse returns -154, /* ASN input error, not enough data */ about wolfssl-examples

[kaleb-himes]

Hi EILamparto,

Thank you so much for providing all the necessary debug information including the certificates. I was able to build/run the example using your cert and pwd. I can confirm the issue. If you turn on debugging you should get a log similar to this:

kalebs-MBP:pkcs12 khimes$ ./pkcs12-example 
extracting private key and certificate from PKCS12 (test-servercert.p12)
wolfSSL Entering wolfSSL_d2i_PKCS12_bio
wolfSSL Entering GetObjectId()
Found PKCS12 OBJECT: DATA
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
return value of d2i pkcs12 = 1 SUCCESS
wolfSSL Entering wc_PKCS12_parse
Parsing PKCS12 DATA Content Info Container
wolfSSL Entering GetObjectId()
PKCS12 Shrouded Key Bag found
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Done Parsing PKCS12 Content Info Container
Decrypting PKCS12 Content Info Container
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Decryption failed, algorithm not compiled in?
return value of parsing pkcs12 = -154 FAIL
	 error parsing pkcs12

Since it was unable to identify which algorithm was used for encrypting that portion of the object I loaded this up into an online parser here: https://lapo.it/asn1js/

Here's what we see in part of the pk12 object:

SEQUENCE(2 elem)
Offset: 75
Length: 2+28
(constructed)
Value:
(2 elem)
OBJECT IDENTIFIER1.2.840.113549.1.12.1.6pbeWithSHAAnd40BitRC2-CBC(PKCS #12 PbeIds)

wolfSSL does not support RC2 unfortunately. If you check this blog post here you will notice we had a similar issue fairly recently:

https://www.wolfssl.com/forums/topic892-solved-does-wolf-support-pcks12-pfx-format.html

We do not currently support RC2, so encryption done with RC2 can not be decrypted by the API.

Is this something that is a requirement for you or are you able to use an alternate PKCS12 bundle?
If you need RC2 support please let us know and I can get you in touch with one of our business managers to discuss that feature addition!

Best Regards,

Kaleb

[ElLamparto]

Kaleb, thank you for your quick response.
Could you tell me, what encryption methods wolfSSL supports? I'll then try to get another version of the PKCS12...

[kaleb-himes]

Hi EILamparto,

Happily! wolfSSL manual chapter 4 section 4.3.4 excerpt:

4.3.4 Block and Stream Ciphers

wolfSSL supports the AES, DES, 3DES, and Camellia block ciphers and the
RC4, RABBIT, HC-128 and CHACHA20 stream ciphers.

These may also be helpful if you are wondering about which hashing or public key algorithms wolfSSL also supports:
4.3.5 Hashing Functions
4.3.6 Public Key Options

I hope this is helpful.

Best Regards,

Kaleb

[ElLamparto]

Thank you very much for your analysis and help.