1// Copyright 2015 The Go Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style
3// license that can be found in the LICENSE file.
4
5// Package pkcs12 implements some of PKCS#12.
6//
7// This implementation is distilled from https://tools.ietf.org/html/rfc7292
8// and referenced documents. It is intended for decoding P12/PFX-stored
9// certificates and keys for use with the crypto/tls package.
10//
11// This package is frozen. If it's missing functionality you need, consider
12// an alternative like software.sslmate.com/src/go-pkcs12.
13package pkcs12
14
15import (
16 "crypto/ecdsa"
17 "crypto/rsa"
18 "crypto/x509"
19 "crypto/x509/pkix"
20 "encoding/asn1"
21 "encoding/hex"
22 "encoding/pem"
23 "errors"
24)
25
26var (
27 oidDataContentType = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 7, 1})
28 oidEncryptedDataContentType = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 7, 6})
29
30 oidFriendlyName = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 20})
31 oidLocalKeyID = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 21})
32 oidMicrosoftCSPName = asn1.ObjectIdentifier([]int{1, 3, 6, 1, 4, 1, 311, 17, 1})
33
34 errUnknownAttributeOID = errors.New("pkcs12: unknown attribute OID")
35)
36
37type pfxPdu struct {
38 Version int
39 AuthSafe contentInfo
40 MacData macData `asn1:"optional"`
41}
42
43type contentInfo struct {
44 ContentType asn1.ObjectIdentifier
45 Content asn1.RawValue `asn1:"tag:0,explicit,optional"`
46}
47
48type encryptedData struct {
49 Version int
50 EncryptedContentInfo encryptedContentInfo
51}
52
53type encryptedContentInfo struct {
54 ContentType asn1.ObjectIdentifier
55 ContentEncryptionAlgorithm pkix.AlgorithmIdentifier
56 EncryptedContent []byte `asn1:"tag:0,optional"`
57}
58
59func (i encryptedContentInfo) Algorithm() pkix.AlgorithmIdentifier {
60 return i.ContentEncryptionAlgorithm
61}
62
63func (i encryptedContentInfo) Data() []byte { return i.EncryptedContent }
64
65type safeBag struct {
66 Id asn1.ObjectIdentifier
67 Value asn1.RawValue `asn1:"tag:0,explicit"`
68 Attributes []pkcs12Attribute `asn1:"set,optional"`
69}
70
71type pkcs12Attribute struct {
72 Id asn1.ObjectIdentifier
73 Value asn1.RawValue `asn1:"set"`
74}
75
76type encryptedPrivateKeyInfo struct {
77 AlgorithmIdentifier pkix.AlgorithmIdentifier
78 EncryptedData []byte
79}
80
81func (i encryptedPrivateKeyInfo) Algorithm() pkix.AlgorithmIdentifier {
82 return i.AlgorithmIdentifier
83}
84
85func (i encryptedPrivateKeyInfo) Data() []byte {
86 return i.EncryptedData
87}
88
89// PEM block types
90const (
91 certificateType = "CERTIFICATE"
92 privateKeyType = "PRIVATE KEY"
93)
94
95// unmarshal calls asn1.Unmarshal, but also returns an error if there is any
96// trailing data after unmarshaling.
97func unmarshal(in []byte, out interface{}) error {
98 trailing, err := asn1.Unmarshal(in, out)
99 if err != nil {
100 return err
101 }
102 if len(trailing) != 0 {
103 return errors.New("pkcs12: trailing data found")
104 }
105 return nil
106}
107
108// ToPEM converts all "safe bags" contained in pfxData to PEM blocks.
109// Unknown attributes are discarded.
110//
111// Note that although the returned PEM blocks for private keys have type
112// "PRIVATE KEY", the bytes are not encoded according to PKCS #8, but according
113// to PKCS #1 for RSA keys and SEC 1 for ECDSA keys.
114func ToPEM(pfxData []byte, password string) ([]*pem.Block, error) {
115 encodedPassword, err := bmpString(password)
116 if err != nil {
117 return nil, ErrIncorrectPassword
118 }
119
120 bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword)
121
122 if err != nil {
123 return nil, err
124 }
125
126 blocks := make([]*pem.Block, 0, len(bags))
127 for _, bag := range bags {
128 block, err := convertBag(&bag, encodedPassword)
129 if err != nil {
130 return nil, err
131 }
132 blocks = append(blocks, block)
133 }
134
135 return blocks, nil
136}
137
138func convertBag(bag *safeBag, password []byte) (*pem.Block, error) {
139 block := &pem.Block{
140 Headers: make(map[string]string),
141 }
142
143 for _, attribute := range bag.Attributes {
144 k, v, err := convertAttribute(&attribute)
145 if err == errUnknownAttributeOID {
146 continue
147 }
148 if err != nil {
149 return nil, err
150 }
151 block.Headers[k] = v
152 }
153
154 switch {
155 case bag.Id.Equal(oidCertBag):
156 block.Type = certificateType
157 certsData, err := decodeCertBag(bag.Value.Bytes)
158 if err != nil {
159 return nil, err
160 }
161 block.Bytes = certsData
162 case bag.Id.Equal(oidPKCS8ShroundedKeyBag):
163 block.Type = privateKeyType
164
165 key, err := decodePkcs8ShroudedKeyBag(bag.Value.Bytes, password)
166 if err != nil {
167 return nil, err
168 }
169
170 switch key := key.(type) {
171 case *rsa.PrivateKey:
172 block.Bytes = x509.MarshalPKCS1PrivateKey(key)
173 case *ecdsa.PrivateKey:
174 block.Bytes, err = x509.MarshalECPrivateKey(key)
175 if err != nil {
176 return nil, err
177 }
178 default:
179 return nil, errors.New("found unknown private key type in PKCS#8 wrapping")
180 }
181 default:
182 return nil, errors.New("don't know how to convert a safe bag of type " + bag.Id.String())
183 }
184 return block, nil
185}
186
187func convertAttribute(attribute *pkcs12Attribute) (key, value string, err error) {
188 isString := false
189
190 switch {
191 case attribute.Id.Equal(oidFriendlyName):
192 key = "friendlyName"
193 isString = true
194 case attribute.Id.Equal(oidLocalKeyID):
195 key = "localKeyId"
196 case attribute.Id.Equal(oidMicrosoftCSPName):
197 // This key is chosen to match OpenSSL.
198 key = "Microsoft CSP Name"
199 isString = true
200 default:
201 return "", "", errUnknownAttributeOID
202 }
203
204 if isString {
205 if err := unmarshal(attribute.Value.Bytes, &attribute.Value); err != nil {
206 return "", "", err
207 }
208 if value, err = decodeBMPString(attribute.Value.Bytes); err != nil {
209 return "", "", err
210 }
211 } else {
212 var id []byte
213 if err := unmarshal(attribute.Value.Bytes, &id); err != nil {
214 return "", "", err
215 }
216 value = hex.EncodeToString(id)
217 }
218
219 return key, value, nil
220}
221
222// Decode extracts a certificate and private key from pfxData. This function
223// assumes that there is only one certificate and only one private key in the
224// pfxData; if there are more use ToPEM instead.
225func Decode(pfxData []byte, password string) (privateKey interface{}, certificate *x509.Certificate, err error) {
226 encodedPassword, err := bmpString(password)
227 if err != nil {
228 return nil, nil, err
229 }
230
231 bags, encodedPassword, err := getSafeContents(pfxData, encodedPassword)
232 if err != nil {
233 return nil, nil, err
234 }
235
236 if len(bags) != 2 {
237 err = errors.New("pkcs12: expected exactly two safe bags in the PFX PDU")
238 return
239 }
240
241 for _, bag := range bags {
242 switch {
243 case bag.Id.Equal(oidCertBag):
244 if certificate != nil {
245 err = errors.New("pkcs12: expected exactly one certificate bag")
246 }
247
248 certsData, err := decodeCertBag(bag.Value.Bytes)
249 if err != nil {
250 return nil, nil, err
251 }
252 certs, err := x509.ParseCertificates(certsData)
253 if err != nil {
254 return nil, nil, err
255 }
256 if len(certs) != 1 {
257 err = errors.New("pkcs12: expected exactly one certificate in the certBag")
258 return nil, nil, err
259 }
260 certificate = certs[0]
261
262 case bag.Id.Equal(oidPKCS8ShroundedKeyBag):
263 if privateKey != nil {
264 err = errors.New("pkcs12: expected exactly one key bag")
265 return nil, nil, err
266 }
267
268 if privateKey, err = decodePkcs8ShroudedKeyBag(bag.Value.Bytes, encodedPassword); err != nil {
269 return nil, nil, err
270 }
271 }
272 }
273
274 if certificate == nil {
275 return nil, nil, errors.New("pkcs12: certificate missing")
276 }
277 if privateKey == nil {
278 return nil, nil, errors.New("pkcs12: private key missing")
279 }
280
281 return
282}
283
284func getSafeContents(p12Data, password []byte) (bags []safeBag, updatedPassword []byte, err error) {
285 pfx := new(pfxPdu)
286 if err := unmarshal(p12Data, pfx); err != nil {
287 return nil, nil, errors.New("pkcs12: error reading P12 data: " + err.Error())
288 }
289
290 if pfx.Version != 3 {
291 return nil, nil, NotImplementedError("can only decode v3 PFX PDU's")
292 }
293
294 if !pfx.AuthSafe.ContentType.Equal(oidDataContentType) {
295 return nil, nil, NotImplementedError("only password-protected PFX is implemented")
296 }
297
298 // unmarshal the explicit bytes in the content for type 'data'
299 if err := unmarshal(pfx.AuthSafe.Content.Bytes, &pfx.AuthSafe.Content); err != nil {
300 return nil, nil, err
301 }
302
303 if len(pfx.MacData.Mac.Algorithm.Algorithm) == 0 {
304 return nil, nil, errors.New("pkcs12: no MAC in data")
305 }
306
307 if err := verifyMac(&pfx.MacData, pfx.AuthSafe.Content.Bytes, password); err != nil {
308 if err == ErrIncorrectPassword && len(password) == 2 && password[0] == 0 && password[1] == 0 {
309 // some implementations use an empty byte array
310 // for the empty string password try one more
311 // time with empty-empty password
312 password = nil
313 err = verifyMac(&pfx.MacData, pfx.AuthSafe.Content.Bytes, password)
314 }
315 if err != nil {
316 return nil, nil, err
317 }
318 }
319
320 var authenticatedSafe []contentInfo
321 if err := unmarshal(pfx.AuthSafe.Content.Bytes, &authenticatedSafe); err != nil {
322 return nil, nil, err
323 }
324
325 if len(authenticatedSafe) != 2 {
326 return nil, nil, NotImplementedError("expected exactly two items in the authenticated safe")
327 }
328
329 for _, ci := range authenticatedSafe {
330 var data []byte
331
332 switch {
333 case ci.ContentType.Equal(oidDataContentType):
334 if err := unmarshal(ci.Content.Bytes, &data); err != nil {
335 return nil, nil, err
336 }
337 case ci.ContentType.Equal(oidEncryptedDataContentType):
338 var encryptedData encryptedData
339 if err := unmarshal(ci.Content.Bytes, &encryptedData); err != nil {
340 return nil, nil, err
341 }
342 if encryptedData.Version != 0 {
343 return nil, nil, NotImplementedError("only version 0 of EncryptedData is supported")
344 }
345 if data, err = pbDecrypt(encryptedData.EncryptedContentInfo, password); err != nil {
346 return nil, nil, err
347 }
348 default:
349 return nil, nil, NotImplementedError("only data and encryptedData content types are supported in authenticated safe")
350 }
351
352 var safeContents []safeBag
353 if err := unmarshal(data, &safeContents); err != nil {
354 return nil, nil, err
355 }
356 bags = append(bags, safeContents...)
357 }
358
359 return bags, password, nil
360}