import PKCS#12 with SHA256 + ECDSA fail !! #237
Comments
|
Thanks for the rapid answer. |
- If a private key is in a format unrecognized by forge, an object representing it in ASN.1 format will be returned. This allows private keys to be extracted from PKCS#12 containers (and potentially converted to DER/PEM) even if forge doesn't recognize them.
|
I added a quick feature that I think will help you, but I'm short on time and haven't written some good tests for it. Essentially, if forge doesn't recognize the key format, it will return Do you mind trying it out? If you use the latest version, you should be able to decrypt your p12 without error. Then you should be able to do something like this (off the top of my head): // get key bags
var bags = p12.getBags({bagType: forge.pki.oids.keyBag});
var keyAsn1 = bags[0].asn1;
// convert to ASN.1, then DER, then PEM-encode
var msg = {
type: 'FIXME', // put the right header in here
body: forge.asn1.toDer(keyAsn1).getBytes()
};
var pem = forge.pem.encode(msg);To get the key in PEM format (if that's something you want). |
|
In fact, I haven't reached that level. I don't have the p12 yet . var p12Der = forge.util.decode64(b64); // OK so I can't use your code here ? Tag: Universal:16 (Sequence) |
|
Do you have the password for that p12 so I can test with it? If it's not just test data, can you generate a similar p12 and supply the password? I can better address the issue in that case. |
|
ok, below a new one for test , the password is : 123321 ASN1Tag: Universal:16 (Sequence) |
|
@nizooo, my apologies, I wasn't clear. Can you send the base64-encoded version? I can't process the above pretty printed version. |
|
no problem , I'm using "reader.readAsArrayBuffer(file)" and below you find data before encoding and after encoding : before : MIIEwQIBAzCCBIcGCSqGSIb3DQEHAaCCBHgEggR0MIIEcDCCAy8GCSqGSIb3DQEHBqCCAyAwggMcAgEAMIIDFQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIxn3OksiScggCAggAgIIC6OB2GSW2p7zaoD4FS5+8kVRF8yTPFpNfV49YCQk49DzPEJoa2tKUE8dMh48jKEh3NRm4kemaN+CKZczTPB5xk21P/+PtLWzfFYFS8/wt/UJ+5NEbRHlVkI2GDj4HYwP+7E0ad0qi54UsuyxIeph7046Jag3keqfoKYinAoiEe3mvbWlICKTWj0PpuDQ2gxb7axwOnqsGfNC3J4HivnbcDPNL+/JReC5SgK/xEQpyBc4Fz49YA9qIGC6gQxNiIC9mQvq7M8hKDumYgkFWH25HXWzj6/pBT+4C8kQxkuLi+KWh9KWj8UXc2YaeqMR6MeJUJ7YMNELVGxU+a3ZY8NFkJf4jLAPy76u4JMEbX6meHtfmOAzqaGG6pnfuqZUWRHrTxYGWIWuTkSFfqCsB08McB6HYqEYm7juHqO7lqnIvRwh++TV7F/DJupOcS8sm4Q0+pI/Ug9lex27d/TVfFL2ICRfCVOvOtv65K+6fqNkPDrctQVl/kqS8tkWZoH+yfS/qDzICk9/fnAnO7bl4yiFGYp6ISbjAnki2NnRVdyGPQIO4B51VqqMeVzN3689ppJQZCajgw7afyq1rDt1dCqiD0OdnKXkARZEp2UeIqmMCMhVPRCeY1N+Z8yF8yWUv77SkGlwtMtyvhGYlrM3Wq/rweW6P20DfeSoLu9pU/ZxXe0X9a4ko/lXjKp/+ksJRZJcxWcRDxFRLtrHIWqrzIEdWilN/ld59HP6JU2+fhBkg+waWXd+lxEmIaVw6YY7WVmQT4riC17GGKjzyrNKQp0q4BDRZKJiJm1LSDBkGYUhWTkiHaZnihuwkidnXGaM6RshPu8c7nA29EoyoZjs4Vtj9dxQzwu6RvA+UvO3v+PMxxa0O/UKjU1XPLdhaxnc5KIUQGechjsgCooHQFOQ8hxEZPUQaBnebTRjq0W7Q+DhKv1EyGFWWRNG2cJRx1EDUO+A02nBvLck5DKOdIcJlsKiHWB0/ntCRqtQ7XzCCATkGCSqGSIb3DQEHAaCCASoEggEmMIIBIjCCAR4GCyqGSIb3DQEMCgECoIG0MIGxMBwGCiqGSIb3DQEMAQMwDgQI3Q+0WbOjf/0CAggABIGQhW8EaZfJhr+MTd4xjkUcubSPjzspoLeLtGLxmKxTBnbwBrKJBJ3bzXvU7we7qvvJGhWQfsRSHXEE841WS8I14veJJLWBJfN5V0AYz2aYkoApDQ61/o7mvgaAIn5rQQh20jp0EFXZM1TRqAT17pjBcBTaZ/s0wpUi2dbYqzhIgEYsQFQfHbW576eht5NlND3tMVgwIwYJKoZIhvcNAQkVMRYEFJ6dpRl6qwj5OZg36y8v5EVowEENMDEGCSqGSIb3DQEJFDEkHiIARQBDAEQAUwBBACAAYwBlAHIAdABpAGYAaQBjAGEAdABlMDEwITAJBgUrDgMCGgUABBSMcup2jX5JqMU5lqH8d/A0/kOu+wQI5FJlbGEnxF4CAggA after encode : 0��Á���0���� *�H�÷
|
- If certificates are not recognized or if they contain key formats that are unrecognized, a pkcs#12 container can still be decrypted. The resulting certificate bag will have its `cert` property set to `null` and an `asn1` property will contain its ASN.1 representation.
|
The sample PKCS#12 you provided now parses properly (forge version 0.6.25), despite the key format not being recognized. There is also a test that successfully extracts the certificate in PEM format. To do this, run the following code: // assumes b64 var holds the above base64-encoded p12
var p12Der = forge.util.decode64(b64);
var p12Asn1 = forge.asn1.fromDer(p12Der);
var p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, '123321');
var bags = p12.getBags({bagType: PKI.oids.certBag});
var bag = bags[PKI.oids.certBag][0];
// convert to ASN.1, then DER, then PEM-encode
var msg = {
type: 'CERTIFICATE',
body: forge.asn1.toDer(bag.asn1).getBytes()
};
var pem = forge.pem.encode(msg);
console.log(pem);This yields: |
|
Thanks a lot , it's very helpful. I'll continue to decrypt the key value and I'll keep you in touch . |
|
Closing as potentially resolved, can be reopened if necessary. |
I'm trying to import a PKCS12 to sign with ECDSA + SHA256 , I got an error after trying to convert the Asn1 object to p12 object.
the error is : Result file generation failed!
Actual error message: Error: Cannot read public key. OID is not RSA.
below the code used :
pwd=prompt("Insert the password for the PKCS12 keystore","");
if (pwd!=null && pwd!="") {
try {
var test = new Uint8Array(event.target.result);
var b64 = forge.util.binary.base64.encode(test);
...
The text was updated successfully, but these errors were encountered: