Class PKCS12StoreParameter.PBMAC1WithPBKDF2Builder

java.lang.Object
org.bouncycastle.jcajce.PKCS12StoreParameter.PBMAC1WithPBKDF2Builder
Enclosing class:
PKCS12StoreParameter
public static class PKCS12StoreParameter.PBMAC1WithPBKDF2Builder extends Object
Builder for the PBMAC1 integrity-MAC algorithm identifier of a PKCS#12 file, with PBKDF2 as the key-derivation function, as specified by RFC 9579. Pass the result to PKCS12StoreParameter.Builder.setMacAlgorithm(AlgorithmIdentifier).

The defaults are 16384 iterations, a 64-octet derived key, HMAC-SHA-256 as the PBKDF2 PRF and HMAC-SHA-512 as the message-authentication scheme. A salt has no default and must be supplied.

  • Method Details

    • setIterationCount

      public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setIterationCount(int iterationCount)
      Set the PBKDF2 iteration count. The default is 16384.
      Parameters:
      iterationCount - the iteration count to derive the MAC key with.
      Returns:
      this builder.

    • setSalt

      public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setSalt(byte[] salt)
      Set the PBKDF2 salt. There is no default - build() fails without one.
      Parameters:
      salt - the salt to derive the MAC key with; the array is copied.
      Returns:
      this builder.

    • setKeySize

      public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setKeySize(int keySizeInOctets)
      Set the length of the MAC key PBKDF2 derives, in octets - this is the PBKDF2-params keyLength field, which RFC 8018 app. A.2 defines in octets rather than bits.

      RFC 9579 sec. 5 has it match the output size of the message-authentication scheme set by setMac(ASN1ObjectIdentifier): 64 for the default HMAC-SHA-512, 32 for HMAC-SHA-256. Sec. 9 of the same document asks that a length below 20 octets be rejected, and BC does so when the MAC is derived. The default is 64.

      Parameters:
      keySizeInOctets - the length in octets of the key to derive.
      Returns:
      this builder.

    • setPrf

      public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setPrf(ASN1ObjectIdentifier prf)
      Set the PBKDF2 pseudo-random function. The default is HMAC-SHA-256, which RFC 9579 sec. 5 requires every implementation to support.
      Parameters:
      prf - OID of the PRF to derive the MAC key with.
      Returns:
      this builder.

    • setMac

      public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setMac(ASN1ObjectIdentifier mac)
      Set the message-authentication scheme the derived key is used with. The default is HMAC-SHA-512. Changing it means changing setKeySize(int) to match its output size.
      Parameters:
      mac - OID of the HMAC to authenticate the file with.
      Returns:
      this builder.

    • build

      public AlgorithmIdentifier build()
      Build the PBMAC1 algorithm identifier.
      Returns:
      an AlgorithmIdentifier for id-PBMAC1 carrying the configured PBMAC1-params.
      Throws:
      IllegalStateException - if no salt has been set.