org.bouncycastle.pkcs.util

Class PKCS12Util

java.lang.Object

org.bouncycastle.pkcs.util.PKCS12Util

public class PKCS12Util
extends java.lang.Object

Utility class for re-encoding PKCS#12 files to definite length.

Replaces org.bouncycastle.jce.PKCS12Util; this class additionally understands RFC 9579 PBMAC1 protected PFX files.

Constructor Summary

Constructors

Constructor and Description
PKCS12Util()

Method Summary

Modifier and Type	Method and Description
static byte[]	convertToDefiniteLength(byte[] berPKCS12File) Just re-encode the outer layer of the PKCS#12 file to definite length encoding.
static byte[]	convertToDefiniteLength(byte[] berPKCS12File, char[] passwd) Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
static byte[]	convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, java.security.Provider provider) Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
static byte[]	convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, java.lang.String provider) Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
static org.bouncycastle.asn1.ASN1Encodable	getContent(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo) Return the content of a ContentInfo, raising ASN1ParsingException if absent.
static byte[]	getContentOctets(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo) Return the octets carried by a ContentInfo, raising ASN1ParsingException if the content is absent or not an OCTET STRING.
static org.bouncycastle.asn1.ASN1OctetString	getEncryptedContent(org.bouncycastle.asn1.pkcs.EncryptedData encryptedData) Return the ciphertext octets of an EncryptedData, raising ASN1ParsingException if absent.
static int	validateIterationCount(java.math.BigInteger ic) Validate an iteration count from a PFX, enforcing the cap configured via the Properties.PKCS12_MAX_IT_COUNT security property (default 5,000,000).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PKCS12Util

public PKCS12Util()

Method Detail

convertToDefiniteLength

public static byte[] convertToDefiniteLength(byte[] berPKCS12File)
                                      throws java.io.IOException

Just re-encode the outer layer of the PKCS#12 file to definite length encoding.

Parameters:

berPKCS12File - - original PKCS#12 file

Returns:

a byte array representing the DER encoding of the PFX structure

Throws:

java.io.IOException

convertToDefiniteLength

public static byte[] convertToDefiniteLength(byte[] berPKCS12File,
                                             char[] passwd)
                                      throws java.io.IOException

Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.

Parameters:

berPKCS12File - - original PKCS12 file.

Returns:

a byte array representing the DER encoding of the PFX structure.

Throws:

java.io.IOException - on parsing, encoding errors.

convertToDefiniteLength

public static byte[] convertToDefiniteLength(byte[] berPKCS12File,
                                             char[] passwd,
                                             java.lang.String provider)
                                      throws java.io.IOException

Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.

Parameters:

berPKCS12File - - original PKCS12 file.

provider - - provider name to use for MAC calculation.

Returns:

a byte array representing the DER encoding of the PFX structure.

Throws:

java.io.IOException - on parsing, encoding errors.

convertToDefiniteLength

public static byte[] convertToDefiniteLength(byte[] berPKCS12File,
                                             char[] passwd,
                                             java.security.Provider provider)
                                      throws java.io.IOException

Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.

Parameters:

berPKCS12File - - original PKCS12 file.

provider - - provider to use for MAC calculation.

Returns:

a byte array representing the DER encoding of the PFX structure.

Throws:

java.io.IOException - on parsing, encoding errors.

getContent

public static org.bouncycastle.asn1.ASN1Encodable getContent(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo)
                                                      throws java.io.IOException

Return the content of a ContentInfo, raising ASN1ParsingException if absent.

Parameters:

contentInfo - the ContentInfo to inspect.

Returns:

the carried content.

Throws:

java.io.IOException - on ASN.1 parsing errors.

getContentOctets

public static byte[] getContentOctets(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo)
                               throws java.io.IOException

Return the octets carried by a ContentInfo, raising ASN1ParsingException if the content is absent or not an OCTET STRING.

Parameters:

contentInfo - the ContentInfo to inspect.

Returns:

the content octets.

Throws:

java.io.IOException - on ASN.1 parsing errors.

getEncryptedContent

public static org.bouncycastle.asn1.ASN1OctetString getEncryptedContent(org.bouncycastle.asn1.pkcs.EncryptedData encryptedData)
                                                                 throws java.io.IOException

Return the ciphertext octets of an EncryptedData, raising ASN1ParsingException if absent.

Parameters:

encryptedData - the EncryptedData to inspect.

Returns:

the encrypted-content octet string.

Throws:

java.io.IOException - on ASN.1 parsing errors.

validateIterationCount

public static int validateIterationCount(java.math.BigInteger ic)

Validate an iteration count from a PFX, enforcing the cap configured via the Properties.PKCS12_MAX_IT_COUNT security property (default 5,000,000). Negative values and values that do not fit in a signed 32-bit integer are also rejected.

Parameters:

ic - the iteration count from the wire.

Returns:

the validated iteration count as an int.

Throws:

java.lang.IllegalStateException - if the iteration count is negative, larger than the configured maximum, or does not fit in a signed 32-bit integer.