因密码无法打开PKCS12商店 [英] cannot open PKCS12 store because of password
本文介绍了因密码无法打开PKCS12商店的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！
问题描述
在充气城堡的例子中，我找到了这段代码：
In the bouncy castle examples, I found this code:
package crypto;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.Security;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.DERBMPString;
import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
import org.bouncycastle.asn1.pkcs.Attribute;
import org.bouncycastle.asn1.pkcs.ContentInfo;
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.asn1.x509.SubjectKeyIdentifier;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509ExtensionUtils;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.operator.InputDecryptorProvider;
import org.bouncycastle.operator.OutputEncryptor;
import org.bouncycastle.operator.bc.BcDefaultDigestProvider;
import org.bouncycastle.pkcs.PKCS12PfxPdu;
import org.bouncycastle.pkcs.PKCS12PfxPduBuilder;
import org.bouncycastle.pkcs.PKCS12SafeBag;
import org.bouncycastle.pkcs.PKCS12SafeBagBuilder;
import org.bouncycastle.pkcs.PKCS12SafeBagFactory;
import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;
import org.bouncycastle.pkcs.bc.BcPKCS12MacCalculatorBuilderProvider;
import org.bouncycastle.pkcs.jcajce.JcaPKCS12SafeBagBuilder;
import org.bouncycastle.pkcs.jcajce.JcePKCS12MacCalculatorBuilder;
import org.bouncycastle.pkcs.jcajce.JcePKCSPBEInputDecryptorProviderBuilder;
import org.bouncycastle.pkcs.jcajce.JcePKCSPBEOutputEncryptorBuilder;
import org.bouncycastle.util.io.Streams;
public class PKCS12 {
public static void main(String[] args)
throws Exception
{
Security.addProvider(new BouncyCastleProvider());
KeyStore credentials = JcaUtils.createCredentials();
PrivateKey key = (PrivateKey)credentials.getKey(JcaUtils.END_ENTITY_ALIAS, JcaUtils.KEY_PASSWD);
Certificate[] chain = credentials.getCertificateChain(JcaUtils.END_ENTITY_ALIAS);
createPKCS12File(new FileOutputStream("id.p12"), key, chain);
//
// first do a "blow by blow" read of the PKCS#12 file.
//
PKCS12PfxPdu pfx = readPKCS12File(new FileInputStream("id.p12"));
//
// or alternately just load it up using a KeyStore
//
KeyStore pkcs12Store = KeyStore.getInstance("PKCS12", "BC");
pkcs12Store.load(new FileInputStream("id.p12"), JcaUtils.KEY_PASSWD);
System.out.println("########## KeyStore Dump");
for (Enumeration en = pkcs12Store.aliases(); en.hasMoreElements();)
{
String alias = (String)en.nextElement();
if (pkcs12Store.isCertificateEntry(alias))
{
System.out.println("Certificate Entry: " + alias + ", Subject: " + (((X509Certificate)pkcs12Store.getCertificate(alias)).getSubjectDN()));
}
else if (pkcs12Store.isKeyEntry(alias))
{
System.out.println("Key Entry: " + alias + ", Subject: " + (((X509Certificate)pkcs12Store.getCertificate(alias)).getSubjectDN()));
}
}
System.out.println();
}
private static void createPKCS12File(OutputStream pfxOut, PrivateKey key, Certificate[] chain)
throws Exception
{
OutputEncryptor encOut = new JcePKCSPBEOutputEncryptorBuilder(NISTObjectIdentifiers.id_aes256_CBC).setProvider("BC").build(JcaUtils.KEY_PASSWD);
PKCS12SafeBagBuilder taCertBagBuilder = new JcaPKCS12SafeBagBuilder((X509Certificate)chain[2]);
taCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute, new DERBMPString("Bouncy Primary Certificate"));
PKCS12SafeBagBuilder caCertBagBuilder = new JcaPKCS12SafeBagBuilder((X509Certificate)chain[1]);
caCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute, new DERBMPString("Bouncy Intermediate Certificate"));
JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();
PKCS12SafeBagBuilder eeCertBagBuilder = new JcaPKCS12SafeBagBuilder((X509Certificate)chain[0]);
eeCertBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute, new DERBMPString("Eric's Key"));
SubjectKeyIdentifier pubKeyId = extUtils.createSubjectKeyIdentifier(chain[0].getPublicKey());
eeCertBagBuilder.addBagAttribute(PKCS12SafeBag.localKeyIdAttribute, pubKeyId);
PKCS12SafeBagBuilder keyBagBuilder = new JcaPKCS12SafeBagBuilder(key, encOut);
keyBagBuilder.addBagAttribute(PKCS12SafeBag.friendlyNameAttribute, new DERBMPString("Eric's Key"));
keyBagBuilder.addBagAttribute(PKCS12SafeBag.localKeyIdAttribute, pubKeyId);
PKCS12PfxPduBuilder builder = new PKCS12PfxPduBuilder();
builder.addData(keyBagBuilder.build());
builder.addEncryptedData(new JcePKCSPBEOutputEncryptorBuilder(PKCSObjectIdentifiers.pbeWithSHAAnd128BitRC2_CBC).setProvider("BC").build(JcaUtils.KEY_PASSWD), new PKCS12SafeBag[]{eeCertBagBuilder.build(), caCertBagBuilder.build(), taCertBagBuilder.build()});
PKCS12PfxPdu pfx = builder.build(new JcePKCS12MacCalculatorBuilder(NISTObjectIdentifiers.id_sha256), JcaUtils.KEY_PASSWD);
// make sure we don't include indefinite length encoding
pfxOut.write(pfx.getEncoded(ASN1Encoding.DL));
pfxOut.close();
}
private static PKCS12PfxPdu readPKCS12File(InputStream pfxIn)
throws Exception
{
PKCS12PfxPdu pfx = new PKCS12PfxPdu(Streams.readAll(pfxIn));
if (!pfx.isMacValid(new BcPKCS12MacCalculatorBuilderProvider(BcDefaultDigestProvider.INSTANCE), JcaUtils.KEY_PASSWD))
{
System.err.println("PKCS#12 MAC test failed!");
}
ContentInfo[] infos = pfx.getContentInfos();
Map certMap = new HashMap();
Map certKeyIds = new HashMap();
Map privKeyMap = new HashMap();
Map privKeyIds = new HashMap();
InputDecryptorProvider inputDecryptorProvider = new JcePKCSPBEInputDecryptorProviderBuilder()
.setProvider("BC").build(JcaUtils.KEY_PASSWD);
JcaX509CertificateConverter jcaConverter = new JcaX509CertificateConverter().setProvider("BC");
for (int i = 0; i != infos.length; i++)
{
if (infos[i].getContentType().equals(PKCSObjectIdentifiers.encryptedData))
{
PKCS12SafeBagFactory dataFact = new PKCS12SafeBagFactory(infos[i], inputDecryptorProvider);
PKCS12SafeBag[] bags = dataFact.getSafeBags();
for (int b = 0; b != bags.length; b++)
{
PKCS12SafeBag bag = bags[b];
X509CertificateHolder certHldr = (X509CertificateHolder)bag.getBagValue();
X509Certificate cert = jcaConverter.getCertificate(certHldr);
Attribute[] attributes = bag.getAttributes();
for (int a = 0; a != attributes.length; a++)
{
Attribute attr = attributes[a];
if (attr.getAttrType().equals(PKCS12SafeBag.friendlyNameAttribute))
{
certMap.put(((DERBMPString)attr.getAttributeValues()[0]).getString(), cert);
}
else if (attr.getAttrType().equals(PKCS12SafeBag.localKeyIdAttribute))
{
certKeyIds.put(attr.getAttributeValues()[0], cert);
}
}
}
}
else
{
PKCS12SafeBagFactory dataFact = new PKCS12SafeBagFactory(infos[i]);
PKCS12SafeBag[] bags = dataFact.getSafeBags();
PKCS8EncryptedPrivateKeyInfo encInfo = (PKCS8EncryptedPrivateKeyInfo)bags[0].getBagValue();
PrivateKeyInfo info = encInfo.decryptPrivateKeyInfo(inputDecryptorProvider);
KeyFactory keyFact = KeyFactory .getInstance(info.getPrivateKeyAlgorithm().getAlgorithm().getId(), "BC");
PrivateKey privKey = keyFact.generatePrivate(new PKCS8EncodedKeySpec(info.getEncoded()));
Attribute[] attributes = bags[0].getAttributes();
for (int a = 0; a != attributes.length; a++)
{
Attribute attr = attributes[a];
if (attr.getAttrType().equals(PKCS12SafeBag.friendlyNameAttribute))
{
privKeyMap.put(((DERBMPString)attr.getAttributeValues()[0]).getString(), privKey);
}
else if (attr.getAttrType().equals(PKCS12SafeBag.localKeyIdAttribute))
{
privKeyIds.put(privKey, attr.getAttributeValues()[0]);
}
}
}
}
System.out.println("########## PFX Dump");
for (Iterator it = privKeyMap.keySet().iterator(); it.hasNext();)
{
String alias = (String)it.next();
System.out.println("Key Entry: " + alias + ", Subject: " + (((X509Certificate)certKeyIds.get(privKeyIds.get(privKeyMap.get(alias)))).getSubjectDN()));
}
for (Iterator it = certMap.keySet().iterator(); it.hasNext();)
{
String alias = (String)it.next();
System.out.println("Certificate Entry: " + alias + ", Subject: " + (((X509Certificate)certMap.get(alias)).getSubjectDN()));
}
System.out.println();
return pfx;
}
}
当我使用此代码编写p12时，我尝试使用openssl或keychain打开它，我被提示输入密码。我使用他们的密码
When I use this code to write a p12, I try to open it using openssl or keychain and I'm prompted to put in a password. I use their password
public static char[] KEY_PASSWD = "keyPassword".toCharArray();
试图打开P12，但它不起作用。此外，当我按原样运行此主函数时，此行将被执行
to try to open the P12, but it does not work. Also, when I just run this main function as is, this line gets executed
System.err.println("PKCS#12 MAC test failed!");
为了在p12上正确输入密码，他们的示例是否有问题？我基本上试图做相当于
Is there something wrong with their example in order to correctly put a password on the p12? I'm basically trying to do the equivalent of
openssl pkcs12 -export -des3
。谢谢。
编辑：
查看NISTObjectIdentifiers可供选择，我看不到p12pbmac / sha1。这就是我所看到的：
Looking at the NISTObjectIdentifiers to choose from, I don't see p12pbmac/sha1. THis is what I see:
public interface NISTObjectIdentifiers {
ASN1ObjectIdentifier nistAlgorithm = new ASN1ObjectIdentifier("2.16.840.1.101.3.4");
ASN1ObjectIdentifier hashAlgs = nistAlgorithm.branch("2");
ASN1ObjectIdentifier id_sha256 = hashAlgs.branch("1");
ASN1ObjectIdentifier id_sha384 = hashAlgs.branch("2");
ASN1ObjectIdentifier id_sha512 = hashAlgs.branch("3");
ASN1ObjectIdentifier id_sha224 = hashAlgs.branch("4");
ASN1ObjectIdentifier id_sha512_224 = hashAlgs.branch("5");
ASN1ObjectIdentifier id_sha512_256 = hashAlgs.branch("6");
ASN1ObjectIdentifier id_sha3_224 = hashAlgs.branch("7");
ASN1ObjectIdentifier id_sha3_256 = hashAlgs.branch("8");
ASN1ObjectIdentifier id_sha3_384 = hashAlgs.branch("9");
ASN1ObjectIdentifier id_sha3_512 = hashAlgs.branch("10");
ASN1ObjectIdentifier id_shake128 = hashAlgs.branch("11");
ASN1ObjectIdentifier id_shake256 = hashAlgs.branch("12");
ASN1ObjectIdentifier id_hmacWithSHA3_224 = hashAlgs.branch("13");
ASN1ObjectIdentifier id_hmacWithSHA3_256 = hashAlgs.branch("14");
ASN1ObjectIdentifier id_hmacWithSHA3_384 = hashAlgs.branch("15");
ASN1ObjectIdentifier id_hmacWithSHA3_512 = hashAlgs.branch("16");
ASN1ObjectIdentifier aes = nistAlgorithm.branch("1");
ASN1ObjectIdentifier id_aes128_ECB = aes.branch("1");
ASN1ObjectIdentifier id_aes128_CBC = aes.branch("2");
ASN1ObjectIdentifier id_aes128_OFB = aes.branch("3");
ASN1ObjectIdentifier id_aes128_CFB = aes.branch("4");
ASN1ObjectIdentifier id_aes128_wrap = aes.branch("5");
ASN1ObjectIdentifier id_aes128_GCM = aes.branch("6");
ASN1ObjectIdentifier id_aes128_CCM = aes.branch("7");
ASN1ObjectIdentifier id_aes128_wrap_pad = aes.branch("8");
ASN1ObjectIdentifier id_aes192_ECB = aes.branch("21");
ASN1ObjectIdentifier id_aes192_CBC = aes.branch("22");
ASN1ObjectIdentifier id_aes192_OFB = aes.branch("23");
ASN1ObjectIdentifier id_aes192_CFB = aes.branch("24");
ASN1ObjectIdentifier id_aes192_wrap = aes.branch("25");
ASN1ObjectIdentifier id_aes192_GCM = aes.branch("26");
ASN1ObjectIdentifier id_aes192_CCM = aes.branch("27");
ASN1ObjectIdentifier id_aes192_wrap_pad = aes.branch("28");
ASN1ObjectIdentifier id_aes256_ECB = aes.branch("41");
ASN1ObjectIdentifier id_aes256_CBC = aes.branch("42");
ASN1ObjectIdentifier id_aes256_OFB = aes.branch("43");
ASN1ObjectIdentifier id_aes256_CFB = aes.branch("44");
ASN1ObjectIdentifier id_aes256_wrap = aes.branch("45");
ASN1ObjectIdentifier id_aes256_GCM = aes.branch("46");
ASN1ObjectIdentifier id_aes256_CCM = aes.branch("47");
ASN1ObjectIdentifier id_aes256_wrap_pad = aes.branch("48");
ASN1ObjectIdentifier sigAlgs = nistAlgorithm.branch("3");
ASN1ObjectIdentifier id_dsa_with_sha2 = sigAlgs;
ASN1ObjectIdentifier dsa_with_sha224 = sigAlgs.branch("1");
ASN1ObjectIdentifier dsa_with_sha256 = sigAlgs.branch("2");
ASN1ObjectIdentifier dsa_with_sha384 = sigAlgs.branch("3");
ASN1ObjectIdentifier dsa_with_sha512 = sigAlgs.branch("4");
ASN1ObjectIdentifier id_dsa_with_sha3_224 = sigAlgs.branch("5");
ASN1ObjectIdentifier id_dsa_with_sha3_256 = sigAlgs.branch("6");
ASN1ObjectIdentifier id_dsa_with_sha3_384 = sigAlgs.branch("7");
ASN1ObjectIdentifier id_dsa_with_sha3_512 = sigAlgs.branch("8");
ASN1ObjectIdentifier id_ecdsa_with_sha3_224 = sigAlgs.branch("9");
ASN1ObjectIdentifier id_ecdsa_with_sha3_256 = sigAlgs.branch("10");
ASN1ObjectIdentifier id_ecdsa_with_sha3_384 = sigAlgs.branch("11");
ASN1ObjectIdentifier id_ecdsa_with_sha3_512 = sigAlgs.branch("12");
ASN1ObjectIdentifier id_rsassa_pkcs1_v1_5_with_sha3_224 = sigAlgs.branch("13");
ASN1ObjectIdentifier id_rsassa_pkcs1_v1_5_with_sha3_256 = sigAlgs.branch("14");
ASN1ObjectIdentifier id_rsassa_pkcs1_v1_5_with_sha3_384 = sigAlgs.branch("15");
ASN1ObjectIdentifier id_rsassa_pkcs1_v1_5_with_sha3_512 = sigAlgs.branch("16");
}
推荐答案
Meta：这是一个变通方法不是Q提出的答案，但需要格式化。
Meta: this is a workaround not an answer for the Q as posed, but needs formatting.
要创建PKCS12简单方法，只需使用 KeyStore ，如其javadoc中所述，它应该在您的IDE中可用或在Oracle的网站上。这是一个结合了javadoc中各个部分的最小例子。由于你的Q没有显示你从获得 createCredentials data 的位置，对于这个例子，我只是从现有的JKS中读取;根据需要改变这一点。并使用更好的密码！
To create a PKCS12 the easy way, just use KeyStore as explained in its javadoc, which should be available in your IDE or on Oracle's website. Here is a minimal example combining the pieces from the javadoc. Since your Q doesn't show where you're getting the createCredentials data from, for this example I just read from an existing JKS; alter this as needed. And use a better password!
我演示了使用默认提供程序（SunJSSE）和BC提供程序。我在最终测试中发现了一个警告：BC需要在Oracle java上安装无限强度策略 - 至少高达j8;据报道，这个功能最终已在j9中删除，但我还没有测试过。也许它将TDES密钥大小168视为超过128，即使TDES 强度仅为112且应该被允许。
I demonstrate both using the default provider (SunJSSE) and the BC provider. One caveat I found in final testing: BC needs the 'unlimited strength policy' installed on Oracle java -- at least up to j8; this 'feature' reportedly has finally been removed in j9 but I haven't tested yet. Perhaps it treats TDES key size of 168 as exceeding 128, even though TDES strength is only 112 and should be permitted.
char[] pw = "password".toCharArray(); // dummy for test
boolean useBC = System.getProperty("useBC")!=null;
KeyStore jks = KeyStore.getInstance("JKS");
InputStream f1 = new FileInputStream ("old.jks"); jks.load(f1, pw); f1.close();
PrivateKey pkey = (PrivateKey)jks.getKey("mykey", pw);
Certificate[] chain = jks.getCertificateChain("mykey");
// only needed once, and not at all if pre-configured in java.security
if(useBC) Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
// then do something like this
KeyStore p12 = useBC? KeyStore.getInstance("PKCS12","BC"): KeyStore.getInstance("PKCS12");
p12.load(null); p12.setKeyEntry("mykey", pkey, pw, chain);
OutputStream f2 = new FileOutputStream ("new.p12"); p12.store(f2,pw); f2.close();
这篇关于因密码无法打开PKCS12商店的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
查看全文
