Skip to content

Rename PBES1 types to better match their origins in the spec#12976

Merged
reaperhulk merged 1 commit intopyca:mainfrom
alex:pbes-rename
May 24, 2025
Merged

Rename PBES1 types to better match their origins in the spec#12976
reaperhulk merged 1 commit intopyca:mainfrom
alex:pbes-rename

Conversation

@alex
Copy link
Member

@alex alex commented May 24, 2025

PBEParams is defined in RFC 8018 as going with PBES1, but then its also used by PKCS#12 ciphers in RFC 7292.

@alex alex requested a review from Copilot May 24, 2025 19:12
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Renames PBES1-related identifiers to align with their definitions in RFC 8018 and PKCS#12

  • Update EncryptionAlgorithm variants and parameter mappings in pkcs12.rs
  • Rename OID constants in oid.rs and corresponding enum variants in common.rs
  • Refactor PBES1Params to PBEParams and update decryption logic in pkcs8.rs

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
src/rust/src/pkcs12.rs Rename enum variants from PBESv1... to PBESHA1... and update AlgorithmParameters mapping
src/rust/cryptography-x509/src/oid.rs Rename OID constants from PBES1_... to PBE_...
src/rust/cryptography-x509/src/common.rs Rename PBES1Params to PBEParams and update enum variant names
src/rust/cryptography-key-parsing/src/pkcs8.rs Rename pbes1_decrypt to pbe_decrypt and update imports
Comments suppressed due to low confidence (2)

src/rust/src/pkcs12.rs:343

  • The Python type constant PBES_PBESV1SHA1AND3KEYTRIPLEDESCBC is not updated to match the renamed Rust variant PBESHA1And3KeyTripleDESCBC. Update the Python constant reference to PBES_PBESHA1AND3KEYTRIPLEDESCBC or the matching key in types.
if key_cert_alg.is(&types::PBES_PBESV1SHA1AND3KEYTRIPLEDESCBC.get(py)?) {

src/rust/cryptography-x509/src/common.rs:532

  • [nitpick] The comment references PBES1Params, but the struct has been renamed to PBEParams. Update this comment to clarify that PBEParams implements the PBES1 parameters defined in RFC 8018 Appendix A.3.
// From RFC 8018 Appendix A.3

PBEParams is defined in RFC 8018 as going with PBES1, but then its also used by PKCS#12 ciphers in RFC 7292.
@alex alex requested a review from Copilot May 24, 2025 19:18
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR aligns PBES1-related types and identifiers with their RFC origins by removing the “v1” suffix and introducing a more flexible parameter struct.

  • Renamed the PBESv1SHA1And3KeyTripleDESCBC enum variant to PBESHA1And3KeyTripleDESCBC
  • Updated OID constants from PBES1_WITH_* to PBE_WITH_* in oid.rs
  • Replaced PBES1Params with a new Pkcs12PbeParams<'a> (slice-based salt) and updated decryption helper names

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
src/rust/src/pkcs12.rs Renamed internal enum variant and updated its uses
src/rust/cryptography-x509/src/oid.rs Renamed PBES1 OID constants to PBE constants
src/rust/cryptography-x509/src/common.rs Replaced PBES1Params with Pkcs12PbeParams<'a> and variants
src/rust/cryptography-key-parsing/src/pkcs8.rs Updated imports, renamed decrypt helper, and adjusted params
Comments suppressed due to low confidence (3)

src/rust/src/pkcs12.rs:115

  • [nitpick] The enum variant PBESHA1And3KeyTripleDESCBC is inconsistent with the AlgorithmParameters naming (PbeWithShaAnd3KeyTripleDesCbc). Consider renaming it to PbeWithShaAnd3KeyTripleDesCbc (or PBEWithShaAnd3KeyTripleDES_CBC) to keep naming aligned.
    PBESHA1And3KeyTripleDESCBC,

src/rust/cryptography-key-parsing/src/pkcs8.rs:125

  • There are no unit tests for pkcs12_pbe_decrypt or for handling variable-length salts. Consider adding tests covering both PBE variants and salt length edge cases to ensure correct behavior.
fn pkcs12_pbe_decrypt(

src/rust/cryptography-x509/src/common.rs:534

  • The new Pkcs12PbeParams accepts a salt slice of arbitrary length, but PBES1-based schemes require exactly 8 bytes of salt per spec. Please validate or truncate the slice to 8 bytes to enforce spec compliance.
pub struct Pkcs12PbeParams<'a> {

@reaperhulk reaperhulk merged commit df48ce0 into pyca:main May 24, 2025
65 checks passed
@alex alex deleted the pbes-rename branch May 25, 2025 02:21
alex added a commit to alex/cryptography that referenced this pull request May 25, 2025
)

PBEParams is defined in RFC 8018 as going with PBES1, but then its also used by PKCS#12 ciphers in RFC 7292.
reaperhulk added a commit that referenced this pull request May 25, 2025
* Rename PBES1 types to better match their origins in the spec (#12976)

PBEParams is defined in RFC 8018 as going with PBES1, but then its also used by PKCS#12 ciphers in RFC 7292.

* add vector and test for longer salt length in PBE (#12977)

* add vector and test for longer salt length in PBE

* Update docs/development/test-vectors.rst

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

---------

Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>

* fixes #12949 -- added support for decrypting des-cbc-md5 keys (#12978)

* add missing 45.0.0 changelog entry (#12946)

* add missing 45.0.0 changelog entry

@Yossarian pointed out that we missed this breaking change #12110

* Update CHANGELOG.rst

* oops

* changelog + version bump

* add pbeWithMD5AndDES-CBC test vector (#12956)

* typo

* fix documentation for the decrepit algorithms module (#12953)

---------

Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants