safebags.go raw

   1  // Copyright 2015 The Go Authors. All rights reserved.
   2  // Use of this source code is governed by a BSD-style
   3  // license that can be found in the LICENSE file.
   4  
   5  package pkcs12
   6  
   7  import (
   8  	"crypto/x509"
   9  	"encoding/asn1"
  10  	"errors"
  11  )
  12  
  13  var (
  14  	// see https://tools.ietf.org/html/rfc7292#appendix-D
  15  	oidCertTypeX509Certificate = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 22, 1})
  16  	oidPKCS8ShroundedKeyBag    = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 2})
  17  	oidCertBag                 = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 3})
  18  )
  19  
  20  type certBag struct {
  21  	Id   asn1.ObjectIdentifier
  22  	Data []byte `asn1:"tag:0,explicit"`
  23  }
  24  
  25  func decodePkcs8ShroudedKeyBag(asn1Data, password []byte) (privateKey interface{}, err error) {
  26  	pkinfo := new(encryptedPrivateKeyInfo)
  27  	if err = unmarshal(asn1Data, pkinfo); err != nil {
  28  		return nil, errors.New("pkcs12: error decoding PKCS#8 shrouded key bag: " + err.Error())
  29  	}
  30  
  31  	pkData, err := pbDecrypt(pkinfo, password)
  32  	if err != nil {
  33  		return nil, errors.New("pkcs12: error decrypting PKCS#8 shrouded key bag: " + err.Error())
  34  	}
  35  
  36  	ret := new(asn1.RawValue)
  37  	if err = unmarshal(pkData, ret); err != nil {
  38  		return nil, errors.New("pkcs12: error unmarshaling decrypted private key: " + err.Error())
  39  	}
  40  
  41  	if privateKey, err = x509.ParsePKCS8PrivateKey(pkData); err != nil {
  42  		return nil, errors.New("pkcs12: error parsing PKCS#8 private key: " + err.Error())
  43  	}
  44  
  45  	return privateKey, nil
  46  }
  47  
  48  func decodeCertBag(asn1Data []byte) (x509Certificates []byte, err error) {
  49  	bag := new(certBag)
  50  	if err := unmarshal(asn1Data, bag); err != nil {
  51  		return nil, errors.New("pkcs12: error decoding cert bag: " + err.Error())
  52  	}
  53  	if !bag.Id.Equal(oidCertTypeX509Certificate) {
  54  		return nil, NotImplementedError("only X509 certificates are supported")
  55  	}
  56  	return bag.Data, nil
  57  }
  58