I came across this piece of code in the openssl backend:
|
# PKCS12 encryption is hopeless trash and can never be fixed. |
|
# This is the least terrible option. |
|
nid_cert = self._lib.NID_pbe_WithSHA1And3_Key_TripleDES_CBC |
|
nid_key = self._lib.NID_pbe_WithSHA1And3_Key_TripleDES_CBC |
|
# At least we can set this higher than OpenSSL's default |
|
pkcs12_iter = 20000 |
|
# mac_iter chosen for compatibility reasons, see: |
|
# https://www.openssl.org/docs/man1.1.1/man3/PKCS12_create.html |
|
# Did we mention how lousy PKCS12 encryption is? |
It's part of what gets called when creating a PKXS#12 file and It uses 3DES for the encryption.
Is there any way to switch this to something like AES256?
When exporting to a PFX in windows 10, you can do this as mentioned here
Also, you can make such PFX file though openSSL as mentioned here (and here for v1.1.1):
C:\>openssl pkcs12 -export -in cert.pem-inkey private.key -out some.pfx -certpbe AES-256-CBC -keypbe AES-256-CBC
Enter pass phrase for key_private_pem.key:
Enter Export Password:
Verifying - Enter Export Password:
C:\>openssl pkcs12 -noout -info -in some.pfx
Enter Import Password:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
I came across this piece of code in the openssl backend:
cryptography/src/cryptography/hazmat/backends/openssl/backend.py
Lines 2194 to 2202 in 4a4f4d9
It's part of what gets called when creating a PKXS#12 file and It uses 3DES for the encryption.
Is there any way to switch this to something like AES256?
When exporting to a PFX in windows 10, you can do this as mentioned here
Also, you can make such PFX file though openSSL as mentioned here (and here for v1.1.1):