From 924e1f38e257ac868a1d8a8adc2b6fa7ed45a339 Mon Sep 17 00:00:00 2001 From: Arthur de Jong Date: Thu, 8 Feb 2018 23:21:33 +0100 Subject: Correctly write a PSKC file without a MAC key In some cases a PSKC file can be written with a MAC algorithm but without a MAC key. This is possible when the MAC key is not supplied (allowed in older PSKC versions) and a fallback to the encryption key is done. If we have not yet decrypted the file the MAC key is not yet available and so can't be included in the written file. --- pskc/serialiser.py | 2 ++ tests/test_write.doctest | 92 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 94 insertions(+) diff --git a/pskc/serialiser.py b/pskc/serialiser.py index ca6622c..26bf1c2 100644 --- a/pskc/serialiser.py +++ b/pskc/serialiser.py @@ -95,6 +95,8 @@ class PSKCSerialiser(object): return mac_method = mk_elem( container, 'pskc:MACMethod', Algorithm=mac.algorithm, empty=True) + if not key_value: + return # encrypt the mac key if needed if not hasattr(key_value, 'get_value'): key_value = EncryptedValue.create(mac.pskc, key_value) diff --git a/tests/test_write.doctest b/tests/test_write.doctest index 34ddb36..4d980d6 100644 --- a/tests/test_write.doctest +++ b/tests/test_write.doctest @@ -257,6 +257,98 @@ providing the encryption key. +Read a legacy encrypted PSKC file and write it out as-is. This should convert +the format to RFC 6030 format as best it can. Note that this does not include +a MAC key (but does include a MAC algorithm because the MAC key is not +specified and we assume to use the encryption key as MAC key). + +>>> pskc = PSKC('tests/draft-hoyer-keyprov-portable-symmetric-key-container-01/password-encrypted.pskcxml') +>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF + + + + + + + + y6TzckeLRQw= + + 999 + 16 + + + + + + + + Token Manufacturer + 98765432187 + 2008-01-01T00:00:00 + + + Credential Issuer + + + + MySecondToken + + + + + + F/CY93NYc/SvmxT3oB6PzG7p6zpG92/t + + + hN793ZE7GM6yCM6gz9OKNRzibhg= + + + + + + VVBYqRF1QSpetvIB2vBAzw== + + + 6clqJvT9l0xIZtWSch2t6zr0IwU= + + + + + + +If we decrypt the file the MAC key will be included in encrypted form. + +>>> pskc.encryption.derive_key('qwerty') +>>> pskc.write(sys.stdout) #doctest: +ELLIPSIS +REPORT_UDIFF + + + + + + + + y6TzckeLRQw= + + 999 + 16 + + + + + + + + + ... + + + + +... + + + + Set up an encrypted PSKC file and generate a pre-shared key for it. >>> pskc = PSKC() -- cgit v1.2.3