Class PKCS12Util

java.lang.Object
org.bouncycastle.pkcs.util.PKCS12Util
public class PKCS12Util extends Object
Utility class for re-encoding PKCS#12 files to definite length.

Replaces PKCS12Util; this class additionally understands RFC 9579 PBMAC1 protected PFX files.

  • Constructor Summary

    Constructors
    Constructor
    Description
    PKCS12Util()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static byte[]
    convertToDefiniteLength(byte[] berPKCS12File)
    Just re-encode the outer layer of the PKCS#12 file to definite length encoding.
    static byte[]
    convertToDefiniteLength(byte[] berPKCS12File, char[] passwd)
    Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
    static byte[]
    convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, String provider)
    Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
    static byte[]
    convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, Provider provider)
    Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
    static org.bouncycastle.asn1.ASN1Encodable
    getContent(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo)
    Return the content of a ContentInfo, raising ASN1ParsingException if absent.
    static byte[]
    getContentOctets(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo)
    Return the octets carried by a ContentInfo, raising ASN1ParsingException if the content is absent or not an OCTET STRING.
    static org.bouncycastle.asn1.ASN1OctetString
    getEncryptedContent(org.bouncycastle.asn1.pkcs.EncryptedData encryptedData)
    Return the ciphertext octets of an EncryptedData, raising ASN1ParsingException if absent.
    static int
    validateIterationCount(BigInteger ic)
    Validate an iteration count from a PFX, enforcing the cap configured via the Properties.PKCS12_MAX_IT_COUNT security property (default 5,000,000).

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • PKCS12Util

      public PKCS12Util()

  • Method Details

    • convertToDefiniteLength

      public static byte[] convertToDefiniteLength(byte[] berPKCS12File) throws IOException
      Just re-encode the outer layer of the PKCS#12 file to definite length encoding.
      Parameters:
      berPKCS12File - - original PKCS#12 file
      Returns:
      a byte array representing the DER encoding of the PFX structure
      Throws:
      IOException

    • convertToDefiniteLength

      public static byte[] convertToDefiniteLength(byte[] berPKCS12File, char[] passwd) throws IOException
      Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
      Parameters:
      berPKCS12File - - original PKCS12 file.
      Returns:
      a byte array representing the DER encoding of the PFX structure.
      Throws:
      IOException - on parsing, encoding errors.

    • convertToDefiniteLength

      public static byte[] convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, String provider) throws IOException
      Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
      Parameters:
      berPKCS12File - - original PKCS12 file.
      provider - - provider name to use for MAC calculation.
      Returns:
      a byte array representing the DER encoding of the PFX structure.
      Throws:
      IOException - on parsing, encoding errors.

    • convertToDefiniteLength

      public static byte[] convertToDefiniteLength(byte[] berPKCS12File, char[] passwd, Provider provider) throws IOException
      Re-encode the PKCS#12 structure to definite length encoding at the inner layer as well, recomputing the MAC accordingly.
      Parameters:
      berPKCS12File - - original PKCS12 file.
      provider - - provider to use for MAC calculation.
      Returns:
      a byte array representing the DER encoding of the PFX structure.
      Throws:
      IOException - on parsing, encoding errors.

    • getContent

      public static org.bouncycastle.asn1.ASN1Encodable getContent(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo) throws IOException
      Return the content of a ContentInfo, raising ASN1ParsingException if absent.
      Parameters:
      contentInfo - the ContentInfo to inspect.
      Returns:
      the carried content.
      Throws:
      IOException - on ASN.1 parsing errors.

    • getContentOctets

      public static byte[] getContentOctets(org.bouncycastle.asn1.pkcs.ContentInfo contentInfo) throws IOException
      Return the octets carried by a ContentInfo, raising ASN1ParsingException if the content is absent or not an OCTET STRING.
      Parameters:
      contentInfo - the ContentInfo to inspect.
      Returns:
      the content octets.
      Throws:
      IOException - on ASN.1 parsing errors.

    • getEncryptedContent

      public static org.bouncycastle.asn1.ASN1OctetString getEncryptedContent(org.bouncycastle.asn1.pkcs.EncryptedData encryptedData) throws IOException
      Return the ciphertext octets of an EncryptedData, raising ASN1ParsingException if absent.
      Parameters:
      encryptedData - the EncryptedData to inspect.
      Returns:
      the encrypted-content octet string.
      Throws:
      IOException - on ASN.1 parsing errors.

    • validateIterationCount

      public static int validateIterationCount(BigInteger ic)
      Validate an iteration count from a PFX, enforcing the cap configured via the Properties.PKCS12_MAX_IT_COUNT security property (default 5,000,000). Negative values and values that do not fit in a signed 32-bit integer are also rejected.
      Parameters:
      ic - the iteration count from the wire.
      Returns:
      the validated iteration count as an int.
      Throws:
      IllegalStateException - if the iteration count is negative, larger than the configured maximum, or does not fit in a signed 32-bit integer.