Class PKCS12PBMAC1KeyStoreSpi

java.lang.Object
java.security.KeyStoreSpi
org.bouncycastle.jcajce.provider.keystore.pkcs12.PKCS12PBMAC1KeyStoreSpi
All Implemented Interfaces:
PKCSObjectIdentifiers, X509ObjectIdentifiers, BCKeyStore
public class PKCS12PBMAC1KeyStoreSpi extends KeyStoreSpi implements PKCSObjectIdentifiers, X509ObjectIdentifiers, BCKeyStore
BC's JCA-visible KeyStoreSpi for the PBMAC1-protected PKCS#12 keystore variant (provider "BC", type PKCS12-PBMAC1). On-disk integrity uses RFC 9579 PBMAC1 instead of the legacy MacData construction; the rest of the layout — bag types, entry types and encryption algorithms — matches the standard PKCS#12 layout driven by PKCS12KeyStoreSpi.

Supported entry types

  • Private-key entries — KeyStore.PrivateKeyEntry with a non-empty certificate chain. Stored as a SafeBag of type pkcs8ShroudedKeyBag per RFC 7292 sec. 4.2.2, with the associated chain emitted as certBag entries.
  • Trusted-certificate entries — KeyStore.TrustedCertificateEntry. Stored as a certBag per RFC 7292 sec. 4.2.3.
  • Secret-key entries — KeyStore.SecretKeyEntry, accepted since Bouncy Castle 1.85 (github #1807). Stored as a SafeBag of type secretBag per RFC 7292 sec. 4.2.5: the inner SecretBag carries the algorithm OID as secretTypeId and the SecretKey.getEncoded() bytes as a DER OCTET STRING secretValue, placed inside the keystore's encrypted SafeContents block. Only algorithms with a registered OID are supported — see PKCS12Util.resolveSecretKeyOid(SecretKey) for the current set (AES 128 / 192 / 256, DESede / TripleDES, HmacSHA1 / SHA-224 / SHA-256 / SHA-384 / SHA-512 / SHA3-{224,256,384,512}). Other algorithms are rejected at setKeyEntry-time with a pointer at BCFKS.

SunJCE secret-key interop (read-only, opt-in)

SunJCE writes secret keys using a non-standard encoding: the SafeBag is still secretBag, but the inner SecretBag.secretTypeId is pkcs8ShroudedKeyBag and the secretValue wraps an EncryptedPrivateKeyInfo whose decrypted PKCS#8 carries the raw key bytes. Setting the system or security property Properties.PKCS12_ALLOW_SUN_SECRET_KEYS ("org.bouncycastle.pkcs12.allow_sun_secret_keys") to true lets BC additionally decode this form on load. BC always writes the standards-compliant form regardless — i.e. files BC produces are not readable by SunJCE's PKCS#12 keystore.

System / security properties consulted

See Also: