Skip to content

Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder - #453

Open
aidangarske wants to merge 11 commits into
wolfSSL:masterfrom
aidangarske:fix-pki-cipher-encrypt
Open

Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder#453
aidangarske wants to merge 11 commits into
wolfSSL:masterfrom
aidangarske:fix-pki-cipher-encrypt

Conversation

@aidangarske

@aidangarske aidangarske commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

openssl pkey -aes256 silently wrote unencrypted private keys for EC, Ed25519, X25519, DH and ML-DSA (RSA was fine) because the encoders only encrypted when the caller explicitly asked for the EncryptedPrivateKeyInfo structure, ignoring a cipher set on the ordinary PrivateKeyInfo path now they encrypt whenever a cipher is set plus a DH fix so generated keys don't encode an empty private value.

CLI-testing the new SLH-DSA encoders using openssl pkey -aes256 emitted BEGIN PRIVATE KEY instead of BEGIN ENCRYPTED PRIVATE KEY

Copilot AI review requested due to automatic review settings July 27, 2026 22:29
Copilot AI reviewed Jul 27, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@aidangarske aidangarske added the ci:all PR OSP toggle: run all label Jul 27, 2026
@aidangarske aidangarske self-assigned this Jul 27, 2026
@aidangarske aidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarske force-pushed the fix-pki-cipher-encrypt branch from ac3f5e5 to 87304bc Compare July 28, 2026 17:15
@aidangarske aidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarske force-pushed the fix-pki-cipher-encrypt branch from 87304bc to 736e81f Compare July 28, 2026 21:29
@aidangarske aidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarske force-pushed the fix-pki-cipher-encrypt branch from 27cb2e5 to b266849 Compare July 28, 2026 22:11
@aidangarske aidangarske added ci:all PR OSP toggle: run all ci:perf PR OSP toggle: run perf ci:iperf PR OSP toggle: run iperf and removed ci:all PR OSP toggle: run all ci:perf PR OSP toggle: run perf ci:iperf PR OSP toggle: run iperf labels Jul 28, 2026
@aidangarske aidangarske added ci:iperf PR OSP toggle: run iperf and removed ci:iperf PR OSP toggle: run iperf labels Jul 29, 2026
@aidangarske
aidangarske force-pushed the fix-pki-cipher-encrypt branch from f5a17e3 to 2f56c23 Compare July 29, 2026 07:04
@aidangarske aidangarske added ci:iperf PR OSP toggle: run iperf ci:all PR OSP toggle: run all and removed ci:iperf PR OSP toggle: run iperf labels Jul 29, 2026
@aidangarske aidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 29, 2026
@aidangarske
aidangarske requested a review from ColtonWilley July 29, 2026 19:48
@aidangarske aidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@ColtonWilley ColtonWilley Awaiting requested review from ColtonWilley

At least 1 approving review is required to merge this pull request.

Assignees

@aidangarske aidangarske

Labels

ci:all PR OSP toggle: run all

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aidangarske