Skip to content

Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder - #453

Merged
ColtonWilley merged 9 commits into
wolfSSL:masterfrom
aidangarske:fix-pki-cipher-encrypt
Aug 5, 2026
Merged

Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder#453
ColtonWilley merged 9 commits into
wolfSSL:masterfrom
aidangarske:fix-pki-cipher-encrypt

Conversation

@aidangarske

@aidangarskeaidangarske commented Jul 27, 2026•
edited
Loading

Copy link
Copy Markdown
Member

openssl pkey -aes256 silently wrote unencrypted private keys for EC, Ed25519, X25519, DH and ML-DSA (RSA was fine) because the encoders only encrypted when the caller explicitly asked for the EncryptedPrivateKeyInfo structure, ignoring a cipher set on the ordinary PrivateKeyInfo path now they encrypt whenever a cipher is set plus a DH fix so generated keys don't encode an empty private value.

CLI-testing the new SLH-DSA encoders using openssl pkey -aes256 emitted BEGIN PRIVATE KEY instead of BEGIN ENCRYPTED PRIVATE KEY

Added PKCS8 openssl scripts testing

CopilotAI review requested due to automatic review settings July 27, 2026 22:29
CopilotAI reviewed Jul 27, 2026

CopilotAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@aidangarskeaidangarske added the ci:all PR OSP toggle: run all label Jul 27, 2026
@aidangarskeaidangarske self-assigned this Jul 27, 2026
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch from ac3f5e5 to 87304bcCompareJuly 28, 2026 17:15
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch from 87304bc to 736e81fCompareJuly 28, 2026 21:29
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 28, 2026
@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch from 27cb2e5 to b266849CompareJuly 28, 2026 22:11
@aidangarskeaidangarske added ci:all PR OSP toggle: run all ci:perf PR OSP toggle: run perf ci:iperf PR OSP toggle: run iperf and removed ci:all PR OSP toggle: run all ci:perf PR OSP toggle: run perf ci:iperf PR OSP toggle: run iperf labels Jul 28, 2026
@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch from 6566c83 to f821937CompareJuly 29, 2026 03:47
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Jul 31, 2026
padelsbach
padelsbach reviewed Aug 3, 2026
View reviewed changes
Comment threadsrc/wp_dh_kmgmt.c Outdated
Comment threadsrc/wp_internal.c
Comment threadsrc/wp_internal.c Outdated
Comment threadtest/test_pkey.c Outdated
Comment threadsrc/wp_internal.c
Comment threadsrc/wp_ecc_kmgmt.c
Comment threadtest/test_ecc.c
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Aug 3, 2026
padelsbach
padelsbach previously approved these changes Aug 3, 2026
View reviewed changes

@padelsbachpadelsbach left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would prefer if we had an actual command line test as shown in the PR description, but can be a follow up

@aidangarske

aidangarske commented Aug 3, 2026

Copy link
Copy Markdown
MemberAuthor

Would prefer if we had an actual command line test as shown in the PR description, but can be a follow up

I agree let me add that

@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch 3 times, most recently from a809327 to 86e10e4CompareAugust 3, 2026 21:59
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Aug 3, 2026
@aidangarske
aidangarskeforce-pushed the fix-pki-cipher-encrypt branch from 86e10e4 to ba4b462CompareAugust 3, 2026 22:34
@aidangarskeaidangarske added ci:all PR OSP toggle: run all and removed ci:all PR OSP toggle: run all labels Aug 3, 2026
@aidangarskeaidangarske removed the ci:all PR OSP toggle: run all label Aug 4, 2026
padelsbach
padelsbach previously approved these changes Aug 4, 2026
View reviewed changes
@padelsbach

padelsbach commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

LGTM, let's give @ColtonWilley a chance to look at this one

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@ColtonWilleyColtonWilleyColtonWilley approved these changes
@padelsbachpadelsbachAwaiting requested review from padelsbach

Assignees

@ColtonWilleyColtonWilley

@aidangarskeaidangarske

Labels

ci:allPR OSP toggle: run all

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@aidangarske@padelsbach@ColtonWilley