Skip to content

Commit 1e0e67b

Browse files
basilgellotravarilo
authored andcommitted
make-key: Enforce PBEv1 password-protected signing keys
The bug https://bugs.openjdk.java.net/browse/JDK-8076999 prevents the usage of PBESv2 key encryption schemes enforced by recent OpenSSL versions. So we enforce the PBE-SHA1-3DES scheme as recommended in https://pthree.org/2013/05/27/strengthen-your-private-encrypted-ssh-keys/ Change-Id: I43239d4da1512d08563847db57af74146f8f66ea Signed-off-by: Vasyl Gello <vasek.gello@gmail.com>
1 parent 1f6a53e commit 1e0e67b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tools/make_key

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ if [ "${password}" == "" ]; then
6969
else
7070
echo "creating ${1}.pk8 with password [${password}]"
7171
export password
72-
openssl pkcs8 -in ${one} -topk8 -outform DER -out $1.pk8 \
72+
openssl pkcs8 -in ${one} -topk8 -v1 PBE-SHA1-3DES -outform DER -out $1.pk8 \
7373
-passout env:password
7474
unset password
7575
fi

0 commit comments

Comments
 (0)