Added legacy parsing of encrypted EdEC keys. Relates to github #1238

Author: dghgit

docs/releasenotes.html

@@ -29,6 +29,7 @@ <h3>2.1.2 Defects Fixed</h3>
 <li>X509CertificateFormatter was indenting the basicConstraints pathLenConstraint line incorrectly, dropping the 23-space prefix shared with other extension lines. The line now uses the same pad as the surrounding output (issue #2214).</li>
 <li>A range of catch-and-rethrow sites that wrapped underlying failures as IllegalArgumentException or IllegalStateException without preserving the cause have been updated to chain the original exception via org.bouncycastle.util.Exceptions, retaining the full stack trace. Affected areas include the ASN.1 parsing entry points, the ASN.1 X.500 / X.509 / CMS / DVCS / CMC support classes, the LMS / HSS / ML-DSA / SLH-DSA / XMSS signers, the DH/ECDH KEK generators, the CMS/PKIX selectors and key converters, the JCE provider IES/GM cipher and KeyFactory SPIs, the GOST3410 / Composite key wrappers, the X.509 certificate and CRL implementations, the JceTlsHMAC wrapper, the ITS signer/verifier classes, and the OpenPGP encryptor/decryptor builders (issue #2239 / PR #2250).</li>
 <li>PGPPublicKey.getValidSeconds() returned a stale expiration time when an earlier self-signature carried a Key Expiration Time subpacket and a more recent self-signature omitted it; per RFC 4880 5.2.4.1 the latest self-signature wins, so the absence of the subpacket on the newer signature now correctly cancels the expiry and the method returns 0 (issue #1749).</li>
+<li>PEMParser failed to parse a "BEGIN PRIVATE KEY" block carrying OpenSSL-legacy encryption headers (Proc-Type: 4,ENCRYPTED / DEK-Info), throwing "corrupted stream" while ASN.1-decoding the ciphertext. The PRIVATE KEY parser now honours those headers and returns a PEMEncryptedKeyPair whose decryptKeyPair() yields a PEMKeyPair holding the decrypted PKCS#8 PrivateKeyInfo (issue #1238).</li>
 </ul>
 <h3>2.2.3 Additional Features and Functionality</h3>
 <ul>

pkix/src/main/java/org/bouncycastle/openssl/PEMParser.java

@@ -561,14 +561,68 @@ public PrivateKeyParser()
         public Object parseObject(PemObject obj)
             throws IOException
         {
+            // Some tooling emits a PKCS#8 PrivateKeyInfo wrapped in OpenSSL's legacy
+            // Proc-Type/DEK-Info encryption headers under a "PRIVATE KEY" label
+            // (e.g. github #1238). Honour those headers and return a
+            // PEMEncryptedKeyPair that decrypts to a PrivateKeyInfo.
+            boolean isEncrypted = false;
+            String dekInfo = null;
+
+            for (Iterator it = obj.getHeaders().iterator(); it.hasNext();)
+            {
+                PemHeader hdr = (PemHeader)it.next();
+
+                if (hdr.getName().equals("Proc-Type") && hdr.getValue().equals("4,ENCRYPTED"))
+                {
+                    isEncrypted = true;
+                }
+                else if (hdr.getName().equals("DEK-Info"))
+                {
+                    dekInfo = hdr.getValue();
+                }
+            }
+
+            byte[] keyBytes = obj.getContent();
+
             try
             {
-                return PrivateKeyInfo.getInstance(obj.getContent());
+                if (isEncrypted)
+                {
+                    StringTokenizer tknz = new StringTokenizer(dekInfo, ",");
+                    String dekAlgName = tknz.nextToken();
+                    byte[] iv = Hex.decode(tknz.nextToken());
+
+                    return new PEMEncryptedKeyPair(dekAlgName, iv, keyBytes,
+                        new PrivateKeyInfoKeyPairParser());
+                }
+
+                return PrivateKeyInfo.getInstance(keyBytes);
             }
             catch (Exception e)
             {
+                if (isEncrypted)
+                {
+                    throw new PEMException("exception decoding - please check password and data.", e);
+                }
                 throw new PEMException("problem parsing PRIVATE KEY: " + e.toString(), e);
             }
         }
     }
+
+    private static class PrivateKeyInfoKeyPairParser
+        implements PEMKeyPairParser
+    {
+        public PEMKeyPair parse(byte[] encoding)
+            throws IOException
+        {
+            try
+            {
+                return new PEMKeyPair(null, PrivateKeyInfo.getInstance(encoding));
+            }
+            catch (Exception e)
+            {
+                throw new PEMException("problem creating private key: " + e.toString(), e);
+            }
+        }
+    }
 }

pkix/src/test/java/org/bouncycastle/openssl/test/ParserTest.java

@@ -29,6 +29,7 @@
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
 import org.bouncycastle.asn1.cms.ContentInfo;
+import org.bouncycastle.asn1.edec.EdECObjectIdentifiers;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.asn1.x509.KeyPurposeId;
 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
@@ -42,6 +43,7 @@
 import org.bouncycastle.openssl.CertificateTrustBlock;
 import org.bouncycastle.openssl.PEMDecryptorProvider;
 import org.bouncycastle.openssl.PEMEncryptedKeyPair;
+import org.bouncycastle.openssl.PEMEncryptor;
 import org.bouncycastle.openssl.PEMKeyPair;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.openssl.X509TrustedCertificateBlock;
@@ -50,9 +52,13 @@
 import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
 import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
 import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;
+import org.bouncycastle.openssl.jcajce.JcePEMEncryptorBuilder;
 import org.bouncycastle.operator.InputDecryptorProvider;
 import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;
+import org.bouncycastle.util.Arrays;
 import org.bouncycastle.util.Strings;
+import org.bouncycastle.util.encoders.Base64;
+import org.bouncycastle.util.encoders.Hex;
 import org.bouncycastle.util.test.SimpleTest;
 
 /**
@@ -378,6 +384,97 @@ public void performTest()
 
         doOpenSslGost2012Test();
         doParseAttrECKeyTest();
+        doLegacyEncryptedPkcs8PemTest();
+        doLegacyEncryptedPkcs8GenPemTest();
+    }
+
+    private void doLegacyEncryptedPkcs8PemTest()
+         throws Exception
+     {
+         char[] password = "Vjvyhfngz0MCUs$kwOF0".toCharArray();
+
+         String pem = "-----BEGIN PRIVATE KEY-----\n"
+         + "Proc-Type: 4,ENCRYPTED\n"
+         + "DEK-Info: AES-128-CBC,b619a06a16b7b7a6436579f06a14f45e\n"
+         + "\n"
+         + "QmysBFzoMkgvVTM39kvHjkKhcBjK6PVMZ6a/taF44ZXeOl3t5DUp4EWxyfs8htng\n"
+         + "tjsKIb0yKJigIZGrCeHROQ==\n"
+         + "-----END PRIVATE KEY-----\n";
+
+         PEMParser parser = new PEMParser(new StringReader(pem.toString()));
+         Object o = parser.readObject();
+
+         if (!(o instanceof PEMEncryptedKeyPair))
+         {
+             fail("expected PEMEncryptedKeyPair, got " + (o == null ? "null" : o.getClass().getName()));
+         }
+
+         PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()
+             .setProvider("BC").build(password);
+         PEMKeyPair pkp = ((PEMEncryptedKeyPair)o).decryptKeyPair(decProv);
+
+         PrivateKeyInfo decoded = pkp.getPrivateKeyInfo();
+         if (decoded == null)
+         {
+             fail("decrypted PrivateKeyInfo was null");
+         }
+         isEquals(EdECObjectIdentifiers.id_Ed25519, decoded.getPrivateKeyAlgorithm().getAlgorithm());
+     }
+
+    private void doLegacyEncryptedPkcs8GenPemTest()
+        throws Exception
+    {
+        // Reproduces github #1238: a PKCS#8 PrivateKeyInfo wrapped in OpenSSL legacy
+        // encryption headers ("Proc-Type: 4,ENCRYPTED" / "DEK-Info") under a
+        // "BEGIN PRIVATE KEY" label. Earlier releases tried to ASN.1-parse the
+        // ciphertext and failed with "corrupted stream" before this could be
+        // recognised as encrypted.
+        char[] password = "wibble".toCharArray();
+
+        KeyPairGenerator kpg = KeyPairGenerator.getInstance("Ed25519", "BC");
+        KeyPair kp = kpg.generateKeyPair();
+
+        byte[] pkcs8 = kp.getPrivate().getEncoded();
+
+        PEMEncryptor encryptor = new JcePEMEncryptorBuilder("AES-128-CBC")
+            .setProvider("BC").build(password);
+
+        byte[] encrypted = encryptor.encrypt(pkcs8);
+        String ivHex = Strings.fromByteArray(Hex.encode(encryptor.getIV()));
+        String b64 = Strings.fromByteArray(Base64.encode(encrypted));
+
+        StringBuilder pem = new StringBuilder();
+        pem.append("-----BEGIN PRIVATE KEY-----\n");
+        pem.append("Proc-Type: 4,ENCRYPTED\n");
+        pem.append("DEK-Info: AES-128-CBC,").append(ivHex).append("\n");
+        pem.append("\n");
+        for (int i = 0; i < b64.length(); i += 64)
+        {
+            pem.append(b64, i, Math.min(i + 64, b64.length())).append("\n");
+        }
+        pem.append("-----END PRIVATE KEY-----\n");
+
+        PEMParser parser = new PEMParser(new StringReader(pem.toString()));
+        Object o = parser.readObject();
+
+        if (!(o instanceof PEMEncryptedKeyPair))
+        {
+            fail("expected PEMEncryptedKeyPair, got " + (o == null ? "null" : o.getClass().getName()));
+        }
+
+        PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()
+            .setProvider("BC").build(password);
+        PEMKeyPair pkp = ((PEMEncryptedKeyPair)o).decryptKeyPair(decProv);
+
+        PrivateKeyInfo decoded = pkp.getPrivateKeyInfo();
+        if (decoded == null)
+        {
+            fail("decrypted PrivateKeyInfo was null");
+        }
+        if (!Arrays.areEqual(pkcs8, decoded.getEncoded()))
+        {
+            fail("decrypted PrivateKeyInfo did not round-trip");
+        }
     }
 
     private void checkTrustedCert(X509TrustedCertificateBlock trusted)