rfc9548.original.xml   rfc9548.xml 
<?xml version="1.0" encoding="UTF-8"?> <?xml version="1.0" encoding="UTF-8"?>
<!-- [CS] updated by Chris 10/18/22 --> <!-- [ST] updated by Sarah 01/03/24 -->
<!-- draft submitted in xml v3 --> <!-- draft submitted in xml v3 -->
<!DOCTYPE rfc [ <!DOCTYPE rfc [
<!ENTITY nbsp "&#160;"> <!ENTITY nbsp "&#160;">
<!ENTITY zwsp "&#8203;"> <!ENTITY zwsp "&#8203;">
<!ENTITY nbhy "&#8209;"> <!ENTITY nbhy "&#8209;">
<!ENTITY wj "&#8288;"> <!ENTITY wj "&#8288;">
]> ]>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" submissionType="independent" cat <rfc xmlns:xi="http://www.w3.org/2001/XInclude"
egory="info" docName="draft-pkcs12-gost-08" ipr="trust200902" tocInclude="true" submissionType="independent"
tocDepth="4" symRefs="true" sortRefs="true" updates="" obsoletes="" xml:lang="en category="info"
" version="3"> docName="draft-pkcs12-gost-08"
number="9548"
ipr="trust200902"
tocInclude="true"
tocDepth="4"
symRefs="true"
sortRefs="true"
updates=""
obsoletes=""
xml:lang="en"
version="3">
<!-- xml2rfc v2v3 conversion 3.12.10 --> <!-- xml2rfc v2v3 conversion 3.12.10 -->
<front> <front>
<title abbrev="GOST usage in password-based pkcs12"> <title abbrev="GOST Usage in Password-Based PKCS #12">Generating
Generating the Transport Key Containers Using the GOST Algorithms Transport Key Containers (PFX) Using the GOST Algorithms</title>
</title> <seriesInfo name="RFC" value="9548"/>
<author fullname="Ekaterina Karelina" initials="E." role="editor" surname="K arelina"> <author fullname="Ekaterina Karelina" initials="E." role="editor" surname="K arelina">
<organization>InfoTeCS</organization> <organization>InfoTeCS</organization>
<address> <address>
<postal> <postal>
<street>2B stroenie 1, ul. Otradnaya</street> <street>2B stroenie 1, ul. Otradnaya</street>
<city>Moscow</city> <city>Moscow</city>
<code>127273</code> <code>127273</code>
<country>Russian Federation</country> <country>Russian Federation</country>
</postal> </postal>
<email>Ekaterina.Karelina@infotecs.ru</email> <email>Ekaterina.Karelina@infotecs.ru</email>
</address> </address>
</author> </author>
<date year="2023" month="December"/> <date year="2024" month="April"/>
<keyword>the transport key containers, certificates, GOST algorithms, pkcs12, go
st, PFX</keyword> <keyword>certificates</keyword>
<keyword>GOST algorithms</keyword>
<keyword>pkcs12</keyword>
<keyword>gost</keyword>
<keyword>PFX</keyword>
<abstract> <abstract>
<t> This document specifies how to use "PKCS #12: Personal Information Exchang e Syntax v1.1" (RFC 7292) to generate the transport key containers for storing k eys and certificates in conjunction with the <t>This document specifies how to use "PKCS #12: Personal Information Exchange Syntax v1.1" (RFC 7292) to transport key containers (PFX) for storing keys and certificates in conjunction with the
Russian national standard GOST algorithms. Russian national standard GOST algorithms.
</t> </t>
<t> <t>
This specification has been developed outside the IETF. The purpose of publication being to This specification has been developed outside the IETF. The purpose of publication is to
facilitate interoperable implementations that wish to support the facilitate interoperable implementations that wish to support the
GOST algorithms. This document does not imply IETF endorsement of th e cryptographic algorithms GOST algorithms. This document does not imply IETF endorsement of th e cryptographic algorithms
used here. used here.
</t> </t>
</abstract> </abstract>
</front> </front>
<middle> <middle>
<section anchor="Introduction"> <section anchor="Introduction">
<name>Introduction</name> <name>Introduction</name>
<t> <t>
This document provides a specification of the usage of GOST algorith ms with PKCS #12 v1.1. This document provides a specification of the usage of GOST algorith ms with PKCS #12 v1.1.
</t> </t>
<t> <t>
PKCS #12 v1.1 describes a syntax for transfer of personal informatio n such as private keys, certificates, various secrets. PKCS #12 v1.1 describes a syntax for transfer of personal informatio n such as private keys, certificates, and various secrets.
</t> </t>
<t> <t>
This memo describes the creating of transport key containers for key This memo describes the creation of transport key containers (PFX) for keys and
s and certificates of electronic signature verification keys which are created i certificates using the GOST R 34.10-2012 algorithm.
n accordance with GOST R 34.10–2012 algorithm. The GOST R 34.11-2012 algorithm is used to ensure the integrity of PFX.
The GOST R 34.11-2012 algorithm is used to ensure integrity of trans </t>
port key containers. <t>
Caution:
</t>
<t>
This specification is not a standard and does not have IETF community
consensus. It makes use of a cryptographic algorithm that is a national
standard for Russia. Neither the IETF nor the IRTF has analyzed that algor
ithm
for suitability for any given application, and it may contain either inten
ded
or unintended weaknesses.
</t> </t>
</section> </section>
<section> <section>
<name>Conventions Used in This Document</name> <name>Conventions Used in This Document</name>
<t> <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQU "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>",
IRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>",
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14> "<bcp14>SHOULD NOT</bcp14>",
RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document
be interpreted as are to be interpreted as described in BCP&nbsp;14
described in BCP&nbsp;14 <xref target="RFC2119"/> <xref target="RFC8174"/> <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only
when, and only when, they appear in all capitals, as shown here. when, they appear in all capitals, as shown here.</t>
</t>
</section> </section>
<section anchor="Definition"> <section anchor="Definition">
<name>Basic Terms and Definitions</name> <name>Basic Terms and Definitions</name>
<t> <t>
Throughout this document, the following notation is used: Throughout this document, the following notations are used:
</t> </t>
<table align="center"> <dl spacing="normal" newline="false">
<name>Terms and Definitions</name> <dt>P</dt>
<thead> <dd>a password encoded as a Unicode UTF-8 string</dd>
<tr> <dt>S</dt>
<th>Notation</th> <dd>a random initializing value</dd>
<th>Definition</th> <dt>V<sub>s</sub></dt>
</tr> <dd>the set of byte strings of length s, where s &gt;= 0; the string
</thead> b = (b<sub>1</sub>,...,b<sub>s</sub>) belongs to the set V<sub>s</sub> if b<sub
<tbody> >1</sub>,...,b<sub>s</sub> belongs to {0,...,255}</dd>
<tr> <dt>|A|</dt>
<td align="left">P</td> <dd>the number of components (a length) of the vector A belonging to
<td align="left">a password encoded as a Unicode UTF-8 string</td> V<sub>s</sub> (if A is an empty string, then |A| = 0)</dd>
</tr> <dt>A||C</dt>
<tr> <dd>a concatenation of two byte strings A, C from V<sub>s</sub>, i.e
<td align="left">S</td> .,
<td align="left">a random initializing value</td> a string from V<sub>|A|+|C|</sub>, where the left substring from V<s
</tr> ub>|A|</sub>
<tr> is equal to the string A and the right substring from V<sub>|C|</sub
<td align="left">V<sup>*</sup></td> > is
<td align="left">the set of all binary row vectors of finite length equal to the string C: A = (a<sub>1</sub>,...,a<sub>n<sub>1</sub></s
(hereinafter referred to as vectors) including empty string</td> ub>) in V<sub>n<sub>1</sub></sub> and C =
</tr> (c<sub>2</sub>,...,c<sub>n<sub>2</sub></sub>) in V<sub>n<sub>2</sub><
<tr> /sub>, res = (a<sub>1</sub>,...,a<sub>n<sub>1</sub></sub>,c<sub>2</sub>,...,c<su
<td align="left">V<sub>s</sub></td> b>n<sub>2</sub></sub>) in V<sub>n<sub>1</sub>+n<sub>2</sub></sub></dd>
<td align="left">the set of all binary row vectors of length s, s &g <dt>F_q</dt>
t;= 0; if s = 0, then the set V<sub>s</sub> consists of an empty string of lengt <dd>a finite prime field represented as a set of q integers {0,1,...
h 0</td> ,q - 1}, where q > 3 - prime number</dd>
</tr> <dt>b mod q</dt>
<tr> <dd>the minimum non-negative number comparable to b modulo p</dd>
<td align="left">|A|</td> <dt>INT(b)</dt>
<td align="left">the number of components (a length) of the vector A <dd>integer INT(b) = b<sub>1</sub> + b<sub>2</sub> * 256 +...+ b<sub
belonging to V<sup>*</sup> (if A is an empty string, then |A| = 0)</td> >s</sub> * 256<sup>s-1</sup>, where b belongs to V<sub>s</sub></dd>
</tr> </dl>
<tr>
<td align="left">A||C</td>
<td align="left">a concatenation of two octet strings A, C, i.e.,
a vector from V<sub>|A|+|C|</sub>, where the left subvector from V<s
ub>|A|</sub>
is equal to the vector A and the right subvector from V<sub>|C|</sub
> is
equal to the vector C: A = (a<sub>n<sub>1</sub></sub>,...,a<sub>1</s
ub>) in V<sub>n<sub>1</sub></sub> and C =
(c<sub>n<sub>2</sub></sub>,..., c<sub>1</sub>) in V<sub>n<sub>2</sub
></sub>, res = (a<sub>n<sub>1</sub></sub>,...,a<sub>1</sub>,c<sub>n<sub>2</sub><
/sub>,...,
c<sub>1</sub>) in V<sub>n<sub>1</sub>+n<sub>2</sub></sub>)</td>
</tr>
<tr>
<td align="left">F_q</td>
<td align="left">a finite prime field represented as a set of q inte
gers {0,1,..., q - 1}, where q > 3 – prime number</td>
</tr>
<tr>
<td align="left">b mod q</td>
<td align="left">the minimum non-negative number comparable to b mod
ulo p</td>
</tr>
</tbody>
</table>
<t> <t>
This document uses the following abbreviations and definitions:</t> This document uses the following terms and abbreviations:</t>
<table align="center"> <dl spacing="normal" newline="false">
<name>Abbreviations and Definition</name> <dt>Signature</dt>
<thead> <dd>one or more data elements resulting from the signature process (
<tr> Clause 3.12 of <xref target="ISO14888-1"/>).
<th>Abbreviations and Terms</th> Note: The terms "digital signature", "electronic signature", and "el
<th>Definition</th> ectronic digital signature" are considered
</tr> equivalent in this document.</dd>
</thead> <dt>Signature key</dt>
<tbody> <dd>set of private data elements specific to an entity and usable on
<tr> ly by this entity
<td align="left">Signature</td> in the signature process (Clause 3.13 of <xref target="ISO14
<td align="left">one or more data elements resulting from the signat 888-1"/>).
ure process (clause 3.12 of <xref target="ISO14888-1"/>). Note: Sometimes called a private key.</dd>
Note: the terms "digital signature", "electronic signature", and "el <dt>Verification key</dt>
ectronic digital signature" are considered <dd>set of public data elements that is mathematically related to an
equivalent in this document. entity's signature key
</td> and is used by the verifier in the verification process (Cla
</tr> use 3.16 of <xref target="ISO14888-1"/>).
<tr> Note: Sometimes called a public key.</dd>
<td align="left">Signature key</td> <dt>ASN.1</dt>
<td align="left">set of private data elements specific to an entity <dd>Abstract Syntax Notation One, as defined in <xref target="X.680"
and usable only by this entity />.</dd>
in the signature process (clause 3.13 of <xref target="ISO14 <dt>BER</dt>
888-1"/>). <dd>Basic Encoding Rules, as defined in <xref target="X.690"/>.</dd>
Note: Sometimes called a private key.</td> <dt>HMAC_GOSTR3411</dt>
</tr> <dd>Hash-Based Message Authentication Code. A
<tr>
<td align="left">Verification key</td>
<td align="left">set of public data elements which is mathematically
related to an entity's signature key
and which is used by the verifier in the verification proces
s (clause 3.16 of <xref target="ISO14888-1"/>).
Note: Sometimes called a public key.</td>
</tr>
<tr>
<td align="left">ASN.1</td>
<td align="left">Abstract Syntax Notation One, as defined in <xref t
arget="X.680"/>.</td>
</tr>
<tr>
<td align="left">BER</td>
<td align="left">Basic Encoding Rules, as defined in <xref target="X
.690"/>.</td>
</tr>
<tr>
<td align="left">HMAC_GOSTR3411</td>
<td align="left">Hashed-Based Message Authentication Code. A
function for calculating a Message Authentication Code (MAC) based function for calculating a Message Authentication Code (MAC) based
on the GOST R 34.11-2012 hash function (see <xref on the GOST R 34.11-2012 hash function (see <xref
target="RFC6986"/>) with 512-bit output in accordance with <xref target="RFC6986"/>) with 512-bit output in accordance with <xref
target="RFC2104"/>.</td> target="RFC2104"/>.</dd>
</tr> </dl>
</tbody>
</table>
</section> </section>
<section anchor="PFX"> <section anchor="PFX">
<name>PFX</name> <name>PFX</name>
<t> <t>
The transport key container (PFX, see <xref target="RFC7292"/>) is d The PFX (see <xref target="RFC7292"/>) is designed for secure storag
esigned for secure storage and data transfer. e and data transfer.
The scope of this document is to define how the transport key contai The scope of this document is to define how PFX is used for private k
ner is used for private key and certificate protection with a password when GOST ey and certificate protection with a password when GOST R 34.10-2012 is applied.
R 34.10-2012 is applied.
.
</t> </t>
<section anchor="StrucurePFX"> <section anchor="StrucurePFX">
<name>Structure of PFX</name> <name>Structure of PFX</name>
<t>In accordance with <xref target="RFC7292"/> the transport key container has the following structure:</t> <t>In accordance with <xref target="RFC7292"/>, PFX has the foll owing structure:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
PFX ::= SEQUENCE PFX ::= SEQUENCE
{ {
version INTEGER {v3(3)}(v3,...), version INTEGER {v3(3)}(v3,...),
authSafe ContentInfo, authSafe ContentInfo,
macData MacData OPTIONAL macData MacData OPTIONAL
}]]></sourcecode> }]]></sourcecode>
<t>The fields of PFX have the following meanings:</t> <t>The fields of the PFX have the following meanings:</t>
<ul spacing="normal"><li>version is the syntax version numbe <ul spacing="normal"><li>version is the syntax version numbe
r; the only allowed value for this specification is 3;</li> r; the only allowed value for this specification is 3.</li>
<li>authSafe contains the data of type ContentInfo. In the c <li>authSafe contains the data of type ContentInfo. In the c
ase of password integrity mode the authSafe.content field has a Data type value ase of password integrity mode, the authSafe.content field has a Data type value
and contains a BER-encoded value of AuthenticatedSafe structure;</li> and contains a BER-encoded value of the AuthenticatedSafe structure.</li>
<li>macData has a MacData type and in the case of password i <li>macData has a MacData type; in the case of password inte
ntegrity mode the macData field should contain the information about algorithm a grity mode, the macData field should contain information about the algorithm and
nd parameters for a password key generation. parameters for password key generation.
The integrity control is ensured by using the HMAC_GOSTR Integrity control is ensured by using the HMAC_GOSTR3411
3411_2012_512 algorithm: the macData.mac.digestAlgorithm.algorithm field contain _2012_512 algorithm: the macData.mac.digestAlgorithm.algorithm field contains th
s the HMAC_GOSTR3411_2012_512 algorithm identifier (see <xref target="SecurityM" e HMAC_GOSTR3411_2012_512 algorithm identifier (see <xref target="SecurityM"/>).
/>). When processing PFX, this field should be checked first.
When processing a transport key container, this field sh </li>
ould be checked first.</li>
</ul> </ul>
</section> </section>
<section anchor="AuthenticatedSafe"> <section anchor="AuthenticatedSafe">
<name>AuthenticatedSafe</name> <name>AuthenticatedSafe</name>
<t>The AuthenticatedSafe structure is a sequence of ContentInfo v alues (see <xref target="RFC5652"/>):</t> <t>The AuthenticatedSafe structure is a sequence of ContentInfo v alues (see <xref target="RFC5652"/>):</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
AuthenticatedSafe ::= SEQUENCE OF ContentInfo AuthenticatedSafe ::= SEQUENCE OF ContentInfo
-- Data if unencrypted -- Data if unencrypted
-- EncryptedData if password-encrypted -- EncryptedData if password-encrypted
-- EnvelopedData if public key-encrypted -- EnvelopedData if public key-encrypted
]]></sourcecode> ]]></sourcecode>
<section anchor="Unencrypted"> <section anchor="Unencrypted">
<name>Unencrypted Data</name> <name>Unencrypted Data</name>
<t>If the data is not encrypted then the content field is the BE R-encoded value of the SafeContents structure. The contentType field is set to t he id-data type.</t> <t>If the data is not encrypted, then the content field is the B ER-encoded value of the SafeContents structure. The contentType field is set to the id-data type.</t>
</section> </section>
<section anchor="Password-encrypted"> <section anchor="Password-encrypted">
<name>Password-encrypted data</name> <name>Password-Encrypted Data</name>
<t>When password integrity mode is used the data is represented a <t>When password integrity mode is used, the data is represented
s an EncryptedData structure (<xref target="RFC5652"/>). as an EncryptedData structure (see <xref target="RFC5652"/>).
The encryption algorithm and parameters have the following values :</t> The encryption algorithm and parameters have the following values :</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
ContentEncryptionAlgorithmIdentifier ::= SEQUENCE ContentEncryptionAlgorithmIdentifier ::= SEQUENCE
{ {
encryptionAlgorithmOID OBJECT IDENTIFIER, encryptionAlgorithmOID OBJECT IDENTIFIER,
parameters PBES2-params parameters PBES2-params
} }
]]></sourcecode> ]]></sourcecode>
<t>The PBES2-params type is defined in <xref target="RFC9337"/>. <t>The PBES2-params type is defined in <xref target="RFC9337"/>.
The content should be encrypted according to the encryption algorithm in the PB The content should be encrypted according to the encryption algorithm in the PB
ES2 scheme, described in <xref target="RFC9337"/>. ES2 scheme, as described in <xref target="RFC9337"/>.
The following identifier MUST be specified in EncryptedData.Encr The following identifier <bcp14>MUST</bcp14> be specified in the
yptedContentInfo.contentEncryptionAlgorithm.encryptionAlgorithmOID field:</t> EncryptedData.EncryptedContentInfo.contentEncryptionAlgorithm.<br/>
encryptionAlgorithmOID field:
</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
{ {
iso(1) member-body(2) us(840) rsadsi(113549) iso(1) member-body(2) us(840) rsadsi(113549)
pkcs(1) pkcs-5(5) pbes2(13) pkcs(1) pkcs-5(5) pbes2(13)
} }
]]></sourcecode> ]]></sourcecode>
<t>The encrypted content is specified in EncryptedData.Encrypted ContentInfo.encryptedContent field.</t> <t>The encrypted content is specified in the EncryptedData.Encry ptedContentInfo.encryptedContent field.</t>
</section> </section>
</section> </section>
<section anchor="SC"> <section anchor="SC">
<name>SafeContents and SafeBag</name> <name>SafeContents and SafeBag</name>
<t>In accordance with <xref target="RFC7292"/> the SafeContents structure is a sequence of SafeBag:</t> <t>In accordance with <xref target="RFC7292"/>, the SafeContents structure is a sequence of SafeBag:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
SafeContents ::= SEQUENCE OF SafeBag SafeContents ::= SEQUENCE OF SafeBag
]]></sourcecode> ]]></sourcecode>
<t>where</t> <t>where</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
SafeBag ::= SEQUENCE SafeBag ::= SEQUENCE
{ {
bagId BAG-TYPE.&id ({PKCS12BagSet}) bagId BAG-TYPE.&id ({PKCS12BagSet})
bagValue [0] EXPLICIT BAG-TYPE.&Type({PKCS12BagSet}{@bagId}) bagValue [0] EXPLICIT BAG-TYPE.&Type({PKCS12BagSet}{@bagId})
bagAttributes SET OF PKCS12Attribute OPTIONAL bagAttributes SET OF PKCS12Attribute OPTIONAL
} }
]]></sourcecode> ]]></sourcecode>
<t>The fields of SafeBag have the following meanings:</t> <t>The fields of SafeBag have the following meanings:</t>
<ul spacing="normal"><li>bagId is an object identifier, it d <ul spacing="normal"><li>bagId is an object identifier; it d
efines the type of object;</li> efines the type of object.</li>
<li>bagValue is the value of an object;</li> <li>bagValue is the value of an object.</li>
<li>bagAttributes contains the users names, the key identifi <li>bagAttributes contains the users' names, the key identif
ers and other additional information. It is optional.</li> iers, and other additional information. This field is optional.</li>
</ul>
<t>See <xref target="RFC7292"/> Section 4.2. for the different b
ag types.
This document describes the 2 object types of SafeBag structure:
</t>
<ul spacing="normal">
<li>pkcs8ShroudedKeyBag,</li>
<li>certBag.</li>
</ul> </ul>
<t>When password integrity mode is used the private key has the <t>See <xref target="RFC7292" sectionFormat="comma" section="4.2
following structure:</t> "/>
for the different bag types.
This document describes the two object types of the SafeBag stru
cture:</t>
<ol spacing="normal">
<li>pkcs8ShroudedKeyBag</li>
<li>certBag</li>
</ol>
<t>When password integrity mode is used, the private key has the
following structure:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
pkcs8ShroudedKeyBag BAG-TYPE ::= pkcs8ShroudedKeyBag BAG-TYPE ::=
{ {
PKCS8ShroudedKeyBag IDENTIFIED BY {bagtypes 2} PKCS8ShroudedKeyBag IDENTIFIED BY {bagtypes 2}
} }
]]></sourcecode> ]]></sourcecode>
<t>The bagValue field contains the key and information about it in the encrypted form in the EncryptedPrivateKeyInfo structure.</t> <t>The bagValue field contains the key and information about the key, in encrypted form, in the EncryptedPrivateKeyInfo structure.</t>
<t>A certBag contains a certificate of a certain type. Object id entifiers are used to distinguish between different certificate types.</t> <t>A certBag contains a certificate of a certain type. Object id entifiers are used to distinguish between different certificate types.</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
certBag BAG-TYPE ::= certBag BAG-TYPE ::=
{ {
CertBag IDENTIFIED BY { bagtypes 3 } CertBag IDENTIFIED BY { bagtypes 3 }
} }
]]></sourcecode> ]]></sourcecode>
<t>If the certificate is not encrypted, the CertBag structure is placed in the Data structure (see <xref target="RFC5652"/>). <t>If the certificate is not encrypted, the CertBag structure is placed in the Data structure (see <xref target="RFC5652"/>).
If the certificate is encrypted, the CertBag structure is placed in the EncryptedData structure (see <xref target="RFC5652"/>).</t> If the certificate is encrypted, the CertBag structure is placed in the EncryptedData structure (see <xref target="RFC5652"/>).</t>
</section> </section>
</section> </section>
<section anchor="Key_repres"> <section anchor="Key_repres">
<name>GOST R 34.10–2012 key representation</name> <name>GOST R 34.10-2012 Key Representation</name>
<t>This section describes the GOST R 34.10–2012 private keys represe <t>This section describes the GOST R 34.10-2012 private key represen
ntation for asymmetric key pairs. tation for asymmetric key pairs.
Masked keys should be used to ensure the protection of private keys Masked keys should be used to ensure that private keys are protected
from leaks through the side channels when reading and performing operations with from leaking through side channels when reading and performing operations with
keys.</t> keys.</t>
<section anchor="Key_mask"> <section anchor="Key_mask">
<name>Masking GOST R 34.10–2012 keys</name> <name>Masking GOST R 34.10-2012 Keys</name>
<t>The masking algorithm is defined by the basic cryptographic t <t>The masking algorithm is defined by the basic cryptographic t
ransformation operation of the algorithm: multiplication in the F_q field for G ransformation operation of the algorithm: multiplication in the F_q field for G
OST R 34.10–2012 keys.</t> OST R 34.10-2012 keys.</t>
<t>Let M<sub>1</sub>, M<sub>2</sub>, ..., M<sub>k</sub> be a seq uence of k masks. Let M<sub>i</sub>() denote the operation of applying the i-th mask and M<sub>i</sub><sup>-1</sup>() denote the operation of removing the i-th mask, 1 &lt;= i &lt;= k. <t>Let M<sub>1</sub>, M<sub>2</sub>, ..., M<sub>k</sub> be a seq uence of k masks. Let M<sub>i</sub>() denote the operation of applying the i-th mask and M<sub>i</sub><sup>-1</sup>() denote the operation of removing the i-th mask, 1 &lt;= i &lt;= k.
Let K be a key. The masked key K<sub>M</sub> is obtained by appl ying the masking operation k times:</t> Let K be a key. The masked key K<sub>M</sub> is obtained by appl ying the masking operation k times:</t>
<ul empty="true" spacing="normal"> <t indent="3">K<sub>M</sub> = M<sub>k</sub> (...(M<sub>2</sub>(M
<li>K<sub>M</sub> = M<sub>k</sub> (...(M<sub>2</sub>(M<sub>1</su <sub>1</sub>(K)...).</t>
b>(K)...).</li> <t>Unmasking is performed by applying the removal operation k ti
</ul> mes, but in reverse order:</t>
<t>Unmasking is performed by applying the removing operation k t <t indent="3">K = M<sub>1</sub><sup>-1</sup>(...(M<sub>k-1</sub>
imes, but in reverse order:</t> <sup>-1</sup>(M<sub>k</sub><sup>-1</sup>(K<sub>M</sub>))...).</t>
<ul empty="true" spacing="normal">
<li>K = M<sub>1</sub><sup>-1</sup>(...(M<sub>k-1</sub><sup>-1</s
up>(M<sub>k</sub><sup>-1</sup>(K<sub>M</sub>))...).</li>
</ul>
<t>The masked key is represented as the sequence</t> <t>The masked key is represented as the sequence</t>
<ul empty="true" spacing="normal"> <t indent="3">I = K<sub>M</sub>||M<sub>1</sub>||M<sub>2</sub>||.
<li>I = K<sub>M</sub>||M<sub>1</sub>||M<sub>2</sub>||...||M<sub> ..||M<sub>k</sub>.</t>
k</sub>.</li> <t>Let the key K be n bits in length; then, the sequence I is re
</ul> presented in memory as a sequence of (k + 1)*n bits. I is represented in little-
<t>Let the key K be n bits in length, then the sequence I is rep endian format.
resented in memory as a sequence of (k + 1)*n bits. I is represented in little-e
ndian format.
It is possible to use an unmasked private key (i.e., k = 0, K<su b>M</sub> = K). It is possible to use an unmasked private key (i.e., k = 0, K<su b>M</sub> = K).
The masking operation is the multiplication of the key by the in For GOST R 34.10-2012 keys, the masking operation is the multipl
verse of the mask: K<sub>M</sub> = K * M<sup>-1</sup> mod Q, where the Q value i ication of the key by the inverse of the mask: INT(K<sub>M</sub>) = INT(K) * INT
s taken from the key parameters. (M)<sup>-1</sup> mod Q, where the Q value is taken from the key parameters.
The operation of removing the mask is the multiplication of the The operation of removing the mask is the multiplication of the
masked key by the mask: K = K<sub>M</sub> * M mod Q. masked key by the mask: INT(K) = INT(K<sub>M</sub>) * INT(M) mod Q.
The public key is specified by a pair of coordinates (x, y) defi The public key is specified by a pair of coordinates (x, y) as d
ned in GOST R 34.10–2012, presented in the following format:</t> efined in GOST R 34.10-2012, presented in the following format:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>a public key corresponding to the GOST R 34.10–2012 algorith <li>a public key corresponding to the GOST R 34.10-2012 algorith
m with a key length of 256 bits m with a key length of 256 bits
has the GostR3410–2012-256-PublicKey representation. It is speci has the GostR3410-2012-256-PublicKey representation. It is speci
fied by a 64-byte string, where the first 32 bytes contain the little-endian rep fied by a 64-byte string, where the first 32 bytes contain the little-endian rep
resentation of the x coordinate, resentation of the x coordinate
and the last 32 bytes contain the little-endian representation o and the last 32 bytes contain the little-endian representation o
f the y coordinate;</li> f the y coordinate.</li>
<li>a public key corresponding to the GOST R 34.10–2012 algorith <li>a public key corresponding to the GOST R 34.10-2012 algorith
m with a key length of 512 bits m with a key length of 512 bits
has the GostR3410–2012-512-PublicKey representation. It is speci has the GostR3410-2012-512-PublicKey representation. It is speci
fied by a 128-byte string, where the first 64 bytes contain the little-endian re fied by a 128-byte string, where the first 64 bytes contain the little-endian re
presentation of the x coordinate, presentation of the x coordinate
and the last 64 bytes contain the little-endian representation o f the y coordinate.</li> and the last 64 bytes contain the little-endian representation o f the y coordinate.</li>
</ul> </ul>
<t>The public keys GostR3410-2012-256-PublicKey and GostR3410-20 <t>The public keys GostR3410-2012-256-PublicKey and GostR3410-20
12-512-PublicKey MUST be DER-encoded as an octet string in accordance with <xref 12-512-PublicKey <bcp14>MUST</bcp14> be DER encoded as an octet string in accord
target="RFC9215"/> (section 4.3):</t> ance with <xref target="RFC9215" sectionFormat="of" section="4.3"/>:</t>
<ul empty="true" spacing="normal"> <sourcecode type="asn.1"><![CDATA[
<li>GostR3410–2012-256-PublicKey ::= OCTET STRING (64),</li> GostR3410-2012-256-PublicKey ::= OCTET STRING (64),
<li>GostR3410–2012-512-PublicKey ::= OCTET STRING (128).</li> GostR3410-2012-512-PublicKey ::= OCTET STRING (128).
</ul> ]]></sourcecode>
</section> </section>
<section anchor="KeyBag"> <section anchor="KeyBag">
<name>KeyBag structure for GOST R 34.10–2012 key</name> <name>KeyBag Structure for GOST R 34.10-2012 Key</name>
<t> <t>
In accordance with <xref target="RFC7292"/> a KeyBag is defined as information about a private key represented as the PrivateKeyInfo structure:< /t> In accordance with <xref target="RFC7292"/>, a KeyBag is defined as information about a private key represented as the PrivateKeyInfo structure: </t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
KeyBag := PrivateKeyInfo KeyBag ::= PrivateKeyInfo
]]></sourcecode> ]]></sourcecode>
<t>In accordance with <xref target="RFC5958"/>, information abou t a private key is presented in the following form:</t> <t>In accordance with <xref target="RFC5958"/>, information abou t a private key is presented in the following form:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
PrivateKeyInfo := OneAsymmetricKey PrivateKeyInfo ::= OneAsymmetricKey
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="OneAsymmetricKey"> <section anchor="OneAsymmetricKey">
<name>OneAsymmetricKey structure</name> <name>OneAsymmetricKey Structure</name>
<t>In accordance with <xref target="RFC5958"/> OneAsymmetricKey <t>In accordance with <xref target="RFC5958"/>, OneAsymmetricKey
has the following structure: </t> has the following structure: </t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
OneAsymmetricKey::= SEQUENCE OneAsymmetricKey::= SEQUENCE
{ {
version Version, version Version,
privateKeyAlgorithm PrivateKeyAlgorithmIdentifier, privateKeyAlgorithm PrivateKeyAlgorithmIdentifier,
privateKey PrivateKey, privateKey PrivateKey,
attributes [0] Attributes OPTIONAL, attributes [0] Attributes OPTIONAL,
..., ...,
[[2:publicKey [1] PublicKey OPTIONAL]], [[2:publicKey [1] PublicKey OPTIONAL]],
... ...
} }
Version ::= INTEGER { v1(0), v2(1) } (v1, ..., v2) Version ::= INTEGER { v1(0), v2(1) } (v1, ..., v2)
PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
PrivateKey ::= OCTET STRING PrivateKey ::= OCTET STRING
PublicKey ::= BIT STRING PublicKey ::= BIT STRING
Attributes ::= SET OF Attribute Attributes ::= SET OF Attribute
]]></sourcecode> ]]></sourcecode>
<t>The fields have the following meanings:</t> <t>The fields have the following meanings:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>version identifies the version of OneAsymmetricKey. If publi <li>version identifies the version of OneAsymmetricKey. If publi
cKey is present, then version is set to 2 else version is set to 1.</li> cKey is present, then version is set to 2; else, version is set to 1.</li>
<li>privateKeyAlgorithm identifies the private-key algorithm and <li>privateKeyAlgorithm identifies the private key algorithm and
optionally contains parameters associated with the asymmetric key optionally contains parameters associated with the asymmetric key
pair. For GOST R 34.10–2012 private keys the identifiers of the pair. For GOST R 34.10-2012 private keys, the identifiers of the
corresponding public keys are used, they are defined in the <xref target="RFC921 corresponding public keys are used; they are defined in <xref target="RFC9215"/
5"/>. >.
The use of identifiers and public key parameters is defined in t The use of identifiers and public key parameters is defined in <
he <xref target="RFC9215"/>.</li> xref target="RFC9215"/>.</li>
<li>privateKey is an OCTET STRING that contains the value of the masked private key I.</li> <li>privateKey is an OCTET STRING that contains the value of the masked private key I.</li>
<li>attributes are optional. They contain information correspond ing to the public key (e.g., certificates).</li> <li>attributes are optional. They contain information correspond ing to the public key (e.g., certificates).</li>
<li>publicKey contains the value of the public key GostR3410–201 2-256-PublicKey or GostR3410–2012-512-PublicKey encoded in a BIT STRING. It is a n optional field.</li> <li>publicKey contains the value of the public key GostR3410-201 2-256-PublicKey or GostR3410-2012-512-PublicKey encoded in a BIT STRING. This fi eld is optional.</li>
</ul> </ul>
</section> </section>
<section anchor="PKCS8ShroudedKeyBag"> <section anchor="PKCS8ShroudedKeyBag">
<name>EncryptedPrivateKeyInfo structure for GOST R 34.10–2012 ke <name>EncryptedPrivateKeyInfo Structure for GOST R 34.10-2012 Ke
y</name> y</name>
<t>In accordance with <xref target="RFC7292"/> the encrypted inf <t>In accordance with <xref target="RFC7292"/>, the encrypted in
ormation of the private key is defined as the PKCS8ShroudedKeyBag structure:</t> formation regarding the private key is defined as the PKCS8ShroudedKeyBag struct
ure:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
PKCS8ShroudedKeyBag::= EncryptedPrivateKeyInfo PKCS8ShroudedKeyBag::= EncryptedPrivateKeyInfo
]]></sourcecode> ]]></sourcecode>
<t>In accordance with <xref target="RFC5958"/> the EncryptedPriv ateKeyInfo has the following structure:</t> <t>In accordance with <xref target="RFC5958"/>, EncryptedPrivate KeyInfo has the following structure:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
EncryptedPrivateKeyInfo ::= SEQUENCE EncryptedPrivateKeyInfo ::= SEQUENCE
{ {
encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptionAlgorithm EncryptionAlgorithmIdentifier,
encryptedData EncryptedData encryptedData EncryptedData
} }
EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
EncryptedData ::= OCTET STRING EncryptedData ::= OCTET STRING
]]></sourcecode> ]]></sourcecode>
<t>The fields have the following meanings:</t> <t>The fields have the following meanings:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>encryptionAlgorithm identifies the algorithm under which the private key information is encrypted. Encryption MUST use PBES2 scheme. The alg orithm and parameters of this scheme are presented in <xref target="RFC9337"/>.< /li> <li>encryptionAlgorithm identifies the algorithm under which the private key information is encrypted. Encryption <bcp14>MUST</bcp14> use the PB ES2 scheme. The algorithm and parameters of this scheme are presented in <xref t arget="RFC9337"/>.</li>
<li>encryptedData is the DER-encoded PrivateKeyInfo structure.</ li> <li>encryptedData is the DER-encoded PrivateKeyInfo structure.</ li>
</ul> </ul>
</section> </section>
</section> </section>
<section anchor="Cert_repres"> <section anchor="Cert_repres">
<name>GOST R 34.10–2012 certificate representation</name> <name>GOST R 34.10-2012 Certificate Representation</name>
<t> <t>
In accordance with <xref target="RFC7292"/> a CertBag is defined as info rmation about a certificate and represented as the following structure:</t> In accordance with <xref target="RFC7292"/>, a CertBag is defined as inf ormation about a certificate and has the following structure:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
CertBag ::= SEQUENCE CertBag ::= SEQUENCE
{ {
certId BAG-TYPE.&id ({CertTypes}), certId BAG-TYPE.&id ({CertTypes}),
certValue [0] EXPLICIT BAG-TYPE.&Type ({CertTypes}{@certId}) certValue [0] EXPLICIT BAG-TYPE.&Type ({CertTypes}{@certId})
} }
]]></sourcecode> ]]></sourcecode>
<t>The fields have the following meanings:</t> <t>The fields have the following meanings:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>certId identifies the type of certificate.</li> <li>certId identifies the type of certificate.</li>
<li>certValue contains certificate.</li> <li>certValue contains the certificate.</li>
</ul> </ul>
</section> </section>
<section anchor="SecurityM"> <section anchor="SecurityM">
<name>Security Mechanisms</name> <name>Security Mechanisms</name>
<t>Let the sender and receiver have a pre-agreed password P. The sender generates a password key using the PBKDF2 algorithm in accordance with <xref tar get="RFC9337"/> and uses it to encrypt the transmitted private key. <t>Let the sender and receiver have a previously agreed-upon password P. The sender generates a password key using the PBKDF2 algorithm in accordance wi th <xref target="RFC9337"/> and uses it to encrypt the transmitted private key.
The recipient independently generates a password key using the same PBKD F2 diversification algorithm in accordance with <xref target="RFC9337"/> and use s it to extract the private key from the PFX.</t> The recipient independently generates a password key using the same PBKD F2 diversification algorithm in accordance with <xref target="RFC9337"/> and use s it to extract the private key from the PFX.</t>
<t>The same password P is used to encrypt different sections of the PFX <t>The same password P is used to encrypt different sections of the PFX
using different random initializing value S with a length of 8 to 32 bytes, using a different random initializing value S with a length of 8 to 32 bytes,
where S and P are the input parameters of the PBKDF2 function. The passw where S and P are the input parameters of the PBKDF2 function. The passw
ord MUST be encoded as a Unicode UTF-8 string and fed into the PBKDF2 algorithm ord <bcp14>MUST</bcp14> be encoded as a Unicode UTF-8 string and fed into the PB
as a P parameter.</t> KDF2 algorithm as a P parameter.</t>
<t>The integrity of PFX is ensured by using the HMAC_GOSTR3411_2012_512 <t>The integrity of the PFX is ensured by using the HMAC_GOSTR3411_2012_
algorithm in accordance with <xref target="RFC7836"/>. For checking the integrit 512 algorithm in accordance with <xref target="RFC7836"/>. To check the integrit
y of PFX with the HMAC_GOSTR3411_2012_512 algorithm y of the PFX with the HMAC_GOSTR3411_2012_512 algorithm,
the key for this algorithm is also generated by using the PBKDF2 algorit the key for this algorithm is also generated by using the PBKDF2 algorit
hm in accordance with <xref target="RFC9337"/> with the same value of the P para hm in accordance with <xref target="RFC9337"/>, with the same value for the P pa
meter and a different initializing value S with a length of 8 to 32 bytes. rameter and a different initializing value S with a length of 8 to 32 bytes.
The dkLen parameter for the PBKDF2 algorithm is set to 96 bytes. The key for the HMAC_GOSTR3411_2012_512 algorithm must be the last 32 bytes of the 96-b yte sequence generated by the PBKDF2 algorithm. The dkLen parameter for the PBKDF2 algorithm is set to 96 bytes. The key for the HMAC_GOSTR3411_2012_512 algorithm must be the last 32 bytes of the 96-b yte sequence generated by the PBKDF2 algorithm.
The PBKDF2 algorithm parameters S and c are saved in macData.Salt and ma cData.iterations fileds respectively. The PBKDF2 algorithm parameters S and c are saved in the macData.Salt an d macData.iterations fields, respectively.
The HMAC_GOSTR3411_2012_512 function is calculated from the content fiel d of the authSafe structure field. The authSafe structure field is a PFX structu re field. The HMAC_GOSTR3411_2012_512 function is calculated from the content fiel d of the authSafe structure field. The authSafe structure field is a PFX structu re field.
The value of the calculated checksum is saved in the macData.mac.digest field. The macData.mac.digestAlgorithm.algorithm field contains the following al gorithm identifier:</t> The value of the calculated checksum is saved in the macData.mac.digest field. The macData.mac.digestAlgorithm.algorithm field contains the following al gorithm identifier:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
id-tc26-gost3411-12-512 :: = id-tc26-gost3411-12-512 :: =
{ {
iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) iso(1) member-body(2) ru(643) rosstandart(7) tc26(1)
algorithms (1) digest(2) gost3411–2012-512(3) algorithms(1) digest(2) gost3411-12-512(3)
} }
]]></sourcecode> ]]></sourcecode>
<t>The macData.mac.digestAlgorithm.parameters field isn't used and shoul d be omitted.</t> <t>The macData.mac.digestAlgorithm.parameters field isn't used and shoul d be omitted.</t>
</section> </section>
<section anchor="Security"> <section anchor="Security">
<name>Security Considerations</name> <name>Security Considerations</name>
<t>The masked keys SHOULD be used to ensure the protection of private ke ys from leaking through side channels when reading and performing operations wit h keys. <t>The masked keys <bcp14>SHOULD</bcp14> be used to ensure that private keys are protected from leaking through side channels when reading and performin g operations with keys.
Applications MUST use unique values for ukm and S in the PBKDF2 algorith Applications <bcp14>MUST</bcp14> use unique values for ukm and S in the
m. PBKDF2 algorithm.
It is RECOMMENDED that parameter S consist of at least 32 octets of pseu It is <bcp14>RECOMMENDED</bcp14> that parameter S consist of at least 32
do-random data in order to reduce the probability of collisions of keys generate octets of pseudorandom data in order to reduce the probability of collisions of
d from the same password. keys generated from the same password.
The password MUST be encoded as a Unicode UTF-8 string and fed into the The password <bcp14>MUST</bcp14> be encoded as a Unicode UTF-8 string an
PBKDF2 algorithm as a P parameter. d fed into the PBKDF2 algorithm as a P parameter.
For more information see <xref target="RFC9337"/>. For more information, see <xref target="RFC9337"/>.
Encryption MUST use PBES2 scheme for encryption private keys. Public key Encryption <bcp14>MUST</bcp14> use the PBES2 scheme to encrypt private k
s MUST be DER-encoded as an octet string in accordance with <xref target="RFC921 eys. Public keys <bcp14>MUST</bcp14> be DER encoded as an octet string in accord
5"/>. ance with <xref target="RFC9215"/>.
Passwords SHOULD be stored in secure way. Passwords <bcp14>SHOULD</bcp14> be stored in a secure way.
For information on security considerations for generating the transport For information on security considerations for generating PFX, see <xref
key containers see <xref target="RFC7292"/>.</t> target="RFC7292"/>.</t>
</section> </section>
<section anchor="IANA_Considerations"> <section anchor="IANA_Considerations">
<name>IANA Considerations</name> <name>IANA Considerations</name>
<t>This document has no IANA actions.</t> <t>This document has no IANA actions.</t>
</section> </section>
<section anchor="ASN"> <section anchor="ASN">
<name>ASN.1 Modules</name> <name>ASN.1 Modules</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
PKCS-12RU PKCS-12RU
{ {
iso(1) member-body(2) ru(643) rosstandart(7) iso(1) member-body(2) ru(643) rosstandart(7)
tc26(1) modules(0) pkcs-12ruSyntax(5) tc26(1) modules(0) pkcs-12ruSyntax(5)
} }
DEFINITIONS EXPLICIT TAGS ::= DEFINITIONS EXPLICIT TAGS ::=
BEGIN BEGIN
IMPORTS IMPORTS
GostR3410–2012-PublicKey GostR3410-2012-PublicKey
FROM GostR3410–2012-PKISyntax FROM GostR3410-2012-PKISyntax
{ {
iso(1) member-body(2) ru(643) rosstandart(7) tc26(1) iso(1) member-body(2) ru(643) rosstandart(7) tc26(1)
modules(0) gostR3410–2012-PKISyntax(2) modules(0) gostR3410-2012-PKISyntax(2)
}; };
END END
]]></sourcecode> ]]></sourcecode>
</section> </section>
</middle> </middle>
<back> <back>
<references> <references>
<name>References</name> <name>References</name>
<references> <references>
<name>Normative References</name> <name>Normative References</name>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.210
.2104.xml"/> 4.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.211
.2119.xml"/> 9.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.817
.8174.xml"/> 4.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.729
.7292.xml"/> 2.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.595
.5958.xml"/> 8.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.565
.5652.xml"/> 2.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.783
.7836.xml"/> 6.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.698
.6986.xml"/> 6.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.921
.9215.xml"/> 5.xml"/>
<xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.933
.9337.xml"/> 7.xml"/>
<reference anchor="X.680">
<reference anchor="X.680" target="https://www.itu.int/rec/T-REC-X.680">
<front> <front>
<title>Information Technology - Abstract Syntax Notation One: Specific ation of Basic Notation.</title> <title>Information Technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation</title>
<author> <author>
<organization>ITU-T</organization> <organization>ITU-T</organization>
</author> </author>
<date year="2002"/> <date month="February" year="2021"/>
</front> </front>
<refcontent>ITU-T, Recommendation X.680, ISO/IEC 8824-1:2002</refcontent <seriesInfo name="ITU-T Recommendation" value="X.680"/>
> <seriesInfo name="ISO/IEC" value="8824-1:2021"/>
</reference> </reference>
<reference anchor="X.690">
<reference anchor="X.690" target="https://www.itu.int/rec/T-REC-X.690">
<front> <front>
<title>Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical <title>Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical
Encoding Rules (CER) and Distinguished Encoding Rules (DER).</titl e> Encoding Rules (CER) and Distinguished Encoding Rules (DER)</title >
<author> <author>
<organization>ITU-T</organization> <organization>ITU-T</organization>
</author> </author>
<date month="November" year="2008"/> <date month="February" year="2021"/>
</front> </front>
<refcontent>ITU-T, Recommendation X.690, ISO/IEC International Standard <seriesInfo name="ITU-T Recommendation" value="X.690"/>
8825-1:2008</refcontent> <seriesInfo name="ISO/IEC International Standard" value="8825-1:2021"/>
</reference> </reference>
</references> </references>
<references> <references>
<name>Informative References</name> <name>Informative References</name>
<reference anchor="ISO14888-1">
<reference anchor="ISO14888-1" target="https://www.iso.org/standard/44226.
html">
<front> <front>
<title>Information technology - Security techniques - Digital signatur es with appendix - Part 1: General.</title> <title>Information technology - Security techniques - Digital signatur es with appendix - Part 1: General</title>
<author> <author>
<organization>ISO/IEC</organization> <organization>ISO/IEC</organization>
</author> </author>
<date year="2008"/> <date month="April" year="2008"/>
</front>
<refcontent>ISO/IEC 14888-1</refcontent>
</reference>
<reference anchor="GostPkcs12">
<front>
<title>Information technology. Cryptographic Data Security. The transp
ort key containers.</title>
<author initials="A." surname="Potashnikov" fullname="A. Potashnikov
">
<organization/>
</author>
<author initials="E." surname="Karelina" fullname="E. Karelina">
<organization/>
</author>
<author initials="S." surname="Pianov" fullname="S. Pianov">
<organization/>
</author>
<author initials="A." surname="Naumenko" fullname="A. Naumenko">
<organization/>
</author>
</front> </front>
<refcontent>R 1323565.1.041–2022. Federal Agency on Technical Regulating and Metrology (In Russian)</refcontent> <seriesInfo name="ISO/IEC" value="14888-1"/>
</reference> </reference>
</references> </references>
</references> </references>
<section anchor="Examples"> <section anchor="Examples">
<name>Examples</name> <name>Examples</name>
<t>This section contains examples of using GOST cryptographic algorithms to create a PFX.</t> <t>This section contains examples of using GOST cryptographic algorithms to create a PFX.</t>
<section anchor="Data"> <section anchor="Data">
<name>Test data</name> <name>Test Data</name>
<t>In all examples the following data is used.</t> <t>In all examples, the following data is used.</t>
<section anchor="Test_cert"> <section anchor="Test_cert">
<name>Test certificate</name> <name>Test Certificate</name>
<t>This section contains a test certififcate in BASE64 format.</t> <t>This section contains a test certificate in BASE64 format.</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
MIICLjCCAdugAwIBAgIEAYy6hDAKBggqhQMHAQEDAjA4MQ0wCwYDVQQKEwRUSzI2 MIICLjCCAdugAwIBAgIEAYy6hDAKBggqhQMHAQEDAjA4MQ0wCwYDVQQKEwRUSzI2
MScwJQYDVQQDEx5DQSBUSzI2OiBHT1NUIDM0LjEwLTEyIDI1Ni1iaXQwHhcNMDEw MScwJQYDVQQDEx5DQSBUSzI2OiBHT1NUIDM0LjEwLTEyIDI1Ni1iaXQwHhcNMDEw
MTAxMDAwMDAwWhcNNDkxMjMxMDAwMDAwWjA7MQ0wCwYDVQQKEwRUSzI2MSowKAYD MTAxMDAwMDAwWhcNNDkxMjMxMDAwMDAwWjA7MQ0wCwYDVQQKEwRUSzI2MSowKAYD
VQQDEyFPUklHSU5BVE9SOiBHT1NUIDM0LjEwLTEyIDUxMi1iaXQwgaAwFwYIKoUD VQQDEyFPUklHSU5BVE9SOiBHT1NUIDM0LjEwLTEyIDUxMi1iaXQwgaAwFwYIKoUD
BwEBAQIwCwYJKoUDBwECAQIBA4GEAASBgLSLt1q8KQ4YZVxioU+1LV9QhE7MHR9g BwEBAQIwCwYJKoUDBwECAQIBA4GEAASBgLSLt1q8KQ4YZVxioU+1LV9QhE7MHR9g
BEh7S1yVNGlqt7+rNG5VFqmrPM74rbUsOlhV8M+zZKprXdk35Oz8lSW/n2oIUHZx BEh7S1yVNGlqt7+rNG5VFqmrPM74rbUsOlhV8M+zZKprXdk35Oz8lSW/n2oIUHZx
ikXIH/SSHj4rv3K/Puvz7hYTQSZl/xPdp78nUmjrEa6d5wfX8biEy2z0dgufFvAk ikXIH/SSHj4rv3K/Puvz7hYTQSZl/xPdp78nUmjrEa6d5wfX8biEy2z0dgufFvAk
Mw1Ua4gdXqDOo4GHMIGEMGMGA1UdIwRcMFqAFKxsDkxEZqJCluKfCTslZvPLpFMq Mw1Ua4gdXqDOo4GHMIGEMGMGA1UdIwRcMFqAFKxsDkxEZqJCluKfCTslZvPLpFMq
oTykOjA4MQ0wCwYDVQQKEwRUSzI2MScwJQYDVQQDEx5DQSBUSzI2OiBHT1NUIDM0 oTykOjA4MQ0wCwYDVQQKEwRUSzI2MScwJQYDVQQDEx5DQSBUSzI2OiBHT1NUIDM0
LjEwLTEyIDI1Ni1iaXSCBAGMuoEwHQYDVR0OBBYEFH4GVwmYDK1rCKhX7nkAWDrJ LjEwLTEyIDI1Ni1iaXSCBAGMuoEwHQYDVR0OBBYEFH4GVwmYDK1rCKhX7nkAWDrJ
16CkMAoGCCqFAwcBAQMCA0EACl6p8dAbpi9Hk+3mgMyI0WIh17IrlrSp/mB0F7Zz 16CkMAoGCCqFAwcBAQMCA0EACl6p8dAbpi9Hk+3mgMyI0WIh17IrlrSp/mB0F7Zz
Mt8XUD1Dwz3JrrnxeXnfMvOA5BdUJ9hCyDgMVAGs/IcEEA== Mt8XUD1Dwz3JrrnxeXnfMvOA5BdUJ9hCyDgMVAGs/IcEEA==
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="Test_key"> <section anchor="Test_key">
<name>Test key</name> <name>Test Key</name>
<t>This section contains a test key bytes in hexadecimal.</t> <t>This section contains test key bytes in hexadecimal.</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
F95A5D44C5245F63F2E7DF8E782C1924EADCB8D06C52D91023179786154CBDB1 F95A5D44C5245F63F2E7DF8E782C1924EADCB8D06C52D91023179786154CBDB1
561B4DF759D69F67EE1FBD5B68800E134BAA12818DA4F3AC75B0E5E6F9256911 561B4DF759D69F67EE1FBD5B68800E134BAA12818DA4F3AC75B0E5E6F9256911
]]></sourcecode> ]]></sourcecode>
</section> </section>
</section> </section>
<section anchor="PFXUnencrypted"> <section anchor="PFXUnencrypted">
<name>The example of a PFX with a password-protected key and unencry <name>Example of a PFX with a Password-Protected Key and Unencrypted
pted certificate.</name> Certificate</name>
<t>In this example the PKCS8SHroudedKeybag structure is used to stor <t>In this example, the PKCS8SHroudedKeybag structure is used to sto
e the key, which is placed in the Data structure. re the key, which is placed in the Data structure.
The certBag structure is used to store the certificate, which is pla ced in the Data structure. The certBag structure is used to store the certificate, which is pla ced in the Data structure.
A following password is used to encrypt the key and control the inte grity: The following password is used to encrypt the key and provide integr ity control:
"Пароль для PFX". "Пароль для PFX".
The password is in hexadecimal:</t> The password is in hexadecimal:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
D09FD0B0D180D0BED0BBD18C20D0B4D0BBD18F20504658 D09FD0B0D180D0BED0BBD18C20D0B4D0BBD18F20504658
]]></sourcecode> ]]></sourcecode>
<t>The key encryption algorithm identifier:</t> <t>The key encryption algorithm identifier:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
1.2.643.7.1.1.5.2.2 1.2.643.7.1.1.5.2.2
]]></sourcecode> ]]></sourcecode>
<section anchor="PFX_BASE64"> <section anchor="PFX_BASE64">
<name>PFX in BASE64 format</name> <name>PFX in BASE64 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
MIIFKwIBAzCCBMQGCSqGSIb3DQEHAaCCBLUEggSxMIIErTCCAswGCSqGSIb3DQEH MIIFKwIBAzCCBMQGCSqGSIb3DQEHAaCCBLUEggSxMIIErTCCAswGCSqGSIb3DQEH
AaCCAr0EggK5MIICtTCCArEGCyqGSIb3DQEMCgEDoIICSjCCAkYGCiqGSIb3DQEJ AaCCAr0EggK5MIICtTCCArEGCyqGSIb3DQEMCgEDoIICSjCCAkYGCiqGSIb3DQEJ
FgGgggI2BIICMjCCAi4wggHboAMCAQICBAGMuoQwCgYIKoUDBwEBAwIwODENMAsG FgGgggI2BIICMjCCAi4wggHboAMCAQICBAGMuoQwCgYIKoUDBwEBAwIwODENMAsG
A1UEChMEVEsyNjEnMCUGA1UEAxMeQ0EgVEsyNjogR09TVCAzNC4xMC0xMiAyNTYt A1UEChMEVEsyNjEnMCUGA1UEAxMeQ0EgVEsyNjogR09TVCAzNC4xMC0xMiAyNTYt
Yml0MB4XDTAxMDEwMTAwMDAwMFoXDTQ5MTIzMTAwMDAwMFowOzENMAsGA1UEChME Yml0MB4XDTAxMDEwMTAwMDAwMFoXDTQ5MTIzMTAwMDAwMFowOzENMAsGA1UEChME
VEsyNjEqMCgGA1UEAxMhT1JJR0lOQVRPUjogR09TVCAzNC4xMC0xMiA1MTItYml0 VEsyNjEqMCgGA1UEAxMhT1JJR0lOQVRPUjogR09TVCAzNC4xMC0xMiA1MTItYml0
MIGgMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQOBhAAEgYC0i7davCkOGGVcYqFP MIGgMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQOBhAAEgYC0i7davCkOGGVcYqFP
tS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO+K21LDpYVfDPs2Sqa13ZN+Ts tS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO+K21LDpYVfDPs2Sqa13ZN+Ts
/JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0EmZf8T3ae/J1Jo6xGunecH1/G4 /JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0EmZf8T3ae/J1Jo6xGunecH1/G4
hMts9HYLnxbwJDMNVGuIHV6gzqOBhzCBhDBjBgNVHSMEXDBagBSsbA5MRGaiQpbi hMts9HYLnxbwJDMNVGuIHV6gzqOBhzCBhDBjBgNVHSMEXDBagBSsbA5MRGaiQpbi
skipping to change at line 618 skipping to change at line 582
0dL5f6ga4aPWLrWbbgWERFOoOPyh4DotlPF37AQOwiEjsbyyRHq3HgbWiaxQRuAh 0dL5f6ga4aPWLrWbbgWERFOoOPyh4DotlPF37AQOwiEjsbyyRHq3HgbWiaxQRuAh
eqHOn4QVGY92/HFvJ7u3TcnQdLWhTe/lh1RHLNF3RnXtN9if9zC23laDZOiWZplU eqHOn4QVGY92/HFvJ7u3TcnQdLWhTe/lh1RHLNF3RnXtN9if9zC23laDZOiWZplU
yLrUiTCbHrtn1RppPDmLFNMt9dJ7KKgCkOi7Zm5nhqPChbywX13wcfYxVDAjBgkq yLrUiTCbHrtn1RppPDmLFNMt9dJ7KKgCkOi7Zm5nhqPChbywX13wcfYxVDAjBgkq
hkiG9w0BCRUxFgQUeVV0+dS25MICJChpmGc/8AoUwE0wLQYJKoZIhvcNAQkUMSAe hkiG9w0BCRUxFgQUeVV0+dS25MICJChpmGc/8AoUwE0wLQYJKoZIhvcNAQkUMSAe
HgBwADEAMgBGAHIAaQBlAG4AZABsAHkATgBhAG0AZTBeME4wCgYIKoUDBwEBAgME HgBwADEAMgBGAHIAaQBlAG4AZABsAHkATgBhAG0AZTBeME4wCgYIKoUDBwEBAgME
QAkBKw4ihn7pSIYTEhu0bcvTPZjI3WgVxCkUVlOsc80G69EKFEOTnObGJGSKJ51U QAkBKw4ihn7pSIYTEhu0bcvTPZjI3WgVxCkUVlOsc80G69EKFEOTnObGJGSKJ51U
KkOsXF0a7+VBZf3BcVVQh9UECIVEtO+VpuskAgIIAA== KkOsXF0a7+VBZf3BcVVQh9UECIVEtO+VpuskAgIIAA==
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="PFX_ASN"> <section anchor="PFX_ASN">
<name>PFX in ASN.1 format</name> <name>PFX in ASN.1 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
0 1323:SEQUENCE: 0 1323:SEQUENCE:
4 1: INTEGER: 3 4 1: INTEGER: 3
7 1220: SEQUENCE: 7 1220: SEQUENCE:
11 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 11 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
22 1205: CONTEXT SPECIFIC (0): 22 1205: CONTEXT SPECIFIC (0):
26 1201: OCTET STRING: 26 1201: OCTET STRING:
30 1197: SEQUENCE: 30 1197: SEQUENCE:
34 716: SEQUENCE: 34 716: SEQUENCE:
38 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 38 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
skipping to change at line 701 skipping to change at line 665
: 937E4ECFC9525BF9F6A0850 : 937E4ECFC9525BF9F6A0850
: 76718A45C81FF4921E3E2BB : 76718A45C81FF4921E3E2BB
: F72BF3EEBF3EE1613412665 : F72BF3EEBF3EE1613412665
: FF13DDA7BF275268EB11AE9 : FF13DDA7BF275268EB11AE9
: DE707D7F1B884CB6CF4760B : DE707D7F1B884CB6CF4760B
: 9F16F024330D546B881D5EA0CE : 9F16F024330D546B881D5EA0CE
451 135: CONTEXT SPECIFIC (3): 451 135: CONTEXT SPECIFIC (3):
454 132: SEQUENCE: 454 132: SEQUENCE:
457 99: SEQUENCE: 457 99: SEQUENCE:
459 3: OBJECT IDENTIFIER: 459 3: OBJECT IDENTIFIER:
: authorityKeyIdentifier [2.5.29.35] : authorityKeyIdentifier
: [2.5.29.35]
464 92: OCTET STRING: 464 92: OCTET STRING:
466 90: SEQUENCE: 466 90: SEQUENCE:
468 20: CONTEXT SPECIFIC (0): 468 20: CONTEXT SPECIFIC (0):
: AC6C0E4C4466A24296E2 : AC6C0E4C4466A24296E2
: 9F093B2566F3CBA4532A : 9F093B2566F3CBA4532A
490 60: CONTEXT SPECIFIC (1): 490 60: CONTEXT SPECIFIC (1):
492 58: CONTEXT SPECIFIC (4): 492 58: CONTEXT SPECIFIC (4):
494 56: SEQUENCE: 494 56: SEQUENCE:
496 13: SET: 496 13: SET:
498 11: SEQUENCE: 498 11: SEQUENCE:
500 3: OBJECT IDENTIFIER: 500 3: OBJECT IDENTIFIER:
: organizationName : organizationName
: [2.5.4.10] : [2.5.4.10]
505 4: PRINTABLE STRING:'TK26' 505 4: PRINTABLE STRING:
: 'TK26'
511 39: SET: 511 39: SET:
513 37: SEQUENCE: 513 37: SEQUENCE:
515 3: OBJECT IDENTIFIER: 515 3: OBJECT IDENTIFIER:
: commonName [2.5.4.3] : commonName
: [2.5.4.3]
520 30: PRINTABLE STRING: 520 30: PRINTABLE STRING:
: 'CA TK26: GOST ' : 'CA TK26: GOST '
: '34.10-12 256-bit' : '34.10-12 256-bit'
552 4: CONTEXT SPECIFIC (2): 552 4: CONTEXT SPECIFIC (2):
: 018CBA81 : 018CBA81
558 29: SEQUENCE: 558 29: SEQUENCE:
560 3: OBJECT IDENTIFIER: 560 3: OBJECT IDENTIFIER:
: subjectKeyIdentifier [2.5.29.14] : subjectKeyIdentifier
: [2.5.29.14]
565 22: OCTET STRING: 565 22: OCTET STRING:
567 20: OCTET STRING: 567 20: OCTET STRING:
: 7E065709980CAD6B08A8 : 7E065709980CAD6B08A8
: 57EE7900583AC9D7A0A4 : 57EE7900583AC9D7A0A4
589 10: SEQUENCE: 589 10: SEQUENCE:
591 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.3.2] 591 8: OBJECT IDENTIFIER:
: [1.2.643.7.1.1.3.2]
601 65: BIT STRING UnusedBits:0: 601 65: BIT STRING UnusedBits:0:
: 0A5EA9F1D01BA62F4793EDE680CC88D1 : 0A5EA9F1D01BA62F4793EDE680CC88D1
: 6221D7B22B96B4A9FE607417B67332DF : 6221D7B22B96B4A9FE607417B67332DF
: 17503D43C33DC9AEB9F17979DF32F380 : 17503D43C33DC9AEB9F17979DF32F380
: E4175427D842C8380C5401ACFC870410 : E4175427D842C8380C5401ACFC870410
668 84: SET: 668 84: SET:
670 35: SEQUENCE: 670 35: SEQUENCE:
672 9: OBJECT IDENTIFIER:localKeyID 672 9: OBJECT IDENTIFIER:localKeyID
: [1.2.840.113549.1.9.21] : [1.2.840.113549.1.9.21]
683 22: SET: 683 22: SET:
skipping to change at line 758 skipping to change at line 727
709 9: OBJECT IDENTIFIER:friendlyName 709 9: OBJECT IDENTIFIER:friendlyName
: [1.2.840.113549.1.9.20] : [1.2.840.113549.1.9.20]
720 32: SET: 720 32: SET:
722 30: BMP STRING:'p12FriendlyName' 722 30: BMP STRING:'p12FriendlyName'
754 473: SEQUENCE: 754 473: SEQUENCE:
758 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 758 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
769 458: CONTEXT SPECIFIC (0): 769 458: CONTEXT SPECIFIC (0):
773 454: OCTET STRING: 773 454: OCTET STRING:
777 450: SEQUENCE: 777 450: SEQUENCE:
781 446: SEQUENCE: 781 446: SEQUENCE:
785 11: OBJECT IDENTIFIER:pkcs-12-pkcs-8ShroudedKeyBag 785 11: OBJECT IDENTIFIER:
: [1.2.840.113549.1.12.10.1.2] : pkcs-12-pkcs-8ShroudedKeyBag
: [1.2.840.113549.1.12.10.1.2]
798 343: CONTEXT SPECIFIC (0): 798 343: CONTEXT SPECIFIC (0):
802 339: SEQUENCE: 802 339: SEQUENCE:
806 89: SEQUENCE: 806 89: SEQUENCE:
808 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.13] 808 9: OBJECT IDENTIFIER:
: [1.2.840.113549.1.5.13]
819 76: SEQUENCE: 819 76: SEQUENCE:
821 41: SEQUENCE: 821 41: SEQUENCE:
823 9: OBJECT IDENTIFIER: 823 9: OBJECT IDENTIFIER:
: [1.2.840.113549.1.5.12] : [1.2.840.113549.1.5.12]
834 28: SEQUENCE: 834 28: SEQUENCE:
836 8: OCTET STRING:'A7F837B34CC2E82A' 836 8: OCTET STRING:'A7F837B34CC2E82A'
846 2: INTEGER:2048 846 2: INTEGER:2048
850 12: SEQUENCE: 850 12: SEQUENCE:
852 8: OBJECT IDENTIFIER: 852 8: OBJECT IDENTIFIER:
: [1.2.643.7.1.1.4.2] : [1.2.643.7.1.1.4.2]
862 0: NULL: 862 0: NULL:
864 31: SEQUENCE: 864 31: SEQUENCE:
866 9: OBJECT IDENTIFIER:[1.2.643.7.1.1.5.2.2] 866 9: OBJECT IDENTIFIER:
: [1.2.643.7.1.1.5.2.2]
877 18: SEQUENCE: 877 18: SEQUENCE:
879 16: OCTET STRING: 879 16: OCTET STRING:
: 259ADD960DF68F265B00B3498B2A0973 : 259ADD960DF68F265B00B3498B2A0973
897 245: OCTET STRING: 897 245: OCTET STRING:
: 0CCBC469C6DB5913435529D724B5B281 : 0CCBC469C6DB5913435529D724B5B281
: 8ACAA22A5D3A30C0FF61C49C1677E2E1 : 8ACAA22A5D3A30C0FF61C49C1677E2E1
: 4E2CD85E52A88AA423E81696D1D86062 : 4E2CD85E52A88AA423E81696D1D86062
: 55855354AF626E273381A71A1106330D : 55855354AF626E273381A71A1106330D
: 7B5C4B440264EC692967ED78095B7492 : 7B5C4B440264EC692967ED78095B7492
: C2FD2A8FBAB3D8C8A8B43154543D13A1 : C2FD2A8FBAB3D8C8A8B43154543D13A1
skipping to change at line 803 skipping to change at line 775
: F730B6DE568364E896669954C8BAD489 : F730B6DE568364E896669954C8BAD489
: 309B1EBB67D51A693C398B14D32DF5D2 : 309B1EBB67D51A693C398B14D32DF5D2
: 7B28A80290E8BB666E6786A3C285BCB0 : 7B28A80290E8BB666E6786A3C285BCB0
: 5F5DF071F6 : 5F5DF071F6
1145 84: SET: 1145 84: SET:
1147 35: SEQUENCE: 1147 35: SEQUENCE:
1149 9: OBJECT IDENTIFIER:localKeyID 1149 9: OBJECT IDENTIFIER:localKeyID
: [1.2.840.113549.1.9.21] : [1.2.840.113549.1.9.21]
1160 22: SET: 1160 22: SET:
1162 20: OCTET STRING: 1162 20: OCTET STRING:
: 795574F9D4B6E4C20224286998673FF00A14C04D : 795574F9D4B6E4C20224
: 286998673FF00A14C04D
1184 45: SEQUENCE: 1184 45: SEQUENCE:
1186 9: OBJECT IDENTIFIER:friendlyName 1186 9: OBJECT IDENTIFIER:friendlyName
: [1.2.840.113549.1.9.20] : [1.2.840.113549.1.9.20]
1197 32: SET: 1197 32: SET:
1199 30: BMP STRING:'p12FriendlyName' 1199 30: BMP STRING:'p12FriendlyName'
1231 94: SEQUENCE: 1231 94: SEQUENCE:
1233 78: SEQUENCE: 1233 78: SEQUENCE:
1235 10: SEQUENCE: 1235 10: SEQUENCE:
1237 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.2.3] 1237 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.2.3]
1247 64: OCTET STRING: 1247 64: OCTET STRING:
: 09012B0E22867EE9488613121BB46DCB : 09012B0E22867EE9488613121BB46DCB
: D33D98C8DD6815C429145653AC73CD06 : D33D98C8DD6815C429145653AC73CD06
: EBD10A1443939CE6C624648A279D542A : EBD10A1443939CE6C624648A279D542A
: 43AC5C5D1AEFE54165FDC171555087D5 : 43AC5C5D1AEFE54165FDC171555087D5
1313 8: OCTET STRING:'8544B4EF95A6EB24' 1313 8: OCTET STRING:'8544B4EF95A6EB24'
1323 2: INTEGER:2048 1323 2: INTEGER:2048
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="Dec_key"> <section anchor="Dec_key">
<name>Decrypted key value in BASE64 format</name> <name>Decrypted Key Value in BASE64 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
MIHiAgEBMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQRAEWkl+eblsHWs86SNgRKq MIHiAgEBMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQRAEWkl+eblsHWs86SNgRKq
SxMOgGhbvR/uZ5/WWfdNG1axvUwVhpcXIxDZUmzQuNzqJBkseI7f5/JjXyTFRF1a SxMOgGhbvR/uZ5/WWfdNG1axvUwVhpcXIxDZUmzQuNzqJBkseI7f5/JjXyTFRF1a
+YGBgQG0i7davCkOGGVcYqFPtS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO +YGBgQG0i7davCkOGGVcYqFPtS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO
+K21LDpYVfDPs2Sqa13ZN+Ts/JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0Em +K21LDpYVfDPs2Sqa13ZN+Ts/JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0Em
Zf8T3ae/J1Jo6xGunecH1/G4hMts9HYLnxbwJDMNVGuIHV6gzg== Zf8T3ae/J1Jo6xGunecH1/G4hMts9HYLnxbwJDMNVGuIHV6gzg==
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="Dec_key_ASN"> <section anchor="Dec_key_ASN">
<name>Decrypted key value in ASN.1 format</name> <name>Decrypted Key Value in ASN.1 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
0 226:SEQUENCE : 0 226:SEQUENCE:
3 1: INTEGER : 1 3 1: INTEGER: 1
6 23: SEQUENCE : 6 23: SEQUENCE:
8 8: OBJECT IDENTIFIER : [1.2.643.7.1.1.1.2] 8 8: OBJECT IDENTIFIER: [1.2.643.7.1.1.1.2]
18 11: SEQUENCE : 18 11: SEQUENCE:
20 9: OBJECT IDENTIFIER : [1.2.643.7.1.2.1.2.1] 20 9: OBJECT IDENTIFIER: [1.2.643.7.1.2.1.2.1]
31 64: OCTET STRING : 31 64: OCTET STRING:
: 116925F9E6E5B075ACF3A48D8112AA4B130E80685BBD1FEE679FD6 : 116925F9E6E5B075ACF3A48D8112AA4B130E80685BBD1FEE679FD6
: 59F74D1B56B1BD4C158697172310D9526CD0B8DCEA24192C788EDF : 59F74D1B56B1BD4C158697172310D9526CD0B8DCEA24192C788EDF
: E7F2635F24C5445D5AF9 : E7F2635F24C5445D5AF9
97 129: CONTEXT SPECIFIC (1) : 97 129: CONTEXT SPECIFIC (1):
: 01B48BB75ABC290E18655C62A14FB52D5F50844ECC1D1F6004487B : 01B48BB75ABC290E18655C62A14FB52D5F50844ECC1D1F6004487B
: 4B5C9534696AB7BFAB346E5516A9AB3CCEF8ADB52C3A5855F0CFB3 : 4B5C9534696AB7BFAB346E5516A9AB3CCEF8ADB52C3A5855F0CFB3
: 64AA6B5DD937E4ECFC9525BF9F6A085076718A45C81FF4921E3E2B : 64AA6B5DD937E4ECFC9525BF9F6A085076718A45C81FF4921E3E2B
: BF72BF3EEBF3EE1613412665FF13DDA7BF275268EB11AE9DE707D7 : BF72BF3EEBF3EE1613412665FF13DDA7BF275268EB11AE9DE707D7
: F1B884CB6CF4760B9F16F024330D546B881D5EA0CE : F1B884CB6CF4760B9F16F024330D546B881D5EA0CE
]]></sourcecode> ]]></sourcecode>
</section> </section>
</section> </section>
<section anchor="PFXEncrypted"> <section anchor="PFXEncrypted">
<name>The example of a PFX with a password-protected key and a passw <name>Example of a PFX with a Password-Protected Key and a Password-
ord-protected certificate.</name> Protected Certificate</name>
<t>In this example the PKCS8SHroudedKeybag structure is used to stor <t>In this example, the PKCS8SHroudedKeybag structure is used to sto
e the key, which is placed in the Data structure (see <xref target="RFC5652"/>). re the key, which is placed in the Data structure (see <xref target="RFC5652"/>)
.
The certBag structure is used to store the certificate, which is pla ced in the EncryptedData structure (see <xref target="RFC5652"/>). The certBag structure is used to store the certificate, which is pla ced in the EncryptedData structure (see <xref target="RFC5652"/>).
A following password is used to encrypt the key and control the inte The following password is used to encrypt the key and provide integr
grity. The password is in hexadecimal.</t> ity control. The password is in hexadecimal.</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
0xD09FD0B0D180D0BED0BBD18C20D0B4D0BBD18F20504658 D09FD0B0D180D0BED0BBD18C20D0B4D0BBD18F20504658
]]></sourcecode> ]]></sourcecode>
<t>The key encryption algorithm identifier:</t> <t>The key encryption algorithm identifier:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
1.2.643.7.1.1.5.1.1 1.2.643.7.1.1.5.1.1
]]></sourcecode> ]]></sourcecode>
<t>The certificate encryption algorithm identifier:</t> <t>The certificate encryption algorithm identifier:</t>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
1.2.643.7.1.1.5.1.2 1.2.643.7.1.1.5.1.2
]]></sourcecode> ]]></sourcecode>
<section anchor="PFX_BASE64_Ex2"> <section anchor="PFX_BASE64_Ex2">
<name>PFX in BASE64 format</name> <name>PFX in BASE64 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
MIIFjAIBAzCCBSUGCSqGSIb3DQEHAaCCBRYEggUSMIIFDjCCA0EGCSqGSIb3DQEH MIIFjAIBAzCCBSUGCSqGSIb3DQEHAaCCBRYEggUSMIIFDjCCA0EGCSqGSIb3DQEH
BqCCAzIwggMuAgEAMIIDJwYJKoZIhvcNAQcBMFUGCSqGSIb3DQEFDTBIMCkGCSqG BqCCAzIwggMuAgEAMIIDJwYJKoZIhvcNAQcBMFUGCSqGSIb3DQEFDTBIMCkGCSqG
SIb3DQEFDDAcBAgUuSVGsSwGjQICCAAwDAYIKoUDBwEBBAIFADAbBgkqhQMHAQEF SIb3DQEFDDAcBAgUuSVGsSwGjQICCAAwDAYIKoUDBwEBBAIFADAbBgkqhQMHAQEF
AQIwDgQM9Hk3dagtS48+G/x+gIICwWGPqxxN+sTrKbruRf9R5Ya9cf5AtO1frqMn AQIwDgQM9Hk3dagtS48+G/x+gIICwWGPqxxN+sTrKbruRf9R5Ya9cf5AtO1frqMn
f1eULfmZmTg/BdE51QQ+Vbnh3v1kmspr6h2+e4Wli+ndEeCWG6A6X/G22h/RAHW2 f1eULfmZmTg/BdE51QQ+Vbnh3v1kmspr6h2+e4Wli+ndEeCWG6A6X/G22h/RAHW2
YrVmf6cCWxW+YrqzT4h/8RQL/9haunD5LmHPLVsYrEai0OwbgXayDSwARVJQLQYq YrVmf6cCWxW+YrqzT4h/8RQL/9haunD5LmHPLVsYrEai0OwbgXayDSwARVJQLQYq
sLNmZK5ViN+fRiS5wszVJ3AtVq8EuPt41aQEKwPy2gmH4S6WmnQRC6W7aoqmIifF sLNmZK5ViN+fRiS5wszVJ3AtVq8EuPt41aQEKwPy2gmH4S6WmnQRC6W7aoqmIifF
PJENJNn5K2M1J6zNESs6bFtYNKMArNqtvv3rioY6eAaaLy6AV6ljsekmqodHmQjv PJENJNn5K2M1J6zNESs6bFtYNKMArNqtvv3rioY6eAaaLy6AV6ljsekmqodHmQjv
Y4eEioJs0xhpXhZY69PXT+ZBeHv6MSheBhwXqxAd1DqtPTafMjNK8rqKCap9TtPG Y4eEioJs0xhpXhZY69PXT+ZBeHv6MSheBhwXqxAd1DqtPTafMjNK8rqKCap9TtPG
vONvo5W9dgwegxRRQzlum8dzV4m1W9Aq4W7t8/UcxDWRz3k6ijFPlGaA9+8ZMTEO vONvo5W9dgwegxRRQzlum8dzV4m1W9Aq4W7t8/UcxDWRz3k6ijFPlGaA9+8ZMTEO
skipping to change at line 907 skipping to change at line 880
kG9xhLFzoD16dhtqX0+/dQg9G8pE5EzCBIYRXLm1Arcz9k7KVsTJuNMjFrr7EQuu kG9xhLFzoD16dhtqX0+/dQg9G8pE5EzCBIYRXLm1Arcz9k7KVsTJuNMjFrr7EQuu
Tr80ATSQOtsq50zpFyrpznVPGCrOdIjpymZxNdvw48bZxqTtRVDxCYATOGqz0pwH Tr80ATSQOtsq50zpFyrpznVPGCrOdIjpymZxNdvw48bZxqTtRVDxCYATOGqz0pwH
ClWULHD9LIajLMB2GhBKyQw6ujIlltJs0T+WNdX/AT2FLi1LFSS3+Cj9MVQwIwYJ ClWULHD9LIajLMB2GhBKyQw6ujIlltJs0T+WNdX/AT2FLi1LFSS3+Cj9MVQwIwYJ
KoZIhvcNAQkVMRYEFHlVdPnUtuTCAiQoaZhnP/AKFMBNMC0GCSqGSIb3DQEJFDEg KoZIhvcNAQkVMRYEFHlVdPnUtuTCAiQoaZhnP/AKFMBNMC0GCSqGSIb3DQEJFDEg
Hh4AcAAxADIARgByAGkAZQBuAGQAbAB5AE4AYQBtAGUwXjBOMAoGCCqFAwcBAQID Hh4AcAAxADIARgByAGkAZQBuAGQAbAB5AE4AYQBtAGUwXjBOMAoGCCqFAwcBAQID
BEDp4e22JmXdnvR0xA99yQuzQuJ8pxBeOpsLm2dZQqt3Fje5zqW1uk/7VOcfV5r2 BEDp4e22JmXdnvR0xA99yQuzQuJ8pxBeOpsLm2dZQqt3Fje5zqW1uk/7VOcfV5r2
bKm8nsLOs2rPT8hBOoeAZvOIBAjGIUHw6IjG2QICCAA= bKm8nsLOs2rPT8hBOoeAZvOIBAjGIUHw6IjG2QICCAA=
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="PFX_ASN_Ex2"> <section anchor="PFX_ASN_Ex2">
<name>PFX in ASN.1 format</name> <name>PFX in ASN.1 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
0 1420:SEQUENCE: 0 1420:SEQUENCE:
4 1: INTEGER:3 4 1: INTEGER:3
7 1317: SEQUENCE: 7 1317: SEQUENCE:
11 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 11 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
22 1302: CONTEXT SPECIFIC (0): 22 1302: CONTEXT SPECIFIC (0):
26 1298: OCTET STRING: 26 1298: OCTET STRING:
30 1294: SEQUENCE: 30 1294: SEQUENCE:
34 833: SEQUENCE: 34 833: SEQUENCE:
38 9: OBJECT IDENTIFIER:encryptedData [1.2.840.113549.1.7.6] 38 9: OBJECT IDENTIFIER:
49 818: CONTEXT SPECIFIC (0): : encryptedData [1.2.840.113549.1.7.6]
53 814: SEQUENCE: 49 818: CONTEXT SPECIFIC (0):
57 1: INTEGER:0 53 814: SEQUENCE:
60 807: SEQUENCE: 57 1: INTEGER:0
64 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 60 807: SEQUENCE:
75 85: SEQUENCE: 64 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
77 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.13] 75 85: SEQUENCE:
88 72: SEQUENCE: 77 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.13]
90 41: SEQUENCE: 88 72: SEQUENCE:
92 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.12] 90 41: SEQUENCE:
103 28: SEQUENCE: 92 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.12]
105 8: OCTET STRING:'14B92546B12C068D' 103 28: SEQUENCE:
115 2: INTEGER:2048 105 8: OCTET STRING:'14B92546B12C068D'
119 12: SEQUENCE: 115 2: INTEGER:2048
121 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.4.2] 119 12: SEQUENCE:
131 0: NULL: 121 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.4.2]
133 27: SEQUENCE: 131 0: NULL:
135 9: OBJECT IDENTIFIER:[1.2.643.7.1.1.5.1.2] 133 27: SEQUENCE:
146 14: SEQUENCE: 135 9: OBJECT IDENTIFIER:[1.2.643.7.1.1.5.1.2]
148 12: OCTET STRING: 146 14: SEQUENCE:
: F4793775A82D4B8F3E1BFC7E 148 12: OCTET STRING:
162 705: CONTEXT SPECIFIC (0): : F4793775A82D4B8F3E1BFC7E
: 618FAB1C4DFAC4EB29BAEE45FF51E586BD7 162 705: CONTEXT SPECIFIC (0):
: 1FE40B4ED5FAEA3277F57942DF99999383F : 618FAB1C4DFAC4EB29BAEE45FF51E586BD7
: 05D139D5043E55B9E1DEFD649ACA6BEA1DB : 1FE40B4ED5FAEA3277F57942DF99999383F
: E7B85A58BE9DD11E0961BA03A5FF1B6DA1F : 05D139D5043E55B9E1DEFD649ACA6BEA1DB
: D10075B662B5667FA7025B15BE62BAB34F8 : E7B85A58BE9DD11E0961BA03A5FF1B6DA1F
: 87FF1140BFFD85ABA70F92E61CF2D5B18AC : D10075B662B5667FA7025B15BE62BAB34F8
: 46A2D0EC1B8176B20D2C004552502D062AB : 87FF1140BFFD85ABA70F92E61CF2D5B18AC
: 0B36664AE5588DF9F4624B9C2CCD527702D : 46A2D0EC1B8176B20D2C004552502D062AB
: 56AF04B8FB78D5A4042B03F2DA0987E12E9 : 0B36664AE5588DF9F4624B9C2CCD527702D
: 69A74110BA5BB6A8AA62227C53C910D24D9 : 56AF04B8FB78D5A4042B03F2DA0987E12E9
: F92B633527ACCD112B3A6C5B5834A300ACD : 69A74110BA5BB6A8AA62227C53C910D24D9
: AADBEFDEB8A863A78069A2F2E8057A963B1 : F92B633527ACCD112B3A6C5B5834A300ACD
: E926AA87479908EF6387848A826CD318695 : AADBEFDEB8A863A78069A2F2E8057A963B1
: E1658EBD3D74FE641787BFA31285E061C17 : E926AA87479908EF6387848A826CD318695
: AB101DD43AAD3D369F32334AF2BA8A09AA7 : E1658EBD3D74FE641787BFA31285E061C17
: D4ED3C6BCE36FA395BD760C1E8314514339 : AB101DD43AAD3D369F32334AF2BA8A09AA7
: 6E9BC7735789B55BD02AE16EEDF3F51CC43 : D4ED3C6BCE36FA395BD760C1E8314514339
: 591CF793A8A314F946680F7EF1931310E44 : 6E9BC7735789B55BD02AE16EEDF3F51CC43
: 784146F33A398DBF54D3716E0C567C662E3 : 591CF793A8A314F946680F7EF1931310E44
: F1A528B762709920F98111EE6553F5EFECA : 784146F33A398DBF54D3716E0C567C662E3
: 8F316EB06337F05F1847AD64E3F40DA4A23 : F1A528B762709920F98111EE6553F5EFECA
: 5414BFBD7860A7DA510CE7B21186CC82EFD : 8F316EB06337F05F1847AD64E3F40DA4A23
: 4D1880FADA9975F89237BEE6B08B698332B : 5414BFBD7860A7DA510CE7B21186CC82EFD
: 9A4B8CF50154F6FFE444FF9CDAE0470EE38 : 4D1880FADA9975F89237BEE6B08B698332B
: 6114512361174F29EFEC37BF1A656AD1965 : 9A4B8CF50154F6FFE444FF9CDAE0470EE38
: C7F5F988B0F05D9367F7C249FEAF0A2AAC4 : 6114512361174F29EFEC37BF1A656AD1965
: BA28CC23F6C2032954FCCD0330A840A3D8F : C7F5F988B0F05D9367F7C249FEAF0A2AAC4
: 7D5461265D8B87EC7D15980C932AFFC14F9 : BA28CC23F6C2032954FCCD0330A840A3D8F
: FDEADBA8FA80A96EABF7354C2964CFFC2E2 : 7D5461265D8B87EC7D15980C932AFFC14F9
: E31AA04C7B58C3FF9F446D3F3FA5DA74D12 : FDEADBA8FA80A96EABF7354C2964CFFC2E2
: 2208FD36237A72DF5475E300739526C55E0 : E31AA04C7B58C3FF9F446D3F3FA5DA74D12
: AEFEDDC4B0C60741D74D0A1AC593F21CD8F : 2208FD36237A72DF5475E300739526C55E0
: 74840EC81E3F7A7A56D2AACA7A049BC9936 : AEFEDDC4B0C60741D74D0A1AC593F21CD8F
: E175588E33978988F3D2FC753401524872E : 74840EC81E3F7A7A56D2AACA7A049BC9936
: 39C905D99430FC93512B61DB5D12C3EDCFF : E175588E33978988F3D2FC753401524872E
: E33B92A5B9E6C021084683AE497B46B893F : 39C905D99430FC93512B61DB5D12C3EDCFF
: EB5B71611744A336501822DEA063A67EC35 : E33B92A5B9E6C021084683AE497B46B893F
: 35F0CB6CAD133DA4375A765F264FF55F87D : EB5B71611744A336501822DEA063A67EC35
: F81F1D641655C6042EEF494C3C419EC5B52 : 35F0CB6CAD133DA4375A765F264FF55F87D
: 4607B850829F28BD27457DD92B5B233125C : F81F1D641655C6042EEF494C3C419EC5B52
: 656B555E6E : 4607B850829F28BD27457DD92B5B233125C
871 453: SEQUENCE: : 656B555E6E
875 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1] 871 453: SEQUENCE:
886 438: CONTEXT SPECIFIC (0): 875 9: OBJECT IDENTIFIER:data [1.2.840.113549.1.7.1]
890 434: OCTET STRING: 886 438: CONTEXT SPECIFIC (0):
894 430: SEQUENCE: 890 434: OCTET STRING:
898 426: SEQUENCE: 894 430: SEQUENCE:
902 11: OBJECT IDENTIFIER:pkcs-12-pkcs-8ShroudedKeyBag [1.2.840 898 426: SEQUENCE:
.113549.1.12.10.1.2] 902 11: OBJECT IDENTIFIER:
915 323: CONTEXT SPECIFIC (0): : pkcs-12-pkcs-8ShroudedKeyBag
919 319: SEQUENCE: : [1.2.840.113549.1.12.10.1.2]
923 85: SEQUENCE: 915 323: CONTEXT SPECIFIC (0):
925 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.13] 919 319: SEQUENCE:
936 72: SEQUENCE: 923 85: SEQUENCE:
938 41: SEQUENCE: 925 9: OBJECT IDENTIFIER:
940 9: OBJECT IDENTIFIER:[1.2.840.113549.1.5.12] : [1.2.840.113549.1.5.13]
951 28: SEQUENCE: 936 72: SEQUENCE:
953 8: OCTET STRING: 938 41: SEQUENCE:
: FD04424D0ED6DC2F 940 9: OBJECT IDENTIFIER:
963 2: INTEGER:2048 : [1.2.840.113549.1.5.12]
967 12: SEQUENCE: 951 28: SEQUENCE:
969 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.4.2] 953 8: OCTET STRING:
979 0: NULL: : FD04424D0ED6DC2F
981 27: SEQUENCE: 963 2: INTEGER:2048
983 9: OBJECT IDENTIFIER:[1.2.643.7.1.1.5.1.1] 967 12: SEQUENCE:
994 14: SEQUENCE: 969 8: OBJECT IDENTIFIER:
996 12: OCTET STRING: : [1.2.643.7.1.1.4.2]
: F0C52AA00000000000000000 979 0: NULL:
981 27: SEQUENCE:
983 9: OBJECT IDENTIFIER:
: [1.2.643.7.1.1.5.1.1]
994 14: SEQUENCE:
996 12: OCTET STRING:
: F0C52AA00000000000000000
1010 229: OCTET STRING: 1010 229: OCTET STRING:
: 2A8FD988DD10DF2B984C77411E630B3B7E864AFF900DAF6C14 : 2A8FD988DD10DF2B984C77411E630B3B
84FE6A9C38C : 7E864AFF900DAF6C1484FE6A9C38C066
: 06609FBEA513127EC2EBE59D2F4F0A17D656E82F765FFD5C98 : 09FBEA513127EC2EBE59D2F4F0A17D65
10BEFAFD0AE : 6E82F765FFD5C9810BEFAFD0AEE293A1
: E293A1E08097A65721732D1D1A4FCCCC8B474550B9C0ADA74F : E08097A65721732D1D1A4FCCCC8B4745
1C10E242939 : 50B9C0ADA74F1C10E24293906F7184B1
: 06F7184B173A03D7A761B6A5F4FBF75083D1BCA44E44CC2048 : 73A03D7A761B6A5F4FBF75083D1BCA44
6115CB9B502 : E44CC20486115CB9B502B733F64ECA56
: B733F64ECA56C4C9B8D32316BAFB110BAE4EBF340134903ADB : C4C9B8D32316BAFB110BAE4EBF340134
2AE74CE9172 : 903ADB2AE74CE9172AE9CE754F182ACE
: AE9CE754F182ACE7488E9CA667135DBF0E3C6D9C6A4ED4550F : 7488E9CA667135DBF0E3C6D9C6A4ED45
1098013386A : 50F1098013386AB3D29C070A55942C70
: B3D29C070A55942C70FD2C86A32CC0761A104AC90C3ABA3225 : FD2C86A32CC0761A104AC90C3ABA3225
96D26CD13F9 : 96D26CD13F9635D5FF013D852E2D4B15
: 635D5FF013D852E2D4B1524B7F828FD : 24B7F828FD
1242 84: SET: 1242 84: SET:
1244 35: SEQUENCE: 1244 35: SEQUENCE:
1246 9: OBJECT IDENTIFIER:localKeyID [1.2.840.113549.1.9.21] 1246 9: OBJECT IDENTIFIER:localKeyID
: [1.2.840.113549.1.9.21]
1257 22: SET: 1257 22: SET:
1259 20: OCTET STRING: 1259 20: OCTET STRING:
: 795574F9D4B6E4C20224286998673FF00A14C04D : 795574F9D4B6E4C20224
: 286998673FF00A14C04D
1281 45: SEQUENCE: 1281 45: SEQUENCE:
1283 9: OBJECT IDENTIFIER:friendlyName [1.2.840.113549.1.9.2 1283 9: OBJECT IDENTIFIER:
0] : friendlyName [1.2.840.113549.1.9.20]
1294 32: SET: 1294 32: SET:
1296 30: BMP STRING:'p12FriendlyName' 1296 30: BMP STRING:'p12FriendlyName'
1328 94: SEQUENCE: 1328 94: SEQUENCE:
1330 78: SEQUENCE: 1330 78: SEQUENCE:
1332 10: SEQUENCE: 1332 10: SEQUENCE:
1334 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.2.3] 1334 8: OBJECT IDENTIFIER:[1.2.643.7.1.1.2.3]
1344 64: OCTET STRING: 1344 64: OCTET STRING:
: E9E1EDB62665DD9EF474C40F7DC90BB342E27CA7105E3A9B0B9B675942AB7716 : E9E1EDB62665DD9EF474C40F7DC90BB3
37B9CEA5B5BA4FFB54E71F57 : 42E27CA7105E3A9B0B9B675942AB7716
: 9AF66CA9BC9EC2CEB36ACF4FC8413A878066F388 : 37B9CEA5B5BA4FFB54E71F579AF66CA9
: BC9EC2CEB36ACF4FC8413A878066F388
1410 8: OCTET STRING:'C62141F0E888C6D9' 1410 8: OCTET STRING:'C62141F0E888C6D9'
1420 2: INTEGER:2048 1420 2: INTEGER:2048
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="Dec_key_Ex2"> <section anchor="Dec_key_Ex2">
<name>Decrypted key value in BASE64 format</name> <name>Decrypted Key Value in BASE64 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type=""><![CDATA[
MIHiAgEBMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQRAEWkl+eblsHWs86SNgRKq MIHiAgEBMBcGCCqFAwcBAQECMAsGCSqFAwcBAgECAQRAEWkl+eblsHWs86SNgRKq
SxMOgGhbvR/uZ5/WWfdNG1axvUwVhpcXIxDZUmzQuNzqJBkseI7f5/JjXyTFRF1a SxMOgGhbvR/uZ5/WWfdNG1axvUwVhpcXIxDZUmzQuNzqJBkseI7f5/JjXyTFRF1a
+YGBgQG0i7davCkOGGVcYqFPtS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO +YGBgQG0i7davCkOGGVcYqFPtS1fUIROzB0fYARIe0tclTRpare/qzRuVRapqzzO
+K21LDpYVfDPs2Sqa13ZN+Ts/JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0Em +K21LDpYVfDPs2Sqa13ZN+Ts/JUlv59qCFB2cYpFyB/0kh4+K79yvz7r8+4WE0Em
Zf8T3ae/J1Jo6xGunecH1/G4hMts9HYLnxbwJDMNVGuIHV6gzg== Zf8T3ae/J1Jo6xGunecH1/G4hMts9HYLnxbwJDMNVGuIHV6gzg==
]]></sourcecode> ]]></sourcecode>
</section> </section>
<section anchor="Dec_key_ASN_Ex2"> <section anchor="Dec_key_ASN_Ex2">
<name>Decrypted key value in ASN.1 format</name> <name>Decrypted Key Value in ASN.1 Format</name>
<sourcecode type="asn.1"><![CDATA[ <sourcecode type="asn.1"><![CDATA[
0 226:SEQUENCE : 0 226:SEQUENCE:
3 1: INTEGER : 1 3 1: INTEGER: 1
6 23: SEQUENCE : 6 23: SEQUENCE:
8 8: OBJECT IDENTIFIER : [1.2.643.7.1.1.1.2] 8 8: OBJECT IDENTIFIER: [1.2.643.7.1.1.1.2]
18 11: SEQUENCE : 18 11: SEQUENCE:
20 9: OBJECT IDENTIFIER : [1.2.643.7.1.2.1.2.1] 20 9: OBJECT IDENTIFIER: [1.2.643.7.1.2.1.2.1]
31 64: OCTET STRING : 31 64: OCTET STRING:
: 116925F9E6E5B075ACF3A48D8112AA4B130E80685BBD1FEE679FD6 : 116925F9E6E5B075ACF3A48D8112AA4B130E80685BBD1FEE679FD6
: 59F74D1B56B1BD4C158697172310D9526CD0B8DCEA24192C788EDF : 59F74D1B56B1BD4C158697172310D9526CD0B8DCEA24192C788EDF
: E7F2635F24C5445D5AF9 : E7F2635F24C5445D5AF9
97 129: CONTEXT SPECIFIC (1) : 97 129: CONTEXT SPECIFIC (1):
: 01B48BB75ABC290E18655C62A14FB52D5F50844ECC1D1F6004487B : 01B48BB75ABC290E18655C62A14FB52D5F50844ECC1D1F6004487B
: 4B5C9534696AB7BFAB346E5516A9AB3CCEF8ADB52C3A5855F0CFB3 : 4B5C9534696AB7BFAB346E5516A9AB3CCEF8ADB52C3A5855F0CFB3
: 64AA6B5DD937E4ECFC9525BF9F6A085076718A45C81FF4921E3E2B : 64AA6B5DD937E4ECFC9525BF9F6A085076718A45C81FF4921E3E2B
: BF72BF3EEBF3EE1613412665FF13DDA7BF275268EB11AE9DE707D7 : BF72BF3EEBF3EE1613412665FF13DDA7BF275268EB11AE9DE707D7
: F1B884CB6CF4760B9F16F024330D546B881D5EA0CE : F1B884CB6CF4760B9F16F024330D546B881D5EA0CE
]]></sourcecode> ]]></sourcecode>
</section> </section>
</section> </section>
</section> </section>
<section anchor="Acknowledgments" numbered="false"> <section anchor="Acknowledgments" numbered="false">
<name>Acknowledgments</name> <name>Acknowledgments</name>
<t>The author thanks <contact fullname="Potashnikov Alexander"/>, <contact <t>The author thanks <contact fullname="Alexander Potashnikov"/>, <contact
fullname="Pianov Semen"/> and <contact fullname="Smyslov Valery"/> for their ca fullname="Semen Pianov"/>, and <contact fullname="Valery Smyslov"/> for their c
reful readings and useful comments.</t> areful readings and useful comments,
and <contact fullname="Alexander Chelpanov"/> for his help with the reg
istration of identifiers.</t>
</section> </section>
</back> </rfc> </back>
</rfc>
 End of changes. 106 change blocks. 
541 lines changed or deleted 514 lines changed or added

This html diff was produced by rfcdiff 1.48.