URL: https://github.com/freeipa/freeipa/pull/884 Author: npmccallum Title: #884: ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace Action: opened
PR body: """ For some unknown reason, when I wrote the ipa-otptoken-import script I used bad input data which had the PBKDF2 parameters in the wrong XML namespace. I have corrected this input data to match RFC 6030. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/884/head:pr884 git checkout pr884
From 0d083d23eb9fb5b85dec5fc53aaa9ab223981f30 Mon Sep 17 00:00:00 2001 From: Nathaniel McCallum <npmccal...@redhat.com> Date: Tue, 20 Jun 2017 10:31:15 -0400 Subject: [PATCH] ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace For some unknown reason, when I wrote the ipa-otptoken-import script I used bad input data which had the PBKDF2 parameters in the wrong XML namespace. I have corrected this input data to match RFC 6030. --- ipaserver/install/ipa_otptoken_import.py | 11 ++++++----- ipatests/test_ipaserver/data/pskc-figure7.xml | 16 ++++++++-------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/ipaserver/install/ipa_otptoken_import.py b/ipaserver/install/ipa_otptoken_import.py index 2580e2cfc9..b97803b648 100644 --- a/ipaserver/install/ipa_otptoken_import.py +++ b/ipaserver/install/ipa_otptoken_import.py @@ -52,6 +52,7 @@ class ValidationError(Exception): def fetchAll(element, xpath, conv=lambda x: x): return [conv(e) for e in element.xpath(xpath, namespaces={ + "pkcs5": "http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#", "pskc": "urn:ietf:params:xml:ns:keyprov:pskc", "xenc11": "http://www.w3.org/2009/xmlenc11#", "xenc": "http://www.w3.org/2001/04/xmlenc#", @@ -175,18 +176,18 @@ def derive(self, masterkey): class PBKDF2KeyDerivation(XMLKeyDerivation): def __init__(self, enckey): - params = fetch(enckey, "./xenc11:DerivedKey/xenc11:KeyDerivationMethod/xenc11:PBKDF2-params") + params = fetch(enckey, "./xenc11:DerivedKey/xenc11:KeyDerivationMethod/pkcs5:PBKDF2-params") if params is None: raise ValueError("XML file is missing PBKDF2 parameters!") salt = fetch( - params, "./xenc11:Salt/xenc11:Specified/text()", base64.b64decode) + params, "./pkcs5:Salt/pkcs5:Specified/text()", base64.b64decode) itrs = fetch( - params, "./xenc11:IterationCount/text()", int) + params, "./pkcs5:IterationCount/text()", int) klen = fetch( - params, "./xenc11:KeyLength/text()", int) + params, "./pkcs5:KeyLength/text()", int) hmod = fetch( - params, "./xenc11:PRF/@Algorithm", convertHMACType, hashes.SHA1) + params, "./pkcs5:PRF/@Algorithm", convertHMACType, hashes.SHA1) if salt is None: raise ValueError("XML file is missing PBKDF2 salt!") diff --git a/ipatests/test_ipaserver/data/pskc-figure7.xml b/ipatests/test_ipaserver/data/pskc-figure7.xml index 1fb04fc319..808e272a54 100644 --- a/ipatests/test_ipaserver/data/pskc-figure7.xml +++ b/ipatests/test_ipaserver/data/pskc-figure7.xml @@ -8,14 +8,14 @@ <xenc11:DerivedKey> <xenc11:KeyDerivationMethod Algorithm="http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2"> - <xenc11:PBKDF2-params> - <xenc11:Salt> - <xenc11:Specified>Ej7/PEpyEpw=</xenc11:Specified> - </xenc11:Salt> - <xenc11:IterationCount>1000</xenc11:IterationCount> - <xenc11:KeyLength>16</xenc11:KeyLength> - <xenc11:PRF/> - </xenc11:PBKDF2-params> + <pkcs5:PBKDF2-params> + <Salt> + <Specified>Ej7/PEpyEpw=</Specified> + </Salt> + <IterationCount>1000</IterationCount> + <KeyLength>16</KeyLength> + <PRF/> + </pkcs5:PBKDF2-params> </xenc11:KeyDerivationMethod> <xenc:ReferenceList> <xenc:DataReference URI="#ED"/>
_______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-le...@lists.fedorahosted.org