crypto

Author: tanmay-hc

builder/azure/arm/config.go

@@ -817,7 +817,7 @@ func (c *Config) formatCertificateForKeyVault(privateKey *rsa.PrivateKey) (strin
 		return "", err
 	}
 
-	pfxBytes, err := pkcs12.Encode(derBytes, privateKey, c.tmpCertificatePassword)
+	pfxBytes, err := pkcs12.EncodeModern(derBytes, privateKey, c.tmpCertificatePassword)
 	if err != nil {
 		err = fmt.Errorf("Failed to encode certificate as PFX: %s", err)
 		return "", err

builder/azure/dtl/config.go

@@ -377,7 +377,7 @@ func (c *Config) createCertificate() (string, string, error) {
 		return "", "", err
 	}
 
-	pfxBytes, err := pkcs12.Encode(derBytes, privateKey, c.tmpCertificatePassword)
+	pfxBytes, err := pkcs12.EncodeModern(derBytes, privateKey, c.tmpCertificatePassword)
 	if err != nil {
 		err = fmt.Errorf("Failed to encode certificate as PFX: %s", err)
 		return "", "", err

builder/azure/pkcs12/crypto.go

@@ -6,25 +6,34 @@ package pkcs12
 
 import (
 	"bytes"
+	"crypto/aes"
 	"crypto/cipher"
 	"crypto/des"
 	"crypto/rand"
+	"crypto/sha256"
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"errors"
 	"io"
 
 	"github.com/hashicorp/packer-plugin-azure/builder/azure/pkcs12/rc2"
+	"golang.org/x/crypto/pbkdf2"
 )
 
 const (
-	pbeIterationCount = 2048
-	pbeSaltSizeBytes  = 8
+	pbeIterationCount       = 2048
+	pbeIterationCountModern = 100000 // OWASP 2021 baseline for PBKDF2, balances security and performance
+	pbeSaltSizeBytes        = 8
 )
 
 var (
 	oidPBEWithSHAAnd3KeyTripleDESCBC = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 3})
 	oidPBEWithSHAAnd40BitRC2CBC      = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 1, 6})
+	// PBES2 (Password-Based Encryption Scheme 2) from PKCS#5 v2.0
+	oidPBES2      = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 5, 13})
+	oidPBKDF2     = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 5, 12})
+	oidHMACSHA256 = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 2, 9})
+	oidAES256CBC  = asn1.ObjectIdentifier([]int{2, 16, 840, 1, 101, 3, 4, 1, 42})
 )
 
 // pbeCipher is an abstraction of a PKCS#12 cipher.
@@ -70,9 +79,37 @@ type pbeParams struct {
 	Iterations int
 }
 
+// PBES2 parameters as per PKCS#5 v2.0
+type pbes2Params struct {
+	KeyDerivationFunc pkix.AlgorithmIdentifier
+	EncryptionScheme  pkix.AlgorithmIdentifier
+}
+
+type pbkdf2Params struct {
+	Salt           []byte
+	IterationCount int
+	KeyLength      int                      `asn1:"optional"`
+	PRF            pkix.AlgorithmIdentifier `asn1:"optional"`
+}
+
+type aes256CBCParams struct {
+	IV []byte
+}
+
 func pbDecrypterFor(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher.BlockMode, int, error) {
+	// Check if this is PBES2 (modern AES-256)
+	if algorithm.Algorithm.Equal(oidPBES2) {
+		return pbes2Decrypter(algorithm, password)
+	}
+
+	// Legacy PBES1 algorithms
 	var cipherType pbeCipher
 
+	var params pbeParams
+	if err := unmarshal(algorithm.Parameters.FullBytes, &params); err != nil {
+		return nil, 0, err
+	}
+
 	switch {
 	case algorithm.Algorithm.Equal(oidPBEWithSHAAnd3KeyTripleDESCBC):
 		cipherType = shaWithTripleDESCBC{}
@@ -82,11 +119,6 @@ func pbDecrypterFor(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher
 		return nil, 0, NotImplementedError("algorithm " + algorithm.Algorithm.String() + " is not supported")
 	}
 
-	var params pbeParams
-	if err := unmarshal(algorithm.Parameters.FullBytes, &params); err != nil {
-		return nil, 0, err
-	}
-
 	key := cipherType.deriveKey(params.Salt, password, params.Iterations)
 	iv := cipherType.deriveIV(params.Salt, password, params.Iterations)
 
@@ -98,6 +130,46 @@ func pbDecrypterFor(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher
 	return cipher.NewCBCDecrypter(block, iv), block.BlockSize(), nil
 }
 
+func pbes2Decrypter(algorithm pkix.AlgorithmIdentifier, password []byte) (cipher.BlockMode, int, error) {
+	var params pbes2Params
+	if err := unmarshal(algorithm.Parameters.FullBytes, &params); err != nil {
+		return nil, 0, errors.New("pkcs12: invalid PBES2 parameters: " + err.Error())
+	}
+
+	// Verify we're using PBKDF2
+	if !params.KeyDerivationFunc.Algorithm.Equal(oidPBKDF2) {
+		return nil, 0, NotImplementedError("only PBKDF2 is supported for PBES2")
+	}
+
+	// Parse PBKDF2 parameters
+	var kdfParams pbkdf2Params
+	if err := unmarshal(params.KeyDerivationFunc.Parameters.FullBytes, &kdfParams); err != nil {
+		return nil, 0, errors.New("pkcs12: invalid PBKDF2 parameters: " + err.Error())
+	}
+
+	// Verify we're using AES-256-CBC
+	if !params.EncryptionScheme.Algorithm.Equal(oidAES256CBC) {
+		return nil, 0, NotImplementedError("only AES-256-CBC is supported for PBES2")
+	}
+
+	// Parse AES parameters (IV)
+	var aesParams aes256CBCParams
+	if err := unmarshal(params.EncryptionScheme.Parameters.FullBytes, &aesParams); err != nil {
+		return nil, 0, errors.New("pkcs12: invalid AES parameters: " + err.Error())
+	}
+
+	// Derive key using PBKDF2
+	key := pbkdf2.Key(password, kdfParams.Salt, kdfParams.IterationCount, 32, sha256.New)
+
+	// Create AES cipher
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return cipher.NewCBCDecrypter(block, aesParams.IV), block.BlockSize(), nil
+}
+
 func pbDecrypt(info decryptable, password []byte) (decrypted []byte, err error) {
 	cbc, blockSize, err := pbDecrypterFor(info.Algorithm(), password)
 	if err != nil {
@@ -137,6 +209,8 @@ func pad(src []byte, blockSize int) []byte {
 	return append(src, paddingText...)
 }
 
+// pbEncrypt encrypts plainText using legacy Triple DES algorithm with low iteration count.
+// Deprecated: Use pbEncryptModern for stronger security with high iteration count instead.
 func pbEncrypt(plainText, salt, password []byte, iterations int) (cipherText []byte, err error) {
 	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
 		return nil, errors.New("pkcs12: failed to create a random salt value: " + err.Error())
@@ -160,6 +234,93 @@ func pbEncrypt(plainText, salt, password []byte, iterations int) (cipherText []b
 	return cipherText, nil
 }
 
+// pbEncryptModern encrypts plainText using AES-256-CBC with PBES2 (PKCS#5 v2.0).
+// This provides modern encryption that is compatible with Windows and Azure while
+// offering much stronger security than legacy Triple DES.
+// Uses 100,000 iterations (OWASP 2021 baseline), providing strong security while
+// maintaining reasonable performance for ephemeral certificates.
+// Returns the ciphertext and the IV used (needed for PBES2 parameters).
+func pbEncryptModern(plainText, salt, password []byte, iterations int) (cipherText, iv []byte, err error) {
+	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, nil, errors.New("pkcs12: failed to create a random salt value: " + err.Error())
+	}
+
+	// Generate IV for AES-256-CBC
+	iv = make([]byte, aes.BlockSize)
+	if _, err := io.ReadFull(rand.Reader, iv); err != nil {
+		return nil, nil, errors.New("pkcs12: failed to create IV: " + err.Error())
+	}
+
+	// Derive key using PBKDF2 with SHA-256
+	key := pbkdf2.Key(password, salt, iterations, 32, sha256.New)
+
+	// Create AES cipher
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, errors.New("pkcs12: failed to create AES cipher: " + err.Error())
+	}
+
+	paddedPlainText := pad(plainText, block.BlockSize())
+
+	encrypter := cipher.NewCBCEncrypter(block, iv)
+	cipherText = make([]byte, len(paddedPlainText))
+	encrypter.CryptBlocks(cipherText, paddedPlainText)
+
+	return cipherText, iv, nil
+}
+
+// pbEncryptModernParams returns PBES2 algorithm parameters for AES-256-CBC encryption
+func pbEncryptModernParams(salt, iv []byte, iterations int) (asn1.RawValue, error) {
+	// PBKDF2 parameters
+	pbkdf2Params := pbkdf2Params{
+		Salt:           salt,
+		IterationCount: iterations,
+		KeyLength:      32, // AES-256 requires 32 bytes
+		PRF: pkix.AlgorithmIdentifier{
+			Algorithm: oidHMACSHA256,
+		},
+	}
+
+	pbkdf2ParamsBytes, err := asn1.Marshal(pbkdf2Params)
+	if err != nil {
+		return asn1.RawValue{}, err
+	}
+
+	var pbkdf2ParamsRaw asn1.RawValue
+	if _, err := asn1.Unmarshal(pbkdf2ParamsBytes, &pbkdf2ParamsRaw); err != nil {
+		return asn1.RawValue{}, err
+	}
+
+	// AES-256-CBC parameters (just the IV)
+	aesParams := aes256CBCParams{
+		IV: iv,
+	}
+
+	aesParamsBytes, err := asn1.Marshal(aesParams)
+	if err != nil {
+		return asn1.RawValue{}, err
+	}
+
+	var aesParamsRaw asn1.RawValue
+	if _, err := asn1.Unmarshal(aesParamsBytes, &aesParamsRaw); err != nil {
+		return asn1.RawValue{}, err
+	}
+
+	// PBES2 parameters
+	pbes2Params := pbes2Params{
+		KeyDerivationFunc: pkix.AlgorithmIdentifier{
+			Algorithm:  oidPBKDF2,
+			Parameters: pbkdf2ParamsRaw,
+		},
+		EncryptionScheme: pkix.AlgorithmIdentifier{
+			Algorithm:  oidAES256CBC,
+			Parameters: aesParamsRaw,
+		},
+	}
+
+	return convertToRawVal(pbes2Params)
+}
+
 // decryptable abstracts a object that contains ciphertext.
 type decryptable interface {
 	Algorithm() pkix.AlgorithmIdentifier

builder/azure/pkcs12/pkcs12.go

@@ -381,6 +381,40 @@ func makeContentInfos(derBytes []byte, privateKey interface{}, password []byte)
 	return contentInfos, nil
 }
 
+// makeShroudedKeyBagContentInfoModern creates content info using AES-256-CBC with PBES2.
+func makeShroudedKeyBagContentInfoModern(privateKey interface{}, password []byte) (*contentInfo, error) {
+	shroudedKeyBagBytes, err := encodePkcs8ShroudedKeyBagModern(privateKey, password)
+	if err != nil {
+		return nil, EncodeError("encode PKCS#8 shrouded key bag: " + err.Error())
+	}
+
+	safeBags, err := makeSafeBags(oidPKCS8ShroudedKeyBag, shroudedKeyBagBytes)
+	if err != nil {
+		return nil, EncodeError("safe bags: " + err.Error())
+	}
+
+	return makeContentInfo(safeBags)
+}
+
+// makeContentInfosModern creates content infos using AES-256-CBC with PBES2.
+func makeContentInfosModern(derBytes []byte, privateKey interface{}, password []byte) ([]contentInfo, error) {
+	shroudedKeyContentInfo, err := makeShroudedKeyBagContentInfoModern(privateKey, password)
+	if err != nil {
+		return nil, EncodeError("shrouded key content info: " + err.Error())
+	}
+
+	certBagContentInfo, err := makeCertBagContentInfo(derBytes)
+	if err != nil {
+		return nil, EncodeError("cert bag content info: " + err.Error())
+	}
+
+	contentInfos := make([]contentInfo, 2)
+	contentInfos[0] = *shroudedKeyContentInfo
+	contentInfos[1] = *certBagContentInfo
+
+	return contentInfos, nil
+}
+
 func makeSalt(saltByteCount int) ([]byte, error) {
 	salt := make([]byte, saltByteCount)
 	_, err := io.ReadFull(rand.Reader, salt)
@@ -453,6 +487,76 @@ func Encode(derBytes []byte, privateKey interface{}, password string) (pfxBytes
 	return bytes, err
 }
 
+// EncodeModern converts a certificate and a private key to the PKCS#12 byte stream format
+// using AES-256-CBC encryption with PBES2 (PKCS#5 v2.0).
+// This provides modern, standards-compliant encryption that is fully compatible with
+// Windows and Azure while offering much stronger security than the legacy Triple DES.
+//
+// derBytes is a DER encoded certificate.
+// privateKey is an RSA or ECDSA private key.
+// password is the password to encrypt the private key.
+func EncodeModern(derBytes []byte, privateKey interface{}, password string) (pfxBytes []byte, err error) {
+	secret, err := bmpString(password)
+	if err != nil {
+		return nil, ErrIncorrectPassword
+	}
+
+	contentInfos, err := makeContentInfosModern(derBytes, privateKey, secret)
+	if err != nil {
+		return nil, err
+	}
+
+	// Marshal []contentInfo so we can re-constitute the byte stream that will
+	// be suitable for computing the MAC
+	bytes, err := asn1.Marshal(contentInfos)
+	if err != nil {
+		return nil, err
+	}
+
+	// Unmarshal as an asn1.RawValue so, we can compute the MAC against the .Bytes
+	var contentInfosRaw asn1.RawValue
+	err = unmarshal(bytes, &contentInfosRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	authSafeContentInfo, err := makeContentInfo(contentInfosRaw)
+	if err != nil {
+		return nil, EncodeError("authSafe content info: " + err.Error())
+	}
+
+	salt, err := makeSalt(pbeSaltSizeBytes)
+	if err != nil {
+		return nil, EncodeError("salt value: " + err.Error())
+	}
+
+	// Compute the MAC for marshaled bytes of contentInfos, which includes the
+	// cert bag, and the shrouded key bag.
+	digest := computeMac(contentInfosRaw.FullBytes, pbeIterationCount, salt, secret)
+
+	pfx := pfxPdu{
+		Version:  3,
+		AuthSafe: *authSafeContentInfo,
+		MacData: macData{
+			Iterations: pbeIterationCount,
+			MacSalt:    salt,
+			Mac: digestInfo{
+				Algorithm: pkix.AlgorithmIdentifier{
+					Algorithm: oidSHA1,
+				},
+				Digest: digest,
+			},
+		},
+	}
+
+	bytes, err = asn1.Marshal(pfx)
+	if err != nil {
+		return nil, EncodeError("marshal PFX PDU: " + err.Error())
+	}
+
+	return bytes, err
+}
+
 func getSafeContents(p12Data, password []byte) (bags []safeBag, updatedPassword []byte, err error) {
 	pfx := new(pfxPdu)