|
 |
460745 |
From 92f450a4b6eacb7950e5414d40d9949076cb096e Mon Sep 17 00:00:00 2001
|
|
|
460745 |
From: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
460745 |
Date: Tue, 20 Jun 2017 10:31:15 -0400
|
|
|
460745 |
Subject: [PATCH] ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
|
|
|
460745 |
|
|
|
460745 |
For some unknown reason, when I wrote the ipa-otptoken-import script
|
|
|
460745 |
I used bad input data which had the PBKDF2 parameters in the wrong
|
|
|
460745 |
XML namespace. I have corrected this input data to match RFC 6030.
|
|
|
460745 |
|
|
|
460745 |
https://pagure.io/freeipa/issue/7035
|
|
|
460745 |
|
|
|
460745 |
Signed-off-by: Nathaniel McCallum <npmccallum@redhat.com>
|
|
|
460745 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
460745 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
460745 |
---
|
|
|
460745 |
ipaserver/install/ipa_otptoken_import.py | 15 ++++++---------
|
|
|
460745 |
ipatests/test_ipaserver/data/pskc-figure7.xml | 16 ++++++++--------
|
|
|
460745 |
2 files changed, 14 insertions(+), 17 deletions(-)
|
|
|
460745 |
|
|
|
460745 |
diff --git a/ipaserver/install/ipa_otptoken_import.py b/ipaserver/install/ipa_otptoken_import.py
|
|
|
460745 |
index 2580e2cfc97f4960af68a5eae407a7ebe3c7a257..31225e96b55c20bd78e9a8650848a28cf9feef63 100644
|
|
|
460745 |
--- a/ipaserver/install/ipa_otptoken_import.py
|
|
|
460745 |
+++ b/ipaserver/install/ipa_otptoken_import.py
|
|
|
460745 |
@@ -52,6 +52,7 @@ class ValidationError(Exception):
|
|
|
460745 |
|
|
|
460745 |
def fetchAll(element, xpath, conv=lambda x: x):
|
|
|
460745 |
return [conv(e) for e in element.xpath(xpath, namespaces={
|
|
|
460745 |
+ "pkcs5": "http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#",
|
|
|
460745 |
"pskc": "urn:ietf:params:xml:ns:keyprov:pskc",
|
|
|
460745 |
"xenc11": "http://www.w3.org/2009/xmlenc11#",
|
|
|
460745 |
"xenc": "http://www.w3.org/2001/04/xmlenc#",
|
|
|
460745 |
@@ -175,18 +176,14 @@ class XMLKeyDerivation(six.with_metaclass(abc.ABCMeta, object)):
|
|
|
460745 |
|
|
|
460745 |
class PBKDF2KeyDerivation(XMLKeyDerivation):
|
|
|
460745 |
def __init__(self, enckey):
|
|
|
460745 |
- params = fetch(enckey, "./xenc11:DerivedKey/xenc11:KeyDerivationMethod/xenc11:PBKDF2-params")
|
|
|
460745 |
+ params = fetch(enckey, "./xenc11:DerivedKey/xenc11:KeyDerivationMethod/pkcs5:PBKDF2-params")
|
|
|
460745 |
if params is None:
|
|
|
460745 |
raise ValueError("XML file is missing PBKDF2 parameters!")
|
|
|
460745 |
|
|
|
460745 |
- salt = fetch(
|
|
|
460745 |
- params, "./xenc11:Salt/xenc11:Specified/text()", base64.b64decode)
|
|
|
460745 |
- itrs = fetch(
|
|
|
460745 |
- params, "./xenc11:IterationCount/text()", int)
|
|
|
460745 |
- klen = fetch(
|
|
|
460745 |
- params, "./xenc11:KeyLength/text()", int)
|
|
|
460745 |
- hmod = fetch(
|
|
|
460745 |
- params, "./xenc11:PRF/@Algorithm", convertHMACType, hashes.SHA1)
|
|
|
460745 |
+ salt = fetch(params, "./Salt/Specified/text()", base64.b64decode)
|
|
|
460745 |
+ itrs = fetch(params, "./IterationCount/text()", int)
|
|
|
460745 |
+ klen = fetch(params, "./KeyLength/text()", int)
|
|
|
460745 |
+ hmod = fetch(params, "./PRF/@Algorithm", convertHMACType, hashes.SHA1)
|
|
|
460745 |
|
|
|
460745 |
if salt is None:
|
|
|
460745 |
raise ValueError("XML file is missing PBKDF2 salt!")
|
|
|
460745 |
diff --git a/ipatests/test_ipaserver/data/pskc-figure7.xml b/ipatests/test_ipaserver/data/pskc-figure7.xml
|
|
|
460745 |
index 1fb04fc319d7572d9d25ff34a0ce3378a939dfc6..808e272a5469a1c9eb4087ed53e0907bb80b39ad 100644
|
|
|
460745 |
--- a/ipatests/test_ipaserver/data/pskc-figure7.xml
|
|
|
460745 |
+++ b/ipatests/test_ipaserver/data/pskc-figure7.xml
|
|
|
460745 |
@@ -8,14 +8,14 @@
|
|
|
460745 |
<xenc11:DerivedKey>
|
|
|
460745 |
|
|
|
460745 |
Algorithm="http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#pbkdf2">
|
|
|
460745 |
- <xenc11:PBKDF2-params>
|
|
|
460745 |
- <xenc11:Salt>
|
|
|
460745 |
- <xenc11:Specified>Ej7/PEpyEpw=</xenc11:Specified>
|
|
|
460745 |
- </xenc11:Salt>
|
|
|
460745 |
- <xenc11:IterationCount>1000</xenc11:IterationCount>
|
|
|
460745 |
- <xenc11:KeyLength>16</xenc11:KeyLength>
|
|
|
460745 |
- <xenc11:PRF/>
|
|
|
460745 |
- </xenc11:PBKDF2-params>
|
|
|
460745 |
+ <pkcs5:PBKDF2-params>
|
|
|
460745 |
+ <Salt>
|
|
|
460745 |
+ <Specified>Ej7/PEpyEpw=</Specified>
|
|
|
460745 |
+ </Salt>
|
|
|
460745 |
+ <IterationCount>1000</IterationCount>
|
|
|
460745 |
+ <KeyLength>16</KeyLength>
|
|
|
460745 |
+ <PRF/>
|
|
|
460745 |
+ </pkcs5:PBKDF2-params>
|
|
|
460745 |
</xenc11:KeyDerivationMethod>
|
|
|
460745 |
<xenc:ReferenceList>
|
|
|
460745 |
<xenc:DataReference URI="#ED"/>
|
|
|
460745 |
--
|
|
|
460745 |
2.13.5
|