Subject: [saag] encrypted files with UTF-8/16 passwords

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 24 Mar 2017 09:07:46 +0100

Hi,
 PKCS#8 (rfc8018) and PKCS#12 (rfc7292) can be used to encrypt keys
and certificates with a password. In the first case, PKCS#8 utilizes
PKCS#5 for converting a password to an encryption key, and PKCS#5
requires a password to be in UTF-8. For PKCS#12, a password is input
in UTF-16 format (mentioned as BMPString in the document) in some
preset schemes, but uses UTF-8 for newer schemes like AES via PKCS#5.

However, UTF-8 (and UTF-16) are ambiguous. The same string may have
multiple representations, and for that, there are some guidelines in
RFC7613 to prepare a unicode string for a password, but they do not
update either of these documents.

Given that these are informational RFCs, which would be the proper
method to propose an update on them based on these lines and requiring
RFC7613 processing for passwords entered in UTF-8?

regards,
Nikos

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Fri, 24 Mar 2017 14:53:28 +0000

Hi Nikos,

They are just informational because they were contributed as existing standards.  Change control has been handed over to the IETF, so an update could happen to make them standards track.  Or you could start an updated draft to add what you need and we'll figure out if it has to stay informational or not.

Thanks,
Kathleen 

Sent from my iPhone

> On Mar 24, 2017, at 4:08 AM, Nikos Mavrogiannopoulos <[email-masked]> wrote:
> 
> Hi,