Subject: [Secdispatch] publishing PKCS#12/PKCS#5 clarification is indiv. draft

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 07 May 2018 13:51:42 +0000

Background:
 PKCS#8 (rfc8018) and PKCS#12 (rfc7292) are used to encrypt keys and
certificates with a password. Both however do not define how a password
should be encoded other than referring to the ambiguous UTF-8 or BMPString
encodings. In particular
PKCS#8 utilizes PKCS#5 for converting a password to an encryption key, and
PKCS#5 requires a password to be in UTF-8. For PKCS#12, a password is input
in UTF-16 format (mentioned as BMPString in the document) in some preset
schemes, but uses UTF-8 for newer schemes like AES via PKCS#5.

Thus as UTF-8 (and UTF-16) are ambiguous the same internationalized string
may have multiple representations. There are some guidelines (by a
different WG) in RFC7613 to prepare a unicode string for a password, but
they are not used by the documents above.

The proposed draft, clarifies several aspects of the PKCS#12 and PKCS#5
documents with regards to internationalized strings, and proposes a well
defined encoding for passwords in that context based on RFC7613.

I'd like to have AD sponsorship for this draft.

The draft (PKCS#5/PKCS#12 clarification on internationalized passwords):
https://datatracker.ietf.org/doc/draft-mavrogiannopoulos-pkcs5-passwords/

Previous discussion on saag mailing list:
https://mailarchive.ietf.org/arch/msg/saag/598CnK5rxOZ8qJY9W38gNNlIvvc

regards,
Nikos