Missing support of PKCS#12 with BagAttributeCarrier informations and Brainpool keys (Oracle JCE-provider is used for open PKCS#12 always)

[wothe]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
I've have created a valid PKCS#12-KeyStore with BouncyCastle including PKCS#12BagAttributeCarrier informations, These informations as supported by BouncyCastle. KeyStore can not be opened because without changes on KeyStore Explorer Java SunJsse is always used to open PKCS#12. Oracle Java does not support PKCS#12BagAttributeCarriers informations.
I want to use Bouncy to open the PKCS#12.

Describe the solution you'd like
Key Store Explorer should use both providers after another to open it (PKCS#12 only). There is also an password incompatibility issue on both providers for using PKCS#12 (BC: only store password, Oracle: store and key password are possible)
Another issue is the incompatibility on loading brainpool keys with Sun that still does not, but listed as working at project (assumption: only creating supports brainpool keys).

Describe alternatives you've considered
A setting at configuration should be provided to change Default Crypto Provider to open PKCS#12-KeyStore between the two JCE-CryptoProviders Bouncy and SunJsse.

Additional context
Add any other context or screenshots about the feature request here.

[kaikramer]

First of all, thanks for your ticket, but you'll have to provide more information: What Java version, what bag attributes? I can open PKCS#12 files with bag attributes in KSE without any problems and there have never been any other bug reports about this.

I completely understand the advantages of using the BC library and it is heavily used in KSE for other purposes. The problem with the Bouncy Castle PKCS#12 provider is that it has several issues that won't be fixed by the BC maintainers because of compatibility reasons. In fact, KSE has used the BC provider for p12 files for several years. But as KSE users have reported bugs that could only be fixed in BC (and were not), I have switched to the SunJSSE provider instead. This had other advantages as well: The BC provider supports - as you have mentioned - only one password for p12 (i.e. the same password for every key bag and the whole p12 structure), which does not reflect the reality and causes problems when opening a p12 file that has different passwords set (which is discouraged, but possible). It also makes KSE completely compatible with the behavior of keytool (and Java in general), which is generally preferable for a tool that claims to be a replacement for keytool.

KSE versions before 5.0 had their own provider for PKCS#12. This might be another option and would allow to adapt the provider exactly for usage in KSE. However, this would mean that there is a third provider with incompatibilities and I am not sure what is currently required to sign your own JCE provider.

As for the Brainpool EC curves: Their availability depends on the provider. Obviously the BC provider supports them, but the situation with the SunEC provider is much more complicated. The Brainpool curves have been added to Java 11, but only in a restricted way (s. https://bugs.openjdk.java.net/browse/JDK-8208580) and were deprecated/disabled in Java 14/15 again because their implementation is not resistant against side channel attacks (https://docs.oracle.com/en/java/javase/14/security/oracle-providers.html#GUID-091BF58C-82AB-4C9C-850F-1660824D5254). KSE can create Brainpool curves in BC keystore types like BKS, UBER and BCFKS, but not in keystore types that are backed by the standard Java providers.

There are other feature requests related to PKCS#12 and my plan is to evaluate the PKCS#12 support in KSE again after the release of KSE 5.5.0.

[wothe]

Thanks for your answer and the interesting informations about brainpool support. The Attributes issue was a fault by myself, you’re right. I’m sorry about that and excuse for wrong ticket description. My test keystore has attributes and brainpool keys. After removing the brainpool keys everything works fine incl. using attributes. I’ve not checked out, JCE KeyStore requires a JCE signature yet, but would not be no problem for me. Another way would be using endorsed directory of jre with changing of java.security to BC. But that might create some mysterious effects during development, so that’s not my preferred way. Best regards and again thank you for your quick and detailed answer Jens Wothe

[gdmeunier]

I created a new issue (issue #434) for P12 property bags that's actually related to this. So it turns out that property bags are actually named BagAttributeCarrier, good to know.

I guess we can keep both issues or turn mine into a reply for this one since I added more info on example uses for Windows.