Implement pkcs8 cli #2342

kingstjo · 2025-04-21T18:32:15Z

Issues:

Addresses CryptoAlg-3073
Addresses CryptoAlg-3074
Addresses CryptoAlg-3075

Description of changes:

This PR implements the PKCS8 CLI command wrapper for AWS-LC, providing OpenSSL-compatible command-line interface to the existing PKCS8 functionality. The CLI tool adds support for:

Converting traditional format private keys to PKCS#8 format through a command-line interface
CLI options for both encrypted and unencrypted PKCS#8 private keys
Command-line access to PKCS#5 v2.0 encryption algorithms
Handling PRF parameters through AWS-LC's existing implementation
Supporting multiple key types via d2i_AutoPrivateKey wrapper
DER and PEM format input/output options

Call-outs:

PRF Parameter Compatibility: The implementation accepts the -v2prf parameter for OpenSSL command-line compatibility and validates supported values (hmacWithSHA1, hmacWithSHA256, hmacWithSHA512). However, AWS-LC's underlying PKCS#8 implementation always uses its default PRF implementation (-1) in the PKCS8_encrypt function, regardless of the specified -v2prf value.
Comprehensive Key Type Support: The CLI implementation uses d2i_AutoPrivateKey to provide support for all private key types that AWS-LC can handle. This allows users to process various key formats through the pkcs8 command without type restrictions.
User-Friendly Error Handling: The implementation provides context-rich error messages that guide users through troubleshooting common issues including:
- Invalid key types or formats
- Password/passphrase problems
- Permission or disk space issues for output files
- Unsupported encryption parameters

Testing:

The CLI wrapper is validated through two testing approaches:

Unit tests (PKCS8Test class) verify:
- Basic CLI options processing (PKCS8ToolBasicTest)
- Format handling with -inform and -outform options (PKCS8ToolFormatTest)
- Encryption with -v2 aes-256-cbc options (PKCS8ToolEncryptionTest)
- PRF parameter handling via -v2prf (PKCS8ToolPRFTest)
- Error handling for invalid inputs (PKCS8OptionUsageErrorsTest)
Comparison tests (PKCS8ComparisonTest class) directly compare AWS-LC's output with OpenSSL's:
- Unencrypted PKCS#8 conversion (PKCS8ToolCompareUnencryptedOpenSSL)
- Encrypted PKCS#8 with AES-256-CBC (PKCS8ToolCompareEncryptedOpenSSL)
- DER format output handling (PKCS8ToolCompareDERFormatOpenSSL)
- PRF parameter handling (PKCS8ToolCompareV2prfOpenSSL)

These tests ensure that the AWS-LC CLI tool produces output files with the correct PKCS#8 boundaries and format compatibility with OpenSSL's pkcs8 command.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

Add the pkcs8 command to the AWS-LC OpenSSL-compatible CLI tools. This implementation includes support for the following options: - [-in filename] [-out filename] - [-inform format] [-outform format] - [-topk8] [-nocrypt] - [-v2 alg] [-v2prf alg] - [-passin arg] [-passout arg] The implementation ensures identical output to OpenSSL 1.1.1 and includes appropriate test files. This functionality allows users to convert between traditional key formats and PKCS#8 with options for encryption, format control, and password handling.

This fix addresses three main issues in the PKCS8 CLI tool: 1) Properly handle PRF parameters with AWS-LC's implementation 2) Support all key types by using d2i_AutoPrivateKey instead of RSA-specific function 3) Add more descriptive error messages for better troubleshooting

codecov-commenter · 2025-04-21T18:55:11Z

Codecov Report

Attention: Patch coverage is 43.63257% with 270 lines in your changes missing coverage. Please review.

Project coverage is 78.74%. Comparing base (4131f11) to head (66ea951).

Files with missing lines	Patch %	Lines
tool-openssl/pkcs8_test.cc	30.20%	171 Missing ⚠️
tool-openssl/pkcs8.cc	59.73%	91 Missing ⚠️
tool-openssl/test_util.h	0.00%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2342      +/-   ##
==========================================
- Coverage   78.88%   78.74%   -0.14%     
==========================================
  Files         640      642       +2     
  Lines      109766   110241     +475     
  Branches    15526    15580      +54     
==========================================
+ Hits        86590    86811     +221     
- Misses      22479    22732     +253     
- Partials      697      698       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tool-openssl/pkcs8.cc

- Updated the implementation to only accept hmacWithSHA1 as a valid PRF algorithm - Added explicit error messages when users specify unsupported PRF algorithms - Updated comments to clearly indicate that only hmacWithSHA1 is supported - Updated tests to use hmacWithSHA1 and added test for unsupported PRF rejection

Added OpenSSLPointer template in internal.h to handle memory allocated with OPENSSL functions. Updated pkcs8.cc to use smart pointers for better resource management and to eliminate manual cleanup. This improves code safety, simplifies error paths, and aligns with patterns used in the rest of the codebase.

When -v2 option is specified without a value in OpenSSL 1.1.1, it defaults to using aes-256-cbc. This commit ensures AWS-LC maintains the same behavior for compatibility. Added tests to verify this behavior.

- Added cross-compatibility tests to verify AWS-LC and OpenSSL can decrypt each other's outputs - Added tests for custom PRF algorithm and default cipher interoperability - Moved helper functions to test_util.h for better code organization - Enhanced test validation to verify decrypted keys match original keys - Maintained backward compatibility with existing tests

…ded prompts for pass similar to OpenSSL

… behavior

samuel40791765

Awesome tests and the code is much more concise with only what's needed! There are still some examples of "over-documentation" and a few nits here and there. Preferably would like the comments and additional test debugging error messages cut down a bit before merging, but I don't see any major blockers.

tool-openssl/pkcs8.cc

tool-openssl/pkcs8_test.cc

tool-openssl/test_util.h

…s8.cc This commit replaces the goto error handling pattern with modern C++ RAII techniques by introducing a SensitiveString class that automatically clears sensitive data on destruction. The implementation: 1. Adds a SensitiveString wrapper class that securely handles sensitive data 2. Refactors pkcs8Tool to use early returns instead of goto statements 3. Removes the now-obsolete secure_clear function 4. Maintains all existing functionality while improving code clarity

…h EXPECT

- Removed std::cout statements that duplicated information already provided by the test framework - Eliminated content dumps that add visual noise without providing additional test value - Removed redundant section comments and normalized whitespace - Preserved all test logic and functionality while making the code cleaner - Maintained descriptive assertion messages that explain failure scenarios

… implement-pkcs8-cli Pulling down changes from main

tool-openssl/pkcs8.cc

- Replace custom SensitiveString class with bssl::UniquePtr<std::string> - Use BORINGSSL_MAKE_DELETER with custom SensitiveStringDeleter function - Maintain same security by calling OPENSSL_cleanse before deletion - Update all function calls to use pointer semantics (.get(), *, ->) - Improve code consistency with existing bssl::UniquePtr usage in file - All PKCS#8 tests continue to pass This addresses team feedback to leverage existing BoringSSL deleter infrastructure instead of custom RAII implementation.

Resolved unresolved merge conflict markers that were causing compilation failures. The conflict was between different include statements that needed to be merged properly.

smittals2

Looks good! My only other ask is could you verify before merge if this is one of the cli tools where order of input flags determines order of output in Openssl?

If it is, see these as examples of what would be required to change:
#2501
17530c1

Jonathon Kingston and others added 8 commits April 17, 2025 21:12

Fix build errors in pkcs8 CLI implementation

8705147

Fix unused variable warning in pkcs8 implementation

9d01ae4

Fix password path handling in pkcs8 tests

462bd64

Use default PKCS#5v2 encryption algorithm

84091f2

Merge branch 'aws:main' into implement-pkcs8-cli

969665d

fix comment styling

fe370f1

kingstjo force-pushed the implement-pkcs8-cli branch from 1d59317 to fe370f1 Compare April 22, 2025 20:53

kingstjo marked this pull request as ready for review April 23, 2025 17:07

kingstjo requested a review from a team as a code owner April 23, 2025 17:07

kingstjo assigned samuel40791765 Apr 23, 2025

samuel40791765 reviewed Apr 23, 2025

View reviewed changes

kingstjo force-pushed the implement-pkcs8-cli branch from ab578cf to fe370f1 Compare April 24, 2025 21:27

kingstjo and others added 6 commits April 24, 2025 15:06

Merge branch 'main' into implement-pkcs8-cli

6ae84e6

Fix pkcs8.cc OpenSSL 1.1.1 compatibility for -v2 option default value

562482a

When -v2 option is specified without a value in OpenSSL 1.1.1, it defaults to using aes-256-cbc. This commit ensures AWS-LC maintains the same behavior for compatibility. Added tests to verify this behavior.

added trim for formatting

eb62ec0

kingstjo marked this pull request as draft April 25, 2025 17:56

Jonathon Kingston added 7 commits April 25, 2025 23:27

-v2 -v2prf are default options with -topk8 and -passin when not provi…

0299545

…ded prompts for pass similar to OpenSSL

fixing pass prompt

2b752e2

Fix decryption of PKCS#8 encrypted keys from OpenSSL 1.1.1

32cbdf2

temporary decryption debugging

bf0524b

temp debug fixes

9dc4cb8

detailed decryption debugging

0f8f4db

Add enhanced PBES2 debugging output for PKCS#8 decryption issues

4a26183

smittals2 self-requested a review April 28, 2025 20:44

Initialize variables in pkcs8.cc and pkcs8_test.cc to avoid undefined…

4489b3c

… behavior

kingstjo requested review from samuel40791765 and smittals2 May 16, 2025 20:36

samuel40791765 previously approved these changes May 16, 2025

View reviewed changes

tool-openssl/pkcs8.cc Outdated Show resolved Hide resolved

tool-openssl/pkcs8_test.cc Show resolved Hide resolved

tool-openssl/pkcs8_test.cc Show resolved Hide resolved

smittals2 reviewed May 16, 2025

View reviewed changes

tool-openssl/test_util.h Show resolved Hide resolved

kingstjo dismissed samuel40791765’s stale review via 0a182c8 June 4, 2025 20:41

kingstjo and others added 4 commits June 13, 2025 11:52

Optimize ASSERT usage in pkcs8_test.cc by replacing format checks wit…

0e1fd18

…h EXPECT

Merge branch 'main' into implement-pkcs8-cli

f179743

Merge branch 'implement-pkcs8-cli' of github.com:kingstjo/aws-lc into…

ee346cf

… implement-pkcs8-cli Pulling down changes from main

kingstjo requested review from samuel40791765 and smittals2 June 16, 2025 21:42

smittals2 previously approved these changes Jun 18, 2025

View reviewed changes

samuel40791765 reviewed Jun 19, 2025

View reviewed changes

tool-openssl/pkcs8.cc Outdated Show resolved Hide resolved

tool-openssl/pkcs8.cc Outdated Show resolved Hide resolved

kingstjo added 2 commits June 20, 2025 21:38

removed comment to reflect current env of library

ef15854

kingstjo dismissed smittals2’s stale review via f579d1b June 21, 2025 05:20

kingstjo and others added 2 commits June 24, 2025 10:23

Merge branch 'main' into implement-pkcs8-cli

49a8757

Fix merge conflict in tool-openssl/internal.h

a937285

Resolved unresolved merge conflict markers that were causing compilation failures. The conflict was between different include statements that needed to be merged properly.

kingstjo requested review from samuel40791765 and smittals2 June 25, 2025 16:45

smittals2 approved these changes Jun 25, 2025

View reviewed changes

samuel40791765 approved these changes Jun 26, 2025

View reviewed changes

kingstjo added 3 commits July 7, 2025 11:36

Merge remote-tracking branch 'upstream/main' into implement-pkcs8-cli

b0e85c5

Merge remote-tracking branch 'upstream/main' into implement-pkcs8-cli

7e5572d

Merge remote-tracking branch 'upstream/main' into implement-pkcs8-cli

66ea951

kingstjo merged commit 45d7b89 into aws:main Jul 9, 2025
129 of 133 checks passed

kingstjo mentioned this pull request Jul 29, 2025

Centralize password handling tool-openssl #2555

Merged

kingstjo deleted the implement-pkcs8-cli branch August 21, 2025 19:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Implement pkcs8 cli #2342

Implement pkcs8 cli #2342

Uh oh!

kingstjo commented Apr 21, 2025

Uh oh!

codecov-commenter commented Apr 21, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

samuel40791765 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smittals2 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Implement pkcs8 cli #2342

Implement pkcs8 cli #2342

Uh oh!

Conversation

kingstjo commented Apr 21, 2025

Issues:

Description of changes:

Call-outs:

Testing:

Uh oh!

codecov-commenter commented Apr 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

samuel40791765 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smittals2 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov-commenter commented Apr 21, 2025 •

edited

Loading