Package org.bouncycastle.jcajce

Class PKCS12StoreParameter.PBMAC1WithPBKDF2Builder

java.lang.Object

org.bouncycastle.jcajce.PKCS12StoreParameter.PBMAC1WithPBKDF2Builder

Enclosing class:

PKCS12StoreParameter

public static class PKCS12StoreParameter.PBMAC1WithPBKDF2Builder
extends java.lang.Object

Builder for the PBMAC1 integrity-MAC algorithm identifier of a PKCS#12 file, with PBKDF2 as the key-derivation function, as specified by RFC 9579. Pass the result to PKCS12StoreParameter.Builder.setMacAlgorithm(AlgorithmIdentifier).

The defaults are 16384 iterations, a 64-octet derived key, HMAC-SHA-256 as the PBKDF2 PRF and HMAC-SHA-512 as the message-authentication scheme. A salt has no default and must be supplied.

Method Summary

Modifier and Type	Method	Description
AlgorithmIdentifier	build()	Build the PBMAC1 algorithm identifier.
PKCS12StoreParameter.PBMAC1WithPBKDF2Builder	setIterationCount(int iterationCount)	Set the PBKDF2 iteration count.
PKCS12StoreParameter.PBMAC1WithPBKDF2Builder	setKeySize(int keySizeInOctets)	Set the length of the MAC key PBKDF2 derives, in octets - this is the PBKDF2-params keyLength field, which RFC 8018 app.
PKCS12StoreParameter.PBMAC1WithPBKDF2Builder	setMac(ASN1ObjectIdentifier mac)	Set the message-authentication scheme the derived key is used with.
PKCS12StoreParameter.PBMAC1WithPBKDF2Builder	setPrf(ASN1ObjectIdentifier prf)	Set the PBKDF2 pseudo-random function.
PKCS12StoreParameter.PBMAC1WithPBKDF2Builder	setSalt(byte[] salt)	Set the PBKDF2 salt.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

setIterationCount

public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setIterationCount(int iterationCount)

Set the PBKDF2 iteration count. The default is 16384.

Parameters:

iterationCount - the iteration count to derive the MAC key with.

Returns:

this builder.

setSalt

public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setSalt(byte[] salt)

Set the PBKDF2 salt. There is no default - build() fails without one.

Parameters:

salt - the salt to derive the MAC key with; the array is copied.

Returns:

this builder.

setKeySize

public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setKeySize(int keySizeInOctets)

Set the length of the MAC key PBKDF2 derives, in octets - this is the PBKDF2-params keyLength field, which RFC 8018 app. A.2 defines in octets rather than bits.

RFC 9579 sec. 5 has it match the output size of the message-authentication scheme set by setMac(ASN1ObjectIdentifier): 64 for the default HMAC-SHA-512, 32 for HMAC-SHA-256. Sec. 9 of the same document asks that a length below 20 octets be rejected, and BC does so when the MAC is derived. The default is 64.

Parameters:

keySizeInOctets - the length in octets of the key to derive.

Returns:

this builder.

setPrf

public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setPrf(ASN1ObjectIdentifier prf)

Set the PBKDF2 pseudo-random function. The default is HMAC-SHA-256, which RFC 9579 sec. 5 requires every implementation to support.

Parameters:

prf - OID of the PRF to derive the MAC key with.

Returns:

this builder.

setMac

public PKCS12StoreParameter.PBMAC1WithPBKDF2Builder setMac(ASN1ObjectIdentifier mac)

Set the message-authentication scheme the derived key is used with. The default is HMAC-SHA-512. Changing it means changing setKeySize(int) to match its output size.

Parameters:

mac - OID of the HMAC to authenticate the file with.

Returns:

this builder.

build

public AlgorithmIdentifier build()

Build the PBMAC1 algorithm identifier.

Returns:

an AlgorithmIdentifier for id-PBMAC1 carrying the configured PBMAC1-params.

Throws:

java.lang.IllegalStateException - if no salt has been set.