1 // Copyright 2015 The Go Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style
3 // license that can be found in the LICENSE file.
14 // see https://tools.ietf.org/html/rfc7292#appendix-D
15 oidCertTypeX509Certificate = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 9, 22, 1})
16 oidPKCS8ShroundedKeyBag = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 2})
17 oidCertBag = asn1.ObjectIdentifier([]int{1, 2, 840, 113549, 1, 12, 10, 1, 3})
21 Id asn1.ObjectIdentifier
22 Data []byte `asn1:"tag:0,explicit"`
25 func decodePkcs8ShroudedKeyBag(asn1Data, password []byte) (privateKey interface{}, err error) {
26 pkinfo := new(encryptedPrivateKeyInfo)
27 if err = unmarshal(asn1Data, pkinfo); err != nil {
28 return nil, errors.New("pkcs12: error decoding PKCS#8 shrouded key bag: " + err.Error())
31 pkData, err := pbDecrypt(pkinfo, password)
33 return nil, errors.New("pkcs12: error decrypting PKCS#8 shrouded key bag: " + err.Error())
36 ret := new(asn1.RawValue)
37 if err = unmarshal(pkData, ret); err != nil {
38 return nil, errors.New("pkcs12: error unmarshaling decrypted private key: " + err.Error())
41 if privateKey, err = x509.ParsePKCS8PrivateKey(pkData); err != nil {
42 return nil, errors.New("pkcs12: error parsing PKCS#8 private key: " + err.Error())
45 return privateKey, nil
48 func decodeCertBag(asn1Data []byte) (x509Certificates []byte, err error) {
50 if err := unmarshal(asn1Data, bag); err != nil {
51 return nil, errors.New("pkcs12: error decoding cert bag: " + err.Error())
53 if !bag.Id.Equal(oidCertTypeX509Certificate) {
54 return nil, NotImplementedError("only X509 certificates are supported")