#include <pkcs12.h>

Public Member Functions
const std::string &	cert_encryption_algo () const
	Empty means: store certificates unencrypted.
const std::optional< std::string > &	friendly_name () const
bool	include_mac () const
size_t	iterations () const
const std::string &	key_encryption_algo () const
const std::string &	mac_digest () const
const std::string &	password () const
	PKCS12_Export_Options (std::string_view password, std::optional< std::string > friendly_name={})
PKCS12_Export_Options &	with_cert_encryption_algo (std::string algo)
PKCS12_Export_Options &	with_friendly_name (std::string name)
	Override the friendly-name attribute (otherwise taken from the bundle).
PKCS12_Export_Options &	with_iterations (size_t n)
	Set number of KDF iterations.
PKCS12_Export_Options &	with_key_encryption_algo (std::string algo)
	Set the private key encryption algorithm (PKCS#12 PBE or PBES2 name).
PKCS12_Export_Options &	with_mac_digest (std::string algo)
	Set the digest used for the integrity MAC.
PKCS12_Export_Options &	without_mac ()
	Disable the integrity MAC. Generally not recommended.

Static Public Member Functions
static PKCS12_Export_Options	legacy_compat (std::string_view password, std::optional< std::string > friendly_name={})
static PKCS12_Export_Options	modern (std::string_view password, std::optional< std::string > friendly_name={})

Detailed Description

Options controlling PKCS#12/PFX export.

Use one of the static pseudo-constructors for the common cases:

modern - PBES2-SHA256-AES256, SHA-256 MAC, 100 000 iterations
legacy_compat - PBE-SHA1-3DES, SHA-1 MAC, 2 048 iterations

For custom configurations construct directly and use the with_*() mutators (chainable). Any field not set explicitly defaults to the "modern" value.

Definition at line 38 of file pkcs12.h.

Constructor & Destructor Documentation

◆ PKCS12_Export_Options()

Botan::PKCS12_Export_Options::PKCS12_Export_Options	(	std::string_view	password,
		std::optional< std::string >	friendly_name = {} )

explicit

Parameters

password	password protecting the file. Empty is allowed: PKCS#12 defines an encoding for an empty password, so it may be used with encryption and the MAC, although doing so offers no real protection.
friendly_name	optional friendly name attribute stored on the private key bag and on the matching end-entity certificate bag.

Definition at line 398 of file pkcs12.cpp.

398 :

399 m_password(password), m_friendly_name(std::move(friendly_name)) {}

Botan::PKCS12_Export_Options::friendly_name

const std::optional< std::string > & friendly_name() const

Definition pkcs12.h:88

Botan::PKCS12_Export_Options::password

const std::string & password() const

Definition pkcs12.h:86

References friendly_name(), and password().

Referenced by legacy_compat(), modern(), with_cert_encryption_algo(), with_friendly_name(), with_iterations(), with_key_encryption_algo(), with_mac_digest(), and without_mac().

Member Function Documentation

◆ cert_encryption_algo()

const std::string & Botan::PKCS12_Export_Options::cert_encryption_algo ( ) const

inline

Empty means: store certificates unencrypted.

Definition at line 95 of file pkcs12.h.

95{ return m_cert_encryption_algo; }

Referenced by Botan::PKCS12::export_to().

◆ friendly_name()

const std::optional< std::string > & Botan::PKCS12_Export_Options::friendly_name ( ) const

inline

Definition at line 88 of file pkcs12.h.

88{ return m_friendly_name; }

Referenced by Botan::PKCS12::export_to(), legacy_compat(), modern(), and PKCS12_Export_Options().

◆ include_mac()

bool Botan::PKCS12_Export_Options::include_mac ( ) const

inline

Definition at line 99 of file pkcs12.h.

99{ return m_include_mac; }

Referenced by Botan::PKCS12::export_to().

◆ iterations()

size_t Botan::PKCS12_Export_Options::iterations ( ) const

inline

Definition at line 90 of file pkcs12.h.

90{ return m_iterations; }

Referenced by Botan::PKCS12::export_to().

◆ key_encryption_algo()

const std::string & Botan::PKCS12_Export_Options::key_encryption_algo ( ) const

inline

Definition at line 92 of file pkcs12.h.

92{ return m_key_encryption_algo; }

Referenced by Botan::PKCS12::export_to().

◆ legacy_compat()

PKCS12_Export_Options Botan::PKCS12_Export_Options::legacy_compat	(	std::string_view	password,
		std::optional< std::string >	friendly_name = {} )

static

Legacy-compatible defaults: PBE-SHA1-3DES, SHA-1 MAC, 2 048 iterations. Use when interoperability with old software (Java keytool pre-2019, older OpenSSL releases, Windows pre-Windows-10) is required.

Definition at line 406 of file pkcs12.cpp.

                                                                                                 {
   PKCS12_Export_Options opts(password, std::move(friendly_name));
   opts.m_iterations = 2048;
   opts.m_key_encryption_algo = "PBE-SHA1-3DES";
   opts.m_mac_digest = "SHA-1";
   return opts;
}

References friendly_name(), password(), and PKCS12_Export_Options().

◆ mac_digest()

const std::string & Botan::PKCS12_Export_Options::mac_digest ( ) const

inline

Definition at line 97 of file pkcs12.h.

97{ return m_mac_digest; }

Referenced by Botan::PKCS12::export_to().

◆ modern()

PKCS12_Export_Options Botan::PKCS12_Export_Options::modern	(	std::string_view	password,
		std::optional< std::string >	friendly_name = {} )

static

Modern defaults: PBES2-SHA256-AES256, SHA-256 MAC, 100 000 iterations.

Definition at line 401 of file pkcs12.cpp.

                                                                                          {
   return PKCS12_Export_Options(password, std::move(friendly_name));
}

References friendly_name(), password(), and PKCS12_Export_Options().

◆ password()

const std::string & Botan::PKCS12_Export_Options::password ( ) const

inline

Definition at line 86 of file pkcs12.h.

86{ return m_password; }

Referenced by Botan::PKCS12::export_to(), legacy_compat(), modern(), and PKCS12_Export_Options().

◆ with_cert_encryption_algo()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::with_cert_encryption_algo ( std::string algo )

Set the certificate encryption algorithm. Empty string (the default) means certificates are stored unencrypted (inside an unencrypted SafeContents); pass a non-empty algorithm to wrap them.

Definition at line 430 of file pkcs12.cpp.

                                                                                      {
   m_cert_encryption_algo = std::move(algo);
   return *this;
}

References PKCS12_Export_Options().

◆ with_friendly_name()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::with_friendly_name ( std::string name )

Override the friendly-name attribute (otherwise taken from the bundle).

Definition at line 415 of file pkcs12.cpp.

                                                                               {
   m_friendly_name = std::move(name);
   return *this;
}

References PKCS12_Export_Options().

◆ with_iterations()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::with_iterations ( size_t n )

Set number of KDF iterations.

Definition at line 420 of file pkcs12.cpp.

                                                                      {
   m_iterations = n;
   return *this;
}

References PKCS12_Export_Options().

◆ with_key_encryption_algo()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::with_key_encryption_algo ( std::string algo )

Set the private key encryption algorithm (PKCS#12 PBE or PBES2 name).

Definition at line 425 of file pkcs12.cpp.

                                                                                     {
   m_key_encryption_algo = std::move(algo);
   return *this;
}

References PKCS12_Export_Options().

◆ with_mac_digest()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::with_mac_digest ( std::string algo )

Set the digest used for the integrity MAC.

Definition at line 435 of file pkcs12.cpp.

                                                                            {
   m_mac_digest = std::move(algo);
   return *this;
}

References PKCS12_Export_Options().

◆ without_mac()

PKCS12_Export_Options & Botan::PKCS12_Export_Options::without_mac ( )

Disable the integrity MAC. Generally not recommended.

Definition at line 440 of file pkcs12.cpp.

                                                          {
   m_include_mac = false;
   return *this;
}

References PKCS12_Export_Options().

The documentation for this class was generated from the following files:

src/lib/pkcs12/pkcs12.h
src/lib/pkcs12/pkcs12.cpp

Public Member Functions

Static Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ PKCS12_Export_Options()

Member Function Documentation

◆ cert_encryption_algo()

◆ friendly_name()

◆ include_mac()

◆ iterations()

◆ key_encryption_algo()

◆ legacy_compat()

◆ mac_digest()

◆ modern()

◆ password()

◆ with_cert_encryption_algo()

◆ with_friendly_name()

◆ with_iterations()

◆ with_key_encryption_algo()

◆ with_mac_digest()

◆ without_mac()