1
$\begingroup$

I am trying to decrypt PKCS8-Shrouded Key Bag inside a PKCS#12 pfx file.

The oid for the encrypted data is PbeWithSHAAnd3-KeyTripleDES CBC.

Iteration count and salt has been provided within the pfx file, and I know

the password.

As far as I know, 3Key Triple DES needs 3 × 56 = 168 bits of key.

I am not sure what I need to do exactly to generate a 168 key using pbkdf2.

Do I simply generate a 192bit key using pbkdf2 and divide it into 3 parts and

use them as three seprate keys after having ignored parity bits?

|improve this question
$\endgroup$
  • $\begingroup$ These types of questions are usually not answered here. Maybe security.stackexchange.com is more appropriate? $\endgroup$ – Guut Boy Feb 2 '16 at 13:07
  • 2
    $\begingroup$ Not PBKDF2; this scheme is defined in PKCS#12 and uses a derivation more like (but not identical to) PBES1/PBKDF1. See Appendix B in emclink.net/collateral/white-papers/… (note that the IETFized version rfc7292 still has an erratum I am reporting). $\endgroup$ – dave_thompson_085 Feb 2 '16 at 18:39
  • $\begingroup$ Typically, when we generate a (3 key) 3DES key, yes, we do indeed generate 192 bits of key (and the lsbits end up being ignored). However, I haven't worked with PKCS#12, and so I won't make this an answer. $\endgroup$ – poncho Feb 3 '16 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.