rfc9579.original		rfc9579.txt
	Internet Engineering Task Force H. Kario, Ed.		Internet Engineering Task Force (IETF) H. Kario
	Internet-Draft Red Hat, Inc.		Request for Comments: 9579 Red Hat, Inc.
	Updates: 7292, 8018 (if approved) 22 February 2024		Updates: 7292, 8018 May 2024
	Intended status: Informational		Category: Informational
	Expires: 25 August 2024		ISSN: 2070-1721
	Use of Password Based Message Authentication Code 1 (PBMAC1) in PKCS #12		Use of Password-Based Message Authentication Code 1 (PBMAC1) in PKCS #12
	Syntax		Syntax
	draft-ietf-lamps-pkcs12-pbmac1-08
	Abstract		Abstract
	This document specifies additions and amendments to RFCs 7292 and		This document specifies additions and amendments to RFCs 7292 and
	8018. It defines a way to use the Password Based Message		8018. It defines a way to use the Password-Based Message
	Authentication Code 1, defined in RFC 8018, inside the PKCS #12		Authentication Code 1 (PBMAC1), defined in RFC 8018, inside the PKCS
	syntax. The purpose of this specification is to permit use of more		#12 syntax. The purpose of this specification is to permit the use
	modern Password-Based Key Derivation Functions (PBKDFs) and allow for		of more modern Password-Based Key Derivation Functions (PBKDFs) and
	regulatory compliance.		allow for regulatory compliance.
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This document is not an Internet Standards Track specification; it is
	provisions of BCP 78 and BCP 79.		published for informational purposes.
	Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		This document is a product of the Internet Engineering Task Force
	and may be updated, replaced, or obsoleted by other documents at any		(IETF). It represents the consensus of the IETF community. It has
	time. It is inappropriate to use Internet-Drafts as reference		received public review and has been approved for publication by the
	material or to cite them other than as "work in progress."		Internet Engineering Steering Group (IESG). Not all documents
			approved by the IESG are candidates for any level of Internet
			Standard; see Section 2 of RFC 7841.
	This Internet-Draft will expire on 25 August 2024.		Information about the current status of this document, any errata,
			and how to provide feedback on it may be obtained at
			https://www.rfc-editor.org/info/rfc9579.
	Copyright Notice		Copyright Notice
	Copyright (c) 2024 IETF Trust and the persons identified as the		Copyright (c) 2024 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents (https://trustee.ietf.org/		Provisions Relating to IETF Documents
	license-info) in effect on the date of publication of this document.		(https://trustee.ietf.org/license-info) in effect on the date of
	Please review these documents carefully, as they describe your rights		publication of this document. Please review these documents
	and restrictions with respect to this document. Code Components		carefully, as they describe your rights and restrictions with respect
	extracted from this document must include Revised BSD License text as		to this document. Code Components extracted from this document must
	described in Section 4.e of the Trust Legal Provisions and are		include Revised BSD License text as described in Section 4.e of the
	provided without warranty as described in the Revised BSD License.		Trust Legal Provisions and are provided without warranty as described
			in the Revised BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction
	2. Rationale . . . . . . . . . . . . . . . . . . . . . . . . . . 3		2. Rationale
	3. Requirements Language . . . . . . . . . . . . . . . . . . . . 3		3. Requirements Language
	4. Embedding PBMAC1 in PKCS #12 . . . . . . . . . . . . . . . . 3		4. Embedding PBMAC1 in PKCS #12
	5. Recommended parameters . . . . . . . . . . . . . . . . . . . 4		5. Recommended Parameters
	6. Password encoding . . . . . . . . . . . . . . . . . . . . . . 4		6. Password Encoding
	7. Deprecated Algorithms . . . . . . . . . . . . . . . . . . . . 4		7. Deprecated Algorithms
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5		8. IANA Considerations
	9. Security Considerations . . . . . . . . . . . . . . . . . . . 5		9. Security Considerations
	10. References . . . . . . . . . . . . . . . . . . . . . . . . . 5		10. References
	10.1. Normative References . . . . . . . . . . . . . . . . . . 5		10.1. Normative References
	10.2. Informative References . . . . . . . . . . . . . . . . . 6		10.2. Informative References
	Appendix A. Test Vectors . . . . . . . . . . . . . . . . . . . . 7		Appendix A. Test Vectors
	A.1. Valid PKCS#12 file with SHA-256 HMAC and PRF . . . . . . 7		A.1. Valid PKCS #12 File with SHA-256 HMAC and PRF
	A.2. Valid PKCS#12 file with SHA-256 HMAC and SHA-512 PRF . . 8		A.2. Valid PKCS #12 File with SHA-256 HMAC and SHA-512 PRF
	A.3. Valid PKCS#12 file with SHA-512 HMAC and PRF . . . . . . 9		A.3. Valid PKCS #12 File with SHA-512 HMAC and PRF
	A.4. Invalid PKCS#12 file with incorrect iteration count . . . 11		A.4. Invalid PKCS #12 File with Incorrect Iteration Count
	A.5. Invalid PKCS#12 file with incorrect salt . . . . . . . . 12		A.5. Invalid PKCS #12 File with Incorrect Salt
	A.6. Invalid PKCS#12 file with missing key length . . . . . . 13		A.6. Invalid PKCS #12 File with Missing Key Length
	Appendix B. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 15		Appendix B. ASN.1 Module
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 17		Author's Address
	1. Introduction		1. Introduction
	The PKCS #12 [RFC7292] format is widely used for interoperable		The PKCS #12 format [RFC7292] is widely used for the interoperable
	transfer of certificate, key, and other miscellaneous secrets between		transfer of certificate, key, and other miscellaneous secrets between
	machines, applications, browsers, etc. Unfortunately, the original		machines, applications, browsers, etc. Unfortunately, [RFC7292]
	specification mandates the use of a specific password based key		mandates the use of a PKCS #12 specific password-based key derivation
	derivation function, the PBKDF1, allowing only for change of the		function that only allows for change of the underlying message digest
	underlying message digest function.		function.
	2. Rationale		2. Rationale
	Due to security concerns with PBKDF1 and much higher extensibility of		Due to security concerns with the key derivation function from
	PBMAC1 [RFC8018], we propose the use of PBMAC1 for integrity		[RFC7292] and the much higher extensibility of PBMAC1 [RFC8018], we
	protection of PKCS #12 structures. The new syntax is designed to		propose the use of PBMAC1 for integrity protection of PKCS #12
	allow legacy applications to still be able to decrypt the key		structures. The new syntax is designed to allow legacy applications
	material, even if they are unable to interpret the new integrity		to still be able to decrypt the key material, even if they are unable
	protection, provided that they can ignore failures in MAC		to interpret the new integrity protection, provided that they can
	verification. This change allows for use of PBKDF2 [RFC8018] or		ignore failures in Message Authentication Code (MAC) verification.
	scrypt [RFC7914] KDFs for derivation of MAC keys and future		This change allows for the use of PBKDF2 [RFC8018] or scrypt PBKDFs
	extensibility. Use of the extensible PBMAC1 mechanism also allows		[RFC7914] for derivation of MAC keys and future extensibility. Use
	for greater flexibility and alignment to different government		of the extensible PBMAC1 mechanism also allows for greater
	regulations, for example, in environments where PBKDF2 is the only		flexibility and alignment with different government regulations, for
	allowed password-based key derivation function.		example, in environments where PBKDF2 is the only allowed password-
			based key derivation function.
	As recommended methods for key protection require both encryption and		As the recommended methods for key protection require both encryption
	integrity protection, we've decided to amend the PKCS #12 format to		and integrity protection, we decided to amend the PKCS #12 format to
	support different key derivation functions rather than extending the		support different key derivation functions rather than extending the
	PKCS #5 by a new field allowing integrity protection.		PKCS #5 format by a new field that allows integrity protection.
	We have included an ASN.1 module [x680] [x681][x682][x683] [x690]		We included an ASN.1 module [x680] [x681] [x682] [x683] [x690] that
	that can be combined with the ASN.1 module in [RFC8018] to		can be combined with the ASN.1 modules in [RFC7292] and [RFC8018] to
	incorporate additional MAC algorithms.		incorporate additional MAC algorithms.
	3. Requirements Language		3. Requirements Language
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and		"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
	"OPTIONAL" in this document are to be interpreted as described in BCP		"OPTIONAL" in this document are to be interpreted as described in
	14 [RFC2119][RFC8174] when, and only when, they appear in all		BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitabls, as shown here.		capitals, as shown here.
	4. Embedding PBMAC1 in PKCS #12		4. Embedding PBMAC1 in PKCS #12
	The MacData structure in the PFX object, as described in bullet #3 in		The MacData structure in the PFX object, as described in item #3 in
	section 4 of RFC 7292 [RFC7292], is updated to include this		Section 4 of [RFC7292], is updated to include the following
	additional PBMAC1-specific guidance:		PBMAC1-specific guidance:
	1. the id-PBMAC1 object identifier is permitted as a valid type for
	the DigestAlgorithmIdentifier inside the DigestInfo object. If
	the algorithm field of the DigestAlgorithmIdentifier is id-
	PBMAC1, then the parameters field MUST be present and have the
	value consistent with PBMAC1-params
	2. if the PBMAC1 algorithm is used, the digest value of the
	DigestInfo object MUST be the result of the PBMAC1 calculation
	over the authSafe field using the PBMAC1-params parameters
	3. if the PBMAC1 algorithm is used, the macSalt value MUST be
	ignored, for backwards compatibility it SHOULD NOT be empty
	4. if the PBMAC1 algorithm is used, the iterations value MUST be		| a. The id-PBMAC1 object identifier is permitted as a valid type
	ignored, for backwards compatibility it SHOULD have a non-zero		| for the DigestAlgorithmIdentifier inside the DigestInfo
	positive value		| object. If the algorithm field of the
			| DigestAlgorithmIdentifier is id-PBMAC1, then the parameters
			| field MUST be present and have a value consistent with
			| PBMAC1-params parameters.
			|
			| b. If the PBMAC1 algorithm is used, the digest value of the
			| DigestInfo object MUST be the result of the PBMAC1 calculation
			| over the authSafe field using the PBMAC1-params parameters.
			|
			| c. If the PBMAC1 algorithm is used, the macSalt value MUST be
			| ignored. For backwards compatibility, it SHOULD NOT be empty.
			|
			| d. If the PBMAC1 algorithm is used, the iterations value MUST be
			| ignored. For backwards compatibility, it SHOULD have a non-
			| zero positive value.
	5. Recommended parameters		5. Recommended Parameters
	To provide interoperability between different implementations, all		To provide interoperability between different implementations, all
	implementations of this specification MUST support the PBKDF2 key		implementations of this specification MUST support the PBKDF2 key
	derivation function paired with SHA-256 HMAC [SHA2] [RFC2104] for		derivation function paired with SHA-256 HMAC [SHA2] [RFC2104] for
	both integrity check and as the PBKDF2 pseudorandom function (PRF).		both integrity check and the PBKDF2 pseudorandom function (PRF).
	It's RECOMMENDED for implementations to support other SHA-2 based		It's RECOMMENDED for implementations to support other SHA-2-based
	HMACs. Implementations MAY use other hash functions, like the SHA-3		HMACs. Implementations MAY use other hash functions, like the SHA-3
	family of hash functions SHA-3 [SHA3]. Implementations MAY use other		family of hash functions [SHA3]. Implementations MAY use other KDF
	KDF methods, like the scrypt PBKDF [RFC7914].		methods, like the scrypt PBKDF [RFC7914].
	The length of the key generated by the used KDF MUST be encoded		The length of the key generated by the used KDF MUST be encoded
	explicitly in the parameters field and SHOULD be the same size as the		explicitly in the parameters field and SHOULD be the same size as the
	HMAC function output size. That means that PBMAC1-params specifying		HMAC function output size. This means that PBMAC1-params specifying
	SHA-256 HMAC should also include KDF parameters that generate 32		SHA-256 HMAC should also include KDF parameters that generate a
	octet long key. In particular, when using the PBKDF2, the		32-octet key. In particular, when using the PBKDF2, implementations
	implementations MUST include the keyLen field in the encoded		MUST include the keyLength field in the encoded PBKDF2-params.
	PBKDF2-params. Implementations MUST NOT accept PBKDF2 KDF with		Implementations MUST NOT accept PBKDF2 KDF with PBKDF2-params that
	PBKDF2-params that omit the keyLen field.		omit the keyLength field.
	6. Password encoding		6. Password Encoding
	As documented in Appendix B.1 of RFC 7292 [RFC7292] handling of		As documented in Appendix B.1 of [RFC7292], the handling of password
	password encoding in the underlying standards is underspecified.		encoding in the underlying standards is underspecified. However,
	However, just as with PBES1 and PBES2 when used in the context of		just as with PBES1 and PBES2 when used in the context of PKCS #12
	PKCS#12 objects, all passwords used with PBMAC1 MUST be created from		objects, all passwords used with PBMAC1 MUST be created from
	BMPStrings with a NULL terminator.		BMPStrings with a NULL terminator.
	7. Deprecated Algorithms		7. Deprecated Algorithms
	While attacks against SHA-1 HMACs are not considered practical		While attacks against SHA-1 HMACs are not considered practical
	[RFC6194] to limit the number of algorithms needed for		[RFC6194] to limit the number of algorithms needed for
	interoperatbility, implementations of this specification SHOULD NOT		interoperability, implementations of this specification SHOULD NOT
	use PBKDF2 with the SHA-1 HMAC. Additionally the implementation MUST		use PBKDF2 with the SHA-1 HMAC. In addition, implementations MUST
	NOT use any other message digest functions with output of 160 bits or		NOT use any other message digest functions with an output of 160 bits
	smaller.		or less.
	8. IANA Considerations		8. IANA Considerations
	IANA is requested to assign an object identifier from the SMI		IANA has registered the following object identifier in the "SMI
	Security for S/MIME Module Identifier registry for the ASN.1 module		Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)"
	found in Appendix B.		registry. See Appendix B for the ASN.1 module.
			+=========+=======================+===========+
			| Decimal | Description | Reference |
			+=========+=======================+===========+
			| 76 | id-pkcs12-pbmac1-2023 | RFC 9579 |
			+---------+-----------------------+-----------+
			Table 1
	9. Security Considerations		9. Security Considerations
	Except for use of different key derivation functions, this document		Except for the use of different key derivation functions, this
	doesn't change how the integrity protection on PKCS #12 objects is		document doesn't change how the integrity protection on PKCS #12
	computed; therefore all the original security considerations from RFC		objects is computed; therefore, all the security considerations from
	7292 [RFC7292] apply.		[RFC7292] apply.
	Use of PBMAC1 and PBKDF2 is unchanged from RFC 8018 [RFC8018];		Use of PBMAC1 and PBKDF2 is unchanged from [RFC8018]; therefore, all
	therefore all the original security considerations apply.		the security considerations from [RFC8018] apply.
	The KDFs generally don't have a lower limit for the generated key		The KDFs generally don't have a lower limit for the generated key
	size, allowing specifying very small key sizes (of 1 octet), which		size, allowing the specification of very small key sizes (of 1
	can facilitate brute-force attacks on the HMAC. Since the KDF		octet), which can facilitate brute-force attacks on the HMAC. Since
	parameters are not cryptographically protected and HMACs accept		the KDF parameters are not cryptographically protected and HMACs
	arbitrary key sizes, implementations MAY refuse to process KDF		accept arbitrary key sizes, implementations MAY refuse to process KDF
	parameters that specify small key output sizes or weak parameters.		parameters that specify small key output sizes or weak parameters.
	It's RECOMMENDED to reject any KDF parameters that specify key		It's RECOMMENDED to reject any KDF parameters that specify key
	lengths below 20 octets.		lengths less than 20 octets.
	10. References		10. References
	10.1. Normative References		10.1. Normative References
	[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-		[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
	Hashing for Message Authentication", RFC 2104,		Hashing for Message Authentication", RFC 2104,
	DOI 10.17487/RFC2104, February 1997,		DOI 10.17487/RFC2104, February 1997,
	<https://www.rfc-editor.org/info/rfc2104>.		<https://www.rfc-editor.org/info/rfc2104>.
	skipping to change at page 6, line 14 ¶		skipping to change at line 244 ¶
	[RFC8018] Moriarty, K., Ed., Kaliski, B., and A. Rusch, "PKCS #5:		[RFC8018] Moriarty, K., Ed., Kaliski, B., and A. Rusch, "PKCS #5:
	Password-Based Cryptography Specification Version 2.1",		Password-Based Cryptography Specification Version 2.1",
	RFC 8018, DOI 10.17487/RFC8018, January 2017,		RFC 8018, DOI 10.17487/RFC8018, January 2017,
	<https://www.rfc-editor.org/info/rfc8018>.		<https://www.rfc-editor.org/info/rfc8018>.
	[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC		[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
	2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,		2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
	May 2017, <https://www.rfc-editor.org/info/rfc8174>.		May 2017, <https://www.rfc-editor.org/info/rfc8174>.
	[SHA2] National Institute of Standards and Technology, "Secure		[SHA2] National Institute of Standards and Technology (NIST),
	Hash Standard (SHS)", August 2015,		"Secure Hash Standard (SHS)", FIPS PUB 180-4,
	<https://doi.org/10.6028/NIST.FIPS.180-4>.		DOI 10.6028/NIST.FIPS.180-4, August 2015,
			<https://nvlpubs.nist.gov/nistpubs/FIPS/
			NIST.FIPS.180-4.pdf>.
	[x680] ITU-T, "Information Technology - Abstract Syntax Notation		[x680] ITU-T, "Information technology - Abstract Syntax Notation
	One (ASN.1): Specification of basic notation", ITU-T		One (ASN.1): Specification of basic notation", ITU-T
	Recommendation X.680, ISO/IEC 8824-1:2021, February 2021,		Recommendation X.680, ISO/IEC 8824-1:2021, February 2021,
	<https://www.itu.int/rec/T-REC-X.680>.		<https://www.itu.int/rec/T-REC-X.680>.
	[x681] ITU-T, "Information Technology - Abstract Syntax Notation		[x681] ITU-T, "Information technology - Abstract Syntax Notation
	One (ASN.1): Information object specification", ITU-T		One (ASN.1): Information object specification", ITU-T
	Recommendation X.681, ISO/IEC 8824-2:2021, February 2021,		Recommendation X.681, ISO/IEC 8824-2:2021, February 2021,
	<https://www.itu.int/rec/T-REC-X.681>.		<https://www.itu.int/rec/T-REC-X.681>.
	[x682] ITU-T, "Information Technology - Abstract Syntax Notation		[x682] ITU-T, "Information technology - Abstract Syntax Notation
	One (ASN.1): Constraint specification", ITU-T		One (ASN.1): Constraint specification", ITU-T
	Recommendation X.682, ISO/IEC 8824-3:2021, February 2021,		Recommendation X.682, ISO/IEC 8824-3:2021, February 2021,
	<https://www.itu.int/rec/T-REC-X.682>.		<https://www.itu.int/rec/T-REC-X.682>.
	[x683] ITU-T, "Information Technology - Abstract Syntax Notation		[x683] ITU-T, "Information technology - Abstract Syntax Notation
	One (ASN.1): Parameterization of ASN.1 specifications",		One (ASN.1): Parameterization of ASN.1 specifications",
	ITU-T Recommendation X.683, ISO/IEC 8824-4:2021, February		ITU-T Recommendation X.683, ISO/IEC 8824-4:2021, February
	2021, <https://www.itu.int/rec/T-REC-X.683>.		2021, <https://www.itu.int/rec/T-REC-X.683>.
	[x690] ITU-T, "Information Technology - ASN.1 encoding rules:		[x690] ITU-T, "Information technology - ASN.1 encoding rules:
	Specification of Basic Encoding Rules (BER), Canonical		Specification of Basic Encoding Rules (BER), Canonical
	Encoding Rules (CER) and Distinguished Encoding Rules		Encoding Rules (CER) and Distinguished Encoding Rules
	(DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1:2021,		(DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1:2021,
	February 2021, <https://www.itu.int/rec/T-REC-X.690>.		February 2021, <https://www.itu.int/rec/T-REC-X.690>.
	10.2. Informative References		10.2. Informative References
	[RFC7914] Percival, C. and S. Josefsson, "The scrypt Password-Based		[RFC7914] Percival, C. and S. Josefsson, "The scrypt Password-Based
	Key Derivation Function", RFC 7914, DOI 10.17487/RFC7914,		Key Derivation Function", RFC 7914, DOI 10.17487/RFC7914,
	August 2016, <https://www.rfc-editor.org/info/rfc7914>.		August 2016, <https://www.rfc-editor.org/info/rfc7914>.
	[SHA3] National Institute of Standards and Technology, "SHA-3		[SHA3] National Institute of Standards and Technology (NIST),
	Standard: Permutation-Based Hash and Extendable-Output		"SHA-3 Standard: Permutation-Based Hash and Extendable-
	Functions", August 2015,		Output Functions", FIPS PUB 202,
	<https://doi.org/10.6028/NIST.FIPS.202>.		DOI 10.6028/NIST.FIPS.202, August 2015,
			<https://nvlpubs.nist.gov/nistpubs/FIPS/
			NIST.FIPS.202.pdf>.
	Appendix A. Test Vectors		Appendix A. Test Vectors
	All test vectors use "1234" as the password for both encryption and		All test vectors use "1234" as the password for both encryption and
	integrity protection.		integrity protection.
	A.1. Valid PKCS#12 file with SHA-256 HMAC and PRF		A.1. Valid PKCS #12 File with SHA-256 HMAC and PRF
	The following base64 encoded PKCS#12 file MUST be readable by		The following base64-encoded PKCS #12 file MUST be readable by
	implementations following this RFC.		implementations following this RFC.
	MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb		ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb
	7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb		7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb
	+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF		+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF
	Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9		Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9
	5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy		5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy
	skipping to change at page 8, line 29 ¶		skipping to change at line 357 ¶
	p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU		p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU
	QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0		QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0
	7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE		7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE
	IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM		IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM
	FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq		FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF
	DjA8MCwGCSqGSIb3DQEFDDAfBAhvRzw4sC4xcwICCAACASAwDAYIKoZIhvcNAgkF		DjA8MCwGCSqGSIb3DQEFDDAfBAhvRzw4sC4xcwICCAACASAwDAYIKoZIhvcNAgkF
	ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG		ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG
	3QQITk9UIFVTRUQCAQE=		3QQITk9UIFVTRUQCAQE=
	A.2. Valid PKCS#12 file with SHA-256 HMAC and SHA-512 PRF		A.2. Valid PKCS #12 File with SHA-256 HMAC and SHA-512 PRF
	The following base64 encoded PKCS#12 file SHOULD be readable by		The following base64-encoded PKCS #12 file SHOULD be readable by
	implementations following this RFC.		implementations following this RFC.
	MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAi4j6UBBY2iOgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAi4j6UBBY2iOgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEEFpHSS5zrk/9pkDo1JRbtE6AggPgtbMLGoFd5KLpVXMdcxLrT129L7/vCr0B		ASoEEFpHSS5zrk/9pkDo1JRbtE6AggPgtbMLGoFd5KLpVXMdcxLrT129L7/vCr0B
	0I2tnhPPA7aFtRjjuGbwooCMQwxw9qzuCX1eH4xK2LUw6Gbd2H47WimSOWJMaiUb		0I2tnhPPA7aFtRjjuGbwooCMQwxw9qzuCX1eH4xK2LUw6Gbd2H47WimSOWJMaiUb
	wy4alIWELYufe74kXPmKPCyH92lN1hqu8s0EGhIl7nBhWbFzow1+qpIc9/lpujJo		wy4alIWELYufe74kXPmKPCyH92lN1hqu8s0EGhIl7nBhWbFzow1+qpIc9/lpujJo
	wodSY+pNBD8oBeoU1m6DgOjgc62apL7m0nwavDUqEt7HAqtTBxKxu/3lpb1q8nbl		wodSY+pNBD8oBeoU1m6DgOjgc62apL7m0nwavDUqEt7HAqtTBxKxu/3lpb1q8nbl
	XLTqROax5feXErf+GQAqs24hUJIPg3O1eCMDVzH0h5pgZyRN9ZSIP0HC1i+d1lnb		XLTqROax5feXErf+GQAqs24hUJIPg3O1eCMDVzH0h5pgZyRN9ZSIP0HC1i+d1lnb
	skipping to change at page 9, line 44 ¶		skipping to change at line 420 ¶
	TuuV/JWldNuYXLfVfuv3msfSjSWkv6aRtRWIvmOv0Qba2o05LlwFMd1PzKM5uN4D		TuuV/JWldNuYXLfVfuv3msfSjSWkv6aRtRWIvmOv0Qba2o05LlwFMd1PzKM5uN4D
	DYtsS9A6yQOXEsvUkWcLOJnCs8SkJRdXhJTxdmzeBqM1JttKwLbgGMbpjbxlg3ns		DYtsS9A6yQOXEsvUkWcLOJnCs8SkJRdXhJTxdmzeBqM1JttKwLbgGMbpjbxlg3ns
	N+Z+sEFox+2ZWOglgnBHj0mCZOiAC8wqUu+sxsLT4WndaPWKVqoRQChvDaZaNOaN		N+Z+sEFox+2ZWOglgnBHj0mCZOiAC8wqUu+sxsLT4WndaPWKVqoRQChvDaZaNOaN
	qHciF9HPUcfZow+fH8TnSHneiQcDe6XcMhSaQ2MtpY8/jrgNKguZt22yH9gw/VpT		qHciF9HPUcfZow+fH8TnSHneiQcDe6XcMhSaQ2MtpY8/jrgNKguZt22yH9gw/VpT
	3/QOB7FBgKFIEbvUaf3nVjFIlryIheg+LeiBd2isoMNNXaBwcg2YXukxJTAjBgkq		3/QOB7FBgKFIEbvUaf3nVjFIlryIheg+LeiBd2isoMNNXaBwcg2YXukxJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF
	DjA8MCwGCSqGSIb3DQEFDDAfBAgUr2yP+/DBrgICCAACASAwDAYIKoZIhvcNAgsF		DjA8MCwGCSqGSIb3DQEFDDAfBAgUr2yP+/DBrgICCAACASAwDAYIKoZIhvcNAgsF
	ADAMBggqhkiG9w0CCQUABCA5zFL93jw8ItGlcbHKhqkNwbgpp6layuOuxSju4/Vd		ADAMBggqhkiG9w0CCQUABCA5zFL93jw8ItGlcbHKhqkNwbgpp6layuOuxSju4/Vd
	6QQITk9UIFVTRUQCAQE=		6QQITk9UIFVTRUQCAQE=
	A.3. Valid PKCS#12 file with SHA-512 HMAC and PRF		A.3. Valid PKCS #12 File with SHA-512 HMAC and PRF
	The following base64 encoded PKCS#12 file SHOULD be readable by		The following base64-encoded PKCS #12 file SHOULD be readable by
	implementations following this RFC.		implementations following this RFC.
	MIIKrAIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKrAIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAisrqL8obSBaQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAisrqL8obSBaQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEECjXYYca0pwsgn1Imb9WqFGAggPgT7RcF5YzEJANZU9G3tSdpCHnyWatTlhm		ASoEECjXYYca0pwsgn1Imb9WqFGAggPgT7RcF5YzEJANZU9G3tSdpCHnyWatTlhm
	iCEcBGgwI5gz0+GoX+JCojgYY4g+KxeqznyCu+6GeD00T4Em7SWme9nzAfBFzng0		iCEcBGgwI5gz0+GoX+JCojgYY4g+KxeqznyCu+6GeD00T4Em7SWme9nzAfBFzng0
	3lYCSnahSEKfgHerbzAtq9kgXkclPVk0Liy92/buf0Mqotjjs/5o78AqP86Pwbj8		3lYCSnahSEKfgHerbzAtq9kgXkclPVk0Liy92/buf0Mqotjjs/5o78AqP86Pwbj8
	xYNuXOU1ivO0JiW2c2HefKYvUvMYlOh99LCoZPLHPkaaZ4scAwDjFeTICU8oowVk		xYNuXOU1ivO0JiW2c2HefKYvUvMYlOh99LCoZPLHPkaaZ4scAwDjFeTICU8oowVk
	LKvslrg1pHbfmXHMFJ4yqub37hRtj2CoJNy4+UA2hBYlBi9WnuAJIsjv0qS3kpLe		LKvslrg1pHbfmXHMFJ4yqub37hRtj2CoJNy4+UA2hBYlBi9WnuAJIsjv0qS3kpLe
	skipping to change at page 11, line 14 ¶		skipping to change at line 483 ¶
	3bI79uKo4we2g+WaEJlEzQ7147ZzV2wbDq89W69x1MWTfaDwlEtd4UaacYchAv7B		3bI79uKo4we2g+WaEJlEzQ7147ZzV2wbDq89W69x1MWTfaDwlEtd4UaacYchAv7B
	TVaaVFiRAUywWaHGePpZG2WV1feH/zd+temxWR9qMFgBZySg1jipBPVciwl0LqlW		TVaaVFiRAUywWaHGePpZG2WV1feH/zd+temxWR9qMFgBZySg1jipBPVciwl0LqlW
	s/raIBYmLmAaMMgM3759UkNVznDoFHrY4z2EADXp0RHHVzJS1x+yYvp/9I+AcW55		s/raIBYmLmAaMMgM3759UkNVznDoFHrY4z2EADXp0RHHVzJS1x+yYvp/9I+AcW55
	oN0UP/3uQ6eyz/ix22sovQwhMJ8rmgR6CfyRPKmXu1RPK3puNv7mbFTfTXpYN2vX		oN0UP/3uQ6eyz/ix22sovQwhMJ8rmgR6CfyRPKmXu1RPK3puNv7mbFTfTXpYN2vX
	vhEZReXY8hJF/9o4G3UrJ1F0MgUHMCG86cw1z0bhPSaXVoufOnx/fRoxJTAjBgkq		vhEZReXY8hJF/9o4G3UrJ1F0MgUHMCG86cw1z0bhPSaXVoufOnx/fRoxJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwgZ0wgY0wSQYJKoZIhvcN		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwgZ0wgY0wSQYJKoZIhvcN
	AQUOMDwwLAYJKoZIhvcNAQUMMB8ECFDaXOUaOcUPAgIIAAIBQDAMBggqhkiG9w0C		AQUOMDwwLAYJKoZIhvcNAQUMMB8ECFDaXOUaOcUPAgIIAAIBQDAMBggqhkiG9w0C
	CwUAMAwGCCqGSIb3DQILBQAEQHIAM8C9OAsHUCj9CmOJioqf7YwD4O/b3UiZ3Wqo		CwUAMAwGCCqGSIb3DQILBQAEQHIAM8C9OAsHUCj9CmOJioqf7YwD4O/b3UiZ3Wqo
	F6OmQIRDc68SdkZJ6024l4nWlnhTE7a4lb2Tru4k3NOTa1oECE5PVCBVU0VEAgEB		F6OmQIRDc68SdkZJ6024l4nWlnhTE7a4lb2Tru4k3NOTa1oECE5PVCBVU0VEAgEB
	A.4. Invalid PKCS#12 file with incorrect iteration count		A.4. Invalid PKCS #12 File with Incorrect Iteration Count
	The following base64 encoded PKCS#12 file MUST NOT be readable by an		The following base64-encoded PKCS #12 file MUST NOT be readable by an
	implementation following this RFC when it is verifying itegrity		implementation following this RFC when it is verifying integrity
	protection.		protection.
	MIIKiwIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKiwIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb		ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb
	7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb		7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb
	+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF		+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF
	Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9		Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9
	5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy		5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy
	skipping to change at page 12, line 30 ¶		skipping to change at line 547 ¶
	p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU		p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU
	QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0		QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0
	7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE		7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE
	IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM		IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM
	FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq		FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfTBtMEkGCSqGSIb3DQEF		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfTBtMEkGCSqGSIb3DQEF
	DjA8MCwGCSqGSIb3DQEFDDAfBAhvRzw4sC4xcwICCAECASAwDAYIKoZIhvcNAgkF		DjA8MCwGCSqGSIb3DQEFDDAfBAhvRzw4sC4xcwICCAECASAwDAYIKoZIhvcNAgkF
	ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG		ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG
	3QQITk9UIFVTRUQCAggA		3QQITk9UIFVTRUQCAggA
	A.5. Invalid PKCS#12 file with incorrect salt		A.5. Invalid PKCS #12 File with Incorrect Salt
	The following base64 encoded PKCS#12 file MUST NOT be readable by an		The following base64-encoded PKCS #12 file MUST NOT be readable by an
	implementation following this RFC when it is verifying itegrity		implementation following this RFC when it is verifying integrity
	protection.		protection.
	MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKigIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb		ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb
	7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb		7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb
	+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF		+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF
	Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9		Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9
	5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy		5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy
	skipping to change at page 13, line 46 ¶		skipping to change at line 611 ¶
	p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU		p8wyik/BlndxN9eKbdTOi2wIi64h2QG8nOk66wQ/PSIJYwZl6eDNEQSzH/1mGCfU
	QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0		QnUT17UC/p+Qgenf6Auap2GWlvsJrB7u/pytz65rtjt/ouo6Ih6EwWqwVVpGXZD0
	7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE		7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE
	IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM		IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM
	FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq		FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwfDBtMEkGCSqGSIb3DQEF
	DjA8MCwGCSqGSIb3DQEFDDAfBAhOT1QgVVNFRAICCAACASAwDAYIKoZIhvcNAgkF		DjA8MCwGCSqGSIb3DQEFDDAfBAhOT1QgVVNFRAICCAACASAwDAYIKoZIhvcNAgkF
	ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG		ADAMBggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG
	3QQIb0c8OLAuMXMCAQE=		3QQIb0c8OLAuMXMCAQE=
	A.6. Invalid PKCS#12 file with missing key length		A.6. Invalid PKCS #12 File with Missing Key Length
	The following base64 encoded PKCS#12 file MUST NOT be readable by an		The following base64-encoded PKCS #12 file MUST NOT be readable by an
	implementation following this RFC when it is verifying itegrity		implementation following this RFC when it is verifying integrity
	protection.		protection.
	MIIKiAIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH		MIIKiAIBAzCCCgUGCSqGSIb3DQEHAaCCCfYEggnyMIIJ7jCCBGIGCSqGSIb3DQEH
	BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG		BqCCBFMwggRPAgEAMIIESAYJKoZIhvcNAQcBMFcGCSqGSIb3DQEFDTBKMCkGCSqG
	SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME		SIb3DQEFDDAcBAg9pxXxY2yscwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQME
	ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb		ASoEEK7yYaFQDi1pYwWzm9F/fs+AggPgFIT2XapyaFgDppdvLkdvaF3HXw+zjzKb
	7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb		7xFC76DtVPhVTWVHD+kIss+jsj+XyvMwY0aCuAhAG/Dig+vzWomnsqB5ssw5/kTb
	+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF		+TMQ5PXLkNeoBmB6ArKeGc/QmCBQvQG/a6b+nXSWmxNpP+71772dmWmB8gcSJ0kF
	Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9		Fj75NrIbmNiDMCb71Q8gOzBMFf6BpXf/3xWAJtxyic+tSNETfOJa8zTZb0+lV0w9
	5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy		5eUmDrPUpuxEVbb0KJtIc63gRkcfrPtDd6Ii4Zzbzj2Evr4/S4hnrQBsiryVzJWy
	skipping to change at page 15, line 16 ¶		skipping to change at line 677 ¶
	7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE		7gVWH0Ke/Vr6aPGNvkLcmftPuDZsn9jiig3guhdeyRVf10Ox369kKWcG75q77hxE
	IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM		IzSzDyUlBNbnom9SIjut3r+qVYmWONatC6q/4D0I42Lnjd3dEyZx7jmH3g/S2ASM
	FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq		FzWr9pvXc61dsYOkdZ4PYa9XPUZxXFagZsoS3F1sU799+IJVU0tC0MExJTAjBgkq
	hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwejBqMEYGCSqGSIb3DQEF		hkiG9w0BCRUxFgQUwWO5DorvVWYF3BWUmAw0rUEajScwejBqMEYGCSqGSIb3DQEF
	DjA5MCkGCSqGSIb3DQEFDDAcBAhvRzw4sC4xcwICCAAwDAYIKoZIhvcNAgkFADAM		DjA5MCkGCSqGSIb3DQEFDDAcBAhvRzw4sC4xcwICCAAwDAYIKoZIhvcNAgkFADAM
	BggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG3QQI		BggqhkiG9w0CCQUABCB6pW2FOdcCNj87zS64NUXG36K5aXDnFHctIk5Bf4kG3QQI
	b0c8OLAuMXMCAggA		b0c8OLAuMXMCAggA
	Appendix B. ASN.1 Module		Appendix B. ASN.1 Module
	Note to RFC Editor: please change the TBD value below with the value		This appendix documents ASN.1 [x680] [x681] [x682] [x683] [x690]
	assigned by IANA		types, values, and object sets for this specification. It does so by
	This appendix documents ASN.1 [x680] [x681][x682][x683] [x690] types,
	values, and object sets for this specification. It does so by
	providing an ASN.1 module called PKCS12-PBMAC1-2023.		providing an ASN.1 module called PKCS12-PBMAC1-2023.
	Combine this module with the PKCS-12 ASN.1 module found in Appendix D		Combine this module with the PKCS-12 ASN.1 module found in Appendix D
	of [RFC8018] to add SHA-2 based HMACs by replacing the PBKDF2-PRFs		of [RFC7292] and the pkcs5v2-1 ASN.1 module in Appendix C of
	class found therein.		[RFC8018] to add SHA-2-based HMACs by replacing the PBKDF2-PRFs class
			referenced from [RFC7292].
	PKCS12-PBMAC1-2023		PKCS12-PBMAC1-2023
	{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)		{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
	smime(16) id-mod(0) pbkc12-pbamc1-2023(TBD) }		smime(16) id-mod(0) id-pkcs12-pbmac1-2023(76) }
	DEFINITIONS EXPLICIT TAGS ::=		DEFINITIONS EXPLICIT TAGS ::=
	BEGIN		BEGIN
	IMPORTS		IMPORTS
	AlgorithmIdentifier, ALGORITHM-IDENTIFIER, rsadsi		AlgorithmIdentifier, ALGORITHM-IDENTIFIER, rsadsi
	FROM PKCS5v2-1 -- From [RFC8018]		FROM PKCS5v2-1 -- From [RFC8018]
	{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-5(5)		{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-5(5)
	modules(16) pkcs5v2-1(2) }		modules(16) pkcs5v2-1(2) }
	skipping to change at page 17, line 39 ¶		skipping to change at line 792 ¶
	keyLength INTEGER (1..MAX) OPTIONAL,		keyLength INTEGER (1..MAX) OPTIONAL,
	prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT algid-hmacWithSHA1		prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT algid-hmacWithSHA1
	}		}
	PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... }		PBKDF2-SaltSources ALGORITHM-IDENTIFIER ::= { ... }
	END		END
	Author's Address		Author's Address
	Hubert Kario (editor)		Hubert Kario
	Red Hat, Inc.		Red Hat, Inc.
	Purkynova 115		Purkynova 115
	61200 Brno		61200 Brno
	Czech Republic		Czech Republic
	Email: hkario@redhat.com		Email: hkario@redhat.com
End of changes. 53 change blocks.
	166 lines changed or deleted		177 lines changed or added
This html diff was produced by rfcdiff 1.48.