Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder - #453
Open
aidangarske wants to merge 8 commits into
Open
Encrypt PKCS#8 keys when a cipher is set on the PrivateKeyInfo encoder#453aidangarske wants to merge 8 commits into
aidangarske wants to merge 8 commits into
Conversation
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
July 28, 2026 17:15
ac3f5e5 to
87304bc
Compare
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
July 28, 2026 21:29
87304bc to
736e81f
Compare
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
July 28, 2026 22:11
27cb2e5 to
b266849
Compare
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
July 29, 2026 03:47
6566c83 to
f821937
Compare
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
July 31, 2026 18:01
7e7b41c to
d8c513f
Compare
padelsbach
reviewed
Aug 3, 2026
padelsbach
previously approved these changes
Aug 3, 2026
padelsbach
left a comment
Contributor
There was a problem hiding this comment.
Would prefer if we had an actual command line test as shown in the PR description, but can be a follow up
Member
Author
I agree let me add that |
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
3 times, most recently
from
August 3, 2026 21:59
a809327 to
86e10e4
Compare
aidangarske
force-pushed
the
fix-pki-cipher-encrypt
branch
from
August 3, 2026 22:34
86e10e4 to
ba4b462
Compare
padelsbach
approved these changes
Aug 4, 2026
Contributor
|
LGTM, let's give @ColtonWilley a chance to look at this one |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
openssl pkey -aes256silently wrote unencrypted private keys forEC, Ed25519, X25519, DH and ML-DSA(RSA was fine) because the encoders only encrypted when the caller explicitly asked for theEncryptedPrivateKeyInfostructure, ignoring a cipher set on the ordinaryPrivateKeyInfopath now they encrypt whenever a cipher is set plus a DH fix so generated keys don't encode an empty private value.CLI-testing the new SLH-DSA encoders using
openssl pkey -aes256emittedBEGIN PRIVATE KEYinstead ofBEGIN ENCRYPTED PRIVATE KEYAdded PKCS8 openssl scripts testing