PKCS12_GEN_MAC(3ossl)

📦
version 3.5.9 · 8 versions
, in fedora 43, fedora 44

💖 PKCS12_GEN_MAC 💖

okay bestie, gather round, because we're talking about the PKCS12_gen_mac, PKCS12_setup_mac, PKCS12_set_mac, PKCS12_set_pbmac1_pbkdf2, PKCS12_verify_mac, and PKCS12_get0_mac girlies — literally the functions that create and manipulate a PKCS#12 MAC structure. this is the OpenSSL manual, section 3ossl, and she is serving.

✨ SYNOPSIS ✨

#include <openssl/pkcs12.h>

int PKCS12_gen_mac(PKCS12 *p12, const char *pass, int passlen,
                   unsigned char *mac, unsigned int *maclen);
int PKCS12_verify_mac(PKCS12 *p12, const char *pass, int passlen);
int PKCS12_set_mac(PKCS12 *p12, const char *pass, int passlen,
                   unsigned char *salt, int saltlen, int iter,
                   const EVP_MD *md_type);
int PKCS12_set_pbmac1_pbkdf2(PKCS12 *p12, const char *pass, int passlen,
                                  unsigned char *salt, int saltlen, int iter,
                                  const EVP_MD *md_type,
                                  const char *prf_md_name);
int PKCS12_setup_mac(PKCS12 *p12, int iter, unsigned char *salt,
                     int saltlen, const EVP_MD *md_type);

void PKCS12_get0_mac(const ASN1_OCTET_STRING **pmac,
                     const X509_ALGOR **pmacalg,
                     const ASN1_OCTET_STRING **psalt,
                     const ASN1_INTEGER **piter,
                     const PKCS12 *p12);

like. look at them. six little icons. 💅

🌸 DESCRIPTION 🌸

PKCS12_gen_mac() generates an HMAC over the entire PKCS#12 object, using the password you hand her plus a whole set of parameters that are already configured. and the default key generation mechanism she's using? PKCS12KDF. that's the vibe, that's the default, no notes. 🎀

PKCS12_verify_mac() checks the PKCS#12 object's HMAC against the password you gave her. she's the vibe check fr fr. ✅

PKCS12_setup_mac() sets up the MAC part of the PKCS#12 structure using the parameters you supply.

PKCS12_set_mac() sets the MAC and the MAC parameters into the PKCS#12 object. and PKCS12_set_pbmac1_pbkdf2() does that same thing — MAC + MAC parameters into the PKCS#12 object — but specifically when PBMAC1 with PBKDF2 is what's protecting the PKCS#12 object. different girl, different algorithm. 👑

now the arguments, bestie, listen up:

  • pass — the passphrase to use in the HMAC.
  • salt — the salt value to use.
  • iter — the iteration count.
  • md_type — the message digest function to use.
  • prf_md_name — specifies the digest used for the PBKDF2 in PBMAC1 KDF.

and PKCS12_get0_mac()? she retrieves. any included MAC value, the X509_ALGOR object, the salt, and the iter count — all pulled straight out of the PKCS12 object. getting the receipts, as she should. 🧚

📝 NOTES 📝

  • If salt is NULL then a suitable salt will be generated and used. she'll pick for you, don't worry. ✨
  • If iter is 1 then an iteration count will be omitted from the PKCS#12 structure. (yes, omitted. gone. not there. periodt.)
  • PKCS12_gen_mac(), PKCS12_verify_mac(), PKCS12_set_mac() and PKCS12_set_pbmac1_pbkdf2() all make assumptions regarding the encoding of the given passphrase. see passphrase-encoding(7) for more info — go read it, i'm serious. 🫶

🫶 RETURN VALUES 🫶

all functions returning an integer return 1 on success and 0 if an error occurred. that's it. binary. iconic. no in-between, no "it's complicated". 💀

👑 CONFORMING TO 👑

standardized and certified, we love a compliant queen. 🌈

🔥 SEE ALSO 🔥

go read them, they're all part of the same friend group i promise.

💜 HISTORY 💜

the PKCS12_set_pbmac1_pbkdf2 function was added in OpenSSL 3.4. babygirl is new but she's already main character energy. 🌟

Copyright 2021-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

real talk: legal text stays legal text, bestie. don't skip it. 🙈

and that's the whole page!! this was OpenSSL 3.5.9, dated 2026-09-29, and the manual page is PKCS12_GEN_MAC(3ossl). mwah, love you, go generate some MACs responsibly 💖✨🦋

📦 where this page comes from