Parameters used for password integrity mode.

Read a PKCS #12 file from disk.

Read a PKCS #12 file from a bytearray in BER format.

Write a PKCS #12 file to disk.

Write a PKCS #12 file to a bytearray in DER format.

Write a PKCS #12 file without integrity protection to disk.

Write a PKCS #12 file without integrity protection to a bytearray in DER format.

PKCS #12 privacy wrapper, adding optional encryption to SafeContents. ASN.1 equivalent is AuthenticatedSafe.

The semigroup interface allows to combine multiple pieces encrypted separately but they should all derive from the same password to be readable by unPKCS12 and most other software.

Read the contents of a PKCS #12. The same privacy password will be used for all content elements.

This convenience function returns a Protected value as soon as one element at least is encrypted. This does not mean all elements were actually protected in the input. If detailed view is required then function unPKCS12' is also available.

Read the contents of a PKCS #12.

Build a PKCS #12 without encryption. Usage scenario is when private keys are already encrypted with PKCS8ShroudedKeyBag.

Build a PKCS #12 encrypted with the specified scheme and password.

Content objects stored in a PKCS #12.

Main bag type in a PKCS #12.

Polymorphic PKCS #12 bag parameterized by the payload data type.

Main bag payload in PKCS #12 contents.

Certificate bags. Only X.509 certificates are supported.

CRL bags. Only X.509 CRLs are supported.

An attribute extending the parent structure with arbitrary data.

Return all private keys contained in the safe contents.

Return all private keys contained in the safe content list. All shrouded private keys must derive from the same password.

This convenience function returns a Protected value as soon as one key at least is encrypted. This does not mean all keys were actually protected in the input. If detailed view is required then function getSafeKeys is available.

Return all X.509 certificates contained in the safe contents.

Return all X.509 certificates contained in the safe content list.

Return all X.509 CRLs contained in the safe contents.

Return all X.509 CRLs contained in the safe content list.

Return the values for the first attribute with the specified type.

Add or replace an attribute in a list of attributes.

Filter a list of attributes based on a predicate applied to attribute type.

Return the value of the friendlyName attribute.

Add or replace the friendlyName attribute in a list of attributes.

Return the value of the localKeyId attribute.

Add or replace the localKeyId attribute in a list of attributes.

Build a PKCS12 value containing a private key and certificate chain. Distinct encryption is applied for both. Encrypting the certificate chain is optional.

Note: advice is to always generate fresh and independent EncryptionScheme values so that the salt is not reused twice in the encryption process.

Build a PKCS12 value containing a private key and certificate chain identified with the specified friendly name. Distinct encryption is applied for private key and certificates. Encrypting the certificate chain is optional.

Note: advice is to always generate fresh and independent EncryptionScheme values so that the salt is not reused twice in the encryption process.

Extract the private key and certificate chain from a PKCS12 value. A credential is returned when the structure contains exactly one private key and at least one X.509 certificate.

Extract a private key and certificate chain with the specified friendly name from a PKCS12 value. A credential is returned when the structure contains exactly one private key and one X.509 certificate with the name.

A password stored as a sequence of UTF-8 bytes.

Some key-derivation functions add restrictions to what characters are supported.

Beware: fromString truncates multi-byte characters. If the string may contain non-ASCII characters, prefer instead fromProtectionPassword . fromString.

Data type for objects that are possibly authenticated with a password.

Content is verified and retrieved by providing a Password value. When verification is successful, a value of type ProtectionPassword is also returned and this value can be fed to an inner decryption layer that needs the same password (usual case for PKCS #12).

Try to recover an OptAuthenticated content using the specified password.

When successful, the content is returned, as well as the password converted to type ProtectionPassword. This password value can then be fed to the inner decryption layer when both passwords are known to be same (usual case for PKCS #12).

A password stored as a sequence of UTF-8 bytes.

Some key-derivation functions add restrictions to what characters are supported.

The data type provides a special value emptyNotTerminated that is used as alternate representation of empty passwords on some systems and that produces encryption results different than an empty bytearray.

Conversion to/from a regular sequence of bytes is possible with functions toProtectionPassword and fromProtectionPassword.

Beware: the fromString implementation correctly handles multi-byte characters, so here is not equivalent to the ByteString counterpart.

A value denoting an empty password, but having a special encoding when deriving a symmetric key on some systems, like the certificate export wizard on Windows.

This value is different from toProtectionPassword "" and can be tried when decrypting content with a password known to be empty.

Extract the UTF-8 bytes in a password value.

Build a password value from a sequence of UTF-8 bytes.

When the password is empty, the special value emptyNotTerminated may be tried as well.

Data type for objects that are possibly protected with a password.

Try to recover an OptProtected content using the specified password.

Try to recover an OptProtected content in an applicative context. The applicative password is used if necessary.

import qualified Data.ByteString as B
import           Crypto.Store.PKCS8

[encryptedKey] <- readKeyFile "privkey.pem"
let askForPassword = putStr "Please enter password: " >> B.getLine
result <- recoverA (toProtectionPassword <$> askForPassword) encryptedKey
case result of
    Left err  -> putStrLn $ "Unable to recover key: " ++ show err
    Right key -> print key