On Fri, Feb 14, 2003, Aleix Conchillo Flaque wrote: > > hi, > > basically, the question is: which are the security benefits of adding a > MAC to a PKCS#12? >
Its an integrity check so it stops an attacker changing the contents of the file, however some implementations will silently ignore an absent MAC so that wont help. Being able to modify the file in specific ways allows certain attacks to be performed. However a MAC can also reduce security if it uses the same password as the encryption and it has a low iteration count compared to the encryption. This is because that makes a dictionary attack on the MAC easier than one on the encryption. Steve. -- Dr Stephen N. Henson. Core developer of the OpenSSL project: http://www.openssl.org/ Freelance consultant see: http://www.drh-consultancy.demon.co.uk/ Email: [EMAIL PROTECTED], PGP key: via homepage. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
