CVSROOT: /cvs
Module name: src
Changes by: t...@cvs.openbsd.org 2025/05/10 13:01:16
Modified files:
lib/libcrypto/pkcs12: pkcs12.h
Log message:
Increase default PKCS12_SALT_LEN from 8 to 16 bytes
Currently PKCS12_setup_mac() function uses salt length of 8 bytes / 64
bits when no salt length is specified. Increase this fallback default
to 16 bytes / 128 bits, as recommended by NIST SP 800-132.
Note this is for interoperability purposes. Some FIPS implementations
enforce minimum salt length of 16 bytes. Examples of such FIPS
implemenations are Bouncycastle FIPS Java API and Chainguard FIPS
Provider for OpenSSL. Also future v3.6 release of OpenSSL will also
increase the default salt length to 16 bytes.
>From Dimitri John Ledkov, thanks
