keytool and key password on PKCS#12 stores

[Bruno Harbulot]

Hello,

I've always thought that the keystore password and the key password
itself had to be the same in a PKCS12 keystore, due to constraints in
the PKCS#12 format. It appears this is not quite the case with the
Java implementation, especially with a PKCS#12 store generated with
keytool.

When importing a PKCS#12 store into another PKCS#12 store, keytool
changes the store password, but doesn't change the actual key
password. However, keytool -keypasswd doesn't allow to change the key
password itself on a PKCS#12 store.

To test this, generate a PKCS#12 keystore (keystore1.p12):

    keytool -genkeypair -dname "CN=test" -storetype PKCS12 -keystore
keystore1.p12 -storepass testabcd

Import/export this store into another PKCS#12 keystore (keystore2.p12):

   keytool -importkeystore -srckeystore keystore1.p12 -srcstoretype
PKCS12 -srcstorepass testabcd -destkeystore keystore2.p12
-deststoretype PKCS12 -deststorepass test1234

This will change the store password from testabcd to test1234, but the
key password will still be testabcd. This can be tested with the
following code:

    KeyStore ks = KeyStore.getInstance("PKCS12");
    InputStream ksis = new FileInputStream("keystore2.p12");
    try {
        ks.load(ksis, "test1234".toCharArray()); // New password
    } finally {
        if (ksis != null) {
            ksis.close();
        }
    }
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory
            .getDefaultAlgorithm());
    // New password, fails:
    kmf.init(ks, "test1234".toCharArray());
    // Old password, works:
    // kmf.init(ks, "testabcd".toCharArray());


I must admit I'm not familiar with the details of the PKCS#12
specifications, but I think all the other tools I've seen that use the
PKCS#12 format only have a password for the store, not for the
individual keys. In fact, it seems that Firefox is capable of
importing and using keystore2.p12 from the example above using only
the store password, despite producing an error message.
Shouldn't keytool -importkeystore also change the key passwords (or at
least there seems to be a padding issue)? Here is the error message:

    Caused by: javax.crypto.BadPaddingException: Given final block not
properly padded
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:811)
	at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:676)
	at com.sun.crypto.provider.PKCS12PBECipherCore.implDoFinal(PKCS12PBECipherCore.java:355)
	at com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede.engineDoFinal(PKCS12PBECipherCore.java:387)
	at javax.crypto.Cipher.doFinal(Cipher.java:2087)
	... 6 more


Best wishes,

Bruno.