{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/9","repository_url":"https://api.github.com/repos/dotnet/corefx-testdata","labels_url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/9/comments","events_url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/9/events","html_url":"https://github.com/dotnet/corefx-testdata/pull/9","id":153834290,"number":9,"title":"Remove the friendly name attribute from PFX private keys.","user":{"login":"bartonjs","id":10642668,"avatar_url":"https://avatars.githubusercontent.com/u/10642668?v=3","gravatar_id":"","url":"https://api.github.com/users/bartonjs","html_url":"https://github.com/bartonjs","followers_url":"https://api.github.com/users/bartonjs/followers","following_url":"https://api.github.com/users/bartonjs/following{/other_user}","gists_url":"https://api.github.com/users/bartonjs/gists{/gist_id}","starred_url":"https://api.github.com/users/bartonjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bartonjs/subscriptions","organizations_url":"https://api.github.com/users/bartonjs/orgs","repos_url":"https://api.github.com/users/bartonjs/repos","events_url":"https://api.github.com/users/bartonjs/events{/privacy}","received_events_url":"https://api.github.com/users/bartonjs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-09T18:03:55Z","updated_at":"2016-05-09T18:15:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/dotnet/corefx-testdata/pulls/9","html_url":"https://github.com/dotnet/corefx-testdata/pull/9","diff_url":"https://github.com/dotnet/corefx-testdata/pull/9.diff","patch_url":"https://github.com/dotnet/corefx-testdata/pull/9.patch"},"body":"Windows, when creating a PFX, uses the friendly name attribute on a private key to record\r\nthe key name at the time of export. On import this same name is used, if available.\r\nHowever, during a parallel load of the PFX there's a race condition where it has been determined\r\nthat the key name is not in use but the key file has not yet been written. This allows parallel\r\nreaders (same process or different) to collide on the key container name, and later cleanup can\r\ncause unpredictable results.\r\n\r\nThe friendly name stripping was done with OpenSSL, using the following algorithm:\r\n* Validate MAC (check existing password)\r\n* Unpack the PKCS#7 authsafes from the PKCS#12 structure\r\n* Foreach authsafe\r\n    * If the authtype is other than data, copy it as-is to the new authsafes list.\r\n    * Otherwise (aka if pkcs7-data)\r\n        * Unpack the PKCS#12 safebag from the PKCS#7 data blob\r\n        * If the safebag's attribute collection contains 1.2.840.113549.1.9.20 then remove it.\r\n        * Pack the safebag (modified or no) into a PKCS#7 data blob, append it to the new authsafes list.\r\n* Regenerate the MAC using the same password (since the encrypted materials are still using the same key)\r\n\r\nThis approach was chosen over doing an ephemeral import followed by an export in Windows because OpenSSL\r\nexposes enough primitives to do the surgery without re-interpretation of the metadata, so it's a more\r\nminimal change to the datafiles than using Windows would be. The before and after can be diffed under ASN.1\r\nrules to determine that only two changes happened: 1) removal of any friendly name attributes,\r\n2) MAC regeneration.\r\n\r\ncc: @weshaggard @AtsushiKan "},"comment":{"url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/comments/217944379","html_url":"https://github.com/dotnet/corefx-testdata/pull/9#issuecomment-217944379","issue_url":"https://api.github.com/repos/dotnet/corefx-testdata/issues/9","id":217944379,"user":{"login":"AtsushiKan","id":13223578,"avatar_url":"https://avatars.githubusercontent.com/u/13223578?v=3","gravatar_id":"","url":"https://api.github.com/users/AtsushiKan","html_url":"https://github.com/AtsushiKan","followers_url":"https://api.github.com/users/AtsushiKan/followers","following_url":"https://api.github.com/users/AtsushiKan/following{/other_user}","gists_url":"https://api.github.com/users/AtsushiKan/gists{/gist_id}","starred_url":"https://api.github.com/users/AtsushiKan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AtsushiKan/subscriptions","organizations_url":"https://api.github.com/users/AtsushiKan/orgs","repos_url":"https://api.github.com/users/AtsushiKan/repos","events_url":"https://api.github.com/users/AtsushiKan/events{/privacy}","received_events_url":"https://api.github.com/users/AtsushiKan/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T18:15:32Z","updated_at":"2016-05-09T18:15:32Z","body":"What about the ones loaded from static byte arrays in memory?\r\n\r\n\r\n\r\n"}}