Add support for Java keytool PKCS#12 files with symmetric secret keys

Introduce PKCS12_PARSE_CTX opaque context for PKCS12_parse_ex(), replacing
the growing parameter list pattern. Add PKCS12_decrypt_secretbag() for
decrypting secret bags and PKCS12_SAFEBAG_get1_skey() for converting
decrypted PKCS8 data to EVP_SKEY, following the existing private key
pattern (PKCS12_decrypt_skey_ex + EVP_PKCS82PKEY_ex).

Assisted-by: Claude Opus 4.6 <[email protected]>

Reviewed-by: Mounir Idrassi <[email protected]>
Reviewed-by: Simo Sorce <[email protected]>
MergeDate: Thu Sep 24 07:34:22 2026
(Merged from https://github.com/openssl/openssl/pull/30937)

2 files changed, 31 insertions, 0 deletions

diff --git a/include/openssl/evp.h b/include/openssl/evp.h.in
index 55503411eb9..7bad41ba794 100644
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h.in
@@ -7,6 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
+/* clang-format off */
+{-
+use OpenSSL::stackhash qw(generate_stack_macros);
+-}
+/* clang-format on */
+
 #ifndef OPENSSL_EVP_H
 #define OPENSSL_EVP_H
 #pragma once
@@ -118,6 +124,12 @@
 extern "C" {
 #endif
 
+/* clang-format off */
+{-
+    generate_stack_macros("EVP_SKEY");
+-}
+/* clang-format on */
+
 int EVP_set_default_properties(OSSL_LIB_CTX *libctx, const char *propq);
 char *EVP_get1_default_properties(OSSL_LIB_CTX *libctx);
 int EVP_default_properties_is_fips_enabled(OSSL_LIB_CTX *libctx);
diff --git a/include/openssl/pkcs12.h.in b/include/openssl/pkcs12.h.in
index 6555322be31..e966228ea94 100644
--- a/include/openssl/pkcs12.h.in
+++ b/include/openssl/pkcs12.h.in
@@ -27,6 +27,7 @@ use OpenSSL::stackhash qw(generate_stack_macros);
 #include <openssl/bio.h>
 #include <openssl/core.h>
 #include <openssl/x509.h>
+#include <openssl/evp.h>
 #include <openssl/pkcs12err.h>
 #ifndef OPENSSL_NO_STDIO
 #include <stdio.h>
@@ -125,6 +126,8 @@ X509 *PKCS12_SAFEBAG_get1_cert_ex(const PKCS12_SAFEBAG *bag, OSSL_LIB_CTX *libct
 X509 *PKCS12_SAFEBAG_get1_cert(const PKCS12_SAFEBAG *bag);
 X509_CRL *PKCS12_SAFEBAG_get1_crl_ex(const PKCS12_SAFEBAG *bag, OSSL_LIB_CTX *libctx, const char *propq);
 X509_CRL *PKCS12_SAFEBAG_get1_crl(const PKCS12_SAFEBAG *bag);
+EVP_SKEY *PKCS8_PRIV_KEY_INFO_get1_skey(const PKCS8_PRIV_KEY_INFO *p8inf,
+    OSSL_LIB_CTX *libctx, const char *propq);
 const STACK_OF(PKCS12_SAFEBAG) *
 PKCS12_SAFEBAG_get0_safes(const PKCS12_SAFEBAG *bag);
 const PKCS8_PRIV_KEY_INFO *PKCS12_SAFEBAG_get0_p8inf(const PKCS12_SAFEBAG *bag);
@@ -163,6 +166,9 @@ PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_skey_ex(const PKCS12_SAFEBAG *bag,
     const char *pass, int passlen,
     OSSL_LIB_CTX *ctx,
     const char *propq);
+PKCS8_PRIV_KEY_INFO *PKCS12_decrypt_secretbag(const PKCS12_SAFEBAG *bag,
+    const char *pass, int passlen,
+    OSSL_LIB_CTX *ctx, const char *propq);
 X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
     const char *pass, int passlen, unsigned char *salt,
     int saltlen, int iter, PKCS8_PRIV_KEY_INFO *p8);
@@ -300,6 +306,19 @@ DECLARE_ASN1_ITEM(PKCS12_SAFEBAGS)
 DECLARE_ASN1_ITEM(PKCS12_AUTHSAFES)
 
 void PKCS12_PBE_add(void);
+
+typedef struct pkcs12_parse_ctx_st PKCS12_PARSE_CTX;
+PKCS12_PARSE_CTX *PKCS12_PARSE_CTX_new(void);
+void PKCS12_PARSE_CTX_free(PKCS12_PARSE_CTX *ctx);
+void PKCS12_PARSE_CTX_set_pkey(PKCS12_PARSE_CTX *ctx, EVP_PKEY **pkey);
+void PKCS12_PARSE_CTX_set_cert(PKCS12_PARSE_CTX *ctx, X509 **cert);
+void PKCS12_PARSE_CTX_set_ca(PKCS12_PARSE_CTX *ctx, STACK_OF(X509) **ca);
+void PKCS12_PARSE_CTX_set_skeys(PKCS12_PARSE_CTX *ctx, STACK_OF(EVP_SKEY) **skeys);
+
+int PKCS12_parse_ex(PKCS12 *p12, const char *pass,
+    PKCS12_PARSE_CTX *ctx,
+    OSSL_LIB_CTX *libctx, const char *propq);
+
 int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
     STACK_OF(X509) **ca);
 typedef int PKCS12_create_cb(PKCS12_SAFEBAG *bag, void *cbarg);