[WIP] Add unencrypted PEM PKCS8 dumping support

Adds unencrypted PEM dumping for private keys. Public keys and encrypted (PBE) support will be in separate PRs (and PBE requires some discussion. I tried to dig up the issue we've used for this in the past but couldn't find it)
Go appears to offer support for AES:
http://golang.org/src/pkg/crypto/x509/pem_decrypt.go#L59

On Wed, Oct 1, 2014 at 7:10 PM, Paul Kehrer <notifications@github.com>
wrote:

> In cryptography/hazmat/backends/interfaces.py:
>
> > @@ -240,6 +240,12 @@ def load_pem_public_key(self, data):
> >          Loads a public key from PEM encoded data.
> >          """
> >
> > +    @abc.abstractmethod
> > +    def dump_unencrypted_pem_pkcs8_private_key(self, key):
>
> Looking into this more deeply it appears PEM_write_bio_RSAPrivateKey (the
> traditional OpenSSL key type writer) uses a non-configurable iteration
> count of 1 and derives the key using EVP_BytesToKey
> <https://www.openssl.org/docs/crypto/EVP_BytesToKey.html>.
>
> PKCS8 stores the iteration count in its ASN.1 structure but it doesn't
> look like OpenSSL exposes modification to the default (2048) in a
> convenient way. It's also unclear if changing that would result in
> interoperability problems with apps that may just assume 2048. Finally,
> there are both PKCS5 v1.5 (PBES1) and PKCS5 v2.0 (PBES2) schemes. These are
> documented in rfc2898 <http://tools.ietf.org/html/rfc2898>. PBES1 has a
> highly restrictive set of permissible OIDs:
>
>    pbeWithMD2AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 1}
>    pbeWithMD2AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 4}
>    pbeWithMD5AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 3}
>    pbeWithMD5AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 6}
>    pbeWithSHA1AndDES-CBC OBJECT IDENTIFIER ::= {pkcs-5 10}
>    pbeWithSHA1AndRC2-CBC OBJECT IDENTIFIER ::= {pkcs-5 11}
>
> PBES2 appears to allow arbitrary definition of algorithms, but in practice
> is probably only used with the examples in the RFC (and quite probably not
> the RC5 example).
>
> So, from what I can tell, it appears des-EDE3-CBC is pretty much the
> "best" widely available choice.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/pyca/cryptography/pull/1380/files#r18319611>.
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084