Skip to content

Commit 7ea07db

Browse files
committed
Make linters happy
1 parent 50420aa commit 7ea07db

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Diff for: src/libraries/System.Security.Cryptography/docs/X509CertificateLoader.SecurityDesign.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -236,12 +236,12 @@ Any such keys that were not associated with the return value will be erased from
236236

237237
`X509CertificateLoader` follows the "lazy decryption" scheme utilized by Windows 10 PFXImportCertStore.
238238
If a PKCS#12 PFX contains one CertBag value and two PKCS8ShroudedKeyBag values, and the CertBag shares a PKCS#9 LocalKeyId value with only one of the PKCS8ShroudedKeyBag values (and the private key contained therein is properly matched to the public key embedded in the certificate), then the second encrypted key will never be decrypted.
239-
However, the presence of this key counts against both the `IndividualKdfIterationLimit` and the `TotalKdfIterationLimit`, as the work-counting phase is done before key-matching or key-decryption.
239+
However, the presence of this key counts against both the `IndividualKdfIterationLimit` and the `TotalKdfIterationLimit`, as the work-counting phase is done before key-matching or key-decryption.
240240

241241
### Zero-Length Passwords
242242

243243
The KDF defined for PKCS#12 makes a distinction between a null password and an empty password, where most callers fail to see a distinction (particularly when the password is presented as `ReadOnlySpan<char>`).
244-
As such, most API that deals with reading from a PKCS#12 PFX (e.g. the now-legacy constructors, Windows' PFXImportCertStore, and OpenSSL's PKCS12_parse) will use whichever of the two versions works first.
244+
As such, most API that deals with reading from a PKCS#12 PFX (e.g. the now-legacy constructors, Windows' PFXImportCertStore, and OpenSSL's `PKCS12_parse`) will use whichever of the two versions works first.
245245

246246
`X509CertificateLoader` handles this state by always trying the input as-provided first, then will make one allowance that the file was built using the other zero-length password.
247247
In the event of this password mulligan, the first work done with the wrong password is not counted toward "total" work limits.

0 commit comments

Comments
 (0)