1 files changed, 7 insertions, 5 deletions

diff --git a/tools/ca/ca/__main__.py b/tools/ca/ca/__main__.py
index 22dcaeed..b89d91ff 100644
--- a/tools/ca/ca/__main__.py
+++ b/tools/ca/ca/__main__.py
@@ -469,7 +469,7 @@ def new_client(ca_cert, ca_key, key_type, clock_skew, validity, subject, alterna
         ).public_bytes(serialization.Encoding.PEM)
     )
 
-def to_pkcs12(random_password, filename, output):
+def to_pkcs12(random_password, random_password_length, weak_encryption, filename, output):
     key_file = filename.with_suffix('.key')
     cert_file = filename.with_suffix('.crt')
 
@@ -503,17 +503,17 @@ def to_pkcs12(random_password, filename, output):
         else:
             from xkcdpass import xkcd_password as xp
             ws = xp.generate_wordlist(wordfile=xp.locate_wordfile())
-            pw = xp.generate_xkcdpassword(ws, numwords=12)
+            pw = xp.generate_xkcdpassword(ws, numwords=random_password_length)
             print(f'Password: {pw}', file=sys.stderr)
 
         encryption = None
         if pw:
             encryption = PrivateFormat.PKCS12.encryption_builder().kdf_rounds(
-                500000
+                500000 if not weak_encryption else 50000
             ).key_cert_algorithm(
-                pkcs12.PBES.PBESv2SHA256AndAES256CBC
+                pkcs12.PBES.PBESv2SHA256AndAES256CBC if not weak_encryption else pkcs12.PBES.PBESv1SHA1And3KeyTripleDESCBC
             ).hmac_hash(
-                hashes.SHA256()
+                hashes.SHA256() if not weak_encryption else hashes.SHA1()
             ).build(bytes(pw, 'utf-8'))
         fh.write(pkcs12.serialize_key_and_certificates(
             bytes(subject, 'utf-8'),
@@ -589,6 +589,8 @@ def main():
 
     subparser = subparsers.add_parser('pkcs12', aliases=['p12', 'pfx'], formatter_class=argparse.ArgumentDefaultsHelpFormatter)
     subparser.add_argument('--random-password', '--no-random-password', action=BooleanAction, default=True)
+    subparser.add_argument('--random-password-length', type=int, default=12)
+    subparser.add_argument('--weak-encryption', '--no-weak-encryption', action=BooleanAction, default=False)
     subparser.add_argument('--output', type=Path)
     subparser.add_argument('filename', metavar='BASENAME', type=Path)
     subparser.set_defaults(cmd=to_pkcs12)