# mpemtrans 0.1.0 preview 2

First portable preview of the Mystic PEM/cryptlib converter, based on amenonsen/pemtrans.

- Windows x86/x64 ZIP: mpemtrans.exe and README.txt. OpenSSL 3 and the C runtime are linked statically; no OpenSSL DLL or MSI is required.
- Linux amd64/i386/arm64/armhf tar.gz: mpemtrans and README.txt. Uses the distribution's shared OpenSSL 3 libcrypto.
- RSA private keys, 2048–4096 bits, PKCS#1/PKCS#8 including encrypted PEM input; matching leaf certificate or ordered PEM fullchain.
- Automatic cryptlib discovery beside the executable first, then the system library locations. An absolute --library argument overrides discovery.
- Creates a new PKCS#15 keyset, reopens it and retrieves the private key before publishing it. Existing output is never replaced.
- Passwords are read from protected files, not command-line values. No production keys are used in tests.

## Qualification

See build-report.json for the exact source commit, workflow runs and native conversion results. Linux binaries are built on Debian 12 and smoke-tested unchanged on Debian 12/13 and Ubuntu 24.04/26.04. The i386 tests use 32-bit libraries on an amd64 kernel; they do not imply a complete i386 Ubuntu installation is supported.

Native conversion coverage and architecture smoke tests are distinct. A converter accepting a library does not establish that an old Mystic binary supports that library. Native Linux Mystic A49 BinkP TLS 1.2 has now been qualified with the converted RSA fullchain and cryptlib 3.4.5: the exact leaf certificate, CA/hostname validation, encrypted BinkP frames and unchanged keyset are checked. Other Mystic protocol/platform handshakes are not implied. This preview does not replace a working server keyset or activate certificates.

Limitations: RSA only; Windows paths currently need ASCII characters. Certificate-chain relationships and dates are checked, but the tool is not a public-CA trust validator. A bundled OpenSSL update requires a new Windows build.

The original pemtrans permission is retained. OpenSSL notices are included in the Windows README. Runtime cryptlib is external and remains subject to its own license.

## Fixes since preview 1

Accept nonempty protected password files and delegate keyset password constraints to cryptlib. This allows the short fixed legacy password required by Mystic A49; preview 1 rejected it before conversion. Strong passwords remain recommended for general keysets. PEM input passwords are not subjected to an unrelated output-keyset length rule. Native Windows conversion tests in this release also use a synthetic six-character password.