rust
/
webpki
mirror of https://github.com/briansmith/webpki
1
0
Fork 0
Code Issues Releases Wiki Activity
226 Commits 13 Branches 12 Tags 1.3 MiB
Rust 93.7%
Shell 6.3%
Go to file
Sebastian Hahn d139e98815 Add support for Ed25519 certificates 
This adds support for verification of ed25519 certificates according to
RFC 8410. Implements #49.

The test certificate was generated using OpenSSL 1.1.1a, using the
following commands (CA.pl is distributed with OpenSSL):

openssl genpkey -algorithm ed25519 -outform pem -out root_key.pem
openssl req -new -x509 -days 9999 -extensions v3_ca -key root_key.pem \
-inform pem -outform pem -out root_ed25519.pem
echo root_ed25519.pem | CA.pl -newca

openssl genpkey -algorithm ed25519 -outform pem -out client_key.pem
openssl req -new -key client_key.pem -inform pem -outform pem \
-out client_ed25519_csr.pem
openssl ca -keyfile ./root_key.pem -days 999 -notext -in \
client_ed25519_csr.pem -out client_ed25519.pem

I agree to license my contributions to each file under the terms given
at the top of each file I changed.
 		2019-01-18 15:20:58 -10:00
mk Test --no-default-features --features=trust_anchor_util config. 2017-08-27 10:24:29 -10:00
src Add support for Ed25519 certificates 2019-01-18 15:20:58 -10:00
tests Add support for Ed25519 certificates 2019-01-18 15:20:58 -10:00
third-party/chromium Remove unused annotate_test_data.py script. 2017-02-07 11:42:44 -10:00
.gitattributes Treat *.der as binary in .gitattributes. 2016-11-21 12:30:09 -10:00
.gitignore Add IntelliJ IDEA stuff to .gitignore. 2017-04-27 12:53:54 -10:00
.travis.yml Fix Travis CI. 2017-08-27 01:02:23 -10:00
Cargo.toml 0.19.0. 2019-01-09 09:12:23 -10:00
LICENSE
…
README.md Point to rustls for example 2018-10-23 13:40:31 -10:00
appveyor.yml Bump Rust "stable" version on appveyor to latest, Rust 1.19. 2017-08-18 09:40:59 -10:00

README.md

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

What is webpki?

webpki is a library that validates Web PKI (TLS/SSL) certificates. webpki is designed to provide a full implementation of the client side of the Web PKI to a diverse range of applications and devices, including embedded (IoT) applications, mobile apps, desktop applications, and server infrastructure. webpki is intended to not only be the best implementation of the Web PKI, but to also precisely define what the Web PKI is.

webpki is written in Rust and uses ring for signature verification.

webpki is strongly influenced by mozilla::pkix. You can read a little about the ideas underlying both mozilla::pkix and webpki in insanity::pkix: A New Certificate Path Building & Validation Library.

The Rust compiler statically guarantees there are no buffer overflows, uses-after-free, double-frees, data races, etc. in webpki. webpki takes advantage of Rust's borrow checker to ensure that its zero-copy parsing strategy is safe and efficient. webpki never allocates memory on the heap, and it maintains a tight bound on the amount of stack memory it uses. webpki avoids all superfluous PKIX features in order to keep its object code size small. Further reducing the code size of webpki is an important goal.

This release is the very first prototype. Lots of improvements are planned, including:

  • An extensive automated test suite.
  • Key pinning.
  • Certificate Transparency support.
  • Short-lived certificate, OCSP stapling, and CRLSet support.
  • Customization of the supported algorithms, key sizes, and elliptic curves allowed during a validation.
  • A C language wrapper interface to allow using webpki in non-Rust applications.
  • A specification of precisely what the Web PKI is.

Demo

See https://github.com/ctz/rustls#example-code for an example of using webpki.

License

See LICENSE. This project happily accepts pull requests without any formal copyright/contributor license agreement. Pull requests must explicitly indicate who owns the copyright to the code being contributed and that the code is being licensed under the same terms as the existing webpki code.

Bug Reporting

Please report bugs either as pull requests or as issues in the issue tracker. webpki has a full disclosure vulnerability policy. Please do NOT attempt to report any security vulnerability in this code privately to anybody.

Online Automated Testing

Travis CI is used for Linux and Mac OS X. Appveyor is used for Windows.

OSArch.Status
Linux x86, x64 Build Status
Mac OS X x64 x86, x64
Windows (-msvc) x86, x64 Build Status