x509-cert: add Signed Certificate Timestamp (SCT) extension support #1134
Conversation
The DeserializeBytes impl of TlsByteVecUX did not skip the length prefix bytes.
imor
force-pushed
the
sct
branch
2 times, most recently
from
e15c95e
to
9f8b106
Compare
This reverts commit 73e6f26.
|
@imor What's the status of the PR? We're using x509-cert in sigstore-rs and we'd like to parse Signed Certificate Timestamps. By the way, thanks for this! |
|
@tnytown the only thing pending is this TODO. Basically this PR is waiting for a new release of @franziskuskiefer, @tarcieri when is the next planned release for |
|
I can potentially cut a release of |
|
I plan to do one next week or so with couple changes. But if there's the need for an earlier one, I can do one before. |
|
@franziskuskiefer gentle ping on the |
I prepared the release. There are a couple small things that need to get fixed but I think I can do the release today or tomorrow latest. |
| /// ED25519 signature algorithm. | ||
| Ed25519 = 7, | ||
| /// ED448 signature algorithm. | ||
| Ed448 = 8, |
There was a problem hiding this comment.
Just out of curiosity: what RFC/doc do these enum members appear in? They aren't in the TLS 1.2 or 1.3 RFCs.
(The closest thing in 1.3 is SignatureScheme, which has 0x807 and 0x808 for Ed25519 and Ed448 respectively.)
There was a problem hiding this comment.
I think this is mostly that: SignatureAndHashAlgorithm is SignatureScheme in TLS1.3. The first byte encodes for the hash alg, the second byte encodes for signature alg?
| #[derive(Debug, PartialEq)] | ||
| pub struct SignedCertificateTimestampList(OctetString); | ||
|
|
||
| //TODO: Remove this and use const-oid's rfc6962::CT_PRECERT_SCTS once a const-oid version |
There was a problem hiding this comment.
TODO(baloo): make a backport of #1094 and publish a release on 0.9
There was a problem hiding this comment.
There was a problem hiding this comment.
Will leave this in for now but we can address it as a followup
Co-authored-by: Arthur Gautier <[email protected]>
tarcieri
changed the title
This PR adds support for Signed Certificate Timestamp extension to the
x509-certcrate. Since the structures in SCT extension are TLS encoded we need to add a dependency on thetls_codeccrate. This dependency has been made an optional dependency which is only enabled when the newly addedsctfeature is enabled.