-
Notifications
You must be signed in to change notification settings - Fork 140
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
4 changed files
with
407 additions
and
178 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| use alloc::vec; | ||
| use spki::{ | ||
| DynSignatureAlgorithmIdentifier, EncodePublicKey, SignatureBitStringEncoding, | ||
| SubjectPublicKeyInfoOwned, SubjectPublicKeyInfoRef, | ||
| }; | ||
|
|
||
| use crate::{ | ||
| builder::Result, | ||
| certificate::{Certificate, TbsCertificate, Version}, | ||
| ext::{ | ||
| pkix::{ | ||
| AuthorityKeyIdentifier, BasicConstraints, KeyUsage, KeyUsages, SubjectKeyIdentifier, | ||
| }, | ||
| AsExtension, Extension, Extensions, | ||
| }, | ||
| name::Name, | ||
| request::{attributes::AsAttribute, CertReq, CertReqInfo, ExtensionReq}, | ||
| serial_number::SerialNumber, | ||
| time::Validity, | ||
| }; | ||
|
|
||
| pub mod cabf; | ||
| pub mod piv; | ||
|
|
||
| pub(crate) mod sealed { | ||
| use alloc::vec; | ||
| use spki::{ | ||
| DynSignatureAlgorithmIdentifier, EncodePublicKey, SignatureBitStringEncoding, | ||
| SubjectPublicKeyInfoOwned, SubjectPublicKeyInfoRef, | ||
| }; | ||
|
|
||
| use crate::{ | ||
| builder::Result, | ||
| certificate::{Certificate, TbsCertificate, Version}, | ||
| ext::{ | ||
| pkix::{ | ||
| AuthorityKeyIdentifier, BasicConstraints, KeyUsage, KeyUsages, SubjectKeyIdentifier, | ||
| }, | ||
| AsExtension, Extension, Extensions, | ||
| }, | ||
| name::Name, | ||
| request::{attributes::AsAttribute, CertReq, CertReqInfo, ExtensionReq}, | ||
| serial_number::SerialNumber, | ||
| time::Validity, | ||
| }; | ||
|
|
||
| pub trait Profile { | ||
| fn get_issuer(&self, subject: &Name) -> Name; | ||
|
|
||
| fn build_extensions( | ||
| &self, | ||
| spk: SubjectPublicKeyInfoRef<'_>, | ||
| issuer_spk: SubjectPublicKeyInfoRef<'_>, | ||
| tbs: &TbsCertificate, | ||
| ) -> Result<vec::Vec<Extension>>; | ||
| } | ||
| } | ||
|
|
||
| #[cfg(feature = "hazmat")] | ||
| pub use sealed::Profile; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| //! https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-v2.0.1.pdf | ||
| use alloc::vec; | ||
| use core::marker::PhantomData; | ||
|
|
||
| use crate::{ | ||
| builder::{Profile, Result}, | ||
| certificate::{Certificate, TbsCertificate, Version}, | ||
| ext::{ | ||
| pkix::{ | ||
| AuthorityKeyIdentifier, BasicConstraints, KeyUsage, KeyUsages, SubjectKeyIdentifier, | ||
| }, | ||
| AsExtension, Extension, Extensions, | ||
| }, | ||
| name::Name, | ||
| }; | ||
| use spki::{EncodePublicKey, SubjectPublicKeyInfoOwned, SubjectPublicKeyInfoRef}; | ||
|
|
||
| pub struct Root { | ||
| pub emits_ocsp_response: bool, | ||
| } | ||
|
|
||
| impl Default for Root { | ||
| fn default() -> Self { | ||
| Self { | ||
| emits_ocsp_response: false, | ||
| } | ||
| } | ||
| } | ||
|
|
||
| impl Profile for Root { | ||
| fn get_issuer(&self, subject: &Name) -> Name { | ||
| subject.clone() | ||
| } | ||
|
|
||
| fn build_extensions( | ||
| &self, | ||
| spk: SubjectPublicKeyInfoRef<'_>, | ||
| issuer_spk: SubjectPublicKeyInfoRef<'_>, | ||
| tbs: &TbsCertificate, | ||
| ) -> Result<vec::Vec<Extension>> { | ||
| let mut extensions: vec::Vec<Extension> = vec::Vec::new(); | ||
|
|
||
| // 7.1.2.1.2 Root CA Extensions | ||
|
|
||
| // subjectKeyIdentifier MUST | ||
| // | ||
| // TODO: from 7.1.2.11.4 Subject Key Identifier | ||
| // The CA MUST generate a subjectKeyIdentifier that is unique within the scope of all | ||
| // Certificates it has issued for each unique public key (the subjectPublicKeyInfo field of the | ||
| // tbsCertificate). For example, CAs may generate the subject key identifier using an algorithm | ||
| // derived from the public key, or may generate a sufficiently‐large unique number, such by using a | ||
| // CSPRNG. | ||
| let ski = SubjectKeyIdentifier::try_from(spk)?; | ||
| extensions.push(ski.to_extension(&tbs.subject, &extensions)?); | ||
|
|
||
| // authorityKeyIdentifier RECOMMENDED | ||
| // 7.1.2.1.3 Root CA Authority Key Identifier | ||
| extensions.push( | ||
| AuthorityKeyIdentifier { | ||
| // KeyIdentifier must be the same as subjectKeyIdentifier | ||
| key_identifier: Some(ski.0), | ||
| // other fields must not be present. | ||
| ..Default::default() | ||
| } | ||
| .to_extension(&tbs.subject, &extensions)?, | ||
| ); | ||
|
|
||
| // Spec: 7.1.2.1.4 Root CA Basic Constraints | ||
| extensions.push( | ||
| BasicConstraints { | ||
| ca: true, | ||
| path_len_constraint: None, | ||
| } | ||
| .to_extension(&tbs.subject, &extensions)?, | ||
| ); | ||
|
|
||
| // Spec: 7.1.2.10.7 CA Certificate Key Usage | ||
| let mut key_usage = KeyUsages::KeyCertSign | KeyUsages::CRLSign; | ||
| if self.emits_ocsp_response { | ||
| key_usage |= KeyUsages::DigitalSignature; | ||
| } | ||
| extensions.push(KeyUsage(key_usage).to_extension(&tbs.subject, &extensions)?); | ||
|
|
||
| Ok(extensions) | ||
| } | ||
|
|
||
| // 7.1.2.1 Root CA Certificate Profile | ||
| // TODO: | ||
| // - issuerUniqueID MUST NOT be present | ||
| // - subjectUniqueID MUST NOT be present | ||
| // NOTE(baloo): we never build those? | ||
| // | ||
| // 7.1.2.1.1 Root CA Validity | ||
| // TODO: | ||
| // - Minimum 2922 days (approx. 8 years) | ||
| // - Max 9132 days (approx. 25 years) | ||
| // | ||
| // | ||
| } | ||
|
|
||
| pub mod tls; | ||
|
|
||
| pub mod codesigning { | ||
| //! https://cabforum.org/wp-content/uploads/Baseline-Requirements-for-the-Issuance-and-Management-of-Code-Signing.v2.8.pdf | ||
| } |
Oops, something went wrong.