Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Split numeric string conversions out of the OID module #9379

Closed
gilles-peskine-arm opened this issue Jul 9, 2024 · 0 comments · Fixed by #9413
Closed

Split numeric string conversions out of the OID module #9379

gilles-peskine-arm opened this issue Jul 9, 2024 · 0 comments · Fixed by #9413
Assignees
Labels
component-crypto Crypto primitives and low-level interfaces component-x509 size-xs Estimated task size: extra small (a few hours at most)

Comments

@gilles-peskine-arm
Copy link
Contributor

gilles-peskine-arm commented Jul 9, 2024

The OID module (oid.h, oid.c) has three parts:

  • Conversion between binary and numeric string representation. Somewhat bulky code. Only used in X.509: mbedtls_oid_get_numeric_string for the sake of mbedtls_x509_dn_gets (guarded by MBEDTLS_X509_USE_C), mbedtls_x509_info_subject_alt_name (guarded by ``MBEDTLS_X509_USE_C && more), and `mbedtls_oid_from_numeric_string` for the sake of `mbedtls_x509_string_to_names` guarded by `MBEDTLS_X509_CREATE_C`.
  • Conversion between binary and internal representation for the sake of crypto (RSA PKCS#1v1.5 signature, pkparse, pkwrite).
  • Conversion between binary and internal representation for the sake of X.509.

The OID module is in the crypto library because a small part of it is used by crypto, but most of it is only useful for X.509, and we have had complaints about code size (example). The goal of this task is to to move the binary-string conversions to the X.509 module. We should do that before the files move to separate repositories.

  • Move the function declarations to x509.h.
  • Move mbedtls_oid_get_numeric_string to x509.c and its unit tests to test_suite_x509parse.*.
  • Movembedtls_oid_from_numeric_string to x509_create.c and its unit tests to test_suite_x509write.*.

(In other words, move these two functions together with the X.509 code that is their sole user.)

This will leave the OID module as a binary-internal conversion module. There will be later tasks to split crypto vs non-crypto OIDs, but that code is likely to be heavily rewritten, so it doesn't matter if it happens after the repo split.

@gilles-peskine-arm gilles-peskine-arm added component-x509 component-crypto Crypto primitives and low-level interfaces size-xs Estimated task size: extra small (a few hours at most) labels Jul 9, 2024
@gilles-peskine-arm gilles-peskine-arm changed the title Split string conversions out of the OID module Split numeric string conversions out of the OID module Jul 9, 2024
@Harry-Ramsey Harry-Ramsey self-assigned this Sep 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-crypto Crypto primitives and low-level interfaces component-x509 size-xs Estimated task size: extra small (a few hours at most)
Projects
Status: Repository split
Development

Successfully merging a pull request may close this issue.

3 participants