Implement certificate parser / validation

[klutzy]

Yes, the most dangerous code in the world!
I currently only implemented DER parser a bit. I have to implement ASN.1 tree -> certificate parser and certificate validator. Not sure how macros work well for this..

[l0kod]

It would be great to have multiple crates for each Suruga main features like standalone DER/PEM/ASN1 parser, x509 certificate/CRL parser and PKCS#1/PKCS#8 parser.

Using rust-crypto should help too.

[lmb]

Hi klutzy,

Are you actively working on this? I would be interested in contributing.

I have previously written a partial DER parser in C, which I had to abandon b/c it felt C didn't help much. I would work on this over the next few weeks most probably, implementing

• a simple, non-streaming DER parser
• implementations of operations on ASN.1 types
• an X.509 parser that basically turns [u8] into a X509Cert, but does not do any validation itself
• possibly a small DSL to define DER structures (time allowing)

This would allow suruga to implement all certificate validation logic, while keeping concerns separated.
I do not believe an ASN.1 schema parser is worth implementing, since a DSL is easier to implement and has less overhead.

With your help I'd like to flesh out a basic API that would make sense from the suruga side, and then see how I can make it possible.

What do you think?

[klutzy]

Oops, I forgot to update current status: in my x509-parser branch, I've implemented DER reader and X.509 Certificate and CRL reader. Last month I checked it parses some wild certificates well, but I need more validation so haven't pushed to master yet.

[lmb]

I see! Are you looking for collaborators then or is this more of a one man project?

[kmcallister]

I'm also interested in helping.

[tdierks]

I would suggest not implementing an ASN.1 -> DER parser; in my experience, you're much better off never using the ASN.1 at all, but instead re-expressing the structure in code or in some much simpler DSL, then writing a BER parser that goes from octets to parsed structure. You probably don't need a DER encoder; while the standard nominally requires DER expression as the signed structure, in practice, certificates are already DER and so don't require re-encoding. (In the past, some CAs signed BER, so re-encoding would never validate, but that is hopefully uncommon now.)

[l0kod]

FYI, there is a DER parser available: https://github.com/rusticata/der-parser

[anishnath]

There is a useful online version of the PEM parser https://8gwifi.org/PemParserFunctions.jsp