4 ms·

While the contribution to Python Cryptography is incredibly awesome, I'd suggest that perhaps the lede is slightly buried. Having a large suite of well document

by thadt 3y ago

While the contribution to Python Cryptography is incredibly awesome, I'd suggest that perhaps the lede is slightly buried. Having a large suite of well documented test vectors, including both positive and negative examples, raises the bar for the entire ecosystem. Go and OpenSSL are mentioned, but any other environment implementing X.509 now has another very well developed test suite that can be plugged in directly. While I'm a huge fan of formal methods for developing secure code, IMHO well developed suites such as x509-limbo[1] with common, good, problematic, and outright sadistically wrong vectors are the way forward for developing robust cross platform protocols. These are the kinds of unit tests a spec should come with. [1] https://x509-limbo.com https://x509-limbo.com

ivanr 3y ago
Agreed. I don't see NIST's test suites [1] on the list, though. Maybe they're embedded somewhere and I've missed it? [1] https://csrc.nist.gov/projects/pki-testing https://csrc.nist.gov/projects/pki-testing EDIT If the authors are reading, are any of the test cases taken from Chrome's codebase?
- woodruffw 3y ago
  (I'm one of the authors). I looked at NIST's PKITS while building the test suite. We ultimately decided to punt on it for the first round of tests, primarily because it fell slightly out of scope of our MVP on Python Cryptography (being strictly a RFC 3280 suite). We instead chose to integrate the BetterTLS suite[1] (warning: very large page) for the MVP. With that being said: x509-limbo is open source, and I would be overjoyed if someone added a new `nist::pkits` or similar namespace for these :-). I can't promise that it's an immediate priority for us to add ourselves, however. > are any of the test cases taken from Chrome's codebase? Nope. That would also be a valuable thing to have here. [1]: https://x509-limbo.com/testcases/bettertls/ https://x509-limbo.com/testcases/bettertls/
  - ivanr 3y ago
    For reference: https://github.com/chromium/chromium/tree/main/net/data/ssl https://github.com/chromium/chromium/tree/main/net/data/ssl It's been a long time since I looked at them, not sure what's in there exactly any more. Ask Ryan perhaps :)
    - woodruffw 3y ago
      Thank you! I'll add that to https://github.com/C2SP/x509-limbo/issues/174 https://github.com/C2SP/x509-limbo/issues/174.
      - ivanr 3y ago
        You may also want to look at https://github.com/digicert/pkilint https://github.com/digicert/pkilint There are other similar tools (cablint, x509lint, zlint), but there's been a lot of good talk about pkilint recently.
baby 3y ago
Check Frankencerts as well if you're interested in that: https://github.com/sumanj/frankencert https://github.com/sumanj/frankencert

by thadt 3y ago

ivanr 3y ago

Agreed. I don't see NIST's test suites [1] on the list, though. Maybe they're embedded somewhere and I've missed it? [1] https://csrc.nist.gov/projects/pki-testing https://csrc.nist.gov/projects/pki-testing EDIT If the authors are reading, are any of the test cases taken from Chrome's codebase?

woodruffw 3y ago
(I'm one of the authors). I looked at NIST's PKITS while building the test suite. We ultimately decided to punt on it for the first round of tests, primarily because it fell slightly out of scope of our MVP on Python Cryptography (being strictly a RFC 3280 suite). We instead chose to integrate the BetterTLS suite[1] (warning: very large page) for the MVP. With that being said: x509-limbo is open source, and I would be overjoyed if someone added a new `nist::pkits` or similar namespace for these :-). I can't promise that it's an immediate priority for us to add ourselves, however. > are any of the test cases taken from Chrome's codebase? Nope. That would also be a valuable thing to have here. [1]: https://x509-limbo.com/testcases/bettertls/ https://x509-limbo.com/testcases/bettertls/
- ivanr 3y ago
  For reference: https://github.com/chromium/chromium/tree/main/net/data/ssl https://github.com/chromium/chromium/tree/main/net/data/ssl It's been a long time since I looked at them, not sure what's in there exactly any more. Ask Ryan perhaps :)
  - woodruffw 3y ago
    Thank you! I'll add that to https://github.com/C2SP/x509-limbo/issues/174 https://github.com/C2SP/x509-limbo/issues/174.
    - ivanr 3y ago
      You may also want to look at https://github.com/digicert/pkilint https://github.com/digicert/pkilint There are other similar tools (cablint, x509lint, zlint), but there's been a lot of good talk about pkilint recently.

baby 3y ago

Check Frankencerts as well if you're interested in that: https://github.com/sumanj/frankencert https://github.com/sumanj/frankencert