3 ms·

Agreed. I don't see NIST's test suites [1] on the list, though. Maybe they're embedded somewhere and I've missed it? [1] https://csrc.nist.gov/projects/pki-tes

by ivanr 3y ago

Agreed. I don't see NIST's test suites [1] on the list, though. Maybe they're embedded somewhere and I've missed it? [1] https://csrc.nist.gov/projects/pki-testing https://csrc.nist.gov/projects/pki-testing EDIT If the authors are reading, are any of the test cases taken from Chrome's codebase?

woodruffw 3y ago
(I'm one of the authors). I looked at NIST's PKITS while building the test suite. We ultimately decided to punt on it for the first round of tests, primarily because it fell slightly out of scope of our MVP on Python Cryptography (being strictly a RFC 3280 suite). We instead chose to integrate the BetterTLS suite[1] (warning: very large page) for the MVP. With that being said: x509-limbo is open source, and I would be overjoyed if someone added a new `nist::pkits` or similar namespace for these :-). I can't promise that it's an immediate priority for us to add ourselves, however. > are any of the test cases taken from Chrome's codebase? Nope. That would also be a valuable thing to have here. [1]: https://x509-limbo.com/testcases/bettertls/ https://x509-limbo.com/testcases/bettertls/
- ivanr 3y ago
  For reference: https://github.com/chromium/chromium/tree/main/net/data/ssl https://github.com/chromium/chromium/tree/main/net/data/ssl It's been a long time since I looked at them, not sure what's in there exactly any more. Ask Ryan perhaps :)
  - woodruffw 3y ago
    Thank you! I'll add that to https://github.com/C2SP/x509-limbo/issues/174 https://github.com/C2SP/x509-limbo/issues/174.
    - ivanr 3y ago
      You may also want to look at https://github.com/digicert/pkilint https://github.com/digicert/pkilint There are other similar tools (cablint, x509lint, zlint), but there's been a lot of good talk about pkilint recently.