4 ms·

> How the hell do I generate certificates and keys in a way they all understand? When we built Python Cryptography's X.509 validator[1], we also built an entir

> How the hell do I generate certificates and keys in a way they all understand? When we built Python Cryptography's X.509 validator[1], we also built an entire test suite that compares different implementations for RFC 5280/CABF compliance for exactly this purpose[2]. It's already found a decent number of bugs (both public and non-public) in widely used implementations; you may find it useful! (I agree that X.509's constellation of standards are a mess. But I also think a huge part of the mess in practice is implementations trying to do too much: if all you need is to verify client/server chains in the Web PKI, then "all" you need is CABF. There's no point in implementing RFC 3280, etc.) [1]: https://blog.trailofbits.com/2024/01/25/we-build-x-509-chains-so-you-dont-have-to/ https://blog.trailofbits.com/2024/01/25/we-build-x-509-chain... [2]: https://x509-limbo.com/ https://x509-limbo.com/

selfmodruntime 2y ago
That is very nice work. Thank you so much! One thing I would be interested in is if there were any differences between rust-webpki and BoringSSL itself. Also, I would love if MbedTLS or WolfSSL would also be compared. However, their state is in itself a bit questionable.
- woodruffw 2y ago
  > One thing I would be interested in is if there were any differences between rust-webpki and BoringSSL itself. Adding BoringSSL as a harness would probably be pretty easy! We have an existing OpenSSL harness[1] that would probably be straightforward to adapt. We could also probably improve the visualization of differences between implementations: right now you can find them either by looking at individual testcases[2] or on each harness's "anomalies" page[3], but it'd be cool to have a more unified UI. [1]: https://github.com/C2SP/x509-limbo/blob/main/harness/openssl/main.cpp https://github.com/C2SP/x509-limbo/blob/main/harness/openssl... [2]: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-mis... [3]: https://x509-limbo.com/anomalous-results/rust-webpki/ https://x509-limbo.com/anomalous-results/rust-webpki/

selfmodruntime 2y ago

That is very nice work. Thank you so much! One thing I would be interested in is if there were any differences between rust-webpki and BoringSSL itself. Also, I would love if MbedTLS or WolfSSL would also be compared. However, their state is in itself a bit questionable.

woodruffw 2y ago
> One thing I would be interested in is if there were any differences between rust-webpki and BoringSSL itself. Adding BoringSSL as a harness would probably be pretty easy! We have an existing OpenSSL harness[1] that would probably be straightforward to adapt. We could also probably improve the visualization of differences between implementations: right now you can find them either by looking at individual testcases[2] or on each harness's "anomalies" page[3], but it'd be cool to have a more unified UI. [1]: https://github.com/C2SP/x509-limbo/blob/main/harness/openssl/main.cpp https://github.com/C2SP/x509-limbo/blob/main/harness/openssl... [2]: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-mis... [3]: https://x509-limbo.com/anomalous-results/rust-webpki/ https://x509-limbo.com/anomalous-results/rust-webpki/