Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We build X.509 chains so you don't have to

blog.trailofbits.com

Post reply on HN
Print view View original

81–88 of 88 posts

Re: We build X.509 chains so you don't have to

#81

Post by agwa »

ivanr wrote: post #74
mcpherrinm wrote: post #72

Earlier quoted context omitted.

Google's CRLSets don't cover nearly the full set of revocations (AFAIK). I don't know the details of how "valid" works, but as the Apple root program has recently required CAs to publish full CRLs, I assume they're planning something similar. I mostly cite CRLite as it's well-documented. I don't think OCSP must-staple is deployable. It requires code changes to effectively every webserver in the world, and that doesn'…

I think you're right about CRLSets. IMO, Mozilla really wanted to solve the problem, whereas Chrome just wanted to have a solution that they could use for emergency revocation of certificates of high-profile sites (and intermediates/roots). Small-time sites won't be in CRLSets, although if you know the right people and make enough noise you may be added to their list. As for Apple, no one knows what's going on becaus…

Apple shared the details of valid.apple.com in a WWDC talk: https://devstreaming-cdn.apple.com/videos/wwdc/2017/701jvytn...

Slides: https://devstreaming-cdn.apple.com/videos/wwdc/2017/701jvytn...

You can also find the client-side code if you dig around under https://opensource.apple.com/source/Security/

It aims to cover all certificates, similar to Mozilla's CRLite.

Re: We build X.509 chains so you don't have to

#82

Post by paragon_init »

im3w1l wrote: post #79

I'm sure it was even worse before, but I'm not entirely happy with the look of that. * I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me. * I shouldn't have to know what a pem is, and I shouldn't have to open() one. * I don't want a PolicyBuilder. Just give me the normal policy. * I shouldn't have to construct some verifier object specific to a given dns. I do…

> * I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me.

> * I shouldn't have to know what a pem is, and I shouldn't have to open() one.

Agreed, but what you're requesting is separate from the work being discussed in this blog post, and both are actually compatible.

For the PHP community, we made Certainty - https://github.com/paragonie/certainty

You can just...

  getLatestBundle();
  curl_setopt($ch, CURLOPT_CAINFO, $latestCACertBundle->getFilePath());
Writing a Python client should be relatively straightforward, should anyone want to.

For Python specifically, there may be some value in storing the relevant PEM files into something like SigStore. That could be an easier proposal for the PyCA team to consider.

Re: We build X.509 chains so you don't have to

#83

Post by RustyRussell »

This looks great!

I wanted to bundle a chain of certs, check that the leaf was and its key signed , and that the bundle provided a path to a locally-trusted root. This allows third-party serving of signed data, rather than having to trade your IP address for validation.

Doing so with existing tools was so terrible that I was pretty sure my result was grossly insecure :(

I look forward to the promised lower-level APIs!

Re: We build X.509 chains so you don't have to

#84

Post by pvg »

tptacek wrote: post #73
mcpherrinm wrote: post #72

Earlier quoted context omitted.

Google's CRLSets don't cover nearly the full set of revocations (AFAIK). I don't know the details of how "valid" works, but as the Apple root program has recently required CAs to publish full CRLs, I assume they're planning something similar. I mostly cite CRLite as it's well-documented. I don't think OCSP must-staple is deployable. It requires code changes to effectively every webserver in the world, and that doesn'…

"The spiral of non-adoption" is an interesting blog post someone should write. I bet there are a couple more examples besides the obvious one.

It could also be a festival/performance site for unadopted technologies. Sunday, Sunday, key signing ceremony at Non-adoption Spiral!

Re: We build X.509 chains so you don't have to

#86

Post by camkego »

nindalf wrote: post #76
blibble wrote: post #43

Earlier quoted context omitted.

yes, hence my comment on SML while it's nice that the rest of the world is slowly waking up to type systems functional programmers have been bleating on about for the past four decades ... having read through the first couple of pages of bc vulns: even a much stronger type system than rust provides wouldn't appear to help very much in this specific example however if someone wants to rewrite OpenSSL in Rust that woul…

> however if someone wants to rewrite OpenSSL in Rust You mean rustls?

Lacking DTLS at this time, and probably a few other valuable things.

Re: We build X.509 chains so you don't have to

#87

Post by teddyh »

zokier wrote: post #41
teddyh wrote: post #18

Note: If your application does not absolutely need it, there are alternatives to X.509 certificates in TLS, like raw public keys (RFC 7250).

Added to OpenSSL last November: https://www.openssl.org/blog/blog/2023/11/23/OpenSSL32/index...

GnuTLS also has support for it since five years ago.

Re: We build X.509 chains so you don't have to

#88

Post by dang »

nindalf wrote: post #80
dang wrote: post #68

Earlier quoted context omitted.

We've asked you more than once to stop posting unsubstantive comments and flamebait. You've continued to do it, for example in the parent comment, https://news.ycombinator.com/item?id=39108095 , and https://news.ycombinator.com/item?id=39103476 . You've even posted outright slurs like https://news.ycombinator.com/item?id=38832516 , which is seriously not ok. Since you've continued to break HN's rules like this, I've…

Holy fucking shit. I've never seen anything like that last comment on HN before.

That's good, because they certainly get posted. Such things are inevitable on any sufficiently large public forum.

If you haven't seen them, it must be because they're mostly getting flagged and/or killed by users and/or moderators, which is the desired outcome.

Post reply on HN