Deterministic certificates
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- rust
- Domain
- cryptography, security
Research direction
The issue does not name files or tests. Start by reviewing the Certificate API and the existing randomness boundary, then compare the proposed HKDF-based Certificate::from_seed approach with exposing a seeded deterministic RNG. Done means the design is decided and deterministic certificate generation from a given seed is specified without leaking implementation details.
Written by the indexing model from the issue text.
Description
I'd like to have a way to create a fully deterministic certificate from a given seed. We use WebRTC to establish p2p connections and want to embed the certificate hash in the address information that we are passing around. Each node already has a cryptographic identity and I'd like to generate a deterministic certificate from that via a HKDF.
In an ideal world, rcgen exposes a Certificate::from_seed function and uses the provided seed to bootstrap all randomness inside. That would keep implementation details like ring contained within the library.
Alternatively, we can expose the randomness and let users deal with passing a seeded, deterministic RNG.
Thoughts?
- Dominant language
- Rust
- Stars
- 516
- Forks
- 160
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rustls/rcgen
-
Tighten up CertificateSigningRequestParams.from_der() sig AlgorithmIdentifier params validationOpennext-major-release
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
CertificateSigningRequestParams::from_der can parse the wrong key typePossibly taken @jgreeer claimed this 51 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Eyevinn/open-live-ingest#36 · 1 comment ·
Maintainers usually reply within 1 day
-
app
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
bug bug jury peripheral:i2s
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
esp-rs/esp-hal#6828 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
ライブラリを追加Openpriority middle
Difficulty 1/5 Under an hour Newbie friendliness 62/100
KATO-Hiro/AtCoderClans#13015 ·
Maintainers usually reply within 1 day