Tighten up CertificateSigningRequestParams.from_der() sig AlgorithmIdentifier params validation
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- cryptography
Research direction
Start in CertificateSigningRequestParams::from_der() under the x509-parser feature, where SignatureAlgorithm::supports_oid is called on the signature algorithm OID. Read the x509-parser AlgorithmIdentifier parameters handling and the linked PR #459 discussion before deciding how NULL parameters should be enforced. Done means the parameters are checked for algorithms that require NULL and RSA-PSS parameters are handled explicitly, with tests covering both cases.
Written by the indexing model from the issue text.
Description
When building a CertificateSigningRequestParams from CertificateSigningRequestDer with the x509-parser feature enabled we check SignatureAlgorithm::supports_oid(&sig_alg_oid) but this only compares by OID and doesn't consider the x509-parser AlgorithmIdentifier type's parameters. For many algorithms the parameters MUST be NULL and we should enforce that. For RSA-PSS support in particular we'll need to consider the explicit parameters beyond enforcing encoding.
See https://github.com/rustls/rcgen/pull/459#discussion_r4574500586
- Dominant language
- Rust
- Stars
- 516
- Forks
- 160
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rustls/rcgen
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
CertificateSigningRequestParams::from_der can parse the wrong key typePossibly taken @jgreeer claimed this 51 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 55/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Eyevinn/open-live-ingest#36 · 1 comment ·
Maintainers usually reply within 1 day
-
app
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
bug bug jury peripheral:i2s
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
esp-rs/esp-hal#6828 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
ライブラリを追加Openpriority middle
Difficulty 1/5 Under an hour Newbie friendliness 62/100
KATO-Hiro/AtCoderClans#13015 ·
Maintainers usually reply within 1 day