Proposal Details
I'm working on an implementation of Merkle Tree Certificates, a new type of certificate that combines issuance with certificate transparency in a way that reduces the overall size of the certificate The spec involves a new type of signature algorithm, specifically for the issuer's signature.
crypto/X509.ParseCertificate() successfully parses the certificate, but sets SignatureAlgorithm to UnknownSignatureAlgorithm. Before attempting to validate the Signature, I would like to inspect the raw signature algorithm in order to ensure it is the OID we expect.
Options:
- Expose the raw signature algorihm as a field in
Certificate. Though I don't know enough about X.509 to say if this is a realistic option.
- Add support for the MTC signature algorithm. Note, however, that the spec is in an experimental phase and the OID has not been finalized.
Related proposal: #75260
Proposal Details
I'm working on an implementation of Merkle Tree Certificates, a new type of certificate that combines issuance with certificate transparency in a way that reduces the overall size of the certificate The spec involves a new type of signature algorithm, specifically for the issuer's signature.
crypto/X509.ParseCertificate()successfully parses the certificate, but setsSignatureAlgorithmtoUnknownSignatureAlgorithm. Before attempting to validate theSignature, I would like to inspect the raw signature algorithm in order to ensure it is the OID we expect.Options:
Certificate. Though I don't know enough about X.509 to say if this is a realistic option.Related proposal: #75260
I like the idea of
Certificate.RawSignatureAlgorithm. We do have apkix.AlgorithmIdentifiertype, but it uses the oldasn1.ObjectIdentifiertype I would like to move on from.Let's propose to add the following field to Certificate, CertificateRequest, and RevocationList
and it can be compared for equality with the expected MTC one.