webpki

1. Legacy 2. Trust Domains (half completed, but littered throughout the code as nss3 prefix). This was being lead by Sun and stopped when Oracle acquired them. 3. libpkix: This was done by porting Java code to C using preprocessor macros to simulate exception handling. It implemented path discovery, and not just verification, and was used by Firefox for EV processing (AIUI), and was always used by Chrome on Linux/ChromeOS (until recently replaced with the Chromium built-in verifier) 4. mozilla::pkix, which started off as Brian Smith’s insanity::pkix rewrite of a minimalist path builder/verifier. I can’t remember if this launched while Brian was still at Mozilla or after he had left, but Brian would later take the approach he used for insanity::pkix when writing the Rust webpki project ( https://github.com/briansmith/webpki ) Each of the a

Update: tested it with openssl and webpki. both claim to have support but it only works with openssl. For webpki I had to file two bugs: https://github.com/briansmith/webpki/issues/134 https://github.com/briansmith/webpki/issues/135

IDK NSS seems to have code to verify it: https://searchfox.org/mozilla-central/source/security/nss/li... As does webpki: https://github.com/briansmith/webpki/blob/482627c40dad2148da... But haven't tested it (or checked other libraries).

I commented on this at https://github.com/briansmith/webpki/issues/130. This is nothing to be concerned about, for quite a few reasons. I don't expect any compatibility issues with being stricter since Google Chrome's new X.509 processing does enforce the stricter syntax.

> Where are the pervasively used compression libraries in Rust? Video and audio codecs? Network stacks? Database engines? System management utilities? PKI and encryption stacks? All that stuff is still in C. After ten years of Rust success! It's not ten or 20 years, the first release of Rust was in 2015. Pre-1.0 Rust was a wildly different language, with green threads, segmented stacks, regular and wild breakage, not really a C replacement! Please understand this point. But anyway here are some projects: https://github.com/ctz/rustls a TLS library that uses https://github.com/briansmith/webpki a pki library https://github.com/burntsushi/rust-snappy a compression library https://github.com/tikv/tikv a database engine https://github.com/hyperium/tonic a gRPC library https://github.com/tock/tock an embedded OS https://lib.rs/command-line-uti