Skip to content

Commit 4f5e93a

Browse files
davidbendavidben
committed
Implement draft-davidben-10 in the demo tool
Since draft-davidben-09 is what some prototypes are targetting, keep support in there by adding a "Version" field to the config file.
1 parent 217ad16 commit 4f5e93a

6 files changed

Lines changed: 83 additions & 19 deletions

File tree

‎demo/README.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,3 @@
33
This tool generates a corpus of test certificates and issuance log based on a
44
JSON configuration file. It has been minimally tested and may not yet correctly
55
match the spec.
6-
7-
Currently this implements the draft-davidben-tls-merkle-tree-certs-09 variant.
8-
It has not yet been updated for -10.

‎demo/config.go‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,49 @@ var (
1414
oidServerAuth = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 3, 1}
1515
)
1616

17+
type DraftVersion int
18+
19+
// Support versions for as long as it is easy to support and useful. If we need
20+
// to remove one, older versions of the demo tool are always available.
21+
const (
22+
VersionDavidben09 DraftVersion = iota
23+
VersionDavidben10
24+
)
25+
26+
func (v DraftVersion) String() string {
27+
switch v {
28+
case VersionDavidben09:
29+
return "davidben-09"
30+
case VersionDavidben10:
31+
return "davidben-10"
32+
}
33+
panic(fmt.Sprintf("unknown version %d", v))
34+
}
35+
36+
func (v *DraftVersion) UnmarshalJSON(data []byte) error {
37+
var s string
38+
if err := json.Unmarshal(data, &s); err != nil {
39+
return err
40+
}
41+
var ok bool
42+
*v, ok = DraftVersionFromString(s)
43+
if !ok {
44+
return fmt.Errorf("unknown version %q", s)
45+
}
46+
return nil
47+
}
48+
49+
func DraftVersionFromString(s string) (v DraftVersion, ok bool) {
50+
switch s {
51+
case "davidben-09":
52+
return VersionDavidben09, true
53+
case "davidben-10":
54+
return VersionDavidben10, true
55+
default:
56+
return 0, false
57+
}
58+
}
59+
1760
type SignatureAlgorithm int
1861

1962
const (
@@ -62,6 +105,7 @@ func (s *SignatureAlgorithm) UnmarshalJSON(data []byte) error {
62105
}
63106

64107
type CAConfig struct {
108+
Version DraftVersion
65109
LogID TrustAnchorID
66110
Cosigners []CosignerConfig
67111
Entries []EntryConfig

‎demo/encode.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -194,10 +194,8 @@ func MarshalNullEntry() []byte {
194194
return []byte{byte(entryTypeNull >> 8), byte(entryTypeNull)}
195195
}
196196

197-
func MarshalTBSCertificateLogEntry(issuer TrustAnchorID, entry *EntryConfig) ([]byte, error) {
198-
b := cryptobyte.NewBuilder(nil)
199-
b.AddUint16(entryTypeTBSCert)
200-
b.AddASN1(cbasn1.SEQUENCE, func(tbs *cryptobyte.Builder) {
197+
func MarshalTBSCertificateLogEntry(version DraftVersion, issuer TrustAnchorID, entry *EntryConfig) ([]byte, error) {
198+
marshalContents := func(tbs *cryptobyte.Builder) {
201199
addX509V3Version(tbs)
202200
addIssuer(tbs, issuer)
203201
addValidity(tbs, entry)
@@ -207,7 +205,14 @@ func MarshalTBSCertificateLogEntry(issuer TrustAnchorID, entry *EntryConfig) ([]
207205
spkiHash.AddBytes(h[:])
208206
})
209207
addExtensions(tbs, entry)
210-
})
208+
}
209+
b := cryptobyte.NewBuilder(nil)
210+
b.AddUint16(entryTypeTBSCert)
211+
if version >= VersionDavidben10 {
212+
marshalContents(b)
213+
} else {
214+
b.AddASN1(cbasn1.SEQUENCE, marshalContents)
215+
}
211216
return b.Bytes()
212217
}
213218

‎demo/encode_test.go‎

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ func TestMarshalTBSCertificate(t *testing.T) {
2828
}
2929

3030
var tests = []struct {
31+
version DraftVersion
3132
issuer TrustAnchorID
3233
serial int
3334
entry *EntryConfig
@@ -36,20 +37,22 @@ func TestMarshalTBSCertificate(t *testing.T) {
3637
}{
3738
// A minimal TBSCertificate
3839
{
39-
issuer: issuer,
40-
serial: 1234,
40+
version: VersionDavidben10,
41+
issuer: issuer,
42+
serial: 1234,
4143
entry: &EntryConfig{
4244
PublicKey: publicKey,
4345
NotBefore: time.Unix(1577836800, 0), // 2020-01-01 00:00:00
4446
NotAfter: time.Unix(1609459199, 0), // 2020-12-31 23:59:59
4547
},
4648
expectedTBSHex: "3081afa003020102020204d2300c060a2b0601040182da4b2f00301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a30003059301306072a8648ce3d020106082a8648ce3d03010703420004e62b69e2bf659f97be2f1e0d948a4cd5976bb7a91e0d46fbdda9a91e9ddcba5a01e7d697a80a18f9c3c4a31e56e27c8348db161a1cf51d7ef1942d4bcf7222c1",
47-
expectedLogEntryHex: "00013064a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a30000420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5",
49+
expectedLogEntryHex: "0001a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a30000420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5",
4850
},
4951
// Fill in a bit of everything.
5052
{
51-
issuer: issuer,
52-
serial: 1234,
53+
version: VersionDavidben10,
54+
issuer: issuer,
55+
serial: 1234,
5356
entry: &EntryConfig{
5457
Subject: SubjectConfig{
5558
CommonName: "example.com",
@@ -62,13 +65,14 @@ func TestMarshalTBSCertificate(t *testing.T) {
6265
ExtKeyUsage: []ExtKeyUsageConfig{ExtKeyUsageConfig(oidServerAuth)},
6366
},
6467
expectedTBSHex: "30820124a003020102020204d2300c060a2b0601040182da4b2f00301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3016311430120603550403130b6578616d706c652e636f6d3059301306072a8648ce3d020106082a8648ce3d03010703420004e62b69e2bf659f97be2f1e0d948a4cd5976bb7a91e0d46fbdda9a91e9ddcba5a01e7d697a80a18f9c3c4a31e56e27c8348db161a1cf51d7ef1942d4bcf7222c1a35d305b300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b0601050507030130310603551d110101ff04273025820b6578616d706c652e636f6d8209612e6578616d706c65820b2a2e622e6578616d706c65",
65-
expectedLogEntryHex: "00013081d9a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3016311430120603550403130b6578616d706c652e636f6d0420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5a35d305b300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b0601050507030130310603551d110101ff04273025820b6578616d706c652e636f6d8209612e6578616d706c65820b2a2e622e6578616d706c65",
68+
expectedLogEntryHex: "0001a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3016311430120603550403130b6578616d706c652e636f6d0420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5a35d305b300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b0601050507030130310603551d110101ff04273025820b6578616d706c652e636f6d8209612e6578616d706c65820b2a2e622e6578616d706c65",
6669
},
6770
// Generate a CA too, even though it's a little questionable. See
6871
// https://github.com/davidben/merkle-tree-certs/issues/146
6972
{
70-
issuer: issuer,
71-
serial: 1234,
73+
version: VersionDavidben10,
74+
issuer: issuer,
75+
serial: 1234,
7276
entry: &EntryConfig{
7377
Subject: SubjectConfig{
7478
CommonName: "A CA?",
@@ -81,7 +85,20 @@ func TestMarshalTBSCertificate(t *testing.T) {
8185
MaxPathLen: ptrOf(int64(5)),
8286
},
8387
expectedTBSHex: "3081e7a003020102020204d2300c060a2b0601040182da4b2f00301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3010310e300c06035504031305412043413f3059301306072a8648ce3d020106082a8648ce3d03010703420004e62b69e2bf659f97be2f1e0d948a4cd5976bb7a91e0d46fbdda9a91e9ddcba5a01e7d697a80a18f9c3c4a31e56e27c8348db161a1cf51d7ef1942d4bcf7222c1a3263024300e0603551d0f0101ff04040302020430120603551d130101ff040830060101ff020105",
84-
expectedLogEntryHex: "000130819ca003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3010310e300c06035504031305412043413f0420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5a3263024300e0603551d0f0101ff04040302020430120603551d130101ff040830060101ff020105",
88+
expectedLogEntryHex: "0001a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a3010310e300c06035504031305412043413f0420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5a3263024300e0603551d0f0101ff04040302020430120603551d130101ff040830060101ff020105",
89+
},
90+
// draft-davidben-09 included a TBSCertificate wrapper TLV.
91+
{
92+
version: VersionDavidben09,
93+
issuer: issuer,
94+
serial: 1234,
95+
entry: &EntryConfig{
96+
PublicKey: publicKey,
97+
NotBefore: time.Unix(1577836800, 0), // 2020-01-01 00:00:00
98+
NotAfter: time.Unix(1609459199, 0), // 2020-12-31 23:59:59
99+
},
100+
expectedTBSHex: "3081afa003020102020204d2300c060a2b0601040182da4b2f00301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a30003059301306072a8648ce3d020106082a8648ce3d03010703420004e62b69e2bf659f97be2f1e0d948a4cd5976bb7a91e0d46fbdda9a91e9ddcba5a01e7d697a80a18f9c3c4a31e56e27c8348db161a1cf51d7ef1942d4bcf7222c1",
101+
expectedLogEntryHex: "00013064a003020102301931173015060a2b0601040182da4b2f010c0733323437332e31301e170d3230303130313030303030305a170d3230313233313233353935395a30000420b3aea0f0a50538874f2b4c912f2676bd25ccc3dae700e20dcad42d3d5c074ca5",
85102
},
86103
}
87104
for i, tt := range tests {
@@ -94,7 +111,7 @@ func TestMarshalTBSCertificate(t *testing.T) {
94111
t.Errorf("%d. AddTBSCertificate() gave %s, wanted %s", i, got, tt.expectedTBSHex)
95112
}
96113

97-
log, err := MarshalTBSCertificateLogEntry(tt.issuer, tt.entry)
114+
log, err := MarshalTBSCertificateLogEntry(tt.version, tt.issuer, tt.entry)
98115
if err != nil {
99116
t.Errorf("%d. MarshalTBSCertificateLogEntry() failed: %s", i, err)
100117
} else if got := hex.EncodeToString(log); got != tt.expectedLogEntryHex {

‎demo/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ func do() error {
9999
repeat = entryConfig.Repeat
100100
}
101101
for range repeat {
102-
entry, err := MarshalTBSCertificateLogEntry(config.LogID, entryConfig)
102+
entry, err := MarshalTBSCertificateLogEntry(config.Version, config.LogID, entryConfig)
103103
if err != nil {
104104
return err
105105
}

‎demo/mtc.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{
2+
"Version": "davidben-10",
23
"LogID": "32473.1",
34
"Cosigners": [
45
{

0 commit comments

Comments
 (0)