Perf thumbprint caching chain builder - #131
Open
aww-aww wants to merge 12 commits into
Open
Conversation
- Add checks in `findIssuer` to verify that the issuer has `BasicConstraints: cA=true` (if extension present). - Add checks in `findIssuer` to verify that the issuer has `KeyUsage: keyCertSign` (if extension present). - Add regression test `test/chain_validation.ts`. This fixes a vulnerability where invalid chains could be constructed using end-entity certificates as CAs. Co-authored-by: aww-aww <2776327+aww-aww@users.noreply.github.com>
…serial-14597853205968635182 Add test for duplicate serial number in X509CrlGenerator
…ss-8423052248416536031 🛡️ Sentinel: [CRITICAL/HIGH] Fix X.509 Chain Validation Bypass
Added a new test suite in `test/utils.ts` to verify the behavior of `generateCertificateSerialNumber`. Specifically covers: - Prepending 0x00 when the MSB is set. - Removal of leading zeros. - Random generation for empty inputs. Co-authored-by: aww-aww <2776327+aww-aww@users.noreply.github.com>
Added comprehensive tests for X509Crl, X509CrlEntry, and X509CrlGenerator classes. This increases coverage for src/x509_crl.ts from 59% to 92% and src/x509_crl_entry.ts from 76% to 95%. Co-authored-by: aww-aww <2776327+aww-aww@users.noreply.github.com>
…9138447 Improve test coverage for CRL classes
…8446484901 test: add missing tests for generateCertificateSerialNumber MSB padding
…n X509ChainBuilder According to RFC 5280 section 4.2.1.9, the basic constraints extension MUST appear as a critical extension in all CA certificates. Previously, `X509ChainBuilder` would bypass the `ca` boolean check if the `BasicConstraints` extension was completely missing, allowing non-CA End Entity certificates to be improperly treated as CAs when building chains. This patch strictly enforces that Version 3 certificates MUST contain the `BasicConstraints` extension with `ca = true` to act as a valid issuer in a certification path. Tests have been added and existing mock certificates have been updated to properly issue `BasicConstraints` where appropriate. Co-authored-by: aww-aww <2776327+aww-aww@users.noreply.github.com>
…traints-4704870714358861626 Enforce BasicConstraints for V3 CA certificates in X509ChainBuilder
- Implement internal caching for `X509Certificate.getThumbprint()` to avoid redundant cryptographic digest operations. - Optimize `X509ChainBuilder.build()` to use a `Set` of hex-encoded thumbprints for circular dependency detection, reducing complexity from O(N^2) to O(N). Co-authored-by: aww-aww <2776327+aww-aww@users.noreply.github.com>
…hain-builder-4137949091359479031
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improve performance by adding a thumbprint cache.