Support additional public key algorithms

[adamkaplan]

I have some certificates that use public key algorithms that aren’t supported by TrustKit. Specifically, Yahoo has 3 certs that fail pin generation: one future-proof SHA384 and two older SHA1. Ideally TrustKit can support these formats as well (and then might as support SHA512 and SHA224).

It looks like they can be supported by adding the appropriate asn1 headers, and patching the python pin generator.

Is there any reason why these other algorithms can not or should not be supported by TrustKit?

[nabla-c0d3]

The signature algorithms (SHA1, etc.) are all supported so it should not matter. Do you know what the public key algorithms are (RSA, ECDSA, etc.) ? Can I have a look at these certificates?
We support the main algorithms (RSA 2048, RSA 4096 and ECDSA P256) but adding new ones should be straightfoward.

[adamkaplan]

For sure. I believe they are all ECDSA:

SHA1
GeoTrust_Primary_CA_G2_ECC.pem
VeriSign-Class-2-Public-Primary-Certification-Authority-G2.pem

SHA384
VeriSign-Class-3-Public-Primary-Certification-Authority-G4.pem

Appreciate you bearing with me. I’m just coming up to speed on the internal formats and low-level crypto.

[nabla-c0d3]

No problem - so from looking at the certificates:

• The GeoTrust and Verisign G4 roots use ECDSA secp384r1 - I will add support for this.
• The VeriSign G2 uses RSA 1024 - this is a very old certificate and algorithm, I'd rather avoid supporting RSA 1024. Also, it seems like this is a legacy root: "It is intended to be the primary root used for these products until Q4 2010 when VeriSign transitions to using a 2048 bit root." ( https://www.symantec.com/theme/roots )

[adamkaplan]

Thanks for checking into that @nabla-c0d3. I agree with view on 1024/legacy, we’re still discussing it. I’ll relay this back to the Paranoids, but sometimes things aren’t as clean when you run with well over 6,000 certs.

[nabla-c0d3]

Sure - we are directly in touch with the Paranoids too (we've worked with them for the past three years =) - some of the Yahoo Apps are already using TrustKit) so feel free to open an email thread or we can have a quick call with everyone if that helps.

[adamkaplan]

Moved that discussion to ✉️