IntersectMBO / IntersectMBO/mithril

Add a certificate chain cache committed after chain verification in the client library

Open
#3,520 0 comments 0 reactions 1 assignee Claimed by @Alenar View on GitHub
feature :rocket:
Dominant language
Rust
Stars
154
Forks
51
Avg merge
1d 23h
Merged PRs (30d)
38

Description

## Why

We want to update the unstable `MithrilCertificateVerifier` and `CertificateVerifierCache` implementations of the client to support a commit mechanism when the full certificate chain is validated. A first `FullVerification` mode of verification using the cache will verify the cryptography of the cached certificate, thus providing the same level of security than without cache.

## What

Implement the new commit mechanism for the client certificate cache and the `FullVerification` mechanism.

## How

- [x] Update the `CertificateVerifierCache` trait with:
- [x] `stage_certificate(&self, certificate_chain_validation_id: &str, certificate: &CertificateMessage) -> MithrilResult<()>`
- [ ] `commit_staged_certificates(&self, certificate_chain_validation_id: &str) -> MithrilResult<`()>
- [x] `get_certificate_by_hash(&self, certificate_hash: String) -> MithrilResult>`
- [x] `reset(&self) -> MithrilResult<()>`
- [x] Adapt the `MemoryCertificateVerifierCache` implementation
- [ ] Implement the `FullVerification` algorithm in `verify_chain` of the `MithrilCertificateVerifier`
- [ ] Adapt the `ClientBuilder` to configure the cache

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.