google / google/certificate-transparency-go
Don't error on unsupported leaf public keys
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 322
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 5
Description
crt.sh's CT monitor (which uses c-t-go) was getting stuck trying to process https://crt.sh/?id=1552595593, due to the public key's elliptic curve being unsupported.
I don't for a moment think that the patch below would form an acceptable PR; but just FYI, this is what I've done to crt.sh's local copy of c-t-go's x509.go in order to temporarily work around this problem...
```
diff --git a/x509/x509.go b/x509/x509.go
index f70a546..b9e3366 100644
--- a/x509/x509.go
+++ b/x509/x509.go
@@ -1403,7 +1403,7 @@ func parsePublicKey(algo PublicKeyAlgorithm, keyData *publicKeyInfo, nfe *NonFat
}
namedCurve := namedCurveFromOID(*namedCurveOID, nfe)
if namedCurve == nil {
- return nil, fmt.Errorf("x509: unsupported elliptic curve %v", namedCurveOID)
+ return nil, nil
}
x, y := elliptic.Unmarshal(namedCurve, asn1Data)
if x == nil {
```
Contributor guide
Research direction
Start in x509/x509.go at parsePublicKey, especially the namedCurveFromOID path shown in the report, and inspect how the certificate at crt.sh/?id=1552595593 is processed. Reproduce the unsupported-curve case and determine the expected non-blocking behavior; done means the CT monitor can process that certificate without the current unsupported-curve error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100