google / google/certificate-transparency-go

Alternative Endpoint for x509.ParsePKIXPublicKey that allows non-fatal errors

Open
#740 0 comments 3 reactions 0 assignees View on GitHub
x509
Dominant language
Go
Stars
1.2k
Forks
322
Avg merge
3d 4h
Merged PRs (30d)
5

Description

I have to parse a P-192 public key and although it is [not implemented](https://github.com/golang/go/issues/41035) in the upstream `x509` package, this repo is able to parse it properly and flags the fact that it is an insecure algorithm as a non-fatal error; however, the `ParsePKIXPublicKey` function [makes these non-fatal errors fatal errors](https://github.com/google/certificate-transparency-go/blob/7710282e49162cbd95c500777522f436fd5fc279/x509/x509.go#L110-L113), preventing the parsing of a P-192 key. The comment mentions that this is "for this entrypoint"; however, I don't see another entry point that would allow for more lax parsing of these public keys.

Any ideas on an alternative entrypoint for parsing these keys?

Contributor guide

Open the contributing guide

Research direction

Start by reading x509/x509.go around ParsePKIXPublicKey and its handling of non-fatal errors at lines 110-113, then review upstream issue 41035 for the P-192 limitation. Define an alternative parsing entry point that permits the repository's non-fatal algorithm errors without changing the existing entry point's behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.