Should the libp2p extension be over SubjectPublicKeyInfo?
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 1.8k
- Forks
- 320
- Avg merge
- 11d 15h
- Merged PRs (30d)
- 1
Description
Should the libp2p extension include a signature of SubjectPublicKeyInfo instead of a signature of the public key? This seems to be good practice, as SubjectPublicKeyInfo includes not only the public key, but also the signature algorithm. For example, if RSA PKCS 1.5 were broken, but RSASSA-PSA was not broken, this would prevent forgery attacks until clients could upgrade their TLS libraries to reject RSA PKCS 1.5.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or implementation entry points. Start by locating the libp2p extension specification and its current public-key signature definition, then compare that design with SubjectPublicKeyInfo and assess the compatibility and security implications; done means reaching and documenting a decision on the signed data format.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100