Allow CSRs to be created for encryption-only public keys (such as ML-KEM)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.8k
- Forks
- 1.8k
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 157
Description
In relation to #15263, which allows ML-KEM public keys to be included in the subjectPublicKeyInfo field in X.509 certificates.
Certificate applicants will either use a CSR (RFC 2986) or a CRMF (RFC 4211) to provide their to-be-certified public key to the CA (among other information). Since ML-KEM (among others) cannot be used to create a digital signature, RFC 9883 has been published as solution.
While most of this RFC describes a procedure, the following items need be added to support this mechanism:
- Sign a CSR using a different private key than was included;
- Ability to add the
statementOfPossessionattribute to the CSR. I'd imagine extending theAttributemechanism in a similar fashion as is done forExtension.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading RFC 9883 alongside the CSR requirements in RFC 2986 and the CRMF context in RFC 4211. Trace the existing CSR Attribute and Extension mechanisms, then determine how the API should support signing with a separate private key and adding statementOfPossession. Done means both mechanisms are supported with appropriate validation and tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100