Deterministic certificates
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 505
- Forks
- 157
- Avg merge
- 39m
- Merged PRs (30d)
- 1
Description
I'd like to have a way to create a fully deterministic certificate from a given seed. We use WebRTC to establish p2p connections and want to embed the certificate hash in the address information that we are passing around. Each node already has a cryptographic identity and I'd like to generate a deterministic certificate from that via a HKDF.
In an ideal world, rcgen exposes a Certificate::from_seed function and uses the provided seed to bootstrap all randomness inside. That would keep implementation details like ring contained within the library.
Alternatively, we can expose the randomness and let users deal with passing a seeded, deterministic RNG.
Thoughts?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue does not name files or tests. Start by reviewing the Certificate API and the existing randomness boundary, then compare the proposed HKDF-based Certificate::from_seed approach with exposing a seeded deterministic RNG. Done means the design is decided and deterministic certificate generation from a given seed is specified without leaking implementation details.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100