X.509 certificate generation and parsing support

[kwvg]

Existing Works

• rusticata's x509-parser (reliant on the nom parser framework)
• Simple Concatenated Aggregate Little-Endian Codec (source)
• Serde: Rust serialization and deserialization framework (source)
• est31 's rcgen (depends highly on ring for cryptographic operations, limited in nature)
  • Ed25519 certificate recognition is broken in OpenSSL due to a bug (Add support for PKCS#8 v2 (RFC 5958 - Asymmetric Key Packages) openssl/openssl#10468)
  • Ed448 is not supported by ring (Ed448 support briansmith/ring#463)
  • NIST curves are not entirely supported by ring (NIST curve P-521 SHA-512 support for generating keys and signing briansmith/ring#824)

Additional Reading

• PKI Supported Algorithms from the CryptoSys PKI Pro Manual

Initial algorithm support scope

• ECDSA
  • secp256k1
  • prime256v1
  • ed25519
• RSA w/ OAEP

Last Resort

• sfackler's rust-openssl
  • macOS builds aren't a given due to an upstream bug (build failed on macOS sfackler/rust-openssl#960)
  • Incomplete/esoteric X509 certificate support (Read x509 Extensions sfackler/rust-openssl#373, Creating an X.509 certificate from a CSR sfackler/rust-openssl#345)