lys-core 0.1.0

Domain-agnostic cryptographic trust primitives — certificate authority, Merkle transparency log, signed attestations, sealed envelopes, and Ed25519 key management.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

//! Custom X.509 extension transport.
//!
//! These helpers encode and extract opaque DER payloads carried in custom
//! certificate extensions. The crate owns only the extension *structure* —
//! encoding bytes into an extension and reading them back out by OID. It does
//! not interpret the payload: the meaning of the bytes is the consumer's
//! concern.
//!
//! Extensions are created non-critical so that generic X.509 parsers, which
//! do not recognise the custom OID, still accept certificates that carry them.

use x509_parser::oid_registry::Oid;
use x509_parser::prelude::{FromDer, X509Certificate};

use crate::error::{TrustError, TrustResult};

/// The rcgen extension type produced by [`encode_extension`] and consumed by
/// [`crate::ca::CertificateAuthority::issue_certificate`].
pub use rcgen::CustomExtension;

/// Private-enterprise OID arc reserved for lys custom extensions.
///
/// Rooted at the IANA Private Enterprise Numbers arc (`1.3.6.1.4.1`). The
/// final component, `66364`, is the Private Enterprise Number IANA assigned
/// to lys — permanent, publicly registered, and never renumbered: extensions
/// are signed under OIDs beneath this arc, so changing it would invalidate
/// every certificate ever issued. Consumers append their own sub-components
/// to this arc to distinguish individual extension kinds.
pub const LYS_OID_ARC: &[u64] = &[1, 3, 6, 1, 4, 1, 66364];

/// Encodes an opaque DER payload into a non-critical custom X.509 extension.
///
/// The returned extension carries `payload_bytes` verbatim under `oid`. The
/// payload is treated as opaque transport — no structure is imposed on or
/// read from it here. Criticality is set to `false` so parsers that do not
/// recognise `oid` will not reject the certificate.
pub fn encode_extension(oid: &[u64], payload_bytes: impl Into<Vec<u8>>) -> CustomExtension {
    let mut extension = CustomExtension::from_oid_content(oid, payload_bytes.into());
    extension.set_criticality(false);
    extension
}

/// Extracts the opaque payload of a custom extension identified by `oid`.
///
/// Parses `cert_der`, then looks up the extension by OID, rejecting
/// certificates that carry the same OID more than once. Returns the raw
/// extension value bytes unchanged, or `None` when the certificate does not
/// carry an extension with that OID.
///
/// # Errors
///
/// Returns [`TrustError::CertificateParsing`] if `cert_der` is not a valid
/// certificate, `oid` is not a well-formed object identifier, or the
/// certificate carries the OID more than once.
pub fn decode_extension(cert_der: &[u8], oid: &[u64]) -> TrustResult<Option<Vec<u8>>> {
    let (_, certificate) =
        X509Certificate::from_der(cert_der).map_err(|e| TrustError::CertificateParsing {
            reason: format!("failed to parse certificate DER: {e:?}"),
        })?;

    let target = Oid::from(oid).map_err(|_err| TrustError::CertificateParsing {
        reason: "extension lookup OID is not a well-formed object identifier".to_string(),
    })?;

    match certificate.tbs_certificate.get_extension_unique(&target) {
        Ok(Some(extension)) => Ok(Some(extension.value.to_vec())),
        Ok(None) => Ok(None),
        Err(e) => Err(TrustError::CertificateParsing {
            reason: format!("duplicate or malformed extension for OID lookup: {e}"),
        }),
    }
}

#[cfg(test)]
#[path = "extensions_tests.rs"]
mod tests;