Crate mtcs 

Offline Merkle Tree Certificate (MTC) verification, following draft-ietf-plants-merkle-tree-certs-07 (IETF PLANTS WG).

This crate implements the relying-party side of Merkle Tree Certificates: parsing the MTCProof embedded in an X.509 certificate’s signature value, recomputing the log entry hash from the TBSCertificate, evaluating subtree inclusion proofs, and verifying subtree cosignatures against a local trust store (TrustStore, available with the default verify feature). All inputs are supplied by the caller; the crate performs no I/O, reads no clock, and holds no global state. Only the SHA-256 tree hash profile is supported.

The no-feature base layer provides the wire formats, trust anchor IDs, Merkle tree math, log entry hashing, and landmark and property parsing.

• Standalone certificates are verified through cosignature checks (Section 7.3 of the draft).
• Landmark-relative certificates are verified through predistributed trusted subtrees (Section 7.4).

Certificate issuance, log operation, monitoring, and network protocols (tlog-tiles serving, landmark distribution) are out of scope.

let mut store = mtcs::TrustStore::new();
store.add_ca(mtcs::CaTrust::from_ca_certificate(include_bytes!(
    "../tests/fixtures/ca.der"
))?);
let verification = mtcs::verify_certificate(
    &store,
    include_bytes!("../tests/fixtures/standalone.der"),
    1735689600, // 2025-01-01T00:00:00Z
)?;
assert_eq!(verification.entry_index, 10);

Structs

CaTrust

Per-CA relying-party configuration (Sections 7.1, 7.3 and 7.5 of the draft).

CertificatePropertyList

A parsed CertificatePropertyList.

Cosignature

One subtree cosignature.

CosignerGroup

A group of cosigners with a satisfaction threshold: a certificate satisfies the group when at least threshold distinct members carry a cosignature that verifies (Section 7.3 of the draft: “a quorum of signatures from additional cosigners”). A CA collecting cosignatures from a redundant set (Section 6.3) may then legitimately present different subsets over time.

CosignerInfo

A cosigner’s public key and signature algorithm, keyed by its cosigner ID. The algorithm is identified explicitly (Section 5.3.3 of the draft), not inferred from key bytes.

EntryReference

The serial number of a Merkle Tree certificate, split into log coordinates.

Landmark

One entry of a CA’s landmark sequence (Section 6.4.1 of the draft).

MtcCaParameters

The decoded body of an id-pe-mtcCertificationAuthority-SHA256 extension.

MtcProof

A parsed MTCProof structure from a certificate’s signature value.

Subtree

A Merkle subtree interval [start, end) (Section 4.1 of the draft).

TrustAnchorId

An owned trust anchor ID in binary representation (RELATIVE-OID content octets).

TrustStore

The relying party’s local trust configuration. Verification is fully offline: every input is in this structure or supplied at the call site.

TrustedSubtree

A predistributed trusted subtree for landmark-relative certificates (Section 7.4 of the draft). The relying party is responsible for having validated the subtree’s consistency with cosigned checkpoints out of band.

Verification

A successful certificate verification.

Enums

Error

Errors produced by MTC parsing and verification.

Property

One property of a CertificatePropertyList.

SignatureAlgorithm

A cosigner signature algorithm (Section 5.3.3 of the draft).

VerificationKind

What a successful verification relied on.

Constants

HASH_SIZE

The hash output size of the SHA-256 tree profile, in bytes.

Functions

covering_subtrees

Select the two subtrees that efficiently cover [start, end) (Section 4.5.1 of the draft). The right subtree ends exactly at end; either may be empty.

entry_hash_from_certificate

Compute the MTCLogEntry leaf hash for a certificate, given the entry extensions from its MTCProof (the contents of the extensions<0..2^16-1> vector, without its length prefix; the prefix is reconstructed here).

evaluate_inclusion_proof

Evaluate a subtree inclusion proof (Section 4.3.2 of the draft), returning the expected hash of the subtree [start, end). Returns None on failure.

is_valid_subtree

Whether [start, end) is a valid subtree: start <= end and start is a multiple of BIT_CEIL(end - start) (Section 4.1 of the draft).

leaf_hash

The RFC 9162 leaf hash SHA-256(0x00 || entry).

node_hash

The RFC 9162 interior node hash SHA-256(0x01 || left || right).

parse_landmarks

Parse a published landmark document (Section 6.4.3 of the draft).

parse_mtc_ca_parameters

Parse the MTCCertificationAuthority extension body: SEQUENCE { sigAlg AlgorithmIdentifier, minSerial INTEGER, maxSerial INTEGER }.

split_serial

Split an MTC serial number, (log_number << 48) | index, from INTEGER content octets retaining any sign padding. Returns None for empty, negative or over-u64 content. The draft’s nonzero-log-number rule is not enforced here.

verify_certificate

Verify one Merkle Tree certificate against the local trust configuration, checking its validity period against now, the caller’s timestamp in seconds since the Unix epoch. Section 7.2 of the draft requires relying parties to keep performing the other X.509 checks, such as expiry.

verify_certificate_ignoring_validity

Verify one Merkle Tree certificate without checking its validity period. This exists for offline audit and monitoring use; it is not suitable for authenticating a live peer, since expired certificates are accepted without any diagnostic.

verify_consistency_proof

Verify a subtree consistency proof (Section 4.4.3 of the draft): does the subtree hash node_hash of [start, end) commit to the same entries as root_hash of a tree of size n?

Type Aliases

Result

The crate’s result type.