search

golang / go

The Go programming language
https://go.dev
BSD 3-Clause "New" or "Revised" License
123.97k stars 17.66k forks source link

crypto/x509: store stripped down trust anchors #44298

Open rolandshoemaker opened 3 years ago

rolandshoemaker commented 3 years ago

Rather than storing full x509.Certificates in the root pool we could instead store only the information that we require to accomplish chain building (SPKI, subject, name constraints), significantly reducing the memory footprint for the pool.

When returning certificate chains from Verify we'd need to construct a stand-in x509.Certificate which is only partially populated (we'd need to decide what fields to set, and what we can get away with setting based on a typical root profile, i.e. is it safe to consistently set the issuer to match the subject, even for roots where the issuer does not actually match?). Depending on what users are doing with certificates it is possible that this could break some things. As such we should try to land this change early in the 1.17 cycle so any significant breakages are signaled early.

This would also reduce binary sizes on iOS where we bundle roots, and also make things like #43958 somewhat more appealing from a binary bloat perspective.

josharian commented 3 years ago

cc @bradfitz

gopherbot commented 3 years ago

This issue is currently labeled as early-in-cycle for Go 1.17. That time is now, so a friendly reminder to look at it again.

dmitshur commented 3 years ago

There hasn't been much activity here, and by now it's likely late for Go 1.17. I'll move this to Backlog, but please feel free to update it as needed.