search

igrr / axtls-8266

axTLS port for ESP8266
Other
79 stars 33 forks source link

Add support for verifying SHA-256 hash of Subject Public Key Info #31

Closed silbe closed 7 years ago

silbe commented 7 years ago

axtls provides a way to implement "SSH" style key verification by checking the SHA-1 hash of the (entire) certificate. Unfortunately this checksum changes every time the certificate is changed, e.g. because it's getting renewed (usually every year, for letsencrypt.org even every 3 months) or extended with new domains.

For HTTP public key pinning (RFC7469), the SHA-256 hash of the Subject Public Key Info (which usually only changes when the public key changes) is used rather than the SHA-1 hash of the entire certificate. This makes a lot of sense for use with axtls, too. This pull request introduces a new function ssl_match_spki_sha256() that allows an API consumer to verify the SHA-256 hash of the SPKI. The existing SHA-1 certificate hash verification support is left untouched so there should not be any compatibility concerns.

igrr commented 7 years ago

Sorry for not having noticed this when the PR was opened. This change looks very good!

cottsak commented 7 years ago

Can I suggest we remove the "SHA-1 certificate hash verification support" now that sha-1 is broke!?