key fingerprint

[shawnl]

I am not sure what I can do to get the public key with minicrypto/picotls, so that I can hash it (and hash it properly, I have no idea), so I can build ssh-like authentication.

[kazuho]

minicrypto does not provide an interface to deal with the internals of a certificate (e.g. public key), though you might be able to use the existing code that extracts the private key from a PEM file.

However, you can verify the certificate rather than the public key; i.e. check that checksum of the end certificate provided by the server is equal to the value of a certificate that have been verified at a prior moment.

I believe that you can implement that by writing your own ptls_verify_certificate_t callback.

[shawnl]

I believe void **verify_data of verify_certificate callback refers to the public key

[kazuho]

That depends on how you implement the callback.

But yes, we need to do two things:
*extract the public key of the certificate and validate the CertificateVerify message using the public key, to make sure that the owner of the certificate is the peer

• verify the certificate, to make sure that the certificate is legitimate

Regardless of how we would validate the legitimacy of certificate (e.g. track the chain of trust to the root certificate, check the hash of the server certificate), we are required to extract the public key of the certificate.

Unfortunately, we do not have the function. Though I think you can implement one using the ASN.1 decoding functions found in pembase64.c.

The other other would be to add support for Raw Public Key instead of certificate (see RFC 7250 and TLS 1.3 draft section 4.4.2).

But either option requires some development on the picotls side. I am happy to review a PR that implements either of them.

[shawnl]

It appears picotls would be the first to support RFC 7250 Raw Public Key if it was implemented.

[shawnl]

I don't see any ASN.1 in pembase64.c, just base64 stuff.

[kazuho]

@shawnl My bad. The code that deals with private keys is in minicrypto-pem.c.