Support additional public key algorithms about trustkit HOT 6 CLOSED

The signature algorithms (SHA1, etc.) are all supported so it should not matter. Do you know what the public key algorithms are (RSA, ECDSA, etc.) ? Can I have a look at these certificates?
We support the main algorithms (RSA 2048, RSA 4096 and ECDSA P256) but adding new ones should be straightfoward.

from trustkit.

For sure. I believe they are all ECDSA:

SHA1
GeoTrust_Primary_CA_G2_ECC.pem
VeriSign-Class-2-Public-Primary-Certification-Authority-G2.pem

SHA384
VeriSign-Class-3-Public-Primary-Certification-Authority-G4.pem

Appreciate you bearing with me. I’m just coming up to speed on the internal formats and low-level crypto.

from trustkit.

No problem - so from looking at the certificates:

• The GeoTrust and Verisign G4 roots use ECDSA secp384r1 - I will add support for this.
• The VeriSign G2 uses RSA 1024 - this is a very old certificate and algorithm, I'd rather avoid supporting RSA 1024. Also, it seems like this is a legacy root: "It is intended to be the primary root used for these products until Q4 2010 when VeriSign transitions to using a 2048 bit root." ( https://www.symantec.com/theme/roots )

from trustkit.

Thanks for checking into that @nabla-c0d3. I agree with view on 1024/legacy, we’re still discussing it. I’ll relay this back to the Paranoids, but sometimes things aren’t as clean when you run with well over 6,000 certs.

from trustkit.

Sure - we are directly in touch with the Paranoids too (we've worked with them for the past three years =) - some of the Yahoo Apps are already using TrustKit) so feel free to open an email thread or we can have a quick call with everyone if that helps.

from trustkit.

Moved that discussion to ✉️

from trustkit.