Certificate Chain Verification using LibTomCrypt - Is there a plan to introduce this functionality?

[sreedhartk]

Hello all, I see that LibTomCrypt DOES NOT have an inherent implementation for x509_verify which is available in most modern crypto libraries such as OpenSSL, MbedTLS, WolfSSL etc., wherein we can easily pass an entity certificate as well as a root certificate and then verify if they belong to the same chain. I also see that there are no APIs to decode the certificate contents to extract the TBS data.

For a similar functionality, I had to manually write functions to decode the different fields, subject, extension and then use the info to arrive at the TBS data which I hashed and verified using the root certificate's public key to validate the certificate chain.

Is there any plans to provide this certificate chain verification feature in LibTomCrypt in the near future?

[sjaeckel]

For a similar functionality, I had to manually write functions to decode the different fields, subject, extension and then use the info to arrive at the TBS data which I hashed and verified using the root certificate's public key to validate the certificate chain.

Is this available somewhere?

Is there any plans to provide this certificate chain verification feature in LibTomCrypt in the near future?

Yes.

[sreedhartk]

For a similar functionality, I had to manually write functions to decode the different fields, subject, extension and then use the info to arrive at the TBS data which I hashed and verified using the root certificate's public key to validate the certificate chain.

Is this available somewhere?
I just have it locally with me.

Is there any plans to provide this certificate chain verification feature in LibTomCrypt in the near future?

Yes.
Is there a timeline for this availability?

[sjaeckel]

Is there a timeline for this availability?

Nope. It's done when it's done.

If you want to have a timeline you're free to contact me privately and I can prepare you a commercial offer for the complete feature.

[sreedhartk]

Hello @sjaeckel

I would like to know the procedure to contribute my implementation for this functionality. Would that be ok? If yes, are there any particular procedures to be followed? Can you pls help with the information about it?

[sjaeckel]

Would that be ok?

Absolutely!

are there any particular procedures to be followed? Can you pls help with the information about it?

https://github.com/libtom/libtomcrypt?tab=readme-ov-file#submitting-patches

Feel free to get back to me if you have any questions.