truststore.h

Provides API for initializing and checking trust store for pins. \par Reference: RFC 5280.

Security therefore depends on the assumption that an attacker cannot construct an alternate certificate chain terminating in a trusted pinned root without possession of the corresponding signing authority.

Author: Anthony Cagliano

Note

Custom PKI architecture engineered for constrained runtime and storage environments.

Warning

This implementation currently validates that a certificate chain terminates in a pinned root certificate, but does not (yet) perform full cryptographic verification of all intermediate certificate signatures.

Defines

TLS_SPKI_OWNER_ID_LEN

TLS_SPKI_ISSUER_LEN

TLS_SPKI_HASH_MAX_LEN

TLS_SPKI_HEADER_LEN

Enums

enum tls_truststore_status_t

Values:

enumerator TLS_STORE_OK

enumerator TLS_STORE_NOT_FOUND

enumerator TLS_STORE_SIZE_INVALID

enumerator TLS_STORE_VERSION_MISMATCH

enumerator TLS_STORE_HASH_FAIL

enumerator TLS_STORE_SIG_INVALID

Functions

tls_truststore_status_t tls_truststore_init(void)

bool tls_truststore_lookup(uint8_t *recvd_hash, struct tls_spki_entry *result)

struct tls_truststore_state

#include <truststore.h>

Public Members

tls_truststore_status_t status

uint16_t size

uint16_t entry_count

uint16_t version

uint32_t created_timestamp

struct tls_truststore_header

#include <truststore.h>

Public Members

uint8_t sig[256]

uint16_t version

uint32_t created_timestamp

uint16_t entry_count

struct tls_spki_entry

#include <truststore.h>

Public Members

uint8_t owner_id[TLS_SPKI_OWNER_ID_LEN]

uint8_t issuer_id[TLS_SPKI_ISSUER_LEN]

uint32_t not_before

uint32_t not_after

uint8_t hash[TLS_SPKI_HASH_MAX_LEN]