truststore.h

Provides API for initializing and checking the CA root truststore. \par Reference: RFC 5280.

Author: Anthony Cagliano

Note

Custom PKI architecture engineered for constrained runtime and storage environments.

Warning

The topmost certificate in a chain is only checked against the truststore if its issuer is found by subject-name lookup; if absent, the chain is accepted without root anchoring (see tls_truststore_lookup_by_subject). Adjacent links below the root are verified via real RSA signature checks.

Defines

TLS_TRUSTSTORE_SUBJECT_LEN

TLS_TRUSTSTORE_SKI_LEN

TLS_TRUSTSTORE_HEADER_LEN

Enums

enum tls_cert_sig_alg_t

Values:

enumerator TLS_CERT_SIG_RSA_PSS_SHA256

enumerator TLS_CERT_SIG_RSA_PKCS1_SHA256

enumerator TLS_CERT_SIG_ECDSA_SHA256

enumerator TLS_CERT_SIG_UNKNOWN

enum tls_truststore_status_t

Values:

enumerator TLS_STORE_OK

enumerator TLS_STORE_NOT_FOUND

enumerator TLS_STORE_SIZE_INVALID

enumerator TLS_STORE_VERSION_MISMATCH

enumerator TLS_STORE_HASH_FAIL

enumerator TLS_STORE_SIG_INVALID

Functions

tls_truststore_status_t tls_truststore_init(void)

bool tls_truststore_lookup(const uint8_t *ski, struct tls_truststore_entry **result)

struct tls_truststore_state

#include <truststore.h>

Public Members

tls_truststore_status_t status

uint16_t size

uint16_t entry_count

uint16_t version

uint32_t created_timestamp

struct tls_truststore_header

#include <truststore.h>

Public Members

uint8_t sig[256]

uint16_t version

uint32_t created_timestamp

uint16_t entry_count

struct tls_truststore_entry

#include <truststore.h>

Public Members

uint32_t len

uint8_t subject[TLS_TRUSTSTORE_SUBJECT_LEN]

uint8_t ski[TLS_TRUSTSTORE_SKI_LEN]

uint32_t expiry_start

uint32_t expiry_end

uint8_t alg_id

uint8_t key[]