Andreas Steffen
2d41e1c51c
pki: Edited keyid parameter use in various pki man pages and usage outputs
2017-03-06 18:54:09 +01:00
Tobias Brunner
790847d17c
pki: Don't remove zero bytes in CRL serials anymore
...
This was added a few years ago because pki --signcrl once encoded serials
incorrectly as eight byte blobs. But still ensure we have can handle
overflows in case the serial is encoded incorrectly without zero-prefix.
2016-10-11 17:18:22 +02:00
Tobias Brunner
49d9266c31
pki: Use serial of base CRL for delta CRLs
...
According to RFC 5280 delta CRLs and complete CRLs MUST share one
numbering sequence.
2016-10-11 17:18:22 +02:00
Andreas Steffen
f6fede934b
Support BLISS signatures with SHA-3 hash
2015-11-03 21:35:09 +01:00
Tobias Brunner
2872f77829
pki: Choose default digest based on the signature key
2015-03-23 17:22:31 +01:00
Tobias Brunner
ae0604f583
pki: Use SHA-256 as default for signatures
...
Since the BLISS private key supports this we don't do any special
handling anymore (if the user choses a digest that is not supported,
signing will simply fail later because no signature scheme will be found).
2015-03-23 17:22:31 +01:00
Andreas Steffen
27bd0fed93
Allow SHA256 and SHA384 data hash for BLISS signatures.
...
The default is SHA512 since this hash function is also
used for the c_indices random oracle.
2015-02-26 08:56:12 +01:00
Andreas Steffen
b6bb32e658
Implemented full BLISS support for IKEv2 public key authentication and the pki tool
2014-11-29 14:51:18 +01:00
Martin Willi
13298719e3
pki: Switch to binary mode on Windows when reading/writing DER to FDs
2014-06-04 15:53:11 +02:00
Martin Willi
064fe9c963
enum: Return boolean result for enum_from_name() lookup
...
Handling the result for enum_from_name() is difficult, as checking for
negative return values requires a cast if the enum type is unsigned. The new
signature clearly differentiates lookup result from lookup value.
Further, this actually allows to convert real -1 enum values, which could not
be distinguished from "not-found" and the -1 return value.
This also fixes several clang warnings where enums are unsigned.
2014-05-16 15:42:07 +02:00
Martin Willi
2769a22e1f
pki: Support absolute --this/next-update CRL lifetimes
2014-03-31 11:14:59 +02:00
Tobias Brunner
96aa5a1ddd
pki: Add pki --signcrl man page
2013-09-13 15:07:35 +02:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
c63fb853e8
Use centralized hasher names in pki utility
2012-07-17 17:32:05 +02:00
Andreas Steffen
5ff99529e6
ASN.1 two's complement encoding prevents overflow in CRL serial number
2012-04-04 11:29:12 +02:00
Tobias Brunner
20d752b4ff
pki: Avoid integer overflow when calculating certificate lifetimes.
...
This only works properly if sizeof(time_t) > 4.
2011-12-23 16:33:24 +01:00
Tobias Brunner
3fe6c0b27e
Do proper cleanup in some error cases in pki signcrl.
2011-04-14 18:11:44 +02:00
Martin Willi
0110c26a04
Use incremented serial of base CRL when signing delta CRL
2011-01-05 16:46:06 +01:00
Martin Willi
de8521f6f2
Added support for delta CRLs to pki tool
2011-01-05 16:46:04 +01:00
Martin Willi
dffb176f2b
CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation
2011-01-05 16:45:56 +01:00
Martin Willi
efab731338
Added PKCS#11 private key support to the pki tool
2010-08-04 09:26:21 +02:00
Martin Willi
b5b95c75de
Added pki PEM encoding support for certificates, CRLs and PKCS10 requests
2010-07-13 14:14:39 +02:00
Martin Willi
0406eeaacb
Support different encoding types in certificate.get_encoding()
2010-07-13 13:53:20 +02:00
Martin Willi
0c73ceff0a
Added a --signcrl command to the pki utility
2010-05-21 16:25:51 +02:00
Andreas Steffen