Confirmed users
299
edits
SecurityEngineering/Certificate Verification: Difference between revisions
Jump to navigation
Jump to search
SecurityEngineering/Certificate Verification (view source)
Revision as of 20:32, 24 July 2014
, 24 July 2014→Certificate Verification in Firefox Today
| Line 1: | Line 1: | ||
== Certificate Verification in Firefox | == Certificate Verification in Firefox Before Version 31 == | ||
Firefox | Firefox relies on NSS to implement various cryptographic functions. NSS consists of a collection of loosely-coupled libraries. libssl, for example, is the TLS implementation. NSS is a Mozilla project, but its development differs significantly from the rest of the tree. In fact, it has its own tree that is periodically imported wholesale into mozilla-central. The component that uses the NSS libraries in Firefox is a layer called PSM ("Personal Security Manager" or "Privacy and Security Module"). | ||
To enable secure TLS connections to the best of our ability, PSM implements a certificate verification callback. It performs a number of checks, but ultimately it must determine if it trusts a certificate presented by a peer. | To enable secure TLS connections to the best of our ability, PSM implements a certificate verification callback. It performs a number of checks, but ultimately it must determine if it trusts a certificate presented by a peer. In versions before 31, it does this by calling one of two certificate verification libraries in NSS: "classic" or libpkix. The classic library handles DV ("domain validation") certificates while libpkix handles EV ("extended validation") certificates. | ||
=== "classic" verification === | === "classic" verification === | ||
| Line 16: | Line 16: | ||
libpkix was auto-translated from Java to C. It attempts to implement Java's exception semantics in C. It makes liberal use of unclear macros (e.g. https://mxr.mozilla.org/mozilla-central/source/security/nss/lib/libpkix/pkix/util/pkix_tools.h#67 ). A source-line-counting tool clocks it in at 45,000 lines of code (the code is here: https://mxr.mozilla.org/mozilla-central/source/security/nss/lib/libpkix ). There are known bugs in the implementation. No one who works on it wants to continue working on it. | libpkix was auto-translated from Java to C. It attempts to implement Java's exception semantics in C. It makes liberal use of unclear macros (e.g. https://mxr.mozilla.org/mozilla-central/source/security/nss/lib/libpkix/pkix/util/pkix_tools.h#67 ). A source-line-counting tool clocks it in at 45,000 lines of code (the code is here: https://mxr.mozilla.org/mozilla-central/source/security/nss/lib/libpkix ). There are known bugs in the implementation. No one who works on it wants to continue working on it. | ||
These libraries | These libraries were not serving our needs and were impeding progress, which resulted in the decision to write the new verification library, mozilla::pkix. | ||
== Certificate Verification in Firefox Tomorrow == | == Certificate Verification in Firefox Tomorrow == | ||