Building a Rusty path validation library for PyCA Cryptography
summary
A new X.509 path validator is integrated into PyCA Cryptography as a pure Rust implementation claiming to replace OpenSSL path validation with a memory‑safe, standards‑focused alternative; it ships as about 25 200 lines of code new Total, reaches 100% test coverage via x509 limbo, finds bugs in other validators (including one CVE), and shows concrete speed gains (replacing a small SPKI parser yields ~60% faster path building).
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:08About Trail of Bits
- 2:56Rust-based X.509 path validation
- 3:58X.509 security beyond HTTPS
- 4:41X.509 identity binding
- 6:27X.509 chaining primitive
- 7:51X.509 principal introduction
- 8:53X.509 security challenges
- 11:02Better X.509 for Python
- 13:09Design principles
- 16:40Design constraints
- 19:05Minimality in modern profiles
- 21:15Chain building correctness
- 24:44Optimizing path validation
- 27:11Testing and validation
- 28:58X.509 Limbo test suite
- 31:04API design risks
- 35:14Lessons from standards
- 41:34X.509 state and future
related talks
26mShipping Python Extensions in Rust Two Million Times a Day
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
01h 00mKeynote: Bringing Verified Cryptographic Protocols to Practice
35mUsing Rust to write Python modules
39mKeynote: Towards High-Assurance Cryptographic Software
01h 04mSoftware Verification meets Real-World Cryptography
29mClosing the Supply Chain Security Loop with Rust & Pyrsia
32mRust for CPython: Making Python Safer and More Robust for Everyone