Skip to content

Make sigtime validation a fallback for expired certs #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tianyuan129 merged 4 commits into from
Jul 8, 2026
+21 −18
Merged

Make sigtime validation a fallback for expired certs #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
80391d6
remove certificate sigtime exceptions
greetingsuniverse Jul 6, 2026
affc98c
make sigtime validation a fallback for expired certs only
greetingsuniverse Jul 6, 2026
2d43b45
update invalid sigtime test to have expired cert
greetingsuniverse Jul 6, 2026
eed1720
Merge branch 'main' into retired-certs
tianyuan129 Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 6 additions & 15 deletions std/security/trust_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,9 +208,11 @@ func (tc *TrustConfig) Validate(args TrustConfigValidateArgs) {
return
}

if args.UseSignatureTime.GetOr(false) && !ValidateSigTime(args.Data, args.cert) && !args.IgnoreValidity.GetOr(false) {
args.Callback(false, fmt.Errorf("data not signed during validity period: %s", args.cert.Name()))
return
if !args.IgnoreValidity.GetOr(false) && CertIsExpired(args.cert) {
if args.UseSignatureTime.GetOr(false) && !ValidateSigTime(args.Data, args.cert) {
args.Callback(false, fmt.Errorf("data not signed during validity period: %s", args.cert.Name()))
return
}
}

// Check schema if the key is allowed
Expand Down Expand Up @@ -421,7 +423,7 @@ func (tc *TrustConfig) validateCrossSchema(args TrustConfigValidateArgs) {
if !args.IgnoreValidity.GetOr(false) {
if args.UseSignatureTime.GetOr(false) {
// Cross schema was valid at signature time
if !ValidateSigTime(args.Data, crossData) {
if CertIsExpired(crossData) && !ValidateSigTime(args.Data, crossData) {
args.Callback(false, fmt.Errorf("cross schema signature time invalid: %s", crossData.Name()))
return
}
Expand Down Expand Up @@ -705,17 +707,6 @@ func ValidateSigTime(data ndn.Data, cert ndn.Data) bool {
return false
}

exceptionNameStrings := []string{
"/ndn/edu/ucla/KEY/%2F%0D%23x%03%E5%FFC/NA/v=1770689778343",
"/ndn/KEY/%27%C4%B2%2A%9F%7B%81%27/ndn/v=1651246789556",
}
for _, nameString := range exceptionNameStrings {
name, _ := enc.NameFromStr(nameString)
if cert.Name().Equal(name) {
return true
}
}

sigTime := data.Signature().SigTime()

if sigTime == nil {
Expand Down
18 changes: 15 additions & 3 deletions std/security/trust_config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1166,6 +1166,17 @@ func TestSignatureTimeValidationFlows(t *testing.T) {
}))
aliceCertData, _, _ := spec.Spec{}.ReadData(enc.NewWireView(aliceCertWire))

expiredSigner := tu.NoErr(signer.KeygenEd25519(sec.MakeKeyName(n("/app/user/alice_expired"))))
expiredKeyData := tu.NoErr(signer.MarshalSecretToData(expiredSigner))
expiredCertWire := tu.NoErr(sec.SignCert(sec.SignCertArgs{
Signer: anchorSigner,
Data: expiredKeyData,
IssuerId: enc.NewGenericComponent("app"),
NotBefore: now.Add(-2 * time.Hour),
NotAfter: now.Add(-1 * time.Hour),
}))
expiredCertData, _, _ := spec.Spec{}.ReadData(enc.NewWireView(expiredCertWire))

// User data
payload := enc.Wire{[]byte{0x01}}
dataWire := tu.NoErr(spec.Spec{}.MakeData(n("/app/user/alice/data"), &ndn.DataConfig{
Expand All @@ -1175,10 +1186,10 @@ func TestSignatureTimeValidationFlows(t *testing.T) {

// User data with invalid signature time
sigTimeBeforeUserCert := optional.Some(time.Duration(now.Add(-time.Hour).UnixMilli()) * time.Millisecond)
dataWireInvalidSigTime := tu.NoErr(spec.Spec{}.MakeData(n("/app/user/alice/data"), &ndn.DataConfig{
dataWireInvalidSigTime := tu.NoErr(spec.Spec{}.MakeData(n("/app/user/alice_expired/data"), &ndn.DataConfig{
Freshness: optional.Some(time.Minute),
SigTime: sigTimeBeforeUserCert,
}, payload, aliceSigner))
}, payload, expiredSigner))
dataPktInvalidSigTime, dataSigCovInvalidSigTime, _ := spec.Spec{}.ReadData(enc.NewWireView(dataWireInvalidSigTime.Wire))

bobSigner := tu.NoErr(signer.KeygenEd25519(sec.MakeKeyName(n("/app/user/bob"))))
Expand Down Expand Up @@ -1219,10 +1230,11 @@ func TestSignatureTimeValidationFlows(t *testing.T) {
require.True(t, schema.Check(listData.Name(), anchorCertData.Name()))
require.True(t, schema.Check(aliceCertData.Name(), anchorCertData.Name()))
require.True(t, schema.Check(dataPkt.Name(), aliceCertData.Name()))
require.True(t, schema.Check(dataPktInvalidSigTime.Name(), aliceCertData.Name()))
require.True(t, schema.Check(dataPktInvalidSigTime.Name(), expiredCertData.Name()))

network[anchorCertData.Name().String()] = anchorCertWire
network[aliceCertData.Name().String()] = aliceCertWire
network[expiredCertData.Name().String()] = expiredCertWire
network[ownerCertData.Name().String()] = ownerCertWire

type stage struct {
Expand Down
Loading