Crate verdict

Expand description

Welcome to the documentation for verdict, a formally verified X.509 certificate validation library (developed using Verus). You can also find a CLI tool and more details about Verdict at our GitHub repo.

This is still a very experimental tool, so the API here is likely rough around the edges and subject to change.

An example usage of verdict:

use verdict::{ChromePolicy, RootStore, Task, Validator};

const ROOTS: &[u8] = include_bytes!("../tests/roots.pem");
const CHAIN: &[u8] = include_bytes!("../tests/chains/google.pem");
const HOSTNAME: &str = "<hostname>";
const TIMESTAMP: u64 = 1725029869;

let roots = RootStore::from_pem(ROOTS).unwrap();
let validator = Validator::from_roots(ChromePolicy::default(), &roots).unwrap();
let task = Task::new_server_auth(Some(HOSTNAME), TIMESTAMP);

let valid = validator.validate_pem(CHAIN, &task).unwrap();

Here, both the root certificates and certificate chain are loaded in PEM format. The result in valid indicates whether Chromium’s X.509 validation policy that we modeled in Verdict (ChromePolicy) considers the certificate chain valid (agsinst the provided root store, hostname, and timestamp).

We have also modeled the X.509 validation policies in Firefox (FirefoxPolicy) and OpenSSL (OpenSSLPolicy).

Structs§

ChromePolicy: A model of Chromium’s X.509 validation policy around Aug, 2020.
ExecAttribute: Corresponds to AttributeTypeAndValue in X.509
ExecAuthorityInfoAccess
ExecAuthorityKeyIdentifier
ExecBasicConstraints
ExecCertificatePolicies
ExecDistinguishedName
ExecExtendedKeyUsage
ExecExtension
ExecKeyUsage
ExecNameConstraints
ExecSignatureAlgorithm
ExecSubjectAltName
ExecSubjectKeyIdentifier
FirefoxPolicy: A model of Firefox’s X.509 validation policy around Aug, 2020.
OpenSSLPolicy: A model of OpenSSL’s X.509 validation policy around Nov, 2024.
RootStore: A collection of trusted root certificates.
Task: A task includes auxiliary information needed for policy execution, such as hostname, purpose (e.g., server/client authentication), and current time.
Validator: A formally verified X.509 certificate validation engine.

Enums§

ExecExtendedKeyUsageType
ExecGeneralName
ExecSubjectKey
ParseError: Parser errors
ValidationError: Errors in validation, parsing, and policy execution.

Traits§

Policy: Common trait for all policies (e.g. ChromePolicy).

Functions§

decode_base64: Decodes a Base64-encoded sequence of bytes.
parse_x509_der: Parses the given bytes in ASN.1 DER format to a x509::CertificateValue.

Type Aliases§