The GnuTLS Transport Layer Security Library

This year we participate in Google Summer of code under the GNU project umbrella. To discuss ideas you may use the gnutls mailing lists. To propose a project follow the information in the Google summer of code 2012 site.

GnuTLS project ideas for summer of code

• Strict certificate path validation.

  Currently GnuTLS implements a simple and straightforward certificate path validation algorithm. However a complete validation algorithm, such as the one described in RFC5280, requires the consideration of several factors that are currently ignored (certificate policies, path constraints etc). The target of this project is to implement the complete certificate path validation algorithm from RFC5280.

  Difficulty: medium
  Requirements: C, git
  Recommended: familiarity with gnutls' internals
  Mentors: Nikos Mavrogiannopoulos, Daniel Kahn Gillmor
  

• RSASSA-PSS signature scheme.

  Currently GnuTLS implements the PKCS #1 1.5 signature algorithm for certificate and CRL signatures. This target of this project is to enhance GnuTLS to support the PKCS #1, RSASSA-PSS signature scheme.

  Difficulty: medium
  Requirements: C, git
  Recommended: familiarity with gnutls' internals
  Mentors: Nikos Mavrogiannopoulos, Daniel Kahn Gillmor
  

• TLS and DTLS extensions.

  Two extensions are to be implemented:

  1. DTLS Heartbeat
  2. Certificate status request
  The former is an extension to the datagram TLS protocol described in RFC6520 to support heartbeat messages in order to identify the status of the peer (dead or not). The latter provides a way for an HTTPS server to provide a fresh OCSP response to the client, described in RFC6066. This saves the client from the burden of having to connect to the CAs OCSP server in order to get a fresh certificate status.

  Difficulty: medium
  Requirements: C, git
  Mentors: Nikos Mavrogiannopoulos, Daniel Kahn Gillmor
  

• Faster elliptic curve scalar multiplication.

  Improve the scalar multiplication in elliptic curves by implementing the wNAF based method as well as the Yao-DBNS method.

  Difficulty: medium
  Requirements: C, git
  Recommended: mathematics background
  Mentors: Nikos Mavrogiannopoulos, Daniel Kahn Gillmor
  

• Implementation of additional encryption schemas for PKCS #12 and PKCS #8

  Improve the support for encrypted private keys and certificates, by implementing the algorithms and formats used by other popular implementations (openssl, windows).

  Difficulty: medium
  Requirements: C, git
  Recommended: familiarity with gnutls' internals
  Mentors: Nikos Mavrogiannopoulos, Daniel Kahn Gillmor