crypto/external/bsd/heimdal/dist/lib/hx509/TODO

   1 Handle private_key_ops better, esp wrt ->key_oid
   2
   3 Better support for keyex negotiation, DH and ECDH.
   4
   5 x501 name
   6         parsing
   7         comparing (ldap canonlisation rules)
   8
   9 DSA support
  10 DSA2 support
  11
  12 Rewrite the pkcs11 code to support the following:
  13
  14         * Reset the pin on card change.
  15         * Ref count the lock structure to make sure we have a
  16           prompter when we need it.
  17         * Add support for CK_TOKEN_INFO.CKF_PROTECTED_AUTHENTICATION_PATH
  18
  19 x509 policy mappings support
  20
  21 CRL delta support
  22
  23 Qualified statement
  24         https://bugzilla.mozilla.org/show_bug.cgi?id=277797#c2
  25
  26
  27 Signed Receipts
  28         http://www.faqs.org/rfcs/rfc2634.html
  29         chapter 2
  30
  31 tests
  32         nist tests
  33                 name constrains
  34                 policy mappings
  35                 http://csrc.nist.gov/pki/testing/x509paths.html
  36
  37         building path using Subject/Issuer vs SubjKeyID vs AuthKeyID
  38         negative tests
  39                 all checksums
  40                 conditions/branches
  41
  42 pkcs7
  43         handle pkcs7 support in CMS ?
  44
  45 certificate request
  46         generate pkcs10 request
  47                 from existing cert
  48         generate CRMF request
  49                 pk-init KDC/client
  50                 web server/client
  51                 jabber server/client
  52                 email
  53
  54
  55 x509 issues:
  56
  57  OtherName is left unspecified, but it's used by other
  58  specs. creating this hole where a application/CA can't specify
  59  policy for SubjectAltName what covers whole space. For example, a
  60  CA is trusted to provide authentication but not authorization.
  61