I am pleased to announce the initial release of "libpkixpq", 
PostgreSQL user-defined types and functions that allow the
database to understand the basic PKIX types.  

This release should be considered EXPERIMENTAL.  This is 
literally the first public release and the lack of known
bugs undoubtably speaks to my own poor testing skills, not
to the quality of the code.

The intention of this package is enable the database to extract
(and check) fields from PKIX objects, not to create new ones 
or manipulate existing ones.  The latter functions would best 
be supported via a second set of user-defined functions.

One practical use of these types is to create "friendly" views
of PKIX fields:

  create table x (x x509);

  create view v as
    select 
       x509_serial(x) as serial,
       x509_subject(x) as subject,
       x509_issuer(x) as issuer,
       x509_notBefore(x) as notBefore,
       x509_notAfter(x) as notAfter
    from x;

A second practical use is supporting integrity checks on the
data:

  create table cachedx (
     x       x509,
     subject varchar(80)
        constraint c1 check (subject = x509_subject(x))
  );

This is not yet fully supported since there is no test for equality 
of "x509_name" objects.  You can compare individual components.


These new types are defined:

  Certificates and bags:

    x509
    pkcs7
    pkcs8
    pkcs12

  Other PKIX information:

    x509_req
    x509_crl
    pubkey
    rsapubkey
    dsapubkey
    dsaparams
    dhparams

  Miscellaneous

    x509_name
    asn1_integer (probably renamed in future)

A large number of accessor functions are also defined, see the
"test" directory for a list of these files and demonstrations of
their use.

Source:

1) Source is available at http://www.dimensional.com/~bgiles/

2) Source is released under a new-style BSD license.

3) Source can be built with either standard autoconf techniques,
   or as a Debian package.

4) Ideally, the source will eventually be distributed as
   contributed code with either the PostgreSQL or OpenSSL projects.

Requirements:

1) OpenSSL 0.9.6b was used during development, but (slightly) older
   versions shouldn't be a problem.

2) PostgreSQL 7.1.3, primarily because all new types are "TOASTable"
   to allow the contents to be moved out of the main table when necessary.

Known bugs:

1) Many internal functions still guess at how much memory will be
   required to hold results, and silently truncate the output to 4k.
   This has not been a problem during testing, but it's an unnecessary
   restriction.

2) There is essentially no documentation yet.

3) Certificate times are parsed to the minute, not to the second,
   and are presented as "abstime", not "datetime."

Future enhancements:

1) Make it possible to compare x509_name and asn1_integer objects
   directly.

2) Add all arithmetic functions for asn1_integer.

Export stuff:

1) A copy of this notice has been sent to crypt@bxa.doc.gov.

--
Bear Giles
bgiles (at) coyotesong (dot) com

Sun, 23 Dec 2001 19:46:31 -0700 (MST)
Bear Giles <bear@coyotesong.com>
Announcement: libpkixpq 0.1 released
Bear Giles <bear@coyotesong.com> writes:
> I am pleased to announce the initial release of "libpkixpq", 
> PostgreSQL user-defined types and functions that allow the
> database to understand the basic PKIX types.  

For the ignorant among us ... what is PKIX?

			regards, tom lane

Sun, 23 Dec 2001 23:06:30 -0500
Tom Lane <tgl@sss.pgh.pa.us>
Re: Announcement: libpkixpq 0.1 released 
On Sun, Dec 23, 2001 at 11:06:30PM -0500, Tom Lane wrote:
> Bear Giles <bear@coyotesong.com> writes:
> > I am pleased to announce the initial release of "libpkixpq", 
> > PostgreSQL user-defined types and functions that allow the
> > database to understand the basic PKIX types.  
> 
> For the ignorant among us ... what is PKIX?

Bear posted two days previously, with a nice long message about how
all this should work. Bruce, could you drop that post into a TODO.pki
or TODO.crypto ?

http://archives.postgresql.org/pgsql-hackers/2001-12/msg00823.php

Bear, there _is_ an existing SSL patch/connection option. Have you
looked at that code?

Ross
-- 
Ross Reedstrom, Ph.D.                                 reedstrm@rice.edu
Executive Director                                  phone: 713-348-6166
Gulf Coast Consortium for Bioinformatics              fax: 713-348-6182
Rice University MS-39
Houston, TX 77005

Thu, 3 Jan 2002 11:58:57 -0600
"Ross J. Reedstrom" <reedstrm@rice.edu>
Re: Announcement: libpkixpq 0.1 released