visaljs 0.0.2 → 0.0.4

package/runtime/third_party/bearssl/src/x509/x509_minimal.t0

@@ -1,1526 +0,0 @@
-\ Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
-\
-\ Permission is hereby granted, free of charge, to any person obtaining 
-\ a copy of this software and associated documentation files (the
-\ "Software"), to deal in the Software without restriction, including
-\ without limitation the rights to use, copy, modify, merge, publish,
-\ distribute, sublicense, and/or sell copies of the Software, and to
-\ permit persons to whom the Software is furnished to do so, subject to
-\ the following conditions:
-\
-\ The above copyright notice and this permission notice shall be 
-\ included in all copies or substantial portions of the Software.
-\
-\ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 
-\ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-\ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 
-\ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
-\ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
-\ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-\ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-\ SOFTWARE.
-
-preamble {
-
-#include "inner.h"
-
-/*
- * Implementation Notes
- * --------------------
- *
- * The C code pushes the data by chunks; all decoding is done in the
- * T0 code. The cert_length value is set to the certificate length when
- * a new certificate is started; the T0 code picks it up as outer limit,
- * and decoding functions use it to ensure that no attempt is made at
- * reading past it. The T0 code also checks that once the certificate is
- * decoded, there are no trailing bytes.
- *
- * The T0 code sets cert_length to 0 when the certificate is fully
- * decoded.
- *
- * The C code must still perform two checks:
- *
- *  -- If the certificate length is 0, then the T0 code will not be
- *  invoked at all. This invalid condition must thus be reported by the
- *  C code.
- *
- *  -- When reaching the end of certificate, the C code must verify that
- *  the certificate length has been set to 0, thereby signaling that
- *  the T0 code properly decoded a certificate.
- *
- * Processing of a chain works in the following way:
- *
- *  -- The error flag is set to a non-zero value when validation is
- *  finished. The value is either BR_ERR_X509_OK (validation is
- *  successful) or another non-zero error code. When a non-zero error
- *  code is obtained, the remaining bytes in the current certificate and
- *  the subsequent certificates (if any) are completely ignored.
- *
- *  -- Each certificate is decoded in due course, with the following
- *  "interesting points":
- *
- *     -- Start of the TBS: the multihash engine is reset and activated.
- *
- *     -- Start of the issuer DN: the secondary hash engine is started,
- *     to process the encoded issuer DN.
- *
- *     -- End of the issuer DN: the secondary hash engine is stopped. The
- *     resulting hash value is computed and then copied into the
- *     next_dn_hash[] buffer.
- *
- *     -- Start of the subject DN: the secondary hash engine is started,
- *     to process the encoded subject DN.
- *
- *     -- For the EE certificate only: the Common Name, if any, is matched
- *     against the expected server name.
- *
- *     -- End of the subject DN: the secondary hash engine is stopped. The
- *     resulting hash value is computed into the pad. It is then processed:
- *
- *        -- If this is the EE certificate, then the hash is ignored
- *        (except for direct trust processing, see later; the hash is
- *        simply left in current_dn_hash[]).
- *
- *        -- Otherwise, the hashed subject DN is compared with the saved
- *        hash value (in saved_dn_hash[]). They must match.
- *
- *     Either way, the next_dn_hash[] value is then copied into the
- *     saved_dn_hash[] value. Thus, at that point, saved_dn_hash[]
- *     contains the hash of the issuer DN for the current certificate,
- *     and current_dn_hash[] contains the hash of the subject DN for the
- *     current certificate.
- *
- *     -- Public key: it is decoded into the cert_pkey[] buffer. Unknown
- *     key types are reported at that point.
- *
- *        -- If this is the EE certificate, then the key type is compared
- *        with the expected key type (initialization parameter). The public
- *        key data is copied to ee_pkey_data[]. The key and hashed subject
- *        DN are also compared with the "direct trust" keys; if the key
- *        and DN are matched, then validation ends with a success.
- *
- *        -- Otherwise, the saved signature (cert_sig[]) is verified
- *        against the saved TBS hash (tbs_hash[]) and that freshly
- *        decoded public key. Failure here ends validation with an error.
- *
- *     -- Extensions: extension values are processed in due order.
- *
- *        -- Basic Constraints: for all certificates except EE, must be
- *        present, indicate a CA, and have a path length compatible with
- *        the chain length so far.
- *
- *        -- Key Usage: for the EE, if present, must allow signatures
- *        or encryption/key exchange, as required for the cipher suite.
- *        For non-EE, if present, must have the "certificate sign" bit.
- *
- *        -- Subject Alt Name: for the EE, dNSName names are matched
- *        against the server name. Ignored for non-EE.
- *
- *        -- Authority Key Identifier, Subject Key Identifier, Issuer
- *        Alt Name, Subject Directory Attributes, CRL Distribution Points
- *        Freshest CRL, Authority Info Access and Subject Info Access
- *        extensions are always ignored: they either contain only
- *        informative data, or they relate to revocation processing, which
- *        we explicitly do not support.
- *
- *        -- All other extensions are ignored if non-critical. If a
- *        critical extension other than the ones above is encountered,
- *        then a failure is reported.
- *
- *     -- End of the TBS: the multihash engine is stopped.
- *
- *     -- Signature algorithm: the signature algorithm on the
- *     certificate is decoded. A failure is reported if that algorithm
- *     is unknown. The hashed TBS corresponding to the signature hash
- *     function is computed and stored in tbs_hash[] (if not supported,
- *     then a failure is reported). The hash OID and length are stored
- *     in cert_sig_hash_oid and cert_sig_hash_len.
- *
- *     -- Signature value: the signature value is copied into the
- *     cert_sig[] array.
- *
- *     -- Certificate end: the hashed issuer DN (saved_dn_hash[]) is
- *     looked up in the trust store (CA trust anchors only); for all
- *     that match, the signature (cert_sig[]) is verified against the
- *     anchor public key (hashed TBS is in tbs_hash[]). If one of these
- *     signatures is valid, then validation ends with a success.
- *
- *  -- If the chain end is reached without obtaining a validation success,
- *  then validation is reported as failed.
- */
-
-#if BR_USE_UNIX_TIME
-#include <time.h>
-#endif
-
-#if BR_USE_WIN32_TIME
-#include <windows.h>
-#endif
-
-/*
- * The T0 compiler will produce these prototypes declarations in the
- * header.
- *
-void br_x509_minimal_init_main(void *ctx);
-void br_x509_minimal_run(void *ctx);
- */
-
-/* see bearssl_x509.h */
-void
-br_x509_minimal_init(br_x509_minimal_context *ctx,
-	const br_hash_class *dn_hash_impl,
-	const br_x509_trust_anchor *trust_anchors, size_t trust_anchors_num)
-{
-	memset(ctx, 0, sizeof *ctx);
-	ctx->vtable = &br_x509_minimal_vtable;
-	ctx->dn_hash_impl = dn_hash_impl;
-	ctx->trust_anchors = trust_anchors;
-	ctx->trust_anchors_num = trust_anchors_num;
-}
-
-static void
-xm_start_chain(const br_x509_class **ctx, const char *server_name)
-{
-	br_x509_minimal_context *cc;
-	size_t u;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	for (u = 0; u < cc->num_name_elts; u ++) {
-		cc->name_elts[u].status = 0;
-		cc->name_elts[u].buf[0] = 0;
-	}
-	memset(&cc->pkey, 0, sizeof cc->pkey);
-	cc->num_certs = 0;
-	cc->err = 0;
-	cc->cpu.dp = cc->dp_stack;
-	cc->cpu.rp = cc->rp_stack;
-	br_x509_minimal_init_main(&cc->cpu);
-	if (server_name == NULL || *server_name == 0) {
-		cc->server_name = NULL;
-	} else {
-		cc->server_name = server_name;
-	}
-}
-
-static void
-xm_start_cert(const br_x509_class **ctx, uint32_t length)
-{
-	br_x509_minimal_context *cc;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	if (cc->err != 0) {
-		return;
-	}
-	if (length == 0) {
-		cc->err = BR_ERR_X509_TRUNCATED;
-		return;
-	}
-	cc->cert_length = length;
-}
-
-static void
-xm_append(const br_x509_class **ctx, const unsigned char *buf, size_t len)
-{
-	br_x509_minimal_context *cc;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	if (cc->err != 0) {
-		return;
-	}
-	cc->hbuf = buf;
-	cc->hlen = len;
-	br_x509_minimal_run(&cc->cpu);
-}
-
-static void
-xm_end_cert(const br_x509_class **ctx)
-{
-	br_x509_minimal_context *cc;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	if (cc->err == 0 && cc->cert_length != 0) {
-		cc->err = BR_ERR_X509_TRUNCATED;
-	}
-	cc->num_certs ++;
-}
-
-static unsigned
-xm_end_chain(const br_x509_class **ctx)
-{
-	br_x509_minimal_context *cc;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	if (cc->err == 0) {
-		if (cc->num_certs == 0) {
-			cc->err = BR_ERR_X509_EMPTY_CHAIN;
-		} else {
-			cc->err = BR_ERR_X509_NOT_TRUSTED;
-		}
-	} else if (cc->err == BR_ERR_X509_OK) {
-		return 0;
-	}
-	return (unsigned)cc->err;
-}
-
-static const br_x509_pkey *
-xm_get_pkey(const br_x509_class *const *ctx, unsigned *usages)
-{
-	br_x509_minimal_context *cc;
-
-	cc = (br_x509_minimal_context *)(void *)ctx;
-	if (cc->err == BR_ERR_X509_OK
-		|| cc->err == BR_ERR_X509_NOT_TRUSTED)
-	{
-		if (usages != NULL) {
-			*usages = cc->key_usages;
-		}
-		return &((br_x509_minimal_context *)(void *)ctx)->pkey;
-	} else {
-		return NULL;
-	}
-}
-
-/* see bearssl_x509.h */
-const br_x509_class br_x509_minimal_vtable = {
-	sizeof(br_x509_minimal_context),
-	xm_start_chain,
-	xm_start_cert,
-	xm_append,
-	xm_end_cert,
-	xm_end_chain,
-	xm_get_pkey
-};
-
-#define CTX   ((br_x509_minimal_context *)(void *)((unsigned char *)t0ctx - offsetof(br_x509_minimal_context, cpu)))
-#define CONTEXT_NAME   br_x509_minimal_context
-
-#define DNHASH_LEN   ((CTX->dn_hash_impl->desc >> BR_HASHDESC_OUT_OFF) & BR_HASHDESC_OUT_MASK)
-
-/*
- * Hash a DN (from a trust anchor) into the provided buffer. This uses the
- * DN hash implementation and context structure from the X.509 engine
- * context.
- */
-static void
-hash_dn(br_x509_minimal_context *ctx, const void *dn, size_t len,
-	unsigned char *out)
-{
-	ctx->dn_hash_impl->init(&ctx->dn_hash.vtable);
-	ctx->dn_hash_impl->update(&ctx->dn_hash.vtable, dn, len);
-	ctx->dn_hash_impl->out(&ctx->dn_hash.vtable, out);
-}
-
-/*
- * Compare two big integers for equality. The integers use unsigned big-endian
- * encoding; extra leading bytes (of value 0) are allowed.
- */
-static int
-eqbigint(const unsigned char *b1, size_t len1,
-	const unsigned char *b2, size_t len2)
-{
-	while (len1 > 0 && *b1 == 0) {
-		b1 ++;
-		len1 --;
-	}
-	while (len2 > 0 && *b2 == 0) {
-		b2 ++;
-		len2 --;
-	}
-	if (len1 != len2) {
-		return 0;
-	}
-	return memcmp(b1, b2, len1) == 0;
-}
-
-/*
- * Compare two strings for equality, in a case-insensitive way. This
- * function handles casing only for ASCII letters.
- */
-static int
-eqnocase(const void *s1, const void *s2, size_t len)
-{
-	const unsigned char *buf1, *buf2;
-
-	buf1 = s1;
-	buf2 = s2;
-	while (len -- > 0) {
-		int x1, x2;
-
-		x1 = *buf1 ++;
-		x2 = *buf2 ++;
-		if (x1 >= 'A' && x1 <= 'Z') {
-			x1 += 'a' - 'A';
-		}
-		if (x2 >= 'A' && x2 <= 'Z') {
-			x2 += 'a' - 'A';
-		}
-		if (x1 != x2) {
-			return 0;
-		}
-	}
-	return 1;
-}
-
-static int verify_signature(br_x509_minimal_context *ctx,
-	const br_x509_pkey *pk);
-
-}
-
-postamble {
-
-/*
- * Verify the signature on the certificate with the provided public key.
- * This function checks the public key type with regards to the expected
- * type. Returned value is either 0 on success, or a non-zero error code.
- */
-static int
-verify_signature(br_x509_minimal_context *ctx, const br_x509_pkey *pk)
-{
-	int kt;
-
-	kt = ctx->cert_signer_key_type;
-	if ((pk->key_type & 0x0F) != kt) {
-		return BR_ERR_X509_WRONG_KEY_TYPE;
-	}
-	switch (kt) {
-		unsigned char tmp[64];
-
-	case BR_KEYTYPE_RSA:
-		if (ctx->irsa == 0) {
-			return BR_ERR_X509_UNSUPPORTED;
-		}
-		if (!ctx->irsa(ctx->cert_sig, ctx->cert_sig_len,
-			&t0_datablock[ctx->cert_sig_hash_oid],
-			ctx->cert_sig_hash_len, &pk->key.rsa, tmp))
-		{
-			return BR_ERR_X509_BAD_SIGNATURE;
-		}
-		if (memcmp(ctx->tbs_hash, tmp, ctx->cert_sig_hash_len) != 0) {
-			return BR_ERR_X509_BAD_SIGNATURE;
-		}
-		return 0;
-
-	case BR_KEYTYPE_EC:
-		if (ctx->iecdsa == 0) {
-			return BR_ERR_X509_UNSUPPORTED;
-		}
-		if (!ctx->iecdsa(ctx->iec, ctx->tbs_hash,
-			ctx->cert_sig_hash_len, &pk->key.ec,
-			ctx->cert_sig, ctx->cert_sig_len))
-		{
-			return BR_ERR_X509_BAD_SIGNATURE;
-		}
-		return 0;
-
-	default:
-		return BR_ERR_X509_UNSUPPORTED;
-	}
-}
-
-}
-
-cc: read8-low ( -- x ) {
-	if (CTX->hlen == 0) {
-		T0_PUSHi(-1);
-	} else {
-		unsigned char x = *CTX->hbuf ++;
-		if (CTX->do_mhash) {
-			br_multihash_update(&CTX->mhash, &x, 1);
-		}
-		if (CTX->do_dn_hash) {
-			CTX->dn_hash_impl->update(&CTX->dn_hash.vtable, &x, 1);
-		}
-		CTX->hlen --;
-		T0_PUSH(x);
-	}
-}
-
-addr: cert_length
-addr: num_certs
-
-cc: read-blob-inner ( addr len -- addr len ) {
-	uint32_t len = T0_POP();
-	uint32_t addr = T0_POP();
-	size_t clen = CTX->hlen;
-	if (clen > len) {
-		clen = (size_t)len;
-	}
-	if (addr != 0) {
-		memcpy((unsigned char *)CTX + addr, CTX->hbuf, clen);
-	}
-	if (CTX->do_mhash) {
-		br_multihash_update(&CTX->mhash, CTX->hbuf, clen);
-	}
-	if (CTX->do_dn_hash) {
-		CTX->dn_hash_impl->update(
-			&CTX->dn_hash.vtable, CTX->hbuf, clen);
-	}
-	CTX->hbuf += clen;
-	CTX->hlen -= clen;
-	T0_PUSH(addr + clen);
-	T0_PUSH(len - clen);
-}
-
-\ Compute the TBS hash, using the provided hash ID. The hash value is
-\ written in the tbs_hash[] array, and the hash length is returned. If
-\ the requested hash function is not supported, then 0 is returned.
-cc: compute-tbs-hash ( id -- hashlen ) {
-	int id = T0_POPi();
-	size_t len;
-	len = br_multihash_out(&CTX->mhash, id, CTX->tbs_hash);
-	T0_PUSH(len);
-}
-
-\ Push true (-1) if no server name is expected in the EE certificate.
-cc: zero-server-name ( -- bool ) {
-	T0_PUSHi(-(CTX->server_name == NULL));
-}
-
-addr: key_usages
-addr: cert_sig
-addr: cert_sig_len
-addr: cert_signer_key_type
-addr: cert_sig_hash_oid
-addr: cert_sig_hash_len
-addr: tbs_hash
-addr: min_rsa_size
-
-\ Start TBS hash computation. The hash functions are reinitialised.
-cc: start-tbs-hash ( -- ) {
-	br_multihash_init(&CTX->mhash);
-	CTX->do_mhash = 1;
-}
-
-\ Stop TBS hash computation.
-cc: stop-tbs-hash ( -- ) {
-	CTX->do_mhash = 0;
-}
-
-\ Start DN hash computation.
-cc: start-dn-hash ( -- ) {
-	CTX->dn_hash_impl->init(&CTX->dn_hash.vtable);
-	CTX->do_dn_hash = 1;
-}
-
-\ Terminate DN hash computation and write the DN hash into the
-\ current_dn_hash buffer.
-cc: compute-dn-hash ( -- ) {
-	CTX->dn_hash_impl->out(&CTX->dn_hash.vtable, CTX->current_dn_hash);
-	CTX->do_dn_hash = 0;
-}
-
-\ Get the length of hash values obtained with the DN hasher.
-cc: dn-hash-length ( -- len ) {
-	T0_PUSH(DNHASH_LEN);
-}
-
-\ Copy data between two areas in the context.
-cc: blobcopy ( addr-dst addr-src len -- ) {
-	size_t len = T0_POP();
-	unsigned char *src = (unsigned char *)CTX + T0_POP();
-	unsigned char *dst = (unsigned char *)CTX + T0_POP();
-	memcpy(dst, src, len);
-}
-
-addr: current_dn_hash
-addr: next_dn_hash
-addr: saved_dn_hash
-
-\ Read a DN, hashing it into current_dn_hash. The DN contents are not
-\ inspected (only the outer tag, for SEQUENCE, is checked).
-: read-DN ( lim -- lim )
-	start-dn-hash
-	read-sequence-open skip-close-elt
-	compute-dn-hash ;
-
-cc: offset-name-element ( san -- n ) {
-	unsigned san = T0_POP();
-	size_t u;
-
-	for (u = 0; u < CTX->num_name_elts; u ++) {
-		if (CTX->name_elts[u].status == 0) {
-			const unsigned char *oid;
-			size_t len, off;
-
-			oid = CTX->name_elts[u].oid;
-			if (san) {
-				if (oid[0] != 0 || oid[1] != 0) {
-					continue;
-				}
-				off = 2;
-			} else {
-				off = 0;
-			}
-			len = oid[off];
-			if (len != 0 && len == CTX->pad[0]
-				&& memcmp(oid + off + 1,
-					CTX->pad + 1, len) == 0)
-			{
-				T0_PUSH(u);
-				T0_RET();
-			}
-		}
-	}
-	T0_PUSHi(-1);
-}
-
-cc: copy-name-element ( bool offbuf -- ) {
-	size_t len;
-	int32_t off = T0_POPi();
-	int ok = T0_POPi();
-
-	if (off >= 0) {
-		br_name_element *ne = &CTX->name_elts[off];
-
-		if (ok) {
-			len = CTX->pad[0];
-			if (len < ne->len) {
-				memcpy(ne->buf, CTX->pad + 1, len);
-				ne->buf[len] = 0;
-				ne->status = 1;
-			} else {
-				ne->status = -1;
-			}
-		} else {
-			ne->status = -1;
-		}
-	}
-}
-
-cc: copy-name-SAN ( bool tag -- ) {
-	unsigned tag = T0_POP();
-	unsigned ok = T0_POP();
-	size_t u, len;
-
-	len = CTX->pad[0];
-	for (u = 0; u < CTX->num_name_elts; u ++) {
-		br_name_element *ne;
-
-		ne = &CTX->name_elts[u];
-		if (ne->status == 0 && ne->oid[0] == 0 && ne->oid[1] == tag) {
-			if (ok && ne->len > len) {
-				memcpy(ne->buf, CTX->pad + 1, len);
-				ne->buf[len] = 0;
-				ne->status = 1;
-			} else {
-				ne->status = -1;
-			}
-			break;
-		}
-	}
-}
-
-\ Read a value, decoding string types. If the string type is recognised
-\ and the value could be converted to UTF-8 into the pad, then true (-1)
-\ is returned; in all other cases, false (0) is returned. Either way, the
-\ object is consumed.
-: read-string ( lim -- lim bool )
-	read-tag case
-		\ UTF8String
-		12 of check-primitive read-value-UTF8 endof
-		\ NumericString
-		18 of check-primitive read-value-latin1 endof
-		\ PrintableString
-		19 of check-primitive read-value-latin1 endof
-		\ TeletexString
-		20 of check-primitive read-value-latin1 endof
-		\ IA5String
-		22 of check-primitive read-value-latin1 endof
-		\ BMPString
-		30 of check-primitive read-value-UTF16 endof
-		2drop read-length-skip 0 0
-	endcase ;
-
-\ Read a DN for the EE. The normalized DN hash is computed and stored in the
-\ current_dn_hash.
-\ Name elements are gathered. Also, the Common Name is matched against the
-\ intended server name.
-\ Returned value is true (-1) if the CN matches the intended server name,
-\ false (0) otherwise.
-: read-DN-EE ( lim -- lim bool )
-	\ Flag will be set to true if there is a CN and it matches the
-	\ intended server name.
-	0 { eename-matches }
-
-	\ Activate DN hashing.
-	start-dn-hash
-
-	\ Parse the DN structure: it is a SEQUENCE of SET of
-	\ AttributeTypeAndValue. Each AttributeTypeAndValue is a
-	\ SEQUENCE { OBJECT IDENTIFIER, ANY }.
-	read-sequence-open
-	begin
-		dup while
-
-		read-tag 0x11 check-tag-constructed read-length-open-elt
-		dup ifnot ERR_X509_BAD_DN fail then
-		begin
-			dup while
-
-			read-sequence-open
-
-			\ Read the OID. If the OID could not be read (too
-			\ long) then the first pad byte will be 0.
-			read-OID drop
-
-			\ If it is the Common Name then we'll need to
-			\ match it against the intended server name (if
-			\ applicable).
-			id-at-commonName eqOID { isCN }
-
-			\ Get offset for reception buffer for that element
-			\ (or -1).
-			0 offset-name-element { offbuf }
-
-			\ Try to read the value as a string.
-			read-string
-
-			\ If the value could be decoded as a string,
-			\ copy it and/or match it, as appropriate.
-			dup isCN and if
-				match-server-name if
-					-1 >eename-matches
-				then
-			then
-			offbuf copy-name-element
-
-			\ Close the SEQUENCE
-			close-elt
-
-		repeat
-		close-elt
-	repeat
-	close-elt
-
-	\ Compute DN hash and deactivate DN hashing.
-	compute-dn-hash
-
-	\ Return the CN match flag.
-	eename-matches ;
-
-\ Check the provided validity range against the current (or configured)
-\ date and time ("na" = notAfter, "nb = notBefore). Returned value:
-\   -1   current date/time is before the notBefore date
-\    0   current date/time is within the allowed range
-\   +1   current date/time is after the notAfter range
-\ If the current date/time is not available, then this function triggers a
-\ failure and does not return.
-cc: check-validity-range ( na-days na-seconds nb-days nb-seconds -- int ) {
-	uint32_t nbs = T0_POP();
-	uint32_t nbd = T0_POP();
-	uint32_t nas = T0_POP();
-	uint32_t nad = T0_POP();
-	int r;
-	if (CTX->itime != 0) {
-		r = CTX->itime(CTX->itime_ctx, nbd, nbs, nad, nas);
-		if (r < -1 || r > 1) {
-			CTX->err = BR_ERR_X509_TIME_UNKNOWN;
-			T0_CO();
-		}
-	} else {
-		uint32_t vd = CTX->days;
-		uint32_t vs = CTX->seconds;
-		if (vd == 0 && vs == 0) {
-#if BR_USE_UNIX_TIME
-			time_t x = time(NULL);
-
-			vd = (uint32_t)(x / 86400) + 719528;
-			vs = (uint32_t)(x % 86400);
-#elif BR_USE_WIN32_TIME
-			FILETIME ft;
-			uint64_t x;
-
-			GetSystemTimeAsFileTime(&ft);
-			x = ((uint64_t)ft.dwHighDateTime << 32)
-				+ (uint64_t)ft.dwLowDateTime;
-			x = (x / 10000000);
-			vd = (uint32_t)(x / 86400) + 584754;
-			vs = (uint32_t)(x % 86400);
-#else
-			CTX->err = BR_ERR_X509_TIME_UNKNOWN;
-			T0_CO();
-#endif
-		}
-		if (vd < nbd || (vd == nbd && vs < nbs)) {
-			r = -1;
-		} else if (vd > nad || (vd == nad && vs > nas)) {
-			r = 1;
-		} else {
-			r = 0;
-		}
-	}
-	T0_PUSHi(r);
-}
-
-\ Swap the top two elements with the two elements immediately below.
-: swap2 ( a b c d -- c d a b )
-	3 roll 3 roll ;
-
-\ Match the name in the pad with the expected server name. Returned value
-\ is true (-1) on match, false (0) otherwise. If there is no expected
-\ server name, then 0 is returned.
-\ Match conditions: either an exact match (case insensitive), or a
-\ wildcard match, if the found name starts with "*.". We only match a
-\ starting wildcard, and only against a complete DN name component.
-cc: match-server-name ( -- bool ) {
-	size_t n1, n2;
-
-	if (CTX->server_name == NULL) {
-		T0_PUSH(0);
-		T0_RET();
-	}
-	n1 = strlen(CTX->server_name);
-	n2 = CTX->pad[0];
-	if (n1 == n2 && eqnocase(&CTX->pad[1], CTX->server_name, n1)) {
-		T0_PUSHi(-1);
-		T0_RET();
-	}
-	if (n2 >= 2 && CTX->pad[1] == '*' && CTX->pad[2] == '.') {
-		size_t u;
-
-		u = 0;
-		while (u < n1 && CTX->server_name[u] != '.') {
-			u ++;
-		}
-		u ++;
-		n1 -= u;
-		if ((n2 - 2) == n1
-			&& eqnocase(&CTX->pad[3], CTX->server_name + u, n1))
-		{
-			T0_PUSHi(-1);
-			T0_RET();
-		}
-	}
-	T0_PUSH(0);
-}
-
-\ Get the address and length for the pkey_data buffer.
-: addr-len-pkey_data ( -- addr len )
-	CX 0 8191 { offsetof(br_x509_minimal_context, pkey_data) }
-	CX 0 8191 { BR_X509_BUFSIZE_KEY } ;
-
-\ Copy the EE public key to the permanent buffer (RSA).
-cc: copy-ee-rsa-pkey ( nlen elen -- ) {
-	size_t elen = T0_POP();
-	size_t nlen = T0_POP();
-	memcpy(CTX->ee_pkey_data, CTX->pkey_data, nlen + elen);
-	CTX->pkey.key_type = BR_KEYTYPE_RSA;
-	CTX->pkey.key.rsa.n = CTX->ee_pkey_data;
-	CTX->pkey.key.rsa.nlen = nlen;
-	CTX->pkey.key.rsa.e = CTX->ee_pkey_data + nlen;
-	CTX->pkey.key.rsa.elen = elen;
-}
-
-\ Copy the EE public key to the permanent buffer (EC).
-cc: copy-ee-ec-pkey ( curve qlen -- ) {
-	size_t qlen = T0_POP();
-	uint32_t curve = T0_POP();
-	memcpy(CTX->ee_pkey_data, CTX->pkey_data, qlen);
-	CTX->pkey.key_type = BR_KEYTYPE_EC;
-	CTX->pkey.key.ec.curve = curve;
-	CTX->pkey.key.ec.q = CTX->ee_pkey_data;
-	CTX->pkey.key.ec.qlen = qlen;
-}
-
-\ Check whether the current certificate (EE) is directly trusted.
-cc: check-direct-trust ( -- ) {
-	size_t u;
-
-	for (u = 0; u < CTX->trust_anchors_num; u ++) {
-		const br_x509_trust_anchor *ta;
-		unsigned char hashed_DN[64];
-		int kt;
-
-		ta = &CTX->trust_anchors[u];
-		if (ta->flags & BR_X509_TA_CA) {
-			continue;
-		}
-		hash_dn(CTX, ta->dn.data, ta->dn.len, hashed_DN);
-		if (memcmp(hashed_DN, CTX->current_dn_hash, DNHASH_LEN)) {
-			continue;
-		}
-		kt = CTX->pkey.key_type;
-		if ((ta->pkey.key_type & 0x0F) != kt) {
-			continue;
-		}
-		switch (kt) {
-
-		case BR_KEYTYPE_RSA:
-			if (!eqbigint(CTX->pkey.key.rsa.n,
-				CTX->pkey.key.rsa.nlen,
-				ta->pkey.key.rsa.n,
-				ta->pkey.key.rsa.nlen)
-				|| !eqbigint(CTX->pkey.key.rsa.e,
-				CTX->pkey.key.rsa.elen,
-				ta->pkey.key.rsa.e,
-				ta->pkey.key.rsa.elen))
-			{
-				continue;
-			}
-			break;
-
-		case BR_KEYTYPE_EC:
-			if (CTX->pkey.key.ec.curve != ta->pkey.key.ec.curve
-				|| CTX->pkey.key.ec.qlen != ta->pkey.key.ec.qlen
-				|| memcmp(CTX->pkey.key.ec.q,
-					ta->pkey.key.ec.q,
-					ta->pkey.key.ec.qlen) != 0)
-			{
-				continue;
-			}
-			break;
-
-		default:
-			continue;
-		}
-
-		/*
-		 * Direct trust match!
-		 */
-		CTX->err = BR_ERR_X509_OK;
-		T0_CO();
-	}
-}
-
-\ Check the signature on the certificate with regards to all trusted CA.
-\ We use the issuer hash (in saved_dn_hash[]) as CA identifier.
-cc: check-trust-anchor-CA ( -- ) {
-	size_t u;
-
-	for (u = 0; u < CTX->trust_anchors_num; u ++) {
-		const br_x509_trust_anchor *ta;
-		unsigned char hashed_DN[64];
-
-		ta = &CTX->trust_anchors[u];
-		if (!(ta->flags & BR_X509_TA_CA)) {
-			continue;
-		}
-		hash_dn(CTX, ta->dn.data, ta->dn.len, hashed_DN);
-		if (memcmp(hashed_DN, CTX->saved_dn_hash, DNHASH_LEN)) {
-			continue;
-		}
-		if (verify_signature(CTX, &ta->pkey) == 0) {
-			CTX->err = BR_ERR_X509_OK;
-			T0_CO();
-		}
-	}
-}
-
-\ Verify RSA signature. This uses the public key that was just decoded
-\ into CTX->pkey_data; the modulus and exponent length are provided as
-\ parameters. The resulting hash value is compared with the one in
-\ tbs_hash. Returned value is 0 on success, or a non-zero error code.
-cc: do-rsa-vrfy ( nlen elen -- err ) {
-	size_t elen = T0_POP();
-	size_t nlen = T0_POP();
-	br_x509_pkey pk;
-
-	pk.key_type = BR_KEYTYPE_RSA;
-	pk.key.rsa.n = CTX->pkey_data;
-	pk.key.rsa.nlen = nlen;
-	pk.key.rsa.e = CTX->pkey_data + nlen;
-	pk.key.rsa.elen = elen;
-	T0_PUSH(verify_signature(CTX, &pk));
-}
-
-\ Verify ECDSA signature. This uses the public key that was just decoded
-\ into CTX->pkey_dayta; the curve ID and public point length are provided
-\ as parameters. The hash value in tbs_hash is used. Returned value is 0
-\ on success, or non-zero error code.
-cc: do-ecdsa-vrfy ( curve qlen -- err ) {
-	size_t qlen = T0_POP();
-	int curve = T0_POP();
-	br_x509_pkey pk;
-
-	pk.key_type = BR_KEYTYPE_EC;
-	pk.key.ec.curve = curve;
-	pk.key.ec.q = CTX->pkey_data;
-	pk.key.ec.qlen = qlen;
-	T0_PUSH(verify_signature(CTX, &pk));
-}
-
-cc: print-bytes ( addr len -- ) {
-	extern int printf(const char *fmt, ...);
-	size_t len = T0_POP();
-	unsigned char *buf = (unsigned char *)CTX + T0_POP();
-	size_t u;
-
-	for (u = 0; u < len; u ++) {
-		printf("%02X", buf[u]);
-	}
-}
-
-cc: printOID ( -- ) {
-	extern int printf(const char *fmt, ...);
-	size_t u, len;
-
-	len = CTX->pad[0];
-	if (len == 0) {
-		printf("*");
-		T0_RET();
-	}
-	printf("%u.%u", CTX->pad[1] / 40, CTX->pad[1] % 40);
-	u = 2;
-	while (u <= len) {
-		unsigned long ul;
-
-		ul = 0;
-		for (;;) {
-			int x;
-
-			if (u > len) {
-				printf("BAD");
-				T0_RET();
-			}
-			x = CTX->pad[u ++];
-			ul = (ul << 7) + (x & 0x7F);
-			if (!(x & 0x80)) {
-				break;
-			}
-		}
-		printf(".%lu", ul);
-	}
-}
-
-\ Extensions with specific processing.
-OID: basicConstraints      2.5.29.19
-OID: keyUsage              2.5.29.15
-OID: subjectAltName        2.5.29.17
-OID: certificatePolicies   2.5.29.32
-
-\ Policy qualifier "pointer to CPS"
-OID: id-qt-cps             1.3.6.1.5.5.7.2.1
-
-\ Extensions which are ignored when encountered, even if critical.
-OID: authorityKeyIdentifier        2.5.29.35
-OID: subjectKeyIdentifier          2.5.29.14
-OID: issuerAltName                 2.5.29.18
-OID: subjectDirectoryAttributes    2.5.29.9
-OID: crlDistributionPoints         2.5.29.31
-OID: freshestCRL                   2.5.29.46
-OID: authorityInfoAccess           1.3.6.1.5.5.7.1.1
-OID: subjectInfoAccess             1.3.6.1.5.5.7.1.11
-
-\ Process a Basic Constraints extension. This should be called only if
-\ the certificate is not the EE. We check that the extension contains
-\ the "CA" flag, and that the path length, if specified, is compatible
-\ with the current chain length.
-: process-basicConstraints ( lim -- lim )
-	read-sequence-open
-	read-tag-or-end
-	dup 0x01 = if
-		read-boolean ifnot ERR_X509_NOT_CA fail then
-		read-tag-or-end
-	else
-		ERR_X509_NOT_CA fail
-	then
-	dup 0x02 = if
-		drop check-primitive read-small-int-value
-		addr-num_certs get32 1- < if ERR_X509_NOT_CA fail then
-		read-tag-or-end
-	then
-	-1 <> if ERR_X509_UNEXPECTED fail then
-	drop
-	close-elt
-	;
-
-\ Process a Key Usage extension.
-\ For the EE certificate:
-\   -- if the key usage contains keyEncipherment (2), dataEncipherment (3)
-\      or keyAgreement (4), then the "key exchange" usage is allowed;
-\   -- if the key usage contains digitalSignature (0) or nonRepudiation (1),
-\      then the "signature" usage is allowed.
-\ For CA certificates, the extension must contain keyCertSign (5).
-: process-keyUsage ( lim ee -- lim )
-	{ ee }
-
-	\ Read tag for the BIT STRING and open it.
-	read-tag 0x03 check-tag-primitive
-	read-length-open-elt
-	\ First byte indicates number of ignored bits in the last byte. It
-	\ must be between 0 and 7.
-	read8 { ign }
-	ign 7 > if ERR_X509_UNEXPECTED fail then
-	\ Depending on length, we have either 0, 1 or more bytes to read.
-	dup case
-		0 of ERR_X509_FORBIDDEN_KEY_USAGE fail endof
-		1 of read8 ign >> ign << endof
-		drop read8 0
-	endcase
-
-	\ Check bits.
-	ee if
-		\ EE: get usages.
-		0
-		over 0x38 and if 0x10 or then
-		swap 0xC0 and if 0x20 or then
-		addr-key_usages set8
-	else
-		\ Not EE: keyCertSign must be set.
-		0x04 and ifnot ERR_X509_FORBIDDEN_KEY_USAGE fail then
-	then
-
-	\ We don't care about subsequent bytes.
-	skip-close-elt ;
-
-\ Process a Certificate Policies extension.
-\
-\ Since we don't actually support full policies processing, this function
-\ only checks that the extension contents can be safely ignored. Indeed,
-\ we don't validate against a specific set of policies (in RFC 5280
-\ terminology, user-initial-policy-set only contains the special value
-\ any-policy). Moreover, we don't support policy constraints (if a
-\ critical Policy Constraints extension is encountered, the validation
-\ will fail). Therefore, we can safely ignore the contents of this
-\ extension, except if it is critical AND one of the policy OID has a
-\ qualifier which is distinct from id-qt-cps (because id-qt-cps is
-\ specially designated by RFC 5280 has having no mandated action).
-\
-\ This function is called only if the extension is critical.
-: process-certPolicies ( lim -- lim )
-	\ Extension value is a SEQUENCE OF PolicyInformation.
-	read-sequence-open
-	begin dup while
-		\ PolicyInformation ::= SEQUENCE {
-		\    policyIdentifier  OBJECT IDENTIFIER,
-		\    policyQualifiers  SEQUENCE OF PolicyQualifierInfo OPTIONAL
-		\ }
-		read-sequence-open
-		read-OID drop
-		dup if
-			read-sequence-open
-			begin dup while
-				\ PolicyQualifierInfo ::= SEQUENCE {
-				\    policyQualifierId  OBJECT IDENTIFIER,
-				\    qualifier          ANY
-				\ }
-				read-sequence-open
-				read-OID drop id-qt-cps eqOID ifnot
-					ERR_X509_CRITICAL_EXTENSION fail
-				then
-				skip-close-elt
-			repeat
-			close-elt
-		then
-		close-elt
-	repeat
-	close-elt ;
-
-\ Process a Subject Alt Name extension. Returned value is a boolean set
-\ to true if the expected server name was matched against a dNSName in
-\ the extension.
-: process-SAN ( lim -- lim bool )
-	0 { m }
-	read-sequence-open
-	begin dup while
-		\ Read the tag. If the tag is context-0, then parse an
-		\ 'otherName'. If the tag is context-2, then parse a
-		\ dNSName. If the tag is context-1 or context-6,
-		\ parse 
-		read-tag case
-			\ OtherName
-			0x20 of
-				\ OtherName ::= SEQUENCE {
-				\     type-id   OBJECT IDENTIFIER,
-				\     value     [0] EXPLICIT ANY
-				\ }
-				check-constructed read-length-open-elt
-				read-OID drop
-				-1 offset-name-element { offbuf }
-				read-tag 0x20 check-tag-constructed
-				read-length-open-elt
-				read-string offbuf copy-name-element
-				close-elt
-				close-elt
-			endof
-			\ rfc822Name (IA5String)
-			0x21 of
-				check-primitive
-				read-value-UTF8 1 copy-name-SAN
-			endof
-			\ dNSName (IA5String)
-			0x22 of
-				check-primitive
-				read-value-UTF8
-				dup if match-server-name m or >m then
-				2 copy-name-SAN
-			endof
-			\ uniformResourceIdentifier (IA5String)
-			0x26 of
-				check-primitive
-				read-value-UTF8 6 copy-name-SAN
-			endof
-			2drop read-length-skip 0
-		endcase
-
-		\ We check only names of type dNSName; they use IA5String,
-		\ which is basically ASCII.
-		\ read-tag 0x22 = if
-		\ 	check-primitive
-		\ 	read-small-value drop
-		\ 	match-server-name m or >m
-		\ else
-		\ 	drop read-length-skip
-		\ then
-	repeat
-	close-elt
-	m ;
-
-\ Decode a certificate. The "ee" boolean must be true for the EE.
-: decode-certificate ( ee -- )
-	{ ee }
-
-	\ Obtain the total certificate length.
-	addr-cert_length get32
-
-	\ Open the outer SEQUENCE.
-	read-sequence-open
-
-	\ TBS
-	\ Activate hashing.
-	start-tbs-hash
-	read-sequence-open
-
-	\ First element may be an explicit version. We accept only
-	\ versions 0 to 2 (certificates v1 to v3).
-	read-tag dup 0x20 = if
-		drop check-constructed read-length-open-elt
-		read-tag
-		0x02 check-tag-primitive
-		read-small-int-value
-		2 > if ERR_X509_UNSUPPORTED fail then
-		close-elt
-		read-tag
-	then
-
-	\ Serial number. We just check that the tag is correct.
-	0x02 check-tag-primitive
-	read-length-skip
-
-	\ Signature algorithm. This structure is redundant with the one
-	\ on the outside; we just skip it.
-	read-sequence-open skip-close-elt
-
-	\ Issuer name: hashed, then copied into next_dn_hash[].
-	read-DN
-	addr-next_dn_hash addr-current_dn_hash dn-hash-length blobcopy
-
-	\ Validity dates.
-	read-sequence-open
-	read-date { nbd nbs } read-date nbd nbs check-validity-range
-	if ERR_X509_EXPIRED fail then
-	close-elt
-
-	\ Subject name.
-	ee if
-		\ For the EE, we must check whether the Common Name, if
-		\ any, matches the expected server name.
-		read-DN-EE { eename }
-	else
-		\ For a non-EE certificate, the hashed subject DN must match
-		\ the saved hashed issuer DN from the previous certificate.
-		read-DN
-		addr-current_dn_hash addr-saved_dn_hash dn-hash-length eqblob
-		ifnot ERR_X509_DN_MISMATCH fail then
-	then
-	\ Move the hashed issuer DN for this certificate into the
-	\ saved_dn_hash[] array.
-	addr-saved_dn_hash addr-next_dn_hash dn-hash-length blobcopy
-
-	\ Public Key.
-	read-sequence-open
-	\ Algorithm Identifier. Right now we are only interested in the
-	\ OID, since we only support RSA keys.
-	read-sequence-open
-	read-OID ifnot ERR_X509_UNSUPPORTED fail then
-	{ ; pkey-type }
-	choice
-		\ RSA public key.
-		rsaEncryption eqOID uf
-			skip-close-elt
-			\ Public key itself: the BIT STRING contains bytes
-			\ (no partial byte) and these bytes encode the
-			\ actual value.
-			read-bits-open
-				\ RSA public key is a SEQUENCE of two
-				\ INTEGER. We get both INTEGER values into
-				\ the pkey_data[] buffer, if they fit.
-				read-sequence-open
-				addr-len-pkey_data
-				read-integer { nlen }
-				addr-len-pkey_data swap nlen + swap nlen -
-				read-integer { elen }
-				close-elt
-
-				\ Check that the public key fits our minimal
-				\ size requirements. Note that the integer
-				\ decoder already skipped the leading bytes
-				\ of value 0, so we are working on the true
-				\ modulus length here.
-				addr-min_rsa_size get16 128 + nlen > if
-					ERR_X509_WEAK_PUBLIC_KEY fail
-				then
-			close-elt
-			KEYTYPE_RSA >pkey-type
-		enduf
-
-		\ EC public key.
-		id-ecPublicKey eqOID uf
-			\ We support only named curves, for which the
-			\ "parameters" field in the AlgorithmIdentifier
-			\ field should be an OID.
-			read-OID ifnot ERR_X509_UNSUPPORTED fail then
-			choice
-				ansix9p256r1 eqOID uf 23 enduf
-				ansix9p384r1 eqOID uf 24 enduf
-				ansix9p521r1 eqOID uf 25 enduf
-				ERR_X509_UNSUPPORTED fail
-			endchoice
-			{ curve }
-			close-elt
-			read-bits-open
-			dup { qlen }
-			dup addr-len-pkey_data rot < if
-				ERR_X509_LIMIT_EXCEEDED fail
-			then
-			read-blob
-			KEYTYPE_EC >pkey-type
-		enduf
-
-		\ Not a recognised public key type.
-		ERR_X509_UNSUPPORTED fail
-	endchoice
-	close-elt
-
-	\ Process public key.
-	ee if
-		\ For the EE certificate, copy the key data to the
-		\ relevant buffer.
-		pkey-type case
-			KEYTYPE_RSA of nlen elen copy-ee-rsa-pkey endof
-			KEYTYPE_EC of curve qlen copy-ee-ec-pkey endof
-			ERR_X509_UNSUPPORTED fail
-		endcase
-	else
-		\ Verify signature on previous certificate. We invoke
-		\ the RSA implementation.
-		pkey-type case
-			KEYTYPE_RSA of nlen elen do-rsa-vrfy endof
-			KEYTYPE_EC of curve qlen do-ecdsa-vrfy endof
-			ERR_X509_UNSUPPORTED fail
-		endcase
-		dup if fail then
-		drop
-	then
-
-	\ This flag will be set to true if the Basic Constraints extension
-	\ is encountered.
-	0 { seenBC }
-
-	\ Skip issuerUniqueID and subjectUniqueID, and process extensions
-	\ if present. Extensions are an explicit context tag of value 3
-	\ around a SEQUENCE OF extensions. Each extension is a SEQUENCE
-	\ with an OID, an optional boolean, and a value; the value is
-	\ an OCTET STRING.
-	read-tag-or-end
-	0x21 iftag-skip
-	0x22 iftag-skip
-	dup 0x23 = if
-		drop
-		check-constructed read-length-open-elt
-		read-sequence-open
-		begin dup while
-			0 { critical }
-			read-sequence-open
-			read-OID drop
-			read-tag dup 0x01 = if
-				read-boolean >critical
-				read-tag
-			then
-			0x04 check-tag-primitive read-length-open-elt
-			choice
-				\ Extensions with specific processing.
-				basicConstraints eqOID uf
-					ee if
-						skip-remaining
-					else
-						process-basicConstraints
-						-1 >seenBC
-					then
-				enduf
-				keyUsage         eqOID uf
-					ee process-keyUsage
-				enduf
-				subjectAltName   eqOID uf
-					ee if
-						0 >eename
-						process-SAN >eename
-					else
-						skip-remaining
-					then
-				enduf
-
-				\ We don't implement full processing of
-				\ policies. The call below mostly checks
-				\ that the contents of the Certificate
-				\ Policies extension can be safely ignored.
-				certificatePolicies eqOID uf
-					critical if
-						process-certPolicies
-					else
-						skip-remaining
-					then
-				enduf
-
-				\ Extensions which are always ignored,
-				\ even if critical.
-				authorityKeyIdentifier     eqOID uf
-					skip-remaining
-				enduf
-				subjectKeyIdentifier       eqOID uf
-					skip-remaining
-				enduf
-				issuerAltName              eqOID uf
-					skip-remaining
-				enduf
-				subjectDirectoryAttributes eqOID uf
-					skip-remaining
-				enduf
-				crlDistributionPoints      eqOID uf
-					skip-remaining
-				enduf
-				freshestCRL                eqOID uf
-					skip-remaining
-				enduf
-				authorityInfoAccess        eqOID uf
-					skip-remaining
-				enduf
-				subjectInfoAccess          eqOID uf
-					skip-remaining
-				enduf
-
-				\ Unrecognized extensions trigger a failure
-				\ if critical; otherwise, they are just
-				\ ignored.
-				critical if
-					ERR_X509_CRITICAL_EXTENSION fail
-				then
-				skip-remaining
-			endchoice
-			close-elt
-			close-elt
-		repeat
-		close-elt
-		close-elt
-	else
-		-1 = ifnot ERR_X509_UNEXPECTED fail then
-		drop
-	then
-
-	close-elt
-	\ Terminate hashing.
-	stop-tbs-hash
-
-	\ For the EE certificate, verify that the intended server name
-	\ was matched.
-	ee if
-		eename zero-server-name or ifnot
-			ERR_X509_BAD_SERVER_NAME fail
-		then
-	then
-
-	\ If this is the EE certificate, then direct trust may apply.
-	\ Note: we do this at this point, not immediately after decoding
-	\ the public key, because even in case of direct trust we still
-	\ want to check the server name with regards to the SAN extension.
-	\ However, we want to check direct trust before trying to decode
-	\ the signature algorithm, because it should work even if that
-	\ algorithm is not supported.
-	ee if check-direct-trust then
-
-	\ Non-EE certificates MUST have a Basic Constraints extension
-	\ (that marks them as being CA).
-	ee seenBC or ifnot ERR_X509_NOT_CA fail then
-
-	\ signature algorithm
-	read-tag check-sequence read-length-open-elt
-	\ Read and understand the OID. Right now, we support only
-	\ RSA with PKCS#1 v1.5 padding, and hash functions SHA-1,
-	\ SHA-224, SHA-256, SHA-384 and SHA-512. We purposely do NOT
-	\ support MD5 here.
-	\ TODO: add support for RSA/PSS
-	read-OID if
-		\ Based on the signature OID, we get:
-		\ -- the signing key type
-		\ -- the hash function numeric identifier
-		\ -- the hash function OID
-		choice
-			sha1WithRSAEncryption   eqOID
-				uf 2 KEYTYPE_RSA id-sha1   enduf
-			sha224WithRSAEncryption eqOID
-				uf 3 KEYTYPE_RSA id-sha224 enduf
-			sha256WithRSAEncryption eqOID
-				uf 4 KEYTYPE_RSA id-sha256 enduf
-			sha384WithRSAEncryption eqOID
-				uf 5 KEYTYPE_RSA id-sha384 enduf
-			sha512WithRSAEncryption eqOID
-				uf 6 KEYTYPE_RSA id-sha512 enduf
-
-			ecdsa-with-SHA1   eqOID
-				uf 2 KEYTYPE_EC id-sha1 enduf
-			ecdsa-with-SHA224 eqOID
-				uf 3 KEYTYPE_EC id-sha224 enduf
-			ecdsa-with-SHA256 eqOID
-				uf 4 KEYTYPE_EC id-sha256 enduf
-			ecdsa-with-SHA384 eqOID
-				uf 5 KEYTYPE_EC id-sha384 enduf
-			ecdsa-with-SHA512 eqOID
-				uf 6 KEYTYPE_EC id-sha512 enduf
-			ERR_X509_UNSUPPORTED fail
-		endchoice
-		addr-cert_sig_hash_oid set16
-		addr-cert_signer_key_type set8
-
-		\ Compute the TBS hash into tbs_hash.
-		compute-tbs-hash
-		dup ifnot ERR_X509_UNSUPPORTED fail then
-		addr-cert_sig_hash_len set8
-	else
-		ERR_X509_UNSUPPORTED fail
-	then
-	\ We ignore the parameters, whether they are present or not,
-	\ because we got all the information from the OID.
-	skip-close-elt
-
-	\ signature value
-	read-bits-open
-	dup CX 0 8191 { BR_X509_BUFSIZE_SIG } > if
-		ERR_X509_LIMIT_EXCEEDED fail
-	then
-	dup addr-cert_sig_len set16
-	addr-cert_sig read-blob
-
-	\ Close the outer SEQUENCE.
-	close-elt
-
-	\ Close the advertised total certificate length. This checks that
-	\ there is no trailing garbage after the certificate.
-	close-elt
-
-	\ Flag the certificate as fully processed.
-	0 addr-cert_length set32
-
-	\ Check whether the issuer for the current certificate is known
-	\ as a trusted CA; in which case, verify the signature.
-	check-trust-anchor-CA ;
-
-: main
-	\ Unless restricted by a Key Usage extension, all usages are
-	\ deemed allowed.
-	0x30 addr-key_usages set8
-	-1 decode-certificate
-	co
-	begin
-		0 decode-certificate co
-	again
-	;