Documentation
¶
Overview ¶
Package knowledge holds the certificates involved in the October 2026 eMudhra intermediate CA key compromise (Mozilla bug 2083449) and the facts the scanner matches on.
Every match is by public key, never by name: names can be copied, keys cannot. The data proves itself at start-up. Each "compromised" key must be k·G for a tiny k, which is exactly what makes it compromised; if the embedded data ever stopped satisfying that, Load fails instead of scanning with bad data.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotLoaded = errors.New("knowledge base not loaded")
ErrNotLoaded is returned by helpers used before Load succeeded.
Functions ¶
func CertHash ¶
func CertHash(c *x509.Certificate) string
CertHash returns the upper-case hex SHA-256 of a certificate's DER encoding.
func SPKIHash ¶
func SPKIHash(c *x509.Certificate) string
SPKIHash returns the upper-case hex SHA-256 of a certificate's SubjectPublicKeyInfo.
Types ¶
type Key ¶
type Key struct {
Name string // subject common name
Kind Kind // Compromised or PathRoot
Usage string // "tls", "code-signing", or "" for roots
SPKISHA256 string // hex, upper case
Scalar uint32 // private scalar, Compromised keys only
RawKey []byte // EC point (uncompressed) or RSA modulus, for byte search
CertSHA256 []string // every known certificate with this key
Certs []*x509.Certificate
}
Key is one public key the scanner looks for, with every certificate that carries it (the same key can appear under several issuers).
Source Files