bitpay/bitcore — pull request #435 by chjj (2014-07-17 05:45:33+00:00)
Title: BIP-70 x509 signing and verification

Hey guys,

So this PR implements x509 signing and verifying for bip-70 (payment protocol).

`pki_data` is supposed to be a collection of DER certs. I'm still not sure whether this is a certificate chain (similar to a concatenated PEM cert chain) or some part of the btc protocol. Protobuf may parse it as an array and it may not.

Anyway, it runs in node and the browser. Tests are passing on both sides. Unfortunately, `jsrsasign` is needed in node (along with the clientside) because node has no way of converting DER certificates to PEM without it (PEM formatted certs are needed for verification of sigs and testing whether the cert is trusted). I'll do some more poking around, but if `pki_data` is indeed an array of DER certs, these methods will only deal with the first cert in the `pki_data` list.

The build script has been changed in such a way that the root trusted certs are wget'd/curl'd from the node.js repo (which are in turn taken from the mozilla root certs file):
https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/
(it's just much easier to grab it from node).

On how to handle untrusted certs: it originally threw an error, but that obviously made tests fail since our test cert is self-signed.

So the main things to do that need finishing:
- Handle multiple DER certs contained in `pki_data` (hopefully protobuf
automatically parses them to an array)
- Handle untrusted certs by throwing errors or through some other means.

I'll dig into it a little bit more.