Removed indirect dependency on OpenSSL from cryptography-x509-verification

[TaaviE]

This PR should decouple cryptography-x509-verification from cryptography-key-parsing and subsequently OpenSSL.

This makes it possible to (cross-)build the library for targets that would otherwise have difficulties with OpenSSL. It also makes the PKCS#1 parsing pure Rust.

Tests seem to all pass when ran locally.

[alex]

We're not going to depend on an entirely different ASN.1 stack for this. If there's an interest in the objective we can consider it, but this isn't going to be the right approach.

[TaaviE]

@alex Yeah, that makes sense. I just stumbled upon this when trying to use that code standalone (and without OpenSSL).

It might be worthwhile to consider switching to a memory-safe ASN.1 stack even outside the context of build targets that OpenSSL isn't so pleasant to use with.

[alex]

I'm not sure I follow, is there any place we don't use our own rust asn1 stack for der? All that is necessary for evil to succeed is for good people to do nothing.

…

On Sat, Dec 13, 2025, 9:42 AM Taavi Eomäe ***@***.***> wrote: *TaaviE* left a comment (pyca/cryptography#14003) <#14003 (comment)> @alex <https://github.com/alex> Yeah, that makes sense. I just stumbled upon this when trying to use that code standalone (and without OpenSSL). It might be worthwhile to consider switching to a memory-safe ASN.1 stack even outside the context of build targets that OpenSSL isn't so pleasant to use with. — Reply to this email directly, view it on GitHub <#14003 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBESPNKDVR4L7AOYCET4BQQVHAVCNFSM6AAAAACOYTDYL6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMNBZGQ4TONJQHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[TaaviE]

I'm not sure I follow, is there any place we don't use our own rust asn1 stack for der?

Yeah I misremembered/misphrased, OSSL is just intertwined with the Rust asn1 stack currently used in cryptography-key-parsing, including rsa.rs. Which made me make a (silly) leap into assuming it's used throughout.

[alex]

going to close this since it doesn't make sense as-is, but we're generally happy to take improvements to this code.