Re: [pkix] draft-turner-additional-methods-4kis to ISE - example

["Manger, James H" <[e-mail]>]

>> I think we better put an example in the draft: a
>> SubjectPublicKeyValue; 2 (or 4) subjectKeyId extension values; and 2
>> (or 4) corresponding ext-skiSemantics values.
> 
> I'll add a new section:
> 
> ****
> 
> This section provides some examples.  The keys and key identifiers are
> presented in hexadecimal (two hex digits per byte).
> 
> Given the following P-256 ECDSA key:
> 
>    047F7F35A79794C950060B8029FC8F363A28F11159692D9D34E6AC94819043
>    4735F833B1A66652DC514337AFF7F5C9C75D670C019D95A5D639B72744C64A
>    9128BB

Better to start with a SPKI value.

  Given the following DER-encoded SubjectPublicKeyInfo value holding an P-256 ECDSA key:
 
    30 59
       30 13
          06 07 2A8648CE3D0201    -- id-ecPublicKey
          06 08 2A8648CE3D030107  -- secp256r1
       03 42 00
             04 7F7F35A79794C950060B8029FC8F363A
                28F11159692D9D34E6AC948190434735
                F833B1A66652DC514337AFF7F5C9C75D
                670C019D95A5D639B72744C64A9128BB

  The SHA-256 hash of the 65 bytes 047F7F...BB is
    BF37B3E5808FD46D54B28E846311BCCE1CAD2E1A62AA9092EF3EFB3F11451F44

  The SHA-1 hash of these 65 bytes is
    6FEF9162C0A3F2E7608956D41C37DA0C8E87F0AE

  The SHA-256 hash of the 91 bytes 305930...BB is
    6D20896AB8BD833B6B66554BD59B20225D8A75A296088148399D7BF763D57405


  Using method 1 from section 2, the subject key id
  extension and the key id semantics extension would be:

    30 1D
       06 03 551D0E  -- id-ce-subjectKeyIdentifier
       04 16
          04 14 BF37B3E5808FD46D54B28E846311BCCE1CAD2E1A
   
    30 xx
       06 xx xxxxxx  -- id-pe-skiSemantics
       04 xx
          30 xx
             06 xx xxxxxx  -- id-keyHash
             06 09 608648016503040201  -- id-sha256
    

  Using method 1 from RFC5280 the two extensions would be:

    30 1D
       06 03 551D0E  -- id-ce-subjectKeyIdentifier
       04 16
          04 14 6FEF9162C0A3F2E7608956D41C37DA0C8E87F0AE
   
    30 xx
       06 xx xxxxxx  -- id-pe-skiSemantics
       04 xx
          30 xx
             06 xx xxxxxx  -- id-keyHash
             06 05 2B0E03021A  -- id-sha1


  Using method 3 from section 2 the two extensions would be:

    30 1D
       06 03 551D0E  -- id-ce-subjectKeyIdentifier
       04 16
          04 14 6D20896AB8BD833B6B66554BD59B20225D8A75A2
   
    30 xx
       06 xx xxxxxx  -- id-pe-skiSemantics
       04 xx
          30 xx
             06 xx xxxxxx  -- id-keyInfoHash
             06 09 608648016503040201  -- id-sha256 


> 
> The SHA-256 hash output of the key is as follows:
> 
>    E72EE6C9C63D2B7F960F0E0611B9800917B5F9494182403EF1BBA8927A57625E

Not quite.
This is the SHA-256 hash of the 130 ASCII hex digits, not the 65 bytes.

--
James Manger