Skip to content

Commit

Permalink
"Thumbprint" as a digest is not always a digest
Browse files Browse the repository at this point in the history
Add tagged-bytes for any identifier in a RFC5280 Subject Key Identifier.
  • Loading branch information
deeglaze committed Oct 11, 2024
1 parent 62994c8 commit c55b9c9
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 5 deletions.
1 change: 1 addition & 0 deletions cddl/crypto-key-type-choice.cddl
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ $crypto-key-type-choice /= tagged-thumbprint-type
$crypto-key-type-choice /= tagged-cert-thumbprint-type
$crypto-key-type-choice /= tagged-cert-path-thumbprint-type
$crypto-key-type-choice /= tagged-pkix-asn1der-cert-type
$crypto-key-type-choice /= tagged-bytes

tagged-pkix-base64-key-type = #6.554(tstr)
tagged-pkix-base64-cert-type = #6.555(tstr)
Expand Down
11 changes: 6 additions & 5 deletions draft-ietf-rats-corim.md
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,6 @@ contributor:
normative:
RFC4122: uuid
RFC5280: pkix-cert
RFC7250: raw-pk
RFC7468: pkix-text
RFC8610: cddl
RFC9090: cbor-oids
Expand Down Expand Up @@ -1023,19 +1022,21 @@ A cryptographic key can be one of the following formats:
* `tagged-cose-key-type`: CBOR encoded COSE_Key or COSE_KeySet.
Defined in {{Section 7 of -cose}}.

* `tagged-pkix-asn1der-key-type`: a `bstr` of ASN.1 DER encoded X.509 public key certificate.
Defined in {{Section 4 of -pkix-cert}}.

A cryptographic key digest can be one of the following formats:

* `tagged-thumbprint-type`: a `digest` of a raw public key as defined in {{-raw-pk}}. The digest value may
be used to find the public key if contained in a lookup table.
* `tagged-thumbprint-type`: a `digest` of a raw public key.
The digest value may be used to find the public key if contained in a lookup table.

* `tagged-cert-thumbprint-type`: a `digest` of a certificate.
The digest value may be used to find the certificate if contained in a lookup table.

* `tagged-cert-path-thumbprint-type`: a `digest` of a certification path.
The digest value may be used to find the certificate path if contained in a lookup table.

* `tagged-pkix-asn1der-key-type`: a `bstr` of ASN.1 DER encoded X.509 public key certificate.
Defined in {{Section 4 of -pkix-cert}}.
* `tagged-bytes`: a key identifier with no prescribed construction method.

~~~ cddl
{::include cddl/crypto-key-type-choice.cddl}
Expand Down

0 comments on commit c55b9c9

Please # to comment.