formats icon indicating copy to clipboard operation
formats copied to clipboard

spki/pkcs8: add support for creating SPKI from PublicKey/VerifyingKey without going through the der

Open lumag opened this issue 2 years ago • 4 comments

If one wants to construct a certificate, he either has to go through the EncodePublicKey::to_public_key_der() and then parsing the resulting DER to form the SPKI or to create the SPKI manually.

My proposal is to add to_public_key_spki() method allowing one to skip the DER step by returning the corresponding SPKI structure (either by extending the EncodePublicKey trait or by adding a new trait for that).

lumag avatar Aug 18 '22 05:08 lumag

Sometimes serialization of SPKI requires building intermediate structures which can't be easily borrowed from the input, so I don't think it makes sense to mandate this via EncodePublicKey. You could use a From<&T> or TryFrom<&T> bound, though.

I think in the next release of the spki crate it would be good to make certain parts of SubjectPublicKeyInfo generic (namely the algorithm parameters and the subject_public_key body), so it's possible to support an owned form in addition to a borrowed form.

tarcieri avatar Aug 18 '22 13:08 tarcieri

Ack, I will take a look on implementing the From<&T>.

lumag avatar Aug 19 '22 09:08 lumag

@tarcieri So far I have tried changing SPKI (well, AlgorithmIdentifier) into generic item. I stumbled upon accepting any tag object instead of AnyRef. My dumb suggestion would be to define AnyTrait that defines all individual conversion options to return an error and then implementing this trait for tag objects by overriding individual conversion functions. Does that sound sane to you?

lumag avatar Aug 23 '22 07:08 lumag

@lumag it'd probably be good to open a separate issue for discussing the AlgorithmIdentifier changes. It will be a bit tricky.

tarcieri avatar Aug 29 '22 18:08 tarcieri

We made SubjectPublicKeyInfo generic which I think resolves this issue.

tarcieri avatar Aug 18 '24 17:08 tarcieri