Subject: Re: Computation of issuerKeyHash in OCSP

From: [email-masked] (Peter Gutmann)
Date: Tue, 13 Mar 2001 04:50:03 (NZDT)

>I'd be grateful for clarification of the following point, regarding the
>computation of the issuerKeyHash term in the CertID information used in OCSP
>(v1).

The weird hashing is a perpetual source of trouble for implementors (I
eventually found it out by trial and error), what you need to do is take the
BIT STRING part of the subjectPublicKeyInfo, strip off the BIT STRING tag and
the length and the unused-bits value, and hash what's left.  A much easier
solution (and one I hope everyone adopts with all haste) is to use v2 ID's such
as the standard issuerAndSerialNumber or a cert hash (aka thumbprint) which
most software seems to be able to handle.

Peter.

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 12 Mar 2001 14:07:53 -0800

Peter,

The OCSPv2 I-D expands certificate identification as follows:

ReqCert  ::= CHOICE {
   certID            CertID,
   issuerSerial      [0] IssuerandSerialNumber,
   pKCert            [1] Certificate,
   name              [2] GeneralName,
   certHash          [3] OCTET STRING}

CertID          ::=     SEQUENCE {
   hashAlgorithm       AlgorithmIdentifier,
   issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
   issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
   serialNumber        CertificateSerialNumber }

So only in the case of CertID is issuerKeyHash calculation required.  The
issuerSerial options imports IssuerandSerialNumber syntax from CMS.  Do
these actions address the points you raised?

Mike

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, March 13, 2001 4:50 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Computation of issuerKeyHash in OCSP
>
>