Add ability to add Authority Key Identifier to reconstructed SSL public cert

Author: sandeepmistry

src/utility/ECCX08Cert.cpp

@@ -73,6 +73,7 @@ ECCX08CertClass::ECCX08CertClass() :
   _keySlot(-1),
   _compressedCertSlot(-1),
   _serialNumberSlot(-1),
+  _authorityKeyIdentifier(NULL),
   _bytes(NULL),
   _length(0)
 {
@@ -334,10 +335,19 @@ int ECCX08CertClass::endReconstruction()
 
   int publicKeyLen = publicKeyLength();
 
+  int authorityKeyIdentifierLen = authorityKeyIdentifierLength(_authorityKeyIdentifier);
+
   int signatureLen = signatureLength(compressedCert.signature);
 
   int certInfoLen = 5 + serialNumberLen + 12 + issuerHeaderLen + issuerLen + 32 + 
-                    subjectHeaderLen + subjectLen + publicKeyLen + 4;
+                    subjectHeaderLen + subjectLen + publicKeyLen;
+
+  if (authorityKeyIdentifierLen) {
+    certInfoLen += authorityKeyIdentifierLen;
+  } else {
+    certInfoLen += 4;
+  }
+
   int certInfoHeaderLen = sequenceHeaderLength(certInfoLen);
 
   int certDataLen = certInfoLen + certInfoHeaderLen + signatureLen;
@@ -411,11 +421,16 @@ int ECCX08CertClass::endReconstruction()
   appendPublicKey(publicKey, out);
   out += publicKeyLen;
 
-  // null sequence
-  *out++ = 0xA3;
-  *out++ = 0x02;
-  *out++ = 0x30;
-  *out++ = 0x00;
+  if (authorityKeyIdentifierLen) {
+    appendAuthorityKeyIdentifier(_authorityKeyIdentifier, out);
+    out += authorityKeyIdentifierLen;
+  } else {
+    // null sequence
+    *out++ = 0xA3;
+    *out++ = 0x02;
+    *out++ = 0x30;
+    *out++ = 0x00;
+  }
 
   // signature
   appendSignature(compressedCert.signature, out);
@@ -494,6 +509,11 @@ void ECCX08CertClass::setSubjectCommonName(const String& commonName)
   _subjectCommonName = commonName;
 }
 
+void ECCX08CertClass::setAuthorityKeyIdentifier(const byte authorityKeyIdentifier[])
+{
+  _authorityKeyIdentifier = authorityKeyIdentifier;
+}
+
 int ECCX08CertClass::versionLength()
 {
   return 3;
@@ -546,6 +566,11 @@ int ECCX08CertClass::publicKeyLength()
   return (2 + 2 + 9 + 10 + 4 + 64);
 }
 
+int ECCX08CertClass::authorityKeyIdentifierLength(const byte authorityKeyIdentifier[])
+{
+  return (authorityKeyIdentifier == NULL) ? 0 : 37;
+}
+
 int ECCX08CertClass::signatureLength(const byte signature[])
 {
   const byte* r = &signature[0];
@@ -684,6 +709,41 @@ void ECCX08CertClass::appendPublicKey(const byte publicKey[], byte out[])
   memcpy(out, publicKey, 64);
 }
 
+void ECCX08CertClass::appendAuthorityKeyIdentifier(const byte authorityKeyIdentifier[], byte out[])
+{
+  // [3]
+  *out++ = 0xa3;
+  *out++ = 0x23;
+
+  // sequence
+  *out++ = ASN1_SEQUENCE;
+  *out++ = 0x21;
+
+  // sequence
+  *out++ = ASN1_SEQUENCE;
+  *out++ = 0x1f;
+
+  // 2.5.29.35 authorityKeyIdentifier(X.509 extension)
+  *out++ = 0x06;
+  *out++ = 0x03;
+  *out++ = 0x55;
+  *out++ = 0x1d;
+  *out++ = 0x23;
+
+  // octet string
+  *out++ = 0x04;
+  *out++ = 0x18;
+
+  // sequence
+  *out++ = ASN1_SEQUENCE;
+  *out++ = 0x16;
+
+  *out++ = 0x80;
+  *out++ = 0x14;
+
+  memcpy(out, authorityKeyIdentifier, 20);
+}
+
 void ECCX08CertClass::appendSignature(const byte signature[], byte out[])
 {
   // signature algorithm

src/utility/ECCX08Cert.h

@@ -42,6 +42,8 @@ class ECCX08CertClass {
   void setSubjectOrganizationalUnitName(const String& organizationalUnitName);
   void setSubjectCommonName(const String& commonName);
 
+  void setAuthorityKeyIdentifier(const byte authorityKeyIdentifier[]);
+
 private:
   int versionLength();
 
@@ -54,6 +56,8 @@ class ECCX08CertClass {
 
   int publicKeyLength();
 
+  int authorityKeyIdentifierLength(const byte authorityKeyIdentifier[]);
+
   int signatureLength(const byte signature[]);
 
   int serialNumberLength(const byte serialNumber[]);
@@ -72,6 +76,8 @@ class ECCX08CertClass {
 
   void appendPublicKey(const byte publicKey[], byte out[]);
 
+  void appendAuthorityKeyIdentifier(const byte authorityKeyIdentifier[], byte out[]);
+
   void appendSignature(const byte signature[], byte out[]);
 
   void appendSerialNumber(const byte serialNumber[], byte out[]);
@@ -103,6 +109,8 @@ class ECCX08CertClass {
   String _subjectOrganizationalUnitName;
   String _subjectCommonName;
 
+  const byte* _authorityKeyIdentifier;
+
   byte _temp[88];
   byte* _bytes;
   int _length;