Shibboleth Developers

["Tom Scavo" <>]

On Fri, Aug 8, 2008 at 5:07 PM, Scott Cantor 
<>
 wrote:
>
> So I guess I'm talking about the SubjectPublicKeyInfo format.

Not quite (we just finished working through this the last few days).
The SubjectPublicKeyInfo contains two fields, the AlgorithmIdentifier
and the bits of the public key.  The Subject Key Identifier (SKI)
extension is *usually* obtained by computing the SHA-1 hash of the
public key bits only (not the AlgorithmIdentifier), which is then
base64 encoded.  Not all certs have an SKI extension, and not all
those that do compute it as above, but it's the most common way to do
so.  (OpenSAML/Java does it this way, in fact.)

So one approach is the following.  If you have a cert, ignore the SKI
extension and compute the SKI as above.  If you have the key only,
compute the SKI as above.  So in all cases you end up with the same
thing.

Tom