Subject: Authority Key Identifier

From: "Jong 't, D (Dennis)" <[email-masked]>
Date: Mon, 21 Oct 2002 13:28:31 +0200

LS,

I have a question regarding the Authority Key Identifier (AKI) in an x509
certificate. When we resolve the AKI from the "CERT_CONTEXT" (MS IIS), it
returns a 24 bytes structure, like:
30 16 80 14 b2 b6 f2 cb eb d0 b2 26 79 eb 8b 99 74 77 e2 df 2f d5 20 69

The AKI should be 20 bytes long (RFC 2459, 4.2.1.2 using 160 bit SHA-1),
like:
b2 b6 f2 cb eb d0 b2 26 79 eb 8b 99 74 77 e2 df 2f d5 20 69

Does anyone know the purpose of those 4 trailing bytes? If Yes, is it save
to cut them off to substract the original AKI?

Met vriendelijke groet/with kind regards,
 
Dennis 't Jong
Technisch Specialist
Windows Server Management O&O - Beveiliging 

Rabobank ICT           Tel:    +31 30 21 52772
Kamer ZL-R255          Fax:    +31 30 21 51893
Laan van Eikenstein 9  Mobiel: +31 6 24481180
3705 AR Zeist          Email:  [email-masked] 
Nederland              Web:    http://www.RabobankICT.nl 

================================================
De informatie opgenomen in dit bericht kan vertrouwelijk zijn en 
is uitsluitend bestemd voor de geadresseerde. Indien u dit bericht 
onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en 
de afzender direct te informeren door het bericht te retourneren. 
================================================
The information contained in this message may be confidential 
and is intended to be exclusively for the addressee. Should you 
receive this message unintentionally, please do not use the contents 
herein and notify the sender immediately by return e-mail.

---

From: "Housley, Russ" <[email-masked]>
Date: Mon, 21 Oct 2002 07:57:22 -0400

The Authority key identifier is only used to aid in certification path 
construction.  The recipient should not expect to use it in any manner 
other than exact string matching.  RFC 2459 and RFC 3780 recommend methods 
for assigning the key identifiers, but other methods are permitted.

Russ