Refactor certificate generation code in CertifyKey #373
Conversation
clundin25
force-pushed
the
refactor-x509
branch
from
8b484b1 to
f2b4f4c
Compare
| CertificateType::Exported => { | ||
| let cdi = env | ||
| .crypto | ||
| .derive_exported_cdi(algs, &digest, args.cdi_label)?; |
There was a problem hiding this comment.
nit: I wonder if the key derivation code should stay in the CertifyKey command implementation. Since it's not really related to X.509.
There was a problem hiding this comment.
I agree but I could not think of a way to do it.
Since they are an associated type of DpeEnv<impl DpeTypes> I don't think there is a type that we can use in the function signature.
Any ideas?
There was a problem hiding this comment.
The CDI is an associated type, but the key pair derivation functions return a raw public key that we can just pass into this function, right?
There was a problem hiding this comment.
I think the private key is still needed for the exported certificate since it's self signed.
This has made me realized that when I refactored the code, I deleted this portion!
There was a problem hiding this comment.
As discussed offlne, the cert should still be signed by the alias key
clundin25
force-pushed
the
refactor-x509
branch
3 times, most recently
from
586bb31 to
6ec4eff
Compare
…it can be used in DeriveContext.
clundin25
force-pushed
the
refactor-x509
branch
from
6ec4eff to
de8ee01
Compare
| pub cdi_label: &'a [u8], | ||
| pub key_label: &'a [u8], | ||
| pub context: &'a [u8], |
There was a problem hiding this comment.
nit: Can you comment where each of these are used in derivation? Mainly that context is used for both (I think)
clundin25
merged commit beba58d
into
chipsalliance:feature/gh-issue-caliptra-sw-1807
Refactor certificate generation code in CertifyKey to common code so it can be used in DeriveContext.