About SubjecKeyIdentifier computation method2

[fco-code-org]

Hello,
From RFC rfc5280, at §4.2.1.2, it is written:
"For CA certificates, subject key identifiers SHOULD be derived from
the public key or a method that generates unique values
Two common methods for generating key identifiers from the public key" could be used.

Method2:
" The keyIdentifier is composed of a four-bit type field with
the value 0100 followed by the least significant 60 bits of
the SHA-1 hash of the value of the BIT STRING
subjectPublicKey (excluding the tag, length, and number of
unused bits)."

Let's say I have the public key, do you have some code sample which follows method2 ?

I have seen that (see below) but I don't know if it follows method2 or method1 (should be method1 it seems to me)
private SubjectKeyIdentifier getSubjectKeyIdentifier(PublicKey publicKey)
throws IOException
{
InputStream input;
SubjectPublicKeyInfo keyInfo;

input = new ByteArrayInputStream(publicKey.getEncoded());
keyInfo = new SubjectPublicKeyInfo((ASN1Sequence)new ASN1InputStream(input).readObject());

return SubjectKeyIdentifier(keyInfo);

}

Once SubjectKeyIdentifier is returned then we can call getKeyIdentifier() method.

So if I am right, meaning that the code above follow method1, do you have sample code which is compliant with method2 ?

In such case, with the public key, I may do :
MessageDigest mDigest = MessageDigest.getInstance("SHA1");
byte[] result = mDigest.digest(publicKey.getEncoded());

Then I concanate 0100 with the least significant 60 bits of result.
Is it correct?

Best Regards.

[fco-code-org]

Hello again,

Found the solution.
Sorry for the sollicitation.

SubjectPublicKeyInfo spki = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());
JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

// Generates the 64-bit truncated SKI (0100 prefix + 60 LSBs of SHA-1)
SubjectKeyIdentifier skiMethod2 = extUtils.createTruncatedSubjectKeyIdentifier(spki);

Best Regards.

[fco-code-org]

Find the solution