Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The problem is the application which generates the CSR doesn't generate the hash.

How do I generate the hashcode?

Can I create a keystore object using this particular CSR and then extract the hash from it?

Or can anyone suggest any other technique?

Or is it not possible to generate the keystore object from an existing CSR?

share|improve this question
up vote 0 down vote accepted

I suppose that by CSR you mean a Certificate Request. A certificate request is something that is meant to be sent to a Certification Authority so that the CA may turn it into a Certificate. The request shall contain everything that the CA needs for that, i.e. everything that the CA cannot infer or generate by itself.

One critical piece of a certificate is the public key. In a PKI, the two usual emplacements for key pair generation is on the requester or on the CA: either the requester generates his own key pair and sends the public part to the CA as part of his request, or the CA generates the key pair and will send the private key to the requester along with the certificate. I assume that you mean the former: your "CSR generating tool" actually generates a key pair, and puts the public key in a certificate request.

There are several standard formats for certificate requests. A very common format is PKCS#10. If your problem indeed involves a PKCS#10 request containing a public key, which is to be extracted, then it is "just" a matter of locating the public key in the bunch of bytes. PKCS#10 uses ASN.1, with the structures defined in the RFC:

CertificationRequest ::= SEQUENCE {
     certificationRequestInfo CertificationRequestInfo,
     signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
     signature          BIT STRING

CertificationRequestInfo ::= SEQUENCE {
     version       INTEGER { v1(0) } (v1,...),
     subject       Name,
     subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
     attributes    [0] Attributes{{ CRIAttributes }}

SubjectPublicKeyInfo { ALGORITHM : IOSet} ::= SEQUENCE {
     algorithm        AlgorithmIdentifier {{IOSet}},
     subjectPublicKey BIT STRING

So the PKCS#10 request is a SEQUENCE whose first field is a CertificateRequestInfo structure, another SEQUENCE whose third field is a SubjectPublicKeyInfo, which contains the public key that you are looking for. THe public key consists in an identifier for the type of key, and the encoded key value itself.

Your task is now a matter of decoding. Parsing ASN.1/DER with custom code is doable, but requires care. You'd better use some existing library which will do all the hard job for you. OpenSSL can help; see its PEM_read_bio_X509_REQ() function for decoding, then X509_REQ_get_pubkey() (though it must be said that the OpenSSL documentation can be a bit daunting).

An important point is that a public key is a collection of a few mathematical objects, while a hash function takes as input a sequence of bits. So, in order to hash the public key, some sort of encoding must happen, and if you want to compute the right hash value, you must encode the key in exactly the way required by your situation (you say that you "have to provide... a SHA256 hash of the public key": I suppose that you have some sort of formal requirement which describes the exact format with all needed clarity).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.