upki: use aws-lc-rs for hashing

Author: djc

Cargo.lock

@@ -13,7 +13,7 @@ aws-lc-rs = "1.15.2"
 base64 = "0.22.1"
 chrono = { version = "0.4.42", features = ["alloc"], default-features = false }
 clap = { version = "4.5", features = ["derive"] }
-clubcard-crlite = "0.5"
+clubcard-crlite = { version = "0.5", default-features = false, features = ["bincode"] }
 criterion = "0.8"
 csv = "1.4"
 directories = "6"

Cargo.toml

@@ -117,16 +117,16 @@ impl ServerVerifier {
             return self.policy.cert_has_no_scts.as_result();
         }
 
-        let input = RevocationCheckInput {
-            cert_serial: CertSerial(
+        let input = RevocationCheckInput::new(
+            CertSerial(
                 verified_path
                     .end_entity()
                     .serial()
                     .to_vec(),
             ),
-            issuer_spki_hash: IssuerSpkiHash(issuer_spki_hash),
+            IssuerSpkiHash(issuer_spki_hash),
             sct_timestamps,
-        };
+        );
 
         match Index::from_cache(&self.config).and_then(|mut index| index.check(&input)) {
             Ok(rs) => Ok(rs),

rustls-upki/src/lib.rs

@@ -449,14 +449,14 @@ mod tests {
     }
 
     fn test_input() -> RevocationCheckInput {
-        RevocationCheckInput {
-            cert_serial: CertSerial(vec![1, 2, 3]),
-            issuer_spki_hash: IssuerSpkiHash([0xaa; 32]),
-            sct_timestamps: vec![CtTimestamp {
+        RevocationCheckInput::new(
+            CertSerial(vec![1, 2, 3]),
+            IssuerSpkiHash([0xaa; 32]),
+            vec![CtTimestamp {
                 log_id: [0xbb; 32],
                 timestamp: 1000,
             }],
-        }
+        )
     }
 
     #[expect(clippy::type_complexity)]

upki/src/revocation/index.rs

@@ -126,6 +126,7 @@ pub struct RevocationCheckInput {
     pub issuer_spki_hash: IssuerSpkiHash,
     /// CT log IDs and inclusion timestamps present in the end-entity certificate.
     pub sct_timestamps: Vec<CtTimestamp>,
+    issuer_serial_hash: [u8; 32],
 }
 
 impl RevocationCheckInput {
@@ -151,7 +152,7 @@ impl RevocationCheckInput {
             digest::digest(&digest::SHA256, &webpki::spki_for_anchor(&issuer))
                 .as_ref()
                 .try_into()
-                .expect("sha256 output must be [u8;32]"),
+                .expect("sha256 output must be [u8; 32]"),
         );
 
         let mut sct_timestamps = vec![];
@@ -167,15 +168,42 @@ impl RevocationCheckInput {
             });
         }
 
-        Ok(Self {
-            cert_serial: CertSerial(end_entity.serial().into()),
+        Ok(Self::new(
+            CertSerial(end_entity.serial().to_vec()),
             issuer_spki_hash,
             sct_timestamps,
-        })
+        ))
+    }
+
+    /// Construct a `RevocationCheckInput` from its constituent parts.
+    pub fn new(
+        cert_serial: CertSerial,
+        issuer_spki_hash: IssuerSpkiHash,
+        sct_timestamps: Vec<CtTimestamp>,
+    ) -> Self {
+        let mut issuer_serial_context = digest::Context::new(&digest::SHA256);
+        issuer_serial_context.update(&cert_serial.0);
+        issuer_serial_context.update(&issuer_spki_hash.0);
+        let issuer_serial_hash = issuer_serial_context
+            .finish()
+            .as_ref()
+            .try_into()
+            .expect("sha256 output must be [u8; 32]");
+
+        Self {
+            cert_serial,
+            issuer_spki_hash,
+            sct_timestamps,
+            issuer_serial_hash,
+        }
     }
 
     fn key(&self) -> CRLiteKey<'_> {
-        CRLiteKey::new(&self.issuer_spki_hash, &self.cert_serial.0)
+        CRLiteKey::with_hash(
+            &self.issuer_spki_hash,
+            &self.cert_serial.0,
+            self.issuer_serial_hash,
+        )
     }
 }