How to add attributes to a CSR?

[randix]

I haven't figured out how to add a username and challengePassword to a CertificationRequestBuilder.
In JavaScript, for the user, I have:

csr.setSubject([
          ...subject.split(',').map((part) => {
            const [shortName, value] = part.trim().split('=')
            return { shortName, value }
          }),
          {
            name: 'userid',
            shortName: 'UID',
            type: '0.9.2342.19200300.100.1.1',
            value: username,
          },
        ])

I think I need to add that as an attribute:

 let oid = [ (typeName: "name",      value: "userid"),
                  (typeName: "shortName", value: "UID"),
                  (typeName: "type",      value: "0.9.2342.19200300.100.1.1"),
                 (typeName: "value",     value: csrInput!.username)
        ]

and then:

let subject = try NameBuilder()
                .add(multiValued: oid)

but then I get a crash where it is parsed.

For the challengePassword, again, in Javascript:

csr.setAttributes([
              {
                name: 'challengePassword',
                value: password,
              },
            ])

I am trying this:

 var attributes: CRAttributes? = CRAttributes()
 let attrOid = iso.memberBody.us.rsadsi.pkcs.pkcs9.challengePassword.self
 attributes!.append(Attribute(attrType: attrOid.rawValue, attrValues: [csrInput!.password]))

And then:

let csrCSR = try CertificationRequest.Builder(subject: subject, attributes: attributes)
                .publicKey(keyPair: keyPairShort!, usage: [.keyCertSign, .cRLSign])
                .extendedKeyUsage(keyPurposes: [keyPurpose.clientAuth.oid, keyPurpose.serverAuth.oid], isCritical: true)
                .build(signingKey: keyPairShort!.privateKey, digestAlgorithm: .sha256)

but that crashes in .build().

This looks like a great library. I just found it today and am trying to understand it.

Do you have time to help me with those two issues?
Thanks! Randix

[kdubb]

Name Issue

I'm not sure what you mean when you say "crash where it is parsed" but using an example from the tests (CertificationReguestBuilderTests) I was able to generate a CSR and parse it in an online generator
(https://redkestrel.co.uk/products/decoder).

// Create name with `userid` value
let name = try NameBuilder()
  .add("Outfox Signing", forTypeName: "CN")
  .add("test-user", forType: itu.data.pss.ucl.pilot.pilotAttributeType.userId.oid)
  .name

let keyPurpose = iso.org.dod.internet.security.mechanisms.pkix.kp.self
let csr =
  try CertificationRequest.Builder()
    .subject(name: name)
    .alternativeNames(names: .dnsName("outfoxx.io"))
    .publicKey(keyPair: Self.keyPair, usage: [.keyCertSign, .cRLSign])
    .extendedKeyUsage(keyPurposes: [keyPurpose.clientAuth.oid, keyPurpose.serverAuth.oid], isCritical: true)
    .build(signingKey: Self.keyPair.privateKey, digestAlgorithm: .sha256)

This generated this CSR

MIIC0zCCAbsCAQAwNDEXMBUGA1UEAwwOT3V0Zm94IFNpZ25pbmcxGTAXBgoJkiaJk/IsZAEBDAl0ZXN0LXVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6HqYC2huxAZD+5X+01MxB1GsDrMyGZ+fvzjJwbsn8kQ7ypzx09wJR4aMTYh7oyrQr/2MplVnKYuuIwskiCyzzlLe8BElHbnDkWGcDgJ4oHKbMUTPr3mvZN9eIPZzPZUk3SUS+nBCcHUFXxFzimUU/l0eiYopwffMPB/FC5lhgoy4AiZGiKhWVKuPhj4mj6FQliBEQl3lu8M5hWFT6zDNg1FCImYEZSM6iGANfiSn1OLmyC7JdYdJQMeAX3g2CfSEyRyDDHY1qrgr3x/U6ZN+MTbd//SOixhkDxI4jd+9TC9f0qGLU859MMrg6ftzelXY6wHNbTvvz0h9VgxUrNNO/AgMBAAGgWjBYBgkqhkiG9w0BCQ4xSzBJMBUGA1UdEQQOMAyCCm91dGZveHguaW8wDgYDVR0PAQH/BAQDAgEGMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAQEAed3l/Rna4fc0Jl5rYh5GHzbauRwWNYgSh9D6JrQTLE8HyRglRgu9kYEyUt//deOXTPzx0JiCv2l4EakbLzVZ3aZR2g4xbsbzjoUMFjRciM1DXkdFFBX5BaG/MJ0OyI3OJgvktMToQbGpeQA4hgeqGZAyFRGMggenT+NAJrkIdAqSIkTWGXFODowc1Fq+snwXDCGT32ufpbk4tNScoZS9sv9H9UCNZDd5/Fm16re1hS/xSDmKi34i9p89DilXbYrOENgXwgz9n4ruzlYdV03bjRUcJPJYPa1KpbIi63IHDShO9aGQKOSNsVkYf0Z+1Y76h4KHGes8AB8d6EsO6k7GTw==

[randix]

Thanks! That works for getting the UID inserted.

Can you help me with the second part, getting the attribute with the "challengePassword", which we want to use with the above UID?

[kdubb]

Attributes Issue

The attributes issue is a bit more nuanced. Shield cannot encode "any imaginable attribute" because each attribute has a defined ASN.1 encoding rule. Because of that, for unsupported attributes, you need to encode the value in ASN.1 yourself.

Had you used the CRAttributes.append(type:,values:) function, you would have been forced to provide an ASN.1 value.

Generate CSR with challengePassword attribute.

    var extraAttributes = CRAttributes()
    extraAttributes.append(type: iso.memberBody.us.rsadsi.pkcs.pkcs9.challengePassword.oid, values: [.utf8String("challenge")])

    let keyPurpose = iso.org.dod.internet.security.mechanisms.pkix.kp.self
    let csr =
      try CertificationRequest.Builder(attributes: extraAttributes)
        .subject(name: NameBuilder().add("Outfox Signing", forTypeName: "CN").name)
        .alternativeNames(names: .dnsName("outfoxx.io"))
        .publicKey(keyPair: Self.keyPair, usage: [.keyCertSign, .cRLSign])
        .extendedKeyUsage(keyPurposes: [keyPurpose.clientAuth.oid, keyPurpose.serverAuth.oid], isCritical: true)
        .build(signingKey: Self.keyPair.privateKey, digestAlgorithm: .sha256)

Generated CSR

MIIC0jCCAboCAQAwGTEXMBUGA1UEAwwOT3V0Zm94IFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtUEwTVy8IZuflSOQNoRdmJSvGaqCJ1nLRB5Bb8p04G1d7pY21TiXeRzMroIfgTmTY2u4tgfD5EY20vM01YysaDr2iUDDEO/MZG9OTBLCF/5R6s+XfsBEJOqfi5OpT0XhWk2PUBv2zzuUK2eLTLWTO3fKpVly8c1SUpyjQWBqY6j+18gfHOMg14AyH4FearyZt5q8eksIw/k7/rurt7YsLkNAyx5U7IBSpD4fBkTaJwr1NFFSiCQTvybkm2jUWO1YGmsbKl9C9/YYVbxrOuI+8T1ZsAApzdqc77QS+86HEGYzsikMEbZ1tVOFn0A0VxlDM/XqyHEu7VnHkXa5J2HoHAgMBAAGgdDAYBgkqhkiG9w0BCQcxCwwJY2hhbGxlbmdlMFgGCSqGSIb3DQEJDjFLMEkwFQYDVR0RBA4wDIIKb3V0Zm94eC5pbzAOBgNVHQ8BAf8EBAMCAQYwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBTRWmfkNVGin2A3U1YNTO0YiOGO4RaZ2oV7wM4+OdCLE1Le15a0gleSS7QW7XSXbJAnWr+aflnuvLCDbcN19VCaReBlnFqrh6yJRqNkvFofBFzLsTEEMEgghOH0agN8NlyPPCHmEeoxNZymC0L5yGlu5fMVm9HNUlsq5b5IebDW1WyHuF5qc5xjUkLD5FJhtE8l8NBKIewzpw3PaJIT7SvJOLxNVWxORXCKVlRCpXuEO/tUTZJaIZmZ1ylDucFRlmFTRwkfJEDCktCP8HSwPKLk1bS4ywaMqYxDezjqIdqjAHz8k611A5rla1pvPCNmlbPL89SOXWju5U73ZydSnL5

Disclaimer

I don't know the exact encoding to use for challengePassword. In the example above I used UTF8 String (see above ... values: [.utf8String("challenge")]) but you can provide it any ASN1 value and it will encode it.

The online parser I tested with seems to understand UTF8 String and I saw at lease one example using Printable String.

[randix]

Thank you, kdubb! I am very impressed. That solved my problem, I added the extrAttributes and sent the CSR to our server and got our signed certificate back.