Fix all cert lint errors

1. Truncate SerialNumber to 64 bits
2. Count unused bits in KeyUsage
3. Add SubjectKeyIdentifier extension
4. Add AuthorityKeyIdentifier extension
5. Make cert lint errors/warns fatal in CI
6. Update caliptra-cfi revision

fixes #74

Cargo.toml

@@ -11,7 +11,7 @@ members = [
 ]
 
 [workspace.dependencies]
-caliptra-cfi-lib-git = { git = "https://github.com/chipsalliance/caliptra-cfi.git", package = "caliptra-cfi-lib-git", rev = "9f315fcf11fe006e95e62149f54f98620e5244e7", default-features = false, features = ["cfi", "cfi-counter" ] }
-caliptra-cfi-derive-git = { git = "https://github.com/chipsalliance/caliptra-cfi.git", package = "caliptra-cfi-derive-git", rev = "9f315fcf11fe006e95e62149f54f98620e5244e7"}
+caliptra-cfi-lib-git = { git = "https://github.com/chipsalliance/caliptra-cfi.git", package = "caliptra-cfi-lib-git", rev = "a98e499d279e81ae85881991b1e9eee354151189", default-features = false, features = ["cfi", "cfi-counter" ] }
+caliptra-cfi-derive-git = { git = "https://github.com/chipsalliance/caliptra-cfi.git", package = "caliptra-cfi-derive-git", rev = "a98e499d279e81ae85881991b1e9eee354151189"}
 zerocopy = "0.6.6"
-openssl = "0.10.64"
+openssl = "0.10.64"

dpe/src/commands/certify_key.rs

@@ -15,8 +15,8 @@ use caliptra_cfi_lib_git::cfi_launder;
 #[cfg(not(feature = "no-cfi"))]
 use caliptra_cfi_lib_git::{cfi_assert, cfi_assert_eq};
 use cfg_if::cfg_if;
-use crypto::Crypto;
-use platform::{Platform, MAX_ISSUER_NAME_SIZE};
+use crypto::{Crypto, Hasher};
+use platform::{Platform, MAX_ISSUER_NAME_SIZE, MAX_SKI_SIZE};
 
 #[repr(C)]
 #[derive(Debug, PartialEq, Eq, zerocopy::FromBytes, zerocopy::AsBytes)]
@@ -109,10 +109,12 @@ impl CommandExecution for CertifyKeyCmd {
         let mut subj_serial = [0u8; DPE_PROFILE.get_hash_size() * 2];
         env.crypto
             .get_pubkey_serial(DPE_PROFILE.alg_len(), &pub_key, &mut subj_serial)?;
+        // The serial number of the subject can be at most 64 bytes
+        let truncated_subj_serial = &subj_serial[..64];
 
         let subject_name = Name {
             cn: DirectoryString::PrintableString(b"DPE Leaf"),
-            serial: DirectoryString::PrintableString(&subj_serial),
+            serial: DirectoryString::PrintableString(truncated_subj_serial),
         };
 
         // Get TCI Nodes
@@ -122,11 +124,26 @@ impl CommandExecution for CertifyKeyCmd {
         if tcb_count > MAX_HANDLES {
             return Err(DpeErrorCode::InternalError);
         }
+
+        let mut key_identifier = [0u8; MAX_SKI_SIZE];
+        // compute key identifier as SHA-256 hash of the DER encoded subject public key
+        let mut hasher = env.crypto.hash_initialize(crypto::AlgLen::Bit256)?;
+        hasher.update(&[0x04])?;
+        hasher.update(pub_key.x.bytes())?;
+        hasher.update(pub_key.y.bytes())?;
+        let hashed_pub_key = hasher.finish()?;
+        if hashed_pub_key.len() < MAX_SKI_SIZE {
+            return Err(DpeErrorCode::InternalError);
+        }
+        // truncate key identifier to 20 bytes
+        key_identifier.copy_from_slice(&hashed_pub_key.bytes()[..MAX_SKI_SIZE]);
+
         let measurements = MeasurementData {
             label: &self.label,
             tci_nodes: &nodes[..tcb_count],
             is_ca: self.uses_is_ca(),
             supports_recursive: dpe.support.recursive(),
+            key_identifier,
         };
 
         let mut issuer_name = [0u8; MAX_ISSUER_NAME_SIZE];
@@ -577,9 +594,10 @@ mod tests {
         env.crypto
             .get_pubkey_serial(DPE_PROFILE.alg_len(), &pub_key, &mut subj_serial)
             .unwrap();
+        let truncated_subj_serial = &subj_serial[..64];
         let subject_name = Name {
             cn: DirectoryString::PrintableString(b"DPE Leaf"),
-            serial: DirectoryString::PrintableString(&subj_serial),
+            serial: DirectoryString::PrintableString(truncated_subj_serial),
         };
         let expected_subject_name = format!(
             "CN={}, serialNumber={}",