From 630514d844a3f0b52e18a5a34566eb54322bd9a5 Mon Sep 17 00:00:00 2001
From: Tony Arcieri <bascule@gmail.com>
Date: Fri, 25 Nov 2022 15:01:36 -0700
Subject: [PATCH 1/5] [WIP] spki: make `AlgorithmIdentifier` generic around
 `Params`

NOTE: breaking change.

Previously `AlgorithmIdentifier::parameters` were always `AnyRef`.
This commit changes them to a generic parameter `Params`.

An alias `AlgorithmIdentifierRef` provides a type identical to the
original with `AnyRef` as its `parameters`, which is used in all of the
other crates in this repo.
---
 pkcs1/src/lib.rs                    |   2 +-
 pkcs1/src/params.rs                 |  22 +++---
 pkcs5/src/lib.rs                    |  12 ++--
 pkcs5/src/pbes1.rs                  |   8 +--
 pkcs5/src/pbes2.rs                  |  20 +++---
 pkcs5/src/pbes2/kdf.rs              |  22 +++---
 pkcs7/src/enveloped_data_content.rs |   4 +-
 pkcs7/tests/content_tests.rs        |   4 +-
 pkcs8/src/error.rs                  |   2 +-
 pkcs8/src/lib.rs                    |   2 +-
 pkcs8/src/private_key_info.rs       |  10 +--
 sec1/src/traits.rs                  |   2 +-
 spki/src/algorithm.rs               | 101 ++++++++++++++++------------
 spki/src/lib.rs                     |   6 +-
 spki/src/spki.rs                    |   7 +-
 x509-cert/src/certificate.rs        |   6 +-
 x509-cert/src/crl.rs                |   6 +-
 x509-cert/src/request.rs            |   4 +-
 x509-cert/tests/certificate.rs      |   4 +-
 x509-ocsp/src/lib.rs                |  12 ++--
 20 files changed, 138 insertions(+), 118 deletions(-)

diff --git a/pkcs1/src/lib.rs b/pkcs1/src/lib.rs
index 84dc6ab44..cf18ef593 100644
--- a/pkcs1/src/lib.rs
+++ b/pkcs1/src/lib.rs
@@ -52,7 +52,7 @@ pub const ALGORITHM_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.84
 /// `AlgorithmIdentifier` for RSA.
 #[cfg(feature = "pkcs8")]
 #[cfg_attr(docsrs, doc(cfg(feature = "pkcs8")))]
-pub const ALGORITHM_ID: pkcs8::AlgorithmIdentifier<'static> = pkcs8::AlgorithmIdentifier {
+pub const ALGORITHM_ID: pkcs8::AlgorithmIdentifierRef<'static> = pkcs8::AlgorithmIdentifierRef {
     oid: ALGORITHM_OID,
     parameters: Some(der::asn1::AnyRef::NULL),
 };
diff --git a/pkcs1/src/params.rs b/pkcs1/src/params.rs
index e803473e0..b2080893f 100644
--- a/pkcs1/src/params.rs
+++ b/pkcs1/src/params.rs
@@ -6,7 +6,7 @@ use der::{
     asn1::ContextSpecificRef, Decode, DecodeValue, Encode, EncodeValue, FixedTag, Reader, Sequence,
     Tag, TagMode, TagNumber, Writer,
 };
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 
 const OID_SHA_1: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.3.14.3.2.26");
 const OID_MGF_1: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.840.113549.1.1.8");
@@ -15,7 +15,7 @@ const OID_PSPECIFIED: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.840.1
 // TODO(tarcieri): make `AlgorithmIdentifier` generic around params; use `OID_SHA_1`
 const SEQ_OID_SHA_1_DER: &[u8] = &[0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a];
 
-const SHA_1_AI: AlgorithmIdentifier<'_> = AlgorithmIdentifier {
+const SHA_1_AI: AlgorithmIdentifierRef<'_> = AlgorithmIdentifierRef {
     oid: OID_SHA_1,
     parameters: None,
 };
@@ -81,10 +81,10 @@ impl FixedTag for TrailerField {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct RsaPssParams<'a> {
     /// Hash Algorithm
-    pub hash: AlgorithmIdentifier<'a>,
+    pub hash: AlgorithmIdentifierRef<'a>,
 
     /// Mask Generation Function (MGF)
-    pub mask_gen: AlgorithmIdentifier<'a>,
+    pub mask_gen: AlgorithmIdentifierRef<'a>,
 
     /// Salt length
     pub salt_len: u8,
@@ -180,8 +180,8 @@ impl<'a> TryFrom<&'a [u8]> for RsaPssParams<'a> {
 }
 
 /// Default Mask Generation Function (MGF): SHA-1.
-fn default_mgf1_sha1<'a>() -> AlgorithmIdentifier<'a> {
-    AlgorithmIdentifier {
+fn default_mgf1_sha1<'a>() -> AlgorithmIdentifierRef<'a> {
+    AlgorithmIdentifierRef {
         oid: OID_MGF_1,
         parameters: Some(
             AnyRef::new(Tag::Sequence, SEQ_OID_SHA_1_DER)
@@ -208,13 +208,13 @@ fn default_mgf1_sha1<'a>() -> AlgorithmIdentifier<'a> {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct RsaOaepParams<'a> {
     /// Hash Algorithm
-    pub hash: AlgorithmIdentifier<'a>,
+    pub hash: AlgorithmIdentifierRef<'a>,
 
     /// Mask Generation Function (MGF)
-    pub mask_gen: AlgorithmIdentifier<'a>,
+    pub mask_gen: AlgorithmIdentifierRef<'a>,
 
     /// The source (and possibly the value) of the label L
-    pub p_source: AlgorithmIdentifier<'a>,
+    pub p_source: AlgorithmIdentifierRef<'a>,
 }
 
 impl<'a> Default for RsaOaepParams<'a> {
@@ -291,8 +291,8 @@ impl<'a> TryFrom<&'a [u8]> for RsaOaepParams<'a> {
 }
 
 /// Default Source Algorithm, empty string
-fn default_pempty_string<'a>() -> AlgorithmIdentifier<'a> {
-    AlgorithmIdentifier {
+fn default_pempty_string<'a>() -> AlgorithmIdentifierRef<'a> {
+    AlgorithmIdentifierRef {
         oid: OID_PSPECIFIED,
         parameters: Some(
             AnyRef::new(Tag::OctetString, &[]).expect("error creating default OAEP params"),
diff --git a/pkcs5/src/lib.rs b/pkcs5/src/lib.rs
index 7019ee439..f658307c3 100644
--- a/pkcs5/src/lib.rs
+++ b/pkcs5/src/lib.rs
@@ -12,7 +12,7 @@
 //!
 //! The main API for this crate is the [`EncryptionScheme`] enum, which impls
 //! the [`Decode`] and [`Encode`] traits from the [`der`] crate, and can be
-//! used for decoding/encoding PKCS#5 [`AlgorithmIdentifier`] fields.
+//! used for decoding/encoding PKCS#5 `AlgorithmIdentifier` fields.
 //!
 //! [RFC 8018]: https://tools.ietf.org/html/rfc8018
 
@@ -26,7 +26,7 @@ pub mod pbes2;
 
 pub use crate::error::{Error, Result};
 pub use der::{self, asn1::ObjectIdentifier};
-pub use spki::AlgorithmIdentifier;
+pub use spki::AlgorithmIdentifierRef;
 
 use der::{Decode, DecodeValue, Encode, Header, Reader, Sequence, Tag};
 
@@ -136,7 +136,7 @@ impl<'a> EncryptionScheme<'a> {
 
 impl<'a> DecodeValue<'a> for EncryptionScheme<'a> {
     fn decode_value<R: Reader<'a>>(decoder: &mut R, header: Header) -> der::Result<Self> {
-        AlgorithmIdentifier::decode_value(decoder, header)?.try_into()
+        AlgorithmIdentifierRef::decode_value(decoder, header)?.try_into()
     }
 }
 
@@ -164,10 +164,10 @@ impl<'a> From<pbes2::Parameters<'a>> for EncryptionScheme<'a> {
     }
 }
 
-impl<'a> TryFrom<AlgorithmIdentifier<'a>> for EncryptionScheme<'a> {
+impl<'a> TryFrom<AlgorithmIdentifierRef<'a>> for EncryptionScheme<'a> {
     type Error = der::Error;
 
-    fn try_from(alg: AlgorithmIdentifier<'a>) -> der::Result<EncryptionScheme<'_>> {
+    fn try_from(alg: AlgorithmIdentifierRef<'a>) -> der::Result<EncryptionScheme<'_>> {
         if alg.oid == pbes2::PBES2_OID {
             match alg.parameters {
                 Some(params) => pbes2::Parameters::try_from(params).map(Into::into),
@@ -183,6 +183,6 @@ impl<'a> TryFrom<&'a [u8]> for EncryptionScheme<'a> {
     type Error = der::Error;
 
     fn try_from(bytes: &'a [u8]) -> der::Result<EncryptionScheme<'a>> {
-        AlgorithmIdentifier::from_der(bytes)?.try_into()
+        AlgorithmIdentifierRef::from_der(bytes)?.try_into()
     }
 }
diff --git a/pkcs5/src/pbes1.rs b/pkcs5/src/pbes1.rs
index 735070562..7a1165f8e 100644
--- a/pkcs5/src/pbes1.rs
+++ b/pkcs5/src/pbes1.rs
@@ -2,7 +2,7 @@
 //!
 //! [RFC 8018 Section 6.1]: https://tools.ietf.org/html/rfc8018#section-6.1
 
-use crate::AlgorithmIdentifier;
+use crate::AlgorithmIdentifierRef;
 use der::{
     asn1::{AnyRef, ObjectIdentifier, OctetStringRef},
     Decode, Encode, ErrorKind, Length, Reader, Sequence, Tag, Writer,
@@ -68,7 +68,7 @@ impl Algorithm {
 
 impl<'a> Decode<'a> for Algorithm {
     fn decode<R: Reader<'a>>(decoder: &mut R) -> der::Result<Self> {
-        AlgorithmIdentifier::decode(decoder)?.try_into()
+        AlgorithmIdentifierRef::decode(decoder)?.try_into()
     }
 }
 
@@ -81,10 +81,10 @@ impl Sequence<'_> for Algorithm {
     }
 }
 
-impl<'a> TryFrom<AlgorithmIdentifier<'a>> for Algorithm {
+impl<'a> TryFrom<AlgorithmIdentifierRef<'a>> for Algorithm {
     type Error = der::Error;
 
-    fn try_from(alg: AlgorithmIdentifier<'a>) -> der::Result<Self> {
+    fn try_from(alg: AlgorithmIdentifierRef<'a>) -> der::Result<Self> {
         // Ensure that we have a supported PBES1 algorithm identifier
         let encryption = EncryptionScheme::try_from(alg.oid)
             .map_err(|_| der::Tag::ObjectIdentifier.value_error())?;
diff --git a/pkcs5/src/pbes2.rs b/pkcs5/src/pbes2.rs
index 8d63f114b..288dee407 100644
--- a/pkcs5/src/pbes2.rs
+++ b/pkcs5/src/pbes2.rs
@@ -12,7 +12,7 @@ pub use self::kdf::{
     PBKDF2_OID, SCRYPT_OID,
 };
 
-use crate::{AlgorithmIdentifier, Error, Result};
+use crate::{AlgorithmIdentifierRef, Error, Result};
 use der::{
     asn1::{AnyRef, ObjectIdentifier, OctetStringRef},
     Decode, Encode, ErrorKind, Length, Reader, Sequence, Tag, Writer,
@@ -220,8 +220,8 @@ impl<'a> TryFrom<AnyRef<'a>> for Parameters<'a> {
 
     fn try_from(any: AnyRef<'a>) -> der::Result<Self> {
         any.sequence(|params| {
-            let kdf = AlgorithmIdentifier::decode(params)?;
-            let encryption = AlgorithmIdentifier::decode(params)?;
+            let kdf = AlgorithmIdentifierRef::decode(params)?;
+            let encryption = AlgorithmIdentifierRef::decode(params)?;
 
             Ok(Self {
                 kdf: kdf.try_into()?,
@@ -305,14 +305,14 @@ impl<'a> EncryptionScheme<'a> {
 
 impl<'a> Decode<'a> for EncryptionScheme<'a> {
     fn decode<R: Reader<'a>>(reader: &mut R) -> der::Result<Self> {
-        AlgorithmIdentifier::decode(reader).and_then(TryInto::try_into)
+        AlgorithmIdentifierRef::decode(reader).and_then(TryInto::try_into)
     }
 }
 
-impl<'a> TryFrom<AlgorithmIdentifier<'a>> for EncryptionScheme<'a> {
+impl<'a> TryFrom<AlgorithmIdentifierRef<'a>> for EncryptionScheme<'a> {
     type Error = der::Error;
 
-    fn try_from(alg: AlgorithmIdentifier<'a>) -> der::Result<Self> {
+    fn try_from(alg: AlgorithmIdentifierRef<'a>) -> der::Result<Self> {
         // TODO(tarcieri): support for non-AES algorithms?
         let iv = match alg.parameters {
             Some(params) => params.octet_string()?.as_bytes(),
@@ -352,7 +352,7 @@ impl<'a> TryFrom<AlgorithmIdentifier<'a>> for EncryptionScheme<'a> {
     }
 }
 
-impl<'a> TryFrom<EncryptionScheme<'a>> for AlgorithmIdentifier<'a> {
+impl<'a> TryFrom<EncryptionScheme<'a>> for AlgorithmIdentifierRef<'a> {
     type Error = der::Error;
 
     fn try_from(scheme: EncryptionScheme<'a>) -> der::Result<Self> {
@@ -366,7 +366,7 @@ impl<'a> TryFrom<EncryptionScheme<'a>> for AlgorithmIdentifier<'a> {
             EncryptionScheme::DesEde3Cbc { iv } => iv,
         })?;
 
-        Ok(AlgorithmIdentifier {
+        Ok(AlgorithmIdentifierRef {
             oid: scheme.oid(),
             parameters: Some(parameters.into()),
         })
@@ -375,10 +375,10 @@ impl<'a> TryFrom<EncryptionScheme<'a>> for AlgorithmIdentifier<'a> {
 
 impl<'a> Encode for EncryptionScheme<'a> {
     fn encoded_len(&self) -> der::Result<Length> {
-        AlgorithmIdentifier::try_from(*self)?.encoded_len()
+        AlgorithmIdentifierRef::try_from(*self)?.encoded_len()
     }
 
     fn encode(&self, writer: &mut dyn Writer) -> der::Result<()> {
-        AlgorithmIdentifier::try_from(*self)?.encode(writer)
+        AlgorithmIdentifierRef::try_from(*self)?.encode(writer)
     }
 }
diff --git a/pkcs5/src/pbes2/kdf.rs b/pkcs5/src/pbes2/kdf.rs
index 3fc107488..eb389ff71 100644
--- a/pkcs5/src/pbes2/kdf.rs
+++ b/pkcs5/src/pbes2/kdf.rs
@@ -1,6 +1,6 @@
 //! Key derivation functions.
 
-use crate::{AlgorithmIdentifier, Error, Result};
+use crate::{AlgorithmIdentifierRef, Error, Result};
 use der::{
     asn1::{AnyRef, ObjectIdentifier, OctetStringRef},
     Decode, Encode, ErrorKind, Length, Reader, Sequence, Tag, Tagged, Writer,
@@ -100,7 +100,7 @@ impl<'a> Kdf<'a> {
 
 impl<'a> Decode<'a> for Kdf<'a> {
     fn decode<R: Reader<'a>>(reader: &mut R) -> der::Result<Self> {
-        AlgorithmIdentifier::decode(reader)?.try_into()
+        AlgorithmIdentifierRef::decode(reader)?.try_into()
     }
 }
 
@@ -128,10 +128,10 @@ impl<'a> From<ScryptParams<'a>> for Kdf<'a> {
     }
 }
 
-impl<'a> TryFrom<AlgorithmIdentifier<'a>> for Kdf<'a> {
+impl<'a> TryFrom<AlgorithmIdentifierRef<'a>> for Kdf<'a> {
     type Error = der::Error;
 
-    fn try_from(alg: AlgorithmIdentifier<'a>) -> der::Result<Self> {
+    fn try_from(alg: AlgorithmIdentifierRef<'a>) -> der::Result<Self> {
         if let Some(params) = alg.parameters {
             match alg.oid {
                 PBKDF2_OID => params.try_into().map(Self::Pbkdf2),
@@ -242,7 +242,7 @@ impl<'a> TryFrom<AnyRef<'a>> for Pbkdf2Params<'a> {
                 salt: OctetStringRef::decode(reader)?.as_bytes(),
                 iteration_count: reader.decode()?,
                 key_length: reader.decode()?,
-                prf: Option::<AlgorithmIdentifier<'_>>::decode(reader)?
+                prf: Option::<AlgorithmIdentifierRef<'_>>::decode(reader)?
                     .map(TryInto::try_into)
                     .transpose()?
                     .unwrap_or_default(),
@@ -298,10 +298,10 @@ impl Default for Pbkdf2Prf {
     }
 }
 
-impl<'a> TryFrom<AlgorithmIdentifier<'a>> for Pbkdf2Prf {
+impl<'a> TryFrom<AlgorithmIdentifierRef<'a>> for Pbkdf2Prf {
     type Error = der::Error;
 
-    fn try_from(alg: AlgorithmIdentifier<'a>) -> der::Result<Self> {
+    fn try_from(alg: AlgorithmIdentifierRef<'a>) -> der::Result<Self> {
         if let Some(params) = alg.parameters {
             // TODO(tarcieri): support non-NULL parameters?
             if !params.is_null() {
@@ -323,12 +323,12 @@ impl<'a> TryFrom<AlgorithmIdentifier<'a>> for Pbkdf2Prf {
     }
 }
 
-impl<'a> From<Pbkdf2Prf> for AlgorithmIdentifier<'a> {
+impl<'a> From<Pbkdf2Prf> for AlgorithmIdentifierRef<'a> {
     fn from(prf: Pbkdf2Prf) -> Self {
         // TODO(tarcieri): support non-NULL parameters?
         let parameters = der::asn1::Null;
 
-        AlgorithmIdentifier {
+        AlgorithmIdentifierRef {
             oid: prf.oid(),
             parameters: Some(parameters.into()),
         }
@@ -337,11 +337,11 @@ impl<'a> From<Pbkdf2Prf> for AlgorithmIdentifier<'a> {
 
 impl Encode for Pbkdf2Prf {
     fn encoded_len(&self) -> der::Result<Length> {
-        AlgorithmIdentifier::try_from(*self)?.encoded_len()
+        AlgorithmIdentifierRef::try_from(*self)?.encoded_len()
     }
 
     fn encode(&self, writer: &mut dyn Writer) -> der::Result<()> {
-        AlgorithmIdentifier::try_from(*self)?.encode(writer)
+        AlgorithmIdentifierRef::try_from(*self)?.encode(writer)
     }
 }
 
diff --git a/pkcs7/src/enveloped_data_content.rs b/pkcs7/src/enveloped_data_content.rs
index 2efe404d6..02e4f053b 100644
--- a/pkcs7/src/enveloped_data_content.rs
+++ b/pkcs7/src/enveloped_data_content.rs
@@ -6,9 +6,9 @@ use der::{
     asn1::{ContextSpecific, OctetStringRef},
     DecodeValue, Encode, Header, Reader, Sequence, TagMode, TagNumber,
 };
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 
-type ContentEncryptionAlgorithmIdentifier<'a> = AlgorithmIdentifier<'a>;
+type ContentEncryptionAlgorithmIdentifier<'a> = AlgorithmIdentifierRef<'a>;
 
 const ENCRYPTED_CONTENT_TAG: TagNumber = TagNumber::new(0);
 
diff --git a/pkcs7/tests/content_tests.rs b/pkcs7/tests/content_tests.rs
index b542e8139..be8dca179 100644
--- a/pkcs7/tests/content_tests.rs
+++ b/pkcs7/tests/content_tests.rs
@@ -9,7 +9,7 @@ use pkcs7::{
     encrypted_data_content::EncryptedDataContent, enveloped_data_content::EncryptedContentInfo,
     ContentInfo, ContentType,
 };
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 use std::fs;
 
 fn encode_content_info<'a>(content_info: &ContentInfo<'a>, buf: &'a mut [u8]) -> &'a [u8] {
@@ -52,7 +52,7 @@ fn decode_encrypted_key_example() {
                 EncryptedContentInfo {
                     content_type: ContentType::Data,
                     content_encryption_algorithm:
-                        AlgorithmIdentifier {
+                        AlgorithmIdentifierRef {
                             oid,
                             parameters: Some(any),
                         },
diff --git a/pkcs8/src/error.rs b/pkcs8/src/error.rs
index bc4c2eafe..70c60aedb 100644
--- a/pkcs8/src/error.rs
+++ b/pkcs8/src/error.rs
@@ -26,7 +26,7 @@ pub enum Error {
     /// or [`SubjectPublicKeyInfo::subject_public_key`][`crate::SubjectPublicKeyInfo::subject_public_key`].
     KeyMalformed,
 
-    /// [`AlgorithmIdentifier::parameters`][`crate::AlgorithmIdentifier::parameters`]
+    /// [`AlgorithmIdentifier::parameters`][`crate::AlgorithmIdentifierRef::parameters`]
     /// is malformed or otherwise encoded in an unexpected manner.
     ParametersMalformed,
 
diff --git a/pkcs8/src/lib.rs b/pkcs8/src/lib.rs
index a7ea0b725..05fc94d7c 100644
--- a/pkcs8/src/lib.rs
+++ b/pkcs8/src/lib.rs
@@ -83,7 +83,7 @@ pub use crate::{
     version::Version,
 };
 pub use der::{self, asn1::ObjectIdentifier, oid::AssociatedOid};
-pub use spki::{self, AlgorithmIdentifier, DecodePublicKey, SubjectPublicKeyInfo};
+pub use spki::{self, AlgorithmIdentifierRef, DecodePublicKey, SubjectPublicKeyInfo};
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
diff --git a/pkcs8/src/private_key_info.rs b/pkcs8/src/private_key_info.rs
index 52f0878d7..cf23cf228 100644
--- a/pkcs8/src/private_key_info.rs
+++ b/pkcs8/src/private_key_info.rs
@@ -1,6 +1,6 @@
 //! PKCS#8 `PrivateKeyInfo`.
 
-use crate::{AlgorithmIdentifier, Error, Result, Version};
+use crate::{AlgorithmIdentifierRef, Error, Result, Version};
 use core::fmt;
 use der::{
     asn1::{AnyRef, BitStringRef, ContextSpecific, OctetStringRef},
@@ -29,7 +29,7 @@ const PUBLIC_KEY_TAG: TagNumber = TagNumber::N1;
 
 /// PKCS#8 `PrivateKeyInfo`.
 ///
-/// ASN.1 structure containing an [`AlgorithmIdentifier`], private key
+/// ASN.1 structure containing an `AlgorithmIdentifier`, private key
 /// data in an algorithm specific format, and optional attributes
 /// (ignored by this implementation).
 ///
@@ -90,8 +90,8 @@ const PUBLIC_KEY_TAG: TagNumber = TagNumber::N1;
 /// [RFC 5958 Section 2]: https://datatracker.ietf.org/doc/html/rfc5958#section-2
 #[derive(Clone)]
 pub struct PrivateKeyInfo<'a> {
-    /// X.509 [`AlgorithmIdentifier`] for the private key type.
-    pub algorithm: AlgorithmIdentifier<'a>,
+    /// X.509 `AlgorithmIdentifier` for the private key type.
+    pub algorithm: AlgorithmIdentifierRef<'a>,
 
     /// Private key data.
     pub private_key: &'a [u8],
@@ -105,7 +105,7 @@ impl<'a> PrivateKeyInfo<'a> {
     ///
     /// This is a helper method which initializes `attributes` and `public_key`
     /// to `None`, helpful if you aren't using those.
-    pub fn new(algorithm: AlgorithmIdentifier<'a>, private_key: &'a [u8]) -> Self {
+    pub fn new(algorithm: AlgorithmIdentifierRef<'a>, private_key: &'a [u8]) -> Self {
         Self {
             algorithm,
             private_key,
diff --git a/sec1/src/traits.rs b/sec1/src/traits.rs
index cf0d9711e..5bff2f03e 100644
--- a/sec1/src/traits.rs
+++ b/sec1/src/traits.rs
@@ -103,7 +103,7 @@ impl<T: pkcs8::DecodePrivateKey> DecodeEcPrivateKey for T {
             .parameters
             .and_then(|params| params.named_curve());
 
-        let algorithm = pkcs8::AlgorithmIdentifier {
+        let algorithm = pkcs8::AlgorithmIdentifierRef {
             oid: ALGORITHM_OID,
             parameters: params_oid.as_ref().map(Into::into),
         };
diff --git a/spki/src/algorithm.rs b/spki/src/algorithm.rs
index 2a8b6c7f9..6f76d6d35 100644
--- a/spki/src/algorithm.rs
+++ b/spki/src/algorithm.rs
@@ -2,8 +2,10 @@
 
 use crate::{Error, Result};
 use core::cmp::Ordering;
-use der::asn1::{AnyRef, ObjectIdentifier};
-use der::{Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd};
+use der::{
+    asn1::{AnyRef, Choice, ObjectIdentifier},
+    Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
+};
 
 /// X.509 `AlgorithmIdentifier` as defined in [RFC 5280 Section 4.1.1.2].
 ///
@@ -15,16 +17,68 @@ use der::{Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOr
 ///
 /// [RFC 5280 Section 4.1.1.2]: https://tools.ietf.org/html/rfc5280#section-4.1.1.2
 #[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
-pub struct AlgorithmIdentifier<'a> {
+pub struct AlgorithmIdentifier<Params> {
     /// Algorithm OID, i.e. the `algorithm` field in the `AlgorithmIdentifier`
     /// ASN.1 schema.
     pub oid: ObjectIdentifier,
 
     /// Algorithm `parameters`.
-    pub parameters: Option<AnyRef<'a>>,
+    pub parameters: Option<Params>,
 }
 
-impl<'a> AlgorithmIdentifier<'a> {
+impl<'a, Params> DecodeValue<'a> for AlgorithmIdentifier<Params>
+where
+    Params: Choice<'a>,
+{
+    fn decode_value<R: Reader<'a>>(reader: &mut R, header: Header) -> der::Result<Self> {
+        reader.read_nested(header.length, |reader| {
+            Ok(Self {
+                oid: reader.decode()?,
+                parameters: reader.decode()?,
+            })
+        })
+    }
+}
+
+impl<'a, Params> Sequence<'a> for AlgorithmIdentifier<Params>
+where
+    Params: Choice<'a> + Encode,
+{
+    fn fields<F, T>(&self, f: F) -> der::Result<T>
+    where
+        F: FnOnce(&[&dyn Encode]) -> der::Result<T>,
+    {
+        f(&[&self.oid, &self.parameters])
+    }
+}
+
+impl<'a, Params> TryFrom<&'a [u8]> for AlgorithmIdentifier<Params>
+where
+    Params: Choice<'a> + Encode,
+{
+    type Error = Error;
+
+    fn try_from(bytes: &'a [u8]) -> Result<Self> {
+        Ok(Self::from_der(bytes)?)
+    }
+}
+
+impl<Params> ValueOrd for AlgorithmIdentifier<Params>
+where
+    Params: DerOrd,
+{
+    fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
+        match self.oid.der_cmp(&other.oid)? {
+            Ordering::Equal => self.parameters.der_cmp(&other.parameters),
+            other => Ok(other),
+        }
+    }
+}
+
+/// `AlgorithmIdentifier` reference which has `AnyRef` parameters.
+pub type AlgorithmIdentifierRef<'a> = AlgorithmIdentifier<AnyRef<'a>>;
+
+impl<'a> AlgorithmIdentifierRef<'a> {
     /// Assert the `algorithm` OID is an expected value.
     pub fn assert_algorithm_oid(&self, expected_oid: ObjectIdentifier) -> Result<ObjectIdentifier> {
         if self.oid == expected_oid {
@@ -93,40 +147,3 @@ impl<'a> AlgorithmIdentifier<'a> {
         ))
     }
 }
-
-impl<'a> DecodeValue<'a> for AlgorithmIdentifier<'a> {
-    fn decode_value<R: Reader<'a>>(reader: &mut R, header: Header) -> der::Result<Self> {
-        reader.read_nested(header.length, |reader| {
-            Ok(Self {
-                oid: reader.decode()?,
-                parameters: reader.decode()?,
-            })
-        })
-    }
-}
-
-impl<'a> Sequence<'a> for AlgorithmIdentifier<'a> {
-    fn fields<F, T>(&self, f: F) -> der::Result<T>
-    where
-        F: FnOnce(&[&dyn Encode]) -> der::Result<T>,
-    {
-        f(&[&self.oid, &self.parameters])
-    }
-}
-
-impl<'a> TryFrom<&'a [u8]> for AlgorithmIdentifier<'a> {
-    type Error = Error;
-
-    fn try_from(bytes: &'a [u8]) -> Result<Self> {
-        Ok(Self::from_der(bytes)?)
-    }
-}
-
-impl ValueOrd for AlgorithmIdentifier<'_> {
-    fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
-        match self.oid.der_cmp(&other.oid)? {
-            Ordering::Equal => self.parameters.der_cmp(&other.parameters),
-            other => Ok(other),
-        }
-    }
-}
diff --git a/spki/src/lib.rs b/spki/src/lib.rs
index cd11da857..ada8ca3d2 100644
--- a/spki/src/lib.rs
+++ b/spki/src/lib.rs
@@ -15,14 +15,14 @@
 //! Borrow the [`ObjectIdentifier`] first then use [`der::AnyRef::from`] or `.into()`:
 //!
 //! ```
-//! use spki::{AlgorithmIdentifier, ObjectIdentifier, der::AnyRef};
+//! use spki::{AlgorithmIdentifier, ObjectIdentifier};
 //!
 //! let alg_oid = "1.2.840.10045.2.1".parse::<ObjectIdentifier>().unwrap();
 //! let params_oid = "1.2.840.10045.3.1.7".parse::<ObjectIdentifier>().unwrap();
 //!
 //! let alg_id = AlgorithmIdentifier {
 //!     oid: alg_oid,
-//!     parameters: Some(AnyRef::from(&params_oid))
+//!     parameters: Some(params_oid)
 //! };
 //! ```
 
@@ -41,7 +41,7 @@ mod traits;
 mod fingerprint;
 
 pub use crate::{
-    algorithm::AlgorithmIdentifier,
+    algorithm::{AlgorithmIdentifier, AlgorithmIdentifierRef},
     error::{Error, Result},
     spki::SubjectPublicKeyInfo,
     traits::DecodePublicKey,
diff --git a/spki/src/spki.rs b/spki/src/spki.rs
index 9058e49c7..8dbcda699 100644
--- a/spki/src/spki.rs
+++ b/spki/src/spki.rs
@@ -1,6 +1,6 @@
 //! X.509 `SubjectPublicKeyInfo`
 
-use crate::{AlgorithmIdentifier, Error, Result};
+use crate::{AlgorithmIdentifierRef, Error, Result};
 use core::cmp::Ordering;
 use der::{
     asn1::BitStringRef, Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
@@ -21,6 +21,9 @@ use {
 #[cfg(feature = "pem")]
 use der::pem::PemLabel;
 
+#[cfg(doc)]
+use crate::AlgorithmIdentifier;
+
 /// X.509 `SubjectPublicKeyInfo` (SPKI) as defined in [RFC 5280 § 4.1.2.7].
 ///
 /// ASN.1 structure containing an [`AlgorithmIdentifier`] and public key
@@ -36,7 +39,7 @@ use der::pem::PemLabel;
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
 pub struct SubjectPublicKeyInfo<'a> {
     /// X.509 [`AlgorithmIdentifier`] for the public key type
-    pub algorithm: AlgorithmIdentifier<'a>,
+    pub algorithm: AlgorithmIdentifierRef<'a>,
 
     /// Public key data
     pub subject_public_key: &'a [u8],
diff --git a/x509-cert/src/certificate.rs b/x509-cert/src/certificate.rs
index 3083d7bf9..99d1385cd 100644
--- a/x509-cert/src/certificate.rs
+++ b/x509-cert/src/certificate.rs
@@ -7,7 +7,7 @@ use alloc::vec::Vec;
 use const_oid::AssociatedOid;
 use der::asn1::{BitStringRef, UIntRef};
 use der::{Decode, Enumerated, Error, ErrorKind, Sequence};
-use spki::{AlgorithmIdentifier, SubjectPublicKeyInfo};
+use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfo};
 
 #[cfg(feature = "pem")]
 use der::pem::PemLabel;
@@ -77,7 +77,7 @@ pub struct TbsCertificate<'a> {
     pub version: Version,
 
     pub serial_number: UIntRef<'a>,
-    pub signature: AlgorithmIdentifier<'a>,
+    pub signature: AlgorithmIdentifierRef<'a>,
     pub issuer: Name<'a>,
     pub validity: Validity,
     pub subject: Name<'a>,
@@ -142,7 +142,7 @@ impl<'a> TbsCertificate<'a> {
 #[allow(missing_docs)]
 pub struct Certificate<'a> {
     pub tbs_certificate: TbsCertificate<'a>,
-    pub signature_algorithm: AlgorithmIdentifier<'a>,
+    pub signature_algorithm: AlgorithmIdentifierRef<'a>,
     pub signature: BitStringRef<'a>,
 }
 
diff --git a/x509-cert/src/crl.rs b/x509-cert/src/crl.rs
index 3e630435b..8b1bfa564 100644
--- a/x509-cert/src/crl.rs
+++ b/x509-cert/src/crl.rs
@@ -9,7 +9,7 @@ use alloc::vec::Vec;
 
 use der::asn1::{BitStringRef, UIntRef};
 use der::Sequence;
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 
 /// `CertificateList` as defined in [RFC 5280 Section 5.1].
 ///
@@ -26,7 +26,7 @@ use spki::AlgorithmIdentifier;
 #[allow(missing_docs)]
 pub struct CertificateList<'a> {
     pub tbs_cert_list: TbsCertList<'a>,
-    pub signature_algorithm: AlgorithmIdentifier<'a>,
+    pub signature_algorithm: AlgorithmIdentifierRef<'a>,
     pub signature: BitStringRef<'a>,
 }
 
@@ -75,7 +75,7 @@ pub struct RevokedCert<'a> {
 #[allow(missing_docs)]
 pub struct TbsCertList<'a> {
     pub version: Version,
-    pub signature: AlgorithmIdentifier<'a>,
+    pub signature: AlgorithmIdentifierRef<'a>,
     pub issuer: Name<'a>,
     pub this_update: Time,
     pub next_update: Option<Time>,
diff --git a/x509-cert/src/request.rs b/x509-cert/src/request.rs
index 6ab16cf8b..3ed2c73b6 100644
--- a/x509-cert/src/request.rs
+++ b/x509-cert/src/request.rs
@@ -9,7 +9,7 @@ use const_oid::db::rfc5912::ID_EXTENSION_REQ;
 use const_oid::{AssociatedOid, ObjectIdentifier};
 use der::asn1::BitStringRef;
 use der::{Decode, Enumerated, Sequence};
-use spki::{AlgorithmIdentifier, SubjectPublicKeyInfo};
+use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfo};
 
 /// Version identifier for certification request information.
 ///
@@ -75,7 +75,7 @@ pub struct CertReq<'a> {
     pub info: CertReqInfo<'a>,
 
     /// Signature algorithm identifier.
-    pub algorithm: AlgorithmIdentifier<'a>,
+    pub algorithm: AlgorithmIdentifierRef<'a>,
 
     /// Signature.
     pub signature: BitStringRef<'a>,
diff --git a/x509-cert/tests/certificate.rs b/x509-cert/tests/certificate.rs
index 86215e3bf..11ef1045f 100644
--- a/x509-cert/tests/certificate.rs
+++ b/x509-cert/tests/certificate.rs
@@ -5,7 +5,7 @@ use der::{
     Decode, DecodeValue, Encode, FixedTag, Header, Reader, Tag, Tagged,
 };
 use hex_literal::hex;
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 use x509_cert::Certificate;
 use x509_cert::*;
 
@@ -116,7 +116,7 @@ fn reencode_cert() {
     let reencoded_tbs = parsed_tbs.to_vec().unwrap();
     assert_eq!(defer_cert.tbs_certificate, reencoded_tbs);
 
-    let parsed_sigalg = AlgorithmIdentifier::from_der(defer_cert.signature_algorithm).unwrap();
+    let parsed_sigalg = AlgorithmIdentifierRef::from_der(defer_cert.signature_algorithm).unwrap();
     let reencoded_sigalg = parsed_sigalg.to_vec().unwrap();
     assert_eq!(defer_cert.signature_algorithm, reencoded_sigalg);
 
diff --git a/x509-ocsp/src/lib.rs b/x509-ocsp/src/lib.rs
index 9e7a01b39..0c16928d0 100644
--- a/x509-ocsp/src/lib.rs
+++ b/x509-ocsp/src/lib.rs
@@ -6,7 +6,7 @@ extern crate alloc;
 use der::asn1::{BitStringRef, Ia5StringRef, ObjectIdentifier, OctetStringRef, UIntRef};
 use der::asn1::{GeneralizedTime, Null};
 use der::{AnyRef, Choice, Enumerated, Sequence};
-use spki::AlgorithmIdentifier;
+use spki::AlgorithmIdentifierRef;
 use x509_cert::ext::pkix::name::GeneralName;
 use x509_cert::ext::pkix::{AuthorityInfoAccessSyntax, CrlReason};
 use x509_cert::ext::Extensions;
@@ -89,7 +89,7 @@ pub struct TbsRequest<'a> {
 #[derive(Clone, Debug, Eq, PartialEq, Sequence)]
 #[allow(missing_docs)]
 pub struct Signature<'a> {
-    pub signature_algorithm: AlgorithmIdentifier<'a>,
+    pub signature_algorithm: AlgorithmIdentifierRef<'a>,
     pub signature: BitStringRef<'a>,
 
     #[asn1(context_specific = "0", optional = "true", tag_mode = "EXPLICIT")]
@@ -149,7 +149,7 @@ pub struct Request<'a> {
 #[derive(Clone, Debug, Eq, PartialEq, Sequence)]
 #[allow(missing_docs)]
 pub struct CertId<'a> {
-    pub hash_algorithm: AlgorithmIdentifier<'a>,
+    pub hash_algorithm: AlgorithmIdentifierRef<'a>,
     pub issuer_name_hash: OctetStringRef<'a>,
     pub issuer_key_hash: OctetStringRef<'a>,
     pub serial_number: UIntRef<'a>,
@@ -231,7 +231,7 @@ pub struct ResponseBytes<'a> {
 #[allow(missing_docs)]
 pub struct BasicOcspResponse<'a> {
     pub tbs_response_data: ResponseData<'a>,
-    pub signature_algorithm: AlgorithmIdentifier<'a>,
+    pub signature_algorithm: AlgorithmIdentifierRef<'a>,
     pub signature: BitStringRef<'a>,
 
     #[asn1(context_specific = "0", optional = "true", tag_mode = "EXPLICIT")]
@@ -453,6 +453,6 @@ pub type PreferredSignatureAlgorithms<'a> = Vec<PreferredSignatureAlgorithm<'a>>
 #[derive(Clone, Debug, Eq, PartialEq, Sequence)]
 #[allow(missing_docs)]
 pub struct PreferredSignatureAlgorithm<'a> {
-    pub sig_identifier: AlgorithmIdentifier<'a>,
-    pub cert_identifier: Option<AlgorithmIdentifier<'a>>,
+    pub sig_identifier: AlgorithmIdentifierRef<'a>,
+    pub cert_identifier: Option<AlgorithmIdentifierRef<'a>>,
 }

From b09ff1177ccc38151368d2d9f69abd5b4c2aad66 Mon Sep 17 00:00:00 2001
From: Tony Arcieri <bascule@gmail.com>
Date: Sat, 26 Nov 2022 11:55:07 -0700
Subject: [PATCH 2/5] Make `SubjectPublicKeyInfo` generic around `Params`

---
 pkcs1/src/traits.rs          |  4 +--
 pkcs8/src/lib.rs             |  4 ++-
 spki/src/lib.rs              |  2 +-
 spki/src/spki.rs             | 66 ++++++++++++++++++++++++------------
 spki/src/traits.rs           | 18 +++++-----
 spki/tests/spki.rs           | 22 ++++++------
 spki/tests/traits.rs         |  6 ++--
 x509-cert/src/anchor.rs      |  4 +--
 x509-cert/src/certificate.rs |  4 +--
 x509-cert/src/request.rs     |  4 +--
 10 files changed, 80 insertions(+), 54 deletions(-)

diff --git a/pkcs1/src/traits.rs b/pkcs1/src/traits.rs
index c70820cb7..0695124a3 100644
--- a/pkcs1/src/traits.rs
+++ b/pkcs1/src/traits.rs
@@ -183,7 +183,7 @@ impl<T: pkcs8::DecodePrivateKey> DecodeRsaPrivateKey for T {
 #[cfg_attr(docsrs, doc(cfg(feature = "pkcs8")))]
 impl<T: pkcs8::DecodePublicKey> DecodeRsaPublicKey for T {
     fn from_pkcs1_der(public_key: &[u8]) -> Result<Self> {
-        Ok(Self::try_from(pkcs8::SubjectPublicKeyInfo {
+        Ok(Self::try_from(pkcs8::SubjectPublicKeyInfoRef {
             algorithm: ALGORITHM_ID,
             subject_public_key: public_key,
         })?)
@@ -206,7 +206,7 @@ impl<T: pkcs8::EncodePrivateKey> EncodeRsaPrivateKey for T {
 impl<T: pkcs8::EncodePublicKey> EncodeRsaPublicKey for T {
     fn to_pkcs1_der(&self) -> Result<Document> {
         let doc = self.to_public_key_der()?;
-        let spki = pkcs8::SubjectPublicKeyInfo::from_der(doc.as_bytes())?;
+        let spki = pkcs8::SubjectPublicKeyInfoRef::from_der(doc.as_bytes())?;
         spki.algorithm.assert_algorithm_oid(ALGORITHM_OID)?;
         RsaPublicKey::from_der(spki.subject_public_key)?.try_into()
     }
diff --git a/pkcs8/src/lib.rs b/pkcs8/src/lib.rs
index 05fc94d7c..de71bc782 100644
--- a/pkcs8/src/lib.rs
+++ b/pkcs8/src/lib.rs
@@ -83,7 +83,9 @@ pub use crate::{
     version::Version,
 };
 pub use der::{self, asn1::ObjectIdentifier, oid::AssociatedOid};
-pub use spki::{self, AlgorithmIdentifierRef, DecodePublicKey, SubjectPublicKeyInfo};
+pub use spki::{
+    self, AlgorithmIdentifierRef, DecodePublicKey, SubjectPublicKeyInfo, SubjectPublicKeyInfoRef,
+};
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
diff --git a/spki/src/lib.rs b/spki/src/lib.rs
index ada8ca3d2..8f0e4188d 100644
--- a/spki/src/lib.rs
+++ b/spki/src/lib.rs
@@ -43,7 +43,7 @@ mod fingerprint;
 pub use crate::{
     algorithm::{AlgorithmIdentifier, AlgorithmIdentifierRef},
     error::{Error, Result},
-    spki::SubjectPublicKeyInfo,
+    spki::{SubjectPublicKeyInfo, SubjectPublicKeyInfoRef},
     traits::DecodePublicKey,
 };
 pub use der::{self, asn1::ObjectIdentifier};
diff --git a/spki/src/spki.rs b/spki/src/spki.rs
index 8dbcda699..84d7497be 100644
--- a/spki/src/spki.rs
+++ b/spki/src/spki.rs
@@ -1,9 +1,10 @@
 //! X.509 `SubjectPublicKeyInfo`
 
-use crate::{AlgorithmIdentifierRef, Error, Result};
+use crate::{AlgorithmIdentifier, Error, Result};
 use core::cmp::Ordering;
 use der::{
-    asn1::BitStringRef, Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
+    asn1::{AnyRef, BitStringRef},
+    Choice, Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
 };
 
 #[cfg(feature = "alloc")]
@@ -21,8 +22,8 @@ use {
 #[cfg(feature = "pem")]
 use der::pem::PemLabel;
 
-#[cfg(doc)]
-use crate::AlgorithmIdentifier;
+/// [`SubjectPublicKeyInfo`] with [`AnyRef`] algorithm parameters.
+pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<'a, AnyRef<'a>>;
 
 /// X.509 `SubjectPublicKeyInfo` (SPKI) as defined in [RFC 5280 § 4.1.2.7].
 ///
@@ -37,15 +38,25 @@ use crate::AlgorithmIdentifier;
 ///
 /// [RFC 5280 § 4.1.2.7]: https://tools.ietf.org/html/rfc5280#section-4.1.2.7
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
-pub struct SubjectPublicKeyInfo<'a> {
+pub struct SubjectPublicKeyInfo<'a, Params> {
     /// X.509 [`AlgorithmIdentifier`] for the public key type
-    pub algorithm: AlgorithmIdentifierRef<'a>,
+    pub algorithm: AlgorithmIdentifier<Params>,
 
     /// Public key data
     pub subject_public_key: &'a [u8],
 }
 
-impl<'a> SubjectPublicKeyInfo<'a> {
+impl<'a, Params> SubjectPublicKeyInfo<'a, Params> {
+    /// Get a [`BitString`] representing the `subject_public_key`
+    fn bitstring(&self) -> der::Result<BitStringRef<'a>> {
+        BitStringRef::from_bytes(self.subject_public_key)
+    }
+}
+
+impl<'a, Params> SubjectPublicKeyInfo<'a, Params>
+where
+    Params: Choice<'a> + Encode,
+{
     /// Calculate the SHA-256 fingerprint of this [`SubjectPublicKeyInfo`] and
     /// encode it as a Base64 string.
     ///
@@ -71,14 +82,12 @@ impl<'a> SubjectPublicKeyInfo<'a> {
         self.encode(&mut builder)?;
         Ok(builder.finish())
     }
-
-    /// Get a [`BitString`] representing the `subject_public_key`
-    fn bitstring(&self) -> der::Result<BitStringRef<'a>> {
-        BitStringRef::from_bytes(self.subject_public_key)
-    }
 }
 
-impl<'a> DecodeValue<'a> for SubjectPublicKeyInfo<'a> {
+impl<'a, Params> DecodeValue<'a> for SubjectPublicKeyInfo<'a, Params>
+where
+    Params: Choice<'a> + Encode,
+{
     fn decode_value<R: Reader<'a>>(reader: &mut R, header: Header) -> der::Result<Self> {
         reader.read_nested(header.length, |reader| {
             Ok(Self {
@@ -91,7 +100,10 @@ impl<'a> DecodeValue<'a> for SubjectPublicKeyInfo<'a> {
     }
 }
 
-impl<'a> Sequence<'a> for SubjectPublicKeyInfo<'a> {
+impl<'a, Params> Sequence<'a> for SubjectPublicKeyInfo<'a, Params>
+where
+    Params: Choice<'a> + Encode,
+{
     fn fields<F, T>(&self, f: F) -> der::Result<T>
     where
         F: FnOnce(&[&dyn Encode]) -> der::Result<T>,
@@ -100,7 +112,10 @@ impl<'a> Sequence<'a> for SubjectPublicKeyInfo<'a> {
     }
 }
 
-impl<'a> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<'a> {
+impl<'a, Params> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<'a, Params>
+where
+    Params: Choice<'a> + Encode,
+{
     type Error = Error;
 
     fn try_from(bytes: &'a [u8]) -> Result<Self> {
@@ -108,7 +123,10 @@ impl<'a> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<'a> {
     }
 }
 
-impl ValueOrd for SubjectPublicKeyInfo<'_> {
+impl<'a, Params> ValueOrd for SubjectPublicKeyInfo<'a, Params>
+where
+    Params: Choice<'a> + DerOrd + Encode,
+{
     fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
         match self.algorithm.der_cmp(&other.algorithm)? {
             Ordering::Equal => self.bitstring()?.der_cmp(&other.bitstring()?),
@@ -119,26 +137,32 @@ impl ValueOrd for SubjectPublicKeyInfo<'_> {
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl TryFrom<SubjectPublicKeyInfo<'_>> for Document {
+impl<'a, Params> TryFrom<SubjectPublicKeyInfo<'a, Params>> for Document
+where
+    Params: Choice<'a> + Encode,
+{
     type Error = Error;
 
-    fn try_from(spki: SubjectPublicKeyInfo<'_>) -> Result<Document> {
+    fn try_from(spki: SubjectPublicKeyInfo<'a, Params>) -> Result<Document> {
         Self::try_from(&spki)
     }
 }
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl TryFrom<&SubjectPublicKeyInfo<'_>> for Document {
+impl<'a, Params> TryFrom<&SubjectPublicKeyInfo<'a, Params>> for Document
+where
+    Params: Choice<'a> + Encode,
+{
     type Error = Error;
 
-    fn try_from(spki: &SubjectPublicKeyInfo<'_>) -> Result<Document> {
+    fn try_from(spki: &SubjectPublicKeyInfo<'a, Params>) -> Result<Document> {
         Ok(Self::encode_msg(spki)?)
     }
 }
 
 #[cfg(feature = "pem")]
 #[cfg_attr(docsrs, doc(cfg(feature = "pem")))]
-impl PemLabel for SubjectPublicKeyInfo<'_> {
+impl<Params> PemLabel for SubjectPublicKeyInfo<'_, Params> {
     const PEM_LABEL: &'static str = "PUBLIC KEY";
 }
diff --git a/spki/src/traits.rs b/spki/src/traits.rs
index c16e3974d..c6272edea 100644
--- a/spki/src/traits.rs
+++ b/spki/src/traits.rs
@@ -1,6 +1,6 @@
 //! Traits for encoding/decoding SPKI public keys.
 
-use crate::{Error, Result, SubjectPublicKeyInfo};
+use crate::{Error, Result, SubjectPublicKeyInfoRef};
 
 #[cfg(feature = "alloc")]
 use der::Document;
@@ -16,15 +16,15 @@ use std::path::Path;
 
 /// Parse a public key object from an encoded SPKI document.
 pub trait DecodePublicKey:
-    for<'a> TryFrom<SubjectPublicKeyInfo<'a>, Error = Error> + Sized
+    for<'a> TryFrom<SubjectPublicKeyInfoRef<'a>, Error = Error> + Sized
 {
-    /// Deserialize object from ASN.1 DER-encoded [`SubjectPublicKeyInfo`]
+    /// Deserialize object from ASN.1 DER-encoded `SubjectPublicKeyInfo`
     /// (binary format).
     fn from_public_key_der(bytes: &[u8]) -> Result<Self> {
-        Self::try_from(SubjectPublicKeyInfo::try_from(bytes)?)
+        Self::try_from(SubjectPublicKeyInfoRef::try_from(bytes)?)
     }
 
-    /// Deserialize PEM-encoded [`SubjectPublicKeyInfo`].
+    /// Deserialize PEM-encoded `SubjectPublicKeyInfo`.
     ///
     /// Keys in this format begin with the following delimiter:
     ///
@@ -35,7 +35,7 @@ pub trait DecodePublicKey:
     #[cfg_attr(docsrs, doc(cfg(feature = "pem")))]
     fn from_public_key_pem(s: &str) -> Result<Self> {
         let (label, doc) = Document::from_pem(s)?;
-        SubjectPublicKeyInfo::validate_pem_label(label)?;
+        SubjectPublicKeyInfoRef::validate_pem_label(label)?;
         Self::from_public_key_der(doc.as_bytes())
     }
 
@@ -53,7 +53,7 @@ pub trait DecodePublicKey:
     #[cfg_attr(docsrs, doc(cfg(all(feature = "pem", feature = "std"))))]
     fn read_public_key_pem_file(path: impl AsRef<Path>) -> Result<Self> {
         let (label, doc) = Document::read_pem_file(path)?;
-        SubjectPublicKeyInfo::validate_pem_label(&label)?;
+        SubjectPublicKeyInfoRef::validate_pem_label(&label)?;
         Self::from_public_key_der(doc.as_bytes())
     }
 }
@@ -70,7 +70,7 @@ pub trait EncodePublicKey {
     #[cfg_attr(docsrs, doc(cfg(feature = "pem")))]
     fn to_public_key_pem(&self, line_ending: LineEnding) -> Result<String> {
         let doc = self.to_public_key_der()?;
-        Ok(doc.to_pem(SubjectPublicKeyInfo::PEM_LABEL, line_ending)?)
+        Ok(doc.to_pem(SubjectPublicKeyInfoRef::PEM_LABEL, line_ending)?)
     }
 
     /// Write ASN.1 DER-encoded public key to the given path
@@ -89,6 +89,6 @@ pub trait EncodePublicKey {
         line_ending: LineEnding,
     ) -> Result<()> {
         let doc = self.to_public_key_der()?;
-        Ok(doc.write_pem_file(path, SubjectPublicKeyInfo::PEM_LABEL, line_ending)?)
+        Ok(doc.write_pem_file(path, SubjectPublicKeyInfoRef::PEM_LABEL, line_ending)?)
     }
 }
diff --git a/spki/tests/spki.rs b/spki/tests/spki.rs
index 3d6b19f48..a1c229460 100644
--- a/spki/tests/spki.rs
+++ b/spki/tests/spki.rs
@@ -1,7 +1,7 @@
 //! `SubjectPublicKeyInfo` tests.
 
 use hex_literal::hex;
-use spki::SubjectPublicKeyInfo;
+use spki::SubjectPublicKeyInfoRef;
 
 #[cfg(feature = "alloc")]
 use der::Encode;
@@ -46,7 +46,7 @@ const ED25519_SPKI_FINGERPRINT: &[u8] =
 
 #[test]
 fn decode_ec_p256_der() {
-    let spki = SubjectPublicKeyInfo::try_from(EC_P256_DER_EXAMPLE).unwrap();
+    let spki = SubjectPublicKeyInfoRef::try_from(EC_P256_DER_EXAMPLE).unwrap();
 
     assert_eq!(spki.algorithm.oid, "1.2.840.10045.2.1".parse().unwrap());
 
@@ -62,7 +62,7 @@ fn decode_ec_p256_der() {
 #[cfg(feature = "fingerprint")]
 fn decode_ed25519_and_fingerprint_spki() {
     // Repeat the decode test from the pkcs8 crate
-    let spki = SubjectPublicKeyInfo::try_from(ED25519_DER_EXAMPLE).unwrap();
+    let spki = SubjectPublicKeyInfoRef::try_from(ED25519_DER_EXAMPLE).unwrap();
 
     assert_eq!(spki.algorithm.oid, "1.3.101.112".parse().unwrap());
     assert_eq!(spki.algorithm.parameters, None);
@@ -82,7 +82,7 @@ fn decode_ed25519_and_fingerprint_spki() {
 #[cfg(all(feature = "fingerprint", feature = "alloc"))]
 fn decode_ed25519_and_fingerprint_base64() {
     // Repeat the decode test from the pkcs8 crate
-    let spki = SubjectPublicKeyInfo::try_from(ED25519_DER_EXAMPLE).unwrap();
+    let spki = SubjectPublicKeyInfoRef::try_from(ED25519_DER_EXAMPLE).unwrap();
 
     assert_eq!(spki.algorithm.oid, "1.3.101.112".parse().unwrap());
     assert_eq!(spki.algorithm.parameters, None);
@@ -100,7 +100,7 @@ fn decode_ed25519_and_fingerprint_base64() {
 
 #[test]
 fn decode_rsa_2048_der() {
-    let spki = SubjectPublicKeyInfo::try_from(RSA_2048_DER_EXAMPLE).unwrap();
+    let spki = SubjectPublicKeyInfoRef::try_from(RSA_2048_DER_EXAMPLE).unwrap();
 
     assert_eq!(spki.algorithm.oid, "1.2.840.113549.1.1.1".parse().unwrap());
     assert!(spki.algorithm.parameters.unwrap().is_null());
@@ -110,7 +110,7 @@ fn decode_rsa_2048_der() {
 #[test]
 #[cfg(feature = "alloc")]
 fn encode_ec_p256_der() {
-    let pk = SubjectPublicKeyInfo::try_from(EC_P256_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(EC_P256_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_vec().unwrap();
     assert_eq!(EC_P256_DER_EXAMPLE, pk_encoded.as_slice());
 }
@@ -118,7 +118,7 @@ fn encode_ec_p256_der() {
 #[test]
 #[cfg(feature = "alloc")]
 fn encode_ed25519_der() {
-    let pk = SubjectPublicKeyInfo::try_from(ED25519_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(ED25519_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_vec().unwrap();
     assert_eq!(ED25519_DER_EXAMPLE, pk_encoded.as_slice());
 }
@@ -126,7 +126,7 @@ fn encode_ed25519_der() {
 #[test]
 #[cfg(feature = "alloc")]
 fn encode_rsa_2048_der() {
-    let pk = SubjectPublicKeyInfo::try_from(RSA_2048_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(RSA_2048_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_vec().unwrap();
     assert_eq!(RSA_2048_DER_EXAMPLE, pk_encoded.as_slice());
 }
@@ -134,7 +134,7 @@ fn encode_rsa_2048_der() {
 #[test]
 #[cfg(feature = "pem")]
 fn encode_ec_p256_pem() {
-    let pk = SubjectPublicKeyInfo::try_from(EC_P256_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(EC_P256_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_pem(LineEnding::LF).unwrap();
     assert_eq!(EC_P256_PEM_EXAMPLE, pk_encoded);
 }
@@ -142,7 +142,7 @@ fn encode_ec_p256_pem() {
 #[test]
 #[cfg(feature = "pem")]
 fn encode_ed25519_pem() {
-    let pk = SubjectPublicKeyInfo::try_from(ED25519_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(ED25519_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_pem(LineEnding::LF).unwrap();
     assert_eq!(ED25519_PEM_EXAMPLE, pk_encoded);
 }
@@ -150,7 +150,7 @@ fn encode_ed25519_pem() {
 #[test]
 #[cfg(feature = "pem")]
 fn encode_rsa_2048_pem() {
-    let pk = SubjectPublicKeyInfo::try_from(RSA_2048_DER_EXAMPLE).unwrap();
+    let pk = SubjectPublicKeyInfoRef::try_from(RSA_2048_DER_EXAMPLE).unwrap();
     let pk_encoded = pk.to_pem(LineEnding::LF).unwrap();
     assert_eq!(RSA_2048_PEM_EXAMPLE, pk_encoded);
 }
diff --git a/spki/tests/traits.rs b/spki/tests/traits.rs
index 597399e44..e35ed93cb 100644
--- a/spki/tests/traits.rs
+++ b/spki/tests/traits.rs
@@ -3,7 +3,7 @@
 #![cfg(any(feature = "pem", feature = "std"))]
 
 use der::{Decode, Encode};
-use spki::{DecodePublicKey, Document, EncodePublicKey, Error, Result, SubjectPublicKeyInfo};
+use spki::{DecodePublicKey, Document, EncodePublicKey, Error, Result, SubjectPublicKeyInfoRef};
 
 #[cfg(feature = "pem")]
 use spki::der::pem::LineEnding;
@@ -42,10 +42,10 @@ impl EncodePublicKey for MockKey {
     }
 }
 
-impl TryFrom<SubjectPublicKeyInfo<'_>> for MockKey {
+impl TryFrom<SubjectPublicKeyInfoRef<'_>> for MockKey {
     type Error = Error;
 
-    fn try_from(spki: SubjectPublicKeyInfo<'_>) -> Result<MockKey> {
+    fn try_from(spki: SubjectPublicKeyInfoRef<'_>) -> Result<MockKey> {
         Ok(MockKey(spki.to_vec()?))
     }
 }
diff --git a/x509-cert/src/anchor.rs b/x509-cert/src/anchor.rs
index ad7ef08e1..2a329b7c6 100644
--- a/x509-cert/src/anchor.rs
+++ b/x509-cert/src/anchor.rs
@@ -7,7 +7,7 @@ use crate::{Certificate, TbsCertificate};
 use der::asn1::{OctetStringRef, Utf8StringRef};
 use der::{Choice, Enumerated, Sequence};
 use flagset::{flags, FlagSet};
-use spki::SubjectPublicKeyInfo;
+use spki::SubjectPublicKeyInfoRef;
 
 /// Version identifier for TrustAnchorInfo
 #[derive(Clone, Debug, Copy, PartialEq, Eq, Enumerated)]
@@ -45,7 +45,7 @@ pub struct TrustAnchorInfo<'a> {
     #[asn1(default = "Default::default")]
     pub version: Version,
 
-    pub pub_key: SubjectPublicKeyInfo<'a>,
+    pub pub_key: SubjectPublicKeyInfoRef<'a>,
 
     pub key_id: OctetStringRef<'a>,
 
diff --git a/x509-cert/src/certificate.rs b/x509-cert/src/certificate.rs
index 99d1385cd..77d85019d 100644
--- a/x509-cert/src/certificate.rs
+++ b/x509-cert/src/certificate.rs
@@ -7,7 +7,7 @@ use alloc::vec::Vec;
 use const_oid::AssociatedOid;
 use der::asn1::{BitStringRef, UIntRef};
 use der::{Decode, Enumerated, Error, ErrorKind, Sequence};
-use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfo};
+use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfoRef};
 
 #[cfg(feature = "pem")]
 use der::pem::PemLabel;
@@ -81,7 +81,7 @@ pub struct TbsCertificate<'a> {
     pub issuer: Name<'a>,
     pub validity: Validity,
     pub subject: Name<'a>,
-    pub subject_public_key_info: SubjectPublicKeyInfo<'a>,
+    pub subject_public_key_info: SubjectPublicKeyInfoRef<'a>,
 
     #[asn1(context_specific = "1", tag_mode = "IMPLICIT", optional = "true")]
     pub issuer_unique_id: Option<BitStringRef<'a>>,
diff --git a/x509-cert/src/request.rs b/x509-cert/src/request.rs
index 3ed2c73b6..23c01c54d 100644
--- a/x509-cert/src/request.rs
+++ b/x509-cert/src/request.rs
@@ -9,7 +9,7 @@ use const_oid::db::rfc5912::ID_EXTENSION_REQ;
 use const_oid::{AssociatedOid, ObjectIdentifier};
 use der::asn1::BitStringRef;
 use der::{Decode, Enumerated, Sequence};
-use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfo};
+use spki::{AlgorithmIdentifierRef, SubjectPublicKeyInfoRef};
 
 /// Version identifier for certification request information.
 ///
@@ -43,7 +43,7 @@ pub struct CertReqInfo<'a> {
     pub subject: Name<'a>,
 
     /// Subject public key info.
-    pub public_key: SubjectPublicKeyInfo<'a>,
+    pub public_key: SubjectPublicKeyInfoRef<'a>,
 
     /// Request attributes.
     #[asn1(context_specific = "0", tag_mode = "IMPLICIT")]

From 1efe27af581d4b7b2fae81225b764eb10eadf639 Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Tue, 29 Nov 2022 11:19:32 -0800
Subject: [PATCH 3/5] spki: make `SubjectPublicKeyInfo` own the public key

---
 pkcs1/src/traits.rs        |  9 +++++---
 spki/src/spki.rs           | 44 ++++++++++++++++++--------------------
 x509-cert/tests/certreq.rs |  2 +-
 3 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/pkcs1/src/traits.rs b/pkcs1/src/traits.rs
index 0695124a3..5cc1d50a4 100644
--- a/pkcs1/src/traits.rs
+++ b/pkcs1/src/traits.rs
@@ -16,7 +16,10 @@ use {
 };
 
 #[cfg(feature = "pkcs8")]
-use crate::{ALGORITHM_ID, ALGORITHM_OID};
+use {
+    crate::{ALGORITHM_ID, ALGORITHM_OID},
+    der::asn1::BitString,
+};
 
 #[cfg(feature = "std")]
 use std::path::Path;
@@ -185,7 +188,7 @@ impl<T: pkcs8::DecodePublicKey> DecodeRsaPublicKey for T {
     fn from_pkcs1_der(public_key: &[u8]) -> Result<Self> {
         Ok(Self::try_from(pkcs8::SubjectPublicKeyInfoRef {
             algorithm: ALGORITHM_ID,
-            subject_public_key: public_key,
+            subject_public_key: BitString::from_bytes(public_key)?,
         })?)
     }
 }
@@ -208,6 +211,6 @@ impl<T: pkcs8::EncodePublicKey> EncodeRsaPublicKey for T {
         let doc = self.to_public_key_der()?;
         let spki = pkcs8::SubjectPublicKeyInfoRef::from_der(doc.as_bytes())?;
         spki.algorithm.assert_algorithm_oid(ALGORITHM_OID)?;
-        RsaPublicKey::from_der(spki.subject_public_key)?.try_into()
+        RsaPublicKey::from_der(spki.subject_public_key.raw_bytes())?.try_into()
     }
 }
diff --git a/spki/src/spki.rs b/spki/src/spki.rs
index 84d7497be..b0f5af1b1 100644
--- a/spki/src/spki.rs
+++ b/spki/src/spki.rs
@@ -3,7 +3,7 @@
 use crate::{AlgorithmIdentifier, Error, Result};
 use core::cmp::Ordering;
 use der::{
-    asn1::{AnyRef, BitStringRef},
+    asn1::{AnyRef, BitString, BitStringRef},
     Choice, Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
 };
 
@@ -23,7 +23,7 @@ use {
 use der::pem::PemLabel;
 
 /// [`SubjectPublicKeyInfo`] with [`AnyRef`] algorithm parameters.
-pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<'a, AnyRef<'a>>;
+pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<AnyRef<'a>>;
 
 /// X.509 `SubjectPublicKeyInfo` (SPKI) as defined in [RFC 5280 § 4.1.2.7].
 ///
@@ -37,23 +37,23 @@ pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<'a, AnyRef<'a>>;
 /// ```
 ///
 /// [RFC 5280 § 4.1.2.7]: https://tools.ietf.org/html/rfc5280#section-4.1.2.7
-#[derive(Copy, Clone, Debug, Eq, PartialEq)]
-pub struct SubjectPublicKeyInfo<'a, Params> {
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SubjectPublicKeyInfo<Params> {
     /// X.509 [`AlgorithmIdentifier`] for the public key type
     pub algorithm: AlgorithmIdentifier<Params>,
 
     /// Public key data
-    pub subject_public_key: &'a [u8],
+    pub subject_public_key: BitString,
 }
 
-impl<'a, Params> SubjectPublicKeyInfo<'a, Params> {
+impl<Params> SubjectPublicKeyInfo<Params> {
     /// Get a [`BitString`] representing the `subject_public_key`
-    fn bitstring(&self) -> der::Result<BitStringRef<'a>> {
-        BitStringRef::from_bytes(self.subject_public_key)
+    fn bitstring(&self) -> BitStringRef<'_> {
+        BitStringRef::from(&self.subject_public_key)
     }
 }
 
-impl<'a, Params> SubjectPublicKeyInfo<'a, Params>
+impl<'a, Params> SubjectPublicKeyInfo<Params>
 where
     Params: Choice<'a> + Encode,
 {
@@ -84,7 +84,7 @@ where
     }
 }
 
-impl<'a, Params> DecodeValue<'a> for SubjectPublicKeyInfo<'a, Params>
+impl<'a, Params> DecodeValue<'a> for SubjectPublicKeyInfo<Params>
 where
     Params: Choice<'a> + Encode,
 {
@@ -92,15 +92,13 @@ where
         reader.read_nested(header.length, |reader| {
             Ok(Self {
                 algorithm: reader.decode()?,
-                subject_public_key: BitStringRef::decode(reader)?
-                    .as_bytes()
-                    .ok_or_else(|| der::Tag::BitString.value_error())?,
+                subject_public_key: BitString::decode(reader)?,
             })
         })
     }
 }
 
-impl<'a, Params> Sequence<'a> for SubjectPublicKeyInfo<'a, Params>
+impl<'a, Params> Sequence<'a> for SubjectPublicKeyInfo<Params>
 where
     Params: Choice<'a> + Encode,
 {
@@ -108,11 +106,11 @@ where
     where
         F: FnOnce(&[&dyn Encode]) -> der::Result<T>,
     {
-        f(&[&self.algorithm, &self.bitstring()?])
+        f(&[&self.algorithm, &self.bitstring()])
     }
 }
 
-impl<'a, Params> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<'a, Params>
+impl<'a, Params> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<Params>
 where
     Params: Choice<'a> + Encode,
 {
@@ -123,13 +121,13 @@ where
     }
 }
 
-impl<'a, Params> ValueOrd for SubjectPublicKeyInfo<'a, Params>
+impl<'a, Params> ValueOrd for SubjectPublicKeyInfo<Params>
 where
     Params: Choice<'a> + DerOrd + Encode,
 {
     fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
         match self.algorithm.der_cmp(&other.algorithm)? {
-            Ordering::Equal => self.bitstring()?.der_cmp(&other.bitstring()?),
+            Ordering::Equal => self.bitstring().der_cmp(&other.bitstring()),
             other => Ok(other),
         }
     }
@@ -137,32 +135,32 @@ where
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl<'a, Params> TryFrom<SubjectPublicKeyInfo<'a, Params>> for Document
+impl<'a, Params> TryFrom<SubjectPublicKeyInfo<Params>> for Document
 where
     Params: Choice<'a> + Encode,
 {
     type Error = Error;
 
-    fn try_from(spki: SubjectPublicKeyInfo<'a, Params>) -> Result<Document> {
+    fn try_from(spki: SubjectPublicKeyInfo<Params>) -> Result<Document> {
         Self::try_from(&spki)
     }
 }
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl<'a, Params> TryFrom<&SubjectPublicKeyInfo<'a, Params>> for Document
+impl<'a, Params> TryFrom<&SubjectPublicKeyInfo<Params>> for Document
 where
     Params: Choice<'a> + Encode,
 {
     type Error = Error;
 
-    fn try_from(spki: &SubjectPublicKeyInfo<'a, Params>) -> Result<Document> {
+    fn try_from(spki: &SubjectPublicKeyInfo<Params>) -> Result<Document> {
         Ok(Self::encode_msg(spki)?)
     }
 }
 
 #[cfg(feature = "pem")]
 #[cfg_attr(docsrs, doc(cfg(feature = "pem")))]
-impl<Params> PemLabel for SubjectPublicKeyInfo<'_, Params> {
+impl<Params> PemLabel for SubjectPublicKeyInfo<Params> {
     const PEM_LABEL: &'static str = "PUBLIC KEY";
 }
diff --git a/x509-cert/tests/certreq.rs b/x509-cert/tests/certreq.rs
index 547524cd9..a76c02866 100644
--- a/x509-cert/tests/certreq.rs
+++ b/x509-cert/tests/certreq.rs
@@ -52,7 +52,7 @@ fn decode_rsa_2048_der() {
     let alg = cr.info.public_key.algorithm;
     assert_eq!(alg.oid, "1.2.840.113549.1.1.1".parse().unwrap());
     assert!(alg.parameters.unwrap().is_null());
-    assert_eq!(cr.info.public_key.subject_public_key, RSA_KEY);
+    assert_eq!(cr.info.public_key.subject_public_key.raw_bytes(), RSA_KEY);
 
     // Check the attributes (just one; contains extensions).
     assert_eq!(cr.info.attributes.len(), 1);

From 25b9e19c4d90e7cd5eacdbbde3a0a4bf07f7e373 Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Tue, 29 Nov 2022 21:52:15 -0800
Subject: [PATCH 4/5] spki: make key param an attribute of spki

---
 der/src/asn1.rs            |  2 +-
 der/src/asn1/bit_string.rs | 20 +++++++++---
 pkcs1/src/traits.rs        |  4 +--
 spki/src/lib.rs            |  5 ++-
 spki/src/spki.rs           | 64 ++++++++++++++++++++++----------------
 spki/tests/spki.rs         |  8 ++---
 6 files changed, 65 insertions(+), 38 deletions(-)

diff --git a/der/src/asn1.rs b/der/src/asn1.rs
index 34d692b67..fecde5a66 100644
--- a/der/src/asn1.rs
+++ b/der/src/asn1.rs
@@ -27,7 +27,7 @@ mod videotex_string;
 
 pub use self::{
     any::AnyRef,
-    bit_string::{BitStringIter, BitStringRef},
+    bit_string::{BitStringIter, BitStringLike, BitStringRef},
     choice::Choice,
     context_specific::{ContextSpecific, ContextSpecificRef},
     generalized_time::GeneralizedTime,
diff --git a/der/src/asn1/bit_string.rs b/der/src/asn1/bit_string.rs
index 7eea5a596..813d31a0e 100644
--- a/der/src/asn1/bit_string.rs
+++ b/der/src/asn1/bit_string.rs
@@ -1,8 +1,8 @@
 //! ASN.1 `BIT STRING` support.
 
 use crate::{
-    asn1::AnyRef, ByteSlice, DecodeValue, DerOrd, EncodeValue, Error, ErrorKind, FixedTag, Header,
-    Length, Reader, Result, Tag, ValueOrd, Writer,
+    asn1::AnyRef, ByteSlice, Decode, DecodeValue, DerOrd, Encode, EncodeValue, Error, ErrorKind,
+    FixedTag, Header, Length, Reader, Result, Tag, ValueOrd, Writer,
 };
 use core::{cmp::Ordering, iter::FusedIterator};
 
@@ -153,8 +153,8 @@ impl ValueOrd for BitStringRef<'_> {
     }
 }
 
-impl<'a> From<&BitStringRef<'a>> for BitStringRef<'a> {
-    fn from(value: &BitStringRef<'a>) -> BitStringRef<'a> {
+impl<'a, 'k> From<&'k BitStringRef<'a>> for BitStringRef<'a> {
+    fn from(value: &'k BitStringRef<'a>) -> BitStringRef<'a> {
         *value
     }
 }
@@ -441,6 +441,18 @@ where
     }
 }
 
+/// Trait used as a marker to ensure the type can hold the content of a Bit String
+pub trait BitStringLike<'pointer, 'slice: 'pointer>
+where
+    Self: Decode<'slice> + Encode + FixedTag + 'pointer,
+{
+}
+
+impl<'slice: 'pointer, 'pointer> BitStringLike<'pointer, 'slice> for BitStringRef<'slice> {}
+
+#[cfg(feature = "alloc")]
+impl<'a> BitStringLike<'a, 'a> for BitString {}
+
 #[cfg(test)]
 mod tests {
     use super::{BitStringRef, Result, Tag};
diff --git a/pkcs1/src/traits.rs b/pkcs1/src/traits.rs
index 5cc1d50a4..f6cff96fa 100644
--- a/pkcs1/src/traits.rs
+++ b/pkcs1/src/traits.rs
@@ -18,7 +18,7 @@ use {
 #[cfg(feature = "pkcs8")]
 use {
     crate::{ALGORITHM_ID, ALGORITHM_OID},
-    der::asn1::BitString,
+    der::asn1::BitStringRef,
 };
 
 #[cfg(feature = "std")]
@@ -188,7 +188,7 @@ impl<T: pkcs8::DecodePublicKey> DecodeRsaPublicKey for T {
     fn from_pkcs1_der(public_key: &[u8]) -> Result<Self> {
         Ok(Self::try_from(pkcs8::SubjectPublicKeyInfoRef {
             algorithm: ALGORITHM_ID,
-            subject_public_key: BitString::from_bytes(public_key)?,
+            subject_public_key: BitStringRef::from_bytes(public_key)?,
         })?)
     }
 }
diff --git a/spki/src/lib.rs b/spki/src/lib.rs
index 8f0e4188d..34f5b347e 100644
--- a/spki/src/lib.rs
+++ b/spki/src/lib.rs
@@ -49,7 +49,10 @@ pub use crate::{
 pub use der::{self, asn1::ObjectIdentifier};
 
 #[cfg(feature = "alloc")]
-pub use {crate::traits::EncodePublicKey, der::Document};
+pub use {
+    crate::{spki::SubjectPublicKeyInfoOwned, traits::EncodePublicKey},
+    der::Document,
+};
 
 #[cfg(feature = "fingerprint")]
 pub use crate::fingerprint::FingerprintBytes;
diff --git a/spki/src/spki.rs b/spki/src/spki.rs
index b0f5af1b1..87f239726 100644
--- a/spki/src/spki.rs
+++ b/spki/src/spki.rs
@@ -3,12 +3,15 @@
 use crate::{AlgorithmIdentifier, Error, Result};
 use core::cmp::Ordering;
 use der::{
-    asn1::{AnyRef, BitString, BitStringRef},
+    asn1::{AnyRef, BitStringLike, BitStringRef},
     Choice, Decode, DecodeValue, DerOrd, Encode, Header, Reader, Sequence, ValueOrd,
 };
 
 #[cfg(feature = "alloc")]
-use der::Document;
+use der::{
+    asn1::{Any, BitString},
+    Document,
+};
 
 #[cfg(feature = "fingerprint")]
 use crate::{fingerprint, FingerprintBytes};
@@ -22,8 +25,12 @@ use {
 #[cfg(feature = "pem")]
 use der::pem::PemLabel;
 
-/// [`SubjectPublicKeyInfo`] with [`AnyRef`] algorithm parameters.
-pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<AnyRef<'a>>;
+/// [`SubjectPublicKeyInfo`] with [`AnyRef`] algorithm parameters, and [`BitStringRef`] params.
+pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<AnyRef<'a>, BitStringRef<'a>>;
+
+/// [`SubjectPublicKeyInfo`] with [`Any`] algorithm parameters, and [`BitString`] params.
+#[cfg(feature = "alloc")]
+pub type SubjectPublicKeyInfoOwned = SubjectPublicKeyInfo<Any, BitString>;
 
 /// X.509 `SubjectPublicKeyInfo` (SPKI) as defined in [RFC 5280 § 4.1.2.7].
 ///
@@ -38,24 +45,19 @@ pub type SubjectPublicKeyInfoRef<'a> = SubjectPublicKeyInfo<AnyRef<'a>>;
 ///
 /// [RFC 5280 § 4.1.2.7]: https://tools.ietf.org/html/rfc5280#section-4.1.2.7
 #[derive(Clone, Debug, Eq, PartialEq)]
-pub struct SubjectPublicKeyInfo<Params> {
+pub struct SubjectPublicKeyInfo<Params, Key> {
     /// X.509 [`AlgorithmIdentifier`] for the public key type
     pub algorithm: AlgorithmIdentifier<Params>,
 
     /// Public key data
-    pub subject_public_key: BitString,
-}
-
-impl<Params> SubjectPublicKeyInfo<Params> {
-    /// Get a [`BitString`] representing the `subject_public_key`
-    fn bitstring(&self) -> BitStringRef<'_> {
-        BitStringRef::from(&self.subject_public_key)
-    }
+    pub subject_public_key: Key,
 }
 
-impl<'a, Params> SubjectPublicKeyInfo<Params>
+impl<'a: 'k, 'k, Params, Key: 'k> SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
+    Key: BitStringLike<'k, 'a>,
+    BitStringRef<'a>: From<&'k Key>,
 {
     /// Calculate the SHA-256 fingerprint of this [`SubjectPublicKeyInfo`] and
     /// encode it as a Base64 string.
@@ -84,35 +86,40 @@ where
     }
 }
 
-impl<'a, Params> DecodeValue<'a> for SubjectPublicKeyInfo<Params>
+impl<'a: 'k, 'k, Params, Key: 'k> DecodeValue<'a> for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
+    Key: Decode<'a>,
 {
     fn decode_value<R: Reader<'a>>(reader: &mut R, header: Header) -> der::Result<Self> {
         reader.read_nested(header.length, |reader| {
             Ok(Self {
                 algorithm: reader.decode()?,
-                subject_public_key: BitString::decode(reader)?,
+                subject_public_key: Key::decode(reader)?,
             })
         })
     }
 }
 
-impl<'a, Params> Sequence<'a> for SubjectPublicKeyInfo<Params>
+impl<'a: 'k, 'k, Params, Key: 'k> Sequence<'a> for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
+    Key: BitStringLike<'k, 'a>,
+    BitStringRef<'a>: From<&'k Key>,
 {
     fn fields<F, T>(&self, f: F) -> der::Result<T>
     where
         F: FnOnce(&[&dyn Encode]) -> der::Result<T>,
     {
-        f(&[&self.algorithm, &self.bitstring()])
+        f(&[&self.algorithm, &self.subject_public_key])
     }
 }
 
-impl<'a, Params> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<Params>
+impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
+    Key: BitStringLike<'k, 'a>,
+    BitStringRef<'a>: From<&'k Key>,
 {
     type Error = Error;
 
@@ -121,13 +128,14 @@ where
     }
 }
 
-impl<'a, Params> ValueOrd for SubjectPublicKeyInfo<Params>
+impl<'a, Params, Key> ValueOrd for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + DerOrd + Encode,
+    Key: ValueOrd,
 {
     fn value_cmp(&self, other: &Self) -> der::Result<Ordering> {
         match self.algorithm.der_cmp(&other.algorithm)? {
-            Ordering::Equal => self.bitstring().der_cmp(&other.bitstring()),
+            Ordering::Equal => self.subject_public_key.value_cmp(&other.subject_public_key),
             other => Ok(other),
         }
     }
@@ -135,32 +143,36 @@ where
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl<'a, Params> TryFrom<SubjectPublicKeyInfo<Params>> for Document
+impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<SubjectPublicKeyInfo<Params, Key>> for Document
 where
     Params: Choice<'a> + Encode,
+    Key: BitStringLike<'k, 'a>,
+    BitStringRef<'a>: From<&'k Key>,
 {
     type Error = Error;
 
-    fn try_from(spki: SubjectPublicKeyInfo<Params>) -> Result<Document> {
+    fn try_from(spki: SubjectPublicKeyInfo<Params, Key>) -> Result<Document> {
         Self::try_from(&spki)
     }
 }
 
 #[cfg(feature = "alloc")]
 #[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-impl<'a, Params> TryFrom<&SubjectPublicKeyInfo<Params>> for Document
+impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<&SubjectPublicKeyInfo<Params, Key>> for Document
 where
     Params: Choice<'a> + Encode,
+    Key: BitStringLike<'k, 'a>,
+    BitStringRef<'a>: From<&'k Key>,
 {
     type Error = Error;
 
-    fn try_from(spki: &SubjectPublicKeyInfo<Params>) -> Result<Document> {
+    fn try_from(spki: &SubjectPublicKeyInfo<Params, Key>) -> Result<Document> {
         Ok(Self::encode_msg(spki)?)
     }
 }
 
 #[cfg(feature = "pem")]
 #[cfg_attr(docsrs, doc(cfg(feature = "pem")))]
-impl<Params> PemLabel for SubjectPublicKeyInfo<Params> {
+impl<Params, Key> PemLabel for SubjectPublicKeyInfo<Params, Key> {
     const PEM_LABEL: &'static str = "PUBLIC KEY";
 }
diff --git a/spki/tests/spki.rs b/spki/tests/spki.rs
index a1c229460..9ba19d1aa 100644
--- a/spki/tests/spki.rs
+++ b/spki/tests/spki.rs
@@ -55,7 +55,7 @@ fn decode_ec_p256_der() {
         "1.2.840.10045.3.1.7".parse().unwrap()
     );
 
-    assert_eq!(spki.subject_public_key, &hex!("041CACFFB55F2F2CEFD89D89EB374B2681152452802DEEA09916068137D839CF7FC481A44492304D7EF66AC117BEFE83A8D08F155F2B52F9F618DD447029048E0F")[..]);
+    assert_eq!(spki.subject_public_key.raw_bytes(), &hex!("041CACFFB55F2F2CEFD89D89EB374B2681152452802DEEA09916068137D839CF7FC481A44492304D7EF66AC117BEFE83A8D08F155F2B52F9F618DD447029048E0F")[..]);
 }
 
 #[test]
@@ -67,7 +67,7 @@ fn decode_ed25519_and_fingerprint_spki() {
     assert_eq!(spki.algorithm.oid, "1.3.101.112".parse().unwrap());
     assert_eq!(spki.algorithm.parameters, None);
     assert_eq!(
-        spki.subject_public_key,
+        spki.subject_public_key.raw_bytes(),
         &hex!("4D29167F3F1912A6F7ADFA293A051A15C05EC67B8F17267B1C5550DCE853BD0D")[..]
     );
 
@@ -87,7 +87,7 @@ fn decode_ed25519_and_fingerprint_base64() {
     assert_eq!(spki.algorithm.oid, "1.3.101.112".parse().unwrap());
     assert_eq!(spki.algorithm.parameters, None);
     assert_eq!(
-        spki.subject_public_key,
+        spki.subject_public_key.raw_bytes(),
         &hex!("4D29167F3F1912A6F7ADFA293A051A15C05EC67B8F17267B1C5550DCE853BD0D")[..]
     );
 
@@ -104,7 +104,7 @@ fn decode_rsa_2048_der() {
 
     assert_eq!(spki.algorithm.oid, "1.2.840.113549.1.1.1".parse().unwrap());
     assert!(spki.algorithm.parameters.unwrap().is_null());
-    assert_eq!(spki.subject_public_key, &hex!("3082010A0282010100B6C42C515F10A6AAF282C63EDBE24243A170F3FA2633BD4833637F47CA4F6F36E03A5D29EFC3191AC80F390D874B39E30F414FCEC1FCA0ED81E547EDC2CD382C76F61C9018973DB9FA537972A7C701F6B77E0982DFC15FC01927EE5E7CD94B4F599FF07013A7C8281BDF22DCBC9AD7CABB7C4311C982F58EDB7213AD4558B332266D743AED8192D1884CADB8B14739A8DADA66DC970806D9C7AC450CB13D0D7C575FB198534FC61BC41BC0F0574E0E0130C7BBBFBDFDC9F6A6E2E3E2AFF1CBEAC89BA57884528D55CFB08327A1E8C89F4E003CF2888E933241D9D695BCBBACDC90B44E3E095FA37058EA25B13F5E295CBEAC6DE838AB8C50AF61E298975B872F0203010001")[..]);
+    assert_eq!(spki.subject_public_key.raw_bytes(), &hex!("3082010A0282010100B6C42C515F10A6AAF282C63EDBE24243A170F3FA2633BD4833637F47CA4F6F36E03A5D29EFC3191AC80F390D874B39E30F414FCEC1FCA0ED81E547EDC2CD382C76F61C9018973DB9FA537972A7C701F6B77E0982DFC15FC01927EE5E7CD94B4F599FF07013A7C8281BDF22DCBC9AD7CABB7C4311C982F58EDB7213AD4558B332266D743AED8192D1884CADB8B14739A8DADA66DC970806D9C7AC450CB13D0D7C575FB198534FC61BC41BC0F0574E0E0130C7BBBFBDFDC9F6A6E2E3E2AFF1CBEAC89BA57884528D55CFB08327A1E8C89F4E003CF2888E933241D9D695BCBBACDC90B44E3E095FA37058EA25B13F5E295CBEAC6DE838AB8C50AF61E298975B872F0203010001")[..]);
 }
 
 #[test]

From af02c2f6d3a110324b9519c2f586c3f1adf621a2 Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Fri, 2 Dec 2022 13:07:28 -0800
Subject: [PATCH 5/5] spki: Clean `BitStringLike` implementation

---
 der/src/asn1/bit_string.rs |  8 ++++----
 spki/src/spki.rs           | 19 ++++++++-----------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/der/src/asn1/bit_string.rs b/der/src/asn1/bit_string.rs
index 813d31a0e..587449960 100644
--- a/der/src/asn1/bit_string.rs
+++ b/der/src/asn1/bit_string.rs
@@ -442,16 +442,16 @@ where
 }
 
 /// Trait used as a marker to ensure the type can hold the content of a Bit String
-pub trait BitStringLike<'pointer, 'slice: 'pointer>
+pub trait BitStringLike<'der>
 where
-    Self: Decode<'slice> + Encode + FixedTag + 'pointer,
+    Self: Decode<'der> + Encode + FixedTag,
 {
 }
 
-impl<'slice: 'pointer, 'pointer> BitStringLike<'pointer, 'slice> for BitStringRef<'slice> {}
+impl<'der> BitStringLike<'der> for BitStringRef<'der> {}
 
 #[cfg(feature = "alloc")]
-impl<'a> BitStringLike<'a, 'a> for BitString {}
+impl<'a> BitStringLike<'a> for BitString {}
 
 #[cfg(test)]
 mod tests {
diff --git a/spki/src/spki.rs b/spki/src/spki.rs
index 87f239726..14b60ed81 100644
--- a/spki/src/spki.rs
+++ b/spki/src/spki.rs
@@ -53,11 +53,10 @@ pub struct SubjectPublicKeyInfo<Params, Key> {
     pub subject_public_key: Key,
 }
 
-impl<'a: 'k, 'k, Params, Key: 'k> SubjectPublicKeyInfo<Params, Key>
+impl<'a, Params, Key> SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
-    Key: BitStringLike<'k, 'a>,
-    BitStringRef<'a>: From<&'k Key>,
+    Key: BitStringLike<'a>,
 {
     /// Calculate the SHA-256 fingerprint of this [`SubjectPublicKeyInfo`] and
     /// encode it as a Base64 string.
@@ -101,11 +100,10 @@ where
     }
 }
 
-impl<'a: 'k, 'k, Params, Key: 'k> Sequence<'a> for SubjectPublicKeyInfo<Params, Key>
+impl<'a, Params, Key> Sequence<'a> for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
-    Key: BitStringLike<'k, 'a>,
-    BitStringRef<'a>: From<&'k Key>,
+    Key: BitStringLike<'a>,
 {
     fn fields<F, T>(&self, f: F) -> der::Result<T>
     where
@@ -115,11 +113,10 @@ where
     }
 }
 
-impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<Params, Key>
+impl<'a, Params, Key> TryFrom<&'a [u8]> for SubjectPublicKeyInfo<Params, Key>
 where
     Params: Choice<'a> + Encode,
-    Key: BitStringLike<'k, 'a>,
-    BitStringRef<'a>: From<&'k Key>,
+    Key: BitStringLike<'a>,
 {
     type Error = Error;
 
@@ -146,7 +143,7 @@ where
 impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<SubjectPublicKeyInfo<Params, Key>> for Document
 where
     Params: Choice<'a> + Encode,
-    Key: BitStringLike<'k, 'a>,
+    Key: BitStringLike<'a>,
     BitStringRef<'a>: From<&'k Key>,
 {
     type Error = Error;
@@ -161,7 +158,7 @@ where
 impl<'a: 'k, 'k, Params, Key: 'k> TryFrom<&SubjectPublicKeyInfo<Params, Key>> for Document
 where
     Params: Choice<'a> + Encode,
-    Key: BitStringLike<'k, 'a>,
+    Key: BitStringLike<'a>,
     BitStringRef<'a>: From<&'k Key>,
 {
     type Error = Error;