---
id: "x509_key_identifier"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["cryptography"]
langs: ["common"]
quality: 80
url: "https://registry.apicrafter.io/datatype/x509_key_identifier"
---

# X.509 key identifier (SKI, AKI) (`x509_key_identifier`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Identifier of a public key in the subjectKeyIdentifier and authorityKeyIdentifier extensions of an X.509 certificate. It links a certificate to the certificate of its issuer and to revocation lists. RFC 5280 suggests the 160-bit SHA-1 of the public key (20 octets) or a 64-bit form of it (8 octets), and allows other methods. The regexp covers the 20- and 8-octet forms in hexadecimal, compact or with colons. The compact 20-octet form looks like a SHA-1 hash: the type is told by the field name.

- Personal data (PII): no
- Categories: Cryptographic identifiers (cryptography)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^(?:[0-9A-Fa-f]{40}|[0-9A-Fa-f]{16}|[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){19}|[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){7})$
```

## Examples

- `F0B481FE9812BFB528B9644003CBCC1F664E2803` — subjectKeyIdentifier of the example certificate of RFC 7468, section 5.1
- `F0:B4:81:FE:98:12:BF:B5:28:B9:64:40:03:CB:CC:1F:66:4E:28:03` — The same identifier with colons
- `E0986CEDDC7945B1D58115A79A1C75D86601A609` — subjectKeyIdentifier of a CA certificate in the register of accredited certification authorities (e-trust.gosuslugi.ru)
- `F0B481FE9812BFB528B9644003CBCC1F664E28` (invalid example) — 19 octets

## Translations

- ru: Идентификатор ключа X.509 (SKI, AKI): Идентификатор открытого ключа в расширениях subjectKeyIdentifier и authorityKeyIdentifier сертификата X.509, обычно SHA-1 открытого ключа (20 октетов в шестнадцатеричном виде).

## Sources

- doc: <https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2>
- doc: <https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1>

## Quality

Score 80/100. Missing: mapping (Wikidata, Schema.org, ...), detector coverage.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/x509_key_identifier.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/cryptography/x509_key_identifier.yaml>