{
  "schema_version": "1.0.0",
  "record_type": "citation-evidence-pack",
  "pack_id": "certificate-key-matcher",
  "title": "Certificate and key match evidence",
  "description": "Canonical SPKI comparison outcomes for an exact public-key match, a different key, and malformed PEM.",
  "scope": "These cases prove public-key equality only. They do not establish certificate trust, validity, revocation, hostname coverage, or private-key control.",
  "canonical_url": "https://encrypt-online.com/evidence/certificate-key-matcher.json",
  "tool": {
    "id": "certificate-key-matcher",
    "name": "Certificate and Key Matcher",
    "path": "/tools/certificate-key-matcher",
    "canonical_url": "https://encrypt-online.com/tools/certificate-key-matcher"
  },
  "implementation": {
    "version": "source-sha256:0111f7b415a343c8",
    "aggregate_sha256": "0111f7b415a343c8715232b55e78c23f9219e17818946a4144d823fc2a9b827e",
    "sources": [
      {
        "path": "lib/pki-diagnostics-core.mjs",
        "sha256": "cf737107897fba6fe61ea09a69a68924042f797d43438be03fbfaa4b3190f0b5"
      },
      {
        "path": "lib/browser-security-fixtures.mjs",
        "sha256": "77c7622557ad876d4c62b09a18ffb3d4f71374081ae44a8487282620f916557f"
      }
    ]
  },
  "verification": {
    "last_verified": "2026-08-05",
    "command": "npm run check:citation-evidence",
    "environments": [
      "Node.js release check with Web Crypto",
      "Chromium desktop 1440x900 evidence presentation"
    ]
  },
  "standards": [
    {
      "name": "Internet X.509 Public Key Infrastructure Certificate Profile",
      "section": "Section 4.1.2.7, Subject Public Key Info",
      "url": "https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7"
    },
    {
      "name": "PKCS #10 Certification Request Syntax",
      "section": "CertificationRequestInfo and subjectPKInfo",
      "url": "https://www.rfc-editor.org/rfc/rfc2986"
    }
  ],
  "cases": [
    {
      "case_id": "PKI-SPKI-MATCH-001",
      "classification": "valid",
      "symptom": "A synthetic certificate and standalone public key contain the same canonical SPKI bytes.",
      "safe_input": {
        "left_pem": "-----BEGIN CERTIFICATE-----\nMIIDpjCCAo6gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMx\nETAPBgNVBAgMCE5ldyBZb3JrMRwwGgYDVQQKDBNFbmNyeXB0IE9ubGluZSBEZW1v\nMRAwDgYDVQQLDAdQS0kgTGFiMRcwFQYDVQQDDA5yc2EuZGVtby5sb2NhbDAeFw0y\nNjAxMDEwMDAwMDBaFw0zNjAxMDEwMDAwMDBaMGkxCzAJBgNVBAYTAlVTMREwDwYD\nVQQIDAhOZXcgWW9yazEcMBoGA1UECgwTRW5jcnlwdCBPbmxpbmUgRGVtbzEQMA4G\nA1UECwwHUEtJIExhYjEXMBUGA1UEAwwOcnNhLmRlbW8ubG9jYWwwggEiMA0GCSqG\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLGNI/qhnawnMLdsrRIJlHzDwm2qjjHsdQ\ntup6GKVfGkBcvTXOLFrSYA3zmEIKgshgJ7jFosBzPy66+VYUJfDhJLqRWW3JwLov\nnulJRu7yhFmV1vtaugCb8ardjWjh3c9LtQEqxaXJdrjPFMnbg4AjeH7n33CHTOaQ\nKzymb1L0n8s3L8MAWIK8+URA3icaGQk8qXAl5bCCEA5Wb8AArMYE3Wlr6b64zHPo\nENWkHeOqmuE3L7NnbR5YHhr/qX5y5N2qD5LS0JzzZhSKk53L2foNs34YOgEY9NYR\nS8EVlzO6NSCImxAa2bhp43P8VylnHNkCEv/xM6mys5gjlMiDfkLLAgMBAAGjWDBW\nMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMDYGA1UdEQQvMC2CDnJzYS5k\nZW1vLmxvY2FsghVpc3N1ZWQucnNhLmRlbW8ubG9jYWyHBMAAAgowDQYJKoZIhvcN\nAQELBQADggEBAH/ioCurqz5sdJQB6WM5+if/vxXilNfytP9PL1ZbL+QOl3CPJa1X\nOPEu9AsfNzH4QS35P0mM+rWZ4Ij4ckdJ3brV5bYh+baGS99v4RsOar0om8xEPP7+\nbmxJtz9zVVnojqsOpFJ7CcrQJE6NyH3bOs1naw1BYR4HuSlBDJPr1QFZKxpfULWZ\nR3n6G3a8jHAQNFnLwFC5M/tVdoiLT+OisjHlZ2XlVE1c9B7ikMs63tISmTZDdyZg\nwoKg+l1DVGv+G0b1DnI7EtQFbdkhPAfP3p7Mns3yvkIQyZ39ITy4nhJ96YCB3xME\nIdgjdpDHUVor0NiujiMYioHPfbGgfWyfK0Q=\n-----END CERTIFICATE-----",
        "right_pem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyxjSP6oZ2sJzC3bK0SCZ\nR8w8Jtqo4x7HULbqehilXxpAXL01zixa0mAN85hCCoLIYCe4xaLAcz8uuvlWFCXw\n4SS6kVltycC6L57pSUbu8oRZldb7WroAm/Gq3Y1o4d3PS7UBKsWlyXa4zxTJ24OA\nI3h+599wh0zmkCs8pm9S9J/LNy/DAFiCvPlEQN4nGhkJPKlwJeWwghAOVm/AAKzG\nBN1pa+m+uMxz6BDVpB3jqprhNy+zZ20eWB4a/6l+cuTdqg+S0tCc82YUipOdy9n6\nDbN+GDoBGPTWEUvBFZczujUgiJsQGtm4aeNz/FcpZxzZAhL/8TOpsrOYI5TIg35C\nywIDAQAB\n-----END PUBLIC KEY-----"
      },
      "expected_output": {
        "status": "match",
        "distinct_key_count": 1,
        "fingerprints_sha256": [
          "91a80b1c3f8f4d69d373b326912d2ad5619ebd402a4b2d5cc784e0dfda75456b",
          "91a80b1c3f8f4d69d373b326912d2ad5619ebd402a4b2d5cc784e0dfda75456b"
        ]
      },
      "failure_code": null,
      "expected_outcome": "Conclude only that the normalized public keys are equal.",
      "fixture_sha256": "1da825fadbc55dc1ca4ac6c3520d11ed06b3863178b07e608e12dacf7509e37b"
    },
    {
      "case_id": "PKI-SPKI-MISMATCH-002",
      "classification": "mismatch",
      "symptom": "Synthetic RSA and EC public keys have different canonical SPKI bytes.",
      "safe_input": {
        "left_pem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyxjSP6oZ2sJzC3bK0SCZ\nR8w8Jtqo4x7HULbqehilXxpAXL01zixa0mAN85hCCoLIYCe4xaLAcz8uuvlWFCXw\n4SS6kVltycC6L57pSUbu8oRZldb7WroAm/Gq3Y1o4d3PS7UBKsWlyXa4zxTJ24OA\nI3h+599wh0zmkCs8pm9S9J/LNy/DAFiCvPlEQN4nGhkJPKlwJeWwghAOVm/AAKzG\nBN1pa+m+uMxz6BDVpB3jqprhNy+zZ20eWB4a/6l+cuTdqg+S0tCc82YUipOdy9n6\nDbN+GDoBGPTWEUvBFZczujUgiJsQGtm4aeNz/FcpZxzZAhL/8TOpsrOYI5TIg35C\nywIDAQAB\n-----END PUBLIC KEY-----",
        "right_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8NPI9Qk4Xio/ArgLx3OeITeLnl4G\nqibwbvsNvUWiTan+K9Vb+UXtk8uFJNEG5xZOLZsqjZo0y8II4x3z5xrewA==\n-----END PUBLIC KEY-----"
      },
      "expected_output": {
        "status": "mismatch",
        "distinct_key_count": 2,
        "fingerprints_sha256": [
          "91a80b1c3f8f4d69d373b326912d2ad5619ebd402a4b2d5cc784e0dfda75456b",
          "0734898c3065f579ea7156997b9ae3feded75809eec25d6ab08dc7931cd99d6c"
        ]
      },
      "failure_code": "PUBLIC_KEY_MISMATCH",
      "expected_outcome": "Reject the pair as different keys even if labels or names look related.",
      "fixture_sha256": "5034e45d2636318b7724908974db0abed23ed2085785e052bf43ae37a15e83cb"
    },
    {
      "case_id": "PKI-PEM-MALFORMED-003",
      "classification": "malformed",
      "symptom": "The second PEM block contains invalid padded Base64 DER.",
      "safe_input": {
        "left_pem": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyxjSP6oZ2sJzC3bK0SCZ\nR8w8Jtqo4x7HULbqehilXxpAXL01zixa0mAN85hCCoLIYCe4xaLAcz8uuvlWFCXw\n4SS6kVltycC6L57pSUbu8oRZldb7WroAm/Gq3Y1o4d3PS7UBKsWlyXa4zxTJ24OA\nI3h+599wh0zmkCs8pm9S9J/LNy/DAFiCvPlEQN4nGhkJPKlwJeWwghAOVm/AAKzG\nBN1pa+m+uMxz6BDVpB3jqprhNy+zZ20eWB4a/6l+cuTdqg+S0tCc82YUipOdy9n6\nDbN+GDoBGPTWEUvBFZczujUgiJsQGtm4aeNz/FcpZxzZAhL/8TOpsrOYI5TIg35C\nywIDAQAB\n-----END PUBLIC KEY-----",
        "right_pem": "-----BEGIN CERTIFICATE REQUEST-----\nnot-valid-base64!\n-----END CERTIFICATE REQUEST-----"
      },
      "expected_output": {
        "status": "rejected",
        "message": "The CERTIFICATE REQUEST block does not contain valid padded Base64 DER data."
      },
      "failure_code": "PKI_PEM_MALFORMED",
      "expected_outcome": "Reject before comparing keys.",
      "fixture_sha256": "fa9a913e8de59d502d7abdde7b1b59ba42aebf4e2503f39e13da1854f4b2fb37"
    }
  ]
}