# `keys/serialize-spki`

## Purpose

Inverse of `parseRsaPublicKeySpki`. Wraps a serialised PKCS#1 `RSAPublicKey`
in a DER `SubjectPublicKeyInfo` per RFC 5280 §4.1, with the canonical
`AlgorithmIdentifier { algorithm = 1.2.840.113549.1.1.1, parameters = NULL }`
inner SEQUENCE.

## Features

- Standard X.509 SPKI emission.
- RFC 3279 §2.3.1 conformant `NULL` algorithm parameters.
- Reuses `serializeRsaPublicKeyPkcs1` so the inner body matches the PKCS#1
  output bit-for-bit.

## Usage: Basic Example

```ts
import { serializeRsaPublicKeySpki } from "@suaveplan/crypto-rsa";

const spki = serializeRsaPublicKeySpki(key);
```

## Usage: Advanced Example

```ts
import { serializeRsaPublicKeySpki } from "@suaveplan/crypto-rsa";

// Compute the SPKI fingerprint downstream consumers expect for cert pinning.
const spki = serializeRsaPublicKeySpki(key);
const fingerprint = await crypto.subtle.digest("SHA-256", spki);
```

## API Reference

### `serializeRsaPublicKeySpki(key: RsaPublicKey): Uint8Array`

Returns the DER-encoded `SubjectPublicKeyInfo`.

## Implementation Notes

The output is the canonical RFC 5280 SPKI; many PKI libraries accept variants
with implicit-NULL parameters (omitted entirely) but emit the explicit-NULL
form, so we follow the de-facto majority. The PKCS#1 body inside the
`BIT STRING` is wrapped with one leading `0x00` "unused bits" byte per
RFC 5280 §4.1 (handled by `encodeBitString`).