1211 lines
40 KiB
Groff
1211 lines
40 KiB
Groff
-- $Id$ --
|
|
-- Definitions from RFCs 2459, 3280, 5280
|
|
--
|
|
-- Note that those RFCs come with *two* ASN.1 modules, one being a default-
|
|
-- EXPLICIT tagged module, and the other being default-IMPLICIT. Some types
|
|
-- are in one module, while others are in the other. Here the two modules
|
|
-- are merged into a single default-EXPLICIT tagged module, with IMPLICIT added
|
|
-- for all tags for types in the default-IMPLICIT module.
|
|
|
|
RFC2459 DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS HEIM_ANY FROM heim
|
|
PrincipalName, Realm FROM krb5;
|
|
-- For OtherName we really want to also import:
|
|
-- KRB5PrincipalName FROM pkinit
|
|
-- PermanentIdentifier FROM rfc4043
|
|
-- HardwareModuleName FROM rfc4108;
|
|
-- But we can't because that creates circular dependencies.
|
|
|
|
Version ::= INTEGER {
|
|
rfc3280_version_1(0),
|
|
rfc3280_version_2(1),
|
|
rfc3280_version_3(2)
|
|
}
|
|
|
|
id-pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
|
rsadsi(113549) pkcs(1) 1 }
|
|
id-pkcs1-rsaEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 1 }
|
|
id-pkcs1-md2WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 2 }
|
|
id-pkcs1-md5WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 4 }
|
|
id-pkcs1-sha1WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 5 }
|
|
id-pkcs1-sha256WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 11 }
|
|
id-pkcs1-sha384WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 12 }
|
|
id-pkcs1-sha512WithRSAEncryption OBJECT IDENTIFIER ::= { id-pkcs-1 13 }
|
|
|
|
id-heim-rsa-pkcs1-x509 OBJECT IDENTIFIER ::= { 1 2 752 43 16 1 }
|
|
|
|
id-pkcs-2 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
|
rsadsi(113549) pkcs(1) 2 }
|
|
id-pkcs2-md2 OBJECT IDENTIFIER ::= { id-pkcs-2 2 }
|
|
id-pkcs2-md4 OBJECT IDENTIFIER ::= { id-pkcs-2 4 }
|
|
id-pkcs2-md5 OBJECT IDENTIFIER ::= { id-pkcs-2 5 }
|
|
|
|
id-rsa-digestAlgorithm OBJECT IDENTIFIER ::=
|
|
{ iso(1) member-body(2) us(840) rsadsi(113549) 2 }
|
|
|
|
id-rsa-digest-md2 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 2 }
|
|
id-rsa-digest-md4 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 4 }
|
|
id-rsa-digest-md5 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 5 }
|
|
|
|
id-pkcs-3 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
|
rsadsi(113549) pkcs(1) 3 }
|
|
|
|
id-pkcs3-rc2-cbc OBJECT IDENTIFIER ::= { id-pkcs-3 2 }
|
|
id-pkcs3-rc4 OBJECT IDENTIFIER ::= { id-pkcs-3 4 }
|
|
id-pkcs3-des-ede3-cbc OBJECT IDENTIFIER ::= { id-pkcs-3 7 }
|
|
|
|
id-rsadsi-encalg OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
|
rsadsi(113549) 3 }
|
|
|
|
id-rsadsi-rc2-cbc OBJECT IDENTIFIER ::= { id-rsadsi-encalg 2 }
|
|
id-rsadsi-des-ede3-cbc OBJECT IDENTIFIER ::= { id-rsadsi-encalg 7 }
|
|
|
|
id-secsig-sha-1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
|
oiw(14) secsig(3) algorithm(2) 26 }
|
|
|
|
id-secsig-sha-1WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
|
oiw(14) secsig(3) algorithm(2) 29 }
|
|
|
|
id-nistAlgorithm OBJECT IDENTIFIER ::= {
|
|
joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) 4 }
|
|
|
|
id-nist-aes-algs OBJECT IDENTIFIER ::= { id-nistAlgorithm 1 }
|
|
|
|
id-aes-128-cbc OBJECT IDENTIFIER ::= { id-nist-aes-algs 2 }
|
|
id-aes-192-cbc OBJECT IDENTIFIER ::= { id-nist-aes-algs 22 }
|
|
id-aes-256-cbc OBJECT IDENTIFIER ::= { id-nist-aes-algs 42 }
|
|
|
|
id-nist-sha-algs OBJECT IDENTIFIER ::= { id-nistAlgorithm 2 }
|
|
|
|
id-sha256 OBJECT IDENTIFIER ::= { id-nist-sha-algs 1 }
|
|
id-sha224 OBJECT IDENTIFIER ::= { id-nist-sha-algs 4 }
|
|
id-sha384 OBJECT IDENTIFIER ::= { id-nist-sha-algs 2 }
|
|
id-sha512 OBJECT IDENTIFIER ::= { id-nist-sha-algs 3 }
|
|
|
|
id-dhpublicnumber OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-x942(10046)
|
|
number-type(2) 1 }
|
|
|
|
-- ECC
|
|
|
|
id-ecPublicKey OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 }
|
|
|
|
id-ecDH OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) schemes(1)
|
|
ecdh(12) }
|
|
|
|
id-ecMQV OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) schemes(1)
|
|
ecmqv(13) }
|
|
|
|
id-ecdsa-with-SHA512 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
|
|
ecdsa-with-SHA2(3) 4 }
|
|
|
|
id-ecdsa-with-SHA384 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
|
|
ecdsa-with-SHA2(3) 3 }
|
|
|
|
id-ecdsa-with-SHA256 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
|
|
ecdsa-with-SHA2(3) 2 }
|
|
|
|
id-ecdsa-with-SHA224 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
|
|
ecdsa-with-SHA2(3) 1 }
|
|
|
|
id-ecdsa-with-SHA1 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 }
|
|
|
|
-- some EC group ids
|
|
|
|
id-ec-group-secp256r1 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)
|
|
prime(1) 7 }
|
|
|
|
id-ec-group-secp160r1 OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) 0 8 }
|
|
|
|
id-ec-group-secp160r2 OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) 0 30 }
|
|
|
|
id-ec-group-secp224r1 OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) 0 33 }
|
|
|
|
id-ec-group-secp384r1 OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) 0 34 }
|
|
|
|
id-ec-group-secp521r1 OBJECT IDENTIFIER ::= {
|
|
iso(1) identified-organization(3) certicom(132) 0 35 }
|
|
|
|
-- DSA
|
|
|
|
id-x9-57 OBJECT IDENTIFIER ::= {
|
|
iso(1) member-body(2) us(840) ansi-x942(10046) 4 }
|
|
|
|
id-dsa OBJECT IDENTIFIER ::= { id-x9-57 1 }
|
|
id-dsa-with-sha1 OBJECT IDENTIFIER ::= { id-x9-57 3 }
|
|
|
|
-- x.520 names types
|
|
|
|
id-x520-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }
|
|
|
|
id-at-commonName OBJECT IDENTIFIER ::= { id-x520-at 3 }
|
|
id-at-surname OBJECT IDENTIFIER ::= { id-x520-at 4 }
|
|
id-at-serialNumber OBJECT IDENTIFIER ::= { id-x520-at 5 }
|
|
id-at-countryName OBJECT IDENTIFIER ::= { id-x520-at 6 }
|
|
id-at-localityName OBJECT IDENTIFIER ::= { id-x520-at 7 }
|
|
id-at-stateOrProvinceName OBJECT IDENTIFIER ::= { id-x520-at 8 }
|
|
id-at-streetAddress OBJECT IDENTIFIER ::= { id-x520-at 9 }
|
|
id-at-organizationName OBJECT IDENTIFIER ::= { id-x520-at 10 }
|
|
id-at-organizationalUnitName OBJECT IDENTIFIER ::= { id-x520-at 11 }
|
|
id-at-title OBJECT IDENTIFIER ::= { id-x520-at 12 }
|
|
id-at-description OBJECT IDENTIFIER ::= { id-x520-at 13 }
|
|
id-at-name OBJECT IDENTIFIER ::= { id-x520-at 41 }
|
|
id-at-givenName OBJECT IDENTIFIER ::= { id-x520-at 42 }
|
|
id-at-initials OBJECT IDENTIFIER ::= { id-x520-at 43 }
|
|
id-at-generationQualifier OBJECT IDENTIFIER ::= { id-x520-at 44 }
|
|
id-at-dnQualifier OBJECT IDENTIFIER ::= { id-x520-at 46 }
|
|
id-at-pseudonym OBJECT IDENTIFIER ::= { id-x520-at 65 }
|
|
-- RFC 2247
|
|
id-Userid OBJECT IDENTIFIER ::=
|
|
{ 0 9 2342 19200300 100 1 1 }
|
|
id-domainComponent OBJECT IDENTIFIER ::=
|
|
{ 0 9 2342 19200300 100 1 25 }
|
|
|
|
id-at-emailAddress AttributeType ::=
|
|
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 1 }
|
|
|
|
|
|
|
|
-- rfc3280
|
|
|
|
id-x509-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
|
|
|
|
AlgorithmIdentifier ::= SEQUENCE {
|
|
algorithm OBJECT IDENTIFIER,
|
|
parameters HEIM_ANY OPTIONAL
|
|
}
|
|
|
|
AttributeType ::= OBJECT IDENTIFIER
|
|
|
|
AttributeValue ::= HEIM_ANY
|
|
|
|
DirectoryString ::= CHOICE {
|
|
ia5String IA5String,
|
|
teletexString TeletexString,
|
|
printableString PrintableString,
|
|
universalString UniversalString,
|
|
utf8String UTF8String,
|
|
bmpString BMPString
|
|
}
|
|
|
|
AttributeValues ::= SET OF AttributeValue
|
|
|
|
Attribute ::= SEQUENCE {
|
|
type AttributeType,
|
|
value AttributeValues
|
|
}
|
|
|
|
AttributeTypeAndValue ::= SEQUENCE {
|
|
type AttributeType,
|
|
value DirectoryString
|
|
}
|
|
|
|
-- RDNs really should be SET OF SingleAttribute per the RFCs, but making that
|
|
-- change will affect lib/hx509 code, so we'll wait. The issue is that there
|
|
-- is code in lib/hx509 and in lib/asn1/check-gen.c that assumes that the
|
|
-- `value` of an rdn is a `DirectoryString` and not an open type.
|
|
--
|
|
-- Also, it's really not worth making this change, as a) it will increase the
|
|
-- amount of code needed in lib/hx509, and b) it really is useful to be able to
|
|
-- assume RDN values are ultimately only strings, c) we don't have any attrs
|
|
-- for RDNs that aren't strings, and d) the non-string attributes from TCG that
|
|
-- are used in SubjectDirectoryAttributes will never be used here (so we hope).
|
|
--
|
|
-- Until we fix this lib/hx509 cannot support name attributes whose type isn't
|
|
-- DirectoryString. For example, the UID attribute is broken at this time, as
|
|
-- that wants NumericString.
|
|
--
|
|
RelativeDistinguishedName ::= SET OF AttributeTypeAndValue -- XXX SingleAttribute
|
|
|
|
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
|
|
|
|
Name ::= CHOICE {
|
|
rdnSequence RDNSequence
|
|
}
|
|
|
|
CertificateSerialNumber ::= INTEGER
|
|
|
|
Time ::= CHOICE {
|
|
utcTime UTCTime,
|
|
generalTime GeneralizedTime
|
|
}
|
|
|
|
Validity ::= SEQUENCE {
|
|
notBefore Time,
|
|
notAfter Time
|
|
}
|
|
|
|
UniqueIdentifier ::= BIT STRING
|
|
|
|
SubjectPublicKeyInfo ::= SEQUENCE {
|
|
algorithm AlgorithmIdentifier,
|
|
subjectPublicKey BIT STRING
|
|
}
|
|
|
|
-- XXX Should be _OTHER-NAME ::= _TYPE-IDENTIFIER
|
|
_OTHER-NAME ::= CLASS {
|
|
&id OBJECT IDENTIFIER UNIQUE,
|
|
&Type
|
|
}
|
|
|
|
OtherName{_OTHER-NAME:OtherNameSet} ::= SEQUENCE {
|
|
type-id _OTHER-NAME.&id({OtherNameSet}),
|
|
value [0] _OTHER-NAME.&Type({OtherNameSet}{@type-id})
|
|
}
|
|
|
|
_ATTRIBUTE ::= CLASS {
|
|
&id OBJECT IDENTIFIER UNIQUE,
|
|
&Type OPTIONAL,
|
|
-- &equality-match MATCHING-RULE OPTIONAL,
|
|
&minCount INTEGER DEFAULT 1,
|
|
&maxCount INTEGER OPTIONAL
|
|
}
|
|
|
|
SingleAttribute{_ATTRIBUTE:AttrSet} ::= SEQUENCE {
|
|
type _ATTRIBUTE.&id({AttrSet}),
|
|
value _ATTRIBUTE.&Type({AttrSet}{@type})
|
|
}
|
|
|
|
AttributeSet{_ATTRIBUTE:AttrSet} ::= SEQUENCE {
|
|
type _ATTRIBUTE.&id({AttrSet}),
|
|
values SET --SIZE (1..MAX)-- OF _ATTRIBUTE.&Type({AttrSet}{@type})
|
|
}
|
|
|
|
_EXTENSION ::= CLASS {
|
|
&id OBJECT IDENTIFIER UNIQUE,
|
|
&ExtnType,
|
|
&Critical BOOLEAN DEFAULT FALSE
|
|
}
|
|
|
|
Extension{_EXTENSION:ExtensionSet} ::= SEQUENCE {
|
|
extnID _EXTENSION.&id({ExtensionSet}),
|
|
critical BOOLEAN
|
|
-- (EXTENSION.&Critical({ExtensionSet}{@extnID}))
|
|
DEFAULT FALSE,
|
|
extnValue OCTET STRING (CONTAINING
|
|
_EXTENSION.&ExtnType({ExtensionSet}{@extnID}))
|
|
}
|
|
|
|
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
|
|
|
TBSCertificate ::= SEQUENCE {
|
|
version [0] Version OPTIONAL, -- EXPLICIT nnn DEFAULT 1,
|
|
serialNumber CertificateSerialNumber,
|
|
signature AlgorithmIdentifier,
|
|
issuer Name,
|
|
validity Validity,
|
|
subject Name,
|
|
subjectPublicKeyInfo SubjectPublicKeyInfo,
|
|
issuerUniqueID [1] IMPLICIT BIT STRING -- UniqueIdentifier -- OPTIONAL,
|
|
-- If present, version shall be v2 or v3
|
|
subjectUniqueID [2] IMPLICIT BIT STRING -- UniqueIdentifier -- OPTIONAL,
|
|
-- If present, version shall be v2 or v3
|
|
extensions [3] EXPLICIT Extensions OPTIONAL
|
|
-- If present, version shall be v3
|
|
}
|
|
|
|
Certificate ::= SEQUENCE {
|
|
tbsCertificate TBSCertificate,
|
|
signatureAlgorithm AlgorithmIdentifier,
|
|
signatureValue BIT STRING
|
|
}
|
|
|
|
Certificates ::= SEQUENCE OF Certificate
|
|
|
|
ValidationParms ::= SEQUENCE {
|
|
seed BIT STRING,
|
|
pgenCounter INTEGER
|
|
}
|
|
|
|
DomainParameters ::= SEQUENCE {
|
|
p INTEGER, -- odd prime, p=jq +1
|
|
g INTEGER, -- generator, g
|
|
q INTEGER OPTIONAL, -- factor of p-1
|
|
j INTEGER OPTIONAL, -- subgroup factor
|
|
validationParms ValidationParms OPTIONAL -- ValidationParms
|
|
}
|
|
|
|
-- As defined by PKCS3
|
|
DHParameter ::= SEQUENCE {
|
|
prime INTEGER, -- odd prime, p=jq +1
|
|
base INTEGER, -- generator, g
|
|
privateValueLength INTEGER OPTIONAL
|
|
}
|
|
|
|
DHPublicKey ::= INTEGER
|
|
|
|
GeneralName ::= CHOICE {
|
|
otherName [0] IMPLICIT OtherName,
|
|
rfc822Name [1] IMPLICIT IA5String,
|
|
dNSName [2] IMPLICIT IA5String,
|
|
-- x400Address [3] IMPLICIT ORAddress,--
|
|
directoryName [4] IMPLICIT Name,
|
|
-- ediPartyName [5] IMPLICIT EDIPartyName, --
|
|
uniformResourceIdentifier [6] IMPLICIT IA5String,
|
|
iPAddress [7] IMPLICIT OCTET STRING,
|
|
registeredID [8] IMPLICIT OBJECT IDENTIFIER
|
|
}
|
|
|
|
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
|
|
|
|
id-x509-ce-keyUsage OBJECT IDENTIFIER ::= { id-x509-ce 15 }
|
|
|
|
KeyUsage ::= BIT STRING {
|
|
digitalSignature (0),
|
|
nonRepudiation (1),
|
|
keyEncipherment (2),
|
|
dataEncipherment (3),
|
|
keyAgreement (4),
|
|
keyCertSign (5),
|
|
cRLSign (6),
|
|
encipherOnly (7),
|
|
decipherOnly (8)
|
|
}
|
|
|
|
-- private key usage period extension OID and syntax
|
|
|
|
PrivateKeyUsagePeriod ::= SEQUENCE {
|
|
notBefore [0] IMPLICIT GeneralizedTime OPTIONAL,
|
|
notAfter [1] IMPLICIT GeneralizedTime OPTIONAL
|
|
-- either notBefore or notAfter MUST be present
|
|
}
|
|
|
|
-- certificate policies extension OID and syntax
|
|
|
|
_POLICYQUALIFIERINFO ::= CLASS { -- Heimdal extension
|
|
&id OBJECT IDENTIFIER UNIQUE,
|
|
&Type
|
|
}
|
|
|
|
CertPolicyId ::= OBJECT IDENTIFIER
|
|
PolicyQualifierId ::= OBJECT IDENTIFIER -- ( id-qt-cps | id-qt-unotice )
|
|
|
|
PolicyQualifierInfo{_POLICYQUALIFIERINFO:PolicyQualifierSet} ::= SEQUENCE {
|
|
policyQualifierId _POLICYQUALIFIERINFO.&id({PolicyQualifierSet}),
|
|
qualifier _POLICYQUALIFIERINFO.&Type({PolicyQualifierSet}{@policyQualifierId})
|
|
}
|
|
|
|
PolicyQualifierInfos ::= SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo
|
|
|
|
PolicyInformation ::= SEQUENCE {
|
|
policyIdentifier CertPolicyId,
|
|
policyQualifiers PolicyQualifierInfos OPTIONAL
|
|
}
|
|
|
|
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
|
|
|
|
-- CPS pointer qualifier
|
|
|
|
CPSuri ::= IA5String
|
|
|
|
-- user notice qualifier
|
|
|
|
DisplayText ::= CHOICE {
|
|
ia5String IA5String, --(SIZE (1..200))
|
|
visibleString VisibleString, --(SIZE (1..200))
|
|
bmpString BMPString, --(SIZE (1..200))
|
|
utf8String UTF8String --(SIZE (1..200))
|
|
}
|
|
|
|
NoticeReference ::= SEQUENCE {
|
|
organization DisplayText,
|
|
noticeNumbers SEQUENCE OF INTEGER
|
|
}
|
|
|
|
UserNotice ::= SEQUENCE {
|
|
noticeRef NoticeReference OPTIONAL,
|
|
explicitText DisplayText OPTIONAL
|
|
}
|
|
|
|
-- policy mapping extension OID and syntax
|
|
|
|
PolicyMapping ::= SEQUENCE {
|
|
issuerDomainPolicy CertPolicyId,
|
|
subjectDomainPolicy CertPolicyId
|
|
}
|
|
|
|
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF PolicyMapping
|
|
|
|
-- subject key identifier OID and syntax
|
|
|
|
id-x509-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-x509-ce 35 }
|
|
|
|
KeyIdentifier ::= OCTET STRING
|
|
|
|
AuthorityKeyIdentifier ::= SEQUENCE {
|
|
keyIdentifier [0] IMPLICIT OCTET STRING OPTIONAL,
|
|
authorityCertIssuer [1] IMPLICIT -- GeneralName --
|
|
SEQUENCE -- SIZE (1..MAX) -- OF GeneralName OPTIONAL,
|
|
authorityCertSerialNumber [2] IMPLICIT INTEGER OPTIONAL
|
|
}
|
|
|
|
id-x509-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-x509-ce 14 }
|
|
|
|
SubjectKeyIdentifier ::= KeyIdentifier
|
|
|
|
id-x509-ce-basicConstraints OBJECT IDENTIFIER ::= { id-x509-ce 19 }
|
|
|
|
BasicConstraints ::= SEQUENCE {
|
|
cA BOOLEAN DEFAULT FALSE,
|
|
pathLenConstraint INTEGER (0..4294967295) OPTIONAL
|
|
}
|
|
|
|
id-x509-ce-nameConstraints OBJECT IDENTIFIER ::= { id-x509-ce 30 }
|
|
|
|
BaseDistance ::= INTEGER (0..4294967295)
|
|
|
|
GeneralSubtree ::= SEQUENCE {
|
|
base GeneralName,
|
|
minimum [0] IMPLICIT BaseDistance DEFAULT 0,
|
|
maximum [1] IMPLICIT BaseDistance OPTIONAL
|
|
}
|
|
|
|
GeneralSubtrees ::= SEQUENCE -- SIZE (1..MAX) -- OF GeneralSubtree
|
|
|
|
NameConstraints ::= SEQUENCE {
|
|
permittedSubtrees [0] IMPLICIT -- GeneralSubtrees -- SEQUENCE OF GeneralSubtree OPTIONAL,
|
|
excludedSubtrees [1] IMPLICIT -- GeneralSubtrees -- SEQUENCE OF GeneralSubtree OPTIONAL
|
|
}
|
|
|
|
id-x509-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-x509-ce 16 }
|
|
id-x509-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-x509-ce 32 }
|
|
id-x509-ce-certificatePolicies-anyPolicy OBJECT IDENTIFIER ::= { id-x509-ce-certificatePolicies 0 }
|
|
id-x509-ce-policyMappings OBJECT IDENTIFIER ::= { id-x509-ce 33 }
|
|
id-x509-ce-subjectAltName OBJECT IDENTIFIER ::= { id-x509-ce 17 }
|
|
id-x509-ce-issuerAltName OBJECT IDENTIFIER ::= { id-x509-ce 18 }
|
|
id-x509-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-x509-ce 9 }
|
|
id-x509-ce-policyConstraints OBJECT IDENTIFIER ::= { id-x509-ce 36 }
|
|
|
|
id-x509-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-x509-ce 37}
|
|
id-x509-ce-anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-x509-ce-extKeyUsage 0 }
|
|
|
|
ExtKeyUsage ::= SEQUENCE OF OBJECT IDENTIFIER
|
|
|
|
id-x509-ce-cRLReasons OBJECT IDENTIFIER ::= { id-x509-ce 21 }
|
|
id-x509-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-x509-ce 31 }
|
|
id-x509-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-x509-ce 27 }
|
|
id-x509-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-x509-ce 28 }
|
|
id-x509-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-x509-ce 23 }
|
|
id-x509-ce-invalidityDate OBJECT IDENTIFIER ::= { id-x509-ce 24 }
|
|
id-x509-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-x509-ce 29 }
|
|
id-x509-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-x509-ce 54 }
|
|
|
|
-- Heimdal extension
|
|
id-heim-ce-pkinit-princ-max-life OBJECT IDENTIFIER ::=
|
|
{ iso(1) member-body(2) se(752) su(43) heim-pkix(16) 4 }
|
|
|
|
|
|
DistributionPointReasonFlags ::= BIT STRING {
|
|
unused (0),
|
|
keyCompromise (1),
|
|
cACompromise (2),
|
|
affiliationChanged (3),
|
|
superseded (4),
|
|
cessationOfOperation (5),
|
|
certificateHold (6),
|
|
privilegeWithdrawn (7),
|
|
aACompromise (8)
|
|
}
|
|
|
|
DistributionPointName ::= CHOICE {
|
|
fullName [0] IMPLICIT -- GeneralNames -- SEQUENCE SIZE (1..MAX) OF GeneralName,
|
|
nameRelativeToCRLIssuer [1] RelativeDistinguishedName
|
|
}
|
|
|
|
DistributionPoint ::= SEQUENCE {
|
|
distributionPoint [0] IMPLICIT DistributionPointName OPTIONAL,
|
|
reasons [1] IMPLICIT DistributionPointReasonFlags OPTIONAL,
|
|
cRLIssuer [2] IMPLICIT GeneralNames OPTIONAL
|
|
}
|
|
|
|
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
|
|
|
|
|
|
-- rfc3279
|
|
|
|
DSASigValue ::= SEQUENCE {
|
|
r INTEGER,
|
|
s INTEGER
|
|
}
|
|
|
|
DSAPublicKey ::= INTEGER
|
|
|
|
DSAParams ::= SEQUENCE {
|
|
p INTEGER,
|
|
q INTEGER,
|
|
g INTEGER
|
|
}
|
|
|
|
-- draft-ietf-pkix-ecc-subpubkeyinfo-11
|
|
|
|
ECPoint ::= OCTET STRING
|
|
|
|
ECParameters ::= CHOICE {
|
|
namedCurve OBJECT IDENTIFIER
|
|
-- implicitCurve NULL
|
|
-- specifiedCurve SpecifiedECDomain
|
|
}
|
|
|
|
ECDSA-Sig-Value ::= SEQUENCE {
|
|
r INTEGER,
|
|
s INTEGER
|
|
}
|
|
|
|
-- really pkcs1
|
|
|
|
RSAPublicKey ::= SEQUENCE {
|
|
modulus INTEGER, -- n
|
|
publicExponent INTEGER -- e
|
|
}
|
|
|
|
RSAPrivateKey ::= SEQUENCE {
|
|
version INTEGER (0..4294967295),
|
|
modulus INTEGER, -- n
|
|
publicExponent INTEGER, -- e
|
|
privateExponent INTEGER, -- d
|
|
prime1 INTEGER, -- p
|
|
prime2 INTEGER, -- q
|
|
exponent1 INTEGER, -- d mod (p-1)
|
|
exponent2 INTEGER, -- d mod (q-1)
|
|
coefficient INTEGER -- (inverse of q) mod p
|
|
}
|
|
|
|
DigestInfo ::= SEQUENCE {
|
|
digestAlgorithm AlgorithmIdentifier,
|
|
digest OCTET STRING
|
|
}
|
|
|
|
-- some ms ext
|
|
|
|
-- szOID_ENROLL_CERTTYPE_EXTENSION "1.3.6.1.4.1.311.20.2" is Encoded as a
|
|
|
|
-- UNICODESTRING (0x1E tag)
|
|
|
|
-- szOID_CERTIFICATE_TEMPLATE "1.3.6.1.4.1.311.21.7" is Encoded as:
|
|
|
|
-- TemplateVersion ::= INTEGER (0..4294967295)
|
|
|
|
-- CertificateTemplate ::= SEQUENCE {
|
|
-- templateID OBJECT IDENTIFIER,
|
|
-- templateMajorVersion TemplateVersion,
|
|
-- templateMinorVersion TemplateVersion OPTIONAL
|
|
-- }
|
|
|
|
|
|
--
|
|
-- CRL
|
|
--
|
|
|
|
TBSCRLCertList ::= SEQUENCE {
|
|
version Version OPTIONAL, -- if present, MUST be v2
|
|
signature AlgorithmIdentifier,
|
|
issuer Name,
|
|
thisUpdate Time,
|
|
nextUpdate Time OPTIONAL,
|
|
revokedCertificates SEQUENCE OF SEQUENCE {
|
|
userCertificate CertificateSerialNumber,
|
|
revocationDate Time,
|
|
crlEntryExtensions Extensions OPTIONAL
|
|
-- if present, MUST be v2
|
|
} OPTIONAL,
|
|
crlExtensions [0] EXPLICIT Extensions OPTIONAL
|
|
-- if present, MUST be v2
|
|
}
|
|
|
|
|
|
CRLCertificateList ::= SEQUENCE {
|
|
tbsCertList TBSCRLCertList,
|
|
signatureAlgorithm AlgorithmIdentifier,
|
|
signatureValue BIT STRING
|
|
}
|
|
|
|
id-x509-ce-cRLNumber OBJECT IDENTIFIER ::= { id-x509-ce 20 }
|
|
id-x509-ce-freshestCRL OBJECT IDENTIFIER ::= { id-x509-ce 46 }
|
|
id-x509-ce-cRLReason OBJECT IDENTIFIER ::= { id-x509-ce 21 }
|
|
|
|
CRLReason ::= ENUMERATED {
|
|
unspecified (0),
|
|
keyCompromise (1),
|
|
cACompromise (2),
|
|
affiliationChanged (3),
|
|
superseded (4),
|
|
cessationOfOperation (5),
|
|
certificateHold (6),
|
|
removeFromCRL (8),
|
|
privilegeWithdrawn (9),
|
|
aACompromise (10)
|
|
}
|
|
|
|
PKIXXmppAddr ::= UTF8String
|
|
|
|
SRVName ::= IA5String -- (SIZE (1..MAX)), but our compiler doesn't do that
|
|
|
|
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
|
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
|
|
|
|
id-pkix-on OBJECT IDENTIFIER ::= { id-pkix 8 }
|
|
id-pkix-on-xmppAddr OBJECT IDENTIFIER ::= { id-pkix-on 5 }
|
|
id-pkix-on-dnsSRV OBJECT IDENTIFIER ::= { id-pkix-on 7 }
|
|
|
|
-- From RFC4108
|
|
id-pkix-on-hardwareModuleName OBJECT IDENTIFIER ::= { id-pkix-on 4 }
|
|
HardwareModuleName ::= SEQUENCE {
|
|
hwType OBJECT IDENTIFIER,
|
|
hwSerialNum OCTET STRING
|
|
}
|
|
|
|
-- XXX Not really the right name
|
|
id-pkix-on-pkinit-san OBJECT IDENTIFIER ::=
|
|
{ iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
|
|
x509-sanan(2) }
|
|
KRB5PrincipalName ::= SEQUENCE {
|
|
realm [0] Realm,
|
|
principalName [1] PrincipalName
|
|
}
|
|
|
|
-- From RFC4043:
|
|
-- Permanent identifier Object Identifier and Syntax
|
|
id-pkix-on-permanentIdentifier OBJECT IDENTIFIER ::= { id-pkix-on 3 }
|
|
|
|
PermanentIdentifier ::= SEQUENCE {
|
|
identifierValue UTF8String OPTIONAL,
|
|
-- if absent, use the serialNumber attribute
|
|
-- if there is a single such attribute present
|
|
-- in the subject DN
|
|
assigner OBJECT IDENTIFIER OPTIONAL
|
|
-- if absent, the assigner is
|
|
-- the certificate issuer
|
|
}
|
|
|
|
-- EKUs
|
|
id-pkix-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
|
id-pkix-kp-serverAuth OBJECT IDENTIFIER ::= { id-pkix-kp 1 }
|
|
id-pkix-kp-clientAuth OBJECT IDENTIFIER ::= { id-pkix-kp 2 }
|
|
id-pkix-kp-codeSigning OBJECT IDENTIFIER ::= { id-pkix-kp 3 }
|
|
id-pkix-kp-emailProtection OBJECT IDENTIFIER ::= { id-pkix-kp 4 }
|
|
id-pkix-kp-ipsecEndSystem OBJECT IDENTIFIER ::= { id-pkix-kp 5 }
|
|
id-pkix-kp-ipsecTunnel OBJECT IDENTIFIER ::= { id-pkix-kp 6 }
|
|
id-pkix-kp-ipsecUser OBJECT IDENTIFIER ::= { id-pkix-kp 7 }
|
|
id-pkix-kp-timeStamping OBJECT IDENTIFIER ::= { id-pkix-kp 8 }
|
|
id-pkix-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-pkix-kp 9 }
|
|
-- The following are taken from RFC7299 and others
|
|
id-pkix-kp-DVCS OBJECT IDENTIFIER ::= { id-pkix-kp 10 }
|
|
id-pkix-kp-ipsecIKE OBJECT IDENTIFIER ::= { id-pkix-kp 17 }
|
|
id-pkix-kp-capwapAC OBJECT IDENTIFIER ::= { id-pkix-kp 18 }
|
|
id-pkix-kp-capwapWTP OBJECT IDENTIFIER ::= { id-pkix-kp 19 }
|
|
id-pkix-kp-sipDomain OBJECT IDENTIFIER ::= { id-pkix-kp 20 } -- RFC5924
|
|
id-pkix-kp-secureShellClient OBJECT IDENTIFIER ::= { id-pkix-kp 21 }
|
|
id-pkix-kp-secureShellServer OBJECT IDENTIFIER ::= { id-pkix-kp 22 }
|
|
id-pkix-kp-sendRouter OBJECT IDENTIFIER ::= { id-pkix-kp 23 }
|
|
id-pkix-kp-sendProxiedRouter OBJECT IDENTIFIER ::= { id-pkix-kp 24 }
|
|
id-pkix-kp-sendOwner OBJECT IDENTIFIER ::= { id-pkix-kp 25 }
|
|
id-pkix-kp-sendProxiedOwner OBJECT IDENTIFIER ::= { id-pkix-kp 26 }
|
|
id-pkix-kp-cmcCA OBJECT IDENTIFIER ::= { id-pkix-kp 27 } -- RFC6402
|
|
id-pkix-kp-cmcRA OBJECT IDENTIFIER ::= { id-pkix-kp 28 } -- RFC6402
|
|
id-pkix-kp-cmcArchive OBJECT IDENTIFIER ::= { id-pkix-kp 29 } -- RFC6402
|
|
id-pkix-kp-bgpsec-router OBJECT IDENTIFIER ::= { id-pkix-kp 30 } -- RFC8209
|
|
-- The following are MSFT EKUs taken from OpenSSL
|
|
id-msft OBJECT IDENTIFIER ::= { 1 3 6 1 4 1 311 }
|
|
id-msft-kp-msCodeInd OBJECT IDENTIFIER ::= { id-msft 2 1 21 }
|
|
id-msft-kp-msCodeCom OBJECT IDENTIFIER ::= { id-msft 2 1 22 }
|
|
id-msft-kp-msCTLSign OBJECT IDENTIFIER ::= { id-msft 10 3 1 }
|
|
id-msft-kp-msSGC OBJECT IDENTIFIER ::= { id-msft 10 3 3 }
|
|
id-msft-kp-msEFS OBJECT IDENTIFIER ::= { id-msft 10 3 4 }
|
|
id-msft-kp-msSmartcardLogin OBJECT IDENTIFIER ::= { id-msft 20 2 2 }
|
|
id-msft-kp-msUPN OBJECT IDENTIFIER ::= { id-msft 20 2 3 }
|
|
|
|
id-pkix-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
|
|
id-pkix-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pkix-pe 1 }
|
|
|
|
AccessDescription ::= SEQUENCE {
|
|
accessMethod OBJECT IDENTIFIER,
|
|
accessLocation GeneralName
|
|
}
|
|
|
|
AuthorityInfoAccessSyntax ::= SEQUENCE SIZE (1..MAX) OF AccessDescription
|
|
|
|
-- RFC 3820 Proxy Certificate Profile
|
|
|
|
id-pkix-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pkix-pe 14 }
|
|
|
|
id-pkix-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pkix-pe 11 }
|
|
|
|
SubjectInfoAccessSyntax ::=
|
|
SEQUENCE SIZE (1..MAX) OF AccessDescription
|
|
|
|
id-pkix-ppl OBJECT IDENTIFIER ::= { id-pkix 21 }
|
|
|
|
id-pkix-ppl-anyLanguage OBJECT IDENTIFIER ::= { id-pkix-ppl 0 }
|
|
id-pkix-ppl-inheritAll OBJECT IDENTIFIER ::= { id-pkix-ppl 1 }
|
|
id-pkix-ppl-independent OBJECT IDENTIFIER ::= { id-pkix-ppl 2 }
|
|
|
|
ProxyPolicy ::= SEQUENCE {
|
|
policyLanguage OBJECT IDENTIFIER,
|
|
policy OCTET STRING OPTIONAL
|
|
}
|
|
|
|
ProxyCertInfo ::= SEQUENCE {
|
|
pCPathLenConstraint INTEGER (0..4294967295) OPTIONAL, -- really MAX
|
|
proxyPolicy ProxyPolicy
|
|
}
|
|
|
|
-- TCG contents:
|
|
|
|
-- See tcg.asn1 for commentary.
|
|
|
|
--TCG specific OIDs
|
|
tcg OBJECT IDENTIFIER ::= {joint-iso-itu-t(2) international-organizations(23) tcg(133)}
|
|
tcg-attribute OBJECT IDENTIFIER ::= {tcg 2}
|
|
tcg-kp OBJECT IDENTIFIER ::= {tcg 8}
|
|
|
|
--TCG Attribute OIDs
|
|
tcg-at-tpmManufacturer OBJECT IDENTIFIER ::= {tcg-attribute 1}
|
|
tcg-at-tpmModel OBJECT IDENTIFIER ::= {tcg-attribute 2}
|
|
tcg-at-tpmVersion OBJECT IDENTIFIER ::= {tcg-attribute 3}
|
|
tcg-at-tpmSpecification OBJECT IDENTIFIER ::= {tcg-attribute 16}
|
|
tcg-at-tpmSecurityAssertions OBJECT IDENTIFIER ::= {tcg-attribute 18}
|
|
|
|
--TCG Attribute objects
|
|
at-TPMSecurityAssertions _ATTRIBUTE ::= { &Type TPMSecurityAssertions, &id tcg-at-tpmSecurityAssertions }
|
|
at-TPMManufacturer _ATTRIBUTE ::= { &Type AliasUTF8String, --(SIZE (1..STRMAX))-- &id tcg-at-tpmManufacturer }
|
|
at-TPMModel _ATTRIBUTE ::= { &Type AliasUTF8String, --(SIZE (1..STRMAX))-- &id tcg-at-tpmModel }
|
|
at-TPMVersion _ATTRIBUTE ::= { &Type AliasUTF8String, --(SIZE (1..STRMAX))-- &id tcg-at-tpmVersion }
|
|
at-TPMSpecification _ATTRIBUTE ::= { &Type TPMSpecification, &id tcg-at-tpmSpecification }
|
|
|
|
--TCG Extended Key Usage OIDs
|
|
tcg-kp-EKCertificate OBJECT IDENTIFIER ::= {tcg-kp 1}
|
|
|
|
-- OIDs not in the module in TCG_IWG_EKCredentialProfile_v2p3_r2_pub but in
|
|
-- TCG_IWG_DevID_v1r2_02dec2020 (missing arc names not mentioned in the TCG
|
|
-- specs):
|
|
tcg-tpm20 OBJECT IDENTIFIER ::= {tcg 1 2} -- this OID is not named in the TCG specs
|
|
tcg-on-ekPermIdSha256 OBJECT IDENTIFIER ::= {tcg 12 1} -- assigner value for PermanentIdentifier SAN
|
|
tcg-cap-verifiedTPMResidency OBJECT IDENTIFIER ::= {tcg 11 1 1} -- policy OID
|
|
tcg-cap-verifiedTPMFixed OBJECT IDENTIFIER ::= {tcg 11 1 2} -- policy OID
|
|
tcg-cap-verifiedTPMRestricted OBJECT IDENTIFIER ::= {tcg 11 1 3} -- policy OID
|
|
|
|
EKGenerationType ::= ENUMERATED {
|
|
ekgt-internal (0),
|
|
ekgt-injected (1),
|
|
ekgt-internalRevocable(2),
|
|
ekgt-injectedRevocable(3)
|
|
}
|
|
EKGenerationLocation ::= ENUMERATED {
|
|
tpmManufacturer (0),
|
|
platformManufacturer (1),
|
|
ekCertSigner (2)
|
|
}
|
|
EKCertificateGenerationLocation ::= EKGenerationLocation -- XXX
|
|
EvaluationAssuranceLevel ::= ENUMERATED {
|
|
ealevell (1),
|
|
ealevel2 (2),
|
|
ealevel3 (3),
|
|
ealevel4 (4),
|
|
ealevel5 (5),
|
|
ealevel6 (6),
|
|
ealevel7 (7)
|
|
}
|
|
SecurityLevel ::= ENUMERATED {
|
|
sllevel1 (1),
|
|
sllevel2 (2),
|
|
sllevel3 (3),
|
|
sllevel4 (4)
|
|
}
|
|
StrengthOfFunction ::= ENUMERATED {
|
|
sof-basic (0),
|
|
sof-medium (1),
|
|
sof-high (2)
|
|
}
|
|
URIReference ::= SEQUENCE {
|
|
uniformResourceIdentifier IA5String, -- (SIZE (1..URIMAX))
|
|
hashAlgorithm AlgorithmIdentifier OPTIONAL,
|
|
hashValue BIT STRING OPTIONAL
|
|
}
|
|
EvaluationStatus ::= ENUMERATED {
|
|
designedToMeet (0),
|
|
evaluationInProgress (1),
|
|
evaluationCompleted (2)
|
|
}
|
|
|
|
--tcg specification attributes for tpm
|
|
TPMSpecification ::= SEQUENCE {
|
|
family UTF8String, -- (SIZE (1..STRMAX))
|
|
level INTEGER (0..4294967295),
|
|
revision INTEGER (0..4294967295),
|
|
...
|
|
}
|
|
|
|
|
|
--common criteria evaluation
|
|
CommonCriteriaMeasures ::= SEQUENCE {
|
|
version IA5String, -- (SIZE (1..STRMAX)) “2.2” or “3.1”;future syntax defined by CC
|
|
assurancelevel EvaluationAssuranceLevel,
|
|
evaluationStatus EvaluationStatus,
|
|
plus BOOLEAN DEFAULT FALSE,
|
|
strengthOfFunction [0] IMPLICIT StrengthOfFunction OPTIONAL,
|
|
profileOid [1] IMPLICIT OBJECT IDENTIFIER OPTIONAL,
|
|
profileUri [2] IMPLICIT URIReference OPTIONAL,
|
|
targetOid [3] IMPLICIT OBJECT IDENTIFIER OPTIONAL,
|
|
targetUri [4] IMPLICIT URIReference OPTIONAL,
|
|
...
|
|
}
|
|
|
|
--fips evaluation
|
|
FIPSLevel ::= SEQUENCE {
|
|
version IA5String, -- (SIZE (1..STRMAX)) “140-1” or “140-2”
|
|
level SecurityLevel,
|
|
plus BOOLEAN DEFAULT FALSE,
|
|
...
|
|
}
|
|
|
|
--tpm security assertions
|
|
TPMVersion ::= INTEGER { tpm-v1(0) }
|
|
TPMSecurityAssertions ::= SEQUENCE {
|
|
version TPMVersion DEFAULT 0, -- v1
|
|
fieldUpgradable BOOLEAN DEFAULT FALSE,
|
|
-- The TCG EK cert profile spec says all these context tags are IMPLICIT,
|
|
-- but samples in the field have them as EXPLICIT.
|
|
ekGenerationType [0] EXPLICIT EKGenerationType OPTIONAL,
|
|
ekGenerationLocation [1] EXPLICIT EKGenerationLocation OPTIONAL,
|
|
ekCertificateGenerationLocation [2] EXPLICIT EKCertificateGenerationLocation OPTIONAL,
|
|
ccInfo [3] EXPLICIT CommonCriteriaMeasures OPTIONAL,
|
|
fipsLevel [4] EXPLICIT FIPSLevel OPTIONAL,
|
|
iso9000Certified [5] EXPLICIT BOOLEAN DEFAULT FALSE,
|
|
iso9000Uri IA5String OPTIONAL, -- (SIZE (1..URIMAX))
|
|
...
|
|
}
|
|
|
|
-- Back to OtherName, SingleAttribute, AttributeSet, and Extension
|
|
|
|
-- XXX Not really the right name for this OID:
|
|
id-pkix-on-pkinit-ms-san OBJECT IDENTIFIER ::=
|
|
{ iso(1) org(3) dod(6) internet(1) private(4)
|
|
enterprise(1) microsoft(311) 20 2 3 }
|
|
|
|
-- XXX Work around bug (where we don't know the names of universal types in the
|
|
-- template backend) by creating aliases for universal types we use in IOS
|
|
-- objects.
|
|
AliasUTF8String ::= UTF8String
|
|
AliasIA5String ::= UTF8String
|
|
AliasPrintableString ::= PrintableString
|
|
on-xmppAddr _OTHER-NAME ::= { &id id-pkix-on-xmppAddr, &Type AliasUTF8String }
|
|
on-dnsSRV _OTHER-NAME ::= { &id id-pkix-on-dnsSRV, &Type AliasIA5String }
|
|
on-hardwareModuleName _OTHER-NAME ::= {
|
|
&id id-pkix-on-hardwareModuleName,
|
|
&Type HardwareModuleName
|
|
}
|
|
on-permanentIdentifier _OTHER-NAME ::= {
|
|
&id id-pkix-on-permanentIdentifier,
|
|
&Type PermanentIdentifier
|
|
}
|
|
on-krb5PrincipalName _OTHER-NAME ::= {
|
|
&id id-pkix-on-pkinit-san,
|
|
&Type KRB5PrincipalName
|
|
}
|
|
on-pkinit-ms-san _OTHER-NAME ::= {
|
|
&id id-pkix-on-pkinit-ms-san,
|
|
&Type AliasUTF8String
|
|
}
|
|
|
|
KnownOtherNameTypes _OTHER-NAME ::= {
|
|
on-xmppAddr
|
|
| on-dnsSRV
|
|
| on-hardwareModuleName
|
|
| on-permanentIdentifier
|
|
| on-krb5PrincipalName
|
|
| on-pkinit-ms-san
|
|
}
|
|
|
|
OtherName ::= OtherName{KnownOtherNameTypes}
|
|
|
|
X520name ::= DirectoryString --{ub-name}
|
|
X520CommonName ::= DirectoryString --{ub-common-name}
|
|
X520LocalityName ::= DirectoryString --{ub-locality-name}
|
|
X520OrganizationName ::= DirectoryString --{ub-organization-name}
|
|
X520StateOrProvinceName ::= DirectoryString --{ub-state-name}
|
|
X520OrganizationalUnitName ::= DirectoryString --{ub-organizational-unit-name}
|
|
|
|
at-name _ATTRIBUTE ::= { &Type X520name, &id id-at-name }
|
|
at-surname _ATTRIBUTE ::= { &Type X520name, &id id-at-surname }
|
|
at-givenName _ATTRIBUTE ::= { &Type X520name, &id id-at-givenName }
|
|
at-initials _ATTRIBUTE ::= { &Type X520name, &id id-at-initials }
|
|
at-generationQualifier _ATTRIBUTE ::= { &Type X520name, &id id-at-generationQualifier }
|
|
at-x520CommonName _ATTRIBUTE ::= {&Type X520CommonName, &id id-at-commonName }
|
|
at-x520LocalityName _ATTRIBUTE ::= { &Type X520LocalityName, &id id-at-localityName }
|
|
at-x520StateOrProvinceName _ATTRIBUTE ::= { &Type DirectoryString --{ub-state-name}--, &id id-at-stateOrProvinceName }
|
|
at-x520OrganizationName _ATTRIBUTE ::= { &Type DirectoryString --{ub-organization-name}--, &id id-at-organizationName }
|
|
at-x520OrganizationalUnitName _ATTRIBUTE ::= { &Type DirectoryString --{ub-organizational-unit-name}--, &id id-at-organizationalUnitName }
|
|
at-x520Title _ATTRIBUTE ::= { &Type DirectoryString --{ub-title}--, &id id-at-title }
|
|
at-x520dnQualifier _ATTRIBUTE ::= { &Type AliasPrintableString, &id id-at-dnQualifier }
|
|
at-x520countryName _ATTRIBUTE ::= { &Type AliasPrintableString --(SIZE (2))--, &id id-at-countryName }
|
|
at-x520SerialNumber _ATTRIBUTE ::= {&Type AliasPrintableString --(SIZE (1..ub-serial-number))--, &id id-at-serialNumber }
|
|
at-x520Pseudonym _ATTRIBUTE ::= { &Type DirectoryString --{ub-pseudonym}--, &id id-at-pseudonym }
|
|
at-domainComponent _ATTRIBUTE ::= { &Type AliasIA5String, &id id-domainComponent }
|
|
at-emailAddress _ATTRIBUTE ::= { &Type AliasIA5String --(SIZE (1..ub-emailaddress-length))--, &id id-at-emailAddress }
|
|
|
|
SupportedAttributes _ATTRIBUTE ::= {
|
|
at-name
|
|
| at-surname
|
|
| at-givenName
|
|
| at-initials
|
|
| at-generationQualifier
|
|
| at-x520CommonName
|
|
| at-x520LocalityName
|
|
| at-x520StateOrProvinceName
|
|
| at-x520OrganizationName
|
|
| at-x520OrganizationalUnitName
|
|
| at-x520Title
|
|
| at-x520dnQualifier
|
|
| at-x520countryName
|
|
| at-x520SerialNumber
|
|
| at-x520Pseudonym
|
|
| at-domainComponent
|
|
| at-emailAddress
|
|
| at-TPMSecurityAssertions
|
|
| at-TPMManufacturer
|
|
| at-TPMModel
|
|
| at-TPMVersion
|
|
| at-TPMSpecification
|
|
}
|
|
|
|
SingleAttribute ::= SingleAttribute{SupportedAttributes}
|
|
AttributeSet ::= AttributeSet{SupportedAttributes}
|
|
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF AttributeSet
|
|
|
|
ext-AuthorityKeyIdentifier _EXTENSION ::= {
|
|
&id id-x509-ce-authorityKeyIdentifier,
|
|
&Critical FALSE,
|
|
&ExtnType AuthorityKeyIdentifier
|
|
}
|
|
ext-KeyUsage _EXTENSION ::= {
|
|
&id id-x509-ce-keyUsage,
|
|
&Critical FALSE,
|
|
&ExtnType KeyUsage
|
|
}
|
|
ext-SubjectKeyIdentifier _EXTENSION ::= {
|
|
&id id-x509-ce-subjectKeyIdentifier,
|
|
&Critical FALSE,
|
|
&ExtnType SubjectKeyIdentifier
|
|
}
|
|
ext-PrivateKeyUsagePeriod _EXTENSION ::= {
|
|
&id id-x509-ce-privateKeyUsagePeriod,
|
|
&Critical FALSE,
|
|
&ExtnType PrivateKeyUsagePeriod
|
|
}
|
|
ext-CertificatePolicies _EXTENSION ::= {
|
|
&id id-x509-ce-certificatePolicies,
|
|
&Critical FALSE,
|
|
&ExtnType CertificatePolicies
|
|
}
|
|
ext-PolicyMappings _EXTENSION ::= {
|
|
&id id-x509-ce-policyMappings,
|
|
&Critical FALSE,
|
|
&ExtnType PolicyMappings
|
|
}
|
|
ext-SubjectAltName _EXTENSION ::= {
|
|
&id id-x509-ce-subjectAltName,
|
|
&Critical FALSE,
|
|
&ExtnType GeneralNames
|
|
}
|
|
ext-IssuerAltName _EXTENSION ::= {
|
|
&id id-x509-ce-issuerAltName,
|
|
&Critical FALSE,
|
|
&ExtnType GeneralNames
|
|
}
|
|
ext-SubjectDirectoryAttributes _EXTENSION ::= {
|
|
&id id-x509-ce-subjectDirectoryAttributes,
|
|
&Critical FALSE,
|
|
&ExtnType SubjectDirectoryAttributes
|
|
}
|
|
ext-BasicConstraints _EXTENSION ::= {
|
|
&id id-x509-ce-basicConstraints,
|
|
&Critical FALSE,
|
|
&ExtnType BasicConstraints
|
|
}
|
|
ext-NameConstraints _EXTENSION ::= {
|
|
&id id-x509-ce-nameConstraints,
|
|
&Critical FALSE,
|
|
&ExtnType NameConstraints
|
|
}
|
|
SkipCerts ::= INTEGER (0..4294967295)
|
|
PolicyConstraints ::= SEQUENCE {
|
|
requireExplicitPolicy [0] IMPLICIT SkipCerts OPTIONAL,
|
|
inhibitPolicyMapping [1] IMPLICIT SkipCerts OPTIONAL
|
|
}
|
|
ext-PolicyConstraints _EXTENSION ::= {
|
|
&id id-x509-ce-policyConstraints,
|
|
&Critical FALSE,
|
|
&ExtnType PolicyConstraints
|
|
}
|
|
ext-ExtKeyUsage _EXTENSION ::= {
|
|
&id id-x509-ce-extKeyUsage,
|
|
&Critical FALSE,
|
|
&ExtnType ExtKeyUsage
|
|
}
|
|
ext-CRLDistributionPoints _EXTENSION ::= {
|
|
&id id-x509-ce-cRLDistributionPoints,
|
|
&Critical FALSE,
|
|
&ExtnType CRLDistributionPoints
|
|
}
|
|
ext-InhibitAnyPolicy _EXTENSION ::= {
|
|
&id id-x509-ce-inhibitAnyPolicy,
|
|
&Critical FALSE,
|
|
&ExtnType SkipCerts
|
|
}
|
|
ext-FreshestCRL _EXTENSION ::= {
|
|
&id id-x509-ce-freshestCRL,
|
|
&Critical FALSE,
|
|
&ExtnType CRLDistributionPoints
|
|
}
|
|
ext-AuthorityInfoAccess _EXTENSION ::= {
|
|
&id id-pkix-pe-authorityInfoAccess,
|
|
&Critical FALSE,
|
|
&ExtnType AuthorityInfoAccessSyntax
|
|
}
|
|
ext-SubjectInfoAccessSyntax _EXTENSION ::= {
|
|
&id id-pkix-pe-subjectInfoAccess,
|
|
&Critical FALSE,
|
|
&ExtnType SubjectInfoAccessSyntax
|
|
}
|
|
ext-ProxyCertInfo _EXTENSION ::= {
|
|
&id id-pkix-pe-proxyCertInfo,
|
|
&Critical FALSE,
|
|
&ExtnType ProxyCertInfo
|
|
}
|
|
HeimPkinitPrincMaxLifeSecs ::= INTEGER (0..4294967295)
|
|
ext-HeimPkinitPrincMaxLife _EXTENSION ::= {
|
|
&id id-heim-ce-pkinit-princ-max-life,
|
|
&Critical FALSE,
|
|
&ExtnType HeimPkinitPrincMaxLifeSecs
|
|
}
|
|
CertExtensions _EXTENSION ::= {
|
|
ext-AuthorityKeyIdentifier
|
|
| ext-SubjectKeyIdentifier
|
|
| ext-KeyUsage
|
|
| ext-PrivateKeyUsagePeriod
|
|
| ext-CertificatePolicies
|
|
| ext-PolicyMappings
|
|
| ext-SubjectAltName
|
|
| ext-IssuerAltName
|
|
| ext-SubjectDirectoryAttributes
|
|
| ext-BasicConstraints
|
|
| ext-NameConstraints
|
|
| ext-PolicyConstraints
|
|
| ext-ExtKeyUsage
|
|
| ext-CRLDistributionPoints
|
|
| ext-InhibitAnyPolicy
|
|
| ext-FreshestCRL
|
|
| ext-AuthorityInfoAccess
|
|
| ext-SubjectInfoAccessSyntax
|
|
| ext-ProxyCertInfo
|
|
| ext-HeimPkinitPrincMaxLife
|
|
}
|
|
|
|
Extension ::= Extension { CertExtensions }
|
|
|
|
--- U.S. Federal PKI Common Policy Framework
|
|
-- Card Authentication key
|
|
id-uspkicommon-card-id OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 6 }
|
|
id-uspkicommon-piv-interim OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 9 1 }
|
|
|
|
--- Netscape extensions
|
|
|
|
id-netscape OBJECT IDENTIFIER ::=
|
|
{ joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730) }
|
|
id-netscape-cert-comment OBJECT IDENTIFIER ::= { id-netscape 1 13 }
|
|
|
|
--- MS extensions
|
|
|
|
id-ms-cert-enroll-domaincontroller OBJECT IDENTIFIER ::=
|
|
{ 1 3 6 1 4 1 311 20 2 }
|
|
|
|
-- This is a duplicate of id-pkix-kp-clientAuth
|
|
-- id-ms-client-authentication OBJECT IDENTIFIER ::=
|
|
-- { 1 3 6 1 5 5 7 3 2 }
|
|
|
|
-- DER:1e:20:00:44:00:6f:00:6d:00:61:00:69:00:6e:00:43:00:6f:00:6e:00:74:00:72:00:6f:00:6c:00:6c:00:65:00:72
|
|
|
|
-- Upper bounds:
|
|
|
|
ub-name INTEGER ::= 32768
|
|
ub-common-name INTEGER ::= 64
|
|
ub-locality-name INTEGER ::= 128
|
|
ub-state-name INTEGER ::= 128
|
|
ub-organization-name INTEGER ::= 64
|
|
ub-organizational-unit-name INTEGER ::= 64
|
|
ub-title INTEGER ::= 64
|
|
ub-serial-number INTEGER ::= 64
|
|
ub-match INTEGER ::= 128
|
|
ub-emailaddress-length INTEGER ::= 255
|
|
ub-common-name-length INTEGER ::= 64
|
|
ub-country-name-alpha-length INTEGER ::= 2
|
|
ub-country-name-numeric-length INTEGER ::= 3
|
|
ub-domain-defined-attributes INTEGER ::= 4
|
|
ub-domain-defined-attribute-type-length INTEGER ::= 8
|
|
ub-domain-defined-attribute-value-length INTEGER ::= 128
|
|
ub-domain-name-length INTEGER ::= 16
|
|
ub-extension-attributes INTEGER ::= 256
|
|
ub-e163-4-number-length INTEGER ::= 15
|
|
ub-e163-4-sub-address-length INTEGER ::= 40
|
|
ub-generation-qualifier-length INTEGER ::= 3
|
|
ub-given-name-length INTEGER ::= 16
|
|
ub-initials-length INTEGER ::= 5
|
|
ub-integer-options INTEGER ::= 256
|
|
ub-numeric-user-id-length INTEGER ::= 32
|
|
ub-organization-name-length INTEGER ::= 64
|
|
ub-organizational-unit-name-length INTEGER ::= 32
|
|
ub-organizational-units INTEGER ::= 4
|
|
ub-pds-name-length INTEGER ::= 16
|
|
ub-pds-parameter-length INTEGER ::= 30
|
|
ub-pds-physical-address-lines INTEGER ::= 6
|
|
ub-postal-code-length INTEGER ::= 16
|
|
ub-pseudonym INTEGER ::= 128
|
|
ub-surname-length INTEGER ::= 40
|
|
ub-terminal-id-length INTEGER ::= 24
|
|
ub-unformatted-address-length INTEGER ::= 180
|
|
ub-x121-address-length INTEGER ::= 16
|
|
|
|
-- Misc OIDs from RFC5280. We should add related types as well.
|
|
|
|
-- Policy qualifiers
|
|
id-pkix-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
|
|
id-pkix-qt-cps OBJECT IDENTIFIER ::= { id-pkix-qt 1 }
|
|
id-pkix-qt-unotice OBJECT IDENTIFIER ::= { id-pkix-qt 2 }
|
|
|
|
-- Access description
|
|
id-pkix-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
|
id-pkix-ad-ocsp OBJECT IDENTIFIER ::= { id-pkix-ad 1 }
|
|
id-pkix-ad-caIssuers OBJECT IDENTIFIER ::= { id-pkix-ad 2 }
|
|
id-pkix-ad-timeStamping OBJECT IDENTIFIER ::= { id-pkix-ad 3 }
|
|
id-pkix-ad-caRepository OBJECT IDENTIFIER ::= { id-pkix-ad 5 }
|
|
|
|
pq-CPS _POLICYQUALIFIERINFO ::= {
|
|
&id id-pkix-qt-cps,
|
|
&Type AliasIA5String
|
|
}
|
|
pq-UserNotice _POLICYQUALIFIERINFO ::= {
|
|
&id id-pkix-qt-unotice,
|
|
&Type UserNotice
|
|
}
|
|
KnownPolicyQualifiers _POLICYQUALIFIERINFO ::= {
|
|
pq-CPS
|
|
| pq-UserNotice
|
|
}
|
|
PolicyQualifierInfo ::= PolicyQualifierInfo{KnownPolicyQualifiers}
|
|
|
|
END
|