cbe156d927
- No more OpenSSL 1.x support - Remove 1DES and 3DES - Remove NETLOGON, NTLM (client and 'digest' service)
208 lines
6.0 KiB
Groff
208 lines
6.0 KiB
Groff
-- From RFC 3369 --
|
|
-- $Id$ --
|
|
|
|
CMS DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS CertificateSerialNumber, AlgorithmIdentifier, Name,
|
|
Attribute, Certificate, SubjectKeyIdentifier FROM rfc2459
|
|
HEIM_ANY FROM heim;
|
|
|
|
id-pkcs7 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) }
|
|
|
|
id-pkcs7-data OBJECT IDENTIFIER ::= { id-pkcs7 1 }
|
|
id-pkcs7-signedData OBJECT IDENTIFIER ::= { id-pkcs7 2 }
|
|
id-pkcs7-envelopedData OBJECT IDENTIFIER ::= { id-pkcs7 3 }
|
|
id-pkcs7-signedAndEnvelopedData OBJECT IDENTIFIER ::= { id-pkcs7 4 }
|
|
id-pkcs7-digestedData OBJECT IDENTIFIER ::= { id-pkcs7 5 }
|
|
id-pkcs7-encryptedData OBJECT IDENTIFIER ::= { id-pkcs7 6 }
|
|
|
|
CMSVersion ::= INTEGER {
|
|
cMSVersion-v0(0),
|
|
cMSVersion-v1(1),
|
|
cMSVersion-v2(2),
|
|
cMSVersion-v3(3),
|
|
cMSVersion-v4(4)
|
|
}
|
|
|
|
DigestAlgorithmIdentifier ::= AlgorithmIdentifier
|
|
DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
|
|
SignatureAlgorithmIdentifier ::= AlgorithmIdentifier
|
|
|
|
ContentType ::= OBJECT IDENTIFIER
|
|
MessageDigest ::= OCTET STRING
|
|
|
|
EncapsulatedContentInfo ::= SEQUENCE {
|
|
eContentType ContentType,
|
|
eContent [0] EXPLICIT OCTET STRING OPTIONAL
|
|
}
|
|
|
|
CertificateChoices ::= CHOICE {
|
|
certificate Certificate,
|
|
any HEIM_ANY
|
|
}
|
|
|
|
-- Really, for us this is strictly a Certificate. See RFC 5911.
|
|
CertificateSet ::= SET OF CertificateChoices
|
|
|
|
CertificateList ::= Certificate
|
|
|
|
CertificateRevocationLists ::= SET OF CertificateList
|
|
|
|
IssuerAndSerialNumber ::= SEQUENCE {
|
|
issuer Name,
|
|
serialNumber CertificateSerialNumber
|
|
}
|
|
|
|
-- RecipientIdentifier is same as SignerIdentifier,
|
|
-- lets glue them togheter and save some bytes and share code for them
|
|
|
|
CMSIdentifier ::= CHOICE {
|
|
issuerAndSerialNumber IssuerAndSerialNumber,
|
|
subjectKeyIdentifier [0] SubjectKeyIdentifier
|
|
}
|
|
|
|
SignerIdentifier ::= CMSIdentifier
|
|
RecipientIdentifier ::= CMSIdentifier
|
|
|
|
--- CMSAttributes are the combined UnsignedAttributes and SignedAttributes
|
|
--- to store space and share code
|
|
|
|
CMSAttributes ::= SET OF Attribute -- SIZE (1..MAX)
|
|
|
|
SignatureValue ::= OCTET STRING
|
|
|
|
SignerInfo ::= SEQUENCE {
|
|
version CMSVersion,
|
|
sid SignerIdentifier,
|
|
digestAlgorithm DigestAlgorithmIdentifier,
|
|
signedAttrs [0] IMPLICIT CMSAttributes OPTIONAL,
|
|
signatureAlgorithm SignatureAlgorithmIdentifier,
|
|
signature SignatureValue,
|
|
unsignedAttrs [1] IMPLICIT CMSAttributes OPTIONAL
|
|
}
|
|
|
|
SignerInfos ::= SET OF SignerInfo
|
|
|
|
SignedData ::= SEQUENCE {
|
|
version CMSVersion,
|
|
digestAlgorithms DigestAlgorithmIdentifiers,
|
|
encapContentInfo EncapsulatedContentInfo,
|
|
certificates [0] IMPLICIT CertificateSet OPTIONAL,
|
|
crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
|
|
signerInfos SignerInfos
|
|
}
|
|
|
|
OriginatorInfo ::= SEQUENCE {
|
|
certs [0] IMPLICIT CertificateSet OPTIONAL,
|
|
crls [1] IMPLICIT CertificateRevocationLists OPTIONAL
|
|
}
|
|
|
|
KeyEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
|
|
ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
|
|
|
|
EncryptedKey ::= OCTET STRING
|
|
|
|
KeyTransRecipientInfo ::= SEQUENCE {
|
|
version CMSVersion, -- always set to 0 or 2
|
|
rid RecipientIdentifier,
|
|
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
|
|
encryptedKey EncryptedKey
|
|
}
|
|
|
|
RecipientInfo ::= KeyTransRecipientInfo
|
|
|
|
RecipientInfos ::= SET OF RecipientInfo
|
|
|
|
EncryptedContent ::= OCTET STRING
|
|
|
|
EncryptedContentInfo ::= SEQUENCE {
|
|
contentType ContentType,
|
|
contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
|
|
encryptedContent [0] IMPLICIT OCTET STRING OPTIONAL
|
|
}
|
|
|
|
UnprotectedAttributes ::= SET OF Attribute -- SIZE (1..MAX)
|
|
|
|
CMSEncryptedData ::= SEQUENCE {
|
|
version CMSVersion,
|
|
encryptedContentInfo EncryptedContentInfo,
|
|
unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL
|
|
}
|
|
|
|
EnvelopedData ::= SEQUENCE {
|
|
version CMSVersion,
|
|
originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
|
|
recipientInfos RecipientInfos,
|
|
encryptedContentInfo EncryptedContentInfo,
|
|
unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL
|
|
}
|
|
|
|
-- Data ::= OCTET STRING
|
|
|
|
CMSRC2CBCParameter ::= SEQUENCE {
|
|
rc2ParameterVersion INTEGER (0..4294967295),
|
|
iv OCTET STRING -- exactly 8 octets
|
|
}
|
|
|
|
CMSCBCParameter ::= OCTET STRING
|
|
|
|
-- We don't have a) a builtin TYPE-IDENTIFIER class, b) class equality
|
|
-- assignment yet!
|
|
_CONTENT-TYPE ::= CLASS {
|
|
&id OBJECT IDENTIFIER UNIQUE,
|
|
&Type OPTIONAL
|
|
}
|
|
|
|
ContentInfo{_CONTENT-TYPE:ContentSet} ::= SEQUENCE {
|
|
contentType _CONTENT-TYPE.&id({ContentSet}),
|
|
content [0] EXPLICIT _CONTENT-TYPE.&Type({ContentSet}{@contentType}) OPTIONAL
|
|
}
|
|
|
|
-- Content Type Object Identifiers and Objects
|
|
|
|
id-ct-contentInfo OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) ct(1) 6 }
|
|
|
|
id-data OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 1 }
|
|
|
|
OctetString ::= OCTET STRING -- workaround compiler bug
|
|
ct-Data _CONTENT-TYPE ::= { &id id-data, &Type OctetString }
|
|
|
|
id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }
|
|
|
|
ct-SignedData _CONTENT-TYPE ::= { &id id-signedData, &Type SignedData }
|
|
|
|
id-envelopedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 3 }
|
|
|
|
ct-EnvelopedData _CONTENT-TYPE ::= { &id id-envelopedData, &Type EnvelopedData }
|
|
|
|
id-digestedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 5 }
|
|
-- ct-DigestedData _CONTENT-TYPE ::= { &id id-digestedData, &Type DigestedData }
|
|
|
|
id-encryptedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 6 }
|
|
|
|
-- ct-EncryptedData _CONTENT-TYPE ::= { &id id-encryptedData, &Type EncryptedData }
|
|
|
|
id-ct-authData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1) 2 }
|
|
|
|
-- ct-AuthenticatedData _CONTENT-TYPE ::=
|
|
-- { &id id-ct-authData, &Type AuthenticatedData }
|
|
|
|
ContentSet _CONTENT-TYPE ::= {
|
|
-- Define the set of content types to be recognized.
|
|
ct-Data | ct-SignedData | ct-EnvelopedData
|
|
-- | ct-EncryptedData
|
|
-- | ct-AuthenticatedData | ct-DigestedData
|
|
}
|
|
|
|
ContentInfo ::= ContentInfo{ContentSet}
|
|
|
|
END
|