PKIX1 { }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
-- This contains both PKIX1Implicit88 and RFC2630 ASN.1 modules.
id-pkix OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) }
-- ISO arc for standard certificate and CRL extensions
-- authority key identifier OID and syntax
AuthorityKeyIdentifier ::= SEQUENCE {
keyIdentifier [0] KeyIdentifier OPTIONAL,
authorityCertIssuer [1] GeneralNames OPTIONAL,
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
-- authorityCertIssuer and authorityCertSerialNumber shall both
-- be present or both be absgent
KeyIdentifier ::= OCTET STRING
-- subject key identifier OID and syntax
SubjectKeyIdentifier ::= KeyIdentifier
-- key usage extension OID and syntax
KeyUsage ::= BIT STRING
-- Directory string type --
DirectoryString ::= CHOICE {
teletexString TeletexString (SIZE (1..MAX)),
printableString PrintableString (SIZE (1..MAX)),
universalString UniversalString (SIZE (1..MAX)),
utf8String UTF8String (SIZE (1..MAX)),
bmpString BMPString (SIZE(1..MAX)),
-- IA5String is added here to handle old UID encoded as ia5String --
-- See tests/userid/ for more information. It shouldn't be here, --
-- so if it causes problems, considering dropping it. --
ia5String IA5String (SIZE(1..MAX)) }
SubjectAltName ::= GeneralNames
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] AnotherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ANY,
-- Changed to work with the libtasn1 parser.
directoryName [4] EXPLICIT RDNSequence, --Name,
ediPartyName [5] ANY, --EDIPartyName replaced by ANY to save memory
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER }
-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
-- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
AnotherName ::= SEQUENCE {
type-id OBJECT IDENTIFIER,
value [0] EXPLICIT ANY DEFINED BY type-id }
-- issuer alternative name extension OID and syntax
IssuerAltName ::= GeneralNames
-- basic constraints extension OID and syntax
BasicConstraints ::= SEQUENCE {
cA BOOLEAN DEFAULT FALSE,
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
-- CRL distribution points extension OID and syntax
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
DistributionPoint ::= SEQUENCE {
distributionPoint [0] EXPLICIT DistributionPointName OPTIONAL,
reasons [1] ReasonFlags OPTIONAL,
cRLIssuer [2] GeneralNames OPTIONAL
}
DistributionPointName ::= CHOICE {
fullName [0] GeneralNames,
nameRelativeToCRLIssuer [1] RelativeDistinguishedName
}
ReasonFlags ::= BIT STRING
-- extended key usage extension OID and syntax
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
KeyPurposeId ::= OBJECT IDENTIFIER
-- CRL number extension OID and syntax
CRLNumber ::= INTEGER (0..MAX)
-- certificate issuer CRL entry extension OID and syntax
CertificateIssuer ::= GeneralNames
-- attribute data types --
Attribute ::= SEQUENCE {
type AttributeType,
values SET OF AttributeValue
-- at least one value is required --
}
AttributeType ::= OBJECT IDENTIFIER
AttributeValue ::= ANY DEFINED BY type
AttributeTypeAndValue ::= SEQUENCE {
type AttributeType,
value AttributeValue }
-- suggested naming attributes: Definition of the following
-- information object set may be augmented to meet local
-- requirements. Note that deleting members of the set may
-- prevent interoperability with conforming implementations.
-- presented in pairs: the AttributeType followed by the
-- type definition for the corresponding AttributeValue
-- Arc for standard naming attributes
id-at OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
-- Attributes of type NameDirectoryString
-- gnutls: Note that the Object ID (id-at*) is being set just before the
-- actual definition. This is done in order for asn1_find_structure_from_oid
-- to work (locate structure from OID).
-- Maybe this is inefficient and memory consuming. Should we replace with
-- a table that maps OIDs to structures?
PostalAddress ::= SEQUENCE OF DirectoryString
-- Legacy attributes
emailAddress AttributeType ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 1 }
Pkcs9email ::= IA5String (SIZE (1..ub-emailaddress-length))
-- naming data types --
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
DistinguishedName ::= RDNSequence
RelativeDistinguishedName ::=
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
-- --------------------------------------------------------
-- certificate and CRL specific structures begin here
-- --------------------------------------------------------
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertificate ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version shall be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version shall be v3 --
}
Version ::= INTEGER { v1(0), v2(1), v3(2) }
CertificateSerialNumber ::= INTEGER
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
UniqueIdentifier ::= BIT STRING
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING }
-- ------------------------------------------
-- CRL structures
-- ------------------------------------------
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }
TBSCertList ::= SEQUENCE {
version Version OPTIONAL,
-- if present, shall be v2
signature AlgorithmIdentifier,
issuer Name,
thisUpdate Time,
nextUpdate Time OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL
-- if present, shall be v2
} OPTIONAL,
crlExtensions [0] EXPLICIT Extensions OPTIONAL
-- if present, shall be v2 --
}
-- Version, Time, CertificateSerialNumber, and Extensions were
-- defined earlier for use in the certificate structure
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }
-- contains a value of the type
-- registered for use with the
-- algorithm object identifier value
-- Algorithm OIDs and parameter structures
Dss-Sig-Value ::= SEQUENCE {
r INTEGER,
s INTEGER
}
DomainParameters ::= SEQUENCE {
p INTEGER, -- odd prime, p=jq +1
g INTEGER, -- generator, g
q INTEGER, -- factor of p-1
j INTEGER OPTIONAL, -- subgroup factor, j>= 2
validationParms ValidationParms OPTIONAL }
ValidationParms ::= SEQUENCE {
seed BIT STRING,
pgenCounter INTEGER }
Dss-Parms ::= SEQUENCE {
p INTEGER,
q INTEGER,
g INTEGER }
-- x400 address syntax starts here
-- OR Names
CountryName ::= [APPLICATION 1] CHOICE {
x121-dcc-code NumericString
(SIZE (ub-country-name-numeric-length)),
iso-3166-alpha2-code PrintableString
(SIZE (ub-country-name-alpha-length)) }
OrganizationName ::= PrintableString
(SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name
NumericUserIdentifier ::= NumericString
(SIZE (1..ub-numeric-user-id-length))
-- see also teletex-personal-name
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
OF OrganizationalUnitName
-- see also teletex-organizational-unit-names
OrganizationalUnitName ::= PrintableString (SIZE
(1..ub-organizational-unit-name-length))
-- Extension types and attribute values
--
CommonName ::= PrintableString
-- END of PKIX1Implicit88
-- BEGIN of RFC2630
-- Cryptographic Message Syntax
pkcs-7-ContentInfo ::= SEQUENCE {
contentType pkcs-7-ContentType,
content [0] EXPLICIT ANY DEFINED BY contentType }
pkcs-7-DigestInfo ::= SEQUENCE {
digestAlgorithm pkcs-7-DigestAlgorithmIdentifier,
digest pkcs-7-Digest
}
pkcs-7-Digest ::= OCTET STRING
pkcs-7-ContentType ::= OBJECT IDENTIFIER
pkcs-7-SignedData ::= SEQUENCE {
version pkcs-7-CMSVersion,
digestAlgorithms pkcs-7-DigestAlgorithmIdentifiers,
encapContentInfo pkcs-7-EncapsulatedContentInfo,
certificates [0] IMPLICIT pkcs-7-CertificateSet OPTIONAL,
crls [1] IMPLICIT pkcs-7-CertificateRevocationLists OPTIONAL,
signerInfos pkcs-7-SignerInfos
}
pkcs-7-CMSVersion ::= INTEGER { v0(0), v1(1), v2(2), v3(3), v4(4) }
pkcs-7-DigestAlgorithmIdentifiers ::= SET OF pkcs-7-DigestAlgorithmIdentifier
pkcs-7-DigestAlgorithmIdentifier ::= AlgorithmIdentifier
pkcs-7-EncapsulatedContentInfo ::= SEQUENCE {
eContentType pkcs-7-ContentType,
eContent [0] EXPLICIT OCTET STRING OPTIONAL }
-- We don't use CertificateList here since we only want
-- to read the raw data.
pkcs-7-CertificateRevocationLists ::= SET OF ANY
pkcs-7-CertificateChoices ::= CHOICE {
-- Although the paper uses Certificate type, we
-- don't use it since, we don't need to parse it.
-- We only need to read and store it.
certificate ANY
}
pkcs-7-CertificateSet ::= SET OF pkcs-7-CertificateChoices
pkcs-7-SignerInfos ::= SET OF ANY -- this is not correct but we don't use it
-- anyway
-- BEGIN of RFC2986
-- Certificate requests
pkcs-10-CertificationRequestInfo ::= SEQUENCE {
version INTEGER { v1(0) },
subject Name,
subjectPKInfo SubjectPublicKeyInfo,
attributes [0] Attributes
}
Attributes ::= SET OF Attribute
pkcs-10-CertificationRequest ::= SEQUENCE {
certificationRequestInfo pkcs-10-CertificationRequestInfo,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING
}
-- stuff from PKCS#9
pkcs-9-at-challengePassword OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 7}
pkcs-9-challengePassword ::= CHOICE {
printableString PrintableString,
utf8String UTF8String }
pkcs-9-localKeyId ::= OCTET STRING
-- PKCS #8 stuff
-- Private-key information syntax
pkcs-8-PrivateKeyInfo ::= SEQUENCE {
version pkcs-8-Version,
privateKeyAlgorithm AlgorithmIdentifier,
privateKey pkcs-8-PrivateKey,
attributes [0] Attributes OPTIONAL }
pkcs-8-Version ::= INTEGER {v1(0)}
pkcs-8-PrivateKey ::= OCTET STRING
pkcs-8-Attributes ::= SET OF Attribute
-- Encrypted private-key information syntax
pkcs-8-EncryptedPrivateKeyInfo ::= SEQUENCE {
encryptionAlgorithm AlgorithmIdentifier,
encryptedData pkcs-8-EncryptedData
}
pkcs-8-EncryptedData ::= OCTET STRING
-- PKCS #5 stuff
pkcs-5-des-EDE3-CBC-params ::= OCTET STRING (SIZE(8))
pkcs-5-aes128-CBC-params ::= OCTET STRING (SIZE(16))
pkcs-5-aes192-CBC-params ::= OCTET STRING (SIZE(16))
pkcs-5-aes256-CBC-params ::= OCTET STRING (SIZE(16))
pkcs-5-PBES2-params ::= SEQUENCE {
keyDerivationFunc AlgorithmIdentifier,
encryptionScheme AlgorithmIdentifier }
-- PBKDF2
-- pkcs-5-algid-hmacWithSHA1 AlgorithmIdentifier ::=
-- {algorithm pkcs-5-id-hmacWithSHA1, parameters NULL : NULL}
pkcs-5-PBKDF2-params ::= SEQUENCE {
salt CHOICE {
specified OCTET STRING,
otherSource AlgorithmIdentifier
},
iterationCount INTEGER (1..MAX),
keyLength INTEGER (1..MAX) OPTIONAL,
prf AlgorithmIdentifier OPTIONAL -- DEFAULT pkcs-5-id-hmacWithSHA1
}
-- PKCS #12 stuff
pkcs-12-PFX ::= SEQUENCE {
version INTEGER {v3(3)},
authSafe pkcs-7-ContentInfo,
macData pkcs-12-MacData OPTIONAL
}
pkcs-12-PbeParams ::= SEQUENCE {
salt OCTET STRING,
iterations INTEGER
}
pkcs-12-MacData ::= SEQUENCE {
mac pkcs-7-DigestInfo,
macSalt OCTET STRING,
iterations INTEGER DEFAULT 1
-- Note: The default is for historical reasons and its use is
-- deprecated. A higher value, like 1024 is recommended.
}
pkcs-12-AuthenticatedSafe ::= SEQUENCE OF pkcs-7-ContentInfo
-- Data if unencrypted
-- EncryptedData if password-encrypted
-- EnvelopedData if public key-encrypted
pkcs-12-SafeContents ::= SEQUENCE OF pkcs-12-SafeBag
pkcs-12-SafeBag ::= SEQUENCE {
bagId OBJECT IDENTIFIER,
bagValue [0] EXPLICIT ANY DEFINED BY badId,
bagAttributes SET OF pkcs-12-PKCS12Attribute OPTIONAL
}
-- Bag types
pkcs-12-KeyBag ::= pkcs-8-PrivateKeyInfo
-- Shrouded KeyBag
pkcs-12-PKCS8ShroudedKeyBag ::= pkcs-8-EncryptedPrivateKeyInfo
-- CertBag
pkcs-12-CertBag ::= SEQUENCE {
certId OBJECT IDENTIFIER,
certValue [0] EXPLICIT ANY DEFINED BY certId
}
-- x509Certificate BAG-TYPE ::= {OCTET STRING IDENTIFIED BY {pkcs-9-certTypes 1}}
-- DER-encoded X.509 certificate stored in OCTET STRING
pkcs-12-CRLBag ::= SEQUENCE {
crlId OBJECT IDENTIFIER,
crlValue [0] EXPLICIT ANY DEFINED BY crlId
}
pkcs-12-SecretBag ::= SEQUENCE {
secretTypeId OBJECT IDENTIFIER,
secretValue [0] EXPLICIT ANY DEFINED BY secretTypeId
}
-- x509CRL BAG-TYPE ::= {OCTET STRING IDENTIFIED BY {pkcs-9-crlTypes 1}}
-- DER-encoded X.509 CRL stored in OCTET STRING
pkcs-12-PKCS12Attribute ::= Attribute
-- PKCS #7 stuff (needed in PKCS 12)
pkcs-7-Data ::= OCTET STRING
pkcs-7-EncryptedData ::= SEQUENCE {
version pkcs-7-CMSVersion,
encryptedContentInfo pkcs-7-EncryptedContentInfo,
unprotectedAttrs [1] IMPLICIT pkcs-7-UnprotectedAttributes OPTIONAL }
pkcs-7-EncryptedContentInfo ::= SEQUENCE {
contentType pkcs-7-ContentType,
contentEncryptionAlgorithm pkcs-7-ContentEncryptionAlgorithmIdentifier,
encryptedContent [0] IMPLICIT pkcs-7-EncryptedContent OPTIONAL }
pkcs-7-ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
pkcs-7-EncryptedContent ::= OCTET STRING
pkcs-7-UnprotectedAttributes ::= SET SIZE (1..MAX) OF Attribute
-- rfc3820
ProxyCertInfo ::= SEQUENCE {
pCPathLenConstraint INTEGER (0..MAX) OPTIONAL,
proxyPolicy ProxyPolicy }
ProxyPolicy ::= SEQUENCE {
policyLanguage OBJECT IDENTIFIER,
policy OCTET STRING OPTIONAL }
END