New asn1 modules for CMC support
Asn1 modules are autogenerated and not covered by pep8 Change-Id: I7a4e9c308001ed3051e68d2a27e454977f6e787b
This commit is contained in:
Stanisław Pitucha
Stanislaw Pitucha
parent
f8a9466d68
commit
b8c76c0739
0
anchor/asn1/__init__.py
Normal file
0
anchor/asn1/__init__.py
Normal file
1505
anchor/asn1/rfc3280.py
Normal file
1505
anchor/asn1/rfc3280.py
Normal file
File diff suppressed because it is too large
Load Diff
344
anchor/asn1/rfc3281.py
Normal file
344
anchor/asn1/rfc3281.py
Normal file
@ -0,0 +1,344 @@
|
||||
# Auto-generated by asn1ate on 2015-12-17 15:14:22.594350
|
||||
from pyasn1.type import univ
|
||||
from pyasn1.type import char
|
||||
from pyasn1.type import namedtype
|
||||
from pyasn1.type import namedval
|
||||
from pyasn1.type import tag
|
||||
from pyasn1.type import constraint
|
||||
from pyasn1.type import useful
|
||||
|
||||
from . import rfc3280
|
||||
|
||||
MAX=64
|
||||
|
||||
def _OID(*components):
|
||||
output = []
|
||||
for x in tuple(components):
|
||||
if isinstance(x, univ.ObjectIdentifier):
|
||||
output.extend(list(x))
|
||||
else:
|
||||
output.append(int(x))
|
||||
|
||||
return univ.ObjectIdentifier(output)
|
||||
|
||||
|
||||
class ObjectDigestInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ObjectDigestInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('digestedObjectType', univ.Enumerated(namedValues=namedval.NamedValues(('publicKey', 0), ('publicKeyCert', 1), ('otherObjectTypes', 2)))),
|
||||
namedtype.OptionalNamedType('otherObjectTypeID', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('digestAlgorithm', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('objectDigest', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class IssuerSerial(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
IssuerSerial.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuer', rfc3280.GeneralNames()),
|
||||
namedtype.NamedType('serial', rfc3280.CertificateSerialNumber()),
|
||||
namedtype.OptionalNamedType('issuerUID', rfc3280.UniqueIdentifier())
|
||||
)
|
||||
|
||||
|
||||
class TargetCert(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
TargetCert.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('targetCertificate', IssuerSerial()),
|
||||
namedtype.OptionalNamedType('targetName', rfc3280.GeneralName()),
|
||||
namedtype.OptionalNamedType('certDigestInfo', ObjectDigestInfo())
|
||||
)
|
||||
|
||||
|
||||
class Target(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
Target.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('targetName', rfc3280.GeneralName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('targetGroup', rfc3280.GeneralName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('targetCert', TargetCert().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)))
|
||||
)
|
||||
|
||||
|
||||
class Targets(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
Targets.componentType = Target()
|
||||
|
||||
|
||||
class ProxyInfo(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
ProxyInfo.componentType = Targets()
|
||||
|
||||
|
||||
|
||||
id_at_role = _OID(rfc3280.id_at, 72)
|
||||
|
||||
|
||||
id_pe_aaControls = _OID(rfc3280.id_pe, 6)
|
||||
|
||||
|
||||
id_at_role = _OID(rfc3280.id_at, 72)
|
||||
|
||||
|
||||
id_ce_targetInformation = _OID(rfc3280.id_ce, 55)
|
||||
|
||||
|
||||
id_pe_ac_auditIdentity = _OID(rfc3280.id_pe, 4)
|
||||
|
||||
|
||||
class ClassList(univ.BitString):
|
||||
pass
|
||||
|
||||
|
||||
ClassList.namedValues = namedval.NamedValues(
|
||||
('unmarked', 0),
|
||||
('unclassified', 1),
|
||||
('restricted', 2),
|
||||
('confidential', 3),
|
||||
('secret', 4),
|
||||
('topSecret', 5)
|
||||
)
|
||||
|
||||
|
||||
class SecurityCategory(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SecurityCategory.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('type', univ.ObjectIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('value', univ.Any().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class Clearance(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
Clearance.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('policyId', univ.ObjectIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.DefaultedNamedType('classList',
|
||||
ClassList().subtype(implicitTag=tag.Tag(tag.tagClassContext,
|
||||
tag.tagFormatSimple, 1)).subtype(value="unclassified")),
|
||||
namedtype.OptionalNamedType('securityCategories', univ.SetOf(componentType=SecurityCategory()).subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)))
|
||||
)
|
||||
|
||||
|
||||
class AttCertVersion(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
AttCertVersion.namedValues = namedval.NamedValues(
|
||||
('v2', 1)
|
||||
)
|
||||
|
||||
|
||||
id_aca = _OID(rfc3280.id_pkix, 10)
|
||||
|
||||
|
||||
id_at_clearance = _OID(2, 5, 1, 5, 55)
|
||||
|
||||
|
||||
class AttrSpec(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
AttrSpec.componentType = univ.ObjectIdentifier()
|
||||
|
||||
|
||||
class AAControls(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AAControls.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('pathLenConstraint', univ.Integer().subtype(subtypeSpec=constraint.ValueRangeConstraint(0, MAX))),
|
||||
namedtype.OptionalNamedType('permittedAttrs', AttrSpec().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('excludedAttrs', AttrSpec().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.DefaultedNamedType('permitUnSpecified', univ.Boolean().subtype(value=1))
|
||||
)
|
||||
|
||||
|
||||
id_aca = _OID(rfc3280.id_pkix, 10)
|
||||
|
||||
|
||||
class AttCertValidityPeriod(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttCertValidityPeriod.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('notBeforeTime', useful.GeneralizedTime()),
|
||||
namedtype.NamedType('notAfterTime', useful.GeneralizedTime())
|
||||
)
|
||||
|
||||
|
||||
id_pe_ac_auditIdentity = _OID(rfc3280.id_pe, 4)
|
||||
|
||||
|
||||
id_at_clearance = _OID(2, 5, 1, 5, 55)
|
||||
|
||||
|
||||
id_aca_authenticationInfo = _OID(id_aca, 1)
|
||||
|
||||
|
||||
class V2Form(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
V2Form.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('issuerName', rfc3280.GeneralNames()),
|
||||
namedtype.OptionalNamedType('baseCertificateID', IssuerSerial().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.OptionalNamedType('objectDigestInfo', ObjectDigestInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class AttCertIssuer(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
AttCertIssuer.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('v1Form', rfc3280.GeneralNames()),
|
||||
namedtype.NamedType('v2Form', V2Form().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)))
|
||||
)
|
||||
|
||||
|
||||
class Holder(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
Holder.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('baseCertificateID', IssuerSerial().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.OptionalNamedType('entityName', rfc3280.GeneralNames().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.OptionalNamedType('objectDigestInfo', ObjectDigestInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)))
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificateInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', AttCertVersion()),
|
||||
namedtype.NamedType('holder', Holder()),
|
||||
namedtype.NamedType('issuer', AttCertIssuer()),
|
||||
namedtype.NamedType('signature', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('serialNumber', rfc3280.CertificateSerialNumber()),
|
||||
namedtype.NamedType('attrCertValidityPeriod', AttCertValidityPeriod()),
|
||||
namedtype.NamedType('attributes', univ.SequenceOf(componentType=rfc3280.Attribute())),
|
||||
namedtype.OptionalNamedType('issuerUniqueID', rfc3280.UniqueIdentifier()),
|
||||
namedtype.OptionalNamedType('extensions', rfc3280.Extensions())
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificate(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('acinfo', AttributeCertificateInfo()),
|
||||
namedtype.NamedType('signatureAlgorithm', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('signatureValue', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
id_aca_authenticationInfo = _OID(id_aca, 1)
|
||||
|
||||
|
||||
id_mod = _OID(rfc3280.id_pkix, 0)
|
||||
|
||||
|
||||
id_mod_attribute_cert = _OID(id_mod, 12)
|
||||
|
||||
|
||||
id_aca_accessIdentity = _OID(id_aca, 2)
|
||||
|
||||
|
||||
id_aca_accessIdentity = _OID(id_aca, 2)
|
||||
|
||||
|
||||
class RoleSyntax(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RoleSyntax.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('roleAuthority', rfc3280.GeneralNames().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('roleName', rfc3280.GeneralName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
id_aca_chargingIdentity = _OID(id_aca, 3)
|
||||
|
||||
|
||||
id_aca_chargingIdentity = _OID(id_aca, 3)
|
||||
|
||||
|
||||
class ACClearAttrs(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ACClearAttrs.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('acIssuer', rfc3280.GeneralName()),
|
||||
namedtype.NamedType('acSerial', univ.Integer()),
|
||||
namedtype.NamedType('attrs', univ.SequenceOf(componentType=rfc3280.Attribute()))
|
||||
)
|
||||
|
||||
|
||||
id_ce_targetInformation = _OID(rfc3280.id_ce, 55)
|
||||
|
||||
|
||||
id_aca_group = _OID(id_aca, 4)
|
||||
|
||||
|
||||
id_aca_group = _OID(id_aca, 4)
|
||||
|
||||
|
||||
id_pe_ac_proxying = _OID(rfc3280.id_pe, 10)
|
||||
|
||||
|
||||
id_pe_aaControls = _OID(rfc3280.id_pe, 6)
|
||||
|
||||
|
||||
class SvceAuthInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SvceAuthInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('service', rfc3280.GeneralName()),
|
||||
namedtype.NamedType('ident', rfc3280.GeneralName()),
|
||||
namedtype.OptionalNamedType('authInfo', univ.OctetString())
|
||||
)
|
||||
|
||||
|
||||
class IetfAttrSyntax(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
IetfAttrSyntax.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('policyAuthority', rfc3280.GeneralNames().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('values', univ.SequenceOf(componentType=univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('octets', univ.OctetString()),
|
||||
namedtype.NamedType('oid', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('string', char.UTF8String())
|
||||
))
|
||||
))
|
||||
)
|
||||
|
||||
|
||||
id_aca_encAttrs = _OID(id_aca, 6)
|
||||
|
||||
|
||||
id_aca_encAttrs = _OID(id_aca, 6)
|
||||
|
||||
|
||||
id_pe_ac_proxying = _OID(rfc3280.id_pe, 10)
|
||||
|
||||
|
||||
663
anchor/asn1/rfc3852.py
Normal file
663
anchor/asn1/rfc3852.py
Normal file
@ -0,0 +1,663 @@
|
||||
# Auto-generated by asn1ate on 2015-12-18 17:39:54.470347
|
||||
from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful
|
||||
|
||||
MAX = 64
|
||||
|
||||
from . import rfc3280
|
||||
from . import rfc3281
|
||||
|
||||
def _OID(*components):
|
||||
output = []
|
||||
for x in tuple(components):
|
||||
if isinstance(x, univ.ObjectIdentifier):
|
||||
output.extend(list(x))
|
||||
else:
|
||||
output.append(int(x))
|
||||
|
||||
return univ.ObjectIdentifier(output)
|
||||
|
||||
|
||||
class AttributeValue(univ.Any):
|
||||
pass
|
||||
|
||||
|
||||
class Attribute(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
Attribute.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('attrType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('attrValues', univ.SetOf(componentType=AttributeValue()))
|
||||
)
|
||||
|
||||
|
||||
class SignedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
SignedAttributes.componentType = Attribute()
|
||||
SignedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class OtherRevocationInfoFormat(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherRevocationInfoFormat.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('otherRevInfoFormat', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('otherRevInfo', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class RevocationInfoChoice(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RevocationInfoChoice.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('crl', rfc3280.CertificateList()),
|
||||
namedtype.NamedType('other', OtherRevocationInfoFormat().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class RevocationInfoChoices(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
RevocationInfoChoices.componentType = RevocationInfoChoice()
|
||||
|
||||
|
||||
class OtherKeyAttribute(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherKeyAttribute.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('keyAttrId', univ.ObjectIdentifier()),
|
||||
namedtype.OptionalNamedType('keyAttr', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
id_signedData = _OID(1, 2, 840, 113549, 1, 7, 2)
|
||||
|
||||
|
||||
class KeyEncryptionAlgorithmIdentifier(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class EncryptedKey(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class CMSVersion(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
CMSVersion.namedValues = namedval.NamedValues(
|
||||
('v0', 0),
|
||||
('v1', 1),
|
||||
('v2', 2),
|
||||
('v3', 3),
|
||||
('v4', 4),
|
||||
('v5', 5)
|
||||
)
|
||||
|
||||
|
||||
class KEKIdentifier(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KEKIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('keyIdentifier', univ.OctetString()),
|
||||
namedtype.OptionalNamedType('date', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('other', OtherKeyAttribute())
|
||||
)
|
||||
|
||||
|
||||
class KEKRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KEKRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('kekid', KEKIdentifier()),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class KeyDerivationAlgorithmIdentifier(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class PasswordRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PasswordRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('keyDerivationAlgorithm', KeyDerivationAlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class OtherRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('oriType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('oriValue', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class IssuerAndSerialNumber(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
IssuerAndSerialNumber.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuer', rfc3280.Name()),
|
||||
namedtype.NamedType('serialNumber', rfc3280.CertificateSerialNumber())
|
||||
)
|
||||
|
||||
|
||||
class SubjectKeyIdentifier(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class RecipientKeyIdentifier(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RecipientKeyIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier()),
|
||||
namedtype.OptionalNamedType('date', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('other', OtherKeyAttribute())
|
||||
)
|
||||
|
||||
|
||||
class KeyAgreeRecipientIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
KeyAgreeRecipientIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('rKeyId', RecipientKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)))
|
||||
)
|
||||
|
||||
|
||||
class RecipientEncryptedKey(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RecipientEncryptedKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('rid', KeyAgreeRecipientIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class RecipientEncryptedKeys(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
RecipientEncryptedKeys.componentType = RecipientEncryptedKey()
|
||||
|
||||
|
||||
class UserKeyingMaterial(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class OriginatorPublicKey(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorPublicKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('algorithm', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('publicKey', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class OriginatorIdentifierOrKey(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorIdentifierOrKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('originatorKey', OriginatorPublicKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class KeyAgreeRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KeyAgreeRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('originator', OriginatorIdentifierOrKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.OptionalNamedType('ukm', UserKeyingMaterial().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('recipientEncryptedKeys', RecipientEncryptedKeys())
|
||||
)
|
||||
|
||||
|
||||
class RecipientIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RecipientIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class KeyTransRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KeyTransRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('rid', RecipientIdentifier()),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class RecipientInfo(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('ktri', KeyTransRecipientInfo()),
|
||||
namedtype.NamedType('kari', KeyAgreeRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))),
|
||||
namedtype.NamedType('kekri', KEKRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))),
|
||||
namedtype.NamedType('pwri', PasswordRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))),
|
||||
namedtype.NamedType('ori', OtherRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4)))
|
||||
)
|
||||
|
||||
|
||||
class RecipientInfos(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
RecipientInfos.componentType = RecipientInfo()
|
||||
RecipientInfos.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class DigestAlgorithmIdentifier(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class Signature(univ.BitString):
|
||||
pass
|
||||
|
||||
|
||||
class SignerIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
SignerIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class UnprotectedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnprotectedAttributes.componentType = Attribute()
|
||||
UnprotectedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class ContentType(univ.ObjectIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class EncryptedContent(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class ContentEncryptionAlgorithmIdentifier(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class EncryptedContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('contentType', ContentType()),
|
||||
namedtype.NamedType('contentEncryptionAlgorithm', ContentEncryptionAlgorithmIdentifier()),
|
||||
namedtype.OptionalNamedType('encryptedContent', EncryptedContent().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class EncryptedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('encryptedContentInfo', EncryptedContentInfo()),
|
||||
namedtype.OptionalNamedType('unprotectedAttrs', UnprotectedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
id_contentType = _OID(1, 2, 840, 113549, 1, 9, 3)
|
||||
|
||||
|
||||
id_data = _OID(1, 2, 840, 113549, 1, 7, 1)
|
||||
|
||||
|
||||
id_messageDigest = _OID(1, 2, 840, 113549, 1, 9, 4)
|
||||
|
||||
|
||||
class DigestAlgorithmIdentifiers(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
DigestAlgorithmIdentifiers.componentType = DigestAlgorithmIdentifier()
|
||||
|
||||
|
||||
class EncapsulatedContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncapsulatedContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('eContentType', ContentType()),
|
||||
namedtype.OptionalNamedType('eContent', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class Digest(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class DigestedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
DigestedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('digestAlgorithm', DigestAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.NamedType('digest', Digest())
|
||||
)
|
||||
|
||||
|
||||
class ContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('contentType', ContentType()),
|
||||
namedtype.NamedType('content', univ.Any().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class UnauthAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnauthAttributes.componentType = Attribute()
|
||||
UnauthAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class ExtendedCertificateInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificateInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('certificate', rfc3280.Certificate()),
|
||||
namedtype.NamedType('attributes', UnauthAttributes())
|
||||
)
|
||||
|
||||
|
||||
class SignatureAlgorithmIdentifier(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class ExtendedCertificate(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('extendedCertificateInfo', ExtendedCertificateInfo()),
|
||||
namedtype.NamedType('signatureAlgorithm', SignatureAlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', Signature())
|
||||
)
|
||||
|
||||
|
||||
class OtherCertificateFormat(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherCertificateFormat.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('otherCertFormat', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('otherCert', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateV2(rfc3281.AttributeCertificate):
|
||||
pass
|
||||
|
||||
|
||||
class AttCertVersionV1(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
AttCertVersionV1.namedValues = namedval.NamedValues(
|
||||
('v1', 0)
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateInfoV1(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificateInfoV1.componentType = namedtype.NamedTypes(
|
||||
namedtype.DefaultedNamedType('version', AttCertVersionV1().subtype(value="v1")),
|
||||
namedtype.NamedType('subject', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('baseCertificateID', rfc3281.IssuerSerial().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('subjectName', rfc3280.GeneralNames().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
))
|
||||
),
|
||||
namedtype.NamedType('issuer', rfc3280.GeneralNames()),
|
||||
namedtype.NamedType('signature', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('serialNumber', rfc3280.CertificateSerialNumber()),
|
||||
namedtype.NamedType('attCertValidityPeriod', rfc3281.AttCertValidityPeriod()),
|
||||
namedtype.NamedType('attributes', univ.SequenceOf(componentType=rfc3280.Attribute())),
|
||||
namedtype.OptionalNamedType('issuerUniqueID', rfc3280.UniqueIdentifier()),
|
||||
namedtype.OptionalNamedType('extensions', rfc3280.Extensions())
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateV1(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificateV1.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('acInfo', AttributeCertificateInfoV1()),
|
||||
namedtype.NamedType('signatureAlgorithm', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class CertificateChoices(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
CertificateChoices.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certificate', rfc3280.Certificate()),
|
||||
namedtype.NamedType('extendedCertificate', ExtendedCertificate().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('v1AttrCert', AttributeCertificateV1().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('v2AttrCert', AttributeCertificateV2().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.NamedType('other', OtherCertificateFormat().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3)))
|
||||
)
|
||||
|
||||
|
||||
class CertificateSet(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
CertificateSet.componentType = CertificateChoices()
|
||||
|
||||
|
||||
class MessageAuthenticationCode(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class UnsignedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnsignedAttributes.componentType = Attribute()
|
||||
UnsignedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class SignatureValue(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class SignerInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SignerInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('sid', SignerIdentifier()),
|
||||
namedtype.NamedType('digestAlgorithm', DigestAlgorithmIdentifier()),
|
||||
namedtype.OptionalNamedType('signedAttrs', SignedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('signatureAlgorithm', SignatureAlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', SignatureValue()),
|
||||
namedtype.OptionalNamedType('unsignedAttrs', UnsignedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class SignerInfos(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
SignerInfos.componentType = SignerInfo()
|
||||
|
||||
|
||||
class SignedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SignedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('digestAlgorithms', DigestAlgorithmIdentifiers()),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.OptionalNamedType('certificates', CertificateSet().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('crls', RevocationInfoChoices().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('signerInfos', SignerInfos())
|
||||
)
|
||||
|
||||
|
||||
class MessageAuthenticationCodeAlgorithm(rfc3280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class MessageDigest(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class Time(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
Time.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('utcTime', useful.UTCTime()),
|
||||
namedtype.NamedType('generalTime', useful.GeneralizedTime())
|
||||
)
|
||||
|
||||
|
||||
class OriginatorInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('certs', CertificateSet().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('crls', RevocationInfoChoices().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class AuthAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
AuthAttributes.componentType = Attribute()
|
||||
AuthAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class AuthenticatedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AuthenticatedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('originatorInfo', OriginatorInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('recipientInfos', RecipientInfos()),
|
||||
namedtype.NamedType('macAlgorithm', MessageAuthenticationCodeAlgorithm()),
|
||||
namedtype.OptionalNamedType('digestAlgorithm', DigestAlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.OptionalNamedType('authAttrs', AuthAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.NamedType('mac', MessageAuthenticationCode()),
|
||||
namedtype.OptionalNamedType('unauthAttrs', UnauthAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3)))
|
||||
)
|
||||
|
||||
|
||||
id_ct_contentInfo = _OID(1, 2, 840, 113549, 1, 9, 16, 1, 6)
|
||||
|
||||
|
||||
id_envelopedData = _OID(1, 2, 840, 113549, 1, 7, 3)
|
||||
|
||||
|
||||
class EnvelopedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EnvelopedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('originatorInfo', OriginatorInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('recipientInfos', RecipientInfos()),
|
||||
namedtype.NamedType('encryptedContentInfo', EncryptedContentInfo()),
|
||||
namedtype.OptionalNamedType('unprotectedAttrs', UnprotectedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class Countersignature(SignerInfo):
|
||||
pass
|
||||
|
||||
|
||||
id_digestedData = _OID(1, 2, 840, 113549, 1, 7, 5)
|
||||
|
||||
|
||||
id_signingTime = _OID(1, 2, 840, 113549, 1, 9, 5)
|
||||
|
||||
|
||||
class ExtendedCertificateOrCertificate(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificateOrCertificate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certificate', rfc3280.Certificate()),
|
||||
namedtype.NamedType('extendedCertificate', ExtendedCertificate().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)))
|
||||
)
|
||||
|
||||
|
||||
id_encryptedData = _OID(1, 2, 840, 113549, 1, 7, 6)
|
||||
|
||||
|
||||
id_ct_authData = _OID(1, 2, 840, 113549, 1, 9, 16, 1, 2)
|
||||
|
||||
|
||||
class SigningTime(Time):
|
||||
pass
|
||||
|
||||
|
||||
id_countersignature = _OID(1, 2, 840, 113549, 1, 9, 6)
|
||||
|
||||
|
||||
349
anchor/asn1/rfc4211.py
Normal file
349
anchor/asn1/rfc4211.py
Normal file
@ -0,0 +1,349 @@
|
||||
# Auto-generated by asn1ate on 2015-12-21 15:05:42.666261
|
||||
from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful
|
||||
|
||||
from . import rfc3280
|
||||
from . import rfc3852
|
||||
|
||||
MAX = 64
|
||||
|
||||
|
||||
def _OID(*components):
|
||||
output = []
|
||||
for x in tuple(components):
|
||||
if isinstance(x, univ.ObjectIdentifier):
|
||||
output.extend(list(x))
|
||||
else:
|
||||
output.append(int(x))
|
||||
|
||||
return univ.ObjectIdentifier(output)
|
||||
|
||||
|
||||
id_pkix = _OID(1, 3, 6, 1, 5, 5, 7)
|
||||
|
||||
|
||||
id_pkip = _OID(id_pkix, 5)
|
||||
|
||||
|
||||
id_regCtrl = _OID(id_pkip, 1)
|
||||
|
||||
|
||||
class SinglePubInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SinglePubInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('pubMethod', univ.Integer(namedValues=namedval.NamedValues(('dontCare', 0), ('x500', 1), ('web', 2), ('ldap', 3)))),
|
||||
namedtype.OptionalNamedType('pubLocation', rfc3280.GeneralName())
|
||||
)
|
||||
|
||||
|
||||
class UTF8Pairs(char.UTF8String):
|
||||
pass
|
||||
|
||||
|
||||
class PKMACValue(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PKMACValue.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('algId', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('value', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class POPOSigningKeyInput(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
POPOSigningKeyInput.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('authInfo', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('sender', rfc3280.GeneralName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('publicKeyMAC', PKMACValue())
|
||||
))
|
||||
),
|
||||
namedtype.NamedType('publicKey', rfc3280.SubjectPublicKeyInfo())
|
||||
)
|
||||
|
||||
|
||||
class POPOSigningKey(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
POPOSigningKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('poposkInput', POPOSigningKeyInput().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('algorithmIdentifier', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class Attributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
Attributes.componentType = rfc3280.Attribute()
|
||||
|
||||
|
||||
class PrivateKeyInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PrivateKeyInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', univ.Integer()),
|
||||
namedtype.NamedType('privateKeyAlgorithm', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('privateKey', univ.OctetString()),
|
||||
namedtype.OptionalNamedType('attributes', Attributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class EncryptedValue(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedValue.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('intendedAlg', rfc3280.AlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('symmAlg', rfc3280.AlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.OptionalNamedType('encSymmKey', univ.BitString().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.OptionalNamedType('keyAlg', rfc3280.AlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))),
|
||||
namedtype.OptionalNamedType('valueHint', univ.OctetString().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))),
|
||||
namedtype.NamedType('encValue', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class EncryptedKey(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('encryptedValue', EncryptedValue()),
|
||||
namedtype.NamedType('envelopedData', rfc3852.EnvelopedData().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class KeyGenParameters(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class PKIArchiveOptions(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
PKIArchiveOptions.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('encryptedPrivKey', EncryptedKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('keyGenParameters', KeyGenParameters().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('archiveRemGenPrivKey', univ.Boolean().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)))
|
||||
)
|
||||
|
||||
|
||||
id_regCtrl_authenticator = _OID(id_regCtrl, 2)
|
||||
|
||||
|
||||
id_regInfo = _OID(id_pkip, 2)
|
||||
|
||||
|
||||
id_regInfo_certReq = _OID(id_regInfo, 2)
|
||||
|
||||
|
||||
class ProtocolEncrKey(rfc3280.SubjectPublicKeyInfo):
|
||||
pass
|
||||
|
||||
|
||||
class Authenticator(char.UTF8String):
|
||||
pass
|
||||
|
||||
|
||||
class SubsequentMessage(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
SubsequentMessage.namedValues = namedval.NamedValues(
|
||||
('encrCert', 0),
|
||||
('challengeResp', 1)
|
||||
)
|
||||
|
||||
|
||||
class AttributeTypeAndValue(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeTypeAndValue.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('type', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('value', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class POPOPrivKey(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
POPOPrivKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('thisMessage', univ.BitString().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('subsequentMessage', SubsequentMessage().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('dhMAC', univ.BitString().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.NamedType('agreeMAC', PKMACValue().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))),
|
||||
namedtype.NamedType('encryptedKey', rfc3852.EnvelopedData().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4)))
|
||||
)
|
||||
|
||||
|
||||
class ProofOfPossession(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
ProofOfPossession.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('raVerified', univ.Null().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('signature', POPOSigningKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))),
|
||||
namedtype.NamedType('keyEncipherment', POPOPrivKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))),
|
||||
namedtype.NamedType('keyAgreement', POPOPrivKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3)))
|
||||
)
|
||||
|
||||
|
||||
class OptionalValidity(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OptionalValidity.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('notBefore', rfc3280.Time().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.OptionalNamedType('notAfter', rfc3280.Time().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class CertTemplate(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CertTemplate.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('version', rfc3280.Version().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('serialNumber', univ.Integer().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.OptionalNamedType('signingAlg', rfc3280.AlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.OptionalNamedType('issuer', rfc3280.Name().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))),
|
||||
namedtype.OptionalNamedType('validity', OptionalValidity().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4))),
|
||||
namedtype.OptionalNamedType('subject', rfc3280.Name().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 5))),
|
||||
namedtype.OptionalNamedType('publicKey', rfc3280.SubjectPublicKeyInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))),
|
||||
namedtype.OptionalNamedType('issuerUID', rfc3280.UniqueIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 7))),
|
||||
namedtype.OptionalNamedType('subjectUID', rfc3280.UniqueIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))),
|
||||
namedtype.OptionalNamedType('extensions', rfc3280.Extensions().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 9)))
|
||||
)
|
||||
|
||||
|
||||
class Controls(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
Controls.componentType = AttributeTypeAndValue()
|
||||
Controls.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class CertRequest(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CertRequest.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certReqId', univ.Integer()),
|
||||
namedtype.NamedType('certTemplate', CertTemplate()),
|
||||
namedtype.OptionalNamedType('controls', Controls())
|
||||
)
|
||||
|
||||
|
||||
class CertReqMsg(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CertReqMsg.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certReq', CertRequest()),
|
||||
namedtype.OptionalNamedType('popo', ProofOfPossession()),
|
||||
namedtype.OptionalNamedType('regInfo', univ.SequenceOf(componentType=AttributeTypeAndValue()))
|
||||
)
|
||||
|
||||
|
||||
class CertReqMessages(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
CertReqMessages.componentType = CertReqMsg()
|
||||
CertReqMessages.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class CertReq(CertRequest):
|
||||
pass
|
||||
|
||||
|
||||
id_regCtrl_pkiPublicationInfo = _OID(id_regCtrl, 3)
|
||||
|
||||
|
||||
class CertId(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CertId.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuer', rfc3280.GeneralName()),
|
||||
namedtype.NamedType('serialNumber', univ.Integer())
|
||||
)
|
||||
|
||||
|
||||
class OldCertId(CertId):
|
||||
pass
|
||||
|
||||
|
||||
class PKIPublicationInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PKIPublicationInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('action', univ.Integer(namedValues=namedval.NamedValues(('dontPublish', 0), ('pleasePublish', 1)))),
|
||||
namedtype.OptionalNamedType('pubInfos', univ.SequenceOf(componentType=SinglePubInfo()))
|
||||
)
|
||||
|
||||
|
||||
class EncKeyWithID(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncKeyWithID.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('privateKey', PrivateKeyInfo()),
|
||||
namedtype.OptionalNamedType('identifier', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('string', char.UTF8String()),
|
||||
namedtype.NamedType('generalName', rfc3280.GeneralName())
|
||||
))
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
id_regCtrl_protocolEncrKey = _OID(id_regCtrl, 6)
|
||||
|
||||
|
||||
id_regCtrl_oldCertID = _OID(id_regCtrl, 5)
|
||||
|
||||
|
||||
id_smime = _OID(1, 2, 840, 113549, 1, 9, 16)
|
||||
|
||||
|
||||
class PBMParameter(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PBMParameter.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('salt', univ.OctetString()),
|
||||
namedtype.NamedType('owf', rfc3280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('iterationCount', univ.Integer()),
|
||||
namedtype.NamedType('mac', rfc3280.AlgorithmIdentifier())
|
||||
)
|
||||
|
||||
|
||||
id_regCtrl_regToken = _OID(id_regCtrl, 1)
|
||||
|
||||
|
||||
id_regCtrl_pkiArchiveOptions = _OID(id_regCtrl, 4)
|
||||
|
||||
|
||||
id_regInfo_utf8Pairs = _OID(id_regInfo, 1)
|
||||
|
||||
|
||||
id_ct = _OID(id_smime, 1)
|
||||
|
||||
|
||||
id_ct_encKeyWithID = _OID(id_ct, 21)
|
||||
|
||||
|
||||
class RegToken(char.UTF8String):
|
||||
pass
|
||||
|
||||
|
||||
1502
anchor/asn1/rfc5280.py
Normal file
1502
anchor/asn1/rfc5280.py
Normal file
File diff suppressed because it is too large
Load Diff
666
anchor/asn1/rfc5652.py
Normal file
666
anchor/asn1/rfc5652.py
Normal file
@ -0,0 +1,666 @@
|
||||
from pyasn1.type import char
|
||||
from pyasn1.type import constraint
|
||||
from pyasn1.type import namedtype
|
||||
from pyasn1.type import namedval
|
||||
from pyasn1.type import tag
|
||||
from pyasn1.type import univ
|
||||
from pyasn1.type import useful
|
||||
|
||||
from . import rfc3281
|
||||
from . import rfc5280
|
||||
|
||||
MAX = 64
|
||||
|
||||
def _OID(*components):
|
||||
output = []
|
||||
for x in tuple(components):
|
||||
if isinstance(x, univ.ObjectIdentifier):
|
||||
output.extend(list(x))
|
||||
else:
|
||||
output.append(int(x))
|
||||
|
||||
return univ.ObjectIdentifier(output)
|
||||
|
||||
|
||||
class AttCertVersionV1(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
AttCertVersionV1.namedValues = namedval.NamedValues(
|
||||
('v1', 0)
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateInfoV1(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificateInfoV1.componentType = namedtype.NamedTypes(
|
||||
namedtype.DefaultedNamedType('version', AttCertVersionV1().subtype(value="v1")),
|
||||
namedtype.NamedType('subject', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('baseCertificateID', rfc3281.IssuerSerial().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('subjectName', rfc5280.GeneralNames().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
))
|
||||
),
|
||||
namedtype.NamedType('issuer', rfc5280.GeneralNames()),
|
||||
namedtype.NamedType('signature', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('serialNumber', rfc5280.CertificateSerialNumber()),
|
||||
namedtype.NamedType('attCertValidityPeriod', rfc3281.AttCertValidityPeriod()),
|
||||
namedtype.NamedType('attributes', univ.SequenceOf(componentType=rfc5280.Attribute())),
|
||||
namedtype.OptionalNamedType('issuerUniqueID', rfc5280.UniqueIdentifier()),
|
||||
namedtype.OptionalNamedType('extensions', rfc5280.Extensions())
|
||||
)
|
||||
|
||||
|
||||
class AttributeCertificateV1(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AttributeCertificateV1.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('acInfo', AttributeCertificateInfoV1()),
|
||||
namedtype.NamedType('signatureAlgorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class AttributeValue(univ.Any):
|
||||
pass
|
||||
|
||||
|
||||
class Attribute(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
Attribute.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('attrType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('attrValues', univ.SetOf(componentType=AttributeValue()))
|
||||
)
|
||||
|
||||
|
||||
class SignedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
SignedAttributes.componentType = Attribute()
|
||||
SignedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class AttributeCertificateV2(rfc3281.AttributeCertificate):
|
||||
pass
|
||||
|
||||
|
||||
class OtherKeyAttribute(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherKeyAttribute.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('keyAttrId', univ.ObjectIdentifier()),
|
||||
namedtype.OptionalNamedType('keyAttr', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class UnauthAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnauthAttributes.componentType = Attribute()
|
||||
UnauthAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
id_encryptedData = _OID(1, 2, 840, 113549, 1, 7, 6)
|
||||
|
||||
|
||||
class SignatureValue(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class IssuerAndSerialNumber(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
IssuerAndSerialNumber.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuer', rfc5280.Name()),
|
||||
namedtype.NamedType('serialNumber', rfc5280.CertificateSerialNumber())
|
||||
)
|
||||
|
||||
|
||||
class SubjectKeyIdentifier(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class RecipientKeyIdentifier(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RecipientKeyIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier()),
|
||||
namedtype.OptionalNamedType('date', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('other', OtherKeyAttribute())
|
||||
)
|
||||
|
||||
|
||||
class KeyAgreeRecipientIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
KeyAgreeRecipientIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('rKeyId', RecipientKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)))
|
||||
)
|
||||
|
||||
|
||||
class EncryptedKey(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class RecipientEncryptedKey(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RecipientEncryptedKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('rid', KeyAgreeRecipientIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class RecipientEncryptedKeys(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
RecipientEncryptedKeys.componentType = RecipientEncryptedKey()
|
||||
|
||||
|
||||
class MessageAuthenticationCode(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class CMSVersion(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
CMSVersion.namedValues = namedval.NamedValues(
|
||||
('v0', 0),
|
||||
('v1', 1),
|
||||
('v2', 2),
|
||||
('v3', 3),
|
||||
('v4', 4),
|
||||
('v5', 5)
|
||||
)
|
||||
|
||||
|
||||
class OtherCertificateFormat(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherCertificateFormat.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('otherCertFormat', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('otherCert', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class ExtendedCertificateInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificateInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('certificate', rfc5280.Certificate()),
|
||||
namedtype.NamedType('attributes', UnauthAttributes())
|
||||
)
|
||||
|
||||
|
||||
class Signature(univ.BitString):
|
||||
pass
|
||||
|
||||
|
||||
class SignatureAlgorithmIdentifier(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class ExtendedCertificate(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('extendedCertificateInfo', ExtendedCertificateInfo()),
|
||||
namedtype.NamedType('signatureAlgorithm', SignatureAlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', Signature())
|
||||
)
|
||||
|
||||
|
||||
class CertificateChoices(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
CertificateChoices.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certificate', rfc5280.Certificate()),
|
||||
namedtype.NamedType('extendedCertificate', ExtendedCertificate().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('v1AttrCert', AttributeCertificateV1().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('v2AttrCert', AttributeCertificateV2().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.NamedType('other', OtherCertificateFormat().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3)))
|
||||
)
|
||||
|
||||
|
||||
class CertificateSet(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
CertificateSet.componentType = CertificateChoices()
|
||||
|
||||
|
||||
class OtherRevocationInfoFormat(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherRevocationInfoFormat.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('otherRevInfoFormat', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('otherRevInfo', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class RevocationInfoChoice(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RevocationInfoChoice.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('crl', rfc5280.CertificateList()),
|
||||
namedtype.NamedType('other', OtherRevocationInfoFormat().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class RevocationInfoChoices(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
RevocationInfoChoices.componentType = RevocationInfoChoice()
|
||||
|
||||
|
||||
class OriginatorInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('certs', CertificateSet().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('crls', RevocationInfoChoices().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class ContentType(univ.ObjectIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class EncryptedContent(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class ContentEncryptionAlgorithmIdentifier(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class EncryptedContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('contentType', ContentType()),
|
||||
namedtype.NamedType('contentEncryptionAlgorithm', ContentEncryptionAlgorithmIdentifier()),
|
||||
namedtype.OptionalNamedType('encryptedContent', EncryptedContent().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class UnprotectedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnprotectedAttributes.componentType = Attribute()
|
||||
UnprotectedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class KeyEncryptionAlgorithmIdentifier(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class KEKIdentifier(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KEKIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('keyIdentifier', univ.OctetString()),
|
||||
namedtype.OptionalNamedType('date', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('other', OtherKeyAttribute())
|
||||
)
|
||||
|
||||
|
||||
class KEKRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KEKRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('kekid', KEKIdentifier()),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class KeyDerivationAlgorithmIdentifier(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class PasswordRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PasswordRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('keyDerivationAlgorithm', KeyDerivationAlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class RecipientIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RecipientIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class KeyTransRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KeyTransRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('rid', RecipientIdentifier()),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encryptedKey', EncryptedKey())
|
||||
)
|
||||
|
||||
|
||||
class UserKeyingMaterial(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class OriginatorPublicKey(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorPublicKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('algorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('publicKey', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class OriginatorIdentifierOrKey(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
OriginatorIdentifierOrKey.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('originatorKey', OriginatorPublicKey().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
|
||||
)
|
||||
|
||||
|
||||
class KeyAgreeRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
KeyAgreeRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('originator', OriginatorIdentifierOrKey().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.OptionalNamedType('ukm', UserKeyingMaterial().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('keyEncryptionAlgorithm', KeyEncryptionAlgorithmIdentifier()),
|
||||
namedtype.NamedType('recipientEncryptedKeys', RecipientEncryptedKeys())
|
||||
)
|
||||
|
||||
|
||||
class OtherRecipientInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherRecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('oriType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('oriValue', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class RecipientInfo(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
RecipientInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('ktri', KeyTransRecipientInfo()),
|
||||
namedtype.NamedType('kari', KeyAgreeRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))),
|
||||
namedtype.NamedType('kekri', KEKRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2))),
|
||||
namedtype.NamedType('pwri', PasswordRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3))),
|
||||
namedtype.NamedType('ori', OtherRecipientInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4)))
|
||||
)
|
||||
|
||||
|
||||
class RecipientInfos(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
RecipientInfos.componentType = RecipientInfo()
|
||||
RecipientInfos.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class EnvelopedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EnvelopedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('originatorInfo', OriginatorInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('recipientInfos', RecipientInfos()),
|
||||
namedtype.NamedType('encryptedContentInfo', EncryptedContentInfo()),
|
||||
namedtype.OptionalNamedType('unprotectedAttrs', UnprotectedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class DigestAlgorithmIdentifier(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
id_ct_contentInfo = _OID(1, 2, 840, 113549, 1, 9, 16, 1, 6)
|
||||
|
||||
|
||||
id_digestedData = _OID(1, 2, 840, 113549, 1, 7, 5)
|
||||
|
||||
|
||||
class EncryptedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('encryptedContentInfo', EncryptedContentInfo()),
|
||||
namedtype.OptionalNamedType('unprotectedAttrs', UnprotectedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
id_messageDigest = _OID(1, 2, 840, 113549, 1, 9, 4)
|
||||
|
||||
|
||||
id_signedData = _OID(1, 2, 840, 113549, 1, 7, 2)
|
||||
|
||||
|
||||
class MessageAuthenticationCodeAlgorithm(rfc5280.AlgorithmIdentifier):
|
||||
pass
|
||||
|
||||
|
||||
class UnsignedAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
UnsignedAttributes.componentType = Attribute()
|
||||
UnsignedAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class SignerIdentifier(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
SignerIdentifier.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerAndSerialNumber', IssuerAndSerialNumber()),
|
||||
namedtype.NamedType('subjectKeyIdentifier', SubjectKeyIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class SignerInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SignerInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('sid', SignerIdentifier()),
|
||||
namedtype.NamedType('digestAlgorithm', DigestAlgorithmIdentifier()),
|
||||
namedtype.OptionalNamedType('signedAttrs', SignedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.NamedType('signatureAlgorithm', SignatureAlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', SignatureValue()),
|
||||
namedtype.OptionalNamedType('unsignedAttrs', UnsignedAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
|
||||
)
|
||||
|
||||
|
||||
class SignerInfos(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
SignerInfos.componentType = SignerInfo()
|
||||
|
||||
|
||||
class Countersignature(SignerInfo):
|
||||
pass
|
||||
|
||||
|
||||
class ContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('contentType', ContentType()),
|
||||
namedtype.NamedType('content', univ.Any().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
class EncapsulatedContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncapsulatedContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('eContentType', ContentType()),
|
||||
namedtype.OptionalNamedType('eContent', univ.OctetString().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
)
|
||||
|
||||
|
||||
id_countersignature = _OID(1, 2, 840, 113549, 1, 9, 6)
|
||||
|
||||
|
||||
id_data = _OID(1, 2, 840, 113549, 1, 7, 1)
|
||||
|
||||
|
||||
class MessageDigest(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class AuthAttributes(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
AuthAttributes.componentType = Attribute()
|
||||
AuthAttributes.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class Time(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
Time.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('utcTime', useful.UTCTime()),
|
||||
namedtype.NamedType('generalTime', useful.GeneralizedTime())
|
||||
)
|
||||
|
||||
|
||||
class AuthenticatedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AuthenticatedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.OptionalNamedType('originatorInfo', OriginatorInfo().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('recipientInfos', RecipientInfos()),
|
||||
namedtype.NamedType('macAlgorithm', MessageAuthenticationCodeAlgorithm()),
|
||||
namedtype.OptionalNamedType('digestAlgorithm', DigestAlgorithmIdentifier().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.OptionalNamedType('authAttrs', AuthAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
|
||||
namedtype.NamedType('mac', MessageAuthenticationCode()),
|
||||
namedtype.OptionalNamedType('unauthAttrs', UnauthAttributes().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3)))
|
||||
)
|
||||
|
||||
|
||||
id_contentType = _OID(1, 2, 840, 113549, 1, 9, 3)
|
||||
|
||||
|
||||
class ExtendedCertificateOrCertificate(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
ExtendedCertificateOrCertificate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certificate', rfc5280.Certificate()),
|
||||
namedtype.NamedType('extendedCertificate', ExtendedCertificate().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)))
|
||||
)
|
||||
|
||||
|
||||
class Digest(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
class DigestedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
DigestedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('digestAlgorithm', DigestAlgorithmIdentifier()),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.NamedType('digest', Digest())
|
||||
)
|
||||
|
||||
|
||||
id_envelopedData = _OID(1, 2, 840, 113549, 1, 7, 3)
|
||||
|
||||
|
||||
class DigestAlgorithmIdentifiers(univ.SetOf):
|
||||
pass
|
||||
|
||||
|
||||
DigestAlgorithmIdentifiers.componentType = DigestAlgorithmIdentifier()
|
||||
|
||||
|
||||
class SignedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
SignedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', CMSVersion()),
|
||||
namedtype.NamedType('digestAlgorithms', DigestAlgorithmIdentifiers()),
|
||||
namedtype.NamedType('encapContentInfo', EncapsulatedContentInfo()),
|
||||
namedtype.OptionalNamedType('certificates', CertificateSet().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
|
||||
namedtype.OptionalNamedType('crls', RevocationInfoChoices().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('signerInfos', SignerInfos())
|
||||
)
|
||||
|
||||
|
||||
id_signingTime = _OID(1, 2, 840, 113549, 1, 9, 5)
|
||||
|
||||
|
||||
class SigningTime(Time):
|
||||
pass
|
||||
|
||||
|
||||
id_ct_authData = _OID(1, 2, 840, 113549, 1, 9, 16, 1, 2)
|
||||
576
anchor/asn1/rfc6402.py
Normal file
576
anchor/asn1/rfc6402.py
Normal file
@ -0,0 +1,576 @@
|
||||
# Auto-generated by asn1ate on 2015-12-21 15:40:08.299576
|
||||
from pyasn1.type import univ, char, namedtype, namedval, tag, constraint, useful
|
||||
|
||||
from . import rfc4211
|
||||
from . import rfc5280
|
||||
from . import rfc5652
|
||||
|
||||
MAX = 64
|
||||
|
||||
|
||||
def _OID(*components):
|
||||
output = []
|
||||
for x in tuple(components):
|
||||
if isinstance(x, univ.ObjectIdentifier):
|
||||
output.extend(list(x))
|
||||
else:
|
||||
output.append(int(x))
|
||||
|
||||
return univ.ObjectIdentifier(output)
|
||||
|
||||
|
||||
class ChangeSubjectName(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ChangeSubjectName.componentType = namedtype.NamedTypes(
|
||||
namedtype.OptionalNamedType('subject', rfc5280.Name()),
|
||||
namedtype.OptionalNamedType('subjectAlt', rfc5280.GeneralNames())
|
||||
)
|
||||
|
||||
|
||||
class AttributeValue(univ.Any):
|
||||
pass
|
||||
|
||||
|
||||
class CMCStatus(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
CMCStatus.namedValues = namedval.NamedValues(
|
||||
('success', 0),
|
||||
('failed', 2),
|
||||
('pending', 3),
|
||||
('noSupport', 4),
|
||||
('confirmRequired', 5),
|
||||
('popRequired', 6),
|
||||
('partial', 7)
|
||||
)
|
||||
|
||||
|
||||
class PendInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PendInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('pendToken', univ.OctetString()),
|
||||
namedtype.NamedType('pendTime', useful.GeneralizedTime())
|
||||
)
|
||||
|
||||
|
||||
bodyIdMax = univ.Integer(4294967295)
|
||||
|
||||
|
||||
class BodyPartID(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
BodyPartID.subtypeSpec = constraint.ValueRangeConstraint(0, bodyIdMax)
|
||||
|
||||
|
||||
class BodyPartPath(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
BodyPartPath.componentType = BodyPartID()
|
||||
BodyPartPath.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
class BodyPartReference(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
BodyPartReference.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('bodyPartPath', BodyPartPath())
|
||||
)
|
||||
|
||||
|
||||
class CMCFailInfo(univ.Integer):
|
||||
pass
|
||||
|
||||
|
||||
CMCFailInfo.namedValues = namedval.NamedValues(
|
||||
('badAlg', 0),
|
||||
('badMessageCheck', 1),
|
||||
('badRequest', 2),
|
||||
('badTime', 3),
|
||||
('badCertId', 4),
|
||||
('unsupportedExt', 5),
|
||||
('mustArchiveKeys', 6),
|
||||
('badIdentity', 7),
|
||||
('popRequired', 8),
|
||||
('popFailed', 9),
|
||||
('noKeyReuse', 10),
|
||||
('internalCAError', 11),
|
||||
('tryLater', 12),
|
||||
('authDataFail', 13)
|
||||
)
|
||||
|
||||
|
||||
class CMCStatusInfoV2(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CMCStatusInfoV2.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('cMCStatus', CMCStatus()),
|
||||
namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartReference())),
|
||||
namedtype.OptionalNamedType('statusString', char.UTF8String()),
|
||||
namedtype.OptionalNamedType('otherInfo', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('failInfo', CMCFailInfo()),
|
||||
namedtype.NamedType('pendInfo', PendInfo()),
|
||||
namedtype.NamedType('extendedFailInfo', univ.Sequence(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('failInfoOID', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('failInfoValue', AttributeValue())
|
||||
))
|
||||
)
|
||||
))
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
class GetCRL(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
GetCRL.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerName', rfc5280.Name()),
|
||||
namedtype.OptionalNamedType('cRLName', rfc5280.GeneralName()),
|
||||
namedtype.OptionalNamedType('time', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('reasons', rfc5280.ReasonFlags())
|
||||
)
|
||||
|
||||
|
||||
id_pkix = _OID(1, 3, 6, 1, 5, 5, 7)
|
||||
|
||||
|
||||
id_cmc = _OID(id_pkix, 7)
|
||||
|
||||
|
||||
id_cmc_batchResponses = _OID(id_cmc, 29)
|
||||
|
||||
|
||||
id_cmc_popLinkWitness = _OID(id_cmc, 23)
|
||||
|
||||
|
||||
class PopLinkWitnessV2(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PopLinkWitnessV2.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('keyGenAlgorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('macAlgorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('witness', univ.OctetString())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_popLinkWitnessV2 = _OID(id_cmc, 33)
|
||||
|
||||
|
||||
id_cmc_identityProofV2 = _OID(id_cmc, 34)
|
||||
|
||||
|
||||
id_cmc_revokeRequest = _OID(id_cmc, 17)
|
||||
|
||||
|
||||
id_cmc_recipientNonce = _OID(id_cmc, 7)
|
||||
|
||||
|
||||
class ControlsProcessed(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ControlsProcessed.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartReference()))
|
||||
)
|
||||
|
||||
|
||||
class CertificationRequest(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CertificationRequest.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('certificationRequestInfo', univ.Sequence(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('version', univ.Integer()),
|
||||
namedtype.NamedType('subject', rfc5280.Name()),
|
||||
namedtype.NamedType('subjectPublicKeyInfo', univ.Sequence(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('algorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('subjectPublicKey', univ.BitString())
|
||||
))
|
||||
),
|
||||
namedtype.NamedType('attributes', univ.SetOf(componentType=rfc5652.Attribute()).subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)))
|
||||
))
|
||||
),
|
||||
namedtype.NamedType('signatureAlgorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('signature', univ.BitString())
|
||||
)
|
||||
|
||||
|
||||
class TaggedCertificationRequest(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
TaggedCertificationRequest.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('certificationRequest', CertificationRequest())
|
||||
)
|
||||
|
||||
|
||||
class TaggedRequest(univ.Choice):
|
||||
pass
|
||||
|
||||
|
||||
TaggedRequest.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('tcr', TaggedCertificationRequest().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
|
||||
namedtype.NamedType('crm', rfc4211.CertReqMsg().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
|
||||
namedtype.NamedType('orm', univ.Sequence(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('requestMessageType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('requestMessageValue', univ.Any())
|
||||
))
|
||||
.subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)))
|
||||
)
|
||||
|
||||
|
||||
id_cmc_popLinkRandom = _OID(id_cmc, 22)
|
||||
|
||||
|
||||
id_cmc_statusInfo = _OID(id_cmc, 1)
|
||||
|
||||
|
||||
id_cmc_trustedAnchors = _OID(id_cmc, 26)
|
||||
|
||||
|
||||
id_cmc_transactionId = _OID(id_cmc, 5)
|
||||
|
||||
|
||||
id_cmc_encryptedPOP = _OID(id_cmc, 9)
|
||||
|
||||
|
||||
class PublishTrustAnchors(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PublishTrustAnchors.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('seqNumber', univ.Integer()),
|
||||
namedtype.NamedType('hashAlgorithm', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('anchorHashes', univ.SequenceOf(componentType=univ.OctetString()))
|
||||
)
|
||||
|
||||
|
||||
class RevokeRequest(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
RevokeRequest.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerName', rfc5280.Name()),
|
||||
namedtype.NamedType('serialNumber', univ.Integer()),
|
||||
namedtype.NamedType('reason', rfc5280.CRLReason()),
|
||||
namedtype.OptionalNamedType('invalidityDate', useful.GeneralizedTime()),
|
||||
namedtype.OptionalNamedType('passphrase', univ.OctetString()),
|
||||
namedtype.OptionalNamedType('comment', char.UTF8String())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_senderNonce = _OID(id_cmc, 6)
|
||||
|
||||
|
||||
id_cmc_authData = _OID(id_cmc, 27)
|
||||
|
||||
|
||||
class TaggedContentInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
TaggedContentInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('contentInfo', rfc5652.ContentInfo())
|
||||
)
|
||||
|
||||
|
||||
class IdentifyProofV2(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
IdentifyProofV2.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('proofAlgID', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('macAlgId', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('witness', univ.OctetString())
|
||||
)
|
||||
|
||||
|
||||
class CMCPublicationInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CMCPublicationInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('hashAlg', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('certHashes', univ.SequenceOf(componentType=univ.OctetString())),
|
||||
namedtype.NamedType('pubInfo', rfc4211.PKIPublicationInfo())
|
||||
)
|
||||
|
||||
|
||||
id_kp_cmcCA = _OID(rfc5280.id_kp, 27)
|
||||
|
||||
|
||||
id_cmc_confirmCertAcceptance = _OID(id_cmc, 24)
|
||||
|
||||
|
||||
id_cmc_raIdentityWitness = _OID(id_cmc, 35)
|
||||
|
||||
|
||||
id_ExtensionReq = _OID(1, 2, 840, 113549, 1, 9, 14)
|
||||
|
||||
|
||||
id_cct = _OID(id_pkix, 12)
|
||||
|
||||
|
||||
id_cct_PKIData = _OID(id_cct, 2)
|
||||
|
||||
|
||||
id_kp_cmcRA = _OID(rfc5280.id_kp, 28)
|
||||
|
||||
|
||||
class CMCStatusInfo(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CMCStatusInfo.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('cMCStatus', CMCStatus()),
|
||||
namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartID())),
|
||||
namedtype.OptionalNamedType('statusString', char.UTF8String()),
|
||||
namedtype.OptionalNamedType('otherInfo', univ.Choice(componentType=namedtype.NamedTypes(
|
||||
namedtype.NamedType('failInfo', CMCFailInfo()),
|
||||
namedtype.NamedType('pendInfo', PendInfo())
|
||||
))
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
class DecryptedPOP(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
DecryptedPOP.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('thePOPAlgID', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('thePOP', univ.OctetString())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_addExtensions = _OID(id_cmc, 8)
|
||||
|
||||
|
||||
id_cmc_modCertTemplate = _OID(id_cmc, 31)
|
||||
|
||||
|
||||
class TaggedAttribute(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
TaggedAttribute.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('attrType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('attrValues', univ.SetOf(componentType=AttributeValue()))
|
||||
)
|
||||
|
||||
|
||||
class OtherMsg(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
OtherMsg.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartID', BodyPartID()),
|
||||
namedtype.NamedType('otherMsgType', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('otherMsgValue', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class PKIData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PKIData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('controlSequence', univ.SequenceOf(componentType=TaggedAttribute())),
|
||||
namedtype.NamedType('reqSequence', univ.SequenceOf(componentType=TaggedRequest())),
|
||||
namedtype.NamedType('cmsSequence', univ.SequenceOf(componentType=TaggedContentInfo())),
|
||||
namedtype.NamedType('otherMsgSequence', univ.SequenceOf(componentType=OtherMsg()))
|
||||
)
|
||||
|
||||
|
||||
class BodyPartList(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
BodyPartList.componentType = BodyPartID()
|
||||
BodyPartList.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
id_cmc_responseBody = _OID(id_cmc, 37)
|
||||
|
||||
|
||||
class AuthPublish(BodyPartID):
|
||||
pass
|
||||
|
||||
|
||||
class CMCUnsignedData(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
CMCUnsignedData.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('bodyPartPath', BodyPartPath()),
|
||||
namedtype.NamedType('identifier', univ.ObjectIdentifier()),
|
||||
namedtype.NamedType('content', univ.Any())
|
||||
)
|
||||
|
||||
|
||||
class CMCCertId(rfc5652.IssuerAndSerialNumber):
|
||||
pass
|
||||
|
||||
|
||||
class PKIResponse(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
PKIResponse.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('controlSequence', univ.SequenceOf(componentType=TaggedAttribute())),
|
||||
namedtype.NamedType('cmsSequence', univ.SequenceOf(componentType=TaggedContentInfo())),
|
||||
namedtype.NamedType('otherMsgSequence', univ.SequenceOf(componentType=OtherMsg()))
|
||||
)
|
||||
|
||||
|
||||
class ResponseBody(PKIResponse):
|
||||
pass
|
||||
|
||||
|
||||
id_cmc_statusInfoV2 = _OID(id_cmc, 25)
|
||||
|
||||
|
||||
id_cmc_lraPOPWitness = _OID(id_cmc, 11)
|
||||
|
||||
|
||||
class ModCertTemplate(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
ModCertTemplate.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('pkiDataReference', BodyPartPath()),
|
||||
namedtype.NamedType('certReferences', BodyPartList()),
|
||||
namedtype.DefaultedNamedType('replace', univ.Boolean().subtype(value=1)),
|
||||
namedtype.NamedType('certTemplate', rfc4211.CertTemplate())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_regInfo = _OID(id_cmc, 18)
|
||||
|
||||
|
||||
id_cmc_identityProof = _OID(id_cmc, 3)
|
||||
|
||||
|
||||
class ExtensionReq(univ.SequenceOf):
|
||||
pass
|
||||
|
||||
|
||||
ExtensionReq.componentType = rfc5280.Extension()
|
||||
ExtensionReq.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
|
||||
|
||||
|
||||
id_kp_cmcArchive = _OID(rfc5280.id_kp, 28)
|
||||
|
||||
|
||||
id_cmc_publishCert = _OID(id_cmc, 30)
|
||||
|
||||
|
||||
id_cmc_dataReturn = _OID(id_cmc, 4)
|
||||
|
||||
|
||||
class LraPopWitness(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
LraPopWitness.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('pkiDataBodyid', BodyPartID()),
|
||||
namedtype.NamedType('bodyIds', univ.SequenceOf(componentType=BodyPartID()))
|
||||
)
|
||||
|
||||
|
||||
id_aa = _OID(1, 2, 840, 113549, 1, 9, 16, 2)
|
||||
|
||||
|
||||
id_aa_cmc_unsignedData = _OID(id_aa, 34)
|
||||
|
||||
|
||||
id_cmc_getCert = _OID(id_cmc, 15)
|
||||
|
||||
|
||||
id_cmc_batchRequests = _OID(id_cmc, 28)
|
||||
|
||||
|
||||
id_cmc_decryptedPOP = _OID(id_cmc, 10)
|
||||
|
||||
|
||||
id_cmc_responseInfo = _OID(id_cmc, 19)
|
||||
|
||||
|
||||
id_cmc_changeSubjectName = _OID(id_cmc, 36)
|
||||
|
||||
|
||||
class GetCert(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
GetCert.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('issuerName', rfc5280.GeneralName()),
|
||||
namedtype.NamedType('serialNumber', univ.Integer())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_identification = _OID(id_cmc, 2)
|
||||
|
||||
|
||||
id_cmc_queryPending = _OID(id_cmc, 21)
|
||||
|
||||
|
||||
class AddExtensions(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
AddExtensions.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('pkiDataReference', BodyPartID()),
|
||||
namedtype.NamedType('certReferences', univ.SequenceOf(componentType=BodyPartID())),
|
||||
namedtype.NamedType('extensions', univ.SequenceOf(componentType=rfc5280.Extension()))
|
||||
)
|
||||
|
||||
|
||||
class EncryptedPOP(univ.Sequence):
|
||||
pass
|
||||
|
||||
|
||||
EncryptedPOP.componentType = namedtype.NamedTypes(
|
||||
namedtype.NamedType('request', TaggedRequest()),
|
||||
namedtype.NamedType('cms', rfc5652.ContentInfo()),
|
||||
namedtype.NamedType('thePOPAlgID', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('witnessAlgID', rfc5280.AlgorithmIdentifier()),
|
||||
namedtype.NamedType('witness', univ.OctetString())
|
||||
)
|
||||
|
||||
|
||||
id_cmc_getCRL = _OID(id_cmc, 16)
|
||||
|
||||
|
||||
id_cct_PKIResponse = _OID(id_cct, 3)
|
||||
|
||||
|
||||
id_cmc_controlProcessed = _OID(id_cmc, 32)
|
||||
|
||||
|
||||
class NoSignatureValue(univ.OctetString):
|
||||
pass
|
||||
|
||||
|
||||
id_ad_cmc = _OID(rfc5280.id_ad, 12)
|
||||
|
||||
|
||||
id_alg_noSignature = _OID(id_pkix, 6, 2)
|
||||
|
||||
|
||||
10
asn/autogenerated.txt
Normal file
10
asn/autogenerated.txt
Normal file
@ -0,0 +1,10 @@
|
||||
Files in "anchor/asn1" have been generated from the asn1 modules in "asn"
|
||||
directory using asn1ate (https://github.com/kimgr/asn1ate/)
|
||||
|
||||
They can be regenerated by:
|
||||
- running asn1ate on each module
|
||||
- putting .i and .e results together (implicit / explicit modules)
|
||||
- removing faked imports
|
||||
- linking missing classes to other rfcXXXX files
|
||||
|
||||
There's currently no fully automatic way to do it.
|
||||
628
asn/rfc3280.e.asn
Normal file
628
asn/rfc3280.e.asn
Normal file
@ -0,0 +1,628 @@
|
||||
PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) internet(1)
|
||||
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) }
|
||||
|
||||
DEFINITIONS EXPLICIT TAGS ::=
|
||||
|
||||
BEGIN
|
||||
|
||||
-- EXPORTS ALL --
|
||||
|
||||
-- IMPORTS NONE --
|
||||
|
||||
-- UNIVERSAL Types defined in 1993 and 1998 ASN.1
|
||||
-- and required by this specification
|
||||
|
||||
--UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
|
||||
-- UniversalString is defined in ASN.1:1993
|
||||
|
||||
--BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
|
||||
-- BMPString is the subtype of UniversalString and models
|
||||
-- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
|
||||
|
||||
--UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
|
||||
-- The content of this type conforms to RFC 2279.
|
||||
|
||||
-- PKIX specific OIDs
|
||||
|
||||
id-pkix OBJECT IDENTIFIER ::=
|
||||
{ iso(1) identified-organization(3) dod(6) internet(1)
|
||||
security(5) mechanisms(5) pkix(7) }
|
||||
|
||||
-- PKIX arcs
|
||||
|
||||
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
|
||||
-- arc for private certificate extensions
|
||||
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
|
||||
-- arc for policy qualifier types
|
||||
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
||||
-- arc for extended key purpose OIDS
|
||||
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
||||
-- arc for access descriptors
|
||||
|
||||
-- policyQualifierIds for Internet policy qualifiers
|
||||
|
||||
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
|
||||
-- OID for CPS qualifier
|
||||
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
|
||||
-- OID for user notice qualifier
|
||||
|
||||
-- access descriptor definitions
|
||||
|
||||
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }
|
||||
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
|
||||
id-ad-timeStamping OBJECT IDENTIFIER ::= { id-ad 3 }
|
||||
id-ad-caRepository OBJECT IDENTIFIER ::= { id-ad 5 }
|
||||
|
||||
-- attribute data types
|
||||
|
||||
Attribute ::= SEQUENCE {
|
||||
type AttributeType,
|
||||
values SET OF AttributeValue }
|
||||
-- at least one value is required
|
||||
|
||||
AttributeType ::= OBJECT IDENTIFIER
|
||||
|
||||
AttributeValue ::= ANY
|
||||
|
||||
AttributeTypeAndValue ::= SEQUENCE {
|
||||
type AttributeType,
|
||||
value AttributeValue }
|
||||
|
||||
-- suggested naming attributes: Definition of the following
|
||||
-- information object set may be augmented to meet local
|
||||
-- requirements. Note that deleting members of the set may
|
||||
-- prevent interoperability with conforming implementations.
|
||||
-- presented in pairs: the AttributeType followed by the
|
||||
-- type definition for the corresponding AttributeValue
|
||||
--Arc for standard naming attributes
|
||||
id-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }
|
||||
|
||||
-- Naming attributes of type X520name
|
||||
|
||||
id-at-name AttributeType ::= { id-at 41 }
|
||||
id-at-surname AttributeType ::= { id-at 4 }
|
||||
id-at-givenName AttributeType ::= { id-at 42 }
|
||||
id-at-initials AttributeType ::= { id-at 43 }
|
||||
id-at-generationQualifier AttributeType ::= { id-at 44 }
|
||||
|
||||
X520name ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-name)),
|
||||
printableString PrintableString (SIZE (1..ub-name)),
|
||||
universalString UniversalString (SIZE (1..ub-name)),
|
||||
utf8String UTF8String (SIZE (1..ub-name)),
|
||||
bmpString BMPString (SIZE (1..ub-name)) }
|
||||
|
||||
-- Naming attributes of type X520CommonName
|
||||
|
||||
id-at-commonName AttributeType ::= { id-at 3 }
|
||||
|
||||
X520CommonName ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-common-name)),
|
||||
printableString PrintableString (SIZE (1..ub-common-name)),
|
||||
universalString UniversalString (SIZE (1..ub-common-name)),
|
||||
utf8String UTF8String (SIZE (1..ub-common-name)),
|
||||
bmpString BMPString (SIZE (1..ub-common-name)) }
|
||||
|
||||
-- Naming attributes of type X520LocalityName
|
||||
|
||||
id-at-localityName AttributeType ::= { id-at 7 }
|
||||
|
||||
X520LocalityName ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-locality-name)),
|
||||
printableString PrintableString (SIZE (1..ub-locality-name)),
|
||||
universalString UniversalString (SIZE (1..ub-locality-name)),
|
||||
utf8String UTF8String (SIZE (1..ub-locality-name)),
|
||||
bmpString BMPString (SIZE (1..ub-locality-name)) }
|
||||
|
||||
-- Naming attributes of type X520StateOrProvinceName
|
||||
|
||||
id-at-stateOrProvinceName AttributeType ::= { id-at 8 }
|
||||
|
||||
X520StateOrProvinceName ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-state-name)),
|
||||
printableString PrintableString (SIZE (1..ub-state-name)),
|
||||
universalString UniversalString (SIZE (1..ub-state-name)),
|
||||
utf8String UTF8String (SIZE (1..ub-state-name)),
|
||||
bmpString BMPString (SIZE(1..ub-state-name)) }
|
||||
|
||||
|
||||
-- Naming attributes of type X520OrganizationName
|
||||
|
||||
id-at-organizationName AttributeType ::= { id-at 10 }
|
||||
|
||||
X520OrganizationName ::= CHOICE {
|
||||
teletexString TeletexString
|
||||
(SIZE (1..ub-organization-name)),
|
||||
printableString PrintableString
|
||||
(SIZE (1..ub-organization-name)),
|
||||
universalString UniversalString
|
||||
(SIZE (1..ub-organization-name)),
|
||||
utf8String UTF8String
|
||||
(SIZE (1..ub-organization-name)),
|
||||
bmpString BMPString
|
||||
(SIZE (1..ub-organization-name)) }
|
||||
|
||||
-- Naming attributes of type X520OrganizationalUnitName
|
||||
|
||||
id-at-organizationalUnitName AttributeType ::= { id-at 11 }
|
||||
|
||||
X520OrganizationalUnitName ::= CHOICE {
|
||||
teletexString TeletexString
|
||||
(SIZE (1..ub-organizational-unit-name)),
|
||||
printableString PrintableString
|
||||
(SIZE (1..ub-organizational-unit-name)),
|
||||
universalString UniversalString
|
||||
(SIZE (1..ub-organizational-unit-name)),
|
||||
utf8String UTF8String
|
||||
(SIZE (1..ub-organizational-unit-name)),
|
||||
bmpString BMPString
|
||||
(SIZE (1..ub-organizational-unit-name)) }
|
||||
|
||||
-- Naming attributes of type X520Title
|
||||
|
||||
id-at-title AttributeType ::= { id-at 12 }
|
||||
|
||||
X520Title ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-title)),
|
||||
printableString PrintableString (SIZE (1..ub-title)),
|
||||
universalString UniversalString (SIZE (1..ub-title)),
|
||||
utf8String UTF8String (SIZE (1..ub-title)),
|
||||
bmpString BMPString (SIZE (1..ub-title)) }
|
||||
|
||||
-- Naming attributes of type X520dnQualifier
|
||||
|
||||
id-at-dnQualifier AttributeType ::= { id-at 46 }
|
||||
|
||||
X520dnQualifier ::= PrintableString
|
||||
|
||||
-- Naming attributes of type X520countryName (digraph from IS 3166)
|
||||
|
||||
id-at-countryName AttributeType ::= { id-at 6 }
|
||||
|
||||
X520countryName ::= PrintableString (SIZE (2))
|
||||
|
||||
-- Naming attributes of type X520SerialNumber
|
||||
|
||||
id-at-serialNumber AttributeType ::= { id-at 5 }
|
||||
|
||||
X520SerialNumber ::= PrintableString (SIZE (1..ub-serial-number))
|
||||
|
||||
-- Naming attributes of type X520Pseudonym
|
||||
|
||||
id-at-pseudonym AttributeType ::= { id-at 65 }
|
||||
|
||||
X520Pseudonym ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..ub-pseudonym)),
|
||||
printableString PrintableString (SIZE (1..ub-pseudonym)),
|
||||
universalString UniversalString (SIZE (1..ub-pseudonym)),
|
||||
utf8String UTF8String (SIZE (1..ub-pseudonym)),
|
||||
bmpString BMPString (SIZE (1..ub-pseudonym)) }
|
||||
|
||||
-- Naming attributes of type DomainComponent (from RFC 2247)
|
||||
|
||||
id-domainComponent AttributeType ::=
|
||||
{ 0 9 2342 19200300 100 1 25 }
|
||||
|
||||
DomainComponent ::= IA5String
|
||||
|
||||
-- Legacy attributes
|
||||
|
||||
pkcs-9 OBJECT IDENTIFIER ::=
|
||||
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }
|
||||
|
||||
id-emailAddress AttributeType ::= { pkcs-9 1 }
|
||||
|
||||
EmailAddress ::= IA5String (SIZE (1..ub-emailaddress-length))
|
||||
|
||||
-- naming data types --
|
||||
|
||||
Name ::= CHOICE { -- only one possibility for now --
|
||||
rdnSequence RDNSequence }
|
||||
|
||||
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
|
||||
|
||||
DistinguishedName ::= RDNSequence
|
||||
|
||||
|
||||
RelativeDistinguishedName ::=
|
||||
SET SIZE (1 .. MAX) OF AttributeTypeAndValue
|
||||
|
||||
-- Directory string type --
|
||||
|
||||
DirectoryString ::= CHOICE {
|
||||
teletexString TeletexString (SIZE (1..MAX)),
|
||||
printableString PrintableString (SIZE (1..MAX)),
|
||||
universalString UniversalString (SIZE (1..MAX)),
|
||||
utf8String UTF8String (SIZE (1..MAX)),
|
||||
bmpString BMPString (SIZE (1..MAX)) }
|
||||
|
||||
-- certificate and CRL specific structures begin here
|
||||
|
||||
Certificate ::= SEQUENCE {
|
||||
tbsCertificate TBSCertificate,
|
||||
signatureAlgorithm AlgorithmIdentifier,
|
||||
signature BIT STRING }
|
||||
|
||||
TBSCertificate ::= SEQUENCE {
|
||||
version [0] Version DEFAULT v1,
|
||||
serialNumber CertificateSerialNumber,
|
||||
signature AlgorithmIdentifier,
|
||||
issuer Name,
|
||||
validity Validity,
|
||||
subject Name,
|
||||
subjectPublicKeyInfo SubjectPublicKeyInfo,
|
||||
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
|
||||
-- If present, version MUST be v2 or v3
|
||||
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
|
||||
-- If present, version MUST be v2 or v3
|
||||
extensions [3] Extensions OPTIONAL
|
||||
-- If present, version MUST be v3 -- }
|
||||
|
||||
Version ::= INTEGER { v1(0), v2(1), v3(2) }
|
||||
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
|
||||
Validity ::= SEQUENCE {
|
||||
notBefore Time,
|
||||
notAfter Time }
|
||||
|
||||
Time ::= CHOICE {
|
||||
utcTime UTCTime,
|
||||
generalTime GeneralizedTime }
|
||||
|
||||
UniqueIdentifier ::= BIT STRING
|
||||
|
||||
|
||||
SubjectPublicKeyInfo ::= SEQUENCE {
|
||||
algorithm AlgorithmIdentifier,
|
||||
subjectPublicKey BIT STRING }
|
||||
|
||||
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
||||
|
||||
Extension ::= SEQUENCE {
|
||||
extnID OBJECT IDENTIFIER,
|
||||
critical BOOLEAN DEFAULT FALSE,
|
||||
extnValue OCTET STRING }
|
||||
|
||||
-- CRL structures
|
||||
|
||||
CertificateList ::= SEQUENCE {
|
||||
tbsCertList TBSCertList,
|
||||
signatureAlgorithm AlgorithmIdentifier,
|
||||
signature BIT STRING }
|
||||
|
||||
TBSCertList ::= SEQUENCE {
|
||||
version Version OPTIONAL,
|
||||
-- if present, MUST be v2
|
||||
signature AlgorithmIdentifier,
|
||||
issuer Name,
|
||||
thisUpdate Time,
|
||||
nextUpdate Time OPTIONAL,
|
||||
revokedCertificates SEQUENCE OF SEQUENCE {
|
||||
userCertificate CertificateSerialNumber,
|
||||
revocationDate Time,
|
||||
crlEntryExtensions Extensions OPTIONAL
|
||||
-- if present, MUST be v2
|
||||
} OPTIONAL,
|
||||
crlExtensions [0] Extensions OPTIONAL }
|
||||
-- if present, MUST be v2
|
||||
|
||||
-- Version, Time, CertificateSerialNumber, and Extensions were
|
||||
-- defined earlier for use in the certificate structure
|
||||
|
||||
AlgorithmIdentifier ::= SEQUENCE {
|
||||
algorithm OBJECT IDENTIFIER,
|
||||
parameters ANY DEFINED BY algorithm OPTIONAL }
|
||||
-- contains a value of the type
|
||||
-- registered for use with the
|
||||
-- algorithm object identifier value
|
||||
|
||||
-- X.400 address syntax starts here
|
||||
|
||||
|
||||
|
||||
ORAddress ::= SEQUENCE {
|
||||
built-in-standard-attributes BuiltInStandardAttributes,
|
||||
built-in-domain-defined-attributes
|
||||
BuiltInDomainDefinedAttributes OPTIONAL,
|
||||
-- see also teletex-domain-defined-attributes
|
||||
extension-attributes ExtensionAttributes OPTIONAL }
|
||||
|
||||
-- Built-in Standard Attributes
|
||||
|
||||
BuiltInStandardAttributes ::= SEQUENCE {
|
||||
country-name CountryName OPTIONAL,
|
||||
administration-domain-name AdministrationDomainName OPTIONAL,
|
||||
network-address [0] IMPLICIT NetworkAddress OPTIONAL,
|
||||
-- see also extended-network-address
|
||||
terminal-identifier [1] IMPLICIT TerminalIdentifier OPTIONAL,
|
||||
private-domain-name [2] PrivateDomainName OPTIONAL,
|
||||
organization-name [3] IMPLICIT OrganizationName OPTIONAL,
|
||||
-- see also teletex-organization-name
|
||||
numeric-user-identifier [4] IMPLICIT NumericUserIdentifier
|
||||
OPTIONAL,
|
||||
personal-name [5] IMPLICIT PersonalName OPTIONAL,
|
||||
-- see also teletex-personal-name
|
||||
organizational-unit-names [6] IMPLICIT OrganizationalUnitNames
|
||||
OPTIONAL }
|
||||
-- see also teletex-organizational-unit-names
|
||||
|
||||
CountryName ::= [APPLICATION 1] CHOICE {
|
||||
x121-dcc-code NumericString
|
||||
(SIZE (ub-country-name-numeric-length)),
|
||||
iso-3166-alpha2-code PrintableString
|
||||
(SIZE (ub-country-name-alpha-length)) }
|
||||
|
||||
AdministrationDomainName ::= [APPLICATION 2] CHOICE {
|
||||
numeric NumericString (SIZE (0..ub-domain-name-length)),
|
||||
printable PrintableString (SIZE (0..ub-domain-name-length)) }
|
||||
|
||||
NetworkAddress ::= X121Address -- see also extended-network-address
|
||||
|
||||
X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
|
||||
|
||||
TerminalIdentifier ::= PrintableString (SIZE
|
||||
(1..ub-terminal-id-length))
|
||||
|
||||
PrivateDomainName ::= CHOICE {
|
||||
numeric NumericString (SIZE (1..ub-domain-name-length)),
|
||||
printable PrintableString (SIZE (1..ub-domain-name-length)) }
|
||||
|
||||
|
||||
|
||||
OrganizationName ::= PrintableString
|
||||
(SIZE (1..ub-organization-name-length))
|
||||
-- see also teletex-organization-name
|
||||
|
||||
NumericUserIdentifier ::= NumericString
|
||||
(SIZE (1..ub-numeric-user-id-length))
|
||||
|
||||
PersonalName ::= SET {
|
||||
surname [0] IMPLICIT PrintableString
|
||||
(SIZE (1..ub-surname-length)),
|
||||
given-name [1] IMPLICIT PrintableString
|
||||
(SIZE (1..ub-given-name-length)) OPTIONAL,
|
||||
initials [2] IMPLICIT PrintableString
|
||||
(SIZE (1..ub-initials-length)) OPTIONAL,
|
||||
generation-qualifier [3] IMPLICIT PrintableString
|
||||
(SIZE (1..ub-generation-qualifier-length))
|
||||
OPTIONAL }
|
||||
-- see also teletex-personal-name
|
||||
|
||||
OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
|
||||
OF OrganizationalUnitName
|
||||
-- see also teletex-organizational-unit-names
|
||||
|
||||
OrganizationalUnitName ::= PrintableString (SIZE
|
||||
(1..ub-organizational-unit-name-length))
|
||||
|
||||
-- Built-in Domain-defined Attributes
|
||||
|
||||
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
|
||||
(1..ub-domain-defined-attributes) OF
|
||||
BuiltInDomainDefinedAttribute
|
||||
|
||||
BuiltInDomainDefinedAttribute ::= SEQUENCE {
|
||||
type PrintableString (SIZE
|
||||
(1..ub-domain-defined-attribute-type-length)),
|
||||
value PrintableString (SIZE
|
||||
(1..ub-domain-defined-attribute-value-length)) }
|
||||
|
||||
-- Extension Attributes
|
||||
|
||||
ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
|
||||
ExtensionAttribute
|
||||
|
||||
ExtensionAttribute ::= SEQUENCE {
|
||||
extension-attribute-type [0] IMPLICIT INTEGER
|
||||
(0..ub-extension-attributes),
|
||||
extension-attribute-value [1]
|
||||
ANY DEFINED BY extension-attribute-type }
|
||||
|
||||
-- Extension types and attribute values
|
||||
|
||||
common-name INTEGER ::= 1
|
||||
|
||||
CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
|
||||
|
||||
teletex-common-name INTEGER ::= 2
|
||||
|
||||
TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
|
||||
|
||||
teletex-organization-name INTEGER ::= 3
|
||||
|
||||
TeletexOrganizationName ::=
|
||||
TeletexString (SIZE (1..ub-organization-name-length))
|
||||
|
||||
teletex-personal-name INTEGER ::= 4
|
||||
|
||||
TeletexPersonalName ::= SET {
|
||||
surname [0] IMPLICIT TeletexString
|
||||
(SIZE (1..ub-surname-length)),
|
||||
given-name [1] IMPLICIT TeletexString
|
||||
(SIZE (1..ub-given-name-length)) OPTIONAL,
|
||||
initials [2] IMPLICIT TeletexString
|
||||
(SIZE (1..ub-initials-length)) OPTIONAL,
|
||||
generation-qualifier [3] IMPLICIT TeletexString
|
||||
(SIZE (1..ub-generation-qualifier-length))
|
||||
OPTIONAL }
|
||||
|
||||
teletex-organizational-unit-names INTEGER ::= 5
|
||||
|
||||
TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
|
||||
(1..ub-organizational-units) OF TeletexOrganizationalUnitName
|
||||
|
||||
TeletexOrganizationalUnitName ::= TeletexString
|
||||
(SIZE (1..ub-organizational-unit-name-length))
|
||||
|
||||
pds-name INTEGER ::= 7
|
||||
|
||||
PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
|
||||
|
||||
physical-delivery-country-name INTEGER ::= 8
|
||||
|
||||
PhysicalDeliveryCountryName ::= CHOICE {
|
||||
x121-dcc-code NumericString (SIZE
|
||||
(ub-country-name-numeric-length)),
|
||||
iso-3166-alpha2-code PrintableString
|
||||
(SIZE (ub-country-name-alpha-length)) }
|
||||
|
||||
|
||||
postal-code INTEGER ::= 9
|
||||
|
||||
PostalCode ::= CHOICE {
|
||||
numeric-code NumericString (SIZE (1..ub-postal-code-length)),
|
||||
printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
|
||||
|
||||
physical-delivery-office-name INTEGER ::= 10
|
||||
|
||||
PhysicalDeliveryOfficeName ::= PDSParameter
|
||||
|
||||
physical-delivery-office-number INTEGER ::= 11
|
||||
|
||||
PhysicalDeliveryOfficeNumber ::= PDSParameter
|
||||
|
||||
extension-OR-address-components INTEGER ::= 12
|
||||
|
||||
ExtensionORAddressComponents ::= PDSParameter
|
||||
|
||||
physical-delivery-personal-name INTEGER ::= 13
|
||||
|
||||
PhysicalDeliveryPersonalName ::= PDSParameter
|
||||
|
||||
physical-delivery-organization-name INTEGER ::= 14
|
||||
|
||||
PhysicalDeliveryOrganizationName ::= PDSParameter
|
||||
|
||||
extension-physical-delivery-address-components INTEGER ::= 15
|
||||
|
||||
ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
|
||||
|
||||
unformatted-postal-address INTEGER ::= 16
|
||||
|
||||
UnformattedPostalAddress ::= SET {
|
||||
printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines)
|
||||
OF PrintableString (SIZE (1..ub-pds-parameter-length))
|
||||
OPTIONAL,
|
||||
teletex-string TeletexString
|
||||
(SIZE (1..ub-unformatted-address-length)) OPTIONAL }
|
||||
|
||||
street-address INTEGER ::= 17
|
||||
|
||||
StreetAddress ::= PDSParameter
|
||||
|
||||
post-office-box-address INTEGER ::= 18
|
||||
|
||||
PostOfficeBoxAddress ::= PDSParameter
|
||||
|
||||
poste-restante-address INTEGER ::= 19
|
||||
|
||||
PosteRestanteAddress ::= PDSParameter
|
||||
|
||||
unique-postal-name INTEGER ::= 20
|
||||
|
||||
UniquePostalName ::= PDSParameter
|
||||
|
||||
local-postal-attributes INTEGER ::= 21
|
||||
|
||||
LocalPostalAttributes ::= PDSParameter
|
||||
|
||||
PDSParameter ::= SET {
|
||||
printable-string PrintableString
|
||||
(SIZE(1..ub-pds-parameter-length)) OPTIONAL,
|
||||
teletex-string TeletexString
|
||||
(SIZE(1..ub-pds-parameter-length)) OPTIONAL }
|
||||
|
||||
extended-network-address INTEGER ::= 22
|
||||
|
||||
ExtendedNetworkAddress ::= CHOICE {
|
||||
e163-4-address SEQUENCE {
|
||||
number [0] IMPLICIT NumericString
|
||||
(SIZE (1..ub-e163-4-number-length)),
|
||||
sub-address [1] IMPLICIT NumericString
|
||||
(SIZE (1..ub-e163-4-sub-address-length))
|
||||
OPTIONAL },
|
||||
psap-address [0] IMPLICIT PresentationAddress }
|
||||
|
||||
PresentationAddress ::= SEQUENCE {
|
||||
pSelector [0] EXPLICIT OCTET STRING OPTIONAL,
|
||||
sSelector [1] EXPLICIT OCTET STRING OPTIONAL,
|
||||
tSelector [2] EXPLICIT OCTET STRING OPTIONAL,
|
||||
nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
|
||||
|
||||
terminal-type INTEGER ::= 23
|
||||
|
||||
TerminalType ::= INTEGER {
|
||||
telex (3),
|
||||
teletex (4),
|
||||
g3-facsimile (5),
|
||||
g4-facsimile (6),
|
||||
ia5-terminal (7),
|
||||
videotex (8) } --(0..ub-integer-options)
|
||||
|
||||
-- Extension Domain-defined Attributes
|
||||
|
||||
teletex-domain-defined-attributes INTEGER ::= 6
|
||||
|
||||
|
||||
TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
|
||||
(1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
|
||||
|
||||
TeletexDomainDefinedAttribute ::= SEQUENCE {
|
||||
type TeletexString
|
||||
(SIZE (1..ub-domain-defined-attribute-type-length)),
|
||||
value TeletexString
|
||||
(SIZE (1..ub-domain-defined-attribute-value-length)) }
|
||||
|
||||
-- specifications of Upper Bounds MUST be regarded as mandatory
|
||||
-- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
|
||||
-- Upper Bounds
|
||||
|
||||
-- Upper Bounds
|
||||
ub-name INTEGER ::= 32768
|
||||
ub-common-name INTEGER ::= 64
|
||||
ub-locality-name INTEGER ::= 128
|
||||
ub-state-name INTEGER ::= 128
|
||||
ub-organization-name INTEGER ::= 64
|
||||
ub-organizational-unit-name INTEGER ::= 64
|
||||
ub-title INTEGER ::= 64
|
||||
ub-serial-number INTEGER ::= 64
|
||||
ub-match INTEGER ::= 128
|
||||
ub-emailaddress-length INTEGER ::= 128
|
||||
ub-common-name-length INTEGER ::= 64
|
||||
ub-country-name-alpha-length INTEGER ::= 2
|
||||
ub-country-name-numeric-length INTEGER ::= 3
|
||||
ub-domain-defined-attributes INTEGER ::= 4
|
||||
ub-domain-defined-attribute-type-length INTEGER ::= 8
|
||||
ub-domain-defined-attribute-value-length INTEGER ::= 128
|
||||
ub-domain-name-length INTEGER ::= 16
|
||||
ub-extension-attributes INTEGER ::= 256
|
||||
ub-e163-4-number-length INTEGER ::= 15
|
||||
ub-e163-4-sub-address-length INTEGER ::= 40
|
||||
ub-generation-qualifier-length INTEGER ::= 3
|
||||
ub-given-name-length INTEGER ::= 16
|
||||
ub-initials-length INTEGER ::= 5
|
||||
ub-integer-options INTEGER ::= 256
|
||||
ub-numeric-user-id-length INTEGER ::= 32
|
||||
ub-organization-name-length INTEGER ::= 64
|
||||
ub-organizational-unit-name-length INTEGER ::= 32
|
||||
ub-organizational-units INTEGER ::= 4
|
||||
ub-pds-name-length INTEGER ::= 16
|
||||
ub-pds-parameter-length INTEGER ::= 30
|
||||
ub-pds-physical-address-lines INTEGER ::= 6
|
||||
ub-postal-code-length INTEGER ::= 16
|
||||
ub-pseudonym INTEGER ::= 128
|
||||
ub-surname-length INTEGER ::= 40
|
||||
ub-terminal-id-length INTEGER ::= 24
|
||||
ub-unformatted-address-length INTEGER ::= 180
|
||||
ub-x121-address-length INTEGER ::= 16
|
||||
|
||||
-- Note - upper bounds on string types, such as TeletexString, are
|
||||
-- measured in characters. Excepting PrintableString or IA5String, a
|
||||
-- significantly greater number of octets will be required to hold
|
||||
-- such a value. As a minimum, 16 octets, or twice the specified
|
||||
-- upper bound, whichever is the larger, should be allowed for
|
||||
-- TeletexString. For UTF8String or UniversalString at least four
|
||||
-- times the upper bound should be allowed.
|
||||
|
||||
END
|
||||
347
asn/rfc3280.i.asn
Normal file
347
asn/rfc3280.i.asn
Normal file
@ -0,0 +1,347 @@
|
||||
PKIX1Implicit88 { iso(1) identified-organization(3) dod(6) internet(1)
|
||||
security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit(19) }
|
||||
|
||||
DEFINITIONS IMPLICIT TAGS ::=
|
||||
|
||||
BEGIN
|
||||
|
||||
-- EXPORTS ALL --
|
||||
|
||||
-- fake imports
|
||||
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
|
||||
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
||||
ORAddress ::= ANY
|
||||
Name ::= CHOICE { any ANY }
|
||||
RelativeDistinguishedName ::= ANY
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
Attribute ::= ANY
|
||||
DirectoryString ::= CHOICE { any ANY }
|
||||
|
||||
-- ISO arc for standard certificate and CRL extensions
|
||||
|
||||
id-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}
|
||||
|
||||
-- authority key identifier OID and syntax
|
||||
|
||||
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }
|
||||
|
||||
AuthorityKeyIdentifier ::= SEQUENCE {
|
||||
keyIdentifier [0] KeyIdentifier OPTIONAL,
|
||||
authorityCertIssuer [1] GeneralNames OPTIONAL,
|
||||
authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
|
||||
-- authorityCertIssuer and authorityCertSerialNumber MUST both
|
||||
-- be present or both be absent
|
||||
|
||||
KeyIdentifier ::= OCTET STRING
|
||||
|
||||
-- subject key identifier OID and syntax
|
||||
|
||||
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }
|
||||
|
||||
SubjectKeyIdentifier ::= KeyIdentifier
|
||||
|
||||
-- key usage extension OID and syntax
|
||||
|
||||
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
|
||||
|
||||
KeyUsage ::= BIT STRING {
|
||||
digitalSignature (0),
|
||||
nonRepudiation (1),
|
||||
keyEncipherment (2),
|
||||
dataEncipherment (3),
|
||||
keyAgreement (4),
|
||||
keyCertSign (5),
|
||||
cRLSign (6),
|
||||
encipherOnly (7),
|
||||
decipherOnly (8) }
|
||||
|
||||
-- private key usage period extension OID and syntax
|
||||
|
||||
id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= { id-ce 16 }
|
||||
|
||||
PrivateKeyUsagePeriod ::= SEQUENCE {
|
||||
notBefore [0] GeneralizedTime OPTIONAL,
|
||||
notAfter [1] GeneralizedTime OPTIONAL }
|
||||
-- either notBefore or notAfter MUST be present
|
||||
|
||||
-- certificate policies extension OID and syntax
|
||||
|
||||
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
|
||||
|
||||
anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 }
|
||||
|
||||
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
|
||||
|
||||
PolicyInformation ::= SEQUENCE {
|
||||
policyIdentifier CertPolicyId,
|
||||
policyQualifiers SEQUENCE SIZE (1..MAX) OF
|
||||
PolicyQualifierInfo OPTIONAL }
|
||||
|
||||
CertPolicyId ::= OBJECT IDENTIFIER
|
||||
|
||||
PolicyQualifierInfo ::= SEQUENCE {
|
||||
policyQualifierId PolicyQualifierId,
|
||||
qualifier ANY DEFINED BY policyQualifierId }
|
||||
|
||||
-- Implementations that recognize additional policy qualifiers MUST
|
||||
-- augment the following definition for PolicyQualifierId
|
||||
|
||||
PolicyQualifierId ::=
|
||||
OBJECT IDENTIFIER --( id-qt-cps | id-qt-unotice )
|
||||
|
||||
-- CPS pointer qualifier
|
||||
|
||||
CPSuri ::= IA5String
|
||||
|
||||
-- user notice qualifier
|
||||
|
||||
UserNotice ::= SEQUENCE {
|
||||
noticeRef NoticeReference OPTIONAL,
|
||||
explicitText DisplayText OPTIONAL}
|
||||
|
||||
NoticeReference ::= SEQUENCE {
|
||||
organization DisplayText,
|
||||
noticeNumbers SEQUENCE OF INTEGER }
|
||||
|
||||
DisplayText ::= CHOICE {
|
||||
ia5String IA5String (SIZE (1..200)),
|
||||
visibleString VisibleString (SIZE (1..200)),
|
||||
bmpString BMPString (SIZE (1..200)),
|
||||
utf8String UTF8String (SIZE (1..200)) }
|
||||
|
||||
-- policy mapping extension OID and syntax
|
||||
|
||||
id-ce-policyMappings OBJECT IDENTIFIER ::= { id-ce 33 }
|
||||
|
||||
PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
|
||||
issuerDomainPolicy CertPolicyId,
|
||||
subjectDomainPolicy CertPolicyId }
|
||||
|
||||
-- subject alternative name extension OID and syntax
|
||||
|
||||
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
|
||||
|
||||
SubjectAltName ::= GeneralNames
|
||||
|
||||
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
|
||||
|
||||
GeneralName ::= CHOICE {
|
||||
otherName [0] AnotherName,
|
||||
rfc822Name [1] IA5String,
|
||||
dNSName [2] IA5String,
|
||||
x400Address [3] ORAddress,
|
||||
directoryName [4] Name,
|
||||
ediPartyName [5] EDIPartyName,
|
||||
uniformResourceIdentifier [6] IA5String,
|
||||
iPAddress [7] OCTET STRING,
|
||||
registeredID [8] OBJECT IDENTIFIER }
|
||||
|
||||
-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
|
||||
-- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
|
||||
|
||||
AnotherName ::= SEQUENCE {
|
||||
type-id OBJECT IDENTIFIER,
|
||||
value [0] EXPLICIT ANY DEFINED BY type-id }
|
||||
|
||||
EDIPartyName ::= SEQUENCE {
|
||||
nameAssigner [0] DirectoryString OPTIONAL,
|
||||
partyName [1] DirectoryString }
|
||||
|
||||
-- issuer alternative name extension OID and syntax
|
||||
|
||||
id-ce-issuerAltName OBJECT IDENTIFIER ::= { id-ce 18 }
|
||||
|
||||
IssuerAltName ::= GeneralNames
|
||||
|
||||
id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= { id-ce 9 }
|
||||
|
||||
SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
|
||||
|
||||
-- basic constraints extension OID and syntax
|
||||
|
||||
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
|
||||
|
||||
BasicConstraints ::= SEQUENCE {
|
||||
cA BOOLEAN DEFAULT FALSE,
|
||||
pathLenConstraint INTEGER (0..MAX) OPTIONAL }
|
||||
|
||||
-- name constraints extension OID and syntax
|
||||
|
||||
id-ce-nameConstraints OBJECT IDENTIFIER ::= { id-ce 30 }
|
||||
|
||||
NameConstraints ::= SEQUENCE {
|
||||
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
|
||||
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
|
||||
|
||||
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
|
||||
|
||||
GeneralSubtree ::= SEQUENCE {
|
||||
base GeneralName,
|
||||
minimum [0] BaseDistance DEFAULT 0,
|
||||
maximum [1] BaseDistance OPTIONAL }
|
||||
|
||||
BaseDistance ::= INTEGER (0..MAX)
|
||||
|
||||
-- policy constraints extension OID and syntax
|
||||
|
||||
id-ce-policyConstraints OBJECT IDENTIFIER ::= { id-ce 36 }
|
||||
|
||||
PolicyConstraints ::= SEQUENCE {
|
||||
requireExplicitPolicy [0] SkipCerts OPTIONAL,
|
||||
inhibitPolicyMapping [1] SkipCerts OPTIONAL }
|
||||
|
||||
SkipCerts ::= INTEGER (0..MAX)
|
||||
|
||||
-- CRL distribution points extension OID and syntax
|
||||
|
||||
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
|
||||
|
||||
CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
|
||||
|
||||
DistributionPoint ::= SEQUENCE {
|
||||
distributionPoint [0] DistributionPointName OPTIONAL,
|
||||
reasons [1] ReasonFlags OPTIONAL,
|
||||
cRLIssuer [2] GeneralNames OPTIONAL }
|
||||
|
||||
DistributionPointName ::= CHOICE {
|
||||
fullName [0] GeneralNames,
|
||||
nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
|
||||
|
||||
ReasonFlags ::= BIT STRING {
|
||||
unused (0),
|
||||
keyCompromise (1),
|
||||
cACompromise (2),
|
||||
affiliationChanged (3),
|
||||
superseded (4),
|
||||
cessationOfOperation (5),
|
||||
certificateHold (6),
|
||||
privilegeWithdrawn (7),
|
||||
aACompromise (8) }
|
||||
|
||||
-- extended key usage extension OID and syntax
|
||||
|
||||
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
|
||||
|
||||
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
|
||||
|
||||
|
||||
KeyPurposeId ::= OBJECT IDENTIFIER
|
||||
|
||||
-- permit unspecified key uses
|
||||
|
||||
anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 }
|
||||
|
||||
-- extended key purpose OIDs
|
||||
|
||||
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
|
||||
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
|
||||
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
|
||||
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
|
||||
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
|
||||
id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
|
||||
|
||||
-- inhibit any policy OID and syntax
|
||||
|
||||
id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= { id-ce 54 }
|
||||
|
||||
InhibitAnyPolicy ::= SkipCerts
|
||||
|
||||
-- freshest (delta)CRL extension OID and syntax
|
||||
|
||||
id-ce-freshestCRL OBJECT IDENTIFIER ::= { id-ce 46 }
|
||||
|
||||
FreshestCRL ::= CRLDistributionPoints
|
||||
|
||||
-- authority info access
|
||||
|
||||
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
|
||||
|
||||
AuthorityInfoAccessSyntax ::=
|
||||
SEQUENCE SIZE (1..MAX) OF AccessDescription
|
||||
|
||||
AccessDescription ::= SEQUENCE {
|
||||
accessMethod OBJECT IDENTIFIER,
|
||||
accessLocation GeneralName }
|
||||
|
||||
-- subject info access
|
||||
|
||||
id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }
|
||||
|
||||
SubjectInfoAccessSyntax ::=
|
||||
SEQUENCE SIZE (1..MAX) OF AccessDescription
|
||||
|
||||
-- CRL number extension OID and syntax
|
||||
|
||||
id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
|
||||
|
||||
CRLNumber ::= INTEGER (0..MAX)
|
||||
|
||||
-- issuing distribution point extension OID and syntax
|
||||
|
||||
id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
|
||||
|
||||
IssuingDistributionPoint ::= SEQUENCE {
|
||||
distributionPoint [0] DistributionPointName OPTIONAL,
|
||||
onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
|
||||
onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
|
||||
onlySomeReasons [3] ReasonFlags OPTIONAL,
|
||||
indirectCRL [4] BOOLEAN DEFAULT FALSE,
|
||||
onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
|
||||
|
||||
id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
|
||||
|
||||
BaseCRLNumber ::= CRLNumber
|
||||
|
||||
-- CRL reasons extension OID and syntax
|
||||
|
||||
id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
|
||||
|
||||
CRLReason ::= ENUMERATED {
|
||||
unspecified (0),
|
||||
keyCompromise (1),
|
||||
cACompromise (2),
|
||||
affiliationChanged (3),
|
||||
superseded (4),
|
||||
cessationOfOperation (5),
|
||||
certificateHold (6),
|
||||
removeFromCRL (8),
|
||||
privilegeWithdrawn (9),
|
||||
aACompromise (10) }
|
||||
|
||||
-- certificate issuer CRL entry extension OID and syntax
|
||||
|
||||
id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
|
||||
|
||||
CertificateIssuer ::= GeneralNames
|
||||
|
||||
-- hold instruction extension OID and syntax
|
||||
|
||||
id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
|
||||
|
||||
HoldInstructionCode ::= OBJECT IDENTIFIER
|
||||
|
||||
-- ANSI x9 holdinstructions
|
||||
|
||||
-- ANSI x9 arc holdinstruction arc
|
||||
|
||||
holdInstruction OBJECT IDENTIFIER ::=
|
||||
{joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
|
||||
|
||||
-- ANSI X9 holdinstructions referenced by this standard
|
||||
|
||||
id-holdinstruction-none OBJECT IDENTIFIER ::=
|
||||
{holdInstruction 1} -- deprecated
|
||||
|
||||
id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
|
||||
{holdInstruction 2}
|
||||
|
||||
id-holdinstruction-reject OBJECT IDENTIFIER ::=
|
||||
{holdInstruction 3}
|
||||
|
||||
-- invalidity date CRL entry extension OID and syntax
|
||||
|
||||
id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
|
||||
|
||||
InvalidityDate ::= GeneralizedTime
|
||||
|
||||
END
|
||||
51
asn/rfc3852.e.asn
Normal file
51
asn/rfc3852.e.asn
Normal file
@ -0,0 +1,51 @@
|
||||
AttributeCertificateVersion1
|
||||
{ iso(1) member-body(2) us(840) rsadsi(113549)
|
||||
pkcs(1) pkcs-9(9) smime(16) modules(0) v1AttrCert(15) }
|
||||
|
||||
DEFINITIONS EXPLICIT TAGS ::=
|
||||
BEGIN
|
||||
|
||||
-- EXPORTS All
|
||||
|
||||
-- fake imports
|
||||
-- Imports from RFC 3280 [PROFILE], Appendix A.1
|
||||
AlgorithmIdentifier ::= ANY
|
||||
Attribute ::= ANY
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
Extensions ::= ANY
|
||||
UniqueIdentifier ::= BIT STRING
|
||||
|
||||
-- Imports from RFC 3280 [PROFILE], Appendix A.2
|
||||
GeneralNames ::= ANY
|
||||
|
||||
-- Imports from RFC 3281 [ACPROFILE], Appendix B
|
||||
AttCertValidityPeriod ::= ANY
|
||||
IssuerSerial ::= ANY
|
||||
|
||||
-- Definition extracted from X.509-1997 [X.509-97], but
|
||||
-- different type names are used to avoid collisions.
|
||||
|
||||
|
||||
AttributeCertificateV1 ::= SEQUENCE {
|
||||
acInfo AttributeCertificateInfoV1,
|
||||
signatureAlgorithm AlgorithmIdentifier,
|
||||
signature BIT STRING }
|
||||
|
||||
AttributeCertificateInfoV1 ::= SEQUENCE {
|
||||
version AttCertVersionV1 DEFAULT v1,
|
||||
subject CHOICE {
|
||||
baseCertificateID [0] IssuerSerial,
|
||||
-- associated with a Public Key Certificate
|
||||
subjectName [1] GeneralNames },
|
||||
-- associated with a name
|
||||
issuer GeneralNames,
|
||||
signature AlgorithmIdentifier,
|
||||
serialNumber CertificateSerialNumber,
|
||||
attCertValidityPeriod AttCertValidityPeriod,
|
||||
attributes SEQUENCE OF Attribute,
|
||||
issuerUniqueID UniqueIdentifier OPTIONAL,
|
||||
extensions Extensions OPTIONAL }
|
||||
|
||||
AttCertVersionV1 ::= INTEGER { v1(0) }
|
||||
|
||||
END -- of AttributeCertificateVersion1
|
||||
333
asn/rfc3852.i.asn
Normal file
333
asn/rfc3852.i.asn
Normal file
@ -0,0 +1,333 @@
|
||||
CryptographicMessageSyntax2004
|
||||
{ iso(1) member-body(2) us(840) rsadsi(113549)
|
||||
pkcs(1) pkcs-9(9) smime(16) modules(0) cms-2004(24) }
|
||||
|
||||
DEFINITIONS IMPLICIT TAGS ::=
|
||||
BEGIN
|
||||
|
||||
-- EXPORTS All
|
||||
-- The types and values defined in this module are exported for use
|
||||
-- in the other ASN.1 modules. Other applications may use them for
|
||||
-- their own purposes.
|
||||
|
||||
-- fake imports
|
||||
-- Imports from RFC 3280 [PROFILE], Appendix A.1
|
||||
AlgorithmIdentifier ::= ANY
|
||||
Certificate ::= ANY
|
||||
CertificateList ::= ANY
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
Name ::= CHOICE { any ANY }
|
||||
|
||||
-- Imports from RFC 3281 [ACPROFILE], Appendix B
|
||||
AttributeCertificate ::= ANY
|
||||
|
||||
-- Imports from Appendix B of this document
|
||||
AttributeCertificateV1 ::= ANY
|
||||
|
||||
-- Cryptographic Message Syntax
|
||||
|
||||
ContentInfo ::= SEQUENCE {
|
||||
contentType ContentType,
|
||||
content [0] EXPLICIT ANY DEFINED BY contentType }
|
||||
|
||||
ContentType ::= OBJECT IDENTIFIER
|
||||
|
||||
|
||||
SignedData ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
digestAlgorithms DigestAlgorithmIdentifiers,
|
||||
encapContentInfo EncapsulatedContentInfo,
|
||||
certificates [0] IMPLICIT CertificateSet OPTIONAL,
|
||||
crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
|
||||
signerInfos SignerInfos }
|
||||
|
||||
DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
|
||||
|
||||
SignerInfos ::= SET OF SignerInfo
|
||||
|
||||
EncapsulatedContentInfo ::= SEQUENCE {
|
||||
eContentType ContentType,
|
||||
eContent [0] EXPLICIT OCTET STRING OPTIONAL }
|
||||
|
||||
SignerInfo ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
sid SignerIdentifier,
|
||||
digestAlgorithm DigestAlgorithmIdentifier,
|
||||
signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
|
||||
signatureAlgorithm SignatureAlgorithmIdentifier,
|
||||
signature SignatureValue,
|
||||
unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL }
|
||||
|
||||
SignerIdentifier ::= CHOICE {
|
||||
issuerAndSerialNumber IssuerAndSerialNumber,
|
||||
subjectKeyIdentifier [0] SubjectKeyIdentifier }
|
||||
|
||||
SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
|
||||
|
||||
UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute
|
||||
|
||||
Attribute ::= SEQUENCE {
|
||||
attrType OBJECT IDENTIFIER,
|
||||
attrValues SET OF AttributeValue }
|
||||
|
||||
AttributeValue ::= ANY
|
||||
|
||||
SignatureValue ::= OCTET STRING
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
EnvelopedData ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
|
||||
recipientInfos RecipientInfos,
|
||||
encryptedContentInfo EncryptedContentInfo,
|
||||
unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL }
|
||||
|
||||
OriginatorInfo ::= SEQUENCE {
|
||||
certs [0] IMPLICIT CertificateSet OPTIONAL,
|
||||
crls [1] IMPLICIT RevocationInfoChoices OPTIONAL }
|
||||
|
||||
RecipientInfos ::= SET SIZE (1..MAX) OF RecipientInfo
|
||||
|
||||
EncryptedContentInfo ::= SEQUENCE {
|
||||
contentType ContentType,
|
||||
contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
|
||||
encryptedContent [0] IMPLICIT EncryptedContent OPTIONAL }
|
||||
|
||||
EncryptedContent ::= OCTET STRING
|
||||
|
||||
UnprotectedAttributes ::= SET SIZE (1..MAX) OF Attribute
|
||||
|
||||
RecipientInfo ::= CHOICE {
|
||||
ktri KeyTransRecipientInfo,
|
||||
kari [1] KeyAgreeRecipientInfo,
|
||||
kekri [2] KEKRecipientInfo,
|
||||
pwri [3] PasswordRecipientInfo,
|
||||
ori [4] OtherRecipientInfo }
|
||||
|
||||
EncryptedKey ::= OCTET STRING
|
||||
|
||||
KeyTransRecipientInfo ::= SEQUENCE {
|
||||
version CMSVersion, -- always set to 0 or 2
|
||||
rid RecipientIdentifier,
|
||||
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
|
||||
encryptedKey EncryptedKey }
|
||||
|
||||
RecipientIdentifier ::= CHOICE {
|
||||
issuerAndSerialNumber IssuerAndSerialNumber,
|
||||
subjectKeyIdentifier [0] SubjectKeyIdentifier }
|
||||
|
||||
KeyAgreeRecipientInfo ::= SEQUENCE {
|
||||
version CMSVersion, -- always set to 3
|
||||
originator [0] EXPLICIT OriginatorIdentifierOrKey,
|
||||
ukm [1] EXPLICIT UserKeyingMaterial OPTIONAL,
|
||||
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
|
||||
recipientEncryptedKeys RecipientEncryptedKeys }
|
||||
|
||||
|
||||
OriginatorIdentifierOrKey ::= CHOICE {
|
||||
issuerAndSerialNumber IssuerAndSerialNumber,
|
||||
subjectKeyIdentifier [0] SubjectKeyIdentifier,
|
||||
originatorKey [1] OriginatorPublicKey }
|
||||
|
||||
OriginatorPublicKey ::= SEQUENCE {
|
||||
algorithm AlgorithmIdentifier,
|
||||
publicKey BIT STRING }
|
||||
|
||||
RecipientEncryptedKeys ::= SEQUENCE OF RecipientEncryptedKey
|
||||
|
||||
RecipientEncryptedKey ::= SEQUENCE {
|
||||
rid KeyAgreeRecipientIdentifier,
|
||||
encryptedKey EncryptedKey }
|
||||
|
||||
KeyAgreeRecipientIdentifier ::= CHOICE {
|
||||
issuerAndSerialNumber IssuerAndSerialNumber,
|
||||
rKeyId [0] IMPLICIT RecipientKeyIdentifier }
|
||||
|
||||
RecipientKeyIdentifier ::= SEQUENCE {
|
||||
subjectKeyIdentifier SubjectKeyIdentifier,
|
||||
date GeneralizedTime OPTIONAL,
|
||||
other OtherKeyAttribute OPTIONAL }
|
||||
|
||||
SubjectKeyIdentifier ::= OCTET STRING
|
||||
|
||||
KEKRecipientInfo ::= SEQUENCE {
|
||||
version CMSVersion, -- always set to 4
|
||||
kekid KEKIdentifier,
|
||||
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
|
||||
encryptedKey EncryptedKey }
|
||||
|
||||
KEKIdentifier ::= SEQUENCE {
|
||||
keyIdentifier OCTET STRING,
|
||||
date GeneralizedTime OPTIONAL,
|
||||
other OtherKeyAttribute OPTIONAL }
|
||||
|
||||
PasswordRecipientInfo ::= SEQUENCE {
|
||||
version CMSVersion, -- always set to 0
|
||||
keyDerivationAlgorithm [0] KeyDerivationAlgorithmIdentifier
|
||||
OPTIONAL,
|
||||
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
|
||||
encryptedKey EncryptedKey }
|
||||
|
||||
OtherRecipientInfo ::= SEQUENCE {
|
||||
oriType OBJECT IDENTIFIER,
|
||||
oriValue ANY DEFINED BY oriType }
|
||||
|
||||
|
||||
DigestedData ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
digestAlgorithm DigestAlgorithmIdentifier,
|
||||
encapContentInfo EncapsulatedContentInfo,
|
||||
digest Digest }
|
||||
|
||||
Digest ::= OCTET STRING
|
||||
|
||||
EncryptedData ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
encryptedContentInfo EncryptedContentInfo,
|
||||
unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL }
|
||||
|
||||
AuthenticatedData ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
|
||||
recipientInfos RecipientInfos,
|
||||
macAlgorithm MessageAuthenticationCodeAlgorithm,
|
||||
digestAlgorithm [1] DigestAlgorithmIdentifier OPTIONAL,
|
||||
encapContentInfo EncapsulatedContentInfo,
|
||||
authAttrs [2] IMPLICIT AuthAttributes OPTIONAL,
|
||||
mac MessageAuthenticationCode,
|
||||
unauthAttrs [3] IMPLICIT UnauthAttributes OPTIONAL }
|
||||
|
||||
AuthAttributes ::= SET SIZE (1..MAX) OF Attribute
|
||||
|
||||
UnauthAttributes ::= SET SIZE (1..MAX) OF Attribute
|
||||
|
||||
MessageAuthenticationCode ::= OCTET STRING
|
||||
|
||||
DigestAlgorithmIdentifier ::= AlgorithmIdentifier
|
||||
|
||||
SignatureAlgorithmIdentifier ::= AlgorithmIdentifier
|
||||
|
||||
KeyEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
|
||||
|
||||
ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
|
||||
|
||||
MessageAuthenticationCodeAlgorithm ::= AlgorithmIdentifier
|
||||
|
||||
KeyDerivationAlgorithmIdentifier ::= AlgorithmIdentifier
|
||||
|
||||
RevocationInfoChoices ::= SET OF RevocationInfoChoice
|
||||
|
||||
RevocationInfoChoice ::= CHOICE {
|
||||
crl CertificateList,
|
||||
other [1] IMPLICIT OtherRevocationInfoFormat }
|
||||
|
||||
|
||||
OtherRevocationInfoFormat ::= SEQUENCE {
|
||||
otherRevInfoFormat OBJECT IDENTIFIER,
|
||||
otherRevInfo ANY DEFINED BY otherRevInfoFormat }
|
||||
|
||||
CertificateChoices ::= CHOICE {
|
||||
certificate Certificate,
|
||||
extendedCertificate [0] IMPLICIT ExtendedCertificate, -- Obsolete
|
||||
v1AttrCert [1] IMPLICIT AttributeCertificateV1, -- Obsolete
|
||||
v2AttrCert [2] IMPLICIT AttributeCertificateV2,
|
||||
other [3] IMPLICIT OtherCertificateFormat }
|
||||
|
||||
AttributeCertificateV2 ::= AttributeCertificate
|
||||
|
||||
OtherCertificateFormat ::= SEQUENCE {
|
||||
otherCertFormat OBJECT IDENTIFIER,
|
||||
otherCert ANY DEFINED BY otherCertFormat }
|
||||
|
||||
CertificateSet ::= SET OF CertificateChoices
|
||||
|
||||
IssuerAndSerialNumber ::= SEQUENCE {
|
||||
issuer Name,
|
||||
serialNumber CertificateSerialNumber }
|
||||
|
||||
CMSVersion ::= INTEGER { v0(0), v1(1), v2(2), v3(3), v4(4), v5(5) }
|
||||
|
||||
UserKeyingMaterial ::= OCTET STRING
|
||||
|
||||
OtherKeyAttribute ::= SEQUENCE {
|
||||
keyAttrId OBJECT IDENTIFIER,
|
||||
keyAttr ANY DEFINED BY keyAttrId OPTIONAL }
|
||||
|
||||
-- Content Type Object Identifiers
|
||||
|
||||
id-ct-contentInfo OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) ct(1) 6 }
|
||||
|
||||
id-data OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 1 }
|
||||
|
||||
id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }
|
||||
|
||||
id-envelopedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 3 }
|
||||
|
||||
id-digestedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 5 }
|
||||
|
||||
|
||||
id-encryptedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs7(7) 6 }
|
||||
|
||||
id-ct-authData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1) 2 }
|
||||
|
||||
-- The CMS Attributes
|
||||
|
||||
MessageDigest ::= OCTET STRING
|
||||
|
||||
SigningTime ::= Time
|
||||
|
||||
Time ::= CHOICE {
|
||||
utcTime UTCTime,
|
||||
generalTime GeneralizedTime }
|
||||
|
||||
Countersignature ::= SignerInfo
|
||||
|
||||
-- Attribute Object Identifiers
|
||||
|
||||
id-contentType OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 3 }
|
||||
|
||||
id-messageDigest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 4 }
|
||||
|
||||
id-signingTime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 5 }
|
||||
|
||||
id-countersignature OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 6 }
|
||||
|
||||
-- Obsolete Extended Certificate syntax from PKCS#6
|
||||
|
||||
ExtendedCertificateOrCertificate ::= CHOICE {
|
||||
certificate Certificate,
|
||||
extendedCertificate [0] IMPLICIT ExtendedCertificate }
|
||||
|
||||
ExtendedCertificate ::= SEQUENCE {
|
||||
extendedCertificateInfo ExtendedCertificateInfo,
|
||||
signatureAlgorithm SignatureAlgorithmIdentifier,
|
||||
signature Signature }
|
||||
|
||||
|
||||
|
||||
ExtendedCertificateInfo ::= SEQUENCE {
|
||||
version CMSVersion,
|
||||
certificate Certificate,
|
||||
attributes UnauthAttributes }
|
||||
|
||||
Signature ::= BIT STRING
|
||||
|
||||
END -- of CryptographicMessageSyntax2004
|
||||
|
||||
284
asn/rfc4211.asn
Normal file
284
asn/rfc4211.asn
Normal file
@ -0,0 +1,284 @@
|
||||
PKIXCRMF-2005 {iso(1) identified-organization(3) dod(6) internet(1)
|
||||
security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-crmf2005(36)}
|
||||
|
||||
DEFINITIONS IMPLICIT TAGS ::=
|
||||
BEGIN
|
||||
|
||||
-- fake imports
|
||||
|
||||
-- Directory Authentication Framework (X.509)
|
||||
Version ::= INTEGER
|
||||
AlgorithmIdentifier ::= ANY
|
||||
Name ::= CHOICE { any ANY }
|
||||
Time ::= CHOICE { any ANY }
|
||||
SubjectPublicKeyInfo ::= ANY
|
||||
Extensions ::= ANY
|
||||
UniqueIdentifier ::= BIT STRING
|
||||
Attribute ::= ANY
|
||||
|
||||
-- Certificate Extensions (X.509)
|
||||
GeneralName ::= CHOICE { any ANY }
|
||||
|
||||
-- Cryptographic Message Syntax
|
||||
EnvelopedData ::= ANY
|
||||
|
||||
-- The following definition may be uncommented for use with
|
||||
-- ASN.1 compilers that do not understand UTF8String.
|
||||
|
||||
-- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
|
||||
-- The contents of this type correspond to RFC 2279.
|
||||
|
||||
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
||||
dod(6) internet(1) security(5) mechanisms(5) 7 }
|
||||
|
||||
-- arc for Internet X.509 PKI protocols and their components
|
||||
|
||||
id-pkip OBJECT IDENTIFIER ::= { id-pkix 5 }
|
||||
|
||||
id-smime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 16 }
|
||||
|
||||
id-ct OBJECT IDENTIFIER ::= { id-smime 1 } -- content types
|
||||
|
||||
-- Core definitions for this module
|
||||
|
||||
CertReqMessages ::= SEQUENCE SIZE (1..MAX) OF CertReqMsg
|
||||
|
||||
CertReqMsg ::= SEQUENCE {
|
||||
certReq CertRequest,
|
||||
popo ProofOfPossession OPTIONAL,
|
||||
-- content depends upon key type
|
||||
regInfo SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue OPTIONAL }
|
||||
|
||||
CertRequest ::= SEQUENCE {
|
||||
certReqId INTEGER, -- ID for matching request and reply
|
||||
certTemplate CertTemplate, -- Selected fields of cert to be issued
|
||||
controls Controls OPTIONAL } -- Attributes affecting issuance
|
||||
|
||||
CertTemplate ::= SEQUENCE {
|
||||
version [0] Version OPTIONAL,
|
||||
serialNumber [1] INTEGER OPTIONAL,
|
||||
signingAlg [2] AlgorithmIdentifier OPTIONAL,
|
||||
issuer [3] Name OPTIONAL,
|
||||
validity [4] OptionalValidity OPTIONAL,
|
||||
subject [5] Name OPTIONAL,
|
||||
publicKey [6] SubjectPublicKeyInfo OPTIONAL,
|
||||
issuerUID [7] UniqueIdentifier OPTIONAL,
|
||||
subjectUID [8] UniqueIdentifier OPTIONAL,
|
||||
extensions [9] Extensions OPTIONAL }
|
||||
|
||||
OptionalValidity ::= SEQUENCE {
|
||||
notBefore [0] Time OPTIONAL,
|
||||
notAfter [1] Time OPTIONAL } -- at least one MUST be present
|
||||
|
||||
Controls ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue
|
||||
AttributeTypeAndValue ::= SEQUENCE {
|
||||
type OBJECT IDENTIFIER,
|
||||
value ANY DEFINED BY type }
|
||||
|
||||
ProofOfPossession ::= CHOICE {
|
||||
raVerified [0] NULL,
|
||||
-- used if the RA has already verified that the requester is in
|
||||
-- possession of the private key
|
||||
signature [1] POPOSigningKey,
|
||||
keyEncipherment [2] POPOPrivKey,
|
||||
keyAgreement [3] POPOPrivKey }
|
||||
|
||||
POPOSigningKey ::= SEQUENCE {
|
||||
poposkInput [0] POPOSigningKeyInput OPTIONAL,
|
||||
algorithmIdentifier AlgorithmIdentifier,
|
||||
signature BIT STRING }
|
||||
|
||||
-- The signature (using "algorithmIdentifier") is on the
|
||||
-- DER-encoded value of poposkInput. NOTE: If the CertReqMsg
|
||||
-- certReq CertTemplate contains the subject and publicKey values,
|
||||
-- then poposkInput MUST be omitted and the signature MUST be
|
||||
-- computed over the DER-encoded value of CertReqMsg certReq. If
|
||||
-- the CertReqMsg certReq CertTemplate does not contain both the
|
||||
-- public key and subject values (i.e., if it contains only one
|
||||
-- of these, or neither), then poposkInput MUST be present and
|
||||
-- MUST be signed.
|
||||
|
||||
|
||||
POPOSigningKeyInput ::= SEQUENCE {
|
||||
authInfo CHOICE {
|
||||
sender [0] GeneralName,
|
||||
-- used only if an authenticated identity has been
|
||||
-- established for the sender (e.g., a DN from a
|
||||
-- previously-issued and currently-valid certificate)
|
||||
publicKeyMAC PKMACValue },
|
||||
-- used if no authenticated GeneralName currently exists for
|
||||
-- the sender; publicKeyMAC contains a password-based MAC
|
||||
-- on the DER-encoded value of publicKey
|
||||
publicKey SubjectPublicKeyInfo } -- from CertTemplate
|
||||
|
||||
PKMACValue ::= SEQUENCE {
|
||||
algId AlgorithmIdentifier,
|
||||
-- algorithm value shall be PasswordBasedMac {1 2 840 113533 7 66 13}
|
||||
-- parameter value is PBMParameter
|
||||
value BIT STRING }
|
||||
|
||||
PBMParameter ::= SEQUENCE {
|
||||
salt OCTET STRING,
|
||||
owf AlgorithmIdentifier,
|
||||
-- AlgId for a One-Way Function (SHA-1 recommended)
|
||||
iterationCount INTEGER,
|
||||
-- number of times the OWF is applied
|
||||
mac AlgorithmIdentifier
|
||||
-- the MAC AlgId (e.g., DES-MAC, Triple-DES-MAC [PKCS11],
|
||||
} -- or HMAC [HMAC, RFC2202])
|
||||
|
||||
POPOPrivKey ::= CHOICE {
|
||||
thisMessage [0] BIT STRING, -- Deprecated
|
||||
-- possession is proven in this message (which contains the private
|
||||
-- key itself (encrypted for the CA))
|
||||
subsequentMessage [1] SubsequentMessage,
|
||||
-- possession will be proven in a subsequent message
|
||||
dhMAC [2] BIT STRING, -- Deprecated
|
||||
agreeMAC [3] PKMACValue,
|
||||
encryptedKey [4] EnvelopedData }
|
||||
|
||||
-- for keyAgreement (only), possession is proven in this message
|
||||
-- (which contains a MAC (over the DER-encoded value of the
|
||||
-- certReq parameter in CertReqMsg, which MUST include both subject
|
||||
-- and publicKey) based on a key derived from the end entity's
|
||||
-- private DH key and the CA's public DH key);
|
||||
|
||||
SubsequentMessage ::= INTEGER {
|
||||
encrCert (0),
|
||||
-- requests that resulting certificate be encrypted for the
|
||||
-- end entity (following which, POP will be proven in a
|
||||
-- confirmation message)
|
||||
challengeResp (1) }
|
||||
-- requests that CA engage in challenge-response exchange with
|
||||
-- end entity in order to prove private key possession
|
||||
|
||||
-- Object identifier assignments --
|
||||
|
||||
-- Registration Controls in CRMF
|
||||
id-regCtrl OBJECT IDENTIFIER ::= { id-pkip 1 }
|
||||
|
||||
|
||||
id-regCtrl-regToken OBJECT IDENTIFIER ::= { id-regCtrl 1 }
|
||||
--with syntax:
|
||||
RegToken ::= UTF8String
|
||||
|
||||
id-regCtrl-authenticator OBJECT IDENTIFIER ::= { id-regCtrl 2 }
|
||||
--with syntax:
|
||||
Authenticator ::= UTF8String
|
||||
|
||||
id-regCtrl-pkiPublicationInfo OBJECT IDENTIFIER ::= { id-regCtrl 3 }
|
||||
--with syntax:
|
||||
|
||||
PKIPublicationInfo ::= SEQUENCE {
|
||||
action INTEGER {
|
||||
dontPublish (0),
|
||||
pleasePublish (1) },
|
||||
pubInfos SEQUENCE SIZE (1..MAX) OF SinglePubInfo OPTIONAL }
|
||||
-- pubInfos MUST NOT be present if action is "dontPublish"
|
||||
-- (if action is "pleasePublish" and pubInfos is omitted,
|
||||
-- "dontCare" is assumed)
|
||||
|
||||
SinglePubInfo ::= SEQUENCE {
|
||||
pubMethod INTEGER {
|
||||
dontCare (0),
|
||||
x500 (1),
|
||||
web (2),
|
||||
ldap (3) },
|
||||
pubLocation GeneralName OPTIONAL }
|
||||
|
||||
id-regCtrl-pkiArchiveOptions OBJECT IDENTIFIER ::= { id-regCtrl 4 }
|
||||
--with syntax:
|
||||
PKIArchiveOptions ::= CHOICE {
|
||||
encryptedPrivKey [0] EncryptedKey,
|
||||
-- the actual value of the private key
|
||||
keyGenParameters [1] KeyGenParameters,
|
||||
-- parameters that allow the private key to be re-generated
|
||||
archiveRemGenPrivKey [2] BOOLEAN }
|
||||
-- set to TRUE if sender wishes receiver to archive the private
|
||||
-- key of a key pair that the receiver generates in response to
|
||||
-- this request; set to FALSE if no archival is desired.
|
||||
|
||||
EncryptedKey ::= CHOICE {
|
||||
encryptedValue EncryptedValue, -- Deprecated
|
||||
envelopedData [0] EnvelopedData }
|
||||
-- The encrypted private key MUST be placed in the envelopedData
|
||||
-- encryptedContentInfo encryptedContent OCTET STRING.
|
||||
|
||||
EncryptedValue ::= SEQUENCE {
|
||||
intendedAlg [0] AlgorithmIdentifier OPTIONAL,
|
||||
-- the intended algorithm for which the value will be used
|
||||
symmAlg [1] AlgorithmIdentifier OPTIONAL,
|
||||
-- the symmetric algorithm used to encrypt the value
|
||||
encSymmKey [2] BIT STRING OPTIONAL,
|
||||
-- the (encrypted) symmetric key used to encrypt the value
|
||||
keyAlg [3] AlgorithmIdentifier OPTIONAL,
|
||||
-- algorithm used to encrypt the symmetric key
|
||||
valueHint [4] OCTET STRING OPTIONAL,
|
||||
-- a brief description or identifier of the encValue content
|
||||
-- (may be meaningful only to the sending entity, and used only
|
||||
-- if EncryptedValue might be re-examined by the sending entity
|
||||
-- in the future)
|
||||
encValue BIT STRING }
|
||||
-- the encrypted value itself
|
||||
-- When EncryptedValue is used to carry a private key (as opposed to
|
||||
-- a certificate), implementations MUST support the encValue field
|
||||
-- containing an encrypted PrivateKeyInfo as defined in [PKCS11],
|
||||
-- section 12.11. If encValue contains some other format/encoding
|
||||
-- for the private key, the first octet of valueHint MAY be used
|
||||
-- to indicate the format/encoding (but note that the possible values
|
||||
-- of this octet are not specified at this time). In all cases, the
|
||||
-- intendedAlg field MUST be used to indicate at least the OID of
|
||||
-- the intended algorithm of the private key, unless this information
|
||||
-- is known a priori to both sender and receiver by some other means.
|
||||
|
||||
KeyGenParameters ::= OCTET STRING
|
||||
|
||||
id-regCtrl-oldCertID OBJECT IDENTIFIER ::= { id-regCtrl 5 }
|
||||
--with syntax:
|
||||
OldCertId ::= CertId
|
||||
|
||||
CertId ::= SEQUENCE {
|
||||
issuer GeneralName,
|
||||
serialNumber INTEGER }
|
||||
|
||||
id-regCtrl-protocolEncrKey OBJECT IDENTIFIER ::= { id-regCtrl 6 }
|
||||
--with syntax:
|
||||
ProtocolEncrKey ::= SubjectPublicKeyInfo
|
||||
|
||||
-- Registration Info in CRMF
|
||||
id-regInfo OBJECT IDENTIFIER ::= { id-pkip 2 }
|
||||
|
||||
id-regInfo-utf8Pairs OBJECT IDENTIFIER ::= { id-regInfo 1 }
|
||||
--with syntax
|
||||
UTF8Pairs ::= UTF8String
|
||||
|
||||
|
||||
id-regInfo-certReq OBJECT IDENTIFIER ::= { id-regInfo 2 }
|
||||
--with syntax
|
||||
CertReq ::= CertRequest
|
||||
|
||||
-- id-ct-encKeyWithID is a new content type used for CMS objects.
|
||||
-- it contains both a private key and an identifier for key escrow
|
||||
-- agents to check against recovery requestors.
|
||||
|
||||
id-ct-encKeyWithID OBJECT IDENTIFIER ::= {id-ct 21}
|
||||
|
||||
EncKeyWithID ::= SEQUENCE {
|
||||
privateKey PrivateKeyInfo,
|
||||
identifier CHOICE {
|
||||
string UTF8String,
|
||||
generalName GeneralName
|
||||
} OPTIONAL
|
||||
}
|
||||
|
||||
PrivateKeyInfo ::= SEQUENCE {
|
||||
version INTEGER,
|
||||
privateKeyAlgorithm AlgorithmIdentifier,
|
||||
privateKey OCTET STRING,
|
||||
attributes [0] IMPLICIT Attributes OPTIONAL
|
||||
}
|
||||
|
||||
Attributes ::= SET OF Attribute
|
||||
|
||||
END
|
||||
425
asn/rfc6402.asn
Normal file
425
asn/rfc6402.asn
Normal file
@ -0,0 +1,425 @@
|
||||
EnrollmentMessageSyntax-2011-v88
|
||||
{ iso(1) identified-organization(3) dod(6) internet(1)
|
||||
security(5) mechanisms(5) pkix(7) id-mod(0)
|
||||
id-mod-enrollMsgSyntax-2011-88(76) }
|
||||
|
||||
DEFINITIONS IMPLICIT TAGS ::=
|
||||
BEGIN
|
||||
|
||||
-- EXPORTS All --
|
||||
-- The types and values defined in this module are exported for use
|
||||
-- in the other ASN.1 modules. Other applications may use them for
|
||||
-- their own purposes.
|
||||
|
||||
-- fake imports
|
||||
|
||||
-- PKIX Part 1 - Implicit From [RFC5280]
|
||||
GeneralName ::= CHOICE { any ANY }
|
||||
CRLReason ::= INTEGER
|
||||
ReasonFlags ::= BIT STRING
|
||||
GeneralNames ::= ANY
|
||||
|
||||
-- PKIX Part 1 - Explicit From [RFC5280]
|
||||
AlgorithmIdentifier ::= ANY
|
||||
Extension ::= ANY
|
||||
Name ::= CHOICE { any ANY }
|
||||
CertificateSerialNumber ::= INTEGER
|
||||
|
||||
-- Cryptographic Message Syntax FROM [CMS]
|
||||
ContentInfo ::= ANY
|
||||
Attribute ::= ANY
|
||||
IssuerAndSerialNumber ::= ANY
|
||||
|
||||
-- CRMF FROM [RFC4211]
|
||||
CertReqMsg ::= ANY
|
||||
PKIPublicationInfo ::= ANY
|
||||
CertTemplate ::= ANY
|
||||
|
||||
-- Global Types
|
||||
-- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
|
||||
-- The content of this type conforms to RFC 3629.
|
||||
|
||||
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
||||
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
|
||||
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
||||
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
||||
|
||||
id-cmc OBJECT IDENTIFIER ::= {id-pkix 7} -- CMC controls
|
||||
id-cct OBJECT IDENTIFIER ::= {id-pkix 12} -- CMC content types
|
||||
|
||||
-- The following controls have the type OCTET STRING
|
||||
|
||||
id-cmc-identityProof OBJECT IDENTIFIER ::= {id-cmc 3}
|
||||
id-cmc-dataReturn OBJECT IDENTIFIER ::= {id-cmc 4}
|
||||
id-cmc-regInfo OBJECT IDENTIFIER ::= {id-cmc 18}
|
||||
id-cmc-responseInfo OBJECT IDENTIFIER ::= {id-cmc 19}
|
||||
id-cmc-queryPending OBJECT IDENTIFIER ::= {id-cmc 21}
|
||||
id-cmc-popLinkRandom OBJECT IDENTIFIER ::= {id-cmc 22}
|
||||
id-cmc-popLinkWitness OBJECT IDENTIFIER ::= {id-cmc 23}
|
||||
|
||||
-- The following controls have the type UTF8String
|
||||
|
||||
id-cmc-identification OBJECT IDENTIFIER ::= {id-cmc 2}
|
||||
|
||||
-- The following controls have the type INTEGER
|
||||
|
||||
id-cmc-transactionId OBJECT IDENTIFIER ::= {id-cmc 5}
|
||||
|
||||
-- The following controls have the type OCTET STRING
|
||||
|
||||
id-cmc-senderNonce OBJECT IDENTIFIER ::= {id-cmc 6}
|
||||
id-cmc-recipientNonce OBJECT IDENTIFIER ::= {id-cmc 7}
|
||||
|
||||
-- This is the content type used for a request message
|
||||
-- in the protocol
|
||||
|
||||
id-cct-PKIData OBJECT IDENTIFIER ::= { id-cct 2 }
|
||||
|
||||
PKIData ::= SEQUENCE {
|
||||
controlSequence SEQUENCE SIZE(0..MAX) OF TaggedAttribute,
|
||||
reqSequence SEQUENCE SIZE(0..MAX) OF TaggedRequest,
|
||||
cmsSequence SEQUENCE SIZE(0..MAX) OF TaggedContentInfo,
|
||||
otherMsgSequence SEQUENCE SIZE(0..MAX) OF OtherMsg
|
||||
}
|
||||
|
||||
bodyIdMax INTEGER ::= 4294967295
|
||||
|
||||
BodyPartID ::= INTEGER(0..bodyIdMax)
|
||||
|
||||
TaggedAttribute ::= SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
attrType OBJECT IDENTIFIER,
|
||||
attrValues SET OF AttributeValue
|
||||
}
|
||||
|
||||
AttributeValue ::= ANY
|
||||
|
||||
TaggedRequest ::= CHOICE {
|
||||
tcr [0] TaggedCertificationRequest,
|
||||
crm [1] CertReqMsg,
|
||||
orm [2] SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
requestMessageType OBJECT IDENTIFIER,
|
||||
requestMessageValue ANY DEFINED BY requestMessageType
|
||||
}
|
||||
}
|
||||
|
||||
TaggedCertificationRequest ::= SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
certificationRequest CertificationRequest
|
||||
}
|
||||
|
||||
CertificationRequest ::= SEQUENCE {
|
||||
certificationRequestInfo SEQUENCE {
|
||||
version INTEGER,
|
||||
subject Name,
|
||||
subjectPublicKeyInfo SEQUENCE {
|
||||
algorithm AlgorithmIdentifier,
|
||||
subjectPublicKey BIT STRING },
|
||||
attributes [0] IMPLICIT SET OF Attribute },
|
||||
signatureAlgorithm AlgorithmIdentifier,
|
||||
signature BIT STRING
|
||||
}
|
||||
|
||||
TaggedContentInfo ::= SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
contentInfo ContentInfo
|
||||
}
|
||||
|
||||
OtherMsg ::= SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
otherMsgType OBJECT IDENTIFIER,
|
||||
otherMsgValue ANY DEFINED BY otherMsgType }
|
||||
|
||||
-- This defines the response message in the protocol
|
||||
id-cct-PKIResponse OBJECT IDENTIFIER ::= { id-cct 3 }
|
||||
|
||||
|
||||
ResponseBody ::= PKIResponse
|
||||
|
||||
PKIResponse ::= SEQUENCE {
|
||||
controlSequence SEQUENCE SIZE(0..MAX) OF TaggedAttribute,
|
||||
cmsSequence SEQUENCE SIZE(0..MAX) OF TaggedContentInfo,
|
||||
otherMsgSequence SEQUENCE SIZE(0..MAX) OF OtherMsg
|
||||
|
||||
}
|
||||
|
||||
-- Used to return status state in a response
|
||||
|
||||
id-cmc-statusInfo OBJECT IDENTIFIER ::= {id-cmc 1}
|
||||
|
||||
CMCStatusInfo ::= SEQUENCE {
|
||||
cMCStatus CMCStatus,
|
||||
bodyList SEQUENCE SIZE (1..MAX) OF BodyPartID,
|
||||
statusString UTF8String OPTIONAL,
|
||||
otherInfo CHOICE {
|
||||
failInfo CMCFailInfo,
|
||||
pendInfo PendInfo } OPTIONAL
|
||||
}
|
||||
|
||||
PendInfo ::= SEQUENCE {
|
||||
pendToken OCTET STRING,
|
||||
pendTime GeneralizedTime
|
||||
}
|
||||
|
||||
CMCStatus ::= INTEGER {
|
||||
success (0),
|
||||
failed (2),
|
||||
pending (3),
|
||||
noSupport (4),
|
||||
confirmRequired (5),
|
||||
popRequired (6),
|
||||
partial (7)
|
||||
}
|
||||
|
||||
|
||||
-- Note:
|
||||
-- The spelling of unsupportedExt is corrected in this version.
|
||||
-- In RFC 2797, it was unsuportedExt.
|
||||
|
||||
CMCFailInfo ::= INTEGER {
|
||||
badAlg (0),
|
||||
badMessageCheck (1),
|
||||
badRequest (2),
|
||||
badTime (3),
|
||||
badCertId (4),
|
||||
unsupportedExt (5),
|
||||
mustArchiveKeys (6),
|
||||
badIdentity (7),
|
||||
popRequired (8),
|
||||
popFailed (9),
|
||||
noKeyReuse (10),
|
||||
internalCAError (11),
|
||||
tryLater (12),
|
||||
authDataFail (13)
|
||||
}
|
||||
|
||||
-- Used for RAs to add extensions to certification requests
|
||||
id-cmc-addExtensions OBJECT IDENTIFIER ::= {id-cmc 8}
|
||||
|
||||
AddExtensions ::= SEQUENCE {
|
||||
pkiDataReference BodyPartID,
|
||||
certReferences SEQUENCE OF BodyPartID,
|
||||
extensions SEQUENCE OF Extension
|
||||
}
|
||||
|
||||
|
||||
id-cmc-encryptedPOP OBJECT IDENTIFIER ::= {id-cmc 9}
|
||||
id-cmc-decryptedPOP OBJECT IDENTIFIER ::= {id-cmc 10}
|
||||
|
||||
EncryptedPOP ::= SEQUENCE {
|
||||
request TaggedRequest,
|
||||
cms ContentInfo,
|
||||
thePOPAlgID AlgorithmIdentifier,
|
||||
witnessAlgID AlgorithmIdentifier,
|
||||
witness OCTET STRING
|
||||
}
|
||||
|
||||
DecryptedPOP ::= SEQUENCE {
|
||||
bodyPartID BodyPartID,
|
||||
thePOPAlgID AlgorithmIdentifier,
|
||||
thePOP OCTET STRING
|
||||
}
|
||||
|
||||
id-cmc-lraPOPWitness OBJECT IDENTIFIER ::= {id-cmc 11}
|
||||
|
||||
LraPopWitness ::= SEQUENCE {
|
||||
pkiDataBodyid BodyPartID,
|
||||
bodyIds SEQUENCE OF BodyPartID
|
||||
}
|
||||
|
||||
--
|
||||
id-cmc-getCert OBJECT IDENTIFIER ::= {id-cmc 15}
|
||||
|
||||
GetCert ::= SEQUENCE {
|
||||
issuerName GeneralName,
|
||||
serialNumber INTEGER }
|
||||
|
||||
id-cmc-getCRL OBJECT IDENTIFIER ::= {id-cmc 16}
|
||||
|
||||
GetCRL ::= SEQUENCE {
|
||||
issuerName Name,
|
||||
cRLName GeneralName OPTIONAL,
|
||||
time GeneralizedTime OPTIONAL,
|
||||
reasons ReasonFlags OPTIONAL }
|
||||
|
||||
id-cmc-revokeRequest OBJECT IDENTIFIER ::= {id-cmc 17}
|
||||
|
||||
RevokeRequest ::= SEQUENCE {
|
||||
issuerName Name,
|
||||
serialNumber INTEGER,
|
||||
reason CRLReason,
|
||||
invalidityDate GeneralizedTime OPTIONAL,
|
||||
passphrase OCTET STRING OPTIONAL,
|
||||
comment UTF8String OPTIONAL }
|
||||
|
||||
id-cmc-confirmCertAcceptance OBJECT IDENTIFIER ::= {id-cmc 24}
|
||||
|
||||
CMCCertId ::= IssuerAndSerialNumber
|
||||
|
||||
-- The following is used to request V3 extensions be added to a
|
||||
-- certificate
|
||||
|
||||
id-ExtensionReq OBJECT IDENTIFIER ::= {iso(1) member-body(2)
|
||||
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 14}
|
||||
|
||||
ExtensionReq ::= SEQUENCE SIZE (1..MAX) OF Extension
|
||||
|
||||
-- The following exists to allow Diffie-Hellman Certification
|
||||
-- Request Messages to be well-formed
|
||||
|
||||
id-alg-noSignature OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 2}
|
||||
|
||||
NoSignatureValue ::= OCTET STRING
|
||||
|
||||
-- Unauthenticated attribute to carry removable data.
|
||||
-- This could be used in an update of "CMC Extensions: Server
|
||||
-- Side Key Generation and Key Escrow" (February 2005) and in
|
||||
-- other documents.
|
||||
|
||||
id-aa OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
||||
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2)}
|
||||
id-aa-cmc-unsignedData OBJECT IDENTIFIER ::= {id-aa 34}
|
||||
|
||||
CMCUnsignedData ::= SEQUENCE {
|
||||
bodyPartPath BodyPartPath,
|
||||
identifier OBJECT IDENTIFIER,
|
||||
content ANY DEFINED BY identifier
|
||||
}
|
||||
|
||||
-- Replaces CMC Status Info
|
||||
--
|
||||
|
||||
id-cmc-statusInfoV2 OBJECT IDENTIFIER ::= {id-cmc 25}
|
||||
|
||||
CMCStatusInfoV2 ::= SEQUENCE {
|
||||
cMCStatus CMCStatus,
|
||||
bodyList SEQUENCE SIZE (1..MAX) OF
|
||||
BodyPartReference,
|
||||
statusString UTF8String OPTIONAL,
|
||||
otherInfo CHOICE {
|
||||
failInfo CMCFailInfo,
|
||||
pendInfo PendInfo,
|
||||
extendedFailInfo SEQUENCE {
|
||||
failInfoOID OBJECT IDENTIFIER,
|
||||
failInfoValue AttributeValue
|
||||
}
|
||||
} OPTIONAL
|
||||
}
|
||||
|
||||
BodyPartReference ::= CHOICE {
|
||||
bodyPartID BodyPartID,
|
||||
bodyPartPath BodyPartPath
|
||||
}
|
||||
|
||||
BodyPartPath ::= SEQUENCE SIZE (1..MAX) OF BodyPartID
|
||||
|
||||
-- Allow for distribution of trust anchors
|
||||
--
|
||||
|
||||
id-cmc-trustedAnchors OBJECT IDENTIFIER ::= {id-cmc 26}
|
||||
|
||||
PublishTrustAnchors ::= SEQUENCE {
|
||||
seqNumber INTEGER,
|
||||
hashAlgorithm AlgorithmIdentifier,
|
||||
anchorHashes SEQUENCE OF OCTET STRING
|
||||
}
|
||||
|
||||
id-cmc-authData OBJECT IDENTIFIER ::= {id-cmc 27}
|
||||
|
||||
AuthPublish ::= BodyPartID
|
||||
|
||||
-- These two items use BodyPartList
|
||||
id-cmc-batchRequests OBJECT IDENTIFIER ::= {id-cmc 28}
|
||||
id-cmc-batchResponses OBJECT IDENTIFIER ::= {id-cmc 29}
|
||||
|
||||
BodyPartList ::= SEQUENCE SIZE (1..MAX) OF BodyPartID
|
||||
|
||||
--
|
||||
id-cmc-publishCert OBJECT IDENTIFIER ::= {id-cmc 30}
|
||||
|
||||
CMCPublicationInfo ::= SEQUENCE {
|
||||
hashAlg AlgorithmIdentifier,
|
||||
certHashes SEQUENCE OF OCTET STRING,
|
||||
pubInfo PKIPublicationInfo
|
||||
}
|
||||
|
||||
id-cmc-modCertTemplate OBJECT IDENTIFIER ::= {id-cmc 31}
|
||||
|
||||
ModCertTemplate ::= SEQUENCE {
|
||||
pkiDataReference BodyPartPath,
|
||||
certReferences BodyPartList,
|
||||
replace BOOLEAN DEFAULT TRUE,
|
||||
certTemplate CertTemplate
|
||||
}
|
||||
|
||||
-- Inform follow-on servers that one or more controls have already
|
||||
-- been processed
|
||||
|
||||
id-cmc-controlProcessed OBJECT IDENTIFIER ::= {id-cmc 32}
|
||||
|
||||
ControlsProcessed ::= SEQUENCE {
|
||||
bodyList SEQUENCE SIZE(1..MAX) OF BodyPartReference
|
||||
}
|
||||
|
||||
-- Identity Proof control w/ algorithm agility
|
||||
|
||||
id-cmc-identityProofV2 OBJECT IDENTIFIER ::= { id-cmc 34 }
|
||||
|
||||
|
||||
|
||||
IdentifyProofV2 ::= SEQUENCE {
|
||||
proofAlgID AlgorithmIdentifier,
|
||||
macAlgId AlgorithmIdentifier,
|
||||
witness OCTET STRING
|
||||
}
|
||||
|
||||
id-cmc-popLinkWitnessV2 OBJECT IDENTIFIER ::= { id-cmc 33 }
|
||||
PopLinkWitnessV2 ::= SEQUENCE {
|
||||
keyGenAlgorithm AlgorithmIdentifier,
|
||||
macAlgorithm AlgorithmIdentifier,
|
||||
witness OCTET STRING
|
||||
}
|
||||
|
||||
--
|
||||
|
||||
id-cmc-raIdentityWitness OBJECT IDENTIFIER ::= {id-cmc 35}
|
||||
|
||||
|
||||
--
|
||||
-- Allow for an End-Entity to request a change in name.
|
||||
-- This item is added to RegControlSet in CRMF.
|
||||
--
|
||||
|
||||
id-cmc-changeSubjectName OBJECT IDENTIFIER ::= {id-cmc 36}
|
||||
|
||||
ChangeSubjectName ::= SEQUENCE {
|
||||
subject Name OPTIONAL,
|
||||
subjectAlt GeneralNames OPTIONAL
|
||||
}
|
||||
-- (WITH COMPONENTS {..., subject PRESENT} |
|
||||
-- WITH COMPONENTS {..., subjectAlt PRESENT} )
|
||||
|
||||
--
|
||||
-- Embedded response from a third party for processing
|
||||
--
|
||||
|
||||
id-cmc-responseBody OBJECT IDENTIFIER ::= {id-cmc 37}
|
||||
|
||||
--
|
||||
-- Key purpose identifiers are in the Extended Key Usage extension
|
||||
--
|
||||
|
||||
id-kp-cmcCA OBJECT IDENTIFIER ::= { id-kp 27 }
|
||||
id-kp-cmcRA OBJECT IDENTIFIER ::= { id-kp 28 }
|
||||
id-kp-cmcArchive OBJECT IDENTIFIER ::= { id-kp 28 }
|
||||
|
||||
|
||||
|
||||
--
|
||||
-- Subject Information Access identifier
|
||||
--
|
||||
|
||||
id-ad-cmc OBJECT IDENTIFIER ::= { id-ad 12 }
|
||||
|
||||
END
|
||||
2
tox.ini
2
tox.ini
@ -45,5 +45,5 @@ commands = bandit -c bandit.yaml -r anchor -n5 -p anchor_conservative
|
||||
|
||||
[flake8]
|
||||
show-source = True
|
||||
exclude=.venv,.git,.tox,dist,doc,*openstack/common*,*lib/python*,*egg,build
|
||||
exclude=.venv,.git,.tox,dist,doc,*openstack/common*,*lib/python*,*egg,build,anchor/asn1/*py
|
||||
max-complexity=25
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user