diff options
author | Anders Broman <anders.broman@ericsson.com> | 2008-08-31 21:00:06 +0000 |
---|---|---|
committer | Anders Broman <anders.broman@ericsson.com> | 2008-08-31 21:00:06 +0000 |
commit | 47d612ccc9f0738bafd291d7bbc13c690928a397 (patch) | |
tree | cd0a58a0666ef76d0421859b3815205101215076 /asn1/x509ce | |
parent | 48dbffeda48d0409fb4af332aadaf954b265db1c (diff) |
Update to X.509:08/2005.
svn path=/trunk/; revision=26105
Diffstat (limited to 'asn1/x509ce')
-rw-r--r-- | asn1/x509ce/CertificateExtensions.asn | 791 | ||||
-rw-r--r-- | asn1/x509ce/x509ce.cnf | 41 |
2 files changed, 485 insertions, 347 deletions
diff --git a/asn1/x509ce/CertificateExtensions.asn b/asn1/x509ce/CertificateExtensions.asn index 2f1a9bfe44..b9359a7cf1 100644 --- a/asn1/x509ce/CertificateExtensions.asn +++ b/asn1/x509ce/CertificateExtensions.asn @@ -1,6 +1,7 @@ --- Module CertificateExtensions (X.509:03/2000) +-- $Id:$ +-- Module CertificateExtensions (X.509:08/2005) CertificateExtensions {joint-iso-itu-t ds(5) module(1) - certificateExtensions(26) 4} DEFINITIONS IMPLICIT TAGS ::= + certificateExtensions(26) 5} DEFINITIONS IMPLICIT TAGS ::= BEGIN -- EXPORTS ALL @@ -8,19 +9,16 @@ IMPORTS id-at, id-ce, id-mr, informationFramework, authenticationFramework, selectedAttributeTypes, upperBounds FROM UsefulDefinitions {joint-iso-itu-t ds(5) module(1) - usefulDefinitions(0) 4} + usefulDefinitions(0) 5} Name, RelativeDistinguishedName, ATTRIBUTE, Attribute, MATCHING-RULE - FROM InformationFramework {joint-iso-itu-t ds(5) module(1) - informationFramework(1) 4} + FROM InformationFramework informationFramework CertificateSerialNumber, CertificateList, AlgorithmIdentifier, EXTENSION, Time, PolicyID - FROM AuthenticationFramework {joint-iso-itu-t ds(5) module(1) - authenticationFramework(7) 4} - DirectoryString - FROM SelectedAttributeTypes {joint-iso-itu-t ds(5) module(1) - selectedAttributeTypes(5) 4} + FROM AuthenticationFramework authenticationFramework + DirectoryString{} + FROM SelectedAttributeTypes selectedAttributeTypes ub-name - FROM UpperBounds {joint-iso-itu-t ds(5) module(1) upperBounds(10) 4} + FROM UpperBounds upperBounds ORAddress FROM MTSAbstractService {joint-iso-itu-t mhs(6) mts(3) modules(0) mts-abstract-service(1) version-1999(1)}; @@ -28,75 +26,75 @@ IMPORTS -- Unless explicitly noted otherwise, there is no significance to the ordering -- of components of a SEQUENCE OF construct in this Specification. -- public-key certificate and CRL extensions --- authorityKeyIdentifier EXTENSION ::= { --- SYNTAX AuthorityKeyIdentifier --- IDENTIFIED BY id-ce-authorityKeyIdentifier --- } +authorityKeyIdentifier EXTENSION ::= { + SYNTAX AuthorityKeyIdentifier + IDENTIFIED BY id-ce-authorityKeyIdentifier +} AuthorityKeyIdentifier ::= SEQUENCE { - keyIdentifier [0] IMPLICIT KeyIdentifier OPTIONAL, - authorityCertIssuer [1] IMPLICIT GeneralNames OPTIONAL, - authorityCertSerialNumber [2] IMPLICIT CertificateSerialNumber OPTIONAL -} --- (WITH COMPONENTS { --- ..., --- authorityCertIssuer PRESENT, --- authorityCertSerialNumber PRESENT --- } | --- WITH COMPONENTS { --- ..., --- authorityCertIssuer ABSENT, --- authorityCertSerialNumber ABSENT --- }) + keyIdentifier [0] KeyIdentifier OPTIONAL, + authorityCertIssuer [1] GeneralNames OPTIONAL, + authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL +} +(WITH COMPONENTS { + ..., + authorityCertIssuer PRESENT, + authorityCertSerialNumber PRESENT + } | + WITH COMPONENTS { + ..., + authorityCertIssuer ABSENT, + authorityCertSerialNumber ABSENT + }) KeyIdentifier ::= OCTET STRING --- subjectKeyIdentifier EXTENSION ::= { --- SYNTAX SubjectKeyIdentifier --- IDENTIFIED BY id-ce-subjectKeyIdentifier --- } +subjectKeyIdentifier EXTENSION ::= { + SYNTAX SubjectKeyIdentifier + IDENTIFIED BY id-ce-subjectKeyIdentifier +} SubjectKeyIdentifier ::= KeyIdentifier --- keyUsage EXTENSION ::= {SYNTAX KeyUsage --- IDENTIFIED BY id-ce-keyUsage --- } +keyUsage EXTENSION ::= {SYNTAX KeyUsage + IDENTIFIED BY id-ce-keyUsage +} KeyUsage ::= BIT STRING { - digitalSignature(0), nonRepudiation(1), keyEncipherment(2), + digitalSignature(0), contentCommitment(1), keyEncipherment(2), dataEncipherment(3), keyAgreement(4), keyCertSign(5), cRLSign(6), encipherOnly(7), decipherOnly(8)} --- extKeyUsage EXTENSION ::= { --- SYNTAX KeyPurposeIDs --- IDENTIFIED BY id-ce-extKeyUsage --- } - -KeyPurposeIDs ::= SEQUENCE OF KeyPurposeId +extKeyUsage EXTENSION ::= { + SYNTAX SEQUENCE SIZE (1..MAX) OF KeyPurposeId + IDENTIFIED BY id-ce-extKeyUsage +} KeyPurposeId ::= OBJECT IDENTIFIER --- privateKeyUsagePeriod EXTENSION ::= { --- SYNTAX PrivateKeyUsagePeriod --- IDENTIFIED BY id-ce-privateKeyUsagePeriod --- } +KeyPurposeIDs ::= SEQUENCE OF KeyPurposeId + +privateKeyUsagePeriod EXTENSION ::= { + SYNTAX PrivateKeyUsagePeriod + IDENTIFIED BY id-ce-privateKeyUsagePeriod +} PrivateKeyUsagePeriod ::= SEQUENCE { - notBefore [0] IMPLICIT GeneralizedTime OPTIONAL, - notAfter [1] IMPLICIT GeneralizedTime OPTIONAL -} --- (WITH COMPONENTS { --- ..., --- notBefore PRESENT --- } | WITH COMPONENTS { --- ..., --- notAfter PRESENT --- }) --- --- certificatePolicies EXTENSION ::= { --- SYNTAX CertificatePoliciesSyntax --- IDENTIFIED BY id-ce-certificatePolicies --- } + notBefore [0] GeneralizedTime OPTIONAL, + notAfter [1] GeneralizedTime OPTIONAL +} +(WITH COMPONENTS { + ..., + notBefore PRESENT + } | WITH COMPONENTS { + ..., + notAfter PRESENT + }) + +certificatePolicies EXTENSION ::= { + SYNTAX CertificatePoliciesSyntax + IDENTIFIED BY id-ce-certificatePolicies +} CertificatePoliciesSyntax ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation @@ -107,54 +105,52 @@ PolicyInformation ::= SEQUENCE { CertPolicyId ::= OBJECT IDENTIFIER -PolicyQualifierId ::= OBJECT IDENTIFIER +PolicyQualifierInfo ::= SEQUENCE { + policyQualifierId CERT-POLICY-QUALIFIER.&id({SupportedPolicyQualifiers}), + qualifier + CERT-POLICY-QUALIFIER.&Qualifier + ({SupportedPolicyQualifiers}{@policyQualifierId}) OPTIONAL +} -PolicyQualifierValue ::= ANY +SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= + {...} -PolicyQualifierInfo ::= SEQUENCE { - policyQualifierId PolicyQualifierId, - qualifier PolicyQualifierValue OPTIONAL -} - --- SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= --- {...} --- --- anyPolicy OBJECT IDENTIFIER ::= {2 5 29 32 0} --- --- CERT-POLICY-QUALIFIER ::= CLASS { --- &id OBJECT IDENTIFIER UNIQUE, --- &Qualifier OPTIONAL --- }WITH SYNTAX {POLICY-QUALIFIER-ID &id --- [QUALIFIER-TYPE &Qualifier] --- } --- --- policyMappings EXTENSION ::= { --- SYNTAX PolicyMappingsSyntax --- IDENTIFIED BY id-ce-policyMappings --- } +anyPolicy OBJECT IDENTIFIER ::= {2 5 29 32 0} + +CERT-POLICY-QUALIFIER ::= CLASS { + &id OBJECT IDENTIFIER UNIQUE, + &Qualifier OPTIONAL +}WITH SYNTAX {POLICY-QUALIFIER-ID &id + [QUALIFIER-TYPE &Qualifier] +} + +policyMappings EXTENSION ::= { + SYNTAX PolicyMappingsSyntax + IDENTIFIED BY id-ce-policyMappings +} PolicyMappingsSyntax ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {issuerDomainPolicy CertPolicyId, subjectDomainPolicy CertPolicyId} --- subjectAltName EXTENSION ::= { --- SYNTAX GeneralNames --- IDENTIFIED BY id-ce-subjectAltName --- } +subjectAltName EXTENSION ::= { + SYNTAX GeneralNames + IDENTIFIED BY id-ce-subjectAltName +} GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName GeneralName ::= CHOICE { - otherName [0] IMPLICIT --INSTANCE OF OTHER-NAME-- OtherName, - rfc822Name [1] IMPLICIT IA5String, - dNSName [2] IMPLICIT IA5String, - x400Address [3] IMPLICIT ORAddress, - directoryName [4] IMPLICIT Name, - ediPartyName [5] IMPLICIT EDIPartyName, - uniformResourceIdentifier [6] IMPLICIT IA5String, - iPAddress [7] IMPLICIT OCTET STRING, - registeredID [8] IMPLICIT OBJECT IDENTIFIER + otherName [0] -- INSTANCE OF OTHER-NAME-- OtherName, + rfc822Name [1] IA5String, + dNSName [2] IA5String, + x400Address [3] ORAddress, + directoryName [4] Name, + ediPartyName [5] EDIPartyName, + uniformResourceIdentifier [6] IA5String, + iPAddress [7] OCTET STRING, + registeredID [8] OBJECT IDENTIFIER } -- OTHER-NAME ::= TYPE-IDENTIFIER @@ -166,147 +162,146 @@ OtherName ::= SEQUENCE { OtherNameType ::= OBJECT IDENTIFIER OtherNameValue ::= ANY - + EDIPartyName ::= SEQUENCE { - nameAssigner [0] IMPLICIT DirectoryString OPTIONAL, - partyName [1] IMPLICIT DirectoryString + nameAssigner [0] DirectoryString{ub-name} OPTIONAL, + partyName [1] DirectoryString{ub-name} +} + +issuerAltName EXTENSION ::= { + SYNTAX GeneralNames + IDENTIFIED BY id-ce-issuerAltName } --- issuerAltName EXTENSION ::= { --- SYNTAX GeneralNames --- IDENTIFIED BY id-ce-issuerAltName --- } --- --- subjectDirectoryAttributes EXTENSION ::= { --- SYNTAX AttributesSyntax --- IDENTIFIED BY id-ce-subjectDirectoryAttributes --- } +subjectDirectoryAttributes EXTENSION ::= { + SYNTAX AttributesSyntax + IDENTIFIED BY id-ce-subjectDirectoryAttributes +} AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute --- basicConstraints EXTENSION ::= { --- SYNTAX BasicConstraintsSyntax --- IDENTIFIED BY id-ce-basicConstraints --- } +basicConstraints EXTENSION ::= { + SYNTAX BasicConstraintsSyntax + IDENTIFIED BY id-ce-basicConstraints +} BasicConstraintsSyntax ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, - pathLenConstraint INTEGER OPTIONAL + pathLenConstraint INTEGER(0..MAX) OPTIONAL } --- nameConstraints EXTENSION ::= { --- SYNTAX NameConstraintsSyntax --- IDENTIFIED BY id-ce-nameConstraints --- } +nameConstraints EXTENSION ::= { + SYNTAX NameConstraintsSyntax + IDENTIFIED BY id-ce-nameConstraints +} NameConstraintsSyntax ::= SEQUENCE { - permittedSubtrees [0] IMPLICIT GeneralSubtrees OPTIONAL, - excludedSubtrees [1] IMPLICIT GeneralSubtrees OPTIONAL -} + permittedSubtrees [0] GeneralSubtrees OPTIONAL, + excludedSubtrees [1] GeneralSubtrees OPTIONAL +}(-- ALL EXCEPT -- ({ --none; at least one component shall be present--})) -GeneralSubtrees ::= SEQUENCE OF GeneralSubtree +GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree GeneralSubtree ::= SEQUENCE { base GeneralName, - minimum [0] IMPLICIT BaseDistance DEFAULT 0, - maximum [1] IMPLICIT BaseDistance OPTIONAL + minimum [0] BaseDistance DEFAULT 0, + maximum [1] BaseDistance OPTIONAL } BaseDistance ::= INTEGER(0..MAX) --- policyConstraints EXTENSION ::= { --- SYNTAX PolicyConstraintsSyntax --- IDENTIFIED BY id-ce-policyConstraints --- } +policyConstraints EXTENSION ::= { + SYNTAX PolicyConstraintsSyntax + IDENTIFIED BY id-ce-policyConstraints +} PolicyConstraintsSyntax ::= SEQUENCE { - requireExplicitPolicy [0] IMPLICIT SkipCerts OPTIONAL, - inhibitPolicyMapping [1] IMPLICIT SkipCerts OPTIONAL + requireExplicitPolicy [0] SkipCerts OPTIONAL, + inhibitPolicyMapping [1] SkipCerts OPTIONAL } SkipCerts ::= INTEGER(0..MAX) --- cRLNumber EXTENSION ::= { --- SYNTAX CRLNumber --- IDENTIFIED BY id-ce-cRLNumber --- } +cRLNumber EXTENSION ::= { + SYNTAX CRLNumber + IDENTIFIED BY id-ce-cRLNumber +} CRLNumber ::= INTEGER(0..MAX) --- reasonCode EXTENSION ::= { --- SYNTAX CRLReason --- IDENTIFIED BY id-ce-reasonCode --- } +reasonCode EXTENSION ::= { + SYNTAX CRLReason + IDENTIFIED BY id-ce-reasonCode +} CRLReason ::= ENUMERATED { unspecified(0), keyCompromise(1), cACompromise(2), affiliationChanged(3), superseded(4), cessationOfOperation(5), certificateHold(6), removeFromCRL(8), privilegeWithdrawn(9), aaCompromise(10)} --- holdInstructionCode EXTENSION ::= { --- SYNTAX HoldInstruction --- IDENTIFIED BY id-ce-instructionCode --- } +holdInstructionCode EXTENSION ::= { + SYNTAX HoldInstruction + IDENTIFIED BY id-ce-instructionCode +} HoldInstruction ::= OBJECT IDENTIFIER --- invalidityDate EXTENSION ::= { --- SYNTAX GeneralizedTime --- IDENTIFIED BY id-ce-invalidityDate --- } --- --- crlScope EXTENSION ::= { --- SYNTAX CRLScopeSyntax --- IDENTIFIED BY id-ce-cRLScope --- } +invalidityDate EXTENSION ::= { + SYNTAX GeneralizedTime + IDENTIFIED BY id-ce-invalidityDate +} + +crlScope EXTENSION ::= { + SYNTAX CRLScopeSyntax + IDENTIFIED BY id-ce-cRLScope +} CRLScopeSyntax ::= SEQUENCE SIZE (1..MAX) OF PerAuthorityScope PerAuthorityScope ::= SEQUENCE { - authorityName [0] IMPLICIT GeneralName OPTIONAL, - distributionPoint [1] IMPLICIT DistributionPointName OPTIONAL, - onlyContains [2] IMPLICIT OnlyCertificateTypes OPTIONAL, - onlySomeReasons [4] IMPLICIT ReasonFlags OPTIONAL, - serialNumberRange [5] IMPLICIT NumberRange OPTIONAL, - subjectKeyIdRange [6] IMPLICIT NumberRange OPTIONAL, - nameSubtrees [7] IMPLICIT GeneralNames OPTIONAL, - baseRevocationInfo [9] IMPLICIT BaseRevocationInfo OPTIONAL + authorityName [0] GeneralName OPTIONAL, + distributionPoint [1] DistributionPointName OPTIONAL, + onlyContains [2] OnlyCertificateTypes OPTIONAL, + onlySomeReasons [4] ReasonFlags OPTIONAL, + serialNumberRange [5] NumberRange OPTIONAL, + subjectKeyIdRange [6] NumberRange OPTIONAL, + nameSubtrees [7] GeneralNames OPTIONAL, + baseRevocationInfo [9] BaseRevocationInfo OPTIONAL } -OnlyCertificateTypes ::= BIT STRING { - userPublicKey(0), cA(1), userAttribute(2), aA(3), sOAPublicKey(4)} +OnlyCertificateTypes ::= BIT STRING {user(0), authority(1), attribute(2)} NumberRange ::= SEQUENCE { - startingNumber [0] IMPLICIT INTEGER OPTIONAL, - endingNumber [1] IMPLICIT INTEGER OPTIONAL, + startingNumber [0] INTEGER OPTIONAL, + endingNumber [1] INTEGER OPTIONAL, modulus INTEGER OPTIONAL } BaseRevocationInfo ::= SEQUENCE { - cRLStreamIdentifier [0] IMPLICIT CRLStreamIdentifier OPTIONAL, - cRLNumber [1] IMPLICIT CRLNumber, - baseThisUpdate [2] IMPLICIT GeneralizedTime + cRLStreamIdentifier [0] CRLStreamIdentifier OPTIONAL, + cRLNumber [1] CRLNumber, + baseThisUpdate [2] GeneralizedTime } --- statusReferrals EXTENSION ::= { --- SYNTAX StatusReferrals --- IDENTIFIED BY id-ce-statusReferrals --- } +statusReferrals EXTENSION ::= { + SYNTAX StatusReferrals + IDENTIFIED BY id-ce-statusReferrals +} StatusReferrals ::= SEQUENCE SIZE (1..MAX) OF StatusReferral StatusReferral ::= CHOICE { - cRLReferral [0] IMPLICIT CRLReferral --- otherReferral [1] IMPLICIT INSTANCE OF OTHER-REFERRAL + cRLReferral [0] CRLReferral +-- otherReferral [1] INSTANCE OF OTHER-REFERRAL } CRLReferral ::= SEQUENCE { - issuer [0] IMPLICIT GeneralName OPTIONAL, - location [1] IMPLICIT GeneralName OPTIONAL, - deltaRefInfo [2] IMPLICIT DeltaRefInfo OPTIONAL, + issuer [0] GeneralName OPTIONAL, + location [1] GeneralName OPTIONAL, + deltaRefInfo [2] DeltaRefInfo OPTIONAL, cRLScope CRLScopeSyntax, - lastUpdate [3] IMPLICIT GeneralizedTime OPTIONAL, - lastChangedCRL [4] IMPLICIT GeneralizedTime OPTIONAL + lastUpdate [3] GeneralizedTime OPTIONAL, + lastChangedCRL [4] GeneralizedTime OPTIONAL } DeltaRefInfo ::= SEQUENCE { @@ -314,48 +309,48 @@ DeltaRefInfo ::= SEQUENCE { lastDelta GeneralizedTime OPTIONAL } --- OTHER-REFERRAL ::= TYPE-IDENTIFIER --- --- cRLStreamIdentifier EXTENSION ::= { --- SYNTAX CRLStreamIdentifier --- IDENTIFIED BY id-ce-cRLStreamIdentifier --- } +--OTHER-REFERRAL ::= TYPE-IDENTIFIER +-- +cRLStreamIdentifier EXTENSION ::= { + SYNTAX CRLStreamIdentifier + IDENTIFIED BY id-ce-cRLStreamIdentifier +} CRLStreamIdentifier ::= INTEGER(0..MAX) --- orderedList EXTENSION ::= { --- SYNTAX OrderedListSyntax --- IDENTIFIED BY id-ce-orderedList --- } +orderedList EXTENSION ::= { + SYNTAX OrderedListSyntax + IDENTIFIED BY id-ce-orderedList +} OrderedListSyntax ::= ENUMERATED {ascSerialNum(0), ascRevDate(1)} --- deltaInfo EXTENSION ::= { --- SYNTAX DeltaInformation --- IDENTIFIED BY id-ce-deltaInfo --- } +deltaInfo EXTENSION ::= { + SYNTAX DeltaInformation + IDENTIFIED BY id-ce-deltaInfo +} DeltaInformation ::= SEQUENCE { deltaLocation GeneralName, nextDelta GeneralizedTime OPTIONAL } --- cRLDistributionPoints EXTENSION ::= { --- SYNTAX CRLDistPointsSyntax --- IDENTIFIED BY id-ce-cRLDistributionPoints --- } +cRLDistributionPoints EXTENSION ::= { + SYNTAX CRLDistPointsSyntax + IDENTIFIED BY id-ce-cRLDistributionPoints +} CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { - distributionPoint [0] IMPLICIT DistributionPointName OPTIONAL, - reasons [1] IMPLICIT ReasonFlags OPTIONAL, - cRLIssuer [2] IMPLICIT GeneralNames OPTIONAL + distributionPoint [0] DistributionPointName OPTIONAL, + reasons [1] ReasonFlags OPTIONAL, + cRLIssuer [2] GeneralNames OPTIONAL } DistributionPointName ::= CHOICE { - fullName [0] IMPLICIT GeneralNames, - nameRelativeToCRLIssuer [1] IMPLICIT RelativeDistinguishedName + fullName [0] GeneralNames, + nameRelativeToCRLIssuer [1] RelativeDistinguishedName } ReasonFlags ::= BIT STRING { @@ -363,82 +358,150 @@ ReasonFlags ::= BIT STRING { superseded(4), cessationOfOperation(5), certificateHold(6), privilegeWithdrawn(7), aACompromise(8)} --- issuingDistributionPoint EXTENSION ::= { --- SYNTAX IssuingDistPointSyntax --- IDENTIFIED BY id-ce-issuingDistributionPoint --- } +issuingDistributionPoint EXTENSION ::= { + SYNTAX IssuingDistPointSyntax + IDENTIFIED BY id-ce-issuingDistributionPoint +} IssuingDistPointSyntax ::= SEQUENCE { --- If containsUserPublicKeyCerts, containsCACerts, containsUserAttributeCerts, --- containsAACerts, and containsSOAPublicKeyCerts s are all absent, or not set to TRUE, (), --- the CRL covers allthese certificate types - distributionPoint [0] IMPLICIT DistributionPointName OPTIONAL, - containsUserPublicKeyCerts [1] IMPLICIT BOOLEAN DEFAULT FALSE, - containsCACerts [2] IMPLICIT BOOLEAN DEFAULT FALSE, - onlySomeReasons [3] IMPLICIT ReasonFlags OPTIONAL, - indirectCRL [4] IMPLICIT BOOLEAN DEFAULT FALSE, - containsUserAttributeCerts [5] IMPLICIT BOOLEAN DEFAULT FALSE, - containsAACerts [6] IMPLICIT BOOLEAN DEFAULT FALSE, - containsSOAPublicKeyCerts [7] IMPLICIT BOOLEAN DEFAULT FALSE -} - --- certificateIssuer EXTENSION ::= { --- SYNTAX GeneralNames --- IDENTIFIED BY id-ce-certificateIssuer --- } --- --- deltaCRLIndicator EXTENSION ::= { --- SYNTAX BaseCRLNumber --- IDENTIFIED BY id-ce-deltaCRLIndicator --- } + -- If onlyContainsUserPublicKeyCerts and onlyContainsCACerts are both FALSE, + -- the CRL covers both certificate types + distributionPoint [0] DistributionPointName OPTIONAL, + onlyContainsUserPublicKeyCerts [1] BOOLEAN DEFAULT FALSE, + onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE, + onlySomeReasons [3] ReasonFlags OPTIONAL, + indirectCRL [4] BOOLEAN DEFAULT FALSE +} + +certificateIssuer EXTENSION ::= { + SYNTAX GeneralNames + IDENTIFIED BY id-ce-certificateIssuer +} + +deltaCRLIndicator EXTENSION ::= { + SYNTAX BaseCRLNumber + IDENTIFIED BY id-ce-deltaCRLIndicator +} BaseCRLNumber ::= CRLNumber --- baseUpdateTime EXTENSION ::= { --- SYNTAX GeneralizedTime --- IDENTIFIED BY id-ce-baseUpdateTime --- } --- --- freshestCRL EXTENSION ::= { --- SYNTAX CRLDistPointsSyntax --- IDENTIFIED BY id-ce-freshestCRL --- } --- --- inhibitAnyPolicy EXTENSION ::= { --- SYNTAX SkipCerts --- IDENTIFIED BY id-ce-inhibitAnyPolicy --- } --- +toBeRevoked EXTENSION ::= { + SYNTAX ToBeRevokedSyntax + IDENTIFIED BY id-ce-toBeRevoked +} + +ToBeRevokedSyntax ::= SEQUENCE SIZE (1..MAX) OF ToBeRevokedGroup + +ToBeRevokedGroup ::= SEQUENCE { + certificateIssuer [0] GeneralName OPTIONAL, + reasonInfo [1] ReasonInfo OPTIONAL, + revocationTime GeneralizedTime, + certificateGroup CertificateGroup +} + +ReasonInfo ::= SEQUENCE { + reasonCode CRLReason, + holdInstructionCode HoldInstruction OPTIONAL +} + +CertificateGroup ::= CHOICE { + serialNumbers [0] CertificateSerialNumbers, + serialNumberRange [1] CertificateGroupNumberRange, + nameSubtree [2] GeneralName +} + +CertificateGroupNumberRange ::= SEQUENCE { + startingNumber [0] INTEGER, + endingNumber [1] INTEGER +} + +CertificateSerialNumbers ::= SEQUENCE SIZE (1..MAX) OF CertificateSerialNumber + +revokedGroups EXTENSION ::= { + SYNTAX RevokedGroupsSyntax + IDENTIFIED BY id-ce-RevokedGroups +} + +RevokedGroupsSyntax ::= SEQUENCE SIZE (1..MAX) OF RevokedGroup + +RevokedGroup ::= SEQUENCE { + certificateIssuer [0] GeneralName OPTIONAL, + reasonInfo [1] ReasonInfo OPTIONAL, + invalidityDate [2] GeneralizedTime OPTIONAL, + revokedcertificateGroup [3] RevokedCertificateGroup +} + +RevokedCertificateGroup ::= CHOICE { + serialNumberRange NumberRange, + nameSubtree GeneralName +} + +expiredCertsOnCRL EXTENSION ::= { + SYNTAX ExpiredCertsOnCRL + IDENTIFIED BY id-ce-expiredCertsOnCRL +} + +ExpiredCertsOnCRL ::= GeneralizedTime + +baseUpdateTime EXTENSION ::= { + SYNTAX GeneralizedTime + IDENTIFIED BY id-ce-baseUpdateTime +} + +freshestCRL EXTENSION ::= { + SYNTAX CRLDistPointsSyntax + IDENTIFIED BY id-ce-freshestCRL +} + +aAissuingDistributionPoint EXTENSION ::= { + SYNTAX AAIssuingDistPointSyntax + IDENTIFIED BY id-ce-aAissuingDistributionPoint +} + +AAIssuingDistPointSyntax ::= SEQUENCE { + distributionPoint [0] DistributionPointName OPTIONAL, + onlySomeReasons [1] ReasonFlags OPTIONAL, + indirectCRL [2] BOOLEAN DEFAULT FALSE, + containsUserAttributeCerts [3] BOOLEAN DEFAULT TRUE, + containsAACerts [4] BOOLEAN DEFAULT TRUE, + containsSOAPublicKeyCerts [5] BOOLEAN DEFAULT TRUE +} + +inhibitAnyPolicy EXTENSION ::= { + SYNTAX SkipCerts + IDENTIFIED BY id-ce-inhibitAnyPolicy +} + -- PKI matching rules --- certificateExactMatch MATCHING-RULE ::= { --- SYNTAX CertificateExactAssertion --- ID id-mr-certificateExactMatch --- } +certificateExactMatch MATCHING-RULE ::= { + SYNTAX CertificateExactAssertion + ID id-mr-certificateExactMatch +} CertificateExactAssertion ::= SEQUENCE { serialNumber CertificateSerialNumber, issuer Name } --- certificateMatch MATCHING-RULE ::= { --- SYNTAX CertificateAssertion --- ID id-mr-certificateMatch --- } +certificateMatch MATCHING-RULE ::= { + SYNTAX CertificateAssertion + ID id-mr-certificateMatch +} CertificateAssertion ::= SEQUENCE { - serialNumber [0] IMPLICIT CertificateSerialNumber OPTIONAL, - issuer [1] IMPLICIT Name OPTIONAL, - subjectKeyIdentifier [2] IMPLICIT SubjectKeyIdentifier OPTIONAL, - authorityKeyIdentifier [3] IMPLICIT AuthorityKeyIdentifier OPTIONAL, --- certificateValid [4] IMPLICIT Time OPTIONAL, - privateKeyValid [5] IMPLICIT GeneralizedTime OPTIONAL, - subjectPublicKeyAlgID [6] IMPLICIT OBJECT IDENTIFIER OPTIONAL, - keyUsage [7] IMPLICIT KeyUsage OPTIONAL, - subjectAltName [8] IMPLICIT AltNameType OPTIONAL, - policy [9] IMPLICIT CertPolicySet OPTIONAL, - pathToName [10] IMPLICIT Name OPTIONAL, - subject [11] IMPLICIT Name OPTIONAL, - nameConstraints [12] IMPLICIT NameConstraintsSyntax OPTIONAL + serialNumber [0] CertificateSerialNumber OPTIONAL, + issuer [1] Name OPTIONAL, + subjectKeyIdentifier [2] SubjectKeyIdentifier OPTIONAL, + authorityKeyIdentifier [3] AuthorityKeyIdentifier OPTIONAL, + certificateValid [4] Time OPTIONAL, + privateKeyValid [5] GeneralizedTime OPTIONAL, + subjectPublicKeyAlgID [6] OBJECT IDENTIFIER OPTIONAL, + keyUsage [7] KeyUsage OPTIONAL, + subjectAltName [8] AltNameType OPTIONAL, + policy [9] CertPolicySet OPTIONAL, + pathToName [10] Name OPTIONAL, + subject [11] Name OPTIONAL, + nameConstraints [12] NameConstraintsSyntax OPTIONAL } AltNameType ::= CHOICE { @@ -451,87 +514,114 @@ AltNameType ::= CHOICE { CertPolicySet ::= SEQUENCE SIZE (1..MAX) OF CertPolicyId --- certificatePairExactMatch MATCHING-RULE ::= { --- SYNTAX CertificatePairExactAssertion --- ID id-mr-certificatePairExactMatch --- } +certificatePairExactMatch MATCHING-RULE ::= { + SYNTAX CertificatePairExactAssertion + ID id-mr-certificatePairExactMatch +} CertificatePairExactAssertion ::= SEQUENCE { - issuedToThisCAAssertion [0] IMPLICIT CertificateExactAssertion OPTIONAL, - issuedByThisCAAssertion [1] IMPLICIT CertificateExactAssertion OPTIONAL -} --- (WITH COMPONENTS { --- ..., --- issuedToThisCAAssertion PRESENT --- } | WITH COMPONENTS { --- ..., --- issuedByThisCAAssertion PRESENT --- }) --- --- certificatePairMatch MATCHING-RULE ::= { --- SYNTAX CertificatePairAssertion --- ID id-mr-certificatePairMatch --- } + issuedToThisCAAssertion [0] CertificateExactAssertion OPTIONAL, + issuedByThisCAAssertion [1] CertificateExactAssertion OPTIONAL +} +(WITH COMPONENTS { + ..., + issuedToThisCAAssertion PRESENT + } | WITH COMPONENTS { + ..., + issuedByThisCAAssertion PRESENT + }) + +certificatePairMatch MATCHING-RULE ::= { + SYNTAX CertificatePairAssertion + ID id-mr-certificatePairMatch +} CertificatePairAssertion ::= SEQUENCE { - issuedToThisCAAssertion [0] IMPLICIT CertificateAssertion OPTIONAL, - issuedByThisCAAssertion [1] IMPLICIT CertificateAssertion OPTIONAL -} --- (WITH COMPONENTS { --- ..., --- issuedToThisCAAssertion PRESENT --- } | WITH COMPONENTS { --- ..., --- issuedByThisCAAssertion PRESENT --- }) --- --- certificateListExactMatch MATCHING-RULE ::= { --- SYNTAX CertificateListExactAssertion --- ID id-mr-certificateListExactMatch --- } + issuedToThisCAAssertion [0] CertificateAssertion OPTIONAL, + issuedByThisCAAssertion [1] CertificateAssertion OPTIONAL +} +(WITH COMPONENTS { + ..., + issuedToThisCAAssertion PRESENT + } | WITH COMPONENTS { + ..., + issuedByThisCAAssertion PRESENT + }) + +certificateListExactMatch MATCHING-RULE ::= { + SYNTAX CertificateListExactAssertion + ID id-mr-certificateListExactMatch +} CertificateListExactAssertion ::= SEQUENCE { issuer Name, --- thisUpdate Time, + thisUpdate Time, distributionPoint DistributionPointName OPTIONAL } --- certificateListMatch MATCHING-RULE ::= { --- SYNTAX CertificateListAssertion --- ID id-mr-certificateListMatch --- } +certificateListMatch MATCHING-RULE ::= { + SYNTAX CertificateListAssertion + ID id-mr-certificateListMatch +} CertificateListAssertion ::= SEQUENCE { issuer Name OPTIONAL, - minCRLNumber [0] IMPLICIT CRLNumber OPTIONAL, - maxCRLNumber [1] IMPLICIT CRLNumber OPTIONAL, + minCRLNumber [0] CRLNumber OPTIONAL, + maxCRLNumber [1] CRLNumber OPTIONAL, reasonFlags ReasonFlags OPTIONAL, --- dateAndTime Time OPTIONAL, - distributionPoint [2] IMPLICIT DistributionPointName OPTIONAL, - authorityKeyIdentifier [3] IMPLICIT AuthorityKeyIdentifier OPTIONAL -} - --- algorithmIdentifierMatch MATCHING-RULE ::= { --- SYNTAX AlgorithmIdentifier --- ID id-mr-algorithmIdentifierMatch --- } --- --- policyMatch MATCHING-RULE ::= {SYNTAX PolicyID --- ID id-mr-policyMatch --- } --- --- pkiPathMatch MATCHING-RULE ::= { --- SYNTAX PkiPathMatchSyntax --- ID id-mr-pkiPathMatch --- } + dateAndTime Time OPTIONAL, + distributionPoint [2] DistributionPointName OPTIONAL, + authorityKeyIdentifier [3] AuthorityKeyIdentifier OPTIONAL +} + +algorithmIdentifierMatch MATCHING-RULE ::= { + SYNTAX AlgorithmIdentifier + ID id-mr-algorithmIdentifierMatch +} + +policyMatch MATCHING-RULE ::= {SYNTAX PolicyID + ID id-mr-policyMatch +} + +pkiPathMatch MATCHING-RULE ::= { + SYNTAX PkiPathMatchSyntax + ID id-mr-pkiPathMatch +} PkiPathMatchSyntax ::= SEQUENCE {firstIssuer Name, lastSubject Name } +enhancedCertificateMatch MATCHING-RULE ::= { + SYNTAX EnhancedCertificateAssertion + ID id-mr-enhancedCertificateMatch +} + +EnhancedCertificateAssertion ::= SEQUENCE { + serialNumber [0] CertificateSerialNumber OPTIONAL, + issuer [1] Name OPTIONAL, + subjectKeyIdentifier [2] SubjectKeyIdentifier OPTIONAL, + authorityKeyIdentifier [3] AuthorityKeyIdentifier OPTIONAL, + certificateValid [4] Time OPTIONAL, + privateKeyValid [5] GeneralizedTime OPTIONAL, + subjectPublicKeyAlgID [6] OBJECT IDENTIFIER OPTIONAL, + keyUsage [7] KeyUsage OPTIONAL, + subjectAltName [8] AltName OPTIONAL, + policy [9] CertPolicySet OPTIONAL, + pathToName [10] GeneralNames OPTIONAL, + subject [11] Name OPTIONAL, + nameConstraints [12] NameConstraintsSyntax OPTIONAL +}(--ALL EXCEPT-- ({ -- none; at least one component shall be present --})) + +AltName ::= SEQUENCE { + altnameType AltNameType, + altNameValue GeneralName OPTIONAL +} + -- Object identifier assignments -id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= {id-ce 9} - +id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::= + {id-ce 9} + id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 14} id-ce-keyUsage OBJECT IDENTIFIER ::= {id-ce 15} @@ -567,8 +657,8 @@ id-ce-certificatePolicies OBJECT IDENTIFIER ::= {id-ce 32} id-ce-policyMappings OBJECT IDENTIFIER ::= {id-ce 33} -- deprecated OBJECT IDENTIFIER ::= {id-ce 34} - -id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 35} +id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= + {id-ce 35} id-ce-policyConstraints OBJECT IDENTIFIER ::= {id-ce 36} @@ -590,26 +680,36 @@ id-ce-deltaInfo OBJECT IDENTIFIER ::= {id-ce 53} id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= {id-ce 54} +id-ce-toBeRevoked OBJECT IDENTIFIER ::= {id-ce 58} + +id-ce-RevokedGroups OBJECT IDENTIFIER ::= {id-ce 59} + +id-ce-expiredCertsOnCRL OBJECT IDENTIFIER ::= {id-ce 60} + +id-ce-aAissuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 63} + -- matching rule OIDs --- id-mr-certificateExactMatch OBJECT IDENTIFIER ::= --- {id-mr 34} --- --- id-mr-certificateMatch OBJECT IDENTIFIER ::= {id-mr 35} --- --- id-mr-certificatePairExactMatch OBJECT IDENTIFIER ::= {id-mr 36} --- --- id-mr-certificatePairMatch OBJECT IDENTIFIER ::= {id-mr 37} --- --- id-mr-certificateListExactMatch OBJECT IDENTIFIER ::= {id-mr 38} --- --- id-mr-certificateListMatch OBJECT IDENTIFIER ::= {id-mr 39} --- --- id-mr-algorithmIdentifierMatch OBJECT IDENTIFIER ::= {id-mr 40} --- --- id-mr-policyMatch OBJECT IDENTIFIER ::= {id-mr 60} --- --- id-mr-pkiPathMatch OBJECT IDENTIFIER ::= {id-mr 62} --- +id-mr-certificateExactMatch OBJECT IDENTIFIER ::= + {id-mr 34} + +id-mr-certificateMatch OBJECT IDENTIFIER ::= {id-mr 35} + +id-mr-certificatePairExactMatch OBJECT IDENTIFIER ::= {id-mr 36} + +id-mr-certificatePairMatch OBJECT IDENTIFIER ::= {id-mr 37} + +id-mr-certificateListExactMatch OBJECT IDENTIFIER ::= {id-mr 38} + +id-mr-certificateListMatch OBJECT IDENTIFIER ::= {id-mr 39} + +id-mr-algorithmIdentifierMatch OBJECT IDENTIFIER ::= {id-mr 40} + +id-mr-policyMatch OBJECT IDENTIFIER ::= {id-mr 60} + +id-mr-pkiPathMatch OBJECT IDENTIFIER ::= {id-mr 62} + +id-mr-enhancedCertificateMatch OBJECT IDENTIFIER ::= {id-mr 65} + -- The following OBJECT IDENTIFIERS are not used by this Specification: -- {id-ce 2}, {id-ce 3}, {id-ce 4}, {id-ce 5}, {id-ce 6}, {id-ce 7}, -- {id-ce 8}, {id-ce 10}, {id-ce 11}, {id-ce 12}, {id-ce 13}, @@ -626,3 +726,4 @@ CertificateTemplate ::= SEQUENCE { END -- Generated by Asnp, the ASN.1 pretty-printer of France Telecom R&D + diff --git a/asn1/x509ce/x509ce.cnf b/asn1/x509ce/x509ce.cnf index 6006a97e05..b5680405c7 100644 --- a/asn1/x509ce/x509ce.cnf +++ b/asn1/x509ce/x509ce.cnf @@ -11,6 +11,32 @@ MTSAbstractService x411 #.IMPORT ../x509sat/x509sat-exp.cnf #.IMPORT ../x411/x411-exp.cnf +# Forward declaration +#.CLASS CERT-POLICY-QUALIFIER +&id ObjectIdentifierType +&Qualifier +#.END + +# InformationFramework classes +#.CLASS ATTRIBUTE +&derivation ClassReference ATTRIBUTE +&Type +&equality-match ClassReference MATCHING-RULE +&ordering-match ClassReference MATCHING-RULE +&substrings-match ClassReference MATCHING-RULE +&single-valued BooleanType +&collective BooleanType +&no-user-modification BooleanType +&usage +&id ObjectIdentifierType +#.END + +#.CLASS MATCHING-RULE +&ParentMatchingRules ClassReference MATCHING-RULE +&AssertionType +&uniqueMatchIndicator ClassReference ATTRIBUTE +&id ObjectIdentifierType +#.END #.EXPORTS AltNameType AttributesSyntax @@ -66,6 +92,7 @@ StatusReferrals SubjectKeyIdentifier #.REGISTER +PolicyInformationOld B "2.5.29.3" "id-ce-certificatePolicies(Depreciated)" AttributesSyntax B "2.5.29.9" "id-ce-subjectDirectoryAttributes" SubjectKeyIdentifier B "2.5.29.14" "id-ce-subjectKeyIdentifier" KeyUsage B "2.5.29.15" "id-ce-keyUsage" @@ -93,6 +120,16 @@ CRLDistPointsSyntax B "2.5.29.46" "id-ce-freshestCRL" OrderedListSyntax B "2.5.29.47" "id-ce-orderedList" DeltaInformation B "2.5.29.53" "id-ce-deltaInfo" SkipCerts B "2.5.29.54" "id-ce-inhibitAnyPolicy" +ToBeRevokedSyntax B "2.5.29.58" "id-ce-toBeRevoked" +RevokedGroupsSyntax B "2.5.29.59" "id-ce-RevokedGroups" +ExpiredCertsOnCRL B "2.5.29.60" "id-ce-expiredCertsOnCRL" +AAIssuingDistPointSyntax B "2.5.29.61" "id-ce-aAissuingDistributionPoint" + +# These are obsolete??? +# The following OBJECT IDENTIFIERS are not used by this Specification: +# {id-ce 2}, {id-ce 3}, {id-ce 4}, {id-ce 5}, {id-ce 6}, {id-ce 7}, +# {id-ce 8}, {id-ce 10}, {id-ce 11}, {id-ce 12}, {id-ce 13}, +# {id-ce 22}, {id-ce 25}, {id-ce 26} # Microsoft extensions CertificateTemplate B "1.3.6.1.4.1.311.21.7" "id-ms-certificate-template" @@ -107,10 +144,10 @@ CRLReferral/issuer crlr_issuer CertificatePairExactAssertion/issuedToThisCAAssertion cpea_issuedToThisCAAssertion CertificatePairExactAssertion/issuedByThisCAAssertion cpea_issuedByThisCAAssertion -#.FN_PARS PolicyQualifierId +#.FN_PARS PolicyQualifierInfo/policyQualifierId FN_VARIANT = _str HF_INDEX = hf_x509ce_object_identifier_id VAL_PTR = &object_identifier_id -#.FN_BODY PolicyQualifierValue +#.FN_BODY PolicyQualifierInfo/qualifier offset=call_ber_oid_callback(object_identifier_id, tvb, offset, actx->pinfo, tree); #.FN_BODY GeneralName/iPAddress |