PKIXAttributeCertificate-2009
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-attribute-cert-02(47)}
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
AttributeSet{}, Extensions{}, SecurityCategory{},
EXTENSION, ATTRIBUTE, SECURITY-CATEGORY
FROM PKIX-CommonTypes-2009
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57) }
AlgorithmIdentifier{}, SIGNATURE-ALGORITHM, DIGEST-ALGORITHM
FROM AlgorithmInformation-2009
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0)
id-mod-algorithmInformation-02(58)}
-- IMPORTed module OIDs MAY change if [PKIXPROF] changes
-- PKIX Certificate Extensions
CertificateSerialNumber, UniqueIdentifier, id-pkix, id-pe, id-kp,
id-ad, id-at, SIGNED{}, SignatureAlgorithms
FROM PKIX1Explicit-2009
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}
GeneralName, GeneralNames, id-ce, ext-AuthorityKeyIdentifier,
ext-AuthorityInfoAccess, ext-CRLDistributionPoints
FROM PKIX1Implicit-2009
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}
ContentInfo
FROM CryptographicMessageSyntax-2009
{ iso(1) member-body(2) us(840) rsadsi(113549)
pkcs(1) pkcs-9(9) smime(16) modules(0) id-mod-cms-2004-02(41) };
-- Define the set of extensions that can appear.
-- Some of these are imported from PKIX Cert
AttributeCertExtensions EXTENSION ::= {
ext-auditIdentity | ext-targetInformation |
ext-AuthorityKeyIdentifier | ext-AuthorityInfoAccess |
ext-CRLDistributionPoints | ext-noRevAvail | ext-ac-proxying |
ext-aaControls, ... }
ext-auditIdentity EXTENSION ::= { SYNTAX
OCTET STRING IDENTIFIED BY id-pe-ac-auditIdentity}
ext-targetInformation EXTENSION ::= { SYNTAX
Targets IDENTIFIED BY id-ce-targetInformation }
ext-noRevAvail EXTENSION ::= { SYNTAX
NULL IDENTIFIED BY id-ce-noRevAvail}
ext-ac-proxying EXTENSION ::= { SYNTAX
ProxyInfo IDENTIFIED BY id-pe-ac-proxying}
ext-aaControls EXTENSION ::= { SYNTAX
AAControls IDENTIFIED BY id-pe-aaControls}
-- Define the set of attributes used here
AttributesDefined ATTRIBUTE ::= { at-authenticationInfo |
at-accesIdentity | at-chargingIdentity | at-group |
at-role | at-clearance | at-encAttrs, ...}
at-authenticationInfo ATTRIBUTE ::= { TYPE SvceAuthInfo
IDENTIFIED BY id-aca-authenticationInfo}
at-accesIdentity ATTRIBUTE ::= { TYPE SvceAuthInfo
IDENTIFIED BY id-aca-accessIdentity}
at-chargingIdentity ATTRIBUTE ::= { TYPE IetfAttrSyntax
IDENTIFIED BY id-aca-chargingIdentity}
at-group ATTRIBUTE ::= { TYPE IetfAttrSyntax
IDENTIFIED BY id-aca-group}
at-role ATTRIBUTE ::= { TYPE RoleSyntax
IDENTIFIED BY id-at-role}
at-clearance ATTRIBUTE ::= { TYPE Clearance
IDENTIFIED BY id-at-clearance}
at-clearance-RFC3281 ATTRIBUTE ::= {TYPE Clearance-rfc3281
IDENTIFIED BY id-at-clearance-rfc3281 }
at-encAttrs ATTRIBUTE ::= { TYPE ContentInfo
IDENTIFIED BY id-aca-encAttrs}
--
-- OIDs used by Attribute Certificate Extensions
--
id-pe-ac-auditIdentity OBJECT IDENTIFIER ::= { id-pe 4 }
id-pe-aaControls OBJECT IDENTIFIER ::= { id-pe 6 }
id-pe-ac-proxying OBJECT IDENTIFIER ::= { id-pe 10 }
id-ce-targetInformation OBJECT IDENTIFIER ::= { id-ce 55 }
id-ce-noRevAvail OBJECT IDENTIFIER ::= { id-ce 56 }
--
-- OIDs used by Attribute Certificate Attributes
--
id-aca OBJECT IDENTIFIER ::= { id-pkix 10 }
id-aca-authenticationInfo OBJECT IDENTIFIER ::= { id-aca 1 }
id-aca-accessIdentity OBJECT IDENTIFIER ::= { id-aca 2 }
id-aca-chargingIdentity OBJECT IDENTIFIER ::= { id-aca 3 }
id-aca-group OBJECT IDENTIFIER ::= { id-aca 4 }
-- { id-aca 5 } is reserved
id-aca-encAttrs OBJECT IDENTIFIER ::= { id-aca 6 }
id-at-role OBJECT IDENTIFIER ::= { id-at 72}
id-at-clearance OBJECT IDENTIFIER ::= {
joint-iso-ccitt(2) ds(5) attributeType(4) clearance (55) }
-- Uncomment the following declaration and comment the above line if
-- using the id-at-clearance attribute as defined in [RFC3281]
-- id-at-clearance ::= id-at-clearance-3281
id-at-clearance-rfc3281 OBJECT IDENTIFIER ::= {
joint-iso-ccitt(2) ds(5) module(1) selected-attribute-types(5)
clearance (55) }
--
-- The syntax of an Attribute Certificate
--
AttributeCertificate ::= SIGNED{AttributeCertificateInfo}
AttributeCertificateInfo ::= SEQUENCE {
version AttCertVersion, -- version is v2
holder Holder,
issuer AttCertIssuer,
signature AlgorithmIdentifier{SIGNATURE-ALGORITHM,
{SignatureAlgorithms}},
serialNumber CertificateSerialNumber,
attrCertValidityPeriod AttCertValidityPeriod,
attributes SEQUENCE OF
AttributeSet{{AttributesDefined}},
issuerUniqueID UniqueIdentifier OPTIONAL,
extensions Extensions{{AttributeCertExtensions}} OPTIONAL
}
AttCertVersion ::= INTEGER { v2(1) }
Holder ::= SEQUENCE {
baseCertificateID [0] IssuerSerial OPTIONAL,
-- the issuer and serial number of
-- the holder's Public Key Certificate
entityName [1] GeneralNames OPTIONAL,
-- the name of the claimant or role
objectDigestInfo [2] ObjectDigestInfo OPTIONAL
-- used to directly authenticate the
-- holder, for example, an executable
}
ObjectDigestInfo ::= SEQUENCE {
digestedObjectType ENUMERATED {
publicKey (0),
publicKeyCert (1),
otherObjectTypes (2) },
-- otherObjectTypes MUST NOT
-- be used in this profile
otherObjectTypeID OBJECT IDENTIFIER OPTIONAL,
digestAlgorithm AlgorithmIdentifier{DIGEST-ALGORITHM, {...}},
objectDigest BIT STRING
}
AttCertIssuer ::= CHOICE {
v1Form GeneralNames, -- MUST NOT be used in this
-- profile
v2Form [0] V2Form -- v2 only
}
V2Form ::= SEQUENCE {
issuerName GeneralNames OPTIONAL,
baseCertificateID [0] IssuerSerial OPTIONAL,
objectDigestInfo [1] ObjectDigestInfo OPTIONAL
-- issuerName MUST be present in this profile
-- baseCertificateID and objectDigestInfo MUST
-- NOT be present in this profile
}
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serial CertificateSerialNumber,
issuerUID UniqueIdentifier OPTIONAL
}
AttCertValidityPeriod ::= SEQUENCE {
notBeforeTime GeneralizedTime,
notAfterTime GeneralizedTime
}
--
-- Syntax used by Attribute Certificate Extensions
--
Targets ::= SEQUENCE OF Target
Target ::= CHOICE {
targetName [0] GeneralName,
targetGroup [1] GeneralName,
targetCert [2] TargetCert
}
TargetCert ::= SEQUENCE {
targetCertificate IssuerSerial,
targetName GeneralName OPTIONAL,
certDigestInfo ObjectDigestInfo OPTIONAL
}
AAControls ::= SEQUENCE {
pathLenConstraint INTEGER (0..MAX) OPTIONAL,
permittedAttrs [0] AttrSpec OPTIONAL,
excludedAttrs [1] AttrSpec OPTIONAL,
permitUnSpecified BOOLEAN DEFAULT TRUE
}
AttrSpec::= SEQUENCE OF OBJECT IDENTIFIER
ProxyInfo ::= SEQUENCE OF Targets
--
-- Syntax used by Attribute Certificate Attributes
--
IetfAttrSyntax ::= SEQUENCE {
policyAuthority[0] GeneralNames OPTIONAL,
values SEQUENCE OF CHOICE {
octets OCTET STRING,
oid OBJECT IDENTIFIER,
string UTF8String
}
}
SvceAuthInfo ::= SEQUENCE {
service GeneralName,
ident GeneralName,
authInfo OCTET STRING OPTIONAL
}
RoleSyntax ::= SEQUENCE {
roleAuthority [0] GeneralNames OPTIONAL,
roleName [1] GeneralName
}
Clearance ::= SEQUENCE {
policyId OBJECT IDENTIFIER,
classList ClassList DEFAULT {unclassified},
securityCategories SET OF SecurityCategory
{{SupportedSecurityCategories}} OPTIONAL
}
-- Uncomment the following lines to support deprecated clearance
-- syntax and comment out previous Clearance.
-- Clearance ::= Clearance-rfc3281
Clearance-rfc3281 ::= SEQUENCE {
policyId [0] OBJECT IDENTIFIER,
classList [1] ClassList DEFAULT {unclassified},
securityCategories [2] SET OF SecurityCategory-rfc3281
{{SupportedSecurityCategories}} OPTIONAL
}
ClassList ::= BIT STRING {
unmarked (0),
unclassified (1),
restricted (2),
confidential (3),
secret (4),
topSecret (5)
}
SupportedSecurityCategories SECURITY-CATEGORY ::= { ... }
SecurityCategory-rfc3281{SECURITY-CATEGORY:Supported} ::= SEQUENCE {
type [0] IMPLICIT SECURITY-CATEGORY.
&id({Supported}),
value [1] EXPLICIT SECURITY-CATEGORY.
&Type({Supported}{@type})
}
ACClearAttrs ::= SEQUENCE {
acIssuer GeneralName,
acSerial INTEGER,
attrs SEQUENCE OF AttributeSet{{AttributesDefined}}
}
END
