public_key: Add PKCS-7

First attempt to add PKCS-7 does not compile

1 files changed, 869 insertions, 0 deletions

diff --git a/lib/public_key/asn1/PKCS-15.asn1 b/lib/public_key/asn1/PKCS-15.asn1
new file mode 100644
index 0000000000..6d352e1014
--- /dev/null
+++ b/lib/public_key/asn1/PKCS-15.asn1
@@ -0,0 +1,869 @@
+PKCS-15 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
+         pkcs-15(15) modules(1) pkcs-15(1)}
+
+-- $Revision: 1.7 $ --
+
+DEFINITIONS IMPLICIT TAGS ::=
+
+BEGIN
+
+IMPORTS
+
+informationFramework, authenticationFramework, certificateExtensions
+        FROM UsefulDefinitions {joint-iso-itu-t(2) ds(5) module(1)
+                                usefulDefinitions(0) 3}
+
+Name, Attribute
+        FROM InformationFramework informationFramework
+
+Certificate, AttributeCertificate, CertificateSerialNumber,
+        SubjectPublicKeyInfo
+        FROM AuthenticationFramework authenticationFramework
+
+GeneralNames, KeyUsage
+        FROM CertificateExtensions certificateExtensions
+
+RecipientInfos, RecipientInfo, OriginatorInfo, sha-1,
+	id-alg-CMS3DESwrap, id-alg-CMSRC2wrap, hMAC-SHA1, des-ede3-cbc
+	FROM CryptographicMessageSyntax {iso(1) member-body(2)
+	us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) modules(0)
+	cms(1)}
+
+RSAPublicKey
+	FROM PKCS-1 {iso(1) member-body(2) us(840) rsadsi(113549)
+	pkcs(1) pkcs-1(1) modules(0) pkcs-1(1)}
+
+AlgorithmIdentifier, SupportingAlgorithms, PBKDF2Algorithms,
+	ALGORITHM-IDENTIFIER, id-hmacWithSHA1
+	FROM PKCS-5 {iso(1) member-body(2) us(840) rsadsi(113549)
+	pkcs(1) pkcs-5(5) modules(16) pkcs-5(1)}
+
+ECPoint, Parameters
+        FROM ANSI-X9-62 {iso(1) member-body(2) us(840)
+        ansi-x962(10045) module(4) 1}
+
+DiffieHellmanPublicNumber, DomainParameters
+        FROM ANSI-X9-42 {iso(1) member-body(2) us(840)
+        ansi-x942(10046) module(5) 1}
+
+OOBCertHash
+        FROM PKIXCMP {iso(1) identified-organization(3) dod(6)
+        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
+        id-mod-cmp(9)};
+
+-- Constants
+
+pkcs15-ub-identifier          INTEGER ::= 255
+pkcs15-ub-reference           INTEGER ::= 255
+pkcs15-ub-index               INTEGER ::= 65535
+pkcs15-ub-label               INTEGER ::= pkcs15-ub-identifier
+pkcs15-lb-minPinLength        INTEGER ::= 4
+pkcs15-ub-minPinLength        INTEGER ::= 8
+pkcs15-ub-storedPinLength     INTEGER ::= 64
+pkcs15-ub-recordLength        INTEGER ::= 16383
+pkcs15-ub-userConsent         INTEGER ::= 15
+pkcs15-ub-securityConditions  INTEGER ::= 255
+pkcs15-ub-seInfo              INTEGER ::= 255
+
+-- Object Identifiers
+
+pkcs15 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
+                               rsadsi(113549) pkcs(1) pkcs-15(15)}
+pkcs15-mo OBJECT IDENTIFIER ::= {pkcs15 1} -- Modules branch
+pkcs15-at OBJECT IDENTIFIER ::= {pkcs15 2} -- Attribute branch
+pkcs15-ct OBJECT IDENTIFIER ::= {pkcs15 3} -- Content type branch
+
+-- Content Types
+
+pkcs15-ct-PKCS15Token OBJECT IDENTIFIER ::= {pkcs15-ct 1}
+
+-- Basic types
+
+Identifier ::= OCTET STRING (SIZE (0..pkcs15-ub-identifier))
+
+Reference ::= INTEGER (0..pkcs15-ub-reference)
+
+Label ::= UTF8String (SIZE(0..pkcs15-ub-label))
+
+KEY-IDENTIFIER ::= CLASS {
+    &id  INTEGER UNIQUE,
+    &Value
+} WITH SYNTAX {
+    SYNTAX &Value IDENTIFIED BY &id
+}
+
+CredentialIdentifier {KEY-IDENTIFIER : IdentifierSet} ::= SEQUENCE {
+    idType  KEY-IDENTIFIER.&id ({IdentifierSet}),
+    idValue KEY-IDENTIFIER.&Value ({IdentifierSet}{@idType})
+}
+
+KeyIdentifiers KEY-IDENTIFIER ::= {
+    issuerAndSerialNumber|
+    issuerAndSerialNumberHash|
+    subjectKeyId|
+    subjectKeyHash |
+    issuerKeyHash |
+    issuerNameHash |
+    subjectNameHash,
+    ...
+}
+
+issuerAndSerialNumber KEY-IDENTIFIER::=
+        {SYNTAX PKCS15-OPAQUE.&Type IDENTIFIED BY 1}
+        -- As defined in RFC 2630
+subjectKeyId KEY-IDENTIFIER ::=
+        {SYNTAX OCTET STRING IDENTIFIED BY 2}
+        -- From x509v3 certificate extension
+issuerAndSerialNumberHash KEY-IDENTIFIER ::=
+        {SYNTAX OCTET STRING IDENTIFIED BY 3}
+        -- Assumes SHA-1 hash of DER encoding of IssuerAndSerialNumber
+subjectKeyHash KEY-IDENTIFIER ::=
+        {SYNTAX OCTET STRING IDENTIFIED BY 4}
+issuerKeyHash KEY-IDENTIFIER ::=
+        {SYNTAX OCTET STRING IDENTIFIED BY 5}
+issuerNameHash KEY-IDENTIFIER ::=
+	{SYNTAX OCTET STRING IDENTIFIED BY 6}
+	-- SHA-1 hash of DER-encoded issuer name
+subjectNameHash KEY-IDENTIFIER ::=
+        {SYNTAX OCTET STRING IDENTIFIED BY 7}
+	-- SHA-1 hash of DER-encoded subject name
+
+ReferencedValue {Type} ::= CHOICE {
+    path	Path,
+    url		URL
+} (CONSTRAINED BY {-- 'path' or 'url' shall point to an object of
+   -- type -- Type})
+
+URL ::= CHOICE {
+    url		PrintableString,
+    urlWithDigest [3] SEQUENCE {
+	url	IA5String,
+	digest	DigestInfoWithDefault
+	}
+}
+
+alg-id-sha1 AlgorithmIdentifier {{DigestAlgorithms}} ::= {
+    algorithm  sha-1,
+    parameters SHA1Parameters : NULL}
+
+SHA1Parameters ::= NULL
+
+DigestInfoWithDefault ::= SEQUENCE {
+    digestAlg	AlgorithmIdentifier {{DigestAlgorithms}} DEFAULT alg-id-sha1,
+    digest	OCTET STRING (SIZE(8..128))
+}
+
+Path ::= SEQUENCE {
+    path 	OCTET STRING,
+    index  	INTEGER (0..pkcs15-ub-index) OPTIONAL,
+    length 	[0] INTEGER (0..pkcs15-ub-index) OPTIONAL
+    }( WITH COMPONENTS {..., index PRESENT, length PRESENT}|
+       WITH COMPONENTS {..., index ABSENT, length ABSENT})
+
+ObjectValue { Type } ::= CHOICE {
+    indirect 	        ReferencedValue {Type},
+    direct 	        [0] Type,
+    indirect-protected	[1] ReferencedValue {EnvelopedData {Type}},
+    direct-protected	[2] EnvelopedData {Type}
+    }(CONSTRAINED BY {-- if indirection is being used, then it is
+    -- expected that the reference points either to a (possibly
+    -- enveloped) object of type -- Type -- or (key case) to a card-
+    -- specific key file --})
+
+PathOrObjects {ObjectType} ::= CHOICE {
+    path  	Path,
+    objects  	[0] SEQUENCE OF ObjectType,
+    ...,
+    indirect-protected [1] ReferencedValue {EnvelopedData {SEQUENCE OF ObjectType}},
+    direct-protected [2] EnvelopedData {SEQUENCE OF ObjectType}
+    }
+
+CommonObjectAttributes ::= SEQUENCE {
+    label		Label OPTIONAL,
+    flags  		CommonObjectFlags OPTIONAL,
+    authId 		Identifier OPTIONAL,
+    ...,
+    userConsent 	INTEGER (1..pkcs15-ub-userConsent) OPTIONAL,
+    accessControlRules	SEQUENCE SIZE (1..MAX) OF AccessControlRule OPTIONAL
+} (CONSTRAINED BY {-- authId should be present in the IC card case if
+    -- flags.private is set. It must equal an authID in one AuthRecord
+    -- in the AODF -- })
+
+CommonObjectFlags ::= BIT STRING {
+    private	(0),
+    modifiable 	(1)
+}
+
+AccessControlRule ::= SEQUENCE {
+    accessMode		AccessMode,
+    securityCondition 	SecurityCondition,
+    ... -- For future extensions
+}
+
+AccessMode ::= BIT STRING {
+    read	(0),
+    update	(1),
+    execute	(2)
+}
+
+SecurityCondition ::= CHOICE {
+    authId	Identifier,
+    not    	[0] SecurityCondition,
+    and    	[1] SEQUENCE SIZE (2..pkcs15-ub-securityConditions)
+                OF SecurityCondition,
+    or     	[2] SEQUENCE SIZE (2..pkcs15-ub-securityConditions)
+                OF SecurityCondition,
+    ... -- For future extensions
+}
+
+CommonKeyAttributes ::= SEQUENCE {
+    iD 		 Identifier,
+    usage 	 KeyUsageFlags,
+    native	 BOOLEAN DEFAULT TRUE,
+    accessFlags	 KeyAccessFlags OPTIONAL,
+    keyReference Reference OPTIONAL,
+    startDate 	 GeneralizedTime OPTIONAL,
+    endDate  	 [0] GeneralizedTime OPTIONAL,
+    ... -- For future extensions
+}
+
+KeyUsageFlags ::= BIT STRING {
+    encrypt 			(0),
+    decrypt 			(1),
+    sign 			(2),
+    signRecover 		(3),
+    wrap 			(4),
+    unwrap 			(5),
+    verify 			(6),
+    verifyRecover  		(7),
+    derive 			(8),
+    nonRepudiation		(9)
+}
+
+KeyAccessFlags ::= BIT STRING {
+    sensitive  		(0),
+    extractable 	(1),
+    alwaysSensitive 	(2),
+    neverExtractable	(3),
+    local		(4)
+}
+
+CommonPrivateKeyAttributes ::= SEQUENCE {
+    subjectName	Name OPTIONAL,
+    keyIdentifiers 	[0] SEQUENCE OF CredentialIdentifier
+                        {{KeyIdentifiers}} OPTIONAL,
+    ... -- For future extensions
+}
+
+CommonPublicKeyAttributes ::= SEQUENCE {
+    subjectName	 Name OPTIONAL,
+    ...,
+    trustedUsage [0] Usage OPTIONAL
+}
+
+CommonSecretKeyAttributes ::= SEQUENCE {
+    keyLen	INTEGER OPTIONAL, -- keylength (in bits)
+    ... -- For future extensions
+}
+
+KeyInfo {ParameterType, OperationsType} ::= CHOICE {
+    reference		Reference,
+    paramsAndOps 	SEQUENCE {
+	parameters 		ParameterType,
+	supportedOperations 	OperationsType OPTIONAL
+	}
+}
+
+CommonCertificateAttributes ::= SEQUENCE {
+    iD 		Identifier,
+    authority	BOOLEAN DEFAULT FALSE,
+    identifier 	CredentialIdentifier {{KeyIdentifiers}} OPTIONAL,
+    certHash	[0] OOBCertHash OPTIONAL,
+    ...,
+    trustedUsage [1] Usage OPTIONAL,
+    identifiers	[2] SEQUENCE OF CredentialIdentifier{{KeyIdentifiers}} OPTIONAL,
+    implicitTrust [3] BOOLEAN DEFAULT FALSE
+}
+
+Usage ::= SEQUENCE {
+    keyUsage	KeyUsage OPTIONAL,
+    extKeyUsage	SEQUENCE SIZE (1..MAX) OF OBJECT IDENTIFIER OPTIONAL
+    }(WITH COMPONENTS {..., keyUsage PRESENT} |
+      WITH COMPONENTS {..., extKeyUsage PRESENT})
+
+CommonDataObjectAttributes ::= SEQUENCE {
+    applicationName	Label OPTIONAL,
+    applicationOID 	OBJECT IDENTIFIER OPTIONAL,
+    ... -- For future extensions
+    } (WITH COMPONENTS {..., applicationName PRESENT}|
+       WITH COMPONENTS {..., applicationOID PRESENT})
+
+CommonAuthenticationObjectAttributes ::= SEQUENCE {
+    authId Identifier,
+    ... -- For future extensions
+}
+
+PKCS15Object {ClassAttributes, SubClassAttributes, TypeAttributes}
+    ::= SEQUENCE {
+    commonObjectAttributes	CommonObjectAttributes,
+    classAttributes		ClassAttributes,
+    subClassAttributes 		[0] SubClassAttributes OPTIONAL,
+    typeAttributes		[1] TypeAttributes
+}
+
+PKCS15Objects ::= CHOICE {
+    privateKeys 	[0] PrivateKeys,
+    publicKeys 		[1] PublicKeys,
+    trustedPublicKeys  	[2] PublicKeys,
+    secretKeys 		[3] SecretKeys,
+    certificates	[4] Certificates,
+    trustedCertificates [5] Certificates,
+    usefulCertificates 	[6] Certificates,
+    dataObjects 	[7] DataObjects,
+    authObjects 	[8] AuthObjects,
+    ... -- For future extensions
+}
+
+PrivateKeys  ::= PathOrObjects {PrivateKeyType}
+
+SecretKeys   ::= PathOrObjects {SecretKeyType}
+
+PublicKeys   ::= PathOrObjects {PublicKeyType}
+
+Certificates ::= PathOrObjects {CertificateType}
+
+DataObjects  ::= PathOrObjects {DataType}
+
+AuthObjects  ::= PathOrObjects {AuthenticationType}
+
+PrivateKeyType ::= CHOICE {
+    privateRSAKey	PrivateKeyObject {PrivateRSAKeyAttributes},
+    privateECKey 	[0] PrivateKeyObject {PrivateECKeyAttributes},
+    privateDHKey 	[1] PrivateKeyObject {PrivateDHKeyAttributes},
+    privateDSAKey	[2] PrivateKeyObject {PrivateDSAKeyAttributes},
+    privateKEAKey	[3] PrivateKeyObject {PrivateKEAKeyAttributes},
+    ... -- For future extensions
+}
+
+PrivateKeyObject {KeyAttributes} ::= PKCS15Object {
+    CommonKeyAttributes, CommonPrivateKeyAttributes, KeyAttributes}
+
+PrivateRSAKeyAttributes ::= SEQUENCE {
+    value 		ObjectValue {RSAPrivateKeyObject},
+    modulusLength 	INTEGER, -- modulus length in bits, e.g. 1024
+    keyInfo  		KeyInfo {NULL, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+RSAPrivateKeyObject ::= SEQUENCE {
+    modulus 		[0] INTEGER OPTIONAL, -- n
+    publicExponent 	[1] INTEGER OPTIONAL, -- e
+    privateExponent 	[2] INTEGER OPTIONAL, -- d
+    prime1 		[3] INTEGER OPTIONAL, -- p
+    prime2 		[4] INTEGER OPTIONAL, -- q
+    exponent1  		[5] INTEGER OPTIONAL, -- d mod (p-1)
+    exponent2  		[6] INTEGER OPTIONAL, -- d mod (q-1)
+    coefficient 	[7] INTEGER OPTIONAL -- inv(q) mod p
+} (CONSTRAINED BY {-- must be possible to reconstruct modulus and
+   -- privateExponent from selected fields --})
+
+PrivateECKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {ECPrivateKey},
+    keyInfo 	KeyInfo {Parameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+ECPrivateKey ::= INTEGER
+
+PrivateDHKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {DHPrivateKey},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+DHPrivateKey ::= INTEGER -- Diffie-Hellman exponent
+
+PrivateDSAKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {DSAPrivateKey},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+DSAPrivateKey ::= INTEGER
+
+PrivateKEAKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {KEAPrivateKey},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+KEAPrivateKey ::= INTEGER
+
+PublicKeyType ::= CHOICE {
+    publicRSAKey 	PublicKeyObject {PublicRSAKeyAttributes},
+    publicECKey 	[0] PublicKeyObject {PublicECKeyAttributes},
+    publicDHKey 	[1] PublicKeyObject {PublicDHKeyAttributes},
+    publicDSAKey 	[2] PublicKeyObject {PublicDSAKeyAttributes},
+    publicKEAKey 	[3] PublicKeyObject {PublicKEAKeyAttributes},
+    ... -- For future extensions
+}
+
+PublicKeyObject {KeyAttributes} ::= PKCS15Object {
+    CommonKeyAttributes, CommonPublicKeyAttributes, KeyAttributes}
+
+PublicRSAKeyAttributes ::= SEQUENCE {
+    value		ObjectValue {RSAPublicKeyChoice},
+    modulusLength 	INTEGER, -- modulus length in bits, e.g. 1024
+    keyInfo		KeyInfo {NULL, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+RSAPublicKeyChoice ::= CHOICE {
+    raw	 RSAPublicKey,
+    spki [1] SubjectPublicKeyInfo, -- See X.509. Must contain a
+    -- public RSA key
+    ...
+}
+
+PublicECKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {ECPublicKeyChoice},
+    keyInfo 	KeyInfo {Parameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+ECPublicKeyChoice ::= CHOICE {
+    raw	 ECPoint,
+    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public EC key
+    ...
+}
+
+PublicDHKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {DHPublicKeyChoice},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+DHPublicKeyChoice ::= CHOICE {
+    raw	 DiffieHellmanPublicNumber,
+    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public D-H key
+    ...
+}
+
+PublicDSAKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {DSAPublicKeyChoice},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+DSAPublicKeyChoice ::= CHOICE {
+    raw	 INTEGER,
+    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public DSA key.
+    ...
+}
+
+PublicKEAKeyAttributes ::= SEQUENCE {
+    value  	ObjectValue {KEAPublicKeyChoice},
+    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
+    ... -- For future extensions
+}
+
+KEAPublicKeyChoice ::= CHOICE {
+    raw	 INTEGER,
+    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public KEA key
+    ...
+}
+
+SecretKeyType ::= CHOICE {
+    genericSecretKey	SecretKeyObject {GenericSecretKeyAttributes},
+    rc2key 		[0] SecretKeyObject {GenericSecretKeyAttributes},
+    rc4key 		[1] SecretKeyObject {GenericSecretKeyAttributes},
+    desKey 		[2] SecretKeyObject {GenericSecretKeyAttributes},
+    des2Key		[3] SecretKeyObject {GenericSecretKeyAttributes},
+    des3Key    	        [4] SecretKeyObject {GenericSecretKeyAttributes},
+    castKey 		[5] SecretKeyObject {GenericSecretKeyAttributes},
+    cast3Key 		[6] SecretKeyObject {GenericSecretKeyAttributes},
+    cast128Key  	[7] SecretKeyObject {GenericSecretKeyAttributes},
+    rc5Key  		[8] SecretKeyObject {GenericSecretKeyAttributes},
+    ideaKey 		[9] SecretKeyObject {GenericSecretKeyAttributes},
+    skipjackKey 	[10] SecretKeyObject {GenericSecretKeyAttributes},
+    batonKey		[11] SecretKeyObject {GenericSecretKeyAttributes},
+    juniperKey  	[12] SecretKeyObject {GenericSecretKeyAttributes},
+    rc6Key 		[13] SecretKeyObject {GenericSecretKeyAttributes},
+    otherKey		[14] OtherKey,
+... -- For future extensions
+}
+
+SecretKeyObject {KeyAttributes} ::= PKCS15Object {
+     CommonKeyAttributes, CommonSecretKeyAttributes, KeyAttributes}
+
+OtherKey ::= SEQUENCE {
+    keyType	OBJECT IDENTIFIER,
+    keyAttr	SecretKeyObject {GenericSecretKeyAttributes}
+}
+
+GenericSecretKeyAttributes ::= SEQUENCE {
+    value	ObjectValue { OCTET STRING },
+    ... -- For future extensions
+}
+
+CertificateType ::= CHOICE {
+    x509Certificate  	CertificateObject { X509CertificateAttributes},
+    x509AttributeCertificate [0] CertificateObject
+                        {X509AttributeCertificateAttributes},
+    spkiCertificate 	[1] CertificateObject {SPKICertificateAttributes},
+    pgpCertificate  	[2] CertificateObject {PGPCertificateAttributes},
+    wtlsCertificate 	[3] CertificateObject {WTLSCertificateAttributes},
+    x9-68Certificate 	[4] CertificateObject {X9-68CertificateAttributes},
+    ...,
+    cvCertificate	[5] CertificateObject {CVCertificateAttributes}
+}
+
+CertificateObject {CertAttributes} ::= PKCS15Object {
+    CommonCertificateAttributes, NULL, CertAttributes}
+
+X509CertificateAttributes ::= SEQUENCE {
+    value		ObjectValue { Certificate },
+    subject  		Name OPTIONAL,
+    issuer 		[0] Name OPTIONAL,
+    serialNumber 	CertificateSerialNumber OPTIONAL,
+    ... -- For future extensions
+}
+
+X509AttributeCertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { AttributeCertificate },
+    issuer	GeneralNames OPTIONAL,
+    serialNumber CertificateSerialNumber OPTIONAL,
+    attrTypes 	[0] SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,
+    ... -- For future extensions
+}
+
+SPKICertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { PKCS15-OPAQUE.&Type },
+    ... -- For future extensions
+}
+
+PGPCertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { PKCS15-OPAQUE.&Type },
+    ... -- For future extensions
+}
+
+WTLSCertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { PKCS15-OPAQUE.&Type },
+    ... -- For future extensions
+}
+
+X9-68CertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { PKCS15-OPAQUE.&Type },
+    ... -- For future extensions
+}
+CVCertificateAttributes ::= SEQUENCE {
+    value	ObjectValue { PKCS15-OPAQUE.&Type},
+    ... -- For future extensions
+}
+
+DataType ::= CHOICE {
+    opaqueDO	DataObject {Opaque},
+    externalIDO	[0] DataObject {ExternalIDO},
+    oidDO  	[1] DataObject {OidDO},
+    ... -- For future extensions
+}
+
+DataObject {DataObjectAttributes} ::= PKCS15Object {
+    CommonDataObjectAttributes, NULL, DataObjectAttributes}
+
+Opaque ::= ObjectValue {PKCS15-OPAQUE.&Type}
+
+ExternalIDO ::= ObjectValue {PKCS15-OPAQUE.&Type}
+    (CONSTRAINED BY {-- All data objects must be defined in
+    -- accordance with ISO/IEC 7816-6 --})
+
+OidDO ::= SEQUENCE {
+    id		OBJECT IDENTIFIER,
+    value 	ObjectValue {PKCS15-OPAQUE.&Type}
+}
+
+AuthenticationType ::= CHOICE {
+    pin	AuthenticationObject { PinAttributes },
+    ...,
+    biometricTemplate [0] AuthenticationObject {BiometricAttributes},
+    authKey  [1] AuthenticationObject {AuthKeyAttributes},
+    external [2] AuthenticationObject {ExternalAuthObjectAttributes}
+}
+
+AuthenticationObject {AuthObjectAttributes} ::= PKCS15Object {
+    CommonAuthenticationObjectAttributes, NULL, AuthObjectAttributes}
+
+PinAttributes ::= SEQUENCE {
+    pinFlags  	  PinFlags,
+    pinType  	  PinType,
+    minLength 	  INTEGER (pkcs15-lb-minPinLength..pkcs15-ub-minPinLength),
+    storedLength  INTEGER (0..pkcs15-ub-storedPinLength),
+    maxLength 	  INTEGER OPTIONAL,
+    pinReference  [0] Reference DEFAULT 0,
+    padChar  	  OCTET STRING (SIZE(1)) OPTIONAL,
+    lastPinChange GeneralizedTime OPTIONAL,
+    path 	  Path OPTIONAL,
+    ... -- For future extensions
+}
+
+PinFlags ::= BIT STRING {
+    case-sensitive		(0),
+    local 			(1),
+    change-disabled 		(2),
+    unblock-disabled 		(3),
+    initialized  		(4),
+    needs-padding 		(5),
+    unblockingPin 		(6),
+    soPin 			(7),
+    disable-allowed 		(8),
+    integrity-protected		(9),
+    confidentiality-protected	(10),
+    exchangeRefData		(11)
+} (CONSTRAINED BY { -- 'unblockingPin' and 'soPIN' cannot both be set -- })
+
+PinType ::= ENUMERATED {bcd, ascii-numeric, utf8, ...,
+    half-nibble-bcd, iso9564-1}
+
+BiometricAttributes ::= SEQUENCE {
+    bioFlags		BiometricFlags,
+    templateId		OBJECT IDENTIFIER,
+    bioType		BiometricType,
+    bioReference	Reference DEFAULT 0,
+    lastChange		GeneralizedTime OPTIONAL,
+    path		Path OPTIONAL,
+... -- For future extensions
+}
+
+BiometricFlags ::= BIT STRING {
+    local		(1),
+    change-disabled	(2),
+    unblock-disabled	(3),
+    initialized		(4),
+    disable-allowed	(8),
+    integrity-protected	(9),
+    confidentiality-protected	(10)
+    } -- Note: bits 0, 5, 6, and 7 are reserved for future use
+
+BiometricType ::= CHOICE {
+    fingerPrint		FingerPrint,
+    irisScan		[0] IrisScan,
+    -- Possible extensions:
+    -- voiceScan	VoiceScan,
+    -- faceScan		FaceScan,
+    -- retinaScan	Retinascan,
+    -- handGeometry	HandGeometry,
+    -- writeDynamics	WriteDynamics,
+    -- keyStrokeDynamicsKeyStrokeDynamics,
+    -- lipDynamics	LipDynamics,
+    ... -- For future extensions
+}
+
+FingerPrint ::= SEQUENCE {
+    hand	ENUMERATED {left, right},
+    finger	ENUMERATED {thumb, pointerFinger, middleFinger,
+                    ringFinger, littleFinger},
+    ...
+}
+
+IrisScan ::= SEQUENCE {
+    eye	ENUMERATED {left, right},
+    ...
+}
+
+ExternalAuthObjectAttributes ::= CHOICE {
+    authKeyAttributes	AuthKeyAttributes,
+    certBasedAttributes	[0] CertBasedAuthenticationAttributes,
+    ... -- For future extensions
+}
+
+AuthKeyAttributes ::= SEQUENCE {
+    derivedKey	BOOLEAN DEFAULT TRUE,
+    authKeyId	Identifier,
+    ... -- For future extensions
+}
+
+CertBasedAuthenticationAttributes ::= SEQUENCE {
+    cha	OCTET STRING,
+    ...
+}
+
+TokenInfo ::= SEQUENCE {
+    version		INTEGER {v1(0)} (v1,...),
+    serialNumber	OCTET STRING,
+    manufacturerID 	Label OPTIONAL,
+    label 		[0] Label OPTIONAL,
+    tokenflags 		TokenFlags,
+    seInfo 		SEQUENCE OF SecurityEnvironmentInfo OPTIONAL,
+    recordInfo 		[1] RecordInfo OPTIONAL,
+    supportedAlgorithms	[2] SEQUENCE OF AlgorithmInfo OPTIONAL,
+    ...,
+    issuerId		[3] Label OPTIONAL,
+    holderId		[4] Label OPTIONAL,
+    lastUpdate		[5] LastUpdate OPTIONAL,
+    preferredLanguage	PrintableString OPTIONAL -- In accordance with
+    -- IETF RFC 1766
+} (CONSTRAINED BY { -- Each AlgorithmInfo.reference value must be unique --})
+
+TokenFlags ::= BIT STRING {
+    readonly		(0),
+    loginRequired 	(1),
+    prnGeneration 	(2),
+    eidCompliant  	(3)
+}
+
+SecurityEnvironmentInfo ::= SEQUENCE {
+    se		INTEGER (0..pkcs15-ub-seInfo),
+    owner 	OBJECT IDENTIFIER,
+    ... -- For future extensions
+}
+
+RecordInfo ::= SEQUENCE {
+    oDFRecordLength  	[0] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    prKDFRecordLength 	[1] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    puKDFRecordLength	[2] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    sKDFRecordLength 	[3] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    cDFRecordLength  	[4] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    dODFRecordLength 	[5] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
+    aODFRecordLength 	[6] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL
+}
+
+AlgorithmInfo ::= SEQUENCE {
+    reference  	Reference,
+    algorithm  	PKCS15-ALGORITHM.&id({AlgorithmSet}),
+    parameters 	PKCS15-ALGORITHM.&Parameters({AlgorithmSet}{@algorithm}),
+    supportedOperations
+		PKCS15-ALGORITHM.&Operations({AlgorithmSet}{@algorithm}),
+    algId       PKCS15-ALGORITHM.&objectIdentifier({AlgorithmSet}{@algorithm})
+                    OPTIONAL,
+    algRef	Reference OPTIONAL
+}
+
+PKCS15-ALGORITHM ::= CLASS {
+        &id INTEGER UNIQUE,
+        &Parameters,
+        &Operations Operations,
+	&objectIdentifier OBJECT IDENTIFIER OPTIONAL
+} WITH SYNTAX {
+  PARAMETERS &Parameters OPERATIONS &Operations ID &id [OID &objectIdentifier]}
+
+PKCS15-OPAQUE ::= TYPE-IDENTIFIER
+
+PublicKeyOperations ::= Operations
+
+Operations ::= BIT STRING {
+        compute-checksum  (0), -- H/W computation of checksum
+        compute-signature (1), -- H/W computation of signature
+        verify-checksum   (2), -- H/W verification of checksum
+        verify-signature  (3), -- H/W verification of signature
+        encipher          (4), -- H/W encryption of data
+        decipher          (5), -- H/W decryption of data
+        hash              (6), -- H/W hashing
+        generate-key      (7)  -- H/W key generation
+        }
+
+pkcs15-alg-null      PKCS15-ALGORITHM ::= {
+        PARAMETERS NULL OPERATIONS {{generate-key}} ID -1}
+
+AlgorithmSet PKCS15-ALGORITHM ::= {
+        pkcs15-alg-null,
+        ... -- See PKCS #11 for values for the &id field (and parameters)
+        }
+
+LastUpdate ::= CHOICE {
+        generalizedTime GeneralizedTime,
+        referencedTime ReferencedValue {GeneralizedTime},
+	... -- For future extensions
+	}
+
+-- Soft token related types and objects
+
+EnvelopedData {Type} ::= SEQUENCE {
+    version		 INTEGER{v0(0),v1(1),v2(2),v3(3),v4(4)}(v0|v1|v2,...),
+    originatorInfo	 [0] OriginatorInfo OPTIONAL,
+    recipientInfos 	 RecipientInfos,
+    encryptedContentInfo EncryptedContentInfo{Type},
+    unprotectedAttrs	 [1] SET SIZE (1..MAX) OF Attribute OPTIONAL
+}
+
+EncryptedContentInfo {Type} ::= SEQUENCE {
+    contentType		       OBJECT IDENTIFIER,
+    contentEncryptionAlgorithm AlgorithmIdentifier {{KeyDerivationAlgorithms}},
+    encryptedContent 	       [0] OCTET STRING OPTIONAL
+}(CONSTRAINED BY {-- 'encryptedContent' shall be the result of
+  -- encrypting DER-encoded value of type -- Type})
+
+PKCS15Token ::= SEQUENCE {
+    version		INTEGER {v1(0)} (v1,...),
+    keyManagementInfo	[0] KeyManagementInfo OPTIONAL,
+    pkcs15Objects	SEQUENCE OF PKCS15Objects
+}
+
+KeyManagementInfo ::= SEQUENCE OF SEQUENCE {
+    keyId		Identifier,
+    keyInfo		CHOICE {
+	recipientInfo	RecipientInfo,
+	passwordInfo	[0] PasswordInfo
+	}
+} (CONSTRAINED BY {-- Each keyID must be unique --})
+
+PasswordInfo ::= SEQUENCE {
+    hint	Label OPTIONAL,
+    algId	AlgorithmIdentifier {{KeyDerivationAlgorithms}},
+    ...
+} (CONSTRAINED BY {--keyID shall point to a KEKRecipientInfo--})
+
+KeyDerivationAlgorithms ALGORITHM-IDENTIFIER ::= {
+    PBKDF2Algorithms,
+    ... -- For future extensions
+}
+
+CMS3DESwrap ::= NULL
+
+KeyEncryptionAlgorithms ALGORITHM-IDENTIFIER ::= {
+    {CMS3DESwrap IDENTIFIED BY id-alg-CMS3DESwrap} |
+    {INTEGER IDENTIFIED BY id-alg-CMSRC2wrap},
+    ... -- For future extensions
+}
+
+DES-IV ::= OCTET STRING (SIZE(8))
+
+ContentEncryptionAlgorithms ALGORITHM-IDENTIFIER ::= {
+    SupportingAlgorithms EXCEPT {NULL IDENTIFIED BY id-hmacWithSHA1},
+    ... -- For future extensions
+}
+
+MACAlgorithms ALGORITHM-IDENTIFIER ::= {
+    {NULL IDENTIFIED BY hMAC-SHA1},
+    ... -- For future extensions
+}
+
+DigestAlgorithms ALGORITHM-IDENTIFIER ::= {
+    {NULL IDENTIFIED BY sha-1},
+    ... -- For future extensions
+}
+
+-- Misc
+
+DDO ::= SEQUENCE {
+    oid  	  OBJECT IDENTIFIER,
+    odfPath  	  Path OPTIONAL,
+    tokenInfoPath [0] Path OPTIONAL,
+    unusedPath 	  [1] Path OPTIONAL,
+    ... -- For future extensions
+}
+
+DIRRecord ::=   [APPLICATION 1] SEQUENCE {
+    aid  	[APPLICATION 15] OCTET STRING,
+    label 	[APPLICATION 16] UTF8String OPTIONAL,
+    path 	[APPLICATION 17] OCTET STRING,
+    ddo  	[APPLICATION 19] DDO OPTIONAL
+}
+
+UnusedSpace ::= SEQUENCE {
+    path  	Path (WITH COMPONENTS {..., index PRESENT, length PRESENT}),
+    authId 	Identifier OPTIONAL,
+    ...,
+    accessControlRules SEQUENCE OF AccessControlRule OPTIONAL
+}
+
+END