From 0f2d15c95f98e7b271111c9311210a808c624adb Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Fri, 8 May 2015 15:57:15 +0200 Subject: public_key, ssl: Align public_key and ssl doc Make sure that links from ssl to public_key work. OTP-12670 - Ignoring 1.2 extension in 1.0 or TLS-1.1 solved by 5edda23ee854038c9d4bcddd0d676ee0ffd20da5 is mentioned here to make the release scripts happy, as the branch solving this accidently had a name ending 1267 instead of 12670 --- lib/public_key/doc/src/Makefile | 2 +- lib/public_key/doc/src/part.xml | 2 +- lib/public_key/doc/src/public_key_records.xml | 841 ++++++++++++++++++++++++++ lib/public_key/doc/src/records.xml | 841 -------------------------- lib/ssl/doc/src/ssl.xml | 8 +- lib/ssl/doc/src/ssl_crl_cache_api.xml | 4 +- 6 files changed, 849 insertions(+), 849 deletions(-) create mode 100644 lib/public_key/doc/src/public_key_records.xml delete mode 100644 lib/public_key/doc/src/records.xml diff --git a/lib/public_key/doc/src/Makefile b/lib/public_key/doc/src/Makefile index 2adc13a5cf..d04819b5aa 100644 --- a/lib/public_key/doc/src/Makefile +++ b/lib/public_key/doc/src/Makefile @@ -42,7 +42,7 @@ XML_REF6_FILES = XML_PART_FILES = part.xml part_notes.xml XML_CHAPTER_FILES = \ introduction.xml \ - records.xml \ + public_key_records.xml \ using_public_key.xml \ notes.xml diff --git a/lib/public_key/doc/src/part.xml b/lib/public_key/doc/src/part.xml index d3cc9303bd..465f311946 100644 --- a/lib/public_key/doc/src/part.xml +++ b/lib/public_key/doc/src/part.xml @@ -38,7 +38,7 @@ PKCS standard.

- + diff --git a/lib/public_key/doc/src/public_key_records.xml b/lib/public_key/doc/src/public_key_records.xml new file mode 100644 index 0000000000..9536167839 --- /dev/null +++ b/lib/public_key/doc/src/public_key_records.xml @@ -0,0 +1,841 @@ + + + + +
+ + 2008 + 2015 + Ericsson AB, All Rights Reserved + + + The contents of this file are subject to the Erlang Public License, + Version 1.1, (the "License"); you may not use this file except in + compliance with the License. You should have received a copy of the + Erlang Public License along with this software. If not, it can be + retrieved online at http://www.erlang.org/. + + Software distributed under the License is distributed on an "AS IS" + basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See + the License for the specific language governing rights and limitations + under the License. + + The Initial Developer of the Original Code is Ericsson AB. + + + Public-Key Records + Ingela Anderton Andin + + + + + 2008-02-06 + A + public_key_records.xml +
+ +

This chapter briefly describes Erlang records derived from ASN.1 + specifications used to handle public key infrastructure. + The scope is to describe the data types of each component, + not the semantics. For information on the + semantics, refer to the relevant standards and RFCs linked in the sections below.

+ +

Use the following include directive to get access to the + records and constant macros described in the following sections:

+ + -include_lib("public_key/include/public_key.hrl"). + +
+ Data Types + +

Common non-standard Erlang + data types used to describe the record fields in the + following sections and which are not defined in the Public Key Reference Manual + follows here:

+ + + time() +

= uct_time() | general_time()

 + + uct_time() +

= {utcTime, "YYMMDDHHMMSSZ"}

 + + general_time() +

= {generalTime, "YYYYMMDDHHMMSSZ"}

 + + general_name() + =

{rfc822Name, string()}

+

| {dNSName, string()}

+

| {x400Address, string()}

+

| {directoryName, {rdnSequence, [#AttributeTypeAndValue'{}]}}

+

| {eidPartyName, special_string()}

+

| {eidPartyName, special_string(), special_string()}

+

| {uniformResourceIdentifier, string()}

+

| {ipAddress, string()}

+

| {registeredId, oid()}

+

| {otherName, term()}

+ + + special_string() + =

{teletexString, string()}

+

| {printableString, string()}

+

| {universalString, string()}

+

| {utf8String, binary()}

+

| {bmpString, string()}

+ + + dist_reason() + =

unused

+

| keyCompromise

+

| cACompromise

+

| affiliationChanged

+

| superseded

+

| cessationOfOperation

+

| certificateHold

+

| privilegeWithdrawn

+

| aACompromise

+ + + OID_macro() + =

?OID_name()

+ + + OID_name() + =

atom()

+ + + + +
+ +
+ RSA +

Erlang representation of + Rivest-Shamir-Adleman cryptosystem (RSA) keys follows:

+ + +#'RSAPublicKey'{ + modulus, % integer() + publicExponent % integer() + }. + +#'RSAPrivateKey'{ + version, % two-prime | multi + modulus, % integer() + publicExponent, % integer() + privateExponent, % integer() + prime1, % integer() + prime2, % integer() + exponent1, % integer() + exponent2, % integer() + coefficient, % integer() + otherPrimeInfos % [#OtherPrimeInfo{}] | asn1_NOVALUE + }. + +#'OtherPrimeInfo'{ + prime, % integer() + exponent, % integer() + coefficient % integer() + }. + +
+ +
+ DSA +

Erlang representation of Digigital Signature Algorithm (DSA) keys

+ +#'DSAPrivateKey',{ + version, % integer() + p, % integer() + q, % integer() + g, % integer() + y, % integer() + x % integer() + }. + +#'Dss-Parms',{ + p, % integer() + q, % integer() + g % integer() + }. + +
+ +
+ ECDSA +

Erlang representation of Elliptic Curve Digital Signature Algorithm (ECDSA) keys follows:

+ + +#'ECPrivateKey'{ + version, % integer() + privateKey, % binary() + parameters, % der_encoded() - {'EcpkParameters', #'ECParameters'{}} | + {'EcpkParameters', {namedCurve, oid()}} | + {'EcpkParameters', 'NULL'} % Inherited by CA + publicKey % bitstring() + }. + +#'ECParameters'{ + version, % integer() + fieldID, % #'FieldID'{} + curve, % #'Curve'{} + base, % binary() + order, % integer() + cofactor % integer() + }. + +#'Curve'{ + a, % binary() + b, % binary() + seed % bitstring() - optional + + }. + +#'FieldID'{ + fieldType, % oid() + parameters % Depending on fieldType + }. + +#'ECPoint'{ + point % binary() - the public key + }. +
+ +
+ PKIX Certificates +

Erlang representation of PKIX certificates derived from ASN.1 + specifications see also X509 certificates (RFC 5280), also referred to as plain type, are as follows:

+ +#'Certificate'{ + tbsCertificate, % #'TBSCertificate'{} + signatureAlgorithm, % #'AlgorithmIdentifier'{} + signature % bitstring() + }. + +#'TBSCertificate'{ + version, % v1 | v2 | v3 + serialNumber, % integer() + signature, % #'AlgorithmIdentifier'{} + issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} + validity, % #'Validity'{} + subject, % {rdnSequence, [#AttributeTypeAndValue'{}]} + subjectPublicKeyInfo, % #'SubjectPublicKeyInfo'{} + issuerUniqueID, % binary() | asn1_novalue + subjectUniqueID, % binary() | asn1_novalue + extensions % [#'Extension'{}] + }. + +#'AlgorithmIdentifier'{ + algorithm, % oid() + parameters % der_encoded() + }. + +

Erlang alternate representation of PKIX certificate, also referred to as otp type

+ + +#'OTPCertificate'{ + tbsCertificate, % #'OTPTBSCertificate'{} + signatureAlgorithm, % #'SignatureAlgorithm' + signature % bitstring() + }. + +#'OTPTBSCertificate'{ + version, % v1 | v2 | v3 + serialNumber, % integer() + signature, % #'SignatureAlgorithm' + issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} + validity, % #'Validity'{} + subject, % {rdnSequence, [#AttributeTypeAndValue'{}]} + subjectPublicKeyInfo, % #'OTPSubjectPublicKeyInfo'{} + issuerUniqueID, % binary() | asn1_novalue + subjectUniqueID, % binary() | asn1_novalue + extensions % [#'Extension'{}] + }. + +#'SignatureAlgorithm'{ + algorithm, % id_signature_algorithm() + parameters % asn1_novalue | #'Dss-Parms'{} + }. + +

id_signature_algorithm() = OID_macro()

+ +

The available OID names are as follows:

+ + + OID Name + + + id-dsa-with-sha1 + + + id-dsaWithSHA1 (ISO or OID to above) + + + md2WithRSAEncryption + + + md5WithRSAEncryption + + + sha1WithRSAEncryption + + + sha-1WithRSAEncryption (ISO or OID to above) + + + sha224WithRSAEncryption + + + sha256WithRSAEncryption + + + sha512WithRSAEncryption + + + ecdsa-with-SHA1 + + Signature Algorithm OIDs +
+ +

The data type 'AttributeTypeAndValue', is represented as + the following erlang record:

+ + +#'AttributeTypeAndValue'{ + type, % id_attributes() + value % term() + }. + +

The attribute OID name atoms and their corresponding value types +are as follows:

+ + + OID Name + Value Type + + + id-at-name + special_string() + + + id-at-surname + special_string() + + + id-at-givenName + special_string() + + + id-at-initials + special_string() + + + id-at-generationQualifier + special_string() + + + id-at-commonName + special_string() + + + id-at-localityName + special_string() + + + id-at-stateOrProvinceName + special_string() + + + id-at-organizationName + special_string() + + + id-at-title + special_string() + + + id-at-dnQualifier + {printableString, string()} + + + id-at-countryName + {printableString, string()} + + + id-at-serialNumber + {printableString, string()} + + + id-at-pseudonym + special_string() + + Attribute OIDs +
+ +

The data types 'Validity', 'SubjectPublicKeyInfo', and +'SubjectPublicKeyInfoAlgorithm' are represented as the following Erlang records:

+ + +#'Validity'{ + notBefore, % time() + notAfter % time() + }. + +#'SubjectPublicKeyInfo'{ + algorithm, % #AlgorithmIdentifier{} + subjectPublicKey % binary() + }. + +#'SubjectPublicKeyInfoAlgorithm'{ + algorithm, % id_public_key_algorithm() + parameters % public_key_params() + }. + +

The public-key algorithm OID name atoms are as follows:

+ + + OID Name + + + rsaEncryption + + + id-dsa + + + dhpublicnumber + + + id-keyExchangeAlgorithm + + + id-ecPublicKey + + Public-Key Algorithm OIDs +
+ + +#'Extension'{ + extnID, % id_extensions() | oid() + critical, % boolean() + extnValue % der_encoded() + }. + +

id_extensions() + Standard Certificate Extensions, + Private Internet Extensions, + CRL Extensions and + CRL Entry Extensions. +

+ +
+ +
+ + Standard Certificate Extensions + +

The standard certificate extensions OID name atoms and their + corresponding value types are as follows:

+ + + + OID Name + Value Type + + + id-ce-authorityKeyIdentifier + #'AuthorityKeyIdentifier'{} + + + id-ce-subjectKeyIdentifier + oid() + + + id-ce-keyUsage + [key_usage()] + + + id-ce-privateKeyUsagePeriod + #'PrivateKeyUsagePeriod'{} + + + id-ce-certificatePolicies + #'PolicyInformation'{} + + + + id-ce-policyMappings + #'PolicyMappings_SEQOF'{} + + + + id-ce-subjectAltName + general_name() + + + + id-ce-issuerAltName + general_name() + + + + id-ce-subjectDirectoryAttributes + [#'Attribute'{}] + + + + id-ce-basicConstraints + #'BasicConstraints'{} + + + id-ce-nameConstraints + #'NameConstraints'{} + + + id-ce-policyConstraints + #'PolicyConstraints'{} + + + id-ce-extKeyUsage + [id_key_purpose()] + + + + id-ce-cRLDistributionPoints + [#'DistributionPoint'{}] + + + + id-ce-inhibitAnyPolicy + integer() + + + + id-ce-freshestCRL + [#'DistributionPoint'{}] + + + + Standard Certificate Extensions +
+ +

Here:

+ + key_usage() + =

digitalSignature

+

| nonRepudiation

+

| keyEncipherment

+

| dataEncipherment

+

| keyAgreement

+

| keyCertSign

+

| cRLSign

+

| encipherOnly

+

| decipherOnly

+ + + +

And for id_key_purpose():

+ + + + OID Name + + + id-kp-serverAuth + + + id-kp-clientAuth + + + id-kp-codeSigning + + + id-kp-emailProtection + + + id-kp-timeStamping + + + id-kp-OCSPSigning + + Key Purpose OIDs +
+ + +#'AuthorityKeyIdentifier'{ + keyIdentifier, % oid() + authorityCertIssuer, % general_name() + authorityCertSerialNumber % integer() + }. + +#'PrivateKeyUsagePeriod'{ + notBefore, % general_time() + notAfter % general_time() + }. + +#'PolicyInformation'{ + policyIdentifier, % oid() + policyQualifiers % [#PolicyQualifierInfo{}] + }. + +#'PolicyQualifierInfo'{ + policyQualifierId, % oid() + qualifier % string() | #'UserNotice'{} + }. + +#'UserNotice'{ + noticeRef, % #'NoticeReference'{} + explicitText % string() + }. + +#'NoticeReference'{ + organization, % string() + noticeNumbers % [integer()] + }. + +#'PolicyMappings_SEQOF'{ + issuerDomainPolicy, % oid() + subjectDomainPolicy % oid() + }. + +#'Attribute'{ + type, % oid() + values % [der_encoded()] + }). + +#'BasicConstraints'{ + cA, % boolean() + pathLenConstraint % integer() + }). + +#'NameConstraints'{ + permittedSubtrees, % [#'GeneralSubtree'{}] + excludedSubtrees % [#'GeneralSubtree'{}] + }). + +#'GeneralSubtree'{ + base, % general_name() + minimum, % integer() + maximum % integer() + }). + +#'PolicyConstraints'{ + requireExplicitPolicy, % integer() + inhibitPolicyMapping % integer() + }). + +#'DistributionPoint'{ + distributionPoint, % {fullName, [general_name()]} | {nameRelativeToCRLIssuer, + [#AttributeTypeAndValue{}]} + reasons, % [dist_reason()] + cRLIssuer % [general_name()] + }). + +
+ +
+ + Private Internet Extensions + +

The private internet extensions OID name atoms and their corresponding value + types are as follows:

+ + + + OID Name + Value Type + + + id-pe-authorityInfoAccess + [#'AccessDescription'{}] + + + id-pe-subjectInfoAccess + [#'AccessDescription'{}] + + Private Internet Extensions +
+ + +#'AccessDescription'{ + accessMethod, % oid() + accessLocation % general_name() + }). + +
+ +
+ CRL and CRL Extensions Profile + +

Erlang representation of CRL and CRL extensions profile + derived from ASN.1 specifications and RFC 5280 are as follows:

+ + +#'CertificateList'{ + tbsCertList, % #'TBSCertList{} + signatureAlgorithm, % #'AlgorithmIdentifier'{} + signature % bitstring() + }). + +#'TBSCertList'{ + version, % v2 (if defined) + signature, % #AlgorithmIdentifier{} + issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} + thisUpdate, % time() + nextUpdate, % time() + revokedCertificates, % [#'TBSCertList_revokedCertificates_SEQOF'{}] + crlExtensions % [#'Extension'{}] + }). + +#'TBSCertList_revokedCertificates_SEQOF'{ + userCertificate, % integer() + revocationDate, % timer() + crlEntryExtensions % [#'Extension'{}] + }). + +
+ + CRL Extensions + +

The CRL extensions OID name atoms and their corresponding value types are as follows:

+ + + + + OID Name + Value Type + + + id-ce-authorityKeyIdentifier + #'AuthorityKeyIdentifier{} + + + id-ce-issuerAltName + {rdnSequence, [#AttributeTypeAndValue'{}]} + + + id-ce-cRLNumber + integer() + + + id-ce-deltaCRLIndicator + integer() + + + id-ce-issuingDistributionPoint + #'IssuingDistributionPoint'{} + + + id-ce-freshestCRL + [#'Distributionpoint'{}] + + + CRL Extensions +
+ +

Here, the data type 'IssuingDistributionPoint' is represented as + the following Erlang record:

+ + +#'IssuingDistributionPoint'{ + distributionPoint, % {fullName, [general_name()]} | {nameRelativeToCRLIssuer, + [#AttributeTypeAndValue'{}]} + onlyContainsUserCerts, % boolean() + onlyContainsCACerts, % boolean() + onlySomeReasons, % [dist_reason()] + indirectCRL, % boolean() + onlyContainsAttributeCerts % boolean() + }). +
+ +
+ + CRL Entry Extensions + +

The CRL entry extensions OID name atoms and their corresponding value types are as follows:

+ + + + OID Name + Value Type + + + id-ce-cRLReason + crl_reason() + + + id-ce-holdInstructionCode + oid() + + + id-ce-invalidityDate + general_time() + + + id-ce-certificateIssuer + general_name() + + CRL Entry Extensions +
+ + +

Here:

+ + crl_reason() + =

unspecified

+

| keyCompromise

+

| cACompromise

+

| affiliationChanged

+

| superseded

+

| cessationOfOperation

+

| certificateHold

+

| removeFromCRL

+

| privilegeWithdrawn

+

| aACompromise

+ + + +
+ +
+ + PKCS#10 Certification Request +

Erlang representation of a PKCS#10 certification request + derived from ASN.1 specifications and RFC 5280 are as follows:

+ +#'CertificationRequest'{ + certificationRequestInfo #'CertificationRequestInfo'{}, + signatureAlgorithm #'CertificationRequest_signatureAlgorithm'{}}. + signature bitstring() + } + +#'CertificationRequestInfo'{ + version atom(), + subject {rdnSequence, [#AttributeTypeAndValue'{}]} , + subjectPKInfo #'CertificationRequestInfo_subjectPKInfo'{}, + attributes [#'AttributePKCS-10' {}] + } + +#'CertificationRequestInfo_subjectPKInfo'{ + algorithm #'CertificationRequestInfo_subjectPKInfo_algorithm'{} + subjectPublicKey bitstring() + } + +#'CertificationRequestInfo_subjectPKInfo_algorithm'{ + algorithm = oid(), + parameters = der_encoded() +} + +#'CertificationRequest_signatureAlgorithm'{ + algorithm = oid(), + parameters = der_encoded() + } + +#'AttributePKCS-10'{ + type = oid(), + values = [der_encoded()] +} +
+
+ diff --git a/lib/public_key/doc/src/records.xml b/lib/public_key/doc/src/records.xml deleted file mode 100644 index 9536167839..0000000000 --- a/lib/public_key/doc/src/records.xml +++ /dev/null @@ -1,841 +0,0 @@ - - - - -
- - 2008 - 2015 - Ericsson AB, All Rights Reserved - - - The contents of this file are subject to the Erlang Public License, - Version 1.1, (the "License"); you may not use this file except in - compliance with the License. You should have received a copy of the - Erlang Public License along with this software. If not, it can be - retrieved online at http://www.erlang.org/. - - Software distributed under the License is distributed on an "AS IS" - basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See - the License for the specific language governing rights and limitations - under the License. - - The Initial Developer of the Original Code is Ericsson AB. - - - Public-Key Records - Ingela Anderton Andin - - - - - 2008-02-06 - A - public_key_records.xml -
- -

This chapter briefly describes Erlang records derived from ASN.1 - specifications used to handle public key infrastructure. - The scope is to describe the data types of each component, - not the semantics. For information on the - semantics, refer to the relevant standards and RFCs linked in the sections below.

- -

Use the following include directive to get access to the - records and constant macros described in the following sections:

- - -include_lib("public_key/include/public_key.hrl"). - -
- Data Types - -

Common non-standard Erlang - data types used to describe the record fields in the - following sections and which are not defined in the Public Key Reference Manual - follows here:

- - - time() -

= uct_time() | general_time()

 - - uct_time() -

= {utcTime, "YYMMDDHHMMSSZ"}

 - - general_time() -

= {generalTime, "YYYYMMDDHHMMSSZ"}

 - - general_name() - =

{rfc822Name, string()}

-

| {dNSName, string()}

-

| {x400Address, string()}

-

| {directoryName, {rdnSequence, [#AttributeTypeAndValue'{}]}}

-

| {eidPartyName, special_string()}

-

| {eidPartyName, special_string(), special_string()}

-

| {uniformResourceIdentifier, string()}

-

| {ipAddress, string()}

-

| {registeredId, oid()}

-

| {otherName, term()}

- - - special_string() - =

{teletexString, string()}

-

| {printableString, string()}

-

| {universalString, string()}

-

| {utf8String, binary()}

-

| {bmpString, string()}

- - - dist_reason() - =

unused

-

| keyCompromise

-

| cACompromise

-

| affiliationChanged

-

| superseded

-

| cessationOfOperation

-

| certificateHold

-

| privilegeWithdrawn

-

| aACompromise

- - - OID_macro() - =

?OID_name()

- - - OID_name() - =

atom()

- - - - -
- -
- RSA -

Erlang representation of - Rivest-Shamir-Adleman cryptosystem (RSA) keys follows:

- - -#'RSAPublicKey'{ - modulus, % integer() - publicExponent % integer() - }. - -#'RSAPrivateKey'{ - version, % two-prime | multi - modulus, % integer() - publicExponent, % integer() - privateExponent, % integer() - prime1, % integer() - prime2, % integer() - exponent1, % integer() - exponent2, % integer() - coefficient, % integer() - otherPrimeInfos % [#OtherPrimeInfo{}] | asn1_NOVALUE - }. - -#'OtherPrimeInfo'{ - prime, % integer() - exponent, % integer() - coefficient % integer() - }. - -
- -
- DSA -

Erlang representation of Digigital Signature Algorithm (DSA) keys

- -#'DSAPrivateKey',{ - version, % integer() - p, % integer() - q, % integer() - g, % integer() - y, % integer() - x % integer() - }. - -#'Dss-Parms',{ - p, % integer() - q, % integer() - g % integer() - }. - -
- -
- ECDSA -

Erlang representation of Elliptic Curve Digital Signature Algorithm (ECDSA) keys follows:

- - -#'ECPrivateKey'{ - version, % integer() - privateKey, % binary() - parameters, % der_encoded() - {'EcpkParameters', #'ECParameters'{}} | - {'EcpkParameters', {namedCurve, oid()}} | - {'EcpkParameters', 'NULL'} % Inherited by CA - publicKey % bitstring() - }. - -#'ECParameters'{ - version, % integer() - fieldID, % #'FieldID'{} - curve, % #'Curve'{} - base, % binary() - order, % integer() - cofactor % integer() - }. - -#'Curve'{ - a, % binary() - b, % binary() - seed % bitstring() - optional - - }. - -#'FieldID'{ - fieldType, % oid() - parameters % Depending on fieldType - }. - -#'ECPoint'{ - point % binary() - the public key - }. -
- -
- PKIX Certificates -

Erlang representation of PKIX certificates derived from ASN.1 - specifications see also X509 certificates (RFC 5280), also referred to as plain type, are as follows:

- -#'Certificate'{ - tbsCertificate, % #'TBSCertificate'{} - signatureAlgorithm, % #'AlgorithmIdentifier'{} - signature % bitstring() - }. - -#'TBSCertificate'{ - version, % v1 | v2 | v3 - serialNumber, % integer() - signature, % #'AlgorithmIdentifier'{} - issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} - validity, % #'Validity'{} - subject, % {rdnSequence, [#AttributeTypeAndValue'{}]} - subjectPublicKeyInfo, % #'SubjectPublicKeyInfo'{} - issuerUniqueID, % binary() | asn1_novalue - subjectUniqueID, % binary() | asn1_novalue - extensions % [#'Extension'{}] - }. - -#'AlgorithmIdentifier'{ - algorithm, % oid() - parameters % der_encoded() - }. - -

Erlang alternate representation of PKIX certificate, also referred to as otp type

- - -#'OTPCertificate'{ - tbsCertificate, % #'OTPTBSCertificate'{} - signatureAlgorithm, % #'SignatureAlgorithm' - signature % bitstring() - }. - -#'OTPTBSCertificate'{ - version, % v1 | v2 | v3 - serialNumber, % integer() - signature, % #'SignatureAlgorithm' - issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} - validity, % #'Validity'{} - subject, % {rdnSequence, [#AttributeTypeAndValue'{}]} - subjectPublicKeyInfo, % #'OTPSubjectPublicKeyInfo'{} - issuerUniqueID, % binary() | asn1_novalue - subjectUniqueID, % binary() | asn1_novalue - extensions % [#'Extension'{}] - }. - -#'SignatureAlgorithm'{ - algorithm, % id_signature_algorithm() - parameters % asn1_novalue | #'Dss-Parms'{} - }. - -

id_signature_algorithm() = OID_macro()

- -

The available OID names are as follows:

- - - OID Name - - - id-dsa-with-sha1 - - - id-dsaWithSHA1 (ISO or OID to above) - - - md2WithRSAEncryption - - - md5WithRSAEncryption - - - sha1WithRSAEncryption - - - sha-1WithRSAEncryption (ISO or OID to above) - - - sha224WithRSAEncryption - - - sha256WithRSAEncryption - - - sha512WithRSAEncryption - - - ecdsa-with-SHA1 - - Signature Algorithm OIDs -
- -

The data type 'AttributeTypeAndValue', is represented as - the following erlang record:

- - -#'AttributeTypeAndValue'{ - type, % id_attributes() - value % term() - }. - -

The attribute OID name atoms and their corresponding value types -are as follows:

- - - OID Name - Value Type - - - id-at-name - special_string() - - - id-at-surname - special_string() - - - id-at-givenName - special_string() - - - id-at-initials - special_string() - - - id-at-generationQualifier - special_string() - - - id-at-commonName - special_string() - - - id-at-localityName - special_string() - - - id-at-stateOrProvinceName - special_string() - - - id-at-organizationName - special_string() - - - id-at-title - special_string() - - - id-at-dnQualifier - {printableString, string()} - - - id-at-countryName - {printableString, string()} - - - id-at-serialNumber - {printableString, string()} - - - id-at-pseudonym - special_string() - - Attribute OIDs -
- -

The data types 'Validity', 'SubjectPublicKeyInfo', and -'SubjectPublicKeyInfoAlgorithm' are represented as the following Erlang records:

- - -#'Validity'{ - notBefore, % time() - notAfter % time() - }. - -#'SubjectPublicKeyInfo'{ - algorithm, % #AlgorithmIdentifier{} - subjectPublicKey % binary() - }. - -#'SubjectPublicKeyInfoAlgorithm'{ - algorithm, % id_public_key_algorithm() - parameters % public_key_params() - }. - -

The public-key algorithm OID name atoms are as follows:

- - - OID Name - - - rsaEncryption - - - id-dsa - - - dhpublicnumber - - - id-keyExchangeAlgorithm - - - id-ecPublicKey - - Public-Key Algorithm OIDs -
- - -#'Extension'{ - extnID, % id_extensions() | oid() - critical, % boolean() - extnValue % der_encoded() - }. - -

id_extensions() - Standard Certificate Extensions, - Private Internet Extensions, - CRL Extensions and - CRL Entry Extensions. -

- -
- -
- - Standard Certificate Extensions - -

The standard certificate extensions OID name atoms and their - corresponding value types are as follows:

- - - - OID Name - Value Type - - - id-ce-authorityKeyIdentifier - #'AuthorityKeyIdentifier'{} - - - id-ce-subjectKeyIdentifier - oid() - - - id-ce-keyUsage - [key_usage()] - - - id-ce-privateKeyUsagePeriod - #'PrivateKeyUsagePeriod'{} - - - id-ce-certificatePolicies - #'PolicyInformation'{} - - - - id-ce-policyMappings - #'PolicyMappings_SEQOF'{} - - - - id-ce-subjectAltName - general_name() - - - - id-ce-issuerAltName - general_name() - - - - id-ce-subjectDirectoryAttributes - [#'Attribute'{}] - - - - id-ce-basicConstraints - #'BasicConstraints'{} - - - id-ce-nameConstraints - #'NameConstraints'{} - - - id-ce-policyConstraints - #'PolicyConstraints'{} - - - id-ce-extKeyUsage - [id_key_purpose()] - - - - id-ce-cRLDistributionPoints - [#'DistributionPoint'{}] - - - - id-ce-inhibitAnyPolicy - integer() - - - - id-ce-freshestCRL - [#'DistributionPoint'{}] - - - - Standard Certificate Extensions -
- -

Here:

- - key_usage() - =

digitalSignature

-

| nonRepudiation

-

| keyEncipherment

-

| dataEncipherment

-

| keyAgreement

-

| keyCertSign

-

| cRLSign

-

| encipherOnly

-

| decipherOnly

- - - -

And for id_key_purpose():

- - - - OID Name - - - id-kp-serverAuth - - - id-kp-clientAuth - - - id-kp-codeSigning - - - id-kp-emailProtection - - - id-kp-timeStamping - - - id-kp-OCSPSigning - - Key Purpose OIDs -
- - -#'AuthorityKeyIdentifier'{ - keyIdentifier, % oid() - authorityCertIssuer, % general_name() - authorityCertSerialNumber % integer() - }. - -#'PrivateKeyUsagePeriod'{ - notBefore, % general_time() - notAfter % general_time() - }. - -#'PolicyInformation'{ - policyIdentifier, % oid() - policyQualifiers % [#PolicyQualifierInfo{}] - }. - -#'PolicyQualifierInfo'{ - policyQualifierId, % oid() - qualifier % string() | #'UserNotice'{} - }. - -#'UserNotice'{ - noticeRef, % #'NoticeReference'{} - explicitText % string() - }. - -#'NoticeReference'{ - organization, % string() - noticeNumbers % [integer()] - }. - -#'PolicyMappings_SEQOF'{ - issuerDomainPolicy, % oid() - subjectDomainPolicy % oid() - }. - -#'Attribute'{ - type, % oid() - values % [der_encoded()] - }). - -#'BasicConstraints'{ - cA, % boolean() - pathLenConstraint % integer() - }). - -#'NameConstraints'{ - permittedSubtrees, % [#'GeneralSubtree'{}] - excludedSubtrees % [#'GeneralSubtree'{}] - }). - -#'GeneralSubtree'{ - base, % general_name() - minimum, % integer() - maximum % integer() - }). - -#'PolicyConstraints'{ - requireExplicitPolicy, % integer() - inhibitPolicyMapping % integer() - }). - -#'DistributionPoint'{ - distributionPoint, % {fullName, [general_name()]} | {nameRelativeToCRLIssuer, - [#AttributeTypeAndValue{}]} - reasons, % [dist_reason()] - cRLIssuer % [general_name()] - }). - -
- -
- - Private Internet Extensions - -

The private internet extensions OID name atoms and their corresponding value - types are as follows:

- - - - OID Name - Value Type - - - id-pe-authorityInfoAccess - [#'AccessDescription'{}] - - - id-pe-subjectInfoAccess - [#'AccessDescription'{}] - - Private Internet Extensions -
- - -#'AccessDescription'{ - accessMethod, % oid() - accessLocation % general_name() - }). - -
- -
- CRL and CRL Extensions Profile - -

Erlang representation of CRL and CRL extensions profile - derived from ASN.1 specifications and RFC 5280 are as follows:

- - -#'CertificateList'{ - tbsCertList, % #'TBSCertList{} - signatureAlgorithm, % #'AlgorithmIdentifier'{} - signature % bitstring() - }). - -#'TBSCertList'{ - version, % v2 (if defined) - signature, % #AlgorithmIdentifier{} - issuer, % {rdnSequence, [#AttributeTypeAndValue'{}]} - thisUpdate, % time() - nextUpdate, % time() - revokedCertificates, % [#'TBSCertList_revokedCertificates_SEQOF'{}] - crlExtensions % [#'Extension'{}] - }). - -#'TBSCertList_revokedCertificates_SEQOF'{ - userCertificate, % integer() - revocationDate, % timer() - crlEntryExtensions % [#'Extension'{}] - }). - -
- - CRL Extensions - -

The CRL extensions OID name atoms and their corresponding value types are as follows:

- - - - - OID Name - Value Type - - - id-ce-authorityKeyIdentifier - #'AuthorityKeyIdentifier{} - - - id-ce-issuerAltName - {rdnSequence, [#AttributeTypeAndValue'{}]} - - - id-ce-cRLNumber - integer() - - - id-ce-deltaCRLIndicator - integer() - - - id-ce-issuingDistributionPoint - #'IssuingDistributionPoint'{} - - - id-ce-freshestCRL - [#'Distributionpoint'{}] - - - CRL Extensions -
- -

Here, the data type 'IssuingDistributionPoint' is represented as - the following Erlang record:

- - -#'IssuingDistributionPoint'{ - distributionPoint, % {fullName, [general_name()]} | {nameRelativeToCRLIssuer, - [#AttributeTypeAndValue'{}]} - onlyContainsUserCerts, % boolean() - onlyContainsCACerts, % boolean() - onlySomeReasons, % [dist_reason()] - indirectCRL, % boolean() - onlyContainsAttributeCerts % boolean() - }). -
- -
- - CRL Entry Extensions - -

The CRL entry extensions OID name atoms and their corresponding value types are as follows:

- - - - OID Name - Value Type - - - id-ce-cRLReason - crl_reason() - - - id-ce-holdInstructionCode - oid() - - - id-ce-invalidityDate - general_time() - - - id-ce-certificateIssuer - general_name() - - CRL Entry Extensions -
- - -

Here:

- - crl_reason() - =

unspecified

-

| keyCompromise

-

| cACompromise

-

| affiliationChanged

-

| superseded

-

| cessationOfOperation

-

| certificateHold

-

| removeFromCRL

-

| privilegeWithdrawn

-

| aACompromise

- - - -
- -
- - PKCS#10 Certification Request -

Erlang representation of a PKCS#10 certification request - derived from ASN.1 specifications and RFC 5280 are as follows:

- -#'CertificationRequest'{ - certificationRequestInfo #'CertificationRequestInfo'{}, - signatureAlgorithm #'CertificationRequest_signatureAlgorithm'{}}. - signature bitstring() - } - -#'CertificationRequestInfo'{ - version atom(), - subject {rdnSequence, [#AttributeTypeAndValue'{}]} , - subjectPKInfo #'CertificationRequestInfo_subjectPKInfo'{}, - attributes [#'AttributePKCS-10' {}] - } - -#'CertificationRequestInfo_subjectPKInfo'{ - algorithm #'CertificationRequestInfo_subjectPKInfo_algorithm'{} - subjectPublicKey bitstring() - } - -#'CertificationRequestInfo_subjectPKInfo_algorithm'{ - algorithm = oid(), - parameters = der_encoded() -} - -#'CertificationRequest_signatureAlgorithm'{ - algorithm = oid(), - parameters = der_encoded() - } - -#'AttributePKCS-10'{ - type = oid(), - values = [der_encoded()] -} -
-
- diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index cdf6870c25..46dc93e343 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -268,7 +268,7 @@ atom()}} | application. It differentiates between the peer certificate and the CA certificates by using valid_peer or valid as second argument to the verification fun. See the - public_key User's + public_key User's Guide for definition of #'OTPCertificate'{} and #'Extension'{}.

@@ -364,10 +364,10 @@ marker="public_key:public_key#pkix_path_validation-3">public_key:pkix_path_valid empty argument list. The following arguments may be specified for the internal cache.

{http, timeout()} - +

Enables fetching of CRLs specified as http URIs in X509 cerificate extensions. - Requires the OTP inets application. + marker="public_key:public_key_records"> X509 cerificate extensions. + Requires the OTP inets application.

 diff --git a/lib/ssl/doc/src/ssl_crl_cache_api.xml b/lib/ssl/doc/src/ssl_crl_cache_api.xml index 1d9353a2cc..90aa895aff 100644 --- a/lib/ssl/doc/src/ssl_crl_cache_api.xml +++ b/lib/ssl/doc/src/ssl_crl_cache_api.xml @@ -50,8 +50,8 @@ cache_ref() = opaque() dist_point() - = #'DistributionPoint'{} see X509 certificates records +

= #'DistributionPoint'{} see X509 certificates records

 -- cgit v1.2.3 From f630482b4e54b53b78434c6bfc11591ddfdcfbe7 Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Mon, 11 May 2015 16:27:20 +0200 Subject: public_key: Align "=" sign in type declarations to decided policy --- lib/public_key/doc/src/public_key.xml | 157 +++++++++++++------------- lib/public_key/doc/src/public_key_records.xml | 32 +++--- 2 files changed, 97 insertions(+), 92 deletions(-) diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml index 6d220c9b69..883c52393f 100644 --- a/lib/public_key/doc/src/public_key.xml +++ b/lib/public_key/doc/src/public_key.xml @@ -87,104 +87,109 @@ oid()

Object identifier, a tuple of integers as generated by the ASN.1 compiler.

 - boolean() -

= true | false

 - - string() -

= [bytes()]

 - - der_encoded() -

= binary()

 - - pki_asn1_type() - =

'Certificate'

-

| 'RSAPrivateKey'

-

| 'RSAPublicKey'

-

| 'DSAPrivateKey'

-

| 'DSAPublicKey'

-

| 'DHParameter'

-

| 'SubjectPublicKeyInfo'

-

| 'PrivateKeyInfo'

-

| 'CertificationRequest'

-

| 'ECPrivateKey'

-

| 'EcpkParameters'

 - - pem_entry () -

= {pki_asn1_type(), binary(), %% DER or encrypted DER not_encrypted

-

| cipher_info()}

 + boolean() = +

true | false

 + + string() = +

[bytes()]

 + + der_encoded() = +

binary()

 + + pki_asn1_type() = + +

'Certificate'

+

| 'RSAPrivateKey'

+

| 'RSAPublicKey'

+

| 'DSAPrivateKey'

+

| 'DSAPublicKey'

+

| 'DHParameter'

+

| 'SubjectPublicKeyInfo'

+

| 'PrivateKeyInfo'

+

| 'CertificationRequest'

+

| 'ECPrivateKey'

+

| 'EcpkParameters'

+ - cipher_info() -

= {"RC2-CBC" | "DES-CBC" | "DES-EDE3-CBC", crypto:rand_bytes(8)

+ pem_entry () = +

{pki_asn1_type(), binary(), %% DER or encrypted DER not_encrypted

+

| cipher_info()}

 + + cipher_info() = +

{"RC2-CBC" | "DES-CBC" | "DES-EDE3-CBC", crypto:rand_bytes(8)

| {#'PBEParameter{}, digest_type()} | #'PBES2-params'{}}

 - public_key() -

= rsa_public_key() | dsa_public_key() | ec_public_key()

 - - private_key() -

= rsa_private_key() | dsa_private_key() | ec_private_key()

 + public_key() = +

rsa_public_key() | dsa_public_key() | ec_public_key()

 + + private_key() = +

rsa_private_key() | dsa_private_key() | ec_private_key()

 - rsa_public_key() -

= #'RSAPublicKey'{}

 + rsa_public_key() = +

#'RSAPublicKey'{}

 - rsa_private_key() -

= #'RSAPrivateKey'{}

 + rsa_private_key() = +

#'RSAPrivateKey'{}

 - dsa_public_key() -

= {integer(), #'Dss-Parms'{}}

 + dsa_public_key() = +

{integer(), #'Dss-Parms'{}}

 - dsa_private_key() -

= #'DSAPrivateKey'{}

 + dsa_private_key() = +

#'DSAPrivateKey'{}

 ec_public_key()

= {#'ECPoint'{}, #'EcpkParameters'{} | {namedCurve, oid()}}

 - ec_private_key() -

= #'ECPrivateKey'{}

 + ec_private_key() = +

#'ECPrivateKey'{}

 - public_crypt_options() -

= [{rsa_pad, rsa_padding()}]

 + public_crypt_options() = +

[{rsa_pad, rsa_padding()}]

 - rsa_padding() -

= 'rsa_pkcs1_padding'

-

| 'rsa_pkcs1_oaep_padding'

-

| 'rsa_no_padding'

+ rsa_padding() = + +

'rsa_pkcs1_padding'

+

| 'rsa_pkcs1_oaep_padding'

+

| 'rsa_no_padding'

 - digest_type() + digest_type() =

Union of rsa_digest_type(), dss_digest_type(), and ecdsa_digest_type().

 - rsa_digest_type() -

= 'md5' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'

 - - dss_digest_type() -

= 'sha'

 - - ecdsa_digest_type() -

= 'sha'| 'sha224' | 'sha256' | 'sha384' | 'sha512'

 - - crl_reason() -

= unspecified

-

| keyCompromise

-

| cACompromise

-

| affiliationChanged

-

| superseded

-

| cessationOfOperation

-

| certificateHold

-

| privilegeWithdrawn

-

| aACompromise

- + rsa_digest_type() = +

'md5' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'

 + + dss_digest_type() = +

'sha'

 - issuer_name() -

= {rdnSequence,[#'AttributeTypeAndValue'{}]}

+ ecdsa_digest_type() = +

'sha'| 'sha224' | 'sha256' | 'sha384' | 'sha512'

 + + crl_reason() = + +

unspecified

+

| keyCompromise

+

| cACompromise

+

| affiliationChanged

+

| superseded

+

| cessationOfOperation

+

| certificateHold

+

| privilegeWithdrawn

+

| aACompromise

 - ssh_file() -

= openssh_public_key

-

| rfc4716_public_key

-

| known_hosts

-

| auth_keys

+ issuer_name() = +

{rdnSequence,[#'AttributeTypeAndValue'{}]}

+ + + ssh_file() = + +

openssh_public_key

+

| rfc4716_public_key

+

| known_hosts

+

| auth_keys

 diff --git a/lib/public_key/doc/src/public_key_records.xml b/lib/public_key/doc/src/public_key_records.xml index 9536167839..fc2a74a353 100644 --- a/lib/public_key/doc/src/public_key_records.xml +++ b/lib/public_key/doc/src/public_key_records.xml @@ -55,17 +55,17 @@ follows here:

- time() -

= uct_time() | general_time()

 + time() = +

uct_time() | general_time()

 - uct_time() -

= {utcTime, "YYMMDDHHMMSSZ"}

 + uct_time() = +

{utcTime, "YYMMDDHHMMSSZ"}

 - general_time() -

= {generalTime, "YYYYMMDDHHMMSSZ"}

 + general_time() = +

{generalTime, "YYYYMMDDHHMMSSZ"}

 - general_name() - =

{rfc822Name, string()}

+ general_name() = +

{rfc822Name, string()}

| {dNSName, string()}

| {x400Address, string()}

| {directoryName, {rdnSequence, [#AttributeTypeAndValue'{}]}}

@@ -77,16 +77,16 @@

| {otherName, term()}

 - special_string() - =

{teletexString, string()}

+ special_string() = +

{teletexString, string()}

| {printableString, string()}

| {universalString, string()}

| {utf8String, binary()}

| {bmpString, string()}

 - dist_reason() - =

unused

+ dist_reason() = +

unused

| keyCompromise

| cACompromise

| affiliationChanged

@@ -97,12 +97,12 @@

| aACompromise

 - OID_macro() - =

?OID_name()

+ OID_macro() = +

?OID_name()

 - OID_name() - =

atom()

+ OID_name() = +

atom()

 -- cgit v1.2.3 From be5abeec807ab642881898033a3d23503ec91ce3 Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Mon, 11 May 2015 16:54:05 +0200 Subject: ssl: Align "=" sign in type declarations to decided policy --- lib/ssl/doc/src/ssl.xml | 124 ++++++++++++++++++++++++------------------------ 1 file changed, 63 insertions(+), 61 deletions(-) diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index 46dc93e343..c4651d051c 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -67,15 +67,15 @@ - boolean() -

= true | false

 + boolean() = +

true | false

 - option() -

= socketoption() | ssloption() | transportoption()

+ option() = +

socketoption() | ssloption() | transportoption()

 - socketoption() -

= proplists:property()

+ socketoption() = +

proplists:property()

The default socket options are [{mode,list},{packet, 0},{header, 0},{active, true}].

For valid options, see the @@ -83,32 +83,34 @@ gen_tcp(3) manual pages in Kernel.

 - ssloption() -

= {verify, verify_type()}

-

| {verify_fun, {fun(), term()}}

-

| {fail_if_no_peer_cert, boolean()} {depth, integer()}

-

| {cert, public_key:der_encoded()}

-

| {certfile, path()}

-

| {key, {'RSAPrivateKey'| 'DSAPrivateKey' | 'ECPrivateKey' - | 'PrivateKeyInfo', public_key:der_encoded()}}

-

| {keyfile, path()}

-

| {password, string()}

-

| {cacerts, [public_key:der_encoded()]}

-

| {cacertfile, path()}

-

| {dh, public_key:der_encoded()}

-

| {dhfile, path()}

-

| {ciphers, ciphers()}

-

| {user_lookup_fun, {fun(), term()}}, {psk_identity, string()}, - {srp_identity, {string(), string()}}

-

| {reuse_sessions, boolean()}

-

| {reuse_session, fun()} {next_protocols_advertised, [binary()]}

-

| {client_preferred_next_protocols, {client | server, - [binary()]} | {client | server, [binary()], binary()}}

-

| {log_alert, boolean()}

-

| {server_name_indication, hostname() | disable}

 - - transportoption() -

= {cb_info, {CallbackModule::atom(), DataTag::atom(), + ssloption() = + +

{verify, verify_type()}

+

| {verify_fun, {fun(), term()}}

+

| {fail_if_no_peer_cert, boolean()} {depth, integer()}

+

| {cert, public_key:der_encoded()}

+

| {certfile, path()}

+

| {key, {'RSAPrivateKey'| 'DSAPrivateKey' | 'ECPrivateKey' + | 'PrivateKeyInfo', public_key:der_encoded()}}

+

| {keyfile, path()}

+

| {password, string()}

+

| {cacerts, [public_key:der_encoded()]}

+

| {cacertfile, path()}

+

| {dh, public_key:der_encoded()}

+

| {dhfile, path()}

+

| {ciphers, ciphers()}

+

| {user_lookup_fun, {fun(), term()}}, {psk_identity, string()}, + {srp_identity, {string(), string()}}

+

| {reuse_sessions, boolean()}

+

| {reuse_session, fun()} {next_protocols_advertised, [binary()]}

+

| {client_preferred_next_protocols, {client | server, + [binary()]} | {client | server, [binary()], binary()}}

+

| {log_alert, boolean()}

+

| {server_name_indication, hostname() | disable}

+ + + transportoption() = +

{cb_info, {CallbackModule::atom(), DataTag::atom(), ClosedTag::atom(), ErrTag:atom()}}

Defaults to {gen_tcp, tcp, tcp_closed, tcp_error}. Can be used to customize the transport layer. The callback module must implement a @@ -129,57 +131,57 @@ - verify_type() -

= verify_none | verify_peer

 + verify_type() = +

verify_none | verify_peer

 - path() -

= string()

+ path() = +

string()

Represents a file path.

 - public_key:der_encoded() -

= binary()

+ public_key:der_encoded() = +

binary()

ASN.1 DER-encoded entity as an Erlang binary.

 - host() -

= hostname() | ipaddress()

 + host() = +

hostname() | ipaddress()

 - hostname() -

= string()

 + hostname() = +

string()

 - ip_address() -

= {N1,N2,N3,N4} % IPv4 | {K1,K2,K3,K4,K5,K6,K7,K8} % IPv6 + ip_address() = +

{N1,N2,N3,N4} % IPv4 | {K1,K2,K3,K4,K5,K6,K7,K8} % IPv6

- sslsocket() -

Opaque to the user.

 + sslsocket() = +

opaque()

 - protocol() -

= sslv3 | tlsv1 | 'tlsv1.1' | 'tlsv1.2'

 + protocol() = +

sslv3 | tlsv1 | 'tlsv1.1' | 'tlsv1.2'

 - ciphers() + ciphers() =

= [ciphersuite()] | string()

According to old API.

 - ciphersuite() -

= {key_exchange(), cipher(), hash()}

 + ciphersuite() = +

{key_exchange(), cipher(), hash()}

 - key_exchange() -

= rsa | dhe_dss | dhe_rsa | dh_anon | psk | dhe_psk + key_exchange()= +

rsa | dhe_dss | dhe_rsa | dh_anon | psk | dhe_psk | rsa_psk | srp_anon | srp_dss | srp_rsa | ecdh_anon | ecdh_ecdsa | ecdhe_ecdsa | ecdh_rsa | ecdhe_rsa

 - cipher() -

= rc4_128 | des_cbc | '3des_ede_cbc' + cipher() = +

rc4_128 | des_cbc | '3des_ede_cbc' | aes_128_cbc | aes_256_cbc | aes_128_gcm | aes_256_gcm

 - hash() -

= md5 | sha

 + hash() = +

md5 | sha

 - prf_random() -

= client_random | server_random

 + prf_random() = +

client_random | server_random

 - srp_param_type() -

= srp_1024 | srp_1536 | srp_2048 | srp_3072 + srp_param_type() = +

srp_1024 | srp_1536 | srp_2048 | srp_3072 | srp_4096 | srp_6144 | srp_8192

 -- cgit v1.2.3