PKIXAlgs-2009 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-algorithms2008-02(56) } DEFINITIONS EXPLICIT TAGS ::= BEGIN IMPORTS PUBLIC-KEY, SIGNATURE-ALGORITHM, DIGEST-ALGORITHM, SMIME-CAPS FROM AlgorithmInformation-2009 {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-algorithmInformation-02(58)} mda-sha224, mda-sha256, mda-sha384, mda-sha512 FROM PKIX1-PSS-OAEP-Algorithms-2009 {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-rsa-pkalgs-02(54)} ; -- -- Public Key (pk-) Algorithms -- PublicKeys PUBLIC-KEY ::= { pk-rsa | pk-dsa | pk-dh | pk-kea, ..., pk-ec | pk-ecDH | pk-ecMQV } -- -- Signature Algorithms (sa-) -- SignatureAlgs SIGNATURE-ALGORITHM ::= { sa-rsaWithMD2 | sa-rsaWithMD5 | sa-rsaWithSHA1 | sa-dsaWithSHA1 | sa-ecdsaWithSHA1, ..., -- Extensible sa-dsaWithSHA224 | sa-dsaWithSHA256 | sa-ecdsaWithSHA224 | sa-ecdsaWithSHA256 | sa-ecdsaWithSHA384 | sa-ecdsaWithSHA512 } -- -- S/MIME CAPS for algorithms in this document -- -- For all of the algorithms laid out in this document, the -- parameters field for the S/MIME capabilities is defined as -- ABSENT as there are no specific values that need to be known -- by the receiver for negotiation. -- SMimeCaps SMIME-CAPS ::= { sa-rsaWithMD2.&smimeCaps | sa-rsaWithMD5.&smimeCaps | sa-rsaWithSHA1.&smimeCaps | sa-dsaWithSHA1.&smimeCaps | sa-dsaWithSHA224.&smimeCaps | sa-dsaWithSHA256.&smimeCaps | sa-ecdsaWithSHA1.&smimeCaps | sa-ecdsaWithSHA224.&smimeCaps | sa-ecdsaWithSHA256.&smimeCaps | sa-ecdsaWithSHA384.&smimeCaps | sa-ecdsaWithSHA512.&smimeCaps, ... } -- RSA PK Algorithm, Parameters, and Keys pk-rsa PUBLIC-KEY ::= { IDENTIFIER rsaEncryption KEY RSAPublicKey PARAMS TYPE NULL ARE absent -- Private key format not in this module -- CERT-KEY-USAGE {digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, cRLSign} } rsaEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 1 } RSAPublicKey ::= SEQUENCE { modulus INTEGER, -- n publicExponent INTEGER -- e } -- DSA PK Algorithm, Parameters, and Keys pk-dsa PUBLIC-KEY ::= { IDENTIFIER id-dsa KEY DSAPublicKey PARAMS TYPE DSA-Params ARE inheritable -- Private key format not in this module -- CERT-KEY-USAGE { digitalSignature, nonRepudiation, keyCertSign, cRLSign } } id-dsa OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 } DSA-Params ::= SEQUENCE { p INTEGER, q INTEGER, g INTEGER } DSAPublicKey ::= INTEGER -- public key, y -- Diffie-Hellman PK Algorithm, Parameters, and Keys pk-dh PUBLIC-KEY ::= { IDENTIFIER dhpublicnumber KEY DHPublicKey PARAMS TYPE DomainParameters ARE inheritable -- Private key format not in this module -- CERT-KEY-USAGE {keyAgreement, encipherOnly, decipherOnly } } dhpublicnumber OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 } DomainParameters ::= SEQUENCE { p INTEGER, -- odd prime, p=jq +1 g INTEGER, -- generator, g q INTEGER, -- factor of p-1 j INTEGER OPTIONAL, -- subgroup factor, j>= 2 validationParams ValidationParams OPTIONAL } ValidationParams ::= SEQUENCE { seed BIT STRING, pgenCounter INTEGER } DiffieHellmanPublicNumber ::= INTEGER -- according to http://wikisec.free.fr/crypto/crypto.html DHPublicKey ::= INTEGER -- public key, y = g^x mod p -- KEA PK Algorithm and Parameters pk-kea PUBLIC-KEY ::= { IDENTIFIER id-keyExchangeAlgorithm -- key is not encoded -- PARAMS TYPE KEA-Params-Id ARE required -- Private key format not in this module -- CERT-KEY-USAGE {keyAgreement, encipherOnly, decipherOnly } } id-keyExchangeAlgorithm OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) dod(2) infosec(1) algorithms(1) 22 } KEA-Params-Id ::= OCTET STRING -- Elliptic Curve (EC) Signatures: Unrestricted Algorithms -- (Section 2.1.1 of RFC 5480) -- -- EC Unrestricted Algorithm ID -- -- this is used for ECDSA pk-ec PUBLIC-KEY ::= { IDENTIFIER id-ecPublicKey KEY ECPoint PARAMS TYPE ECParameters ARE required -- Private key format not in this module -- CERT-KEY-USAGE { digitalSignature, nonRepudiation, keyAgreement, keyCertSign, cRLSign } } ECPoint ::= OCTET STRING -- see RFC 5480 for syntax and restrictions id-ecPublicKey OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 } -- Elliptic Curve (EC) Signatures: Restricted Algorithms -- (Section 2.1.2 of RFC 5480) -- -- EC Diffie-Hellman Algorithm ID pk-ecDH PUBLIC-KEY ::= { IDENTIFIER id-ecDH KEY ECPoint PARAMS TYPE ECParameters ARE required -- Private key format not in this module -- CERT-KEY-USAGE { keyAgreement, encipherOnly, decipherOnly } } id-ecDH OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) schemes(1) ecdh(12) } -- EC Menezes-Qu-Vanstone Algorithm ID pk-ecMQV PUBLIC-KEY ::= { IDENTIFIER id-ecMQV KEY ECPoint PARAMS TYPE ECParameters ARE required -- Private key format not in this module -- CERT-KEY-USAGE { keyAgreement, encipherOnly, decipherOnly } } id-ecMQV OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) schemes(1) ecmqv(13) } -- Parameters and Keys for both Restricted and Unrestricted EC ECParameters ::= CHOICE { namedCurve CURVE.&id({NamedCurve}) -- implicitCurve NULL -- implicitCurve MUST NOT be used in PKIX -- specifiedCurve SpecifiedCurve -- specifiedCurve MUST NOT be used in PKIX -- Details for specifiedCurve can be found in [X9.62] -- Any future additions to this CHOICE should be coordinated -- with ANSI X.9. } -- If you need to be able to decode ANSI X.9 parameter structures, -- uncomment the implicitCurve and specifiedCurve above, and also -- uncomment the following: --(WITH COMPONENTS {namedCurve PRESENT}) -- Sec 2.1.1.1 Named Curve CURVE ::= CLASS { &id OBJECT IDENTIFIER UNIQUE } WITH SYNTAX { ID &id } NamedCurve CURVE ::= { { ID secp192r1 } | { ID sect163k1 } | { ID sect163r2 } | { ID secp224r1 } | { ID sect233k1 } | { ID sect233r1 } | { ID secp256r1 } | { ID sect283k1 } | { ID sect283r1 } | { ID secp384r1 } | { ID sect409k1 } | { ID sect409r1 } | { ID secp521r1 } | { ID sect571k1 } | { ID sect571r1 }, ... -- Extensible } -- Note in [X9.62] the curves are referred to as 'ansiX9' as -- opposed to 'sec'. For example, secp192r1 is the same curve as -- ansix9p192r1. -- Note that in [PKI-ALG] the secp192r1 curve was referred to as -- prime192v1 and the secp256r1 curve was referred to as -- prime256v1. -- Note that [FIPS186-3] refers to secp192r1 as P-192, -- secp224r1 as P-224, secp256r1 as P-256, secp384r1 as P-384, -- and secp521r1 as P-521. secp192r1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 1 } sect163k1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 1 } sect163r2 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 15 } secp224r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 33 } sect233k1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 26 } sect233r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 27 } secp256r1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3) prime(1) 7 } sect283k1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 16 } sect283r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 17 } secp384r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 34 } sect409k1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 36 } sect409r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 37 } secp521r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 35 } sect571k1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 38 } sect571r1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) certicom(132) curve(0) 39 } -- RSA with MD-2 sa-rsaWithMD2 SIGNATURE-ALGORITHM ::= { IDENTIFIER md2WithRSAEncryption PARAMS TYPE NULL ARE required HASHES { mda-md2 } PUBLIC-KEYS { pk-rsa } SMIME-CAPS { IDENTIFIED BY md2WithRSAEncryption } } md2WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 2 } -- RSA with MD-5 sa-rsaWithMD5 SIGNATURE-ALGORITHM ::= { IDENTIFIER md5WithRSAEncryption PARAMS TYPE NULL ARE required HASHES { mda-md5 } PUBLIC-KEYS { pk-rsa } SMIME-CAPS { IDENTIFIED BY md5WithRSAEncryption } } md5WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 4 } -- RSA with SHA-1 sa-rsaWithSHA1 SIGNATURE-ALGORITHM ::= { IDENTIFIER sha1WithRSAEncryption PARAMS TYPE NULL ARE required HASHES { mda-sha1 } PUBLIC-KEYS { pk-rsa } SMIME-CAPS {IDENTIFIED BY sha1WithRSAEncryption } } sha1WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1) 5 } -- DSA with SHA-1 sa-dsaWithSHA1 SIGNATURE-ALGORITHM ::= { IDENTIFIER dsa-with-sha1 VALUE DSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha1 } PUBLIC-KEYS { pk-dsa } SMIME-CAPS { IDENTIFIED BY dsa-with-sha1 } } dsa-with-sha1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 3 } -- DSA with SHA-224 sa-dsaWithSHA224 SIGNATURE-ALGORITHM ::= { IDENTIFIER dsa-with-sha224 VALUE DSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha224 } PUBLIC-KEYS { pk-dsa } SMIME-CAPS { IDENTIFIED BY dsa-with-sha224 } } dsa-with-sha224 OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) algorithms(4) id-dsa-with-sha2(3) 1 } -- DSA with SHA-256 sa-dsaWithSHA256 SIGNATURE-ALGORITHM ::= { IDENTIFIER dsa-with-sha256 VALUE DSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha256 } PUBLIC-KEYS { pk-dsa } SMIME-CAPS { IDENTIFIED BY dsa-with-sha256 } } dsa-with-sha256 OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) algorithms(4) id-dsa-with-sha2(3) 2 } -- ECDSA with SHA-1 sa-ecdsaWithSHA1 SIGNATURE-ALGORITHM ::= { IDENTIFIER ecdsa-with-SHA1 VALUE ECDSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha1 } PUBLIC-KEYS { pk-ec } SMIME-CAPS {IDENTIFIED BY ecdsa-with-SHA1 } } ecdsa-with-SHA1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 } -- ECDSA with SHA-224 sa-ecdsaWithSHA224 SIGNATURE-ALGORITHM ::= { IDENTIFIER ecdsa-with-SHA224 VALUE ECDSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha224 } PUBLIC-KEYS { pk-ec } SMIME-CAPS { IDENTIFIED BY ecdsa-with-SHA224 } } ecdsa-with-SHA224 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 1 } -- ECDSA with SHA-256 sa-ecdsaWithSHA256 SIGNATURE-ALGORITHM ::= { IDENTIFIER ecdsa-with-SHA256 VALUE ECDSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha256 } PUBLIC-KEYS { pk-ec } SMIME-CAPS { IDENTIFIED BY ecdsa-with-SHA256 } } ecdsa-with-SHA256 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 2 } -- ECDSA with SHA-384 sa-ecdsaWithSHA384 SIGNATURE-ALGORITHM ::= { IDENTIFIER ecdsa-with-SHA384 VALUE ECDSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha384 } PUBLIC-KEYS { pk-ec } SMIME-CAPS { IDENTIFIED BY ecdsa-with-SHA384 } } ecdsa-with-SHA384 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 3 } -- ECDSA with SHA-512 sa-ecdsaWithSHA512 SIGNATURE-ALGORITHM ::= { IDENTIFIER ecdsa-with-SHA512 VALUE ECDSA-Sig-Value PARAMS TYPE NULL ARE absent HASHES { mda-sha512 } PUBLIC-KEYS { pk-ec } SMIME-CAPS { IDENTIFIED BY ecdsa-with-SHA512 } } ecdsa-with-SHA512 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) ecdsa-with-SHA2(3) 4 } -- -- Signature Values -- -- DSA DSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } -- ECDSA ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } -- -- Message Digest Algorithms (mda-) -- HashAlgs DIGEST-ALGORITHM ::= { mda-md2 | mda-md5 | mda-sha1, ... -- Extensible } -- MD-2 mda-md2 DIGEST-ALGORITHM ::= { IDENTIFIER id-md2 PARAMS TYPE NULL ARE preferredAbsent } id-md2 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2 } -- MD-5 mda-md5 DIGEST-ALGORITHM ::= { IDENTIFIER id-md5 PARAMS TYPE NULL ARE preferredAbsent } id-md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5 } -- SHA-1 mda-sha1 DIGEST-ALGORITHM ::= { IDENTIFIER id-sha1 PARAMS TYPE NULL ARE preferredAbsent } id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) oiw(14) secsig(3) algorithm(2) 26 } END