aboutsummaryrefslogtreecommitdiffstats
path: root/lib/asn1/test/asn1_SUITE_data/rfcs/AuthenticationFramework.asn1
blob: 5cfa9062f0097bfb57331094ab12fdf7a4fba851 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
-- Module AuthenticationFramework (X.509:08/1997)

AuthenticationFramework {joint-iso-itu-t ds(5) module(1)
  authenticationFramework(7) 3} DEFINITIONS ::=
BEGIN

--  EXPORTS All 
--  The types and values defined in this module are exported for use in the other ASN.1 modules contained
--  within the Directory Specifications, and for the use of other applications which will use them to access
--  Directory services. Other applications may use them for their own purposes, but this will not constrain
--  extensions and modifications needed to maintain or improve the Directory service.
IMPORTS
  id-at, id-mr, informationFramework, upperBounds, selectedAttributeTypes,
    basicAccessControl, certificateExtensions
    FROM UsefulDefinitions {joint-iso-itu-t ds(5) module(1)
      usefulDefinitions(0) 3}
  Name, ATTRIBUTE, AttributeType, MATCHING-RULE, Attribute
    FROM InformationFramework informationFramework
  ub-user-password
    FROM UpperBounds upperBounds
  AuthenticationLevel
    FROM BasicAccessControl basicAccessControl
  UniqueIdentifier, octetStringMatch
    FROM SelectedAttributeTypes selectedAttributeTypes
  certificateExactMatch, certificatePairExactMatch, certificateListExactMatch,
    GeneralNames
    FROM CertificateExtensions certificateExtensions;

--  basic certificate definition
Certificate ::=
  SIGNED
    {SEQUENCE {version                  [0]  Version DEFAULT v1,
               serialNumber             CertificateSerialNumber,
               signature                AlgorithmIdentifier,
               issuer                   Name,
               validity                 Validity,
               subject                  Name,
               subjectPublicKeyInfo     SubjectPublicKeyInfo,
               issuerUniqueIdentifier   [1] IMPLICIT UniqueIdentifier OPTIONAL,
               --  if present, version must be v2 or v3
               subjectUniqueIdentifier  [2] IMPLICIT UniqueIdentifier OPTIONAL,
               --  if present, version must be v2 or v3
               extensions               [3]  Extensions OPTIONAL
               --  If present, version must be v3 -- }}

Version ::= INTEGER {v1(0), v2(1), v3(2)}

CertificateSerialNumber ::= INTEGER

AlgorithmIdentifier ::= SEQUENCE {
  algorithm   ALGORITHM.&id({SupportedAlgorithms}),
  parameters  ALGORITHM.&Type({SupportedAlgorithms}{@algorithm}) OPTIONAL
}

--	Definition of the following information object set is deferred, perhaps to standardized
--	profiles or to protocol implementation conformance statements. The set is required to
--	specify a table constraint on the parameters component of AlgorithmIdentifier.
SupportedAlgorithms ALGORITHM ::=
{...}

Validity ::= SEQUENCE {notBefore  Time,
                       notAfter   Time
}

SubjectPublicKeyInfo ::= SEQUENCE {
  algorithm         AlgorithmIdentifier,
  subjectPublicKey  BIT STRING
}

Time ::= CHOICE {utcTime          UTCTime,
                 generalizedTime  GeneralizedTime
}

Extensions ::= SEQUENCE OF Extension

--  For those extensions where ordering of individual extensions within the SEQUENCE is significant, the
--  specification of those individual extensions shall include the rules for the significance of the order therein
Extension ::= SEQUENCE {
  extnId     EXTENSION.&id({ExtensionSet}),
  critical   BOOLEAN DEFAULT FALSE,
  extnValue  OCTET STRING--  contains a DER encoding of a value of type &ExtnType
--  for the extension object identified by extnId 
}

ExtensionSet EXTENSION ::=
  {...}

EXTENSION ::= CLASS {&id        OBJECT IDENTIFIER UNIQUE,
                     &ExtnType  
}WITH SYNTAX {SYNTAX &ExtnType
              IDENTIFIED BY &id
}

--  other certificate constructs
Certificates ::= SEQUENCE {
  userCertificate    Certificate,
  certificationPath  ForwardCertificationPath OPTIONAL
}

ForwardCertificationPath ::= SEQUENCE OF CrossCertificates

CrossCertificates ::= SET OF Certificate

CertificationPath ::= SEQUENCE {
  userCertificate    Certificate,
  theCACertificates  SEQUENCE OF CertificatePair OPTIONAL
}

CertificatePair ::= SEQUENCE {
  issuedByThisCA  [0]  Certificate OPTIONAL,
  issuedToThisCA  [1]  Certificate OPTIONAL
  --  at least one of the pair shall be present 
}

--  Certificate Revocation List (CRL)
CertificateList ::=
  SIGNED
    {SEQUENCE {version              Version OPTIONAL,
               --  if present, version must be v2
               signature            AlgorithmIdentifier,
               issuer               Name,
               thisUpdate           Time,
               nextUpdate           Time OPTIONAL,
               revokedCertificates
                 SEQUENCE OF
                   SEQUENCE {userCertificate     CertificateSerialNumber,
                             revocationDate      Time,
                             crlEntryExtensions  Extensions OPTIONAL} OPTIONAL,
               crlExtensions        [0]  Extensions OPTIONAL}}

--  attribute certificate
AttributeCertificationPath ::= SEQUENCE {
  attributeCertificate  AttributeCertificate,
  acPath                SEQUENCE OF ACPathData OPTIONAL
}

ACPathData ::= SEQUENCE {
  certificate           [0]  Certificate OPTIONAL,
  attributeCertificate  [1]  AttributeCertificate OPTIONAL
}

attributeCertificate ATTRIBUTE ::= {
  WITH SYNTAX             AttributeCertificate
  EQUALITY MATCHING RULE  attributeCertificateMatch
  ID                      id-at-attributeCertificate
}

AttributeCertificate ::= SIGNED{AttributeCertificateInfo}

AttributeCertificateInfo ::= SEQUENCE {
  version                Version DEFAULT v1,
  subject
    CHOICE {baseCertificateID  [0]  IssuerSerial, --  associated  with a Public Key Certificate--
            subjectName        [1]  GeneralNames}, --  associated  with a name
  issuer                 GeneralNames, --  CA issuing the attribute certificate
  signature              AlgorithmIdentifier,
  serialNumber           CertificateSerialNumber,
  attCertValidityPeriod  AttCertValidityPeriod,
  attributes             SEQUENCE OF Attribute,
  issuerUniqueID         UniqueIdentifier OPTIONAL,
  extensions             Extensions OPTIONAL
}

IssuerSerial ::= SEQUENCE {
  issuer     GeneralNames,
  serial     CertificateSerialNumber,
  issuerUID  UniqueIdentifier OPTIONAL
}

AttCertValidityPeriod ::= SEQUENCE {
  notBeforeTime  GeneralizedTime,
  notAfterTime   GeneralizedTime
}

attributeCertificateMatch MATCHING-RULE ::= {
  SYNTAX  AttributeCertificateAssertion
  ID      id-mr-attributeCertificateMatch
}

AttributeCertificateAssertion ::= SEQUENCE {
  subject
    [0]  CHOICE {baseCertificateID  [0]  IssuerSerial,
                 subjectName        [1]  Name} OPTIONAL,
  issuer           [1]  Name OPTIONAL,
  attCertValidity  [2]  GeneralizedTime OPTIONAL,
  attType          [3]  SET OF AttributeType OPTIONAL
}

--  At least one component of the sequence must be present
--  attribute types 
userPassword ATTRIBUTE ::= {
  WITH SYNTAX             OCTET STRING(SIZE (0..ub-user-password))
  EQUALITY MATCHING RULE  octetStringMatch
  ID                      id-at-userPassword
}

userCertificate ATTRIBUTE ::= {
  WITH SYNTAX             Certificate
  EQUALITY MATCHING RULE  certificateExactMatch
  ID                      id-at-userCertificate
}

cACertificate ATTRIBUTE ::= {
  WITH SYNTAX             Certificate
  EQUALITY MATCHING RULE  certificateExactMatch
  ID                      id-at-cAcertificate
}

crossCertificatePair ATTRIBUTE ::= {
  WITH SYNTAX             CertificatePair
  EQUALITY MATCHING RULE  certificatePairExactMatch
  ID                      id-at-crossCertificatePair
}

authorityRevocationList ATTRIBUTE ::= {
  WITH SYNTAX             CertificateList
  EQUALITY MATCHING RULE  certificateListExactMatch
  ID                      id-at-authorityRevocationList
}

certificateRevocationList ATTRIBUTE ::= {
  WITH SYNTAX             CertificateList
  EQUALITY MATCHING RULE  certificateListExactMatch
  ID                      id-at-certificateRevocationList
}

attributeCertificateRevocationList ATTRIBUTE ::= {
  WITH SYNTAX  CertificateList
  ID           id-at-attributeCertificateRevocationList
}

--  information object classes 
ALGORITHM ::= TYPE-IDENTIFIER

--  parameterized types 
HASH{ToBeHashed} ::= SEQUENCE {
  algorithmIdentifier  AlgorithmIdentifier,
  hashValue
    BIT STRING
      (CONSTRAINED BY {
         -- must be the result of applying a hashing procedure to the DER-encoded octets 
         -- of a value of -- ToBeHashed})
}

ENCRYPTED-HASH{ToBeSigned} ::=
  BIT STRING
    (CONSTRAINED BY {
       --  must be the result of applying a hashing procedure to the DER-encoded octets 
       --  of a value of --ToBeSigned --  and then applying an encipherment procedure to those octets --})

ENCRYPTED{ToBeEnciphered} ::=
  BIT STRING
    (CONSTRAINED BY {
       --  must be the result of applying an encipherment procedure 
       --  to the BER-encoded octets of a value of --ToBeEnciphered})

SIGNATURE{ToBeSigned} ::= SEQUENCE {
  algorithmIdentifier  AlgorithmIdentifier,
  encrypted            ENCRYPTED-HASH{ToBeSigned}
}

SIGNED{ToBeSigned} ::= SEQUENCE {
  toBeSigned  ToBeSigned,
  COMPONENTS OF SIGNATURE{ToBeSigned}
}

--  object identifier assignments 
id-at-userPassword OBJECT IDENTIFIER ::=
  {id-at 35}

id-at-userCertificate OBJECT IDENTIFIER ::= {id-at 36}

id-at-cAcertificate OBJECT IDENTIFIER ::= {id-at 37}

id-at-authorityRevocationList OBJECT IDENTIFIER ::= {id-at 38}

id-at-certificateRevocationList OBJECT IDENTIFIER ::= {id-at 39}

id-at-crossCertificatePair OBJECT IDENTIFIER ::= {id-at 40}

id-at-attributeCertificate OBJECT IDENTIFIER ::= {id-at 58}

id-at-attributeCertificateRevocationList OBJECT IDENTIFIER ::= {id-at 59}

id-mr-attributeCertificateMatch OBJECT IDENTIFIER ::= {id-mr 42}

END

-- Generated by Asnp, the ASN.1 pretty-printer of France Telecom R&D