426 lines
13 KiB
Groff
426 lines
13 KiB
Groff
EnrollmentMessageSyntax-2011-v88
|
|
{ iso(1) identified-organization(3) dod(6) internet(1)
|
|
security(5) mechanisms(5) pkix(7) id-mod(0)
|
|
id-mod-enrollMsgSyntax-2011-88(76) }
|
|
|
|
DEFINITIONS IMPLICIT TAGS ::=
|
|
BEGIN
|
|
|
|
-- EXPORTS All --
|
|
-- The types and values defined in this module are exported for use
|
|
-- in the other ASN.1 modules. Other applications may use them for
|
|
-- their own purposes.
|
|
|
|
-- fake imports
|
|
|
|
-- PKIX Part 1 - Implicit From [RFC5280]
|
|
GeneralName ::= CHOICE { any ANY }
|
|
CRLReason ::= INTEGER
|
|
ReasonFlags ::= BIT STRING
|
|
GeneralNames ::= ANY
|
|
|
|
-- PKIX Part 1 - Explicit From [RFC5280]
|
|
AlgorithmIdentifier ::= ANY
|
|
Extension ::= ANY
|
|
Name ::= CHOICE { any ANY }
|
|
CertificateSerialNumber ::= INTEGER
|
|
|
|
-- Cryptographic Message Syntax FROM [CMS]
|
|
ContentInfo ::= ANY
|
|
Attribute ::= ANY
|
|
IssuerAndSerialNumber ::= ANY
|
|
|
|
-- CRMF FROM [RFC4211]
|
|
CertReqMsg ::= ANY
|
|
PKIPublicationInfo ::= ANY
|
|
CertTemplate ::= ANY
|
|
|
|
-- Global Types
|
|
-- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
|
|
-- The content of this type conforms to RFC 3629.
|
|
|
|
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
|
|
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
|
|
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
|
|
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
|
|
|
|
id-cmc OBJECT IDENTIFIER ::= {id-pkix 7} -- CMC controls
|
|
id-cct OBJECT IDENTIFIER ::= {id-pkix 12} -- CMC content types
|
|
|
|
-- The following controls have the type OCTET STRING
|
|
|
|
id-cmc-identityProof OBJECT IDENTIFIER ::= {id-cmc 3}
|
|
id-cmc-dataReturn OBJECT IDENTIFIER ::= {id-cmc 4}
|
|
id-cmc-regInfo OBJECT IDENTIFIER ::= {id-cmc 18}
|
|
id-cmc-responseInfo OBJECT IDENTIFIER ::= {id-cmc 19}
|
|
id-cmc-queryPending OBJECT IDENTIFIER ::= {id-cmc 21}
|
|
id-cmc-popLinkRandom OBJECT IDENTIFIER ::= {id-cmc 22}
|
|
id-cmc-popLinkWitness OBJECT IDENTIFIER ::= {id-cmc 23}
|
|
|
|
-- The following controls have the type UTF8String
|
|
|
|
id-cmc-identification OBJECT IDENTIFIER ::= {id-cmc 2}
|
|
|
|
-- The following controls have the type INTEGER
|
|
|
|
id-cmc-transactionId OBJECT IDENTIFIER ::= {id-cmc 5}
|
|
|
|
-- The following controls have the type OCTET STRING
|
|
|
|
id-cmc-senderNonce OBJECT IDENTIFIER ::= {id-cmc 6}
|
|
id-cmc-recipientNonce OBJECT IDENTIFIER ::= {id-cmc 7}
|
|
|
|
-- This is the content type used for a request message
|
|
-- in the protocol
|
|
|
|
id-cct-PKIData OBJECT IDENTIFIER ::= { id-cct 2 }
|
|
|
|
PKIData ::= SEQUENCE {
|
|
controlSequence SEQUENCE SIZE(0..MAX) OF TaggedAttribute,
|
|
reqSequence SEQUENCE SIZE(0..MAX) OF TaggedRequest,
|
|
cmsSequence SEQUENCE SIZE(0..MAX) OF TaggedContentInfo,
|
|
otherMsgSequence SEQUENCE SIZE(0..MAX) OF OtherMsg
|
|
}
|
|
|
|
bodyIdMax INTEGER ::= 4294967295
|
|
|
|
BodyPartID ::= INTEGER(0..bodyIdMax)
|
|
|
|
TaggedAttribute ::= SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
attrType OBJECT IDENTIFIER,
|
|
attrValues SET OF AttributeValue
|
|
}
|
|
|
|
AttributeValue ::= ANY
|
|
|
|
TaggedRequest ::= CHOICE {
|
|
tcr [0] TaggedCertificationRequest,
|
|
crm [1] CertReqMsg,
|
|
orm [2] SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
requestMessageType OBJECT IDENTIFIER,
|
|
requestMessageValue ANY DEFINED BY requestMessageType
|
|
}
|
|
}
|
|
|
|
TaggedCertificationRequest ::= SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
certificationRequest CertificationRequest
|
|
}
|
|
|
|
CertificationRequest ::= SEQUENCE {
|
|
certificationRequestInfo SEQUENCE {
|
|
version INTEGER,
|
|
subject Name,
|
|
subjectPublicKeyInfo SEQUENCE {
|
|
algorithm AlgorithmIdentifier,
|
|
subjectPublicKey BIT STRING },
|
|
attributes [0] IMPLICIT SET OF Attribute },
|
|
signatureAlgorithm AlgorithmIdentifier,
|
|
signature BIT STRING
|
|
}
|
|
|
|
TaggedContentInfo ::= SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
contentInfo ContentInfo
|
|
}
|
|
|
|
OtherMsg ::= SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
otherMsgType OBJECT IDENTIFIER,
|
|
otherMsgValue ANY DEFINED BY otherMsgType }
|
|
|
|
-- This defines the response message in the protocol
|
|
id-cct-PKIResponse OBJECT IDENTIFIER ::= { id-cct 3 }
|
|
|
|
|
|
ResponseBody ::= PKIResponse
|
|
|
|
PKIResponse ::= SEQUENCE {
|
|
controlSequence SEQUENCE SIZE(0..MAX) OF TaggedAttribute,
|
|
cmsSequence SEQUENCE SIZE(0..MAX) OF TaggedContentInfo,
|
|
otherMsgSequence SEQUENCE SIZE(0..MAX) OF OtherMsg
|
|
|
|
}
|
|
|
|
-- Used to return status state in a response
|
|
|
|
id-cmc-statusInfo OBJECT IDENTIFIER ::= {id-cmc 1}
|
|
|
|
CMCStatusInfo ::= SEQUENCE {
|
|
cMCStatus CMCStatus,
|
|
bodyList SEQUENCE SIZE (1..MAX) OF BodyPartID,
|
|
statusString UTF8String OPTIONAL,
|
|
otherInfo CHOICE {
|
|
failInfo CMCFailInfo,
|
|
pendInfo PendInfo } OPTIONAL
|
|
}
|
|
|
|
PendInfo ::= SEQUENCE {
|
|
pendToken OCTET STRING,
|
|
pendTime GeneralizedTime
|
|
}
|
|
|
|
CMCStatus ::= INTEGER {
|
|
success (0),
|
|
failed (2),
|
|
pending (3),
|
|
noSupport (4),
|
|
confirmRequired (5),
|
|
popRequired (6),
|
|
partial (7)
|
|
}
|
|
|
|
|
|
-- Note:
|
|
-- The spelling of unsupportedExt is corrected in this version.
|
|
-- In RFC 2797, it was unsuportedExt.
|
|
|
|
CMCFailInfo ::= INTEGER {
|
|
badAlg (0),
|
|
badMessageCheck (1),
|
|
badRequest (2),
|
|
badTime (3),
|
|
badCertId (4),
|
|
unsupportedExt (5),
|
|
mustArchiveKeys (6),
|
|
badIdentity (7),
|
|
popRequired (8),
|
|
popFailed (9),
|
|
noKeyReuse (10),
|
|
internalCAError (11),
|
|
tryLater (12),
|
|
authDataFail (13)
|
|
}
|
|
|
|
-- Used for RAs to add extensions to certification requests
|
|
id-cmc-addExtensions OBJECT IDENTIFIER ::= {id-cmc 8}
|
|
|
|
AddExtensions ::= SEQUENCE {
|
|
pkiDataReference BodyPartID,
|
|
certReferences SEQUENCE OF BodyPartID,
|
|
extensions SEQUENCE OF Extension
|
|
}
|
|
|
|
|
|
id-cmc-encryptedPOP OBJECT IDENTIFIER ::= {id-cmc 9}
|
|
id-cmc-decryptedPOP OBJECT IDENTIFIER ::= {id-cmc 10}
|
|
|
|
EncryptedPOP ::= SEQUENCE {
|
|
request TaggedRequest,
|
|
cms ContentInfo,
|
|
thePOPAlgID AlgorithmIdentifier,
|
|
witnessAlgID AlgorithmIdentifier,
|
|
witness OCTET STRING
|
|
}
|
|
|
|
DecryptedPOP ::= SEQUENCE {
|
|
bodyPartID BodyPartID,
|
|
thePOPAlgID AlgorithmIdentifier,
|
|
thePOP OCTET STRING
|
|
}
|
|
|
|
id-cmc-lraPOPWitness OBJECT IDENTIFIER ::= {id-cmc 11}
|
|
|
|
LraPopWitness ::= SEQUENCE {
|
|
pkiDataBodyid BodyPartID,
|
|
bodyIds SEQUENCE OF BodyPartID
|
|
}
|
|
|
|
--
|
|
id-cmc-getCert OBJECT IDENTIFIER ::= {id-cmc 15}
|
|
|
|
GetCert ::= SEQUENCE {
|
|
issuerName GeneralName,
|
|
serialNumber INTEGER }
|
|
|
|
id-cmc-getCRL OBJECT IDENTIFIER ::= {id-cmc 16}
|
|
|
|
GetCRL ::= SEQUENCE {
|
|
issuerName Name,
|
|
cRLName GeneralName OPTIONAL,
|
|
time GeneralizedTime OPTIONAL,
|
|
reasons ReasonFlags OPTIONAL }
|
|
|
|
id-cmc-revokeRequest OBJECT IDENTIFIER ::= {id-cmc 17}
|
|
|
|
RevokeRequest ::= SEQUENCE {
|
|
issuerName Name,
|
|
serialNumber INTEGER,
|
|
reason CRLReason,
|
|
invalidityDate GeneralizedTime OPTIONAL,
|
|
passphrase OCTET STRING OPTIONAL,
|
|
comment UTF8String OPTIONAL }
|
|
|
|
id-cmc-confirmCertAcceptance OBJECT IDENTIFIER ::= {id-cmc 24}
|
|
|
|
CMCCertId ::= IssuerAndSerialNumber
|
|
|
|
-- The following is used to request V3 extensions be added to a
|
|
-- certificate
|
|
|
|
id-ExtensionReq OBJECT IDENTIFIER ::= {iso(1) member-body(2)
|
|
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 14}
|
|
|
|
ExtensionReq ::= SEQUENCE SIZE (1..MAX) OF Extension
|
|
|
|
-- The following exists to allow Diffie-Hellman Certification
|
|
-- Request Messages to be well-formed
|
|
|
|
id-alg-noSignature OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 2}
|
|
|
|
NoSignatureValue ::= OCTET STRING
|
|
|
|
-- Unauthenticated attribute to carry removable data.
|
|
-- This could be used in an update of "CMC Extensions: Server
|
|
-- Side Key Generation and Key Escrow" (February 2005) and in
|
|
-- other documents.
|
|
|
|
id-aa OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
|
|
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2)}
|
|
id-aa-cmc-unsignedData OBJECT IDENTIFIER ::= {id-aa 34}
|
|
|
|
CMCUnsignedData ::= SEQUENCE {
|
|
bodyPartPath BodyPartPath,
|
|
identifier OBJECT IDENTIFIER,
|
|
content ANY DEFINED BY identifier
|
|
}
|
|
|
|
-- Replaces CMC Status Info
|
|
--
|
|
|
|
id-cmc-statusInfoV2 OBJECT IDENTIFIER ::= {id-cmc 25}
|
|
|
|
CMCStatusInfoV2 ::= SEQUENCE {
|
|
cMCStatus CMCStatus,
|
|
bodyList SEQUENCE SIZE (1..MAX) OF
|
|
BodyPartReference,
|
|
statusString UTF8String OPTIONAL,
|
|
otherInfo CHOICE {
|
|
failInfo CMCFailInfo,
|
|
pendInfo PendInfo,
|
|
extendedFailInfo SEQUENCE {
|
|
failInfoOID OBJECT IDENTIFIER,
|
|
failInfoValue AttributeValue
|
|
}
|
|
} OPTIONAL
|
|
}
|
|
|
|
BodyPartReference ::= CHOICE {
|
|
bodyPartID BodyPartID,
|
|
bodyPartPath BodyPartPath
|
|
}
|
|
|
|
BodyPartPath ::= SEQUENCE SIZE (1..MAX) OF BodyPartID
|
|
|
|
-- Allow for distribution of trust anchors
|
|
--
|
|
|
|
id-cmc-trustedAnchors OBJECT IDENTIFIER ::= {id-cmc 26}
|
|
|
|
PublishTrustAnchors ::= SEQUENCE {
|
|
seqNumber INTEGER,
|
|
hashAlgorithm AlgorithmIdentifier,
|
|
anchorHashes SEQUENCE OF OCTET STRING
|
|
}
|
|
|
|
id-cmc-authData OBJECT IDENTIFIER ::= {id-cmc 27}
|
|
|
|
AuthPublish ::= BodyPartID
|
|
|
|
-- These two items use BodyPartList
|
|
id-cmc-batchRequests OBJECT IDENTIFIER ::= {id-cmc 28}
|
|
id-cmc-batchResponses OBJECT IDENTIFIER ::= {id-cmc 29}
|
|
|
|
BodyPartList ::= SEQUENCE SIZE (1..MAX) OF BodyPartID
|
|
|
|
--
|
|
id-cmc-publishCert OBJECT IDENTIFIER ::= {id-cmc 30}
|
|
|
|
CMCPublicationInfo ::= SEQUENCE {
|
|
hashAlg AlgorithmIdentifier,
|
|
certHashes SEQUENCE OF OCTET STRING,
|
|
pubInfo PKIPublicationInfo
|
|
}
|
|
|
|
id-cmc-modCertTemplate OBJECT IDENTIFIER ::= {id-cmc 31}
|
|
|
|
ModCertTemplate ::= SEQUENCE {
|
|
pkiDataReference BodyPartPath,
|
|
certReferences BodyPartList,
|
|
replace BOOLEAN DEFAULT TRUE,
|
|
certTemplate CertTemplate
|
|
}
|
|
|
|
-- Inform follow-on servers that one or more controls have already
|
|
-- been processed
|
|
|
|
id-cmc-controlProcessed OBJECT IDENTIFIER ::= {id-cmc 32}
|
|
|
|
ControlsProcessed ::= SEQUENCE {
|
|
bodyList SEQUENCE SIZE(1..MAX) OF BodyPartReference
|
|
}
|
|
|
|
-- Identity Proof control w/ algorithm agility
|
|
|
|
id-cmc-identityProofV2 OBJECT IDENTIFIER ::= { id-cmc 34 }
|
|
|
|
|
|
|
|
IdentifyProofV2 ::= SEQUENCE {
|
|
proofAlgID AlgorithmIdentifier,
|
|
macAlgId AlgorithmIdentifier,
|
|
witness OCTET STRING
|
|
}
|
|
|
|
id-cmc-popLinkWitnessV2 OBJECT IDENTIFIER ::= { id-cmc 33 }
|
|
PopLinkWitnessV2 ::= SEQUENCE {
|
|
keyGenAlgorithm AlgorithmIdentifier,
|
|
macAlgorithm AlgorithmIdentifier,
|
|
witness OCTET STRING
|
|
}
|
|
|
|
--
|
|
|
|
id-cmc-raIdentityWitness OBJECT IDENTIFIER ::= {id-cmc 35}
|
|
|
|
|
|
--
|
|
-- Allow for an End-Entity to request a change in name.
|
|
-- This item is added to RegControlSet in CRMF.
|
|
--
|
|
|
|
id-cmc-changeSubjectName OBJECT IDENTIFIER ::= {id-cmc 36}
|
|
|
|
ChangeSubjectName ::= SEQUENCE {
|
|
subject Name OPTIONAL,
|
|
subjectAlt GeneralNames OPTIONAL
|
|
}
|
|
-- (WITH COMPONENTS {..., subject PRESENT} |
|
|
-- WITH COMPONENTS {..., subjectAlt PRESENT} )
|
|
|
|
--
|
|
-- Embedded response from a third party for processing
|
|
--
|
|
|
|
id-cmc-responseBody OBJECT IDENTIFIER ::= {id-cmc 37}
|
|
|
|
--
|
|
-- Key purpose identifiers are in the Extended Key Usage extension
|
|
--
|
|
|
|
id-kp-cmcCA OBJECT IDENTIFIER ::= { id-kp 27 }
|
|
id-kp-cmcRA OBJECT IDENTIFIER ::= { id-kp 28 }
|
|
id-kp-cmcArchive OBJECT IDENTIFIER ::= { id-kp 28 }
|
|
|
|
|
|
|
|
--
|
|
-- Subject Information Access identifier
|
|
--
|
|
|
|
id-ad-cmc OBJECT IDENTIFIER ::= { id-ad 12 }
|
|
|
|
END
|