Current section
Files
Jump to
Current section
Files
priv/csr/KEP.asn1
-- http://www.dsszzi.gov.ua/dsszzi/control/uk/publish/article?art_id=77726
-- https://zakon.rada.gov.ua/laws/show/z1401-12
-- https://zakon.rada.gov.ua/laws/show/z1402-12
-- https://zakon.rada.gov.ua/laws/show/z0607-17
-- https://zakon.rada.gov.ua/laws/show/z2230-13
-- https://zakon.rada.gov.ua/laws/show/z1398-12
-- PKCS + OCSP + TSP + Authentication + Information (X.501:08, X.509:08, X.511:08, X.520:08).
-- from: Наказ Міністерства юстиції України,
-- to: Адміністрації Державної служби спеціального зв’язку та захисту інформації України
-- date: 20.08.2012 #1236/5/453
KEP DEFINITIONS IMPLICIT TAGS ::= BEGIN
IMPORTS Certificate FROM PKIX1Explicit88
Attribute FROM InformationFramework
AttributeCertificate, CertificateSerialNumber, Extensions, Version FROM AuthenticationFramework
PolicyInformation, CRLReason FROM CertificateExtensions
PKIStatusInfo FROM PKIXCMP-2009 ;
Name ::= CHOICE { rdnSequence RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
DistinguishedName ::= RDNSequence
RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
AttributeTypeX ::= OBJECT IDENTIFIER
AttributeValueX ::= CHOICE {
utf8 UTF8String,
printable PrintableString }
AttributeTypeAndValue ::= SEQUENCE {
type AttributeTypeX,
value AttributeValueX }
Time ::= CHOICE {
utcTime UTCTime,
generalTime GeneralizedTime }
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY OPTIONAL }
ListCertificateList ::= SEQUENCE OF CertificateList
CertificateList ::= SEQUENCE {
tbsCertList TBSCertList,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING OPTIONAL }
TBSCertList ::= SEQUENCE {
version ANY OPTIONAL,
signature ANY,
issuer ANY,
thisUpdate ANY OPTIONAL,
nextUpdate ANY OPTIONAL,
revokedCertificates SEQUENCE OF SEQUENCE {
userCertificate CertificateSerialNumber,
revocationDate Time,
crlEntryExtensions Extensions OPTIONAL} OPTIONAL,
crlExtensions [0] EXPLICIT ANY OPTIONAL
}
ContentInfo ::= SEQUENCE {
contentType ContentType,
content [0] EXPLICIT ANY DEFINED BY contentType }
UnknownInfo ::= NULL
ContentTimeStamp ::= TimeStampToken
CMSVersion ::= INTEGER {v0(0), v1(1), v2(2), v3(3), v4(4), v5(5)}
gost34311 OBJECT IDENTIFIER ::= {iso(1) member-body(2) ua(804) root(2) security(1) cryptography(1) pki(1) pki-alg(1) pki-alg-hash (2) 1}
OTHER-NAME ::= TYPE-IDENTIFIER
GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
GeneralName ::= CHOICE {
otherName [0] INSTANCE OF OTHER-NAME,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
directoryName [4] Name,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER
}
TSAPolicyId ::= OBJECT IDENTIFIER
SignatureAlgorithmIdentifier ::= AlgorithmIdentifier
KeyIdentifier ::= OCTET STRING
SubjectKeyIdentifier ::= KeyIdentifier
RevocationInfoChoices ::= SET OF CertificateList
SignerInfos ::= SET OF SignerInfo
CertificateSet ::= SET OF Certificate
Certificates ::= SEQUENCE OF Certificate
SignedData ::= SEQUENCE {
version CMSVersion,
digestAlgorithms DigestAlgorithmIdentifiers,
encapContentInfo EncapsulatedContentInfo,
certificates [0] IMPLICIT CertificateSet OPTIONAL,
crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
signerInfos SignerInfos }
EnvelopedData ::= SEQUENCE {
version INTEGER,
recipientInfos RecipientInfos,
encryptedContentInfo EncryptedContentInfo
}
RecipientInfos ::= CHOICE { riSet SET OF RecipientInfo, riSequence SEQUENCE OF RecipientInfo }
EncryptedContentInfo ::= SEQUENCE {
contentType ContentType,
contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
encryptedContent [0] IMPLICIT EncryptedContent OPTIONAL
}
ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
KeyEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
EncryptedContent ::= OCTET STRING
RecipientInfoUA ::= SEQUENCE {
version INTEGER {riVer0(0)} (riVer0),
issuerAndSerialNumber IssuerAndSerialNumber,
keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
encryptedKey EncryptedKey
}
RecipientInfo ::= CHOICE { -- CMS v5
ktri RecipientInfoUA,
kari [1] OCTET STRING,
kekri [2] OCTET STRING,
pwri [3] OCTET STRING,
ori [4] OCTET STRING
}
EncryptedKey ::= OCTET STRING
EncapsulatedContentInfo ::= SEQUENCE {
eContentType ContentType,
eContent [0] EXPLICIT OCTET STRING OPTIONAL }
SignerInfo ::= SEQUENCE {
version CMSVersion,
sid SignerIdentifier,
digestAlgorithm DigestAlgorithmIdentifier,
signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
signatureAlgorithm SignatureAlgorithmIdentifier,
signature OCTET STRING,
unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL }
SignerIdentifier ::= CHOICE {
issuerAndSerialNumber IssuerAndSerialNumber,
subjectKeyIdentifier [0] SubjectKeyIdentifier }
IssuerAndSerialNumber ::= SEQUENCE {
issuer Name,
serialNumber INTEGER }
Hash ::= OCTET STRING
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber}
ESSCertIDv2 ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
certHash Hash,
issuerSerial IssuerSerial}
OtherHashValue ::= OCTET STRING
OtherHashAlgAndValue ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
hashValue OtherHashValue }
SPuri ::= IA5String
SigPolicyId ::= OBJECT IDENTIFIER
SigPolicyHash ::= OtherHashAlgAndValue
SigPolicyQualifierId ::= OBJECT IDENTIFIER
SignaturePolicyIdentifier ::= CHOICE {
signaturePolicy SignaturePolicyId }
SigPolicyQualifierInfo ::= SEQUENCE {
sigPolicyQualifierId SigPolicyQualifierId,
sigQualifier ANY DEFINED BY sigPolicyQualifierId }
SignaturePolicyId ::= SEQUENCE {
sigPolicyId SigPolicyId,
sigPolicyHash SigPolicyHash OPTIONAL }
DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
DigestAlgorithmIdentifier ::= AlgorithmIdentifier
CertificateSerialNumber ::= INTEGER
SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute
Attribute ::= SEQUENCE {attrType OBJECT IDENTIFIER, attrValues SET OF AttributeValue }
AttributeValue ::= ANY
MessageDigest ::= OCTET STRING
SigningCertificateV2 ::= SEQUENCE {certs SEQUENCE OF ESSCertIDv2, policies SEQUENCE OF PolicyInformation OPTIONAL}
SignaturePolicyImplied ::= NULL
DisplayText ::= CHOICE {
visibleString VisibleString (SIZE (1..2200)),
bmpString BMPString (SIZE (1..2200)),
utf8String UTF8String (SIZE (1..2200))}
CompleteRevocationRefs ::= SEQUENCE OF CrlOcspRef
CrlOcspRef ::= SEQUENCE {
crlids [0] CRLListID OPTIONAL,
ocspids [1] OcspListID OPTIONAL,
otherRev [2] OtherRevRefs OPTIONAL }
CrlIdentifier ::= SEQUENCE {
crlissuer Name,
crlIssuedTime UTCTime,
crlNumber INTEGER OPTIONAL }
CrlValidatedID ::= SEQUENCE {
crlHash OtherHash,
crlIdentifier CrlIdentifier OPTIONAL}
OtherHash ::= CHOICE {
sha1Hash OtherHashValue,
otherHash OtherHashAlgAndValue}
OcspListID ::= SEQUENCE {
ocspResponses SEQUENCE OF OcspResponsesID }
OcspResponsesID ::= SEQUENCE {
ocspIdentifier ANY, --OcspIdentifier,
ocspRepHash OtherHash OPTIONAL
}
OtherRevRefs ::= SEQUENCE {
otherRevRefType OtherRevRefType,
otherRevRefs ANY DEFINED BY otherRevRefType
}
OcspIdentifier ::= SEQUENCE {
ocspResponderID ResponderID,
producedAt GeneralizedTime
}
ResponderID ::= CHOICE {
byName [1] Name,
byKey [2] KeyHash }
KeyHash ::= OCTET STRING
RevocationValues ::= SEQUENCE {
crlVals [0] SEQUENCE OF CertificateList OPTIONAL,
ocspVals [1] ANY OPTIONAL,
otherRevVals [2] OtherRevVals OPTIONAL}
OtherSigningCertificate ::= SEQUENCE {
certs SEQUENCE OF OtherCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
CompleteCertificateRefs ::= SEQUENCE OF OtherCertID
OtherCertID ::= SEQUENCE { otherCertHash OtherHash, issuerSerial IssuerSerial OPTIONAL }
OtherRevValType ::= OBJECT IDENTIFIER
OtherRevVals ::= SEQUENCE { otherRevValType OtherRevValType }
CRLListID ::= SEQUENCE { crls SEQUENCE OF CrlValidatedID }
BasicOCSPResponses ::= SEQUENCE OF BasicOCSPResponse
BasicOCSPResponse ::= SEQUENCE {
tbsResponseData ResponseData,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING,
certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL}
ResponseData ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
responderID ResponderID,
producedAt GeneralizedTime,
responses SEQUENCE OF SingleResponse,
responseExtensions [1] EXPLICIT Extensions OPTIONAL}
CertID ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
issuerNameHash OCTET STRING,
issuerKeyHash OCTET STRING,
serialNumber CertificateSerialNumber}
CertStatus ::= CHOICE {
good [0] IMPLICIT NULL,
revoked [1] IMPLICIT RevokedInfo,
unknown [2] IMPLICIT UnknownInfo }
RevokedInfo ::= SEQUENCE {
revocationTime GeneralizedTime,
revocationReason [0] EXPLICIT CRLReason OPTIONAL }
SingleResponse ::= SEQUENCE {
certID CertID,
certStatus CertStatus,
thisUpdate GeneralizedTime,
nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL,
singleExtensions [1] EXPLICIT Extensions OPTIONAL }
QCStatements ::= SEQUENCE OF QCStatement
QCStatement ::= SEQUENCE {
statementId OBJECT IDENTIFIER,
statementInfo ANY DEFINED BY statementId OPTIONAL
}
MonetaryValue::= SEQUENCE {
currency Iso4217CurrencyCode,
amount INTEGER,
exponent INTEGER
}
Iso4217CurrencyCode ::= CHOICE { alphabetic PrintableString }
MessageImprint ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
hashedMessage OCTET STRING }
TimeStampReq ::= SEQUENCE {
version INTEGER { v1(1) },
messageImprint MessageImprint,
reqPolicy TSAPolicyId OPTIONAL,
nonce INTEGER OPTIONAL,
certReq BOOLEAN DEFAULT FALSE,
extensions [0] IMPLICIT Extensions OPTIONAL }
TimeStampResp ::= SEQUENCE {
status PKIStatusInfo,
timeStampToken TimeStampToken OPTIONAL }
TimeStampToken ::= ContentInfo
TSTInfo ::= SEQUENCE {
version INTEGER { v1(1)},
policy TSAPolicyId,
messageImprint MessageImprint,
serialNumber INTEGER,
genTime GeneralizedTime,
accuracy Accuracy OPTIONAL,
nonce INTEGER OPTIONAL,
tsa [0] GeneralName OPTIONAL,
extensions [1] IMPLICIT Extensions OPTIONAL }
Accuracy ::= SEQUENCE {
seconds INTEGER OPTIONAL,
millis [0] INTEGER (1..999) OPTIONAL,
micros [1] INTEGER (1..999) OPTIONAL }
OtherRevRefType ::= OBJECT IDENTIFIER
ContentType ::= OBJECT IDENTIFIER
id-data OBJECT IDENTIFIER ::= {1 2 840 113549 1 7 1}
id-signedData OBJECT IDENTIFIER ::= {1 2 840 113549 1 7 2}
id-contentType OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 3}
id-messageDigest OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 4}
id-signingTime OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 5}
id-aa-signTSToken OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 14}
id-aa-ets-sigPolicyId OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 15}
id-aa-ets-ContentTS OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 20}
id-aa-ets-certRefs OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 21}
id-aa-ets-revocationRefs OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 22}
id-aa-ets-certValues OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 23}
id-aa-ets-revoValues OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 24}
id-aa-signingCertV2 OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-aa(2) 47}
id-spq-ets-uri OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-spq(5) 1}
id-spq-ets-unotice OBJECT IDENTIFIER ::= {1 2 840 113549 1 9 16 id-spq(5) 2}
dstu7564-256 OBJECT IDENTIFIER ::= {iso(1) member-body(2) ukraine(804) root(2) security(1) cryptography(1) pki(1) alg(1) hash(2) dstu7564(2) 1}
dstu7564-384 OBJECT IDENTIFIER ::= {iso(1) member-body(2) ukraine(804) root(2) security(1) cryptography(1) pki(1) alg(1) hash(2) dstu7564(2) 2}
dstu7564-512 OBJECT IDENTIFIER ::= {iso(1) member-body(2) ukraine(804) root(2) security(1) cryptography(1) pki(1) alg(1) hash(2) dstu7564(2) 3}
id-kp-timeStamping OBJECT IDENTIFIER ::= {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-kp(3) 8}
id-ct-TSTInfo OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1)4}
END