ref: 7ae7351ace73a70cbbaf5a2da016005485d0d43b
dir: /module/x509.m/
#
# X.509 v3 by ITU-T Recommendation (11/93) & PKCS7 & PKCS10
#
X509: module {
PATH: con "/dis/lib/crypt/x509.dis";
init: fn(): string;
## x509 (id_at) and x509 extention v3 (id_ce) Object Identifiers
objIdTab : array of ASN1->Oid;
id_at,
id_at_commonName,
id_at_countryName,
id_at_localityName,
id_at_stateOrProvinceName,
id_at_organizationName,
id_at_organizationalUnitName,
id_at_userPassword,
id_at_userCertificate,
id_at_cAcertificate,
id_at_authorityRevocationList,
id_at_certificateRevocationList,
id_at_crossCertificatePair,
id_at_supportedAlgorithms,
id_at_deltaRevocationList,
id_ce,
id_ce_subjectDirectoryAttributes,
id_ce_subjectKeyIdentifier,
id_ce_keyUsage,
id_ce_privateKeyUsage,
id_ce_subjectAltName,
id_ce_issuerAltName,
id_ce_basicConstraints,
id_ce_cRLNumber,
id_ce_reasonCode,
id_ce_instructionCode,
id_ce_invalidityDate,
id_ce_deltaCRLIndicator,
id_ce_issuingDistributionPoint,
id_ce_certificateIssuer,
id_ce_nameConstraints,
id_ce_cRLDistributionPoint,
id_ce_certificatePolicies,
id_ce_policyMapping,
id_ce_authorityKeyIdentifier,
id_ce_policyConstraints,
id_mr,
id_mr_certificateExactMatch,
id_mr_certificateMatch,
id_mr_certificatePairExactMatch,
id_mr_certificatePairMatch,
id_mr_certificateListExactMatch,
id_mr_certificateListMatch,
id_mr_algorithmidentifierMatch : con iota;
## Signed (as Public Key, CRL, Attribute Certificates and CertificationRequest)
Signed: adt {
tobe_signed : array of byte;
alg : ref AlgIdentifier;
signature : array of byte; # BIT STRING, DER encoding
decode: fn(a: array of byte): (string, ref Signed);
encode: fn(s: self ref Signed): (string, array of byte);
sign: fn(s: self ref Signed, sk: ref PrivateKey, hash: int): (string, array of byte);
verify: fn(s: self ref Signed, pk: ref PublicKey, hash: int): int;
tostring: fn(s: self ref Signed): string;
};
## Certificate Path
verify_certchain: fn(cs: list of array of byte): (int, string);
verify_certpath: fn(cp: list of (ref Signed, ref Certificate)): (int, string);
## TBS (Public Key) Certificate
Certificate: adt {
version : int; # v1(0; default) or v2(1) or v3(2)
serial_number : ref Keyring->IPint;
sig : ref AlgIdentifier;
issuer : ref Name;
validity : ref Validity;
subject : ref Name;
subject_pkinfo : ref SubjectPKInfo;
# OPTIONAL for v2 and v3; must be in order
issuer_uid : array of byte; # v2
subject_uid : array of byte; # v2 or v3
exts : list of ref Extension; # v3
decode: fn(a: array of byte): (string, ref Certificate);
encode: fn(c: self ref Certificate): (string, array of byte);
tostring: fn(c: self ref Certificate): string;
is_expired: fn(c: self ref Certificate, date: int): int;
};
AlgIdentifier: adt {
oid : ref ASN1->Oid;
parameter : array of byte;
tostring: fn(a: self ref AlgIdentifier): string;
};
Name: adt {
rd_names : list of ref RDName;
equal: fn(a: self ref Name, b: ref Name): int;
tostring: fn(n: self ref Name): string;
};
RDName: adt {
avas : list of ref AVA;
equal: fn(a: self ref RDName, b: ref RDName): int;
tostring: fn(r: self ref RDName): string;
};
AVA: adt {
oid : ref ASN1->Oid;
value : string;
equal: fn(a: self ref AVA, b: ref AVA): int;
tostring: fn(a: self ref AVA): string;
};
Validity: adt {
not_before : int;
not_after : int;
tostring: fn(v: self ref Validity, format: string): string;
};
SubjectPKInfo: adt {
alg_id : ref AlgIdentifier;
subject_pk : array of byte; # BIT STRING
getPublicKey: fn(c: self ref SubjectPKInfo): (string, int, ref PublicKey);
tostring: fn(c: self ref SubjectPKInfo): string;
};
Extension: adt{
oid : ref ASN1->Oid;
critical : int; # default false
value : array of byte;
tostring: fn(e: self ref Extension): string;
};
PublicKey: adt {
pick {
RSA =>
pk : ref PKCS->RSAKey;
DSS =>
pk : ref PKCS->DSSPublicKey;
DH =>
pk : ref PKCS->DHPublicKey;
}
};
PrivateKey: adt {
pick {
RSA =>
sk : ref PKCS->RSAKey;
DSS =>
sk : ref PKCS->DSSPrivateKey;
DH =>
sk : ref PKCS->DHPrivateKey;
}
};
## Certificate Revocation List
CRL: adt {
version : int; # OPTIONAL; v2
sig : ref AlgIdentifier;
issuer : ref Name;
this_update : int;
next_update : int; # OPTIONAL
revoked_certs : list of ref RevokedCert; # OPTIONAL
exts : list of ref Extension; # OPTIONAL
decode: fn(a: array of byte): (string, ref CRL);
encode: fn(c: self ref CRL): (string, array of byte);
tostring: fn(c: self ref CRL): string;
is_revoked: fn(c: self ref CRL, sn: ref Keyring->IPint): int;
};
RevokedCert: adt {
user_cert : ref Keyring->IPint; # serial_number
revoc_date : int; # OPTIONAL
exts : list of ref Extension; # OPTIONAL; CRL entry extensions
tostring: fn(rc: self ref RevokedCert): string;
};
## Certificate Extensions
# get critical extensions
cr_exts: fn(es: list of ref Extension): list of ref Extension;
# get non-critical extensions
noncr_exts: fn(es: list of ref Extension): list of ref Extension;
# decode a list of extensions
parse_exts: fn(es: list of ref Extension): (string, list of ref ExtClass);
# extension classes
ExtClass: adt {
pick {
AuthorityKeyIdentifier =>
id : array of byte; # OCTET STRING
issuer : ref GeneralName;
serial_number : ref Keyring->IPint;
SubjectKeyIdentifier =>
id : array of byte; # OCTET STRING
BasicConstraints =>
depth : int; # certificate path constraints
KeyUsage =>
usage : int;
PrivateKeyUsage =>
period : ref Validity;
PolicyMapping => # (issuer, subject) domain policy pairs
pairs : list of (ref ASN1->Oid, ref ASN1->Oid);
CertificatePolicies =>
policies : list of ref PolicyInfo;
IssuerAltName =>
alias : list of ref GeneralName;
SubjectAltName =>
alias : list of ref GeneralName;
NameConstraints =>
permitted : list of ref GSubtree;
excluded : list of ref GSubtree;
PolicyConstraints =>
require : int;
inhibit : int;
CRLNumber =>
curr : int;
ReasonCode =>
code : int;
InstructionCode =>
oid : ref ASN1->Oid; # hold instruction code field
InvalidityDate =>
date : int;
CRLDistributionPoint =>
ps : list of ref DistrPoint;
IssuingDistributionPoint =>
name : ref DistrPointName;
only_usercerts : int; # DEFAULT FALSE
only_cacerts : int; # DEFAULT FALSE
only_reasons : int;
indirect_crl : int; # DEFAULT FALSE
CertificateIssuer =>
names : list of ref GeneralName;
DeltaCRLIndicator =>
number : ref Keyring->IPint;
SubjectDirectoryAttributes =>
attrs : list of ref Attribute;
UnknownType =>
ext : ref Extension;
}
decode: fn(ext: ref Extension): (string, ref ExtClass);
encode: fn(et: self ref ExtClass, critical: int): ref Extension;
tostring: fn(et: self ref ExtClass): string;
};
# key usage
KeyUsage_DigitalSignature, KeyUsage_NonRepudiation, KeyUsage_KeyEncipherment,
KeyUsage_DataEncipherment, KeyUsage_KeyAgreement, KeyUsage_KeyCertSign,
KeyUsage_CRLSign, KeyUsage_EncipherOnly, KeyUsage_DecipherOnly : con iota << 1;
# CRL reason
Reason_Unspecified, Reason_KeyCompromise, Reason_CACompromise,
Reason_AffiliationChanged, Reason_Superseded, Reason_CessationOfOperation,
Reason_CertificateHold, Reason_RemoveFromCRL : con iota << 1;
# General Name
GeneralName: adt {
pick {
otherName or # [0]
rfc822Name or # [1]
dNSName or # [2]
x400Address or # [3]
uniformResourceIdentifier => # [6]
str : string;
iPAddress => # [7]
ip : array of byte;
registeredID => # [8]
oid : ref ASN1->Oid;
ediPartyName => # [5]
nameAssigner : ref Name; # [0]
partyName : ref Name; # [1]
directoryName => # [4]
dir : ref Name;
}
tostring: fn(g: self ref GeneralName): string;
};
# security policies
PolicyInfo: adt {
oid : ref ASN1->Oid;
qualifiers : list of ref PolicyQualifier;
tostring: fn(pi: self ref PolicyInfo): string;
};
PolicyQualifier: adt {
oid : ref ASN1->Oid;
value : array of byte; # OCTET STRING; OPTIONAL
tostring: fn(pq: self ref PolicyQualifier): string;
};
GSubtree: adt {
base : ref GeneralName;
min : int;
max : int;
tostring: fn(gs: self ref GSubtree): string;
};
# crl distribution point
# with known reason code
# Unused [0], KeyCompromise [1], CACompromise [2], AffilationChanged [3],
# Superseded [4], CessationOfOperation [5], CertificateHold [6]
DistrPoint: adt{
name : ref DistrPointName;
reasons : int;
issuer : list of ref GeneralName;
tostring: fn(dp: self ref DistrPoint): string;
};
DistrPointName: adt {
full_name : list of ref GeneralName;
rdname : list of ref RDName;
};
Attribute: adt {
id : ASN1->Oid;
value : array of byte;
};
};
#X509Attribute: module {
#
# ## Attribute Certificate
#
# AttrCert: adt {
# version : int; # default v1
# base_certid : ref IssuerSerial; # [0]
# subject_name : list of ref GeneralName; # [1]
# issuer : list of ref GeneralName;
# serial_number : ref IPint;
# validity : ref Validity;
# attrs : list of ref Attribute;
# issuer_uid : array of byte; # OPTIONAL
# exts : list of ref Extension; # OPTIONAL
# };
#
# IssuerSerial: adt {
# issuer : list of ref GeneralName;
# serial : ref IPint;
# issuer_uid : array of byte; # OPTIONAL
# };
#};