Attribute Certificate

The Set Attribute Ticket, which is used to authorize updates to key usage limits, has the format of an Attribute Certificate defined by PKIX (RFC 3281).

AttributeCertificate ::= SEQUENCE {
   acinfo               AttributeCertificateInfo,
   signatureAlgorithm   AlgorithmIdentifier,
   signatureValue       BIT STRING
}
 
AttributeCertificateInfo ::= SEQUENCE {
      version              AttCertVersion -- version is v2,
      holder               Holder,
      issuer               AttCertIssuer,
      signature            AlgorithmIdentifier,
      serialNumber         CertificateSerialNumber,
      attrCertValidityPeriod   AttCertValidityPeriod,
      attributes           SEQUENCE OF Attribute,
      issuerUniqueID       UniqueIdentifier OPTIONAL,
      extensions           Extensions OPTIONAL
}
 
AttCertVersion ::= INTEGER { v2(1) }
 
Holder ::= SEQUENCE {
       baseCertificateID   [0] IssuerSerial OPTIONAL,
    -- the issuer and serial number of
    -- the holder's Public Key Certificate
 
       entityName          [1] GeneralNames OPTIONAL,
       objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
           -- used to directly authenticate the target key,
           -- see further description below
}
 
ObjectDigestInfo ::= SEQUENCE {
       digestedObjectType  ENUMERATED {
       publicKey            (0),
       publicKeyCert        (1),
       otherObjectTypes     (2) },
       -- otherObjectTypes only to be used
       otherObjectTypeID   OBJECT IDENTIFIER OPTIONAL,
              -- must be OID_X509_ATTR_KEY_DIGEST
       digestAlgorithm     AlgorithmIdentifier,
       objectDigest        BIT STRING
            }

The algorithm OID_X509_ATTR_KEY_DIGEST is:

objectDigest  = Digest(Token_Serial_Number | Token_Label | ObjectID)

Where:

ObjectID is the concatenation of the CKA_LABEL and CKA_ID attributes of the target Object.

AttCertIssuer ::= CHOICE {
      v1Form   GeneralNames,  -- MUST NOT be used in this
                              -- profile
     v2Form   [0] V2Form     -- v2 only
}
 
V2Form ::= SEQUENCE {
     issuerName            GeneralNames  OPTIONAL,
     baseCertificateID     [0] IssuerSerial  OPTIONAL,
     objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
     -- issuerName MUST be present in this profile
     -- baseCertificateID and objectDigestInfo MUST NOT
     -- be present in this profile
}
 
IssuerSerial  ::=  SEQUENCE {
     issuer         GeneralNames,
     serial         CertificateSerialNumber,
     issuerUID      UniqueIdentifier OPTIONAL
}
 
AttCertValidityPeriod  ::= SEQUENCE {
     notBeforeTime  GeneralizedTime,
     notAfterTime   GeneralizedTime
}
 
 
Attribute ::= SEQUENCE {
     type      AttributeType,
     values    SET OF AttributeValue
     -- at least one value is required
}
 
AttributeType ::= OBJECT IDENTIFIER
-- there is a different OID for each type of Cryptoki Attribute
-- see below for a list
 
AttributeValue ::= ANY DEFINED BY AttributeType
      -- the data type depends on the type field but it 
      -- represents the value part of the Cryptoki attribute.

OID Used to Indicate Key Digest Algorithm

SafeNet ProtectToolkit 5.3 Product Documentation
007-013682-001 Rev. A December 2016 Copyright 2009-2016 Gemalto All rights reserved.