Attribute Certificate
The Set Attribute Ticket, which is used to authorize updates to key usage limits, has the format of an Attribute Certificate defined by PKIX (RFC 3281).
AttributeCertificate ::= SEQUENCE {
acinfo AttributeCertificateInfo,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING
}
AttributeCertificateInfo ::= SEQUENCE {
version AttCertVersion -- version is v2,
holder Holder,
issuer AttCertIssuer,
signature AlgorithmIdentifier,
serialNumber CertificateSerialNumber,
attrCertValidityPeriod AttCertValidityPeriod,
attributes SEQUENCE OF Attribute,
issuerUniqueID UniqueIdentifier OPTIONAL,
extensions Extensions OPTIONAL
}
AttCertVersion ::= INTEGER { v2(1) }
Holder ::= SEQUENCE {
baseCertificateID [0] IssuerSerial OPTIONAL,
-- the issuer and serial number of
-- the holder's Public Key Certificate
entityName [1] GeneralNames OPTIONAL,
objectDigestInfo [2] ObjectDigestInfo OPTIONAL
-- used to directly authenticate the target key,
-- see further description below
}
ObjectDigestInfo ::= SEQUENCE {
digestedObjectType ENUMERATED {
publicKey (0),
publicKeyCert (1),
otherObjectTypes (2) },
-- otherObjectTypes only to be used
otherObjectTypeID OBJECT IDENTIFIER OPTIONAL,
-- must be OID_X509_ATTR_KEY_DIGEST
digestAlgorithm AlgorithmIdentifier,
objectDigest BIT STRING
}
The algorithm OID_X509_ATTR_KEY_DIGEST is:
objectDigest = Digest(Token_Serial_Number | Token_Label | ObjectID)
Where:
ObjectID is the concatenation of the CKA_LABEL and CKA_ID attributes of the target Object.
AttCertIssuer ::= CHOICE {
v1Form GeneralNames, -- MUST NOT be used in this
-- profile
v2Form [0] V2Form -- v2 only
}
V2Form ::= SEQUENCE {
issuerName GeneralNames OPTIONAL,
baseCertificateID [0] IssuerSerial OPTIONAL,
objectDigestInfo [1] ObjectDigestInfo OPTIONAL
-- issuerName MUST be present in this profile
-- baseCertificateID and objectDigestInfo MUST NOT
-- be present in this profile
}
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serial CertificateSerialNumber,
issuerUID UniqueIdentifier OPTIONAL
}
AttCertValidityPeriod ::= SEQUENCE {
notBeforeTime GeneralizedTime,
notAfterTime GeneralizedTime
}
Attribute ::= SEQUENCE {
type AttributeType,
values SET OF AttributeValue
-- at least one value is required
}
AttributeType ::= OBJECT IDENTIFIER
-- there is a different OID for each type of Cryptoki Attribute
-- see below for a list
AttributeValue ::= ANY DEFINED BY AttributeType
-- the data type depends on the type field but it
-- represents the value part of the Cryptoki attribute.
OID Used to Indicate Key Digest Algorithm
|
OID |
OID-type |
|---|---|
|
{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) safeNetInc(23629) safenetRoot(1) safenetHSM(4) ptkc(2) objDigests(2) key(1) } |
OID_X509_ATTR_KEY_DIGEST
|
|
OID Value |
OID-type |
Cryptoki Attribute Type |
DER Encoded Value |
|---|---|---|---|
|
{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) safeNetInc(23629) safenetRoot(1) safenetHSM(4) ptkc(2) p11Attrs(1) usage_limit(1) } |
OID_X509_ATTR_USAGE_LIMIT
|
CKA_USAGE_LIMIT |
INTEGER |
|
{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) safeNetInc(23629) safenetRoot(1) safenetHSM(4) ptkc(2) p11Attrs(1) end_date(2) } |
OID_X509_ATTR_END_DATE
|
CKA_END_DATE |
PrintableString |
|
{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) safeNetInc(23629) safenetRoot(1) safenetHSM(4) ptkc(2) p11Attrs(1) start_date(3) } |
OID_X509_ATTR_START_DATE
|
CKA_START_DATE |
PrintableString |
|
{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprises(1) safeNetInc(23629) safenetRoot(1) safenetHSM(4) ptkc(2) p11Attrs(1) admin_cert(4) } |
OID_X509_ATTR_ADMIN_CERT
|
CKA_ADMIN_CERT |
|
