Attribute certificate

AttributeCertificate ::= SEQUENCE {
acinfo               AttributeCertificateInfo,
signatureAlgorithm   AlgorithmIdentifier,
signatureValue       BIT STRING
}

AttributeCertificateInfo ::= SEQUENCE {
    version              AttCertVersion -- version is v2,
    holder               Holder,
    issuer               AttCertIssuer,
    signature            AlgorithmIdentifier,
    serialNumber         CertificateSerialNumber,
    attrCertValidityPeriod   AttCertValidityPeriod,
    attributes           SEQUENCE OF Attribute,
    issuerUniqueID       UniqueIdentifier OPTIONAL,
    extensions           Extensions OPTIONAL
}

AttCertVersion ::= INTEGER { v2(1) }

Holder ::= SEQUENCE {
    baseCertificateID   [0] IssuerSerial OPTIONAL,
    -- the issuer and serial number of
    -- the holder's Public Key Certificate

    entityName          [1] GeneralNames OPTIONAL,
    objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
        -- used to directly authenticate the target key,
        -- see further description below
}

ObjectDigestInfo ::= SEQUENCE {
    digestedObjectType  ENUMERATED {
    publicKey            (0),
    publicKeyCert        (1),
    otherObjectTypes     (2) },
    -- otherObjectTypes only to be used
    otherObjectTypeID   OBJECT IDENTIFIER OPTIONAL,
            -- must be OID_X509_ATTR_KEY_DIGEST
    digestAlgorithm     AlgorithmIdentifier,
    objectDigest        BIT STRING
            }

objectDigest  = Digest(Token_Serial_Number | Token_Label | ObjectID)

AttCertIssuer ::= CHOICE {
    v1Form   GeneralNames,  -- MUST NOT be used in this
                            -- profile
    v2Form   [0] V2Form     -- v2 only
}

V2Form ::= SEQUENCE {
    issuerName            GeneralNames  OPTIONAL,
    baseCertificateID     [0] IssuerSerial  OPTIONAL,
    objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
    -- issuerName MUST be present in this profile
    -- baseCertificateID and objectDigestInfo MUST NOT
    -- be present in this profile
}

IssuerSerial  ::=  SEQUENCE {
    issuer         GeneralNames,
    serial         CertificateSerialNumber,
    issuerUID      UniqueIdentifier OPTIONAL
}

AttCertValidityPeriod  ::= SEQUENCE {
    notBeforeTime  GeneralizedTime,
    notAfterTime   GeneralizedTime
}


Attribute ::= SEQUENCE {
    type      AttributeType,
    values    SET OF AttributeValue
    -- at least one value is required
}

AttributeType ::= OBJECT IDENTIFIER
-- there is a different OID for each type of Cryptoki Attribute
-- see below for a list

AttributeValue ::= ANY DEFINED BY AttributeType
    -- the data type depends on the type field but it 
    -- represents the value part of the Cryptoki attribute.