All Classes

 BasicOCSPResponse       ::= SEQUENCE {
    tbsResponseData      ResponseData,
    signatureAlgorithm   AlgorithmIdentifier,
    signature            BIT STRING,
    certs                [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
 

 import java.security.Security;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;

 Security.addProvider(new BouncyCastleProvider());
 

     crossCertificatePairATTRIBUTE::={
       WITH SYNTAX   CertificatePair
       EQUALITY MATCHING RULE certificatePairExactMatch
       ID joint-iso-ccitt(2) ds(5) attributeType(4) crossCertificatePair(40)}
 

The forward elements of the crossCertificatePair attribute of a CA's directory entry shall be used to store all, except self-issued certificates issued to this CA.

CMAC is analogous to OMAC1 - see also en.wikipedia.org/wiki/CMAC

CMAC is a NIST recomendation - see csrc.nist.gov/CryptoToolkit/modes/800-38_Series_Publications/SP800-38B.pdf

CMAC/OMAC1 is a blockcipher-based message authentication code designed and analyzed by Tetsu Iwata and Kaoru Kurosawa.

 EncryptedContentInfo ::= SEQUENCE {
     contentType ContentType,
     contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
     encryptedContent [0] IMPLICIT EncryptedContent OPTIONAL 
 }
 

 EnvelopedData ::= SEQUENCE {
     version CMSVersion,
     originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
     recipientInfos RecipientInfos,
     encryptedContentInfo EncryptedContentInfo,
     unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL 
 }
 

 IssuingDistributionPoint ::= SEQUENCE { 
   distributionPoint          [0] DistributionPointName OPTIONAL, 
   onlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE, 
   onlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE, 
   onlySomeReasons            [3] ReasonFlags OPTIONAL, 
   indirectCRL                [4] BOOLEAN DEFAULT FALSE,
   onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
 

   SignedPublicKeyAndChallenge ::= SEQUENCE {
     publicKeyAndChallenge    PublicKeyAndChallenge,
     signatureAlgorithm       AlgorithmIdentifier,
     signature                BIT STRING
   }
 

 OCSPRequest     ::=     SEQUENCE {
       tbsRequest                  TBSRequest,
       optionalSignature   [0]     EXPLICIT Signature OPTIONAL }

   TBSRequest      ::=     SEQUENCE {
       version             [0]     EXPLICIT Version DEFAULT v1,
       requestorName       [1]     EXPLICIT GeneralName OPTIONAL,
       requestList                 SEQUENCE OF Request,
       requestExtensions   [2]     EXPLICIT Extensions OPTIONAL }

   Signature       ::=     SEQUENCE {
       signatureAlgorithm      AlgorithmIdentifier,
       signature               BIT STRING,
       certs               [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL}

   Version         ::=             INTEGER  {  v1(0) }

   Request         ::=     SEQUENCE {
       reqCert                     CertID,
       singleRequestExtensions     [0] EXPLICIT Extensions OPTIONAL }

   CertID          ::=     SEQUENCE {
       hashAlgorithm       AlgorithmIdentifier,
       issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
       issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
       serialNumber        CertificateSerialNumber }
 

 PKIFailureInfo ::= BIT STRING {
 badAlg               (0),
   -- unrecognized or unsupported Algorithm Identifier
 badMessageCheck      (1), -- integrity check failed (e.g., signature did not verify)
 badRequest           (2),
   -- transaction not permitted or supported
 badTime              (3), -- messageTime was not sufficiently close to the system time, as defined by local policy
 badCertId            (4), -- no certificate could be found matching the provided criteria
 badDataFormat        (5),
   -- the data submitted has the wrong format
 wrongAuthority       (6), -- the authority indicated in the request is different from the one creating the response token
 incorrectData        (7), -- the requester's data is incorrect (for notary services)
 missingTimeStamp     (8), -- when the timestamp is missing but should be there (by policy)
 badPOP               (9)  -- the proof-of-possession failed
 timeNotAvailable    (14),
   -- the TSA's time source is not available
 unacceptedPolicy    (15),
   -- the requested TSA policy is not supported by the TSA
 unacceptedExtension (16),
   -- the requested extension is not supported by the TSA
  addInfoNotAvailable (17)
    -- the additional information requested could not be understood
    -- or is not available
  systemFailure       (25)
    -- the request cannot be handled due to system failure 
 

    PrivateKeyUsagePeriod ::= SEQUENCE {
      notBefore       [0]     GeneralizedTime OPTIONAL,
      notAfter        [1]     GeneralizedTime OPTIONAL }
 

         block  word  digest
 SHA-1   512    32    160
 SHA-224 512    32    224
 SHA-256 512    32    256
 SHA-384 1024   64    384
 SHA-512 1024   64    512
 

 SignedData ::= SEQUENCE {
     version CMSVersion,
     digestAlgorithms DigestAlgorithmIdentifiers,
     encapContentInfo EncapsulatedContentInfo,
     certificates [0] IMPLICIT CertificateSet OPTIONAL,
     crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
     signerInfos SignerInfos
   }
 

 AttributeCertificateInfo ::= SEQUENCE {
       version              AttCertVersion -- version is v2,
       holder               Holder,
       issuer               AttCertIssuer,
       signature            AlgorithmIdentifier,
       serialNumber         CertificateSerialNumber,
       attrCertValidityPeriod   AttCertValidityPeriod,
       attributes           SEQUENCE OF Attribute,
       issuerUniqueID       UniqueIdentifier OPTIONAL,
       extensions           Extensions OPTIONAL
 }
 

     RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

     RelativeDistinguishedName ::= SET SIZE (1..MAX) OF AttributeTypeAndValue

     AttributeTypeAndValue ::= SEQUENCE {
                                   type  OBJECT IDENTIFIER,
                                   value ANY }