附录 A. ASN.1 模块 (ASN.1 Module)

中文导读: 本节对应 RFC 9908 的 附录 A. ASN.1 模块 (ASN.1 Module) 部分, 对应文档标题为 附录 A. ASN.1 模块. 下方若包含英文 RFC 原文, 注册表名称, 字段名, 算法名, 对象标识符, 媒体类型, 邮箱地址, URL, 代码, ABNF, ASN.1, YANG, JSON, XML, 测试向量或参考文献条目, 均按规范原样保留, 因为这些内容需要与 RFC 文本, IANA 注册表, 实现代码或验证工具逐字一致. 中文段落用于说明本节的作用, 阅读重点和实现含义, 不改变任何协议语义或注册值.

本页包含机器可读或接近机器可读的规范材料. 对 ASN.1, YANG, JSON Schema, XML Schema, 伪代码, 注册模板, 常量表和算法标识符, 翻译时必须保留关键字, 类型名, OID, namespace, 枚举值, 字段名和语法结构. 实现者应把这些块视为生成代码, 配置模型, 验证输入或一致性测试的依据.

补充实现说明: 本页英文比例高, 是因为主要内容属于可复制的规范材料或实现材料. 在这类页面中, 语法关键字, 缩进, 字符串字面量, 枚举值, 路径, OID, namespace, JSON member, YANG leaf, ASN.1 type 和错误文本都可能被测试工具, 代码生成器或互操作实现直接消费. 因此, 译文只在代码块外说明结构和用途, 不在代码块内替换术语. 实现者应结合正文的语义说明检查默认值, 约束, 必选字段, 扩展点和安全影响, 并用原样保留的块进行验证.

本附录提供 Certification Request Information Template attribute 及其子模板结构的 ASN.1 module [X.680]. 该模块遵循 [RFC5911], [RFC5912] 和 [RFC6268] 建立的约定. 下方 ASN.1 是规范代码, 包括 module OID, IMPORTS, ATTRIBUTE 定义, OBJECT IDENTIFIER, SEQUENCE 结构和 OPTIONAL 字段, 因此保持英文和标识符原样.

该模块定义了两个核心扩展点: aa-certificationRequestInfoTemplate 使用 CertificationRequestInfoTemplate 表达部分填充的 PKCS#10 CSR 信息; at-extensionReqTemplate 使用 ExtensionReqTemplate 表达可带缺失 extnValue 的扩展模板. NameTemplate, SingleAttributeTemplate 和 SubjectPublicKeyInfoTemplate 允许 subject, RDN value 和 subjectPublicKey 在模板中缺失, 从而避免用无效空字符串或空 BIT STRING 表示"由客户端填入".

实现者应逐字使用代码块中的 ASN.1 定义. 特别是, id-aa-certificationRequestInfoTemplate 的分配号为 61, id-aa-extensionReqTemplate 的分配号为 62, module identifier 使用 id-mod-critemplate(82). 这些 OID 与第 7 节的 IANA 注册项一致, 是 DER 编码和互操作验证的基础.

ASN.1 模块定义

Appendix A.  ASN.1 Module

   This appendix provides an ASN.1 module [X.680] for the Certification
   Request Information Template attribute and its sub-template
   structures.  It follows the conventions established in [RFC5911],
   [RFC5912], and [RFC6268].

   CRITemplateModule
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
       pkcs-9(9) smime(16) modules(0) id-mod-critemplate(82) }

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   IMPORTS -- from [RFC5912]

   SupportedAttributes
    FROM PKIX1Explicit-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}

   ATTRIBUTE, EXTENSION
    FROM PKIX-CommonTypes-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57) }

   PUBLIC-KEY, AlgorithmIdentifier{}
    FROM AlgorithmInformation-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0)
       id-mod-algorithmInformation-02(58)}

   CertExtensions
    FROM PKIX1Implicit-2009
     { iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}

   Attributes{}, CRIAttributes, PKInfoAlgorithms
    FROM PKCS-10
     { iso(1) identified-organization(3) dod(6) internet(1)
       security(5) mechanisms(5) pkix(7)
       id-mod(0) id-mod-pkcs10-2009(69) }
   ;

   aa-certificationRequestInfoTemplate ATTRIBUTE ::=
     { TYPE CertificationRequestInfoTemplate IDENTIFIED BY
       id-aa-certificationRequestInfoTemplate }

   id-aa-certificationRequestInfoTemplate OBJECT IDENTIFIER ::=
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
       smime(16) aa(2) id-aa-certificationRequestInfoTemplate(61) }

   --  like CertificationRequestInfo but OPTIONAL subject, subjectPKInfo
   CertificationRequestInfoTemplate ::= SEQUENCE {
       version       INTEGER { v1(0) } (v1, ... ),
       subject       NameTemplate OPTIONAL,
       subjectPKInfo [0] SubjectPublicKeyInfoTemplate
                                 {{ PKInfoAlgorithms }} OPTIONAL,
       attributes    [1] Attributes{{ CRIAttributes }}
   }


   --  like Name, but with OPTIONAL RDN values
   NameTemplate ::= CHOICE { -- only one possibility for now --
       rdnSequence  RDNSequenceTemplate }

   RDNSequenceTemplate ::= SEQUENCE OF RelativeDistinguishedNameTemplate

   RelativeDistinguishedNameTemplate  ::= SET SIZE (1 .. MAX)
       OF SingleAttributeTemplate { {SupportedAttributes} }

   --  like Attributes, but with OPTIONAL value
   SingleAttributeTemplates{ATTRIBUTE:AttrSet} ::= SEQUENCE OF
       SingleAttributeTemplates{ {AttrSet} }

   --  like SingleAttribute, but with OPTIONAL value
   SingleAttributeTemplate{ATTRIBUTE:AttrSet} ::= SEQUENCE {
       type      ATTRIBUTE.&id({AttrSet}),
       value     ATTRIBUTE.&Type({AttrSet}{@type}) OPTIONAL
   }

   --  like SubjectPublicKeyInfo, but with OPTIONAL subjectPublicKey
   SubjectPublicKeyInfoTemplate{PUBLIC-KEY:IOSet} ::= SEQUENCE {
       algorithm        AlgorithmIdentifier{PUBLIC-KEY, {IOSet}},
       subjectPublicKey BIT STRING OPTIONAL
   }

   id-aa-extensionReqTemplate OBJECT IDENTIFIER ::=
   { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
     smime(16) aa(2) id-aa-extensionReqTemplate(62) }

   --  like extensionRequest, but with OPTIONAL Extension extnValues
   --  original definition was in PKCS#9 RFC 2985, Section 5.4.2
   at-extensionReqTemplate ATTRIBUTE ::= {
       TYPE ExtensionReqTemplate IDENTIFIED BY
                    id-aa-extensionReqTemplate }

   ExtensionReqTemplate ::= ExtensionTemplates{{CertExtensions}}

   --  like Extensions, but with OPTIONAL extnValue
   ExtensionTemplates{EXTENSION:ExtensionSet} ::=
       SEQUENCE SIZE (1..MAX) OF ExtensionTemplate{{ExtensionSet}}

   --  like Extension, but with OPTIONAL extnValue
   ExtensionTemplate{EXTENSION:ExtensionSet} ::= SEQUENCE {
       extnID    EXTENSION.&id({ExtensionSet}),
       critical  BOOLEAN
     --                   (EXTENSION.&Critical({ExtensionSet}{@extnID}))
                        DEFAULT FALSE,
       extnValue OCTET STRING (CONTAINING
                 EXTENSION.&ExtnType({ExtensionSet}{@extnID})) OPTIONAL
                 --  contains the DER encoding of the ASN.1 value
                 --  corresponding to the extension type identified
                 --  by extnID when present
   }

   END

ASN.1 模块定义​

ASN.1 模块定义