附录 A. ASN.1 模块 (ASN.1 Module)

中文导读: 本节对应 RFC 9936 的 附录 A. ASN.1 模块 (ASN.1 Module) 部分, 对应文档标题为 RFC 9936 - 在密码消息语法 (CMS) 中使用 ML-KEM. 下方若包含英文 RFC 原文, 注册表名称, 字段名, 算法名, 对象标识符, 媒体类型, 邮箱地址, URL, 代码, ABNF, ASN.1, YANG, JSON, XML, 测试向量或参考文献条目, 均按规范原样保留, 因为这些内容需要与 RFC 文本, IANA 注册表, 实现代码或验证工具逐字一致. 中文段落用于说明本节的作用, 阅读重点和实现含义, 不改变任何协议语义或注册值.

本页包含机器可读或接近机器可读的规范材料. 对 ASN.1, YANG, JSON Schema, XML Schema, 伪代码, 注册模板, 常量表和算法标识符, 翻译时必须保留关键字, 类型名, OID, namespace, 枚举值, 字段名和语法结构. 实现者应把这些块视为生成代码, 配置模型, 验证输入或一致性测试的依据.

本附录包含用于 ML-KEM 的 ASN.1 模块 [X680]. 此模块从 [RFC5911], [RFC9629], [RFC8619] 和 [RFC9935] 导入对象.

   <CODE BEGINS>
   CMS-ML-KEM-2024
   { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
     pkcs-9(9) smime(16) modules(0) id-mod-cms-ml-kem-2024(84) }

   DEFINITIONS IMPLICIT TAGS ::= BEGIN

   EXPORTS ALL;

   IMPORTS
     SMIME-CAPS
       FROM AlgorithmInformation-2009  -- [RFC5911]
         { iso(1) identified-organization(3) dod(6) internet(1)
           security(5) mechanisms(5) pkix(7) id-mod(0)
           id-mod-algorithmInformation-02(58) }

     KEM-ALGORITHM
       FROM KEMAlgorithmInformation-2023  -- [RFC9629]
          { iso(1) identified-organization(3) dod(6) internet(1)
            security(5) mechanisms(5) pkix(7) id-mod(0)
            id-mod-kemAlgorithmInformation-2023(109) }

     kda-hkdf-with-sha256
       FROM HKDF-OID-2019  -- [RFC8619]
          { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
            pkcs-9(9) smime(16) modules(0) id-mod-hkdf-oid-2019(68) }

     kwa-aes128-wrap, kwa-aes256-wrap
       FROM CMSAesRsaesOaep-2009  -- [RFC5911]
          { iso(1) member-body(2) us(840) rsadsi(113549)
          pkcs(1) pkcs-9(9) smime(16) modules(0)
          id-mod-cms-aes-02(38) }

     id-alg-ml-kem-512, id-alg-ml-kem-768, id-alg-ml-kem-1024,
     pk-ml-kem-512, pk-ml-kem-768, pk-ml-kem-1024
       FROM X509-ML-KEM-2024 -- [RFC9935]
          { iso(1) identified-organization(3) dod(6)
            internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
            id-mod-x509-ml-kem-2025(121) };

   --
   -- ML-KEM Key Encapsulation Mechanism Algorithms
   --

   kema-ml-kem-512 KEM-ALGORITHM ::= {
      IDENTIFIER id-alg-ml-kem-512
      PARAMS ARE absent
      PUBLIC-KEYS { pk-ml-kem-512 }
      UKM ARE optional
      SMIME-CAPS { IDENTIFIED BY id-alg-ml-kem-512 } }

   kema-ml-kem-768 KEM-ALGORITHM ::= {
      IDENTIFIER id-alg-ml-kem-768
      PARAMS ARE absent
      PUBLIC-KEYS { pk-ml-kem-768 }
      UKM ARE optional
      SMIME-CAPS { IDENTIFIED BY id-alg-ml-kem-768 } }

   kema-ml-kem-1024 KEM-ALGORITHM ::= {
      IDENTIFIER id-alg-ml-kem-1024
      PARAMS ARE absent
      PUBLIC-KEYS { pk-ml-kem-1024 }
      UKM ARE optional
      SMIME-CAPS { IDENTIFIED BY id-alg-ml-kem-1024 } }

   -- Updates for the SMIME-CAPS Set from RFC 5911

   SMimeCapsSet SMIME-CAPS ::=
      { kema-ml-kem-512.&smimeCaps |
        kema-ml-kem-768.&smimeCaps |
        kema-ml-kem-1024.&smimeCaps |
        kda-hkdf-with-sha256.&smimeCaps |
        kwa-aes128-wrap.&smimeCaps |
        kwa-aes256-wrap.&smimeCaps,
        ... }

   END
   <CODE ENDS>