Re: Updates prior to the release of cryptlib 3.3.4/3.4.0

Hi Peter,

For long term validation
1. the Positive OCSP extension CertHash is needed,
2. OCSP.ArchiveCutoff and
3. CRL.expiredCertsOnCRL

http://www.nbusr.sk/en/electronic-signature/approved-formats/index.html
http://www.nbusr.sk/sk/elektronicky-podpis/standardy-nbu/index.html
 (web must be reloaded twice - firewall :o)
http://www.nbusr.sk/ipublisher/files/nbusr.sk/elektronicky-podpis/formats/formats_crl_ocsp_en.pdf

Another practical example is SHA512 used e.g. in the (content) timestamp
 http://www.nrca-ds.de/st/TSL_DE.PDF.tsr.zip with 
id-aa-signingCertificateV2.
Present interface of CL32 is only for SHA256 and signingCertificateV1
but also SHA512 is frequently used in some timestamp or certificates.


CRL
- expiredCertsOnCRL

OCSP
- ArchiveCutoff
- CertHash

Common PKI Object Identifiers
id-commonpki OBJECT IDENTIFIER ::= {1 3 36 8 }
id-commonpki-at OBJECT IDENTIFIER ::= {id-commonpki 3}
id-commonpki-at-certHash OBJECT IDENTIFIER ::= {id-commonpki-at 13}

CertHash ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
-- The identifier of the algorithm that has been used the
-- hash value below.
certificateHash OCTET STRING
-- The hash over DER-encoding of the entire PKC
}  -- or AC (i.e. NOT a hash over tbsCertificate).

X.509 certificate
- QCStatements RFC 3739
- AuthorityKeyIdentifier is in the CL32 but does not work.

CMS
- id-aa-signingCertificateV2  RFC 5035
- id-aa-ets-sigPolicyId OBJECT IDENTIFIER ::= { 1 2 840 113549 1 9 16 2 15 } 
is in the CL32 but does not work
(Activation of obscure attribs or cert ext in cl32.dll fails with error 216)

SignaturePolicyIdentifier ::=CHOICE{
 SignaturePolicyId SignaturePolicyId,
 SignaturePolicyImplied SignaturePolicyImplied -- not used in this version
}
SignaturePolicyId ::= SEQUENCE {
  sigPolicyId SigPolicyId,
  sigPolicyHash SigPolicyHash,
  sigPolicyQualifiers SEQUENCE SIZE (1..MAX) OF SigPolicyQualifierInfo 
OPTIONAL
}

SignaturePolicyImplied ::= NULL
SigPolicyId ::= OBJECT IDENTIFIER
SigPolicyHash ::=OtherHashAlgAndValue
OtherHashValue ::= OCTET STRING
OtherHashAlgAndValue ::= SEQUENCE {
  hashAlgorithm AlgorithmIdentifier,
  hashValue OtherHashValue
}



----- Original Message ----- 
From: "Peter Gutmann" <[email protected]>
>
> - There's been a neverending series of new X.509 certificate extensions 
> and
> (to a much smaller degree) S/MIME attributes invented by standards 
> committees
> since the last API-level update of cryptlib (3.3.0), the vast majority of
> which will never be used by anyone.  Since the 3.4.0 release is another 
> API-
> level update of cryptlib, it'll be possible to add new certificate 
> attributes
> at this time.  If anyone has any that they'd like added, please let me 
> know
> (providing a convincing argument for the addition, and perhaps a 
> definition
> for ext_def.c, would help too).


_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.