Using cryptlib and matching requirements

Hi,

I have 4 questions about cryptlib. We have some requirements, and i want to
know if cryptlib match them :

- "Implementations claiming conformance to this technical specification
shall specify that the symmetric keys shall be renegotiated based upon a
time period and a maximum allowed number of packets/bytes sent. It is a
PIXIT (Protocol Implementation eXtra Information for Testing) issue, of the
referencing standard, to specify the constraints on the renegotiation.
The renegotiation values shall be configurable." 
--> This is in a TLS session, is renegotiation available ?

- In certificate verification, is that possible to:
–-> accept any certificate from an authorized CA ?
–-> accept individual certificates from an authorized CA (for example, only
4/10 certificates from the CA) ?


- "A protocol specifying the use of this technical specification shall
specify the maximum size of certificate allowed to be used. It is
recommended that this size shall be less than or equal to 8192 bytes."
--> Is certificate size could be checked to ensure that ?

- We have to support two different formats of access tokens :
-- profile A: X.509 ID certificates with extensions

X.509 (see RFC5280) defines a certificate in ASN.1 notation as follows
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }
TBSCertificate ::= SEQUENCE {
version [0] Version must be v3,
serialNumber CertificateSerialNumber,
signature AlgorithmIdentifier,
issuer Name,
validity Validity,
subject Name,
subjectPublicKeyInfo SubjectPublicKeyInfo,
issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version MUST be v2 or v3
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
-- If present, version MUST be v2 or v3
extensions [3] EXPLICIT Extensions OPTIONAL
-- If present, version MUST be v3
}

–- profile B: X.509 attribute certificates

AttributeCertificate::= SEQUENCE {
Acinfo AttributeCertificateInfo,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING
}
AttributeCertificateInfo::= SEQUENCE {
version AttCertVersion -- version is v2,
holder Holder,
issuer AttCertIssuer,
signature AlgorithmIdentifier,
serialNumber CertificateSerialNumber,
attrCertValidityPeriod AttCertValidityPeriod,
attributes SEQUENCE OF Attribute,
issuerUniqueID UniqueIdentifier OPTIONAL,
extensions Extensions OPTIONAL
}
Attribute::= SEQUENCE {
Type AttributeType,
values SET OF AttributeValue
-- at least one value is required
}
AttributeType::= OBJECT IDENTIFIER
AttributeValue::= ANY DEFINED BY AttributeType

--> Are these profiles defined ? Can we create specific attributes not
defined in the norm ? 

David.
-- 
View this message in context: http://old.nabble.com/Using-cryptlib-and-matching-requirements-tp35062491p35062491.html
Sent from the Cryptlib mailing list archive at Nabble.com.


_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.