Re: Using cryptlib and matching requirements

I forgot the extension for the profiles :

id-IEC62351 OBJECT_IDENTIFIER::= { 1 2 840 10070 }
id-IECuserRoles OBJECT_IDENTIFIER::= id-IEC62351 { 8 1 }
IECUserRoles::= SEQUENCE OF UserRoleInfo
UserRoleInfo::= SEQUENCE { -- contains the role information blob
-- IEC62351 specific parameter
userRole SEQUENCE SIZE (1..MAX) OF RoleID
aor UTF8String (SIZE(1..64)),
revision INTEGER (0..255),
roleDefinition UTF8String (0..23) OPTIONAL,
-- optional fields to be used within IEEE 1815 and IEC60870-5
operation Operation OPTIONAL,
statusChangeSequenceNumber INTEGER (0..4294967295) OPTIONAL,
}
RoleId::= INTEGER (-32768..32767)
Operation::= ENUMERATED { Add (1), Delete (2), Change (3) }

This is for profile A, profile B has :

id-IEC62351 OBJECT_IDENTIFIER::= { 1 2 840 10070 }
id-IECuserRoles OBJECT_IDENTIFIER::= id-IEC62351 { 8 1 }
IECUserRoles::= SEQUENCE OF UserRoleInfo
UserRoleInfo::= SEQUENCE { -- contains the role information blob
-- IEC62351 specific parameter
userRole SEQUENCE SIZE (1..MAX) OF RoleID
aor UTF8String (SIZE(1..64)),
revision INTEGER (0..255),
roleDefinition UTF8String (0..23) OPTIONAL,
-- optional fields to be used within IEEE 1815 and IEC60870-5
operation Operation OPTIONAL,
statusChangeSequenceNumber INTEGER (0..4294967295) OPTIONAL,
}
RoleId::= INTEGER (-32768..32767)
Operation::= ENUMERATED { Add (1), Delete (2), Change (3) }

David.


2013/2/25 David Pierre <[email protected]>

>
>
> Hi,
>
> I have 4 questions about cryptlib. We have some requirements, and i want to
> know if cryptlib match them :
>
> - "Implementations claiming conformance to this technical specification
> shall specify that the symmetric keys shall be renegotiated based upon a
> time period and a maximum allowed number of packets/bytes sent. It is a
> PIXIT (Protocol Implementation eXtra Information for Testing) issue, of the
> referencing standard, to specify the constraints on the renegotiation.
> The renegotiation values shall be configurable."
> --> This is in a TLS session, is renegotiation available ?
>
> - In certificate verification, is that possible to:
> –-> accept any certificate from an authorized CA ?
> –-> accept individual certificates from an authorized CA (for example, only
> 4/10 certificates from the CA) ?
>
>
> - "A protocol specifying the use of this technical specification shall
> specify the maximum size of certificate allowed to be used. It is
> recommended that this size shall be less than or equal to 8192 bytes."
> --> Is certificate size could be checked to ensure that ?
>
> - We have to support two different formats of access tokens :
> -- profile A: X.509 ID certificates with extensions
>
> X.509 (see RFC5280) defines a certificate in ASN.1 notation as follows
> Certificate ::= SEQUENCE {
> tbsCertificate TBSCertificate,
> signatureAlgorithm AlgorithmIdentifier,
> signatureValue BIT STRING }
> TBSCertificate ::= SEQUENCE {
> version [0] Version must be v3,
> serialNumber CertificateSerialNumber,
> signature AlgorithmIdentifier,
> issuer Name,
> validity Validity,
> subject Name,
> subjectPublicKeyInfo SubjectPublicKeyInfo,
> issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
> -- If present, version MUST be v2 or v3
> subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
> -- If present, version MUST be v2 or v3
> extensions [3] EXPLICIT Extensions OPTIONAL
> -- If present, version MUST be v3
> }
>
> –- profile B: X.509 attribute certificates
>
> AttributeCertificate::= SEQUENCE {
> Acinfo AttributeCertificateInfo,
> signatureAlgorithm AlgorithmIdentifier,
> signatureValue BIT STRING
> }
> AttributeCertificateInfo::= SEQUENCE {
> version AttCertVersion -- version is v2,
> holder Holder,
> issuer AttCertIssuer,
> signature AlgorithmIdentifier,
> serialNumber CertificateSerialNumber,
> attrCertValidityPeriod AttCertValidityPeriod,
> attributes SEQUENCE OF Attribute,
> issuerUniqueID UniqueIdentifier OPTIONAL,
> extensions Extensions OPTIONAL
> }
> Attribute::= SEQUENCE {
> Type AttributeType,
> values SET OF AttributeValue
> -- at least one value is required
> }
> AttributeType::= OBJECT IDENTIFIER
> AttributeValue::= ANY DEFINED BY AttributeType
>
> --> Are these profiles defined ? Can we create specific attributes not
> defined in the norm ?
>
> David.
> --
> View this message in context:
> http://old.nabble.com/Using-cryptlib-and-matching-requirements-tp35062491p35062491.html
> Sent from the Cryptlib mailing list archive at Nabble.com.
>
>
> _______________________________________________
> Cryptlib mailing list
> [email protected] via Mail:
> [email protected]
> Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
> http://news.gmane.org/gmane.comp.encryption.cryptlib
> Posts from non-subscribed addresses are blocked to prevent spam, please
> subscribe in order to post messages.
>

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.