Additional New ASN.1 Modules
draft-turner-additional-new-asn-04

CompressedDataContent
   { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
     smime(16) modules(0) TBD4 }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

IMPORTS
  CMSVersion, EncapsulatedContentInfo,
  CONTENT-TYPE
  FROM CryptographicMessageSyntax-2009
    { iso(1) member-body(2) us(840) rsadsi(113549)
      pkcs(1) pkcs-9(9) smime(16) modules(0) TBD1 }

  AlgorithmIdentifier{}, SMIME-CAPS, ParamOptions
  FROM AlgorithmInformation-2009
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0)
    id-mod-algorithmInformation-02(58)}
  ;

  --
  --  ContentTypes contains the set of content types that are
  --    defined in this module.
  --
  --  The contents of ContentTypes should be added to
  --    ContentSet defined in [RFC5652]
  --

  ContentTypes CONTENT-TYPE ::= {ct-compressedData}

  --
  --  SMimeCaps contains the set of S/MIME capabilities that
  --    are associated with the algorithms defined in this
  --    document.
  --
  --  SMimeCaps are added to SMimeCapsSet defined in [RFC3851].
  --

  SMimeCaps SMIME-CAPS ::= {cpa-zlibCompress.&smimeCaps}

  --
  --  Define the compressed data content type
  --

  ct-compressedData CONTENT-TYPE ::= {
    TYPE CompressedData IDENTIFIED BY id-ct-compressedData
  }

  CompressedData ::= SEQUENCE {
     version CMSVersion (v0),  -- Always set to 0
     compressionAlgorithm CompressionAlgorithmIdentifier,
     encapContentInfo EncapsulatedContentInfo
  }

  CompressionAlgorithmIdentifier ::=
     AlgorithmIdentifier{COMPRESS-ALGORITHM, {CompressAlgorithmSet}}

  CompressAlgorithmSet COMPRESS-ALGORITHM ::= {
    cpa-zlibCompress, ...
  }

  -- Algorithm Identifiers

  id-alg-zlibCompress OBJECT IDENTIFIER ::= { iso(1) member-body(2)
       us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 8 }

  cpa-zlibCompress COMPRESS-ALGORITHM ::= {
    IDENTIFIER id-alg-zlibCompress
    PARAMS TYPE NULL ARE preferredAbsent
    SMIME-CAPS {IDENTIFIED BY id-alg-zlibCompress}
  }

  -- Content Type Object Identifiers

  id-ct-compressedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
       us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1) 9 }

  --
  --  Class defined for compression algorithms
  --

  COMPRESS-ALGORITHM ::= CLASS {
    &id                OBJECT IDENTIFIER UNIQUE,
    &Params            OPTIONAL,
    &paramPresence     ParamOptions DEFAULT absent,
    &smimeCaps         SMIME-CAPS OPTIONAL
  }
  WITH SYNTAX {
    IDENTIFIER &id
    [PARAMS [TYPE &Params] ARE &paramPresence]
    [SMIME-CAPS &smimeCaps]
  }

 END

IPAddrAndASCertExtn { iso(1) identified-organization(3) dod(6)
         internet(1) security(5) mechanisms(5) pkix(7) mod(0)
         TBD6 }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
   EXPORTS ALL;

   IMPORTS

   -- PKIX specific OIDs and arcs --
   id-pe
   FROM PKIX1Explicit-2009
     { iso(1) identified-organization(3) dod(6) internet(1)
       security(5) mechanisms(5) pkix(7) id-mod(0)
       id-mod-pkix1-explicit-02(51)}

   EXTENSION
   FROM PKIX-CommonTypes-2009
     { iso(1) identified-organization(3) dod(6) internet(1)
       security(5) mechanisms(5) pkix(7) id-mod(0)
       id-mod-pkixCommon-02(57)}
   ;

   --
   --  Extensions contains the set of extensions defined in this
   --      module
   --
   --  These are intended to be placed in public key certificates
   --     and thus should be added to the CertExtensions extension
   --     set in PKIXImplicit-2009 defined for [RFC5280]
   --

   Extensions EXTENSION ::= {
      ext-pe-ipAddrBlocks | ext-pe-autonomousSysIds
   }

   -- IP Address Delegation Extension OID --

   ext-pe-ipAddrBlocks EXTENSION ::= {
     SYNTAX IPAddrBlocks
     IDENTIFIED BY id-pe-ipAddrBlocks
   }

   id-pe-ipAddrBlocks  OBJECT IDENTIFIER ::= { id-pe 7 }

   -- IP Address Delegation Extension Syntax --

   IPAddrBlocks        ::= SEQUENCE OF IPAddressFamily

   IPAddressFamily     ::= SEQUENCE { -- AFI & opt SAFI --
      addressFamily        OCTET STRING (SIZE (2..3)),
      ipAddressChoice      IPAddressChoice }

   IPAddressChoice     ::= CHOICE {
      inherit              NULL, -- inherit from issuer --
      addressesOrRanges    SEQUENCE OF IPAddressOrRange }

   IPAddressOrRange    ::= CHOICE {
      addressPrefix        IPAddress,
      addressRange         IPAddressRange }

   IPAddressRange      ::= SEQUENCE {
      min                  IPAddress,
      max                  IPAddress }

   IPAddress           ::= BIT STRING

   -- Autonomous System Identifier Delegation Extension OID --

   ext-pe-autonomousSysIds EXTENSION ::= {
     SYNTAX ASIdentifiers
     IDENTIFIED BY id-pe-autonomousSysIds
   }

   id-pe-autonomousSysIds  OBJECT IDENTIFIER ::= { id-pe 8 }

   -- Autonomous System Identifier Delegation Extension Syntax --

   ASIdentifiers       ::= SEQUENCE {
       asnum               [0] ASIdentifierChoice OPTIONAL,
       rdi                 [1] ASIdentifierChoice OPTIONAL }
       (WITH COMPONENTS {..., asnum PRESENT} |
        WITH COMPONENTS {..., rdi PRESENT})

   ASIdentifierChoice  ::= CHOICE {
      inherit              NULL, -- inherit from issuer --
      asIdsOrRanges        SEQUENCE OF ASIdOrRange }

   ASIdOrRange         ::= CHOICE {
       id                  ASId,
       range               ASRange }

   ASRange             ::= SEQUENCE {
       min                 ASId,
       max                 ASId }

   ASId                ::= INTEGER

END

BinarySigningTimeModule-2009
      { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
        pkcs-9(9) smime(16) modules(0) TBD6 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
  IMPORTS

  -- From PKIX-CommonTypes-2009 [RFC5912]

  ATTRIBUTE
    FROM PKIX-CommonTypes-2009
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkixCommon-02(57) }
 ;

  --
  -- BinaryTime Definition
  --
  --  BinaryTime contains the number seconds since
  --  midnight Jan 1, 1970 UTC.
  --  Leap seconds are EXCLUDED from the computation.
  --

  BinaryTime ::= INTEGER (0..MAX)

  --
  -- Signing Binary Time Attribute
  --
  --   The binary signing time should be added to
  --      SignedAttributeSet and tAuthenticatedAttributeSet
  --      in CMS [RFC5652] and to AuthEnvDataAttributeSet
  --      in [RFC5083].
  --

  aa-binarySigningTime ATTRIBUTE ::= {
    TYPE BinarySigningTime
    IDENTIFIED BY id-aa-binarySigningTime }

  id-aa-binarySigningTime OBJECT IDENTIFIER ::= { iso(1)
    member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
    smime(16) aa(2) 46 }

  BinarySigningTime ::= BinaryTime

END

ContentCollectionModule-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
      pkcs-9(9) smime(16) modules(0) TBD7 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
  IMPORTS

  -- From CryptographicMessageSyntax-2009 [RFC5911]

  CONTENT-TYPE, ContentInfo
    FROM CryptographicMessageSyntax-2009
      { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
        pkcs-9(9) smime(16) modules(0) TBD1 }

  AttributeSet{}, ATTRIBUTE
    FROM PKIX-CommonTypes-2009
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkixCommon-02(57) }
  ;

  --
  --  An object set of all content types defined by this module.
  --    This is to be added to ContentSet in the CMS module
  --

  ContentSet CONTENT-TYPE ::= {
      ct-ContentCollection | ct-ContentWithAttributes, ...
  }

  --
  -- Content Collection Content Type and Object Identifier
  --

  ct-ContentCollection CONTENT-TYPE ::= {
    TYPE ContentCollection IDENTIFIED BY id-ct-contentCollection }

  id-ct-contentCollection OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) ct(1) 19 }

  ContentCollection ::= SEQUENCE SIZE (1..MAX) OF ContentInfo

  --
  -- Content With Attributes Content Type and Object Identifier
  --

  ct-ContentWithAttributes CONTENT-TYPE ::= {
    TYPE ContentWithAttributes IDENTIFIED BY id-ct-contentWithAttrs }

  id-ct-contentWithAttrs OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) ct(1) 20 }

  ContentWithAttributes ::= SEQUENCE {
     content  ContentInfo,
     attrs    SEQUENCE SIZE (1..MAX) OF AttributeSet
                                               {{ ContentAttributeSet }}
  }

   ContentAttributeSet ATTRIBUTE ::= { ... }
END

HMAC -- { TBD } --
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
  EXPORTS ALL;

  IMPORTS

  MAC-ALGORITHM, SMIME-CAPS
  FROM AlgorithmInformation-2009
    { iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0)
      id-mod-algorithmInformation-02(58)};

  --
  --  This object set contains all of the MAC algorithms that are
  --    defined in this module.
  --  One would add it to a constraining set of objects such as the
  --    MessageAuthenticationCodeAlgorithmSet in [RFC5652]
  --

  MessageAuthAlgs MAC-ALGORITHM ::= {
    maca-hMAC-SHA224 |
    maca-hMAC-SHA256 |
    maca-hMAC-SHA384 |
    maca-hMAC-SHA512
  }

  --
  --  This object set contains all of the S/MIME capabilities that
  --     have been defined for all the MAC algorithms in this module.
  --  One would add this to an object set that is used to restrict
  --    smime capabilities such as the SMimeCapsSet variable in
  --    the S/MIME message draft
  --

  SMimeCaps SMIME-CAPS ::= {
    maca-hMAC-SHA224.&smimeCaps     |
    maca-hMAC-SHA256.&smimeCaps     |
    maca-hMAC-SHA384.&smimeCaps     |
    maca-hMAC-SHA512.&smimeCaps
  }

  --
  --  Define the base OID for the algorithm identifiers
  --

  rsadsi OBJECT IDENTIFIER ::=
       {iso(1) member-body(2) us(840) rsadsi(113549)}

  digestAlgorithm   OBJECT IDENTIFIER ::= {rsadsi 2}

  --
  --  Define the necessary algorithm identifiers
  --

  id-hmacWithSHA224 OBJECT IDENTIFIER ::= {digestAlgorithm 8}
  id-hmacWithSHA256 OBJECT IDENTIFIER ::= {digestAlgorithm 9}
  id-hmacWithSHA384 OBJECT IDENTIFIER ::= {digestAlgorithm 10}
  id-hmacWithSHA512 OBJECT IDENTIFIER ::= {digestAlgorithm 11}

  --
  --  Define each of the MAC-ALGOIRTHM objects to describe the
  --    algorithms defined
  --

  maca-hMAC-SHA224 MAC-ALGORITHM ::= {
    IDENTIFIER id-hmacWithSHA224
    PARAMS TYPE NULL ARE preferredPresent
    IS-KEYED-MAC TRUE
    SMIME-CAPS {IDENTIFIED BY id-hmacWithSHA224}
  }


  maca-hMAC-SHA256 MAC-ALGORITHM ::= {
    IDENTIFIER id-hmacWithSHA256
    PARAMS TYPE NULL ARE preferredPresent
    IS-KEYED-MAC TRUE
    SMIME-CAPS {IDENTIFIED BY id-hmacWithSHA256}
  }


  maca-hMAC-SHA384 MAC-ALGORITHM ::= {
    IDENTIFIER id-hmacWithSHA384
    PARAMS TYPE NULL ARE preferredPresent
    IS-KEYED-MAC TRUE
    SMIME-CAPS {IDENTIFIED BY id-hmacWithSHA384}
  }


  maca-hMAC-SHA512 MAC-ALGORITHM ::= {
    IDENTIFIER id-hmacWithSHA512
    PARAMS TYPE NULL ARE preferredPresent
    IS-KEYED-MAC TRUE
    SMIME-CAPS {IDENTIFIED BY id-hmacWithSHA512}
  }

END

WLANCertExtn
   { iso(1) identified-organization(3) dod(6) internet(1)
     security(5) mechanisms(5) pkix(7) id-mod(0)
     TBD8 }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN
  EXPORTS ALL;

  IMPORTS

  EXTENSION, ATTRIBUTE
  FROM PKIX-CommonTypes-2009
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}

  id-pe, id-kp
  FROM PKIX1Explicit-2009
    { iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}

  id-aca
  FROM PKIXAttributeCertificate-2009
    { iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0) id-mod-attribute-cert-02(47)}

  ;

  -- Extended Key Usage Values


  KeyUsageValues OBJECT IDENTIFIER ::= {
      id-kp-eapOverPPP | id-kp-eapOverLAN
  }

  id-kp-eapOverPPP  OBJECT IDENTIFIER  ::=  { id-kp 13 }

  id-kp-eapOverLAN  OBJECT IDENTIFIER  ::=  { id-kp 14 }


  -- Wireless LAN SSID Extension


  ext-pe-wlanSSID EXTENSION ::= {
    SYNTAX SSIDList
    IDENTIFIED BY id-pe-wlanSSID
    CRITICALITY {FALSE}
  }

  id-pe-wlanSSID  OBJECT IDENTIFIER  ::=  { id-pe 13 }

  SSIDList  ::=  SEQUENCE SIZE (1..MAX) OF SSID

  SSID  ::=  OCTET STRING (SIZE (1..32))


  -- Wireless LAN SSID Attribute Certificate Attribute
  -- Uses same syntax as the certificate extension: SSIDList


   at-aca-wlanSSID ATTRIBUTE ::= {
     TYPE SSIDList
     IDENTIFIED BY id-aca-wlanSSID
   }


   id-aca-wlanSSID  OBJECT IDENTIFIER ::= { id-aca 7 }

  END

CMS-AuthEnvelopedData-2009
    {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) modules(0) TBD2}
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS

CMSVersion, EncryptedContentInfoType{},
    MessageAuthenticationCode, OriginatorInfo, RecipientInfos,
    CONTENT-TYPE, Attributes{}, ATTRIBUTE, CONTENT-ENCRYPTION,
    AlgorithmIdentifier{},
    aa-signingTime, aa-messageDigest, aa-contentType
FROM CryptographicMessageSyntax-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
      smime(16) modules(0) id-mod-cms-2004-02(TBD1)}

ContentEncryptionAlgs
FROM CMS-AES-CCM-and-AES-GCM-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
      pkcs-9(9) smime(16) modules(0) id-mod-cms-aes-ccm-gcm-02(44) }
;

ContentTypes CONTENT-TYPE ::= {ct-authEnvelopedData, ... }

ct-authEnvelopedData CONTENT-TYPE ::= {
   TYPE AuthEnvelopedData IDENTIFIED BY id-ct-authEnvelopedData
}

id-ct-authEnvelopedData OBJECT IDENTIFIER ::=
    {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) ct(1) 23}

AuthEnvelopedData ::= SEQUENCE {
    version CMSVersion,
    originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
    recipientInfos RecipientInfos,
    authEncryptedContentInfo EncryptedContentInfo,
    authAttrs [1] IMPLICIT AuthAttributes OPTIONAL,
    mac MessageAuthenticationCode,
    unauthAttrs [2] IMPLICIT UnauthAttributes OPTIONAL
}

EncryptedContentInfo ::=
  EncryptedContentInfoType { AuthContentEncryptionAlgorithmIdentifier }

AuthContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
   {CONTENT-ENCRYPTION, {AuthContentEncryptionAlgorithmSet}}

AuthContentEncryptionAlgorithmSet CONTENT-ENCRYPTION ::= {
        ContentEncryptionAlgs, ...}

AuthAttributes ::= Attributes{{AuthEnvDataAttributeSet}}

UnauthAttributes ::= Attributes{{UnauthEnvDataAttributeSet}}

AuthEnvDataAttributeSet ATTRIBUTE ::= {
    aa-contentType | aa-messageDigest | aa-signingTime, ... }

UnauthEnvDataAttributeSet ATTRIBUTE ::= {...}

END

CryptographicMessageSyntax-2009
    { iso(1) member-body(2) us(840) rsadsi(113549)
    pkcs(1) pkcs-9(9) smime(16) modules(0) TBD1 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS

ParamOptions, DIGEST-ALGORITHM, SIGNATURE-ALGORITHM,
    PUBLIC-KEY, KEY-DERIVATION, KEY-WRAP, MAC-ALGORITHM,
    KEY-AGREE, KEY-TRANSPORT, CONTENT-ENCRYPTION, ALGORITHM,
    AlgorithmIdentifier{}
FROM AlgorithmInformation-2009
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0)
    id-mod-algorithmInformation-02(58)}

SignatureAlgs, MessageDigestAlgs, KeyAgreementAlgs,
    MessageAuthAlgs, KeyWrapAlgs, ContentEncryptionAlgs,
    KeyTransportAlgs, KeyDerivationAlgs, KeyAgreePublicKeys
FROM CryptographicMessageSyntaxAlgorithms-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) modules(0) id-mod-cmsalg-2001-02(37) }

Certificate, CertificateList, CertificateSerialNumber,
    Name, ATTRIBUTE
FROM PKIX1Explicit-2009
    { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) id-mod(0)
    id-mod-pkix1-explicit-02(51) }

AttributeCertificate
FROM PKIXAttributeCertificate-2009
    { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) id-mod(0)
    id-mod-attribute-cert-02(47) }

AttributeCertificateV1
FROM AttributeCertificateVersion1-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) modules(0) id-mod-v1AttrCert-02(49) } ;

-- Cryptographic Message Syntax

-- The following are used for version numbers using the ASN.1
--   idiom "[[n:"
--   Version 1 = PKCS #7
--   Version 2 = S/MIME V2
--   Version 3 = RFC 2630
--   Version 4 = RFC 3369
--   Version 5 = RFC 3852

CONTENT-TYPE ::= CLASS {
     &id        OBJECT IDENTIFIER UNIQUE,
     &Type      OPTIONAL
} WITH SYNTAX {
    [TYPE &Type] IDENTIFIED BY &id
}

ContentType ::= CONTENT-TYPE.&id

ContentInfo ::= SEQUENCE {
    contentType        CONTENT-TYPE.
                    &id({ContentSet}),
    content            [0] EXPLICIT CONTENT-TYPE.
                    &Type({ContentSet}{@contentType})}

ContentSet CONTENT-TYPE ::= {
    --  Define the set of content types to be recognized.
    ct-Data | ct-SignedData | ct-EncryptedData | ct-EnvelopedData |
    ct-AuthenticatedData | ct-DigestedData, ... }

SignedData ::= SEQUENCE {
    version CMSVersion,
    digestAlgorithms SET OF DigestAlgorithmIdentifier,
    encapContentInfo EncapsulatedContentInfo,
    certificates [0] IMPLICIT CertificateSet OPTIONAL,
    crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
    signerInfos SignerInfos }

SignerInfos ::= SET OF SignerInfo

EncapsulatedContentInfo ::= SEQUENCE {
    eContentType       CONTENT-TYPE.&id({ContentSet}),
    eContent           [0] EXPLICIT OCTET STRING
            ( CONTAINING CONTENT-TYPE.
                &Type({ContentSet}{@eContentType})) OPTIONAL }

SignerInfo ::= SEQUENCE {
    version CMSVersion,
    sid SignerIdentifier,
    digestAlgorithm DigestAlgorithmIdentifier,
    signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
    signatureAlgorithm SignatureAlgorithmIdentifier,
    signature SignatureValue,
    unsignedAttrs [1] IMPLICIT Attributes
        {{UnsignedAttributes}} OPTIONAL }

SignedAttributes ::= Attributes {{ SignedAttributesSet }}

SignerIdentifier ::= CHOICE {
    issuerAndSerialNumber IssuerAndSerialNumber,
    ...,
    [[3: subjectKeyIdentifier [0] SubjectKeyIdentifier ]] }

SignedAttributesSet ATTRIBUTE ::=
    { aa-signingTime | aa-messageDigest | aa-contentType, ... }

UnsignedAttributes ATTRIBUTE ::= { aa-countersignature, ... }

SignatureValue ::= OCTET STRING

EnvelopedData ::= SEQUENCE {
    version CMSVersion,
    originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
    recipientInfos RecipientInfos,
    encryptedContentInfo EncryptedContentInfo,
    ...,
    [[2: unprotectedAttrs [1] IMPLICIT Attributes
        {{ UnprotectedEnvAttributes }} OPTIONAL ]] }

OriginatorInfo ::= SEQUENCE {
    certs [0] IMPLICIT CertificateSet OPTIONAL,
    crls [1] IMPLICIT RevocationInfoChoices OPTIONAL }

RecipientInfos ::= SET SIZE (1..MAX) OF RecipientInfo

EncryptedContentInfo ::=
    EncryptedContentInfoType { ContentEncryptionAlgorithmIdentifier }

EncryptedContentInfoType { AlgorithmIdentifierType } ::= SEQUENCE {
    contentType        CONTENT-TYPE.&id({ContentSet}),
    contentEncryptionAlgorithm AlgorithmIdentifierType,
    encryptedContent   [0] IMPLICIT OCTET STRING OPTIONAL }


-- If you want to do constraints, you might use:
-- EncryptedContentInfo ::= SEQUENCE {
--  contentType        CONTENT-TYPE.&id({ContentSet}),
--  contentEncryptionAlgorithm ContentEncryptionAlgorithmIdentifier,
--  encryptedContent   [0] IMPLICIT ENCRYPTED {CONTENT-TYPE.
--      &Type({ContentSet}{@contentType}) OPTIONAL }
-- ENCRYPTED {ToBeEncrypted} ::= OCTET STRING ( CONSTRAINED BY
--        { ToBeEncrypted } )

UnprotectedEnvAttributes ATTRIBUTE ::=  { ... }
UnprotectedEncAttributes ATTRIBUTE ::=  { ... }

RecipientInfo ::= CHOICE {
    ktri           KeyTransRecipientInfo,
    ...,
    [[3: kari  [1] KeyAgreeRecipientInfo ]],
    [[4: kekri [2] KEKRecipientInfo]],
    [[5: pwri  [3] PasswordRecipientInfo,
         ori   [4] OtherRecipientInfo ]] }

EncryptedKey ::= OCTET STRING

KeyTransRecipientInfo ::= SEQUENCE {
    version CMSVersion,  -- always set to 0 or 2
    rid RecipientIdentifier,
    keyEncryptionAlgorithm AlgorithmIdentifier
        {KEY-TRANSPORT, {KeyTransportAlgorithmSet}},
    encryptedKey EncryptedKey }

KeyTransportAlgorithmSet KEY-TRANSPORT ::= { KeyTransportAlgs, ... }

RecipientIdentifier ::= CHOICE {
    issuerAndSerialNumber IssuerAndSerialNumber,
    ...,
    [[2: subjectKeyIdentifier [0] SubjectKeyIdentifier ]] }
KeyAgreeRecipientInfo ::= SEQUENCE {
    version CMSVersion,  -- always set to 3
    originator [0] EXPLICIT OriginatorIdentifierOrKey,
    ukm [1] EXPLICIT UserKeyingMaterial OPTIONAL,
    keyEncryptionAlgorithm AlgorithmIdentifier
        {KEY-AGREE, {KeyAgreementAlgorithmSet}},
    recipientEncryptedKeys RecipientEncryptedKeys }

KeyAgreementAlgorithmSet KEY-AGREE ::= { KeyAgreementAlgs, ... }

OriginatorIdentifierOrKey ::= CHOICE {
    issuerAndSerialNumber IssuerAndSerialNumber,
    subjectKeyIdentifier [0] SubjectKeyIdentifier,
    originatorKey [1] OriginatorPublicKey }

OriginatorPublicKey ::= SEQUENCE {
    algorithm AlgorithmIdentifier {PUBLIC-KEY, {OriginatorKeySet}},
    publicKey BIT STRING }

OriginatorKeySet PUBLIC-KEY ::= { KeyAgreePublicKeys, ... }

RecipientEncryptedKeys ::= SEQUENCE OF RecipientEncryptedKey

RecipientEncryptedKey ::= SEQUENCE {
    rid KeyAgreeRecipientIdentifier,
    encryptedKey EncryptedKey }

KeyAgreeRecipientIdentifier ::= CHOICE {
    issuerAndSerialNumber IssuerAndSerialNumber,
    rKeyId [0] IMPLICIT RecipientKeyIdentifier }

RecipientKeyIdentifier ::= SEQUENCE {
    subjectKeyIdentifier SubjectKeyIdentifier,
    date GeneralizedTime OPTIONAL,
    other OtherKeyAttribute OPTIONAL }

SubjectKeyIdentifier ::= OCTET STRING

KEKRecipientInfo ::= SEQUENCE {
    version CMSVersion,  -- always set to 4
    kekid KEKIdentifier,
    keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
    encryptedKey EncryptedKey }

KEKIdentifier ::= SEQUENCE {
    keyIdentifier OCTET STRING,
    date GeneralizedTime OPTIONAL,
    other OtherKeyAttribute OPTIONAL }
PasswordRecipientInfo ::= SEQUENCE {
    version CMSVersion,   -- always set to 0
    keyDerivationAlgorithm [0] KeyDerivationAlgorithmIdentifier
                            OPTIONAL,
    keyEncryptionAlgorithm KeyEncryptionAlgorithmIdentifier,
    encryptedKey EncryptedKey }

OTHER-RECIPIENT ::= TYPE-IDENTIFIER

OtherRecipientInfo ::= SEQUENCE {
    oriType    OTHER-RECIPIENT.
            &id({SupportedOtherRecipInfo}),
    oriValue   OTHER-RECIPIENT.
            &Type({SupportedOtherRecipInfo}{@oriType})}

SupportedOtherRecipInfo OTHER-RECIPIENT ::= { ... }

DigestedData ::= SEQUENCE {
    version CMSVersion,
    digestAlgorithm DigestAlgorithmIdentifier,
    encapContentInfo EncapsulatedContentInfo,
    digest Digest, ... }

Digest ::= OCTET STRING

EncryptedData ::= SEQUENCE {
    version CMSVersion,
    encryptedContentInfo EncryptedContentInfo,
    ...,
    [[2: unprotectedAttrs [1] IMPLICIT Attributes
        {{UnprotectedEncAttributes}} OPTIONAL ]] }

AuthenticatedData ::= SEQUENCE {
    version CMSVersion,
    originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
    recipientInfos RecipientInfos,
    macAlgorithm MessageAuthenticationCodeAlgorithm,
    digestAlgorithm [1] DigestAlgorithmIdentifier OPTIONAL,
    encapContentInfo EncapsulatedContentInfo,
    authAttrs [2] IMPLICIT AuthAttributes OPTIONAL,
    mac MessageAuthenticationCode,
    unauthAttrs [3] IMPLICIT UnauthAttributes OPTIONAL }

AuthAttributes ::= SET SIZE (1..MAX) OF Attribute
    {{AuthAttributeSet}}

AuthAttributeSet ATTRIBUTE ::= { aa-contentType | aa-messageDigest
                                     | aa-signingTime, ...}
MessageAuthenticationCode ::= OCTET STRING

UnauthAttributes ::= SET SIZE (1..MAX) OF Attribute
    {{UnauthAttributeSet}}

UnauthAttributeSet ATTRIBUTE ::= {...}

--
--  General algorithm definitions
--

DigestAlgorithmIdentifier ::= AlgorithmIdentifier
    {DIGEST-ALGORITHM, {DigestAlgorithmSet}}

DigestAlgorithmSet DIGEST-ALGORITHM ::= {
    CryptographicMessageSyntaxAlgorithms-2009.MessageDigestAlgs, ... }

SignatureAlgorithmIdentifier ::= AlgorithmIdentifier
    {SIGNATURE-ALGORITHM, {SignatureAlgorithmSet}}

SignatureAlgorithmSet SIGNATURE-ALGORITHM ::=
    { SignatureAlgs, ... }

KeyEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
    {KEY-WRAP, {KeyEncryptionAlgorithmSet}}

KeyEncryptionAlgorithmSet KEY-WRAP ::= { KeyWrapAlgs, ... }

ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
    {CONTENT-ENCRYPTION, {ContentEncryptionAlgorithmSet}}

ContentEncryptionAlgorithmSet CONTENT-ENCRYPTION ::=
    { ContentEncryptionAlgs, ... }

MessageAuthenticationCodeAlgorithm ::= AlgorithmIdentifier
    {MAC-ALGORITHM, {MessageAuthenticationCodeAlgorithmSet}}

MessageAuthenticationCodeAlgorithmSet MAC-ALGORITHM ::=
    { MessageAuthAlgs, ... }

KeyDerivationAlgorithmIdentifier ::= AlgorithmIdentifier
    {KEY-DERIVATION, {KeyDerivationAlgs, ...}}

RevocationInfoChoices ::= SET OF RevocationInfoChoice

RevocationInfoChoice ::= CHOICE {
    crl CertificateList,
    ...,
    [[5: other [1] IMPLICIT OtherRevocationInfoFormat ]] }

OTHER-REVOK-INFO ::= TYPE-IDENTIFIER

OtherRevocationInfoFormat ::= SEQUENCE {
    otherRevInfoFormat    OTHER-REVOK-INFO.
            &id({SupportedOtherRevokInfo}),
    otherRevInfo          OTHER-REVOK-INFO.
            &Type({SupportedOtherRevokInfo}{@otherRevInfoFormat})}

SupportedOtherRevokInfo OTHER-REVOK-INFO ::= { ... }

CertificateChoices ::= CHOICE {
    certificate Certificate,
    extendedCertificate [0] IMPLICIT ExtendedCertificate,
         -- Obsolete
    ...,
    [[3: v1AttrCert [1] IMPLICIT AttributeCertificateV1]],
         -- Obsolete
    [[4: v2AttrCert [2] IMPLICIT AttributeCertificateV2]],
    [[5: other      [3] IMPLICIT OtherCertificateFormat]] }

AttributeCertificateV2 ::= AttributeCertificate

OTHER-CERT-FMT ::= TYPE-IDENTIFIER

OtherCertificateFormat ::= SEQUENCE {
    otherCertFormat OTHER-CERT-FMT.
            &id({SupportedCertFormats}),
    otherCert       OTHER-CERT-FMT.
            &Type({SupportedCertFormats}{@otherCertFormat})}

SupportedCertFormats OTHER-CERT-FMT ::= { ... }

CertificateSet ::= SET OF CertificateChoices

IssuerAndSerialNumber ::= SEQUENCE {
    issuer Name,
    serialNumber CertificateSerialNumber }

CMSVersion ::= INTEGER  { v0(0), v1(1), v2(2), v3(3), v4(4), v5(5) }

UserKeyingMaterial ::= OCTET STRING

KEY-ATTRIBUTE ::= TYPE-IDENTIFIER

OtherKeyAttribute ::= SEQUENCE {
    keyAttrId  KEY-ATTRIBUTE.
            &id({SupportedKeyAttributes}),
    keyAttr    KEY-ATTRIBUTE.
            &Type({SupportedKeyAttributes}{@keyAttrId})}

SupportedKeyAttributes KEY-ATTRIBUTE ::= { ... }

-- Content Type Object Identifiers

id-ct-contentInfo OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) ct(1) 6 }

ct-Data CONTENT-TYPE ::= {IDENTIFIED BY id-data }

id-data OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 1 }

ct-SignedData CONTENT-TYPE ::=
    { TYPE SignedData IDENTIFIED BY id-signedData}

id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }

ct-EnvelopedData CONTENT-TYPE ::=
    { TYPE EnvelopedData IDENTIFIED BY id-envelopedData}

id-envelopedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 3 }

ct-DigestedData CONTENT-TYPE ::=
    { TYPE DigestedData IDENTIFIED BY id-digestedData}

id-digestedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 5 }

ct-EncryptedData CONTENT-TYPE ::=
    { TYPE EncryptedData IDENTIFIED BY id-encryptedData}

id-encryptedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 6 }

ct-AuthenticatedData CONTENT-TYPE ::=
    { TYPE AuthenticatedData IDENTIFIED BY id-ct-authData}

id-ct-authData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) ct(1) 2 }

--
-- The CMS Attributes
--

MessageDigest ::= OCTET STRING

SigningTime  ::= Time

Time ::= CHOICE {
    utcTime UTCTime,
    generalTime GeneralizedTime }

Countersignature ::= SignerInfo

-- Attribute Object Identifiers

aa-contentType ATTRIBUTE ::=
    { TYPE ContentType IDENTIFIED BY id-contentType }
id-contentType OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs9(9) 3 }

aa-messageDigest ATTRIBUTE ::=
    { TYPE MessageDigest IDENTIFIED BY id-messageDigest}
id-messageDigest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs9(9) 4 }

aa-signingTime ATTRIBUTE ::=
    { TYPE SigningTime IDENTIFIED BY id-signingTime }
id-signingTime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs9(9) 5 }

aa-countersignature ATTRIBUTE ::=
    { TYPE Countersignature IDENTIFIED BY id-countersignature }
id-countersignature OBJECT IDENTIFIER ::= { iso(1) member-body(2)
   us(840) rsadsi(113549) pkcs(1) pkcs9(9) 6 }

--
-- Obsolete Extended Certificate syntax from PKCS#6
--

ExtendedCertificateOrCertificate ::= CHOICE {
    certificate Certificate,
    extendedCertificate [0] IMPLICIT ExtendedCertificate }

ExtendedCertificate ::= SEQUENCE {
    extendedCertificateInfo ExtendedCertificateInfo,
    signatureAlgorithm SignatureAlgorithmIdentifier,
    signature Signature }

ExtendedCertificateInfo ::= SEQUENCE {
    version CMSVersion,
    certificate Certificate,
    attributes UnauthAttributes }

Signature ::= BIT STRING

Attribute{ ATTRIBUTE:AttrList } ::= SEQUENCE {
    attrType           ATTRIBUTE.
            &id({AttrList}),
    attrValues         SET OF ATTRIBUTE.
            &Type({AttrList}{@attrType})  }

Attributes { ATTRIBUTE:AttrList } ::=
    SET SIZE (1..MAX) OF Attribute {{ AttrList }}

END

MultipleSignatures-2009
  { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
    smime(16) modules(0) TBD9 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
  -- EXPORTS All
  -- The types and values defined in this module are exported for use
  -- in the other ASN.1 modules.  Other applications may use them for
  -- their own purposes.

  IMPORTS

  -- Imports from PKIX-Common-Types-2009 [RFC5912]

  ATTRIBUTE
    FROM PKIX-CommonTypes-2009
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkixCommon-02(57) }

  -- Imports from CryptographicMessageSyntax-2009 [RFC5911]

  DigestAlgorithmIdentifier, SignatureAlgorithmIdentifier
    FROM CryptographicMessageSyntax-2009
    { iso(1) member-body(2) us(840) rsadsi(113549)
      pkcs(1) pkcs-9(9) smime(16) modules(0) TBD1 }

  -- Imports from ExtendedSecurityServices-2009 [RFC5911]

  ESSCertIDv2
    FROM ExtendedSecurityServices-2009
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
      smime(16) modules(0) id-mod-ess-2006-02(42) }
  ;

  --
  -- Section 3.0
  --
  --  at-multipleSignatures should be added ONLY to the
  --    SignedAttributesSet defined in [RFC5652]
  --

  at-multipleSignatures ATTRIBUTE ::= {
    TYPE MultipleSignatures
    IDENTIFIED BY id-aa-multipleSignatures
  }

  id-aa-multipleSignatures OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
    id-aa(2) 51 }

  MultipleSignatures ::= SEQUENCE {
    bodyHashAlg     DigestAlgorithmIdentifier,
    signAlg         SignatureAlgorithmIdentifier,
    signAttrsHash   SignAttrsHash,
    cert            ESSCertIDv2 OPTIONAL
  }

  SignAttrsHash ::= SEQUENCE {
    algID            DigestAlgorithmIdentifier,
    hash             OCTET STRING
  }

END

ModuleNumbers
DEFINITIONS TAGS ::=
BEGIN
   id-mod-CMS ::= { iso(1) member-body(2) us(840) rsadsi(113549)
      pkcs(1) pkcs-9(9) smime(16) modules(0) TBD }

   id-mod-AlgInfo ::=
      {iso(1) identified-organization(3) dod(6) internet(1)
       security(5) mechanisms(5) pkix(7) id-mod(0)
       id-mod-algorithmInformation-02(58)}
END

IMPORTS
  id-mod-CMS, id-mod-AlgInfo
  FROM ModuleNumber   -- Note it will match on the name since no
                      -- OID is provided

  CMSVersion, EncapsulatedContentInfo, CONTENT-TYPE
  FROM CryptographicMessageSyntax-2009
    id-mod-CMS

  AlgorithmIdentifier{}, SMIME-CAPS, ParamOptions
  FROM AlgorithmInformation-2009 id-mod-AlgInfo
  ;