320 lines
10 KiB
OCaml
320 lines
10 KiB
OCaml
|
|
(*
|
|
* Object Identifiers: magic numbers with a tie. Some OIDs also have an MBA.
|
|
*
|
|
* http://www.alvestrand.no/objectid/
|
|
* http://oid-info.com/
|
|
*)
|
|
|
|
open Asn.OID
|
|
|
|
let pkix = base 1 3 <| 6 <| 1 <| 5 <| 5 <| 7
|
|
|
|
let usa = base 1 2 <| 840
|
|
let rsadsi = usa <| 113549
|
|
let pkcs = rsadsi <| 1
|
|
|
|
let us_govt = base 2 16 <| 840 <| 1 <| 101
|
|
let nist_alg = us_govt <| 3 <| 4
|
|
let hash_algs = nist_alg <| 2
|
|
|
|
(* PKCS1 *)
|
|
|
|
and md5 = rsadsi <| 2 <| 5
|
|
and sha1 = base 1 3 <| 14 <| 3 <| 2 <| 26
|
|
and sha1_rsa_encryption = base 1 3 <| 14 <| 3 <| 2 <| 29
|
|
|
|
(* rfc5758 *)
|
|
|
|
let sha256 = hash_algs <| 1
|
|
and sha384 = hash_algs <| 2
|
|
and sha512 = hash_algs <| 3
|
|
and sha224 = hash_algs <| 4
|
|
|
|
module ANSI_X9_62 = struct
|
|
|
|
let ansi_x9_62 = usa <| 10045
|
|
|
|
let ecdsa_sha1 = ansi_x9_62 <| 1
|
|
let prime_field = ecdsa_sha1 <| 1
|
|
and characteristic_2_field = ecdsa_sha1 <| 2
|
|
|
|
let key_type = ansi_x9_62 <| 2
|
|
let ec_pub_key = key_type <| 1
|
|
|
|
let signatures = ansi_x9_62 <| 4
|
|
let field_type = signatures <| 1
|
|
and ecdsa_sha2 = signatures <| 3
|
|
|
|
let ecdsa_sha224 = ecdsa_sha2 <| 1
|
|
and ecdsa_sha256 = ecdsa_sha2 <| 2
|
|
and ecdsa_sha384 = ecdsa_sha2 <| 3
|
|
and ecdsa_sha512 = ecdsa_sha2 <| 4
|
|
|
|
(* from RFC 5480 *)
|
|
let certicom = base 1 3 <| 132 <| 0
|
|
let curves = ansi_x9_62 <| 3 <| 1
|
|
|
|
let secp224r1 = certicom <| 33
|
|
let secp256r1 = curves <| 7
|
|
let secp384r1 = certicom <| 34
|
|
let secp521r1 = certicom <| 35
|
|
end
|
|
|
|
module PKCS1 = struct
|
|
let pkcs1 = pkcs <| 1
|
|
|
|
let rsa_encryption = pkcs1 <| 1
|
|
and md5_rsa_encryption = pkcs1 <| 4
|
|
and sha1_rsa_encryption = pkcs1 <| 5
|
|
and rsaes_oaep = pkcs1 <| 7
|
|
and rsassa_pss = pkcs1 <| 10
|
|
and sha256_rsa_encryption = pkcs1 <| 11
|
|
and sha384_rsa_encryption = pkcs1 <| 12
|
|
and sha512_rsa_encryption = pkcs1 <| 13
|
|
and sha224_rsa_encryption = pkcs1 <| 14
|
|
end
|
|
|
|
module RFC8410 = struct
|
|
let thawte = base 1 3 <| 101
|
|
|
|
let x25519 = thawte <| 110
|
|
and x448 = thawte <| 111
|
|
and ed25519 = thawte <| 112
|
|
and ed448 = thawte <| 113
|
|
end
|
|
|
|
module PKCS2 = struct
|
|
let pkcs2 = rsadsi <| 2
|
|
|
|
let md4 = pkcs2 <| 4
|
|
and hmac_sha1 = pkcs2 <| 7
|
|
and hmac_sha224 = pkcs2 <| 8
|
|
and hmac_sha256 = pkcs2 <| 9
|
|
and hmac_sha384 = pkcs2 <| 10
|
|
and hmac_sha512 = pkcs2 <| 11
|
|
end
|
|
|
|
module PKCS5 = struct
|
|
let pkcs5 = pkcs <| 5
|
|
|
|
let pbe_md2_des_cbc = pkcs5 <| 1
|
|
and pbe_md5_des_cbc = pkcs5 <| 3
|
|
and pbe_md2_rc2_cbc = pkcs5 <| 4
|
|
and pbe_md5_rc2_cbc = pkcs5 <| 6
|
|
and pbe_md5_xor = pkcs5 <| 9
|
|
and pbe_sha1_des_cbc = pkcs5 <| 10
|
|
and pbe_sha1_rc2_cbc = pkcs5 <| 11
|
|
and pbkdf2 = pkcs5 <| 12
|
|
and pbes2 = pkcs5 <| 13
|
|
and pbmac1 = pkcs5 <| 14
|
|
|
|
let aes = nist_alg <| 1
|
|
let aes128_cbc = aes <| 2
|
|
and aes192_cbc = aes <| 22
|
|
and aes256_cbc = aes <| 42
|
|
end
|
|
|
|
module PKCS7 = struct
|
|
let pkcs7 = pkcs <| 7
|
|
|
|
let data = pkcs7 <| 1
|
|
and signed_data = pkcs7 <| 2
|
|
and enveloped_data = pkcs7 <| 3
|
|
and signed_and_enveloped_data = pkcs7 <| 4
|
|
and digested_data = pkcs7 <| 5
|
|
and encrypted_data = pkcs7 <| 6
|
|
end
|
|
|
|
module PKCS9 = struct
|
|
let pkcs9 = pkcs <| 9
|
|
|
|
let email = pkcs9 <| 1
|
|
and unstructured_name = pkcs9 <| 2
|
|
and content_type = pkcs9 <| 3
|
|
and message_digest = pkcs9 <| 4
|
|
and signing_time = pkcs9 <| 5
|
|
and challenge_password = pkcs9 <| 7
|
|
and unstructured_address = pkcs9 <| 8
|
|
and signing_description = pkcs9 <| 13
|
|
and extension_request = pkcs9 <| 14
|
|
and smime_capabilities = pkcs9 <| 15
|
|
and smime_oid_registry = pkcs9 <| 16
|
|
and friendly_name = pkcs9 <| 20
|
|
and local_key_id = pkcs9 <| 21
|
|
and cert_types = pkcs9 <| 22
|
|
and crl_types = pkcs9 <| 23
|
|
end
|
|
|
|
module PKCS12 = struct
|
|
let pkcs12 = pkcs <| 12
|
|
|
|
let bagtypes = pkcs12 <| 10 <| 1
|
|
|
|
let key_bag = bagtypes <| 1
|
|
and pkcs8_shrouded_key_bag = bagtypes <| 2
|
|
and cert_bag = bagtypes <| 3
|
|
and crl_bag = bagtypes <| 4
|
|
and secret_bag = bagtypes <| 5
|
|
and safe_contents_bag = bagtypes <| 6
|
|
|
|
let pbe_ids = pkcs12 <| 1
|
|
|
|
let pbe_with_SHA_and_128Bit_RC4 = pbe_ids <| 1
|
|
and pbe_with_SHA_and_40Bit_RC4 = pbe_ids <| 2
|
|
and pbe_with_SHA_and_3_KeyTripleDES_CBC = pbe_ids <| 3
|
|
and pbe_with_SHA_and_2_KeyTripleDES_CBC = pbe_ids <| 4
|
|
and pbe_with_SHA_and_128Bit_RC2_CBC = pbe_ids <| 5
|
|
and pbe_with_SHA_and_40Bit_RC2_CBC = pbe_ids <| 6
|
|
end
|
|
|
|
module X520 = struct
|
|
let x520 = base 2 5 <| 4
|
|
|
|
let object_class = x520 <| 0
|
|
and aliased_entry_name = x520 <| 1
|
|
and knowldgeinformation = x520 <| 2
|
|
and common_name = x520 <| 3
|
|
and surname = x520 <| 4
|
|
and serial_number = x520 <| 5
|
|
and country_name = x520 <| 6
|
|
and locality_name = x520 <| 7
|
|
and state_or_province_name = x520 <| 8
|
|
and street_address = x520 <| 9
|
|
and organization_name = x520 <| 10
|
|
and organizational_unit_name = x520 <| 11
|
|
and title = x520 <| 12
|
|
and description = x520 <| 13
|
|
and search_guide = x520 <| 14
|
|
and business_category = x520 <| 15
|
|
and postal_address = x520 <| 16
|
|
and postal_code = x520 <| 17
|
|
and post_office_box = x520 <| 18
|
|
and physical_delivery_office_name = x520 <| 19
|
|
and telephone_number = x520 <| 20
|
|
and telex_number = x520 <| 21
|
|
and teletex_terminal_identifier = x520 <| 22
|
|
and facsimile_telephone_number = x520 <| 23
|
|
and x121_address = x520 <| 24
|
|
and internationa_isdn_number = x520 <| 25
|
|
and registered_address = x520 <| 26
|
|
and destination_indicator = x520 <| 27
|
|
and preferred_delivery_method = x520 <| 28
|
|
and presentation_address = x520 <| 29
|
|
and supported_application_context = x520 <| 30
|
|
and member = x520 <| 31
|
|
and owner = x520 <| 32
|
|
and role_occupant = x520 <| 33
|
|
and see_also = x520 <| 34
|
|
and user_password = x520 <| 35
|
|
and user_certificate = x520 <| 36
|
|
and ca_certificate = x520 <| 37
|
|
and authority_revocation_list = x520 <| 38
|
|
and certificate_revocation_list = x520 <| 39
|
|
and cross_certificate_pair = x520 <| 40
|
|
and name = x520 <| 41
|
|
and given_name = x520 <| 42
|
|
and initials = x520 <| 43
|
|
and generation_qualifier = x520 <| 44
|
|
and unique_identifier = x520 <| 45
|
|
and dn_qualifier = x520 <| 46
|
|
and enhanced_search_guide = x520 <| 47
|
|
and protocol_information = x520 <| 48
|
|
and distinguished_name = x520 <| 49
|
|
and unique_member = x520 <| 50
|
|
and house_identifier = x520 <| 51
|
|
and supported_algorithms = x520 <| 52
|
|
and delta_revocation_list = x520 <| 53
|
|
and attribute_certificate = x520 <| 58
|
|
and pseudonym = x520 <| 65
|
|
end
|
|
|
|
let ucl_data_networks = base 0 9 <| 2342 <| 19200300
|
|
let directory_pilot = ucl_data_networks <| 100 <| 1
|
|
(* The single rfc4519 oid rfc5280 requires us to be aware of.... *)
|
|
let domain_component = directory_pilot <| 25
|
|
(* rfc4514 oid required for compliance *)
|
|
let userid = directory_pilot <| 1
|
|
|
|
module Cert_extn = struct
|
|
let ce = base 2 5 <| 29
|
|
|
|
let authority_key_identifier_old = ce <| 1
|
|
and primary_key_attributes_old = ce <| 2
|
|
and certificate_policies_1 = ce <| 3
|
|
and primary_key_usage_restriction = ce <| 4
|
|
and subject_directory_attributes = ce <| 9
|
|
and subject_key_identifier = ce <| 14
|
|
and key_usage = ce <| 15
|
|
and private_key_usage_period = ce <| 16
|
|
and subject_alternative_name = ce <| 17
|
|
and issuer_alternative_name = ce <| 18
|
|
and basic_constraints = ce <| 19
|
|
and crl_number = ce <| 20
|
|
and reason_code = ce <| 21
|
|
and hold_instruction_code = ce <| 23
|
|
and invalidity_date = ce <| 24
|
|
and delta_crl_indicator = ce <| 27
|
|
and issuing_distribution_point = ce <| 28
|
|
and certificate_issuer = ce <| 29
|
|
and name_constraints = ce <| 30
|
|
and crl_distribution_points = ce <| 31
|
|
and certificate_policies_2 = ce <| 32
|
|
and policy_mappings = ce <| 33
|
|
and authority_key_identifier = ce <| 35
|
|
and policy_constraints = ce <| 36
|
|
and extended_key_usage = ce <| 37
|
|
and freshest_crl = ce <| 46
|
|
and inhibit_any_policy = ce <| 54
|
|
|
|
(* https://tools.ietf.org/html/rfc5280#section-4.2.2.1 *)
|
|
module Private_internet_extensions = struct
|
|
let pe = pkix <| 1
|
|
let authority_info_access = pe <| 1
|
|
let ad = pkix <| 48
|
|
let ad_ca_issuer = ad <| 2
|
|
let ad_ocsp = ad <| 1
|
|
let ad_ocsp_basic = ad_ocsp <| 1
|
|
end
|
|
|
|
module Extended_usage = struct
|
|
let any = extended_key_usage <| 0
|
|
let key_purpose = pkix <| 3
|
|
let server_auth = key_purpose <| 1
|
|
and client_auth = key_purpose <| 2
|
|
and code_signing = key_purpose <| 3
|
|
and email_protection = key_purpose <| 4
|
|
and ipsec_end_system = key_purpose <| 5
|
|
and ipsec_tunnel = key_purpose <| 6
|
|
and ipsec_user = key_purpose <| 7
|
|
and time_stamping = key_purpose <| 8
|
|
and ocsp_signing = key_purpose <| 9
|
|
end
|
|
|
|
module Cert_policy = struct
|
|
let qt = pkix <| 2
|
|
let cps = qt <| 1
|
|
let unotice = qt <| 2
|
|
|
|
let any_policy = certificate_policies_2 <| 0
|
|
end
|
|
end
|
|
|
|
module Name_extn = struct
|
|
|
|
(* For the rarely-used feature of GeneralName: AnotherName. *)
|
|
|
|
let id_other_name = pkix <| 8
|
|
|
|
(* rfc6120 *)
|
|
let xmpp_addr = id_other_name <| 5
|
|
(* rfc4985 *)
|
|
let srv_name = id_other_name <| 7 (* an IA5String _Service.Name *)
|
|
|
|
let venezuela = base 2 16 <| 862
|
|
let venezuela_1 = venezuela <| 2 <| 1
|
|
and venezuela_2 = venezuela <| 2 <| 2
|
|
|
|
let is_utf8_id oid =
|
|
List.mem oid [ xmpp_addr ; venezuela_1 ; venezuela_2 ]
|
|
end
|