rfc3163.txt

RFC 的详细文档！

               Specification of Basic Encoding Rules (BER), Canonical
               Encoding Rules (CER) and Distinguished Encoding Rules
               (DER).

9. Authors' Addresses

   Robert Zuccherato
   Entrust Technologies
   1000 Innovation Drive
   Ottawa, Ontario
   Canada K2K 3E7

   Phone: [phone]
   EMail: [e-mail]


   Magnus Nystrom
   RSA Security
   Box 10704
   121 29 Stockholm
   Sweden

   Phone: [phone]
   EMail: [e-mail]











Zuccherato & Nystrom          Experimental                     [Page 12]

RFC 3163      ISO/IEC 9798-3 Authentication SASL Mechanism   August 2001


APPENDICES

A. ASN.1 modules

A.1. 1988 ASN.1 module

   SASL-9798-3-1988

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS ALL --

   IMPORTS

   Name, AlgorithmIdentifier, Certificate
        FROM PKIX1Explicit88 {iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-pkix1-explicit-88(1)}

   GeneralNames
        FROM PKIX1Implicit88 {iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-pkix1-implicit-88(2)};

   TokenBA1 ::= SEQUENCE {
        randomB   RandomNumber,
        entityB   [0] GeneralNames OPTIONAL,
        certPref  [1] SEQUENCE SIZE (1..MAX) OF TrustedAuth OPTIONAL
   }

   TokenAB ::= SEQUENCE {
        randomA   RandomNumber,
        entityB   [0] GeneralNames OPTIONAL,
        certA     [1] CertData,
        authID    [2] GeneralNames OPTIONAL,
        signature SEQUENCE {
             algorithm AlgorithmIdentifier,
             signature BIT STRING
       }
   } -- The entityB and authID fields shall be included in TokenAB
     -- if and only if they are also included in TBSDataAB.  The entityB
     -- field SHOULD be present in TokenAB whenever the client
     -- believes it knows the identity of the server.
     -- The signature operation shall be done on a
     -- DER-encoded value of type TBSDataAB.




Zuccherato & Nystrom          Experimental                     [Page 13]

RFC 3163      ISO/IEC 9798-3 Authentication SASL Mechanism   August 2001


   TBSDataAB ::= SEQUENCE {
        randomA RandomNumber,
        randomB RandomNumber,
        entityB [0] GeneralNames OPTIONAL,
        authID  [1] GeneralNames OPTIONAL
   }

   TokenBA2 ::= SEQUENCE {
        randomC   RandomNumber,
        entityA   [0] GeneralNames OPTIONAL,
        certB     [1] CertData,
        signature SEQUENCE {
             algorithm AlgorithmIdentifier,
             signature BIT STRING
        }
   } -- The entityA field shall be included in TokenBA2
     -- if and only if it is also included in TBSDataBA.  The entityA
     -- field SHOULD be present and MUST contain the client's name
     -- from their X.509 certificate.  The signature shall be done
     -- on a DER-encoded value of type TBSDataBA.

   TBSDataBA ::= SEQUENCE {
        randomB RandomNumber,
        randomA RandomNumber,
        randomC RandomNumber,
        entityA GeneralNames OPTIONAL
   }

   TrustedAuth ::= CHOICE {
        authorityName         [0] Name,
             -- SubjectName from CA certificate
        issuerNameHash        [1] OCTET STRING,
             -- SHA-1 hash of Authority's DN
        issuerKeyHash         [2] OCTET STRING,
             -- SHA-1 hash of Authority's public key
        authorityCertificate  [3] Certificate,
             -- CA certificate
        pkcs15KeyHash         [4] OCTET STRING
             -- PKCS #15 key hash
   }

   CertData ::= CHOICE {
        certificateSet     SET SIZE (1..MAX) OF Certificate,
        certURL            IA5String
   }

   RandomNumber ::= OCTET STRING (SIZE(8..MAX))




Zuccherato & Nystrom          Experimental                     [Page 14]

RFC 3163      ISO/IEC 9798-3 Authentication SASL Mechanism   August 2001


   END

A.2. 1997 ASN.1 module

   SASL-9798-3-1997

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS ALL --

   IMPORTS

   AlgorithmIdentifier, Name, Certificate
        FROM PKIX1Explicit93 {iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-pkix1-explicit-93(3)}

   GeneralNames
        FROM PKIX1Implicit93 {iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-pkix1-implicit-93(4)};

   TokenBA1 ::= SEQUENCE {
        randomB   RandomNumber,
        entityB   [0] GeneralNames OPTIONAL,
        certPref  [1] SEQUENCE SIZE (1..MAX) OF TrustedAuth OPTIONAL
   }

   TokenAB ::= SEQUENCE {
        randomA   RandomNumber,
        entityB   [0] GeneralNames OPTIONAL,
        certA     [1] CertData,
        authID    [2] GeneralNames OPTIONAL,
        signature SIGNATURE { TBSDataAB }
   }(CONSTRAINED BY {-- The entityB and authID fields shall be included
     -- in TokenAB if and only if they are also included in TBSDataAB.
     -- The entityB field SHOULD be present in TokenAB whenever the
     -- client believes it knows the identity of the server.--})

   TBSDataAB ::= SEQUENCE {
        randomA RandomNumber,
        randomB RandomNumber,
        entityB [0] GeneralNames OPTIONAL,
        authID  [1] GeneralNames OPTIONAL
   }




Zuccherato & Nystrom          Experimental                     [Page 15]

RFC 3163      ISO/IEC 9798-3 Authentication SASL Mechanism   August 2001


   TokenBA2 ::= SEQUENCE {
        randomC   RandomNumber,
        entityA   [0] GeneralNames OPTIONAL,
        certB     [1] CertData,
        signature SIGNATURE { TBSDataBA }
   }(CONSTRAINED BY {-- The entityA field shall be included in TokenBA2
     -- if and only if it is also included in TBSDataBA.  The entityA
     -- field SHOULD be present and MUST contain the client's name
     -- from their X.509 certificate.--})

   TBSDataBA ::= SEQUENCE {
        randomB RandomNumber,
        randomA RandomNumber,
        randomC RandomNumber,
        entityA GeneralNames OPTIONAL
   }

   TrustedAuth ::= CHOICE {
        authorityName         [0] Name,
             -- SubjectName from CA certificate
        issuerNameHash        [1] OCTET STRING,
             -- SHA-1 hash of Authority's DN
        issuerKeyHash         [2] OCTET STRING,
             -- SHA-1 hash of Authority's public key
        authorityCertificate  [3] Certificate,
             -- CA certificate
        pkcs15KeyHash         [4] OCTET STRING
             -- PKCS #15 key hash
   }

   CertData ::= CHOICE {
        certificateSet     SET SIZE (1..MAX) OF Certificate,
        certURL            IA5String,
        ... -- For future extensions
   }

   RandomNumber ::= OCTET STRING (SIZE(8..MAX))

   SIGNATURE { ToBeSigned } ::= SEQUENCE {
        algorithm AlgorithmIdentifier,
        signature BIT STRING
   }(CONSTRAINED BY {-- Must be the result of applying the signing
     -- operation indicated in "algorithm" to the DER-encoded octets of
     -- a value of type -- ToBeSigned })

   END





Zuccherato & Nystrom          Experimental                     [Page 16]

RFC 3163      ISO/IEC 9798-3 Authentication SASL Mechanism   August 2001


Full Copyright Statement

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Zuccherato & Nystrom          Experimental                     [Page 17]