PKCS-15 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
         pkcs-15(15) modules(1) pkcs-15(1)} 

-- $Revision$ --

DEFINITIONS IMPLICIT TAGS ::=

BEGIN

IMPORTS

informationFramework, authenticationFramework, certificateExtensions
        FROM UsefulDefinitions {joint-iso-itu-t(2) ds(5) module(1)
                                usefulDefinitions(0) 3} 

Name, Attribute
        FROM InformationFramework informationFramework

Certificate, AttributeCertificate, CertificateSerialNumber,
        SubjectPublicKeyInfo
        FROM AuthenticationFramework authenticationFramework

GeneralNames, KeyUsage
        FROM CertificateExtensions certificateExtensions

RecipientInfos, RecipientInfo, OriginatorInfo, sha-1,
	id-alg-CMS3DESwrap, id-alg-CMSRC2wrap, hMAC-SHA1, des-ede3-cbc
	FROM CryptographicMessageSyntax {iso(1) member-body(2)
	us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) modules(0)
	cms(1)}

RSAPublicKey
	FROM PKCS-1 {iso(1) member-body(2) us(840) rsadsi(113549)
	pkcs(1) pkcs-1(1) modules(0) pkcs-1(1)} 

AlgorithmIdentifier, SupportingAlgorithms, PBKDF2Algorithms,
	ALGORITHM-IDENTIFIER, id-hmacWithSHA1
	FROM PKCS-5 {iso(1) member-body(2) us(840) rsadsi(113549)
	pkcs(1) pkcs-5(5) modules(16) pkcs-5(1)} 

ECPoint, Parameters
        FROM ANSI-X9-62 {iso(1) member-body(2) us(840)
        ansi-x962(10045) module(4) 1} 

DiffieHellmanPublicNumber, DomainParameters
        FROM ANSI-X9-42 {iso(1) member-body(2) us(840)
        ansi-x942(10046) module(5) 1}

OOBCertHash
        FROM PKIXCMP {iso(1) identified-organization(3) dod(6)
        internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-cmp(9)};

-- Constants

pkcs15-ub-identifier          INTEGER ::= 255
pkcs15-ub-reference           INTEGER ::= 255
pkcs15-ub-index               INTEGER ::= 65535
pkcs15-ub-label               INTEGER ::= pkcs15-ub-identifier
pkcs15-lb-minPinLength        INTEGER ::= 4
pkcs15-ub-minPinLength        INTEGER ::= 8
pkcs15-ub-storedPinLength     INTEGER ::= 64
pkcs15-ub-recordLength        INTEGER ::= 16383
pkcs15-ub-userConsent         INTEGER ::= 15
pkcs15-ub-securityConditions  INTEGER ::= 255
pkcs15-ub-seInfo              INTEGER ::= 255

-- Object Identifiers

pkcs15 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
                               rsadsi(113549) pkcs(1) pkcs-15(15)}
pkcs15-mo OBJECT IDENTIFIER ::= {pkcs15 1} -- Modules branch
pkcs15-at OBJECT IDENTIFIER ::= {pkcs15 2} -- Attribute branch
pkcs15-ct OBJECT IDENTIFIER ::= {pkcs15 3} -- Content type branch

-- Content Types

pkcs15-ct-PKCS15Token OBJECT IDENTIFIER ::= {pkcs15-ct 1}

-- Basic types

Identifier ::= OCTET STRING (SIZE (0..pkcs15-ub-identifier))

Reference ::= INTEGER (0..pkcs15-ub-reference)

Label ::= UTF8String (SIZE(0..pkcs15-ub-label))

KEY-IDENTIFIER ::= CLASS {
    &id  INTEGER UNIQUE,
    &Value
} WITH SYNTAX {
    SYNTAX &Value IDENTIFIED BY &id
}

CredentialIdentifier {KEY-IDENTIFIER : IdentifierSet} ::= SEQUENCE {
    idType  KEY-IDENTIFIER.&id ({IdentifierSet}),
    idValue KEY-IDENTIFIER.&Value ({IdentifierSet}{@idType})
}

KeyIdentifiers KEY-IDENTIFIER ::= {
    issuerAndSerialNumber|
    issuerAndSerialNumberHash|
    subjectKeyId|
    subjectKeyHash |
    issuerKeyHash |
    issuerNameHash |
    subjectNameHash,
    ...
}

issuerAndSerialNumber KEY-IDENTIFIER::= 
        {SYNTAX PKCS15-OPAQUE.&Type IDENTIFIED BY 1}
        -- As defined in RFC 2630
subjectKeyId KEY-IDENTIFIER ::= 
        {SYNTAX OCTET STRING IDENTIFIED BY 2}
        -- From x509v3 certificate extension
issuerAndSerialNumberHash KEY-IDENTIFIER ::= 
        {SYNTAX OCTET STRING IDENTIFIED BY 3}
        -- Assumes SHA-1 hash of DER encoding of IssuerAndSerialNumber
subjectKeyHash KEY-IDENTIFIER ::= 
        {SYNTAX OCTET STRING IDENTIFIED BY 4}
issuerKeyHash KEY-IDENTIFIER ::= 
        {SYNTAX OCTET STRING IDENTIFIED BY 5}
issuerNameHash KEY-IDENTIFIER ::=
	{SYNTAX OCTET STRING IDENTIFIED BY 6}
	-- SHA-1 hash of DER-encoded issuer name
subjectNameHash KEY-IDENTIFIER ::=
        {SYNTAX OCTET STRING IDENTIFIED BY 7}
	-- SHA-1 hash of DER-encoded subject name

ReferencedValue {Type} ::= CHOICE {
    path	Path,
    url		URL
} (CONSTRAINED BY {-- 'path' or 'url' shall point to an object of
   -- type -- Type}) 

URL ::= CHOICE {
    url		PrintableString,
    urlWithDigest [3] SEQUENCE {
    	url	IA5String,
    	digest	DigestInfoWithDefault
    	}
}

alg-id-sha1 AlgorithmIdentifier {{DigestAlgorithms}} ::= {
    algorithm  sha-1, 
    parameters SHA1Parameters : NULL} 

SHA1Parameters ::= NULL

DigestInfoWithDefault ::= SEQUENCE {
    digestAlg	AlgorithmIdentifier {{DigestAlgorithms}} DEFAULT alg-id-sha1,
    digest	OCTET STRING (SIZE(8..128))
}

Path ::= SEQUENCE {
    path 	OCTET STRING,
    index  	INTEGER (0..pkcs15-ub-index) OPTIONAL,
    length 	[0] INTEGER (0..pkcs15-ub-index) OPTIONAL
    }( WITH COMPONENTS {..., index PRESENT, length PRESENT}| 
       WITH COMPONENTS {..., index ABSENT, length ABSENT})

ObjectValue { Type } ::= CHOICE {
    indirect 	        ReferencedValue {Type},
    direct 	        [0] Type,
    indirect-protected	[1] ReferencedValue {EnvelopedData {Type}},
    direct-protected	[2] EnvelopedData {Type}
    }(CONSTRAINED BY {-- if indirection is being used, then it is
    -- expected that the reference points either to a (possibly
    -- enveloped) object of type -- Type -- or (key case) to a card- 
    -- specific key file --})

PathOrObjects {ObjectType} ::= CHOICE {
    path  	Path,
    objects  	[0] SEQUENCE OF ObjectType,
    ...,
    indirect-protected [1] ReferencedValue {EnvelopedData {SEQUENCE OF ObjectType}},
    direct-protected [2] EnvelopedData {SEQUENCE OF ObjectType}
    }

CommonObjectAttributes ::= SEQUENCE {
    label		Label OPTIONAL,
    flags  		CommonObjectFlags OPTIONAL,
    authId 		Identifier OPTIONAL,
    ...,
    userConsent 	INTEGER (1..pkcs15-ub-userConsent) OPTIONAL,
    accessControlRules	SEQUENCE SIZE (1..MAX) OF AccessControlRule OPTIONAL
} (CONSTRAINED BY {-- authId should be present in the IC card case if
    -- flags.private is set. It must equal an authID in one AuthRecord
    -- in the AODF -- }) 

CommonObjectFlags ::= BIT STRING {
    private	(0),
    modifiable 	(1)
}

AccessControlRule ::= SEQUENCE {
    accessMode		AccessMode,
    securityCondition 	SecurityCondition,
    ... -- For future extensions
}

AccessMode ::= BIT STRING {
    read	(0),
    update	(1),
    execute	(2)
}

SecurityCondition ::= CHOICE {
    authId	Identifier,
    not    	[0] SecurityCondition,
    and    	[1] SEQUENCE SIZE (2..pkcs15-ub-securityConditions)
                OF SecurityCondition, 
    or     	[2] SEQUENCE SIZE (2..pkcs15-ub-securityConditions)
                OF SecurityCondition, 
    ... -- For future extensions
}

CommonKeyAttributes ::= SEQUENCE {
    iD 		 Identifier,
    usage 	 KeyUsageFlags,
    native	 BOOLEAN DEFAULT TRUE,
    accessFlags	 KeyAccessFlags OPTIONAL,
    keyReference Reference OPTIONAL,
    startDate 	 GeneralizedTime OPTIONAL,
    endDate  	 [0] GeneralizedTime OPTIONAL,
    ... -- For future extensions
}

KeyUsageFlags ::= BIT STRING {
    encrypt 			(0),
    decrypt 			(1),
    sign 			(2),
    signRecover 		(3),
    wrap 			(4),
    unwrap 			(5),
    verify 			(6),
    verifyRecover  		(7),
    derive 			(8),
    nonRepudiation		(9)
}

KeyAccessFlags ::= BIT STRING {
    sensitive  		(0),
    extractable 	(1),
    alwaysSensitive 	(2),
    neverExtractable	(3),
    local		(4)
}

CommonPrivateKeyAttributes ::= SEQUENCE {
    subjectName	Name OPTIONAL,
    keyIdentifiers 	[0] SEQUENCE OF CredentialIdentifier
                        {{KeyIdentifiers}} OPTIONAL, 
    ... -- For future extensions
}

CommonPublicKeyAttributes ::= SEQUENCE {
    subjectName	 Name OPTIONAL,
    ...,
    trustedUsage [0] Usage OPTIONAL
}

CommonSecretKeyAttributes ::= SEQUENCE {
    keyLen	INTEGER OPTIONAL, -- keylength (in bits)
    ... -- For future extensions
}

KeyInfo {ParameterType, OperationsType} ::= CHOICE {
    reference		Reference,
    paramsAndOps 	SEQUENCE {
    	parameters 		ParameterType,
    	supportedOperations 	OperationsType OPTIONAL
	}
}

CommonCertificateAttributes ::= SEQUENCE {
    iD 		Identifier, 
    authority	BOOLEAN DEFAULT FALSE,
    identifier 	CredentialIdentifier {{KeyIdentifiers}} OPTIONAL,
    certHash	[0] OOBCertHash OPTIONAL,
    ...,
    trustedUsage [1] Usage OPTIONAL,
    identifiers	[2] SEQUENCE OF CredentialIdentifier{{KeyIdentifiers}} OPTIONAL, 
    implicitTrust [3] BOOLEAN DEFAULT FALSE
}

Usage ::= SEQUENCE {
    keyUsage	KeyUsage OPTIONAL,
    extKeyUsage	SEQUENCE SIZE (1..MAX) OF OBJECT IDENTIFIER OPTIONAL
    }(WITH COMPONENTS {..., keyUsage PRESENT} |
      WITH COMPONENTS {..., extKeyUsage PRESENT})

CommonDataObjectAttributes ::= SEQUENCE {
    applicationName	Label OPTIONAL,
    applicationOID 	OBJECT IDENTIFIER OPTIONAL,
    ... -- For future extensions
    } (WITH COMPONENTS {..., applicationName PRESENT}| 
       WITH COMPONENTS {..., applicationOID PRESENT})

CommonAuthenticationObjectAttributes ::= SEQUENCE {
    authId Identifier,
    ... -- For future extensions
}

PKCS15Object {ClassAttributes, SubClassAttributes, TypeAttributes}
    ::= SEQUENCE {
    commonObjectAttributes	CommonObjectAttributes,
    classAttributes		ClassAttributes,
    subClassAttributes 		[0] SubClassAttributes OPTIONAL,
    typeAttributes		[1] TypeAttributes
}

PKCS15Objects ::= CHOICE {
    privateKeys 	[0] PrivateKeys,
    publicKeys 		[1] PublicKeys,
    trustedPublicKeys  	[2] PublicKeys,
    secretKeys 		[3] SecretKeys,
    certificates	[4] Certificates,
    trustedCertificates [5] Certificates,
    usefulCertificates 	[6] Certificates,
    dataObjects 	[7] DataObjects,
    authObjects 	[8] AuthObjects,
    ... -- For future extensions
}

PrivateKeys  ::= PathOrObjects {PrivateKeyType}

SecretKeys   ::= PathOrObjects {SecretKeyType}

PublicKeys   ::= PathOrObjects {PublicKeyType}

Certificates ::= PathOrObjects {CertificateType}

DataObjects  ::= PathOrObjects {DataType}

AuthObjects  ::= PathOrObjects {AuthenticationType}

PrivateKeyType ::= CHOICE {
    privateRSAKey	PrivateKeyObject {PrivateRSAKeyAttributes},
    privateECKey 	[0] PrivateKeyObject {PrivateECKeyAttributes},
    privateDHKey 	[1] PrivateKeyObject {PrivateDHKeyAttributes},
    privateDSAKey	[2] PrivateKeyObject {PrivateDSAKeyAttributes},
    privateKEAKey	[3] PrivateKeyObject {PrivateKEAKeyAttributes},
    ... -- For future extensions
}

PrivateKeyObject {KeyAttributes} ::= PKCS15Object { 
    CommonKeyAttributes, CommonPrivateKeyAttributes, KeyAttributes}

PrivateRSAKeyAttributes ::= SEQUENCE {
    value 		ObjectValue {RSAPrivateKeyObject},
    modulusLength 	INTEGER, -- modulus length in bits, e.g. 1024
    keyInfo  		KeyInfo {NULL, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
} 

RSAPrivateKeyObject ::= SEQUENCE {
    modulus 		[0] INTEGER OPTIONAL, -- n
    publicExponent 	[1] INTEGER OPTIONAL, -- e
    privateExponent 	[2] INTEGER OPTIONAL, -- d
    prime1 		[3] INTEGER OPTIONAL, -- p
    prime2 		[4] INTEGER OPTIONAL, -- q
    exponent1  		[5] INTEGER OPTIONAL, -- d mod (p-1)
    exponent2  		[6] INTEGER OPTIONAL, -- d mod (q-1)
    coefficient 	[7] INTEGER OPTIONAL -- inv(q) mod p
} (CONSTRAINED BY {-- must be possible to reconstruct modulus and
   -- privateExponent from selected fields --}) 

PrivateECKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {ECPrivateKey},
    keyInfo 	KeyInfo {Parameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

ECPrivateKey ::= INTEGER

PrivateDHKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {DHPrivateKey},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

DHPrivateKey ::= INTEGER -- Diffie-Hellman exponent

PrivateDSAKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {DSAPrivateKey},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

DSAPrivateKey ::= INTEGER

PrivateKEAKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {KEAPrivateKey},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

KEAPrivateKey ::= INTEGER

PublicKeyType ::= CHOICE {
    publicRSAKey 	PublicKeyObject {PublicRSAKeyAttributes},
    publicECKey 	[0] PublicKeyObject {PublicECKeyAttributes},
    publicDHKey 	[1] PublicKeyObject {PublicDHKeyAttributes},
    publicDSAKey 	[2] PublicKeyObject {PublicDSAKeyAttributes},
    publicKEAKey 	[3] PublicKeyObject {PublicKEAKeyAttributes},
    ... -- For future extensions
}

PublicKeyObject {KeyAttributes} ::= PKCS15Object { 
    CommonKeyAttributes, CommonPublicKeyAttributes, KeyAttributes}

PublicRSAKeyAttributes ::= SEQUENCE {
    value		ObjectValue {RSAPublicKeyChoice},
    modulusLength 	INTEGER, -- modulus length in bits, e.g. 1024
    keyInfo		KeyInfo {NULL, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
} 

RSAPublicKeyChoice ::= CHOICE {
    raw	 RSAPublicKey,
    spki [1] SubjectPublicKeyInfo, -- See X.509. Must contain a
    -- public RSA key 
    ...
}

PublicECKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {ECPublicKeyChoice},
    keyInfo 	KeyInfo {Parameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

ECPublicKeyChoice ::= CHOICE {
    raw	 ECPoint,
    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public EC key
    ...
}

PublicDHKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {DHPublicKeyChoice},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

DHPublicKeyChoice ::= CHOICE {
    raw	 DiffieHellmanPublicNumber,
    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public D-H key
    ...
}

PublicDSAKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {DSAPublicKeyChoice},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

DSAPublicKeyChoice ::= CHOICE {
    raw	 INTEGER,
    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public DSA key.
    ...
}

PublicKEAKeyAttributes ::= SEQUENCE {
    value  	ObjectValue {KEAPublicKeyChoice},
    keyInfo 	KeyInfo {DomainParameters, PublicKeyOperations} OPTIONAL,
    ... -- For future extensions
}

KEAPublicKeyChoice ::= CHOICE {
    raw	 INTEGER,
    spki SubjectPublicKeyInfo, -- See X.509. Must contain a public KEA key
    ...
}

SecretKeyType ::= CHOICE {
    genericSecretKey	SecretKeyObject {GenericSecretKeyAttributes},
    rc2key 		[0] SecretKeyObject {GenericSecretKeyAttributes},
    rc4key 		[1] SecretKeyObject {GenericSecretKeyAttributes},
    desKey 		[2] SecretKeyObject {GenericSecretKeyAttributes},
    des2Key		[3] SecretKeyObject {GenericSecretKeyAttributes},
    des3Key    	        [4] SecretKeyObject {GenericSecretKeyAttributes}, 
    castKey 		[5] SecretKeyObject {GenericSecretKeyAttributes},
    cast3Key 		[6] SecretKeyObject {GenericSecretKeyAttributes},
    cast128Key  	[7] SecretKeyObject {GenericSecretKeyAttributes},
    rc5Key  		[8] SecretKeyObject {GenericSecretKeyAttributes},
    ideaKey 		[9] SecretKeyObject {GenericSecretKeyAttributes},
    skipjackKey 	[10] SecretKeyObject {GenericSecretKeyAttributes},
    batonKey		[11] SecretKeyObject {GenericSecretKeyAttributes},
    juniperKey  	[12] SecretKeyObject {GenericSecretKeyAttributes},
    rc6Key 		[13] SecretKeyObject {GenericSecretKeyAttributes},
    otherKey		[14] OtherKey,
... -- For future extensions
}

SecretKeyObject {KeyAttributes} ::= PKCS15Object { 
     CommonKeyAttributes, CommonSecretKeyAttributes, KeyAttributes}

OtherKey ::= SEQUENCE {
    keyType	OBJECT IDENTIFIER,
    keyAttr	SecretKeyObject {GenericSecretKeyAttributes}
}

GenericSecretKeyAttributes ::= SEQUENCE {
    value	ObjectValue { OCTET STRING },
    ... -- For future extensions
}

CertificateType ::= CHOICE {
    x509Certificate  	CertificateObject { X509CertificateAttributes},
    x509AttributeCertificate [0] CertificateObject
                        {X509AttributeCertificateAttributes}, 
    spkiCertificate 	[1] CertificateObject {SPKICertificateAttributes},
    pgpCertificate  	[2] CertificateObject {PGPCertificateAttributes},
    wtlsCertificate 	[3] CertificateObject {WTLSCertificateAttributes},
    x9-68Certificate 	[4] CertificateObject {X9-68CertificateAttributes},
    ...,
    cvCertificate	[5] CertificateObject {CVCertificateAttributes}
}

CertificateObject {CertAttributes} ::= PKCS15Object { 
    CommonCertificateAttributes, NULL, CertAttributes}

X509CertificateAttributes ::= SEQUENCE {
    value		ObjectValue { Certificate },
    subject  		Name OPTIONAL,
    issuer 		[0] Name OPTIONAL,
    serialNumber 	CertificateSerialNumber OPTIONAL,
    ... -- For future extensions
}

X509AttributeCertificateAttributes ::= SEQUENCE {
    value	ObjectValue { AttributeCertificate },
    issuer	GeneralNames OPTIONAL,
    serialNumber CertificateSerialNumber OPTIONAL,
    attrTypes 	[0] SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,
    ... -- For future extensions
}

SPKICertificateAttributes ::= SEQUENCE {
    value	ObjectValue { PKCS15-OPAQUE.&Type },
    ... -- For future extensions
}

PGPCertificateAttributes ::= SEQUENCE {
    value	ObjectValue { PKCS15-OPAQUE.&Type },
    ... -- For future extensions
}

WTLSCertificateAttributes ::= SEQUENCE {
    value	ObjectValue { PKCS15-OPAQUE.&Type },
    ... -- For future extensions
}

X9-68CertificateAttributes ::= SEQUENCE {
    value	ObjectValue { PKCS15-OPAQUE.&Type },
    ... -- For future extensions
}
CVCertificateAttributes ::= SEQUENCE {
    value	ObjectValue { PKCS15-OPAQUE.&Type},
    ... -- For future extensions
}

DataType ::= CHOICE {
    opaqueDO	DataObject {Opaque},
    externalIDO	[0] DataObject {ExternalIDO},
    oidDO  	[1] DataObject {OidDO},
    ... -- For future extensions
}

DataObject {DataObjectAttributes} ::= PKCS15Object { 
    CommonDataObjectAttributes, NULL, DataObjectAttributes}

Opaque ::= ObjectValue {PKCS15-OPAQUE.&Type}

ExternalIDO ::= ObjectValue {PKCS15-OPAQUE.&Type}
    (CONSTRAINED BY {-- All data objects must be defined in
    -- accordance with ISO/IEC 7816-6 --}) 

OidDO ::= SEQUENCE {
    id		OBJECT IDENTIFIER,
    value 	ObjectValue {PKCS15-OPAQUE.&Type}
}

AuthenticationType ::= CHOICE {
    pin	AuthenticationObject { PinAttributes },
    ...,
    biometricTemplate [0] AuthenticationObject {BiometricAttributes},
    authKey  [1] AuthenticationObject {AuthKeyAttributes},
    external [2] AuthenticationObject {ExternalAuthObjectAttributes}
}

AuthenticationObject {AuthObjectAttributes} ::= PKCS15Object { 
    CommonAuthenticationObjectAttributes, NULL, AuthObjectAttributes}

PinAttributes ::= SEQUENCE {
    pinFlags  	  PinFlags,
    pinType  	  PinType,
    minLength 	  INTEGER (pkcs15-lb-minPinLength..pkcs15-ub-minPinLength),
    storedLength  INTEGER (0..pkcs15-ub-storedPinLength),
    maxLength 	  INTEGER OPTIONAL,
    pinReference  [0] Reference DEFAULT 0,
    padChar  	  OCTET STRING (SIZE(1)) OPTIONAL,
    lastPinChange GeneralizedTime OPTIONAL,
    path 	  Path OPTIONAL,
    ... -- For future extensions
}

PinFlags ::= BIT STRING {
    case-sensitive		(0),
    local 			(1),
    change-disabled 		(2),
    unblock-disabled 		(3),
    initialized  		(4),
    needs-padding 		(5),
    unblockingPin 		(6),
    soPin 			(7),
    disable-allowed 		(8),
    integrity-protected		(9),
    confidentiality-protected	(10),
    exchangeRefData		(11)
} (CONSTRAINED BY { -- 'unblockingPin' and 'soPIN' cannot both be set -- })

PinType ::= ENUMERATED {bcd, ascii-numeric, utf8, ...,
    half-nibble-bcd, iso9564-1}

BiometricAttributes ::= SEQUENCE {
    bioFlags		BiometricFlags,
    templateId		OBJECT IDENTIFIER,
    bioType		BiometricType,
    bioReference	Reference DEFAULT 0,
    lastChange		GeneralizedTime OPTIONAL,
    path		Path OPTIONAL,
... -- For future extensions
}

BiometricFlags ::= BIT STRING {
    local		(1),
    change-disabled	(2),
    unblock-disabled	(3),
    initialized		(4),
    disable-allowed	(8),
    integrity-protected	(9),
    confidentiality-protected	(10)
    } -- Note: bits 0, 5, 6, and 7 are reserved for future use

BiometricType ::= CHOICE {
    fingerPrint		FingerPrint,
    irisScan		[0] IrisScan,
    -- Possible extensions:
    -- voiceScan	VoiceScan,
    -- faceScan		FaceScan,
    -- retinaScan	Retinascan,
    -- handGeometry	HandGeometry,
    -- writeDynamics	WriteDynamics,
    -- keyStrokeDynamicsKeyStrokeDynamics,
    -- lipDynamics	LipDynamics,
    ... -- For future extensions
}

FingerPrint ::= SEQUENCE {
    hand	ENUMERATED {left, right},
    finger	ENUMERATED {thumb, pointerFinger, middleFinger,
                    ringFinger, littleFinger}, 
    ...
}

IrisScan ::= SEQUENCE {
    eye	ENUMERATED {left, right},
    ...
}

ExternalAuthObjectAttributes ::= CHOICE {
    authKeyAttributes	AuthKeyAttributes,
    certBasedAttributes	[0] CertBasedAuthenticationAttributes,
    ... -- For future extensions
}

AuthKeyAttributes ::= SEQUENCE {
    derivedKey	BOOLEAN DEFAULT TRUE,
    authKeyId	Identifier,
    ... -- For future extensions
}

CertBasedAuthenticationAttributes ::= SEQUENCE {
    cha	OCTET STRING,
    ...
}

TokenInfo ::= SEQUENCE {
    version		INTEGER {v1(0)} (v1,...),
    serialNumber	OCTET STRING,
    manufacturerID 	Label OPTIONAL,
    label 		[0] Label OPTIONAL,
    tokenflags 		TokenFlags,
    seInfo 		SEQUENCE OF SecurityEnvironmentInfo OPTIONAL,
    recordInfo 		[1] RecordInfo OPTIONAL,
    supportedAlgorithms	[2] SEQUENCE OF AlgorithmInfo OPTIONAL,
    ...,
    issuerId		[3] Label OPTIONAL,
    holderId		[4] Label OPTIONAL,
    lastUpdate		[5] LastUpdate OPTIONAL,
    preferredLanguage	PrintableString OPTIONAL -- In accordance with
    -- IETF RFC 1766 
} (CONSTRAINED BY { -- Each AlgorithmInfo.reference value must be unique --})

TokenFlags ::= BIT STRING {
    readonly		(0),
    loginRequired 	(1),
    prnGeneration 	(2),
    eidCompliant  	(3)
}

SecurityEnvironmentInfo ::= SEQUENCE {
    se		INTEGER (0..pkcs15-ub-seInfo),
    owner 	OBJECT IDENTIFIER,
    ... -- For future extensions
}

RecordInfo ::= SEQUENCE {
    oDFRecordLength  	[0] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    prKDFRecordLength 	[1] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    puKDFRecordLength	[2] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    sKDFRecordLength 	[3] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    cDFRecordLength  	[4] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    dODFRecordLength 	[5] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL,
    aODFRecordLength 	[6] INTEGER (0..pkcs15-ub-recordLength) OPTIONAL
}

AlgorithmInfo ::= SEQUENCE {
    reference  	Reference,
    algorithm  	PKCS15-ALGORITHM.&id({AlgorithmSet}),
    parameters 	PKCS15-ALGORITHM.&Parameters({AlgorithmSet}{@algorithm}),
    supportedOperations
        	PKCS15-ALGORITHM.&Operations({AlgorithmSet}{@algorithm}),
    algId       PKCS15-ALGORITHM.&objectIdentifier({AlgorithmSet}{@algorithm})
                    OPTIONAL, 
    algRef	Reference OPTIONAL
}

PKCS15-ALGORITHM ::= CLASS {
        &id INTEGER UNIQUE,
        &Parameters,
        &Operations Operations,
	&objectIdentifier OBJECT IDENTIFIER OPTIONAL
} WITH SYNTAX {
  PARAMETERS &Parameters OPERATIONS &Operations ID &id [OID &objectIdentifier]}

PKCS15-OPAQUE ::= TYPE-IDENTIFIER

PublicKeyOperations ::= Operations 

Operations ::= BIT STRING {
        compute-checksum  (0), -- H/W computation of checksum
        compute-signature (1), -- H/W computation of signature
        verify-checksum   (2), -- H/W verification of checksum
        verify-signature  (3), -- H/W verification of signature
        encipher          (4), -- H/W encryption of data
        decipher          (5), -- H/W decryption of data
        hash              (6), -- H/W hashing
        generate-key      (7)  -- H/W key generation
        }

pkcs15-alg-null      PKCS15-ALGORITHM ::= {
        PARAMETERS NULL OPERATIONS {{generate-key}} ID -1}

AlgorithmSet PKCS15-ALGORITHM ::= { 
        pkcs15-alg-null,
        ... -- See PKCS #11 for values for the &id field (and parameters)
        }

LastUpdate ::= CHOICE {
        generalizedTime GeneralizedTime,
        referencedTime ReferencedValue {GeneralizedTime},
	... -- For future extensions
	}

-- Soft token related types and objects

EnvelopedData {Type} ::= SEQUENCE {
    version		 INTEGER{v0(0),v1(1),v2(2),v3(3),v4(4)}(v0|v1|v2,...),
    originatorInfo	 [0] OriginatorInfo OPTIONAL,
    recipientInfos 	 RecipientInfos,
    encryptedContentInfo EncryptedContentInfo{Type},
    unprotectedAttrs	 [1] SET SIZE (1..MAX) OF Attribute OPTIONAL
}

EncryptedContentInfo {Type} ::= SEQUENCE {
    contentType		       OBJECT IDENTIFIER,
    contentEncryptionAlgorithm AlgorithmIdentifier {{KeyDerivationAlgorithms}},
    encryptedContent 	       [0] OCTET STRING OPTIONAL
}(CONSTRAINED BY {-- 'encryptedContent' shall be the result of
  -- encrypting DER-encoded value of type -- Type})

PKCS15Token ::= SEQUENCE {
    version		INTEGER {v1(0)} (v1,...),
    keyManagementInfo	[0] KeyManagementInfo OPTIONAL,
    pkcs15Objects	SEQUENCE OF PKCS15Objects
}

KeyManagementInfo ::= SEQUENCE OF SEQUENCE {
    keyId		Identifier,
    keyInfo		CHOICE {
    	recipientInfo	RecipientInfo,
    	passwordInfo	[0] PasswordInfo
	}
} (CONSTRAINED BY {-- Each keyID must be unique --})

PasswordInfo ::= SEQUENCE {
    hint	Label OPTIONAL,
    algId	AlgorithmIdentifier {{KeyDerivationAlgorithms}},
    ...
} (CONSTRAINED BY {--keyID shall point to a KEKRecipientInfo--})

KeyDerivationAlgorithms ALGORITHM-IDENTIFIER ::= {
    PBKDF2Algorithms,
    ... -- For future extensions
}

CMS3DESwrap ::= NULL

KeyEncryptionAlgorithms ALGORITHM-IDENTIFIER ::= {
    {CMS3DESwrap IDENTIFIED BY id-alg-CMS3DESwrap} |
    {INTEGER IDENTIFIED BY id-alg-CMSRC2wrap},
    ... -- For future extensions
}

DES-IV ::= OCTET STRING (SIZE(8))

ContentEncryptionAlgorithms ALGORITHM-IDENTIFIER ::= {
    SupportingAlgorithms EXCEPT {NULL IDENTIFIED BY id-hmacWithSHA1},
    ... -- For future extensions
}

MACAlgorithms ALGORITHM-IDENTIFIER ::= {
    {NULL IDENTIFIED BY hMAC-SHA1},
    ... -- For future extensions
}

DigestAlgorithms ALGORITHM-IDENTIFIER ::= {
    {NULL IDENTIFIED BY sha-1},
    ... -- For future extensions
}

-- Misc

DDO ::= SEQUENCE {
    oid  	  OBJECT IDENTIFIER,
    odfPath  	  Path OPTIONAL,
    tokenInfoPath [0] Path OPTIONAL,
    unusedPath 	  [1] Path OPTIONAL,
    ... -- For future extensions
}

DIRRecord ::=   [APPLICATION 1] SEQUENCE {
    aid  	[APPLICATION 15] OCTET STRING,
    label 	[APPLICATION 16] UTF8String OPTIONAL,
    path 	[APPLICATION 17] OCTET STRING,
    ddo  	[APPLICATION 19] DDO OPTIONAL
}

UnusedSpace ::= SEQUENCE {
    path  	Path (WITH COMPONENTS {..., index PRESENT, length PRESENT}),
    authId 	Identifier OPTIONAL,
    ...,
    accessControlRules SEQUENCE OF AccessControlRule OPTIONAL
}

END