The Tor Browser / annotate

security/nss/lib/util/secoid.c@b8a032363ba2 (annotated)

security/nss/lib/util/secoid.c

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4
michael@0 5 #include "secoid.h"
michael@0 6 #include "pkcs11t.h"
michael@0 7 #include "secitem.h"
michael@0 8 #include "secerr.h"
michael@0 9 #include "prenv.h"
michael@0 10 #include "plhash.h"
michael@0 11 #include "nssrwlk.h"
michael@0 12 #include "nssutil.h"
michael@0 13
michael@0 14 /* Library identity and versioning */
michael@0 15
michael@0 16 #if defined(DEBUG)
michael@0 17 #define _DEBUG_STRING " (debug)"
michael@0 18 #else
michael@0 19 #define _DEBUG_STRING ""
michael@0 20 #endif
michael@0 21
michael@0 22 /*
michael@0 23 * Version information for the 'ident' and 'what commands
michael@0 24 *
michael@0 25 * NOTE: the first component of the concatenated rcsid string
michael@0 26 * must not end in a '$' to prevent rcs keyword substitution.
michael@0 27 */
michael@0 28 const char __nss_util_rcsid[] = "$Header: NSS " NSSUTIL_VERSION _DEBUG_STRING
michael@0 29 " " __DATE__ " " __TIME__ " $";
michael@0 30 const char __nss_util_sccsid[] = "@(#)NSS " NSSUTIL_VERSION _DEBUG_STRING
michael@0 31 " " __DATE__ " " __TIME__;
michael@0 32
michael@0 33 /* MISSI Mosaic Object ID space */
michael@0 34 /* USGov algorithm OID space: { 2 16 840 1 101 } */
michael@0 35 #define USGOV 0x60, 0x86, 0x48, 0x01, 0x65
michael@0 36 #define MISSI USGOV, 0x02, 0x01, 0x01
michael@0 37 #define MISSI_OLD_KEA_DSS MISSI, 0x0c
michael@0 38 #define MISSI_OLD_DSS MISSI, 0x02
michael@0 39 #define MISSI_KEA_DSS MISSI, 0x14
michael@0 40 #define MISSI_DSS MISSI, 0x13
michael@0 41 #define MISSI_KEA MISSI, 0x0a
michael@0 42 #define MISSI_ALT_KEA MISSI, 0x16
michael@0 43
michael@0 44 #define NISTALGS USGOV, 3, 4
michael@0 45 #define AES NISTALGS, 1
michael@0 46 #define SHAXXX NISTALGS, 2
michael@0 47 #define DSA2 NISTALGS, 3
michael@0 48
michael@0 49 /**
michael@0 50 ** The Netscape OID space is allocated by Terry Hayes. If you need
michael@0 51 ** a piece of the space, contact him at thayes@netscape.com.
michael@0 52 **/
michael@0 53
michael@0 54 /* Netscape Communications Corporation Object ID space */
michael@0 55 /* { 2 16 840 1 113730 } */
michael@0 56 #define NETSCAPE_OID 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42
michael@0 57 #define NETSCAPE_CERT_EXT NETSCAPE_OID, 0x01
michael@0 58 #define NETSCAPE_DATA_TYPE NETSCAPE_OID, 0x02
michael@0 59 /* netscape directory oid - owned by Mark Smith (mcs@netscape.com) */
michael@0 60 #define NETSCAPE_DIRECTORY NETSCAPE_OID, 0x03
michael@0 61 #define NETSCAPE_POLICY NETSCAPE_OID, 0x04
michael@0 62 #define NETSCAPE_CERT_SERVER NETSCAPE_OID, 0x05
michael@0 63 #define NETSCAPE_ALGS NETSCAPE_OID, 0x06 /* algorithm OIDs */
michael@0 64 #define NETSCAPE_NAME_COMPONENTS NETSCAPE_OID, 0x07
michael@0 65
michael@0 66 #define NETSCAPE_CERT_EXT_AIA NETSCAPE_CERT_EXT, 0x10
michael@0 67 #define NETSCAPE_CERT_SERVER_CRMF NETSCAPE_CERT_SERVER, 0x01
michael@0 68
michael@0 69 /* these are old and should go away soon */
michael@0 70 #define OLD_NETSCAPE 0x60, 0x86, 0x48, 0xd8, 0x6a
michael@0 71 #define NS_CERT_EXT OLD_NETSCAPE, 0x01
michael@0 72 #define NS_FILE_TYPE OLD_NETSCAPE, 0x02
michael@0 73 #define NS_IMAGE_TYPE OLD_NETSCAPE, 0x03
michael@0 74
michael@0 75 /* RSA OID name space */
michael@0 76 #define RSADSI 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d
michael@0 77 #define PKCS RSADSI, 0x01
michael@0 78 #define DIGEST RSADSI, 0x02
michael@0 79 #define CIPHER RSADSI, 0x03
michael@0 80 #define PKCS1 PKCS, 0x01
michael@0 81 #define PKCS5 PKCS, 0x05
michael@0 82 #define PKCS7 PKCS, 0x07
michael@0 83 #define PKCS9 PKCS, 0x09
michael@0 84 #define PKCS12 PKCS, 0x0c
michael@0 85
michael@0 86 /* Other OID name spaces */
michael@0 87 #define ALGORITHM 0x2b, 0x0e, 0x03, 0x02
michael@0 88 #define X500 0x55
michael@0 89 #define X520_ATTRIBUTE_TYPE X500, 0x04
michael@0 90 #define X500_ALG X500, 0x08
michael@0 91 #define X500_ALG_ENCRYPTION X500_ALG, 0x01
michael@0 92
michael@0 93 /** X.509 v3 Extension OID
michael@0 94 ** {joint-iso-ccitt (2) ds(5) 29}
michael@0 95 **/
michael@0 96 #define ID_CE_OID X500, 0x1d
michael@0 97
michael@0 98 #define RFC1274_ATTR_TYPE 0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x1
michael@0 99 /* #define RFC2247_ATTR_TYPE 0x09, 0x92, 0x26, 0xf5, 0x98, 0x1e, 0x64, 0x1 this is WRONG! */
michael@0 100
michael@0 101 /* PKCS #12 name spaces */
michael@0 102 #define PKCS12_MODE_IDS PKCS12, 0x01
michael@0 103 #define PKCS12_ESPVK_IDS PKCS12, 0x02
michael@0 104 #define PKCS12_BAG_IDS PKCS12, 0x03
michael@0 105 #define PKCS12_CERT_BAG_IDS PKCS12, 0x04
michael@0 106 #define PKCS12_OIDS PKCS12, 0x05
michael@0 107 #define PKCS12_PBE_IDS PKCS12_OIDS, 0x01
michael@0 108 #define PKCS12_ENVELOPING_IDS PKCS12_OIDS, 0x02
michael@0 109 #define PKCS12_SIGNATURE_IDS PKCS12_OIDS, 0x03
michael@0 110 #define PKCS12_V2_PBE_IDS PKCS12, 0x01
michael@0 111 #define PKCS9_CERT_TYPES PKCS9, 0x16
michael@0 112 #define PKCS9_CRL_TYPES PKCS9, 0x17
michael@0 113 #define PKCS9_SMIME_IDS PKCS9, 0x10
michael@0 114 #define PKCS9_SMIME_ATTRS PKCS9_SMIME_IDS, 2
michael@0 115 #define PKCS9_SMIME_ALGS PKCS9_SMIME_IDS, 3
michael@0 116 #define PKCS12_VERSION1 PKCS12, 0x0a
michael@0 117 #define PKCS12_V1_BAG_IDS PKCS12_VERSION1, 1
michael@0 118
michael@0 119 /* for DSA algorithm */
michael@0 120 /* { iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) } */
michael@0 121 #define ANSI_X9_ALGORITHM 0x2a, 0x86, 0x48, 0xce, 0x38, 0x4
michael@0 122
michael@0 123 /* for DH algorithm */
michael@0 124 /* { iso(1) member-body(2) us(840) x9-57(10046) number-type(2) } */
michael@0 125 /* need real OID person to look at this, copied the above line
michael@0 126 * and added 6 to second to last value (and changed '4' to '2' */
michael@0 127 #define ANSI_X942_ALGORITHM 0x2a, 0x86, 0x48, 0xce, 0x3e, 0x2
michael@0 128
michael@0 129 #define VERISIGN 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x45
michael@0 130
michael@0 131 #define PKIX 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07
michael@0 132 #define PKIX_CERT_EXTENSIONS PKIX, 1
michael@0 133 #define PKIX_POLICY_QUALIFIERS PKIX, 2
michael@0 134 #define PKIX_KEY_USAGE PKIX, 3
michael@0 135 #define PKIX_ACCESS_DESCRIPTION PKIX, 0x30
michael@0 136 #define PKIX_OCSP PKIX_ACCESS_DESCRIPTION, 1
michael@0 137 #define PKIX_CA_ISSUERS PKIX_ACCESS_DESCRIPTION, 2
michael@0 138
michael@0 139 #define PKIX_ID_PKIP PKIX, 5
michael@0 140 #define PKIX_ID_REGCTRL PKIX_ID_PKIP, 1
michael@0 141 #define PKIX_ID_REGINFO PKIX_ID_PKIP, 2
michael@0 142
michael@0 143 /* Microsoft Object ID space */
michael@0 144 /* { 1.3.6.1.4.1.311 } */
michael@0 145 #define MICROSOFT_OID 0x2b, 0x6, 0x1, 0x4, 0x1, 0x82, 0x37
michael@0 146 #define EV_NAME_ATTRIBUTE MICROSOFT_OID, 60, 2, 1
michael@0 147
michael@0 148 /* Microsoft Crypto 2.0 ID space */
michael@0 149 /* { 1.3.6.1.4.1.311.10 } */
michael@0 150 #define MS_CRYPTO_20 MICROSOFT_OID, 10
michael@0 151 /* Microsoft Crypto 2.0 Extended Key Usage ID space */
michael@0 152 /* { 1.3.6.1.4.1.311.10.3 } */
michael@0 153 #define MS_CRYPTO_EKU MS_CRYPTO_20, 3
michael@0 154
michael@0 155 #define CERTICOM_OID 0x2b, 0x81, 0x04
michael@0 156 #define SECG_OID CERTICOM_OID, 0x00
michael@0 157
michael@0 158 #define ANSI_X962_OID 0x2a, 0x86, 0x48, 0xce, 0x3d
michael@0 159 #define ANSI_X962_CURVE_OID ANSI_X962_OID, 0x03
michael@0 160 #define ANSI_X962_GF2m_OID ANSI_X962_CURVE_OID, 0x00
michael@0 161 #define ANSI_X962_GFp_OID ANSI_X962_CURVE_OID, 0x01
michael@0 162 #define ANSI_X962_SIGNATURE_OID ANSI_X962_OID, 0x04
michael@0 163 #define ANSI_X962_SPECIFY_OID ANSI_X962_SIGNATURE_OID, 0x03
michael@0 164
michael@0 165 /* for Camellia: iso(1) member-body(2) jisc(392)
michael@0 166 * mitsubishi(200011) isl(61) security(1) algorithm(1)
michael@0 167 */
michael@0 168 #define MITSUBISHI_ALG 0x2a,0x83,0x08,0x8c,0x9a,0x4b,0x3d,0x01,0x01
michael@0 169 #define CAMELLIA_ENCRYPT_OID MITSUBISHI_ALG,1
michael@0 170 #define CAMELLIA_WRAP_OID MITSUBISHI_ALG,3
michael@0 171
michael@0 172 /* for SEED : iso(1) member-body(2) korea(410)
michael@0 173 * kisa(200004) algorithm(1)
michael@0 174 */
michael@0 175 #define SEED_OID 0x2a,0x83,0x1a,0x8c,0x9a,0x44,0x01
michael@0 176
michael@0 177 #define CONST_OID static const unsigned char
michael@0 178
michael@0 179 CONST_OID md2[] = { DIGEST, 0x02 };
michael@0 180 CONST_OID md4[] = { DIGEST, 0x04 };
michael@0 181 CONST_OID md5[] = { DIGEST, 0x05 };
michael@0 182 CONST_OID hmac_sha1[] = { DIGEST, 7 };
michael@0 183 CONST_OID hmac_sha224[] = { DIGEST, 8 };
michael@0 184 CONST_OID hmac_sha256[] = { DIGEST, 9 };
michael@0 185 CONST_OID hmac_sha384[] = { DIGEST, 10 };
michael@0 186 CONST_OID hmac_sha512[] = { DIGEST, 11 };
michael@0 187
michael@0 188 CONST_OID rc2cbc[] = { CIPHER, 0x02 };
michael@0 189 CONST_OID rc4[] = { CIPHER, 0x04 };
michael@0 190 CONST_OID desede3cbc[] = { CIPHER, 0x07 };
michael@0 191 CONST_OID rc5cbcpad[] = { CIPHER, 0x09 };
michael@0 192
michael@0 193 CONST_OID desecb[] = { ALGORITHM, 0x06 };
michael@0 194 CONST_OID descbc[] = { ALGORITHM, 0x07 };
michael@0 195 CONST_OID desofb[] = { ALGORITHM, 0x08 };
michael@0 196 CONST_OID descfb[] = { ALGORITHM, 0x09 };
michael@0 197 CONST_OID desmac[] = { ALGORITHM, 0x0a };
michael@0 198 CONST_OID sdn702DSASignature[] = { ALGORITHM, 0x0c };
michael@0 199 CONST_OID isoSHAWithRSASignature[] = { ALGORITHM, 0x0f };
michael@0 200 CONST_OID desede[] = { ALGORITHM, 0x11 };
michael@0 201 CONST_OID sha1[] = { ALGORITHM, 0x1a };
michael@0 202 CONST_OID bogusDSASignaturewithSHA1Digest[] = { ALGORITHM, 0x1b };
michael@0 203 CONST_OID isoSHA1WithRSASignature[] = { ALGORITHM, 0x1d };
michael@0 204
michael@0 205 CONST_OID pkcs1RSAEncryption[] = { PKCS1, 0x01 };
michael@0 206 CONST_OID pkcs1MD2WithRSAEncryption[] = { PKCS1, 0x02 };
michael@0 207 CONST_OID pkcs1MD4WithRSAEncryption[] = { PKCS1, 0x03 };
michael@0 208 CONST_OID pkcs1MD5WithRSAEncryption[] = { PKCS1, 0x04 };
michael@0 209 CONST_OID pkcs1SHA1WithRSAEncryption[] = { PKCS1, 0x05 };
michael@0 210 CONST_OID pkcs1RSAOAEPEncryption[] = { PKCS1, 0x07 };
michael@0 211 CONST_OID pkcs1MGF1[] = { PKCS1, 0x08 };
michael@0 212 CONST_OID pkcs1PSpecified[] = { PKCS1, 0x09 };
michael@0 213 CONST_OID pkcs1RSAPSSSignature[] = { PKCS1, 10 };
michael@0 214 CONST_OID pkcs1SHA256WithRSAEncryption[] = { PKCS1, 11 };
michael@0 215 CONST_OID pkcs1SHA384WithRSAEncryption[] = { PKCS1, 12 };
michael@0 216 CONST_OID pkcs1SHA512WithRSAEncryption[] = { PKCS1, 13 };
michael@0 217 CONST_OID pkcs1SHA224WithRSAEncryption[] = { PKCS1, 14 };
michael@0 218
michael@0 219 CONST_OID pkcs5PbeWithMD2AndDEScbc[] = { PKCS5, 0x01 };
michael@0 220 CONST_OID pkcs5PbeWithMD5AndDEScbc[] = { PKCS5, 0x03 };
michael@0 221 CONST_OID pkcs5PbeWithSha1AndDEScbc[] = { PKCS5, 0x0a };
michael@0 222 CONST_OID pkcs5Pbkdf2[] = { PKCS5, 12 };
michael@0 223 CONST_OID pkcs5Pbes2[] = { PKCS5, 13 };
michael@0 224 CONST_OID pkcs5Pbmac1[] = { PKCS5, 14 };
michael@0 225
michael@0 226 CONST_OID pkcs7[] = { PKCS7 };
michael@0 227 CONST_OID pkcs7Data[] = { PKCS7, 0x01 };
michael@0 228 CONST_OID pkcs7SignedData[] = { PKCS7, 0x02 };
michael@0 229 CONST_OID pkcs7EnvelopedData[] = { PKCS7, 0x03 };
michael@0 230 CONST_OID pkcs7SignedEnvelopedData[] = { PKCS7, 0x04 };
michael@0 231 CONST_OID pkcs7DigestedData[] = { PKCS7, 0x05 };
michael@0 232 CONST_OID pkcs7EncryptedData[] = { PKCS7, 0x06 };
michael@0 233
michael@0 234 CONST_OID pkcs9EmailAddress[] = { PKCS9, 0x01 };
michael@0 235 CONST_OID pkcs9UnstructuredName[] = { PKCS9, 0x02 };
michael@0 236 CONST_OID pkcs9ContentType[] = { PKCS9, 0x03 };
michael@0 237 CONST_OID pkcs9MessageDigest[] = { PKCS9, 0x04 };
michael@0 238 CONST_OID pkcs9SigningTime[] = { PKCS9, 0x05 };
michael@0 239 CONST_OID pkcs9CounterSignature[] = { PKCS9, 0x06 };
michael@0 240 CONST_OID pkcs9ChallengePassword[] = { PKCS9, 0x07 };
michael@0 241 CONST_OID pkcs9UnstructuredAddress[] = { PKCS9, 0x08 };
michael@0 242 CONST_OID pkcs9ExtendedCertificateAttributes[] = { PKCS9, 0x09 };
michael@0 243 CONST_OID pkcs9ExtensionRequest[] = { PKCS9, 14 };
michael@0 244 CONST_OID pkcs9SMIMECapabilities[] = { PKCS9, 15 };
michael@0 245 CONST_OID pkcs9FriendlyName[] = { PKCS9, 20 };
michael@0 246 CONST_OID pkcs9LocalKeyID[] = { PKCS9, 21 };
michael@0 247
michael@0 248 CONST_OID pkcs9X509Certificate[] = { PKCS9_CERT_TYPES, 1 };
michael@0 249 CONST_OID pkcs9SDSICertificate[] = { PKCS9_CERT_TYPES, 2 };
michael@0 250 CONST_OID pkcs9X509CRL[] = { PKCS9_CRL_TYPES, 1 };
michael@0 251
michael@0 252 /* RFC2630 (CMS) OIDs */
michael@0 253 CONST_OID cmsESDH[] = { PKCS9_SMIME_ALGS, 5 };
michael@0 254 CONST_OID cms3DESwrap[] = { PKCS9_SMIME_ALGS, 6 };
michael@0 255 CONST_OID cmsRC2wrap[] = { PKCS9_SMIME_ALGS, 7 };
michael@0 256
michael@0 257 /* RFC2633 SMIME message attributes */
michael@0 258 CONST_OID smimeEncryptionKeyPreference[] = { PKCS9_SMIME_ATTRS, 11 };
michael@0 259 CONST_OID ms_smimeEncryptionKeyPreference[] = { MICROSOFT_OID, 0x10, 0x4 };
michael@0 260
michael@0 261 CONST_OID x520CommonName[] = { X520_ATTRIBUTE_TYPE, 3 };
michael@0 262 CONST_OID x520SurName[] = { X520_ATTRIBUTE_TYPE, 4 };
michael@0 263 CONST_OID x520SerialNumber[] = { X520_ATTRIBUTE_TYPE, 5 };
michael@0 264 CONST_OID x520CountryName[] = { X520_ATTRIBUTE_TYPE, 6 };
michael@0 265 CONST_OID x520LocalityName[] = { X520_ATTRIBUTE_TYPE, 7 };
michael@0 266 CONST_OID x520StateOrProvinceName[] = { X520_ATTRIBUTE_TYPE, 8 };
michael@0 267 CONST_OID x520StreetAddress[] = { X520_ATTRIBUTE_TYPE, 9 };
michael@0 268 CONST_OID x520OrgName[] = { X520_ATTRIBUTE_TYPE, 10 };
michael@0 269 CONST_OID x520OrgUnitName[] = { X520_ATTRIBUTE_TYPE, 11 };
michael@0 270 CONST_OID x520Title[] = { X520_ATTRIBUTE_TYPE, 12 };
michael@0 271 CONST_OID x520BusinessCategory[] = { X520_ATTRIBUTE_TYPE, 15 };
michael@0 272 CONST_OID x520PostalAddress[] = { X520_ATTRIBUTE_TYPE, 16 };
michael@0 273 CONST_OID x520PostalCode[] = { X520_ATTRIBUTE_TYPE, 17 };
michael@0 274 CONST_OID x520PostOfficeBox[] = { X520_ATTRIBUTE_TYPE, 18 };
michael@0 275 CONST_OID x520Name[] = { X520_ATTRIBUTE_TYPE, 41 };
michael@0 276 CONST_OID x520GivenName[] = { X520_ATTRIBUTE_TYPE, 42 };
michael@0 277 CONST_OID x520Initials[] = { X520_ATTRIBUTE_TYPE, 43 };
michael@0 278 CONST_OID x520GenerationQualifier[] = { X520_ATTRIBUTE_TYPE, 44 };
michael@0 279 CONST_OID x520DnQualifier[] = { X520_ATTRIBUTE_TYPE, 46 };
michael@0 280 CONST_OID x520HouseIdentifier[] = { X520_ATTRIBUTE_TYPE, 51 };
michael@0 281 CONST_OID x520Pseudonym[] = { X520_ATTRIBUTE_TYPE, 65 };
michael@0 282
michael@0 283 CONST_OID nsTypeGIF[] = { NETSCAPE_DATA_TYPE, 0x01 };
michael@0 284 CONST_OID nsTypeJPEG[] = { NETSCAPE_DATA_TYPE, 0x02 };
michael@0 285 CONST_OID nsTypeURL[] = { NETSCAPE_DATA_TYPE, 0x03 };
michael@0 286 CONST_OID nsTypeHTML[] = { NETSCAPE_DATA_TYPE, 0x04 };
michael@0 287 CONST_OID nsTypeCertSeq[] = { NETSCAPE_DATA_TYPE, 0x05 };
michael@0 288
michael@0 289 CONST_OID missiCertKEADSSOld[] = { MISSI_OLD_KEA_DSS };
michael@0 290 CONST_OID missiCertDSSOld[] = { MISSI_OLD_DSS };
michael@0 291 CONST_OID missiCertKEADSS[] = { MISSI_KEA_DSS };
michael@0 292 CONST_OID missiCertDSS[] = { MISSI_DSS };
michael@0 293 CONST_OID missiCertKEA[] = { MISSI_KEA };
michael@0 294 CONST_OID missiCertAltKEA[] = { MISSI_ALT_KEA };
michael@0 295 CONST_OID x500RSAEncryption[] = { X500_ALG_ENCRYPTION, 0x01 };
michael@0 296
michael@0 297 /* added for alg 1485 */
michael@0 298 CONST_OID rfc1274Uid[] = { RFC1274_ATTR_TYPE, 1 };
michael@0 299 CONST_OID rfc1274Mail[] = { RFC1274_ATTR_TYPE, 3 };
michael@0 300 CONST_OID rfc2247DomainComponent[] = { RFC1274_ATTR_TYPE, 25 };
michael@0 301
michael@0 302 /* Netscape private certificate extensions */
michael@0 303 CONST_OID nsCertExtNetscapeOK[] = { NS_CERT_EXT, 1 };
michael@0 304 CONST_OID nsCertExtIssuerLogo[] = { NS_CERT_EXT, 2 };
michael@0 305 CONST_OID nsCertExtSubjectLogo[] = { NS_CERT_EXT, 3 };
michael@0 306 CONST_OID nsExtCertType[] = { NETSCAPE_CERT_EXT, 0x01 };
michael@0 307 CONST_OID nsExtBaseURL[] = { NETSCAPE_CERT_EXT, 0x02 };
michael@0 308 CONST_OID nsExtRevocationURL[] = { NETSCAPE_CERT_EXT, 0x03 };
michael@0 309 CONST_OID nsExtCARevocationURL[] = { NETSCAPE_CERT_EXT, 0x04 };
michael@0 310 CONST_OID nsExtCACRLURL[] = { NETSCAPE_CERT_EXT, 0x05 };
michael@0 311 CONST_OID nsExtCACertURL[] = { NETSCAPE_CERT_EXT, 0x06 };
michael@0 312 CONST_OID nsExtCertRenewalURL[] = { NETSCAPE_CERT_EXT, 0x07 };
michael@0 313 CONST_OID nsExtCAPolicyURL[] = { NETSCAPE_CERT_EXT, 0x08 };
michael@0 314 CONST_OID nsExtHomepageURL[] = { NETSCAPE_CERT_EXT, 0x09 };
michael@0 315 CONST_OID nsExtEntityLogo[] = { NETSCAPE_CERT_EXT, 0x0a };
michael@0 316 CONST_OID nsExtUserPicture[] = { NETSCAPE_CERT_EXT, 0x0b };
michael@0 317 CONST_OID nsExtSSLServerName[] = { NETSCAPE_CERT_EXT, 0x0c };
michael@0 318 CONST_OID nsExtComment[] = { NETSCAPE_CERT_EXT, 0x0d };
michael@0 319
michael@0 320 /* the following 2 extensions are defined for and used by Cartman(NSM) */
michael@0 321 CONST_OID nsExtLostPasswordURL[] = { NETSCAPE_CERT_EXT, 0x0e };
michael@0 322 CONST_OID nsExtCertRenewalTime[] = { NETSCAPE_CERT_EXT, 0x0f };
michael@0 323
michael@0 324 CONST_OID nsExtAIACertRenewal[] = { NETSCAPE_CERT_EXT_AIA, 0x01 };
michael@0 325 CONST_OID nsExtCertScopeOfUse[] = { NETSCAPE_CERT_EXT, 0x11 };
michael@0 326 /* Reserved Netscape (2 16 840 1 113730 1 18) = { NETSCAPE_CERT_EXT, 0x12 }; */
michael@0 327
michael@0 328 /* Netscape policy values */
michael@0 329 CONST_OID nsKeyUsageGovtApproved[] = { NETSCAPE_POLICY, 0x01 };
michael@0 330
michael@0 331 /* Netscape other name types */
michael@0 332 CONST_OID netscapeNickname[] = { NETSCAPE_NAME_COMPONENTS, 0x01 };
michael@0 333 CONST_OID netscapeAOLScreenname[] = { NETSCAPE_NAME_COMPONENTS, 0x02 };
michael@0 334
michael@0 335 /* OIDs needed for cert server */
michael@0 336 CONST_OID netscapeRecoveryRequest[] = { NETSCAPE_CERT_SERVER_CRMF, 0x01 };
michael@0 337
michael@0 338
michael@0 339 /* Standard x.509 v3 Certificate & CRL Extensions */
michael@0 340 CONST_OID x509SubjectDirectoryAttr[] = { ID_CE_OID, 9 };
michael@0 341 CONST_OID x509SubjectKeyID[] = { ID_CE_OID, 14 };
michael@0 342 CONST_OID x509KeyUsage[] = { ID_CE_OID, 15 };
michael@0 343 CONST_OID x509PrivateKeyUsagePeriod[] = { ID_CE_OID, 16 };
michael@0 344 CONST_OID x509SubjectAltName[] = { ID_CE_OID, 17 };
michael@0 345 CONST_OID x509IssuerAltName[] = { ID_CE_OID, 18 };
michael@0 346 CONST_OID x509BasicConstraints[] = { ID_CE_OID, 19 };
michael@0 347 CONST_OID x509CRLNumber[] = { ID_CE_OID, 20 };
michael@0 348 CONST_OID x509ReasonCode[] = { ID_CE_OID, 21 };
michael@0 349 CONST_OID x509HoldInstructionCode[] = { ID_CE_OID, 23 };
michael@0 350 CONST_OID x509InvalidDate[] = { ID_CE_OID, 24 };
michael@0 351 CONST_OID x509DeltaCRLIndicator[] = { ID_CE_OID, 27 };
michael@0 352 CONST_OID x509IssuingDistributionPoint[] = { ID_CE_OID, 28 };
michael@0 353 CONST_OID x509CertIssuer[] = { ID_CE_OID, 29 };
michael@0 354 CONST_OID x509NameConstraints[] = { ID_CE_OID, 30 };
michael@0 355 CONST_OID x509CRLDistPoints[] = { ID_CE_OID, 31 };
michael@0 356 CONST_OID x509CertificatePolicies[] = { ID_CE_OID, 32 };
michael@0 357 CONST_OID x509PolicyMappings[] = { ID_CE_OID, 33 };
michael@0 358 CONST_OID x509AuthKeyID[] = { ID_CE_OID, 35 };
michael@0 359 CONST_OID x509PolicyConstraints[] = { ID_CE_OID, 36 };
michael@0 360 CONST_OID x509ExtKeyUsage[] = { ID_CE_OID, 37 };
michael@0 361 CONST_OID x509FreshestCRL[] = { ID_CE_OID, 46 };
michael@0 362 CONST_OID x509InhibitAnyPolicy[] = { ID_CE_OID, 54 };
michael@0 363
michael@0 364 CONST_OID x509CertificatePoliciesAnyPolicy[] = { ID_CE_OID, 32, 0 };
michael@0 365
michael@0 366 CONST_OID x509AuthInfoAccess[] = { PKIX_CERT_EXTENSIONS, 1 };
michael@0 367 CONST_OID x509SubjectInfoAccess[] = { PKIX_CERT_EXTENSIONS, 11 };
michael@0 368
michael@0 369 CONST_OID x509SIATimeStamping[] = {PKIX_ACCESS_DESCRIPTION, 0x03};
michael@0 370 CONST_OID x509SIACaRepository[] = {PKIX_ACCESS_DESCRIPTION, 0x05};
michael@0 371
michael@0 372 /* pkcs 12 additions */
michael@0 373 CONST_OID pkcs12[] = { PKCS12 };
michael@0 374 CONST_OID pkcs12ModeIDs[] = { PKCS12_MODE_IDS };
michael@0 375 CONST_OID pkcs12ESPVKIDs[] = { PKCS12_ESPVK_IDS };
michael@0 376 CONST_OID pkcs12BagIDs[] = { PKCS12_BAG_IDS };
michael@0 377 CONST_OID pkcs12CertBagIDs[] = { PKCS12_CERT_BAG_IDS };
michael@0 378 CONST_OID pkcs12OIDs[] = { PKCS12_OIDS };
michael@0 379 CONST_OID pkcs12PBEIDs[] = { PKCS12_PBE_IDS };
michael@0 380 CONST_OID pkcs12EnvelopingIDs[] = { PKCS12_ENVELOPING_IDS };
michael@0 381 CONST_OID pkcs12SignatureIDs[] = { PKCS12_SIGNATURE_IDS };
michael@0 382 CONST_OID pkcs12PKCS8KeyShrouding[] = { PKCS12_ESPVK_IDS, 0x01 };
michael@0 383 CONST_OID pkcs12KeyBagID[] = { PKCS12_BAG_IDS, 0x01 };
michael@0 384 CONST_OID pkcs12CertAndCRLBagID[] = { PKCS12_BAG_IDS, 0x02 };
michael@0 385 CONST_OID pkcs12SecretBagID[] = { PKCS12_BAG_IDS, 0x03 };
michael@0 386 CONST_OID pkcs12X509CertCRLBag[] = { PKCS12_CERT_BAG_IDS, 0x01 };
michael@0 387 CONST_OID pkcs12SDSICertBag[] = { PKCS12_CERT_BAG_IDS, 0x02 };
michael@0 388 CONST_OID pkcs12PBEWithSha1And128BitRC4[] = { PKCS12_PBE_IDS, 0x01 };
michael@0 389 CONST_OID pkcs12PBEWithSha1And40BitRC4[] = { PKCS12_PBE_IDS, 0x02 };
michael@0 390 CONST_OID pkcs12PBEWithSha1AndTripleDESCBC[] = { PKCS12_PBE_IDS, 0x03 };
michael@0 391 CONST_OID pkcs12PBEWithSha1And128BitRC2CBC[] = { PKCS12_PBE_IDS, 0x04 };
michael@0 392 CONST_OID pkcs12PBEWithSha1And40BitRC2CBC[] = { PKCS12_PBE_IDS, 0x05 };
michael@0 393 CONST_OID pkcs12RSAEncryptionWith128BitRC4[] = { PKCS12_ENVELOPING_IDS, 0x01 };
michael@0 394 CONST_OID pkcs12RSAEncryptionWith40BitRC4[] = { PKCS12_ENVELOPING_IDS, 0x02 };
michael@0 395 CONST_OID pkcs12RSAEncryptionWithTripleDES[] = { PKCS12_ENVELOPING_IDS, 0x03 };
michael@0 396 CONST_OID pkcs12RSASignatureWithSHA1Digest[] = { PKCS12_SIGNATURE_IDS, 0x01 };
michael@0 397
michael@0 398 /* pkcs 12 version 1.0 ids */
michael@0 399 CONST_OID pkcs12V2PBEWithSha1And128BitRC4[] = { PKCS12_V2_PBE_IDS, 0x01 };
michael@0 400 CONST_OID pkcs12V2PBEWithSha1And40BitRC4[] = { PKCS12_V2_PBE_IDS, 0x02 };
michael@0 401 CONST_OID pkcs12V2PBEWithSha1And3KeyTripleDEScbc[]= { PKCS12_V2_PBE_IDS, 0x03 };
michael@0 402 CONST_OID pkcs12V2PBEWithSha1And2KeyTripleDEScbc[]= { PKCS12_V2_PBE_IDS, 0x04 };
michael@0 403 CONST_OID pkcs12V2PBEWithSha1And128BitRC2cbc[] = { PKCS12_V2_PBE_IDS, 0x05 };
michael@0 404 CONST_OID pkcs12V2PBEWithSha1And40BitRC2cbc[] = { PKCS12_V2_PBE_IDS, 0x06 };
michael@0 405
michael@0 406 CONST_OID pkcs12SafeContentsID[] = { PKCS12_BAG_IDS, 0x04 };
michael@0 407 CONST_OID pkcs12PKCS8ShroudedKeyBagID[] = { PKCS12_BAG_IDS, 0x05 };
michael@0 408
michael@0 409 CONST_OID pkcs12V1KeyBag[] = { PKCS12_V1_BAG_IDS, 0x01 };
michael@0 410 CONST_OID pkcs12V1PKCS8ShroudedKeyBag[] = { PKCS12_V1_BAG_IDS, 0x02 };
michael@0 411 CONST_OID pkcs12V1CertBag[] = { PKCS12_V1_BAG_IDS, 0x03 };
michael@0 412 CONST_OID pkcs12V1CRLBag[] = { PKCS12_V1_BAG_IDS, 0x04 };
michael@0 413 CONST_OID pkcs12V1SecretBag[] = { PKCS12_V1_BAG_IDS, 0x05 };
michael@0 414 CONST_OID pkcs12V1SafeContentsBag[] = { PKCS12_V1_BAG_IDS, 0x06 };
michael@0 415
michael@0 416 /* The following encoding is INCORRECT, but correcting it would create a
michael@0 417 * duplicate OID in the table. So, we will leave it alone.
michael@0 418 */
michael@0 419 CONST_OID pkcs12KeyUsageAttr[] = { 2, 5, 29, 15 };
michael@0 420
michael@0 421 CONST_OID ansix9DSASignature[] = { ANSI_X9_ALGORITHM, 0x01 };
michael@0 422 CONST_OID ansix9DSASignaturewithSHA1Digest[] = { ANSI_X9_ALGORITHM, 0x03 };
michael@0 423 CONST_OID nistDSASignaturewithSHA224Digest[] = { DSA2, 0x01 };
michael@0 424 CONST_OID nistDSASignaturewithSHA256Digest[] = { DSA2, 0x02 };
michael@0 425
michael@0 426 /* verisign OIDs */
michael@0 427 CONST_OID verisignUserNotices[] = { VERISIGN, 1, 7, 1, 1 };
michael@0 428
michael@0 429 /* pkix OIDs */
michael@0 430 CONST_OID pkixCPSPointerQualifier[] = { PKIX_POLICY_QUALIFIERS, 1 };
michael@0 431 CONST_OID pkixUserNoticeQualifier[] = { PKIX_POLICY_QUALIFIERS, 2 };
michael@0 432
michael@0 433 CONST_OID pkixOCSP[] = { PKIX_OCSP };
michael@0 434 CONST_OID pkixOCSPBasicResponse[] = { PKIX_OCSP, 1 };
michael@0 435 CONST_OID pkixOCSPNonce[] = { PKIX_OCSP, 2 };
michael@0 436 CONST_OID pkixOCSPCRL[] = { PKIX_OCSP, 3 };
michael@0 437 CONST_OID pkixOCSPResponse[] = { PKIX_OCSP, 4 };
michael@0 438 CONST_OID pkixOCSPNoCheck[] = { PKIX_OCSP, 5 };
michael@0 439 CONST_OID pkixOCSPArchiveCutoff[] = { PKIX_OCSP, 6 };
michael@0 440 CONST_OID pkixOCSPServiceLocator[] = { PKIX_OCSP, 7 };
michael@0 441
michael@0 442 CONST_OID pkixCAIssuers[] = { PKIX_CA_ISSUERS };
michael@0 443
michael@0 444 CONST_OID pkixRegCtrlRegToken[] = { PKIX_ID_REGCTRL, 1};
michael@0 445 CONST_OID pkixRegCtrlAuthenticator[] = { PKIX_ID_REGCTRL, 2};
michael@0 446 CONST_OID pkixRegCtrlPKIPubInfo[] = { PKIX_ID_REGCTRL, 3};
michael@0 447 CONST_OID pkixRegCtrlPKIArchOptions[] = { PKIX_ID_REGCTRL, 4};
michael@0 448 CONST_OID pkixRegCtrlOldCertID[] = { PKIX_ID_REGCTRL, 5};
michael@0 449 CONST_OID pkixRegCtrlProtEncKey[] = { PKIX_ID_REGCTRL, 6};
michael@0 450 CONST_OID pkixRegInfoUTF8Pairs[] = { PKIX_ID_REGINFO, 1};
michael@0 451 CONST_OID pkixRegInfoCertReq[] = { PKIX_ID_REGINFO, 2};
michael@0 452
michael@0 453 CONST_OID pkixExtendedKeyUsageServerAuth[] = { PKIX_KEY_USAGE, 1 };
michael@0 454 CONST_OID pkixExtendedKeyUsageClientAuth[] = { PKIX_KEY_USAGE, 2 };
michael@0 455 CONST_OID pkixExtendedKeyUsageCodeSign[] = { PKIX_KEY_USAGE, 3 };
michael@0 456 CONST_OID pkixExtendedKeyUsageEMailProtect[] = { PKIX_KEY_USAGE, 4 };
michael@0 457 CONST_OID pkixExtendedKeyUsageTimeStamp[] = { PKIX_KEY_USAGE, 8 };
michael@0 458 CONST_OID pkixOCSPResponderExtendedKeyUsage[] = { PKIX_KEY_USAGE, 9 };
michael@0 459 CONST_OID msExtendedKeyUsageTrustListSigning[] = { MS_CRYPTO_EKU, 1 };
michael@0 460
michael@0 461 /* OIDs for Netscape defined algorithms */
michael@0 462 CONST_OID netscapeSMimeKEA[] = { NETSCAPE_ALGS, 0x01 };
michael@0 463
michael@0 464 /* Fortezza algorithm OIDs */
michael@0 465 CONST_OID skipjackCBC[] = { MISSI, 0x04 };
michael@0 466 CONST_OID dhPublicKey[] = { ANSI_X942_ALGORITHM, 0x1 };
michael@0 467
michael@0 468 CONST_OID aes128_ECB[] = { AES, 1 };
michael@0 469 CONST_OID aes128_CBC[] = { AES, 2 };
michael@0 470 #ifdef DEFINE_ALL_AES_CIPHERS
michael@0 471 CONST_OID aes128_OFB[] = { AES, 3 };
michael@0 472 CONST_OID aes128_CFB[] = { AES, 4 };
michael@0 473 #endif
michael@0 474 CONST_OID aes128_KEY_WRAP[] = { AES, 5 };
michael@0 475
michael@0 476 CONST_OID aes192_ECB[] = { AES, 21 };
michael@0 477 CONST_OID aes192_CBC[] = { AES, 22 };
michael@0 478 #ifdef DEFINE_ALL_AES_CIPHERS
michael@0 479 CONST_OID aes192_OFB[] = { AES, 23 };
michael@0 480 CONST_OID aes192_CFB[] = { AES, 24 };
michael@0 481 #endif
michael@0 482 CONST_OID aes192_KEY_WRAP[] = { AES, 25 };
michael@0 483
michael@0 484 CONST_OID aes256_ECB[] = { AES, 41 };
michael@0 485 CONST_OID aes256_CBC[] = { AES, 42 };
michael@0 486 #ifdef DEFINE_ALL_AES_CIPHERS
michael@0 487 CONST_OID aes256_OFB[] = { AES, 43 };
michael@0 488 CONST_OID aes256_CFB[] = { AES, 44 };
michael@0 489 #endif
michael@0 490 CONST_OID aes256_KEY_WRAP[] = { AES, 45 };
michael@0 491
michael@0 492 CONST_OID camellia128_CBC[] = { CAMELLIA_ENCRYPT_OID, 2};
michael@0 493 CONST_OID camellia192_CBC[] = { CAMELLIA_ENCRYPT_OID, 3};
michael@0 494 CONST_OID camellia256_CBC[] = { CAMELLIA_ENCRYPT_OID, 4};
michael@0 495 CONST_OID camellia128_KEY_WRAP[] = { CAMELLIA_WRAP_OID, 2};
michael@0 496 CONST_OID camellia192_KEY_WRAP[] = { CAMELLIA_WRAP_OID, 3};
michael@0 497 CONST_OID camellia256_KEY_WRAP[] = { CAMELLIA_WRAP_OID, 4};
michael@0 498
michael@0 499 CONST_OID sha256[] = { SHAXXX, 1 };
michael@0 500 CONST_OID sha384[] = { SHAXXX, 2 };
michael@0 501 CONST_OID sha512[] = { SHAXXX, 3 };
michael@0 502 CONST_OID sha224[] = { SHAXXX, 4 };
michael@0 503
michael@0 504 CONST_OID ansix962ECPublicKey[] = { ANSI_X962_OID, 0x02, 0x01 };
michael@0 505 CONST_OID ansix962SignaturewithSHA1Digest[] = { ANSI_X962_SIGNATURE_OID, 0x01 };
michael@0 506 CONST_OID ansix962SignatureRecommended[] = { ANSI_X962_SIGNATURE_OID, 0x02 };
michael@0 507 CONST_OID ansix962SignatureSpecified[] = { ANSI_X962_SPECIFY_OID };
michael@0 508 CONST_OID ansix962SignaturewithSHA224Digest[] = { ANSI_X962_SPECIFY_OID, 0x01 };
michael@0 509 CONST_OID ansix962SignaturewithSHA256Digest[] = { ANSI_X962_SPECIFY_OID, 0x02 };
michael@0 510 CONST_OID ansix962SignaturewithSHA384Digest[] = { ANSI_X962_SPECIFY_OID, 0x03 };
michael@0 511 CONST_OID ansix962SignaturewithSHA512Digest[] = { ANSI_X962_SPECIFY_OID, 0x04 };
michael@0 512
michael@0 513 /* ANSI X9.62 prime curve OIDs */
michael@0 514 /* NOTE: prime192v1 is the same as secp192r1, prime256v1 is the
michael@0 515 * same as secp256r1
michael@0 516 */
michael@0 517 CONST_OID ansiX962prime192v1[] = { ANSI_X962_GFp_OID, 0x01 };
michael@0 518 CONST_OID ansiX962prime192v2[] = { ANSI_X962_GFp_OID, 0x02 };
michael@0 519 CONST_OID ansiX962prime192v3[] = { ANSI_X962_GFp_OID, 0x03 };
michael@0 520 CONST_OID ansiX962prime239v1[] = { ANSI_X962_GFp_OID, 0x04 };
michael@0 521 CONST_OID ansiX962prime239v2[] = { ANSI_X962_GFp_OID, 0x05 };
michael@0 522 CONST_OID ansiX962prime239v3[] = { ANSI_X962_GFp_OID, 0x06 };
michael@0 523 CONST_OID ansiX962prime256v1[] = { ANSI_X962_GFp_OID, 0x07 };
michael@0 524
michael@0 525 /* SECG prime curve OIDs */
michael@0 526 CONST_OID secgECsecp112r1[] = { SECG_OID, 0x06 };
michael@0 527 CONST_OID secgECsecp112r2[] = { SECG_OID, 0x07 };
michael@0 528 CONST_OID secgECsecp128r1[] = { SECG_OID, 0x1c };
michael@0 529 CONST_OID secgECsecp128r2[] = { SECG_OID, 0x1d };
michael@0 530 CONST_OID secgECsecp160k1[] = { SECG_OID, 0x09 };
michael@0 531 CONST_OID secgECsecp160r1[] = { SECG_OID, 0x08 };
michael@0 532 CONST_OID secgECsecp160r2[] = { SECG_OID, 0x1e };
michael@0 533 CONST_OID secgECsecp192k1[] = { SECG_OID, 0x1f };
michael@0 534 CONST_OID secgECsecp224k1[] = { SECG_OID, 0x20 };
michael@0 535 CONST_OID secgECsecp224r1[] = { SECG_OID, 0x21 };
michael@0 536 CONST_OID secgECsecp256k1[] = { SECG_OID, 0x0a };
michael@0 537 CONST_OID secgECsecp384r1[] = { SECG_OID, 0x22 };
michael@0 538 CONST_OID secgECsecp521r1[] = { SECG_OID, 0x23 };
michael@0 539
michael@0 540 /* ANSI X9.62 characteristic two curve OIDs */
michael@0 541 CONST_OID ansiX962c2pnb163v1[] = { ANSI_X962_GF2m_OID, 0x01 };
michael@0 542 CONST_OID ansiX962c2pnb163v2[] = { ANSI_X962_GF2m_OID, 0x02 };
michael@0 543 CONST_OID ansiX962c2pnb163v3[] = { ANSI_X962_GF2m_OID, 0x03 };
michael@0 544 CONST_OID ansiX962c2pnb176v1[] = { ANSI_X962_GF2m_OID, 0x04 };
michael@0 545 CONST_OID ansiX962c2tnb191v1[] = { ANSI_X962_GF2m_OID, 0x05 };
michael@0 546 CONST_OID ansiX962c2tnb191v2[] = { ANSI_X962_GF2m_OID, 0x06 };
michael@0 547 CONST_OID ansiX962c2tnb191v3[] = { ANSI_X962_GF2m_OID, 0x07 };
michael@0 548 CONST_OID ansiX962c2onb191v4[] = { ANSI_X962_GF2m_OID, 0x08 };
michael@0 549 CONST_OID ansiX962c2onb191v5[] = { ANSI_X962_GF2m_OID, 0x09 };
michael@0 550 CONST_OID ansiX962c2pnb208w1[] = { ANSI_X962_GF2m_OID, 0x0a };
michael@0 551 CONST_OID ansiX962c2tnb239v1[] = { ANSI_X962_GF2m_OID, 0x0b };
michael@0 552 CONST_OID ansiX962c2tnb239v2[] = { ANSI_X962_GF2m_OID, 0x0c };
michael@0 553 CONST_OID ansiX962c2tnb239v3[] = { ANSI_X962_GF2m_OID, 0x0d };
michael@0 554 CONST_OID ansiX962c2onb239v4[] = { ANSI_X962_GF2m_OID, 0x0e };
michael@0 555 CONST_OID ansiX962c2onb239v5[] = { ANSI_X962_GF2m_OID, 0x0f };
michael@0 556 CONST_OID ansiX962c2pnb272w1[] = { ANSI_X962_GF2m_OID, 0x10 };
michael@0 557 CONST_OID ansiX962c2pnb304w1[] = { ANSI_X962_GF2m_OID, 0x11 };
michael@0 558 CONST_OID ansiX962c2tnb359v1[] = { ANSI_X962_GF2m_OID, 0x12 };
michael@0 559 CONST_OID ansiX962c2pnb368w1[] = { ANSI_X962_GF2m_OID, 0x13 };
michael@0 560 CONST_OID ansiX962c2tnb431r1[] = { ANSI_X962_GF2m_OID, 0x14 };
michael@0 561
michael@0 562 /* SECG characterisitic two curve OIDs */
michael@0 563 CONST_OID secgECsect113r1[] = {SECG_OID, 0x04 };
michael@0 564 CONST_OID secgECsect113r2[] = {SECG_OID, 0x05 };
michael@0 565 CONST_OID secgECsect131r1[] = {SECG_OID, 0x16 };
michael@0 566 CONST_OID secgECsect131r2[] = {SECG_OID, 0x17 };
michael@0 567 CONST_OID secgECsect163k1[] = {SECG_OID, 0x01 };
michael@0 568 CONST_OID secgECsect163r1[] = {SECG_OID, 0x02 };
michael@0 569 CONST_OID secgECsect163r2[] = {SECG_OID, 0x0f };
michael@0 570 CONST_OID secgECsect193r1[] = {SECG_OID, 0x18 };
michael@0 571 CONST_OID secgECsect193r2[] = {SECG_OID, 0x19 };
michael@0 572 CONST_OID secgECsect233k1[] = {SECG_OID, 0x1a };
michael@0 573 CONST_OID secgECsect233r1[] = {SECG_OID, 0x1b };
michael@0 574 CONST_OID secgECsect239k1[] = {SECG_OID, 0x03 };
michael@0 575 CONST_OID secgECsect283k1[] = {SECG_OID, 0x10 };
michael@0 576 CONST_OID secgECsect283r1[] = {SECG_OID, 0x11 };
michael@0 577 CONST_OID secgECsect409k1[] = {SECG_OID, 0x24 };
michael@0 578 CONST_OID secgECsect409r1[] = {SECG_OID, 0x25 };
michael@0 579 CONST_OID secgECsect571k1[] = {SECG_OID, 0x26 };
michael@0 580 CONST_OID secgECsect571r1[] = {SECG_OID, 0x27 };
michael@0 581
michael@0 582 CONST_OID seed_CBC[] = { SEED_OID, 4 };
michael@0 583
michael@0 584 CONST_OID evIncorporationLocality[] = { EV_NAME_ATTRIBUTE, 1 };
michael@0 585 CONST_OID evIncorporationState[] = { EV_NAME_ATTRIBUTE, 2 };
michael@0 586 CONST_OID evIncorporationCountry[] = { EV_NAME_ATTRIBUTE, 3 };
michael@0 587
michael@0 588 #define OI(x) { siDEROID, (unsigned char *)x, sizeof x }
michael@0 589 #ifndef SECOID_NO_STRINGS
michael@0 590 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, desc, mech, ext }
michael@0 591 #else
michael@0 592 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, 0, mech, ext }
michael@0 593 #endif
michael@0 594
michael@0 595 #if defined(NSS_ALLOW_UNSUPPORTED_CRITICAL)
michael@0 596 #define FAKE_SUPPORTED_CERT_EXTENSION SUPPORTED_CERT_EXTENSION
michael@0 597 #else
michael@0 598 #define FAKE_SUPPORTED_CERT_EXTENSION UNSUPPORTED_CERT_EXTENSION
michael@0 599 #endif
michael@0 600
michael@0 601 /*
michael@0 602 * NOTE: the order of these entries must mach the SECOidTag enum in secoidt.h!
michael@0 603 */
michael@0 604 const static SECOidData oids[SEC_OID_TOTAL] = {
michael@0 605 { { siDEROID, NULL, 0 }, SEC_OID_UNKNOWN,
michael@0 606 "Unknown OID", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION },
michael@0 607 OD( md2, SEC_OID_MD2, "MD2", CKM_MD2, INVALID_CERT_EXTENSION ),
michael@0 608 OD( md4, SEC_OID_MD4,
michael@0 609 "MD4", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 610 OD( md5, SEC_OID_MD5, "MD5", CKM_MD5, INVALID_CERT_EXTENSION ),
michael@0 611 OD( sha1, SEC_OID_SHA1, "SHA-1", CKM_SHA_1, INVALID_CERT_EXTENSION ),
michael@0 612 OD( rc2cbc, SEC_OID_RC2_CBC,
michael@0 613 "RC2-CBC", CKM_RC2_CBC, INVALID_CERT_EXTENSION ),
michael@0 614 OD( rc4, SEC_OID_RC4, "RC4", CKM_RC4, INVALID_CERT_EXTENSION ),
michael@0 615 OD( desede3cbc, SEC_OID_DES_EDE3_CBC,
michael@0 616 "DES-EDE3-CBC", CKM_DES3_CBC, INVALID_CERT_EXTENSION ),
michael@0 617 OD( rc5cbcpad, SEC_OID_RC5_CBC_PAD,
michael@0 618 "RC5-CBCPad", CKM_RC5_CBC, INVALID_CERT_EXTENSION ),
michael@0 619 OD( desecb, SEC_OID_DES_ECB,
michael@0 620 "DES-ECB", CKM_DES_ECB, INVALID_CERT_EXTENSION ),
michael@0 621 OD( descbc, SEC_OID_DES_CBC,
michael@0 622 "DES-CBC", CKM_DES_CBC, INVALID_CERT_EXTENSION ),
michael@0 623 OD( desofb, SEC_OID_DES_OFB,
michael@0 624 "DES-OFB", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 625 OD( descfb, SEC_OID_DES_CFB,
michael@0 626 "DES-CFB", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 627 OD( desmac, SEC_OID_DES_MAC,
michael@0 628 "DES-MAC", CKM_DES_MAC, INVALID_CERT_EXTENSION ),
michael@0 629 OD( desede, SEC_OID_DES_EDE,
michael@0 630 "DES-EDE", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 631 OD( isoSHAWithRSASignature, SEC_OID_ISO_SHA_WITH_RSA_SIGNATURE,
michael@0 632 "ISO SHA with RSA Signature",
michael@0 633 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 634 OD( pkcs1RSAEncryption, SEC_OID_PKCS1_RSA_ENCRYPTION,
michael@0 635 "PKCS #1 RSA Encryption", CKM_RSA_PKCS, INVALID_CERT_EXTENSION ),
michael@0 636
michael@0 637 /* the following Signing mechanisms should get new CKM_ values when
michael@0 638 * values for CKM_RSA_WITH_MDX and CKM_RSA_WITH_SHA_1 get defined in
michael@0 639 * PKCS #11.
michael@0 640 */
michael@0 641 OD( pkcs1MD2WithRSAEncryption, SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION,
michael@0 642 "PKCS #1 MD2 With RSA Encryption", CKM_MD2_RSA_PKCS,
michael@0 643 INVALID_CERT_EXTENSION ),
michael@0 644 OD( pkcs1MD4WithRSAEncryption, SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION,
michael@0 645 "PKCS #1 MD4 With RSA Encryption",
michael@0 646 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 647 OD( pkcs1MD5WithRSAEncryption, SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION,
michael@0 648 "PKCS #1 MD5 With RSA Encryption", CKM_MD5_RSA_PKCS,
michael@0 649 INVALID_CERT_EXTENSION ),
michael@0 650 OD( pkcs1SHA1WithRSAEncryption, SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION,
michael@0 651 "PKCS #1 SHA-1 With RSA Encryption", CKM_SHA1_RSA_PKCS,
michael@0 652 INVALID_CERT_EXTENSION ),
michael@0 653
michael@0 654 OD( pkcs5PbeWithMD2AndDEScbc, SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC,
michael@0 655 "PKCS #5 Password Based Encryption with MD2 and DES-CBC",
michael@0 656 CKM_PBE_MD2_DES_CBC, INVALID_CERT_EXTENSION ),
michael@0 657 OD( pkcs5PbeWithMD5AndDEScbc, SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC,
michael@0 658 "PKCS #5 Password Based Encryption with MD5 and DES-CBC",
michael@0 659 CKM_PBE_MD5_DES_CBC, INVALID_CERT_EXTENSION ),
michael@0 660 OD( pkcs5PbeWithSha1AndDEScbc, SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC,
michael@0 661 "PKCS #5 Password Based Encryption with SHA-1 and DES-CBC",
michael@0 662 CKM_NETSCAPE_PBE_SHA1_DES_CBC, INVALID_CERT_EXTENSION ),
michael@0 663 OD( pkcs7, SEC_OID_PKCS7,
michael@0 664 "PKCS #7", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 665 OD( pkcs7Data, SEC_OID_PKCS7_DATA,
michael@0 666 "PKCS #7 Data", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 667 OD( pkcs7SignedData, SEC_OID_PKCS7_SIGNED_DATA,
michael@0 668 "PKCS #7 Signed Data", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 669 OD( pkcs7EnvelopedData, SEC_OID_PKCS7_ENVELOPED_DATA,
michael@0 670 "PKCS #7 Enveloped Data",
michael@0 671 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 672 OD( pkcs7SignedEnvelopedData, SEC_OID_PKCS7_SIGNED_ENVELOPED_DATA,
michael@0 673 "PKCS #7 Signed And Enveloped Data",
michael@0 674 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 675 OD( pkcs7DigestedData, SEC_OID_PKCS7_DIGESTED_DATA,
michael@0 676 "PKCS #7 Digested Data",
michael@0 677 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 678 OD( pkcs7EncryptedData, SEC_OID_PKCS7_ENCRYPTED_DATA,
michael@0 679 "PKCS #7 Encrypted Data",
michael@0 680 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 681 OD( pkcs9EmailAddress, SEC_OID_PKCS9_EMAIL_ADDRESS,
michael@0 682 "PKCS #9 Email Address",
michael@0 683 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 684 OD( pkcs9UnstructuredName, SEC_OID_PKCS9_UNSTRUCTURED_NAME,
michael@0 685 "PKCS #9 Unstructured Name",
michael@0 686 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 687 OD( pkcs9ContentType, SEC_OID_PKCS9_CONTENT_TYPE,
michael@0 688 "PKCS #9 Content Type",
michael@0 689 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 690 OD( pkcs9MessageDigest, SEC_OID_PKCS9_MESSAGE_DIGEST,
michael@0 691 "PKCS #9 Message Digest",
michael@0 692 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 693 OD( pkcs9SigningTime, SEC_OID_PKCS9_SIGNING_TIME,
michael@0 694 "PKCS #9 Signing Time",
michael@0 695 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 696 OD( pkcs9CounterSignature, SEC_OID_PKCS9_COUNTER_SIGNATURE,
michael@0 697 "PKCS #9 Counter Signature",
michael@0 698 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 699 OD( pkcs9ChallengePassword, SEC_OID_PKCS9_CHALLENGE_PASSWORD,
michael@0 700 "PKCS #9 Challenge Password",
michael@0 701 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 702 OD( pkcs9UnstructuredAddress, SEC_OID_PKCS9_UNSTRUCTURED_ADDRESS,
michael@0 703 "PKCS #9 Unstructured Address",
michael@0 704 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 705 OD( pkcs9ExtendedCertificateAttributes,
michael@0 706 SEC_OID_PKCS9_EXTENDED_CERTIFICATE_ATTRIBUTES,
michael@0 707 "PKCS #9 Extended Certificate Attributes",
michael@0 708 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 709 OD( pkcs9SMIMECapabilities, SEC_OID_PKCS9_SMIME_CAPABILITIES,
michael@0 710 "PKCS #9 S/MIME Capabilities",
michael@0 711 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 712 OD( x520CommonName, SEC_OID_AVA_COMMON_NAME,
michael@0 713 "X520 Common Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 714 OD( x520CountryName, SEC_OID_AVA_COUNTRY_NAME,
michael@0 715 "X520 Country Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 716 OD( x520LocalityName, SEC_OID_AVA_LOCALITY,
michael@0 717 "X520 Locality Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 718 OD( x520StateOrProvinceName, SEC_OID_AVA_STATE_OR_PROVINCE,
michael@0 719 "X520 State Or Province Name",
michael@0 720 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 721 OD( x520OrgName, SEC_OID_AVA_ORGANIZATION_NAME,
michael@0 722 "X520 Organization Name",
michael@0 723 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 724 OD( x520OrgUnitName, SEC_OID_AVA_ORGANIZATIONAL_UNIT_NAME,
michael@0 725 "X520 Organizational Unit Name",
michael@0 726 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 727 OD( x520DnQualifier, SEC_OID_AVA_DN_QUALIFIER,
michael@0 728 "X520 DN Qualifier", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 729 OD( rfc2247DomainComponent, SEC_OID_AVA_DC,
michael@0 730 "RFC 2247 Domain Component",
michael@0 731 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 732
michael@0 733 OD( nsTypeGIF, SEC_OID_NS_TYPE_GIF,
michael@0 734 "GIF", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 735 OD( nsTypeJPEG, SEC_OID_NS_TYPE_JPEG,
michael@0 736 "JPEG", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 737 OD( nsTypeURL, SEC_OID_NS_TYPE_URL,
michael@0 738 "URL", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 739 OD( nsTypeHTML, SEC_OID_NS_TYPE_HTML,
michael@0 740 "HTML", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 741 OD( nsTypeCertSeq, SEC_OID_NS_TYPE_CERT_SEQUENCE,
michael@0 742 "Certificate Sequence",
michael@0 743 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 744 OD( missiCertKEADSSOld, SEC_OID_MISSI_KEA_DSS_OLD,
michael@0 745 "MISSI KEA and DSS Algorithm (Old)",
michael@0 746 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 747 OD( missiCertDSSOld, SEC_OID_MISSI_DSS_OLD,
michael@0 748 "MISSI DSS Algorithm (Old)",
michael@0 749 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 750 OD( missiCertKEADSS, SEC_OID_MISSI_KEA_DSS,
michael@0 751 "MISSI KEA and DSS Algorithm",
michael@0 752 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 753 OD( missiCertDSS, SEC_OID_MISSI_DSS,
michael@0 754 "MISSI DSS Algorithm",
michael@0 755 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 756 OD( missiCertKEA, SEC_OID_MISSI_KEA,
michael@0 757 "MISSI KEA Algorithm",
michael@0 758 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 759 OD( missiCertAltKEA, SEC_OID_MISSI_ALT_KEA,
michael@0 760 "MISSI Alternate KEA Algorithm",
michael@0 761 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 762
michael@0 763 /* Netscape private extensions */
michael@0 764 OD( nsCertExtNetscapeOK, SEC_OID_NS_CERT_EXT_NETSCAPE_OK,
michael@0 765 "Netscape says this cert is OK",
michael@0 766 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 767 OD( nsCertExtIssuerLogo, SEC_OID_NS_CERT_EXT_ISSUER_LOGO,
michael@0 768 "Certificate Issuer Logo",
michael@0 769 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 770 OD( nsCertExtSubjectLogo, SEC_OID_NS_CERT_EXT_SUBJECT_LOGO,
michael@0 771 "Certificate Subject Logo",
michael@0 772 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 773 OD( nsExtCertType, SEC_OID_NS_CERT_EXT_CERT_TYPE,
michael@0 774 "Certificate Type",
michael@0 775 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 776 OD( nsExtBaseURL, SEC_OID_NS_CERT_EXT_BASE_URL,
michael@0 777 "Certificate Extension Base URL",
michael@0 778 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 779 OD( nsExtRevocationURL, SEC_OID_NS_CERT_EXT_REVOCATION_URL,
michael@0 780 "Certificate Revocation URL",
michael@0 781 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 782 OD( nsExtCARevocationURL, SEC_OID_NS_CERT_EXT_CA_REVOCATION_URL,
michael@0 783 "Certificate Authority Revocation URL",
michael@0 784 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 785 OD( nsExtCACRLURL, SEC_OID_NS_CERT_EXT_CA_CRL_URL,
michael@0 786 "Certificate Authority CRL Download URL",
michael@0 787 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 788 OD( nsExtCACertURL, SEC_OID_NS_CERT_EXT_CA_CERT_URL,
michael@0 789 "Certificate Authority Certificate Download URL",
michael@0 790 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 791 OD( nsExtCertRenewalURL, SEC_OID_NS_CERT_EXT_CERT_RENEWAL_URL,
michael@0 792 "Certificate Renewal URL",
michael@0 793 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 794 OD( nsExtCAPolicyURL, SEC_OID_NS_CERT_EXT_CA_POLICY_URL,
michael@0 795 "Certificate Authority Policy URL",
michael@0 796 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 797 OD( nsExtHomepageURL, SEC_OID_NS_CERT_EXT_HOMEPAGE_URL,
michael@0 798 "Certificate Homepage URL",
michael@0 799 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 800 OD( nsExtEntityLogo, SEC_OID_NS_CERT_EXT_ENTITY_LOGO,
michael@0 801 "Certificate Entity Logo",
michael@0 802 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 803 OD( nsExtUserPicture, SEC_OID_NS_CERT_EXT_USER_PICTURE,
michael@0 804 "Certificate User Picture",
michael@0 805 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 806 OD( nsExtSSLServerName, SEC_OID_NS_CERT_EXT_SSL_SERVER_NAME,
michael@0 807 "Certificate SSL Server Name",
michael@0 808 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 809 OD( nsExtComment, SEC_OID_NS_CERT_EXT_COMMENT,
michael@0 810 "Certificate Comment",
michael@0 811 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 812 OD( nsExtLostPasswordURL, SEC_OID_NS_CERT_EXT_LOST_PASSWORD_URL,
michael@0 813 "Lost Password URL",
michael@0 814 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 815 OD( nsExtCertRenewalTime, SEC_OID_NS_CERT_EXT_CERT_RENEWAL_TIME,
michael@0 816 "Certificate Renewal Time",
michael@0 817 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 818 OD( nsKeyUsageGovtApproved, SEC_OID_NS_KEY_USAGE_GOVT_APPROVED,
michael@0 819 "Strong Crypto Export Approved",
michael@0 820 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 821
michael@0 822
michael@0 823 /* x.509 v3 certificate extensions */
michael@0 824 OD( x509SubjectDirectoryAttr, SEC_OID_X509_SUBJECT_DIRECTORY_ATTR,
michael@0 825 "Certificate Subject Directory Attributes",
michael@0 826 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION),
michael@0 827 OD( x509SubjectKeyID, SEC_OID_X509_SUBJECT_KEY_ID,
michael@0 828 "Certificate Subject Key ID",
michael@0 829 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 830 OD( x509KeyUsage, SEC_OID_X509_KEY_USAGE,
michael@0 831 "Certificate Key Usage",
michael@0 832 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 833 OD( x509PrivateKeyUsagePeriod, SEC_OID_X509_PRIVATE_KEY_USAGE_PERIOD,
michael@0 834 "Certificate Private Key Usage Period",
michael@0 835 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 836 OD( x509SubjectAltName, SEC_OID_X509_SUBJECT_ALT_NAME,
michael@0 837 "Certificate Subject Alt Name",
michael@0 838 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 839 OD( x509IssuerAltName, SEC_OID_X509_ISSUER_ALT_NAME,
michael@0 840 "Certificate Issuer Alt Name",
michael@0 841 CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 842 OD( x509BasicConstraints, SEC_OID_X509_BASIC_CONSTRAINTS,
michael@0 843 "Certificate Basic Constraints",
michael@0 844 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 845 OD( x509NameConstraints, SEC_OID_X509_NAME_CONSTRAINTS,
michael@0 846 "Certificate Name Constraints",
michael@0 847 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 848 OD( x509CRLDistPoints, SEC_OID_X509_CRL_DIST_POINTS,
michael@0 849 "CRL Distribution Points",
michael@0 850 CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 851 OD( x509CertificatePolicies, SEC_OID_X509_CERTIFICATE_POLICIES,
michael@0 852 "Certificate Policies",
michael@0 853 CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 854 OD( x509PolicyMappings, SEC_OID_X509_POLICY_MAPPINGS,
michael@0 855 "Certificate Policy Mappings",
michael@0 856 CKM_INVALID_MECHANISM, UNSUPPORTED_CERT_EXTENSION ),
michael@0 857 OD( x509PolicyConstraints, SEC_OID_X509_POLICY_CONSTRAINTS,
michael@0 858 "Certificate Policy Constraints",
michael@0 859 CKM_INVALID_MECHANISM, FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 860 OD( x509AuthKeyID, SEC_OID_X509_AUTH_KEY_ID,
michael@0 861 "Certificate Authority Key Identifier",
michael@0 862 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 863 OD( x509ExtKeyUsage, SEC_OID_X509_EXT_KEY_USAGE,
michael@0 864 "Extended Key Usage",
michael@0 865 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 866 OD( x509AuthInfoAccess, SEC_OID_X509_AUTH_INFO_ACCESS,
michael@0 867 "Authority Information Access",
michael@0 868 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 869
michael@0 870 /* x.509 v3 CRL extensions */
michael@0 871 OD( x509CRLNumber, SEC_OID_X509_CRL_NUMBER,
michael@0 872 "CRL Number", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 873 OD( x509ReasonCode, SEC_OID_X509_REASON_CODE,
michael@0 874 "CRL reason code", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 875 OD( x509InvalidDate, SEC_OID_X509_INVALID_DATE,
michael@0 876 "Invalid Date", CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 877
michael@0 878 OD( x500RSAEncryption, SEC_OID_X500_RSA_ENCRYPTION,
michael@0 879 "X500 RSA Encryption", CKM_RSA_X_509, INVALID_CERT_EXTENSION ),
michael@0 880
michael@0 881 /* added for alg 1485 */
michael@0 882 OD( rfc1274Uid, SEC_OID_RFC1274_UID,
michael@0 883 "RFC1274 User Id", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 884 OD( rfc1274Mail, SEC_OID_RFC1274_MAIL,
michael@0 885 "RFC1274 E-mail Address",
michael@0 886 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 887
michael@0 888 /* pkcs 12 additions */
michael@0 889 OD( pkcs12, SEC_OID_PKCS12,
michael@0 890 "PKCS #12", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 891 OD( pkcs12ModeIDs, SEC_OID_PKCS12_MODE_IDS,
michael@0 892 "PKCS #12 Mode IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 893 OD( pkcs12ESPVKIDs, SEC_OID_PKCS12_ESPVK_IDS,
michael@0 894 "PKCS #12 ESPVK IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 895 OD( pkcs12BagIDs, SEC_OID_PKCS12_BAG_IDS,
michael@0 896 "PKCS #12 Bag IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 897 OD( pkcs12CertBagIDs, SEC_OID_PKCS12_CERT_BAG_IDS,
michael@0 898 "PKCS #12 Cert Bag IDs",
michael@0 899 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 900 OD( pkcs12OIDs, SEC_OID_PKCS12_OIDS,
michael@0 901 "PKCS #12 OIDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 902 OD( pkcs12PBEIDs, SEC_OID_PKCS12_PBE_IDS,
michael@0 903 "PKCS #12 PBE IDs", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 904 OD( pkcs12SignatureIDs, SEC_OID_PKCS12_SIGNATURE_IDS,
michael@0 905 "PKCS #12 Signature IDs",
michael@0 906 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 907 OD( pkcs12EnvelopingIDs, SEC_OID_PKCS12_ENVELOPING_IDS,
michael@0 908 "PKCS #12 Enveloping IDs",
michael@0 909 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 910 OD( pkcs12PKCS8KeyShrouding, SEC_OID_PKCS12_PKCS8_KEY_SHROUDING,
michael@0 911 "PKCS #12 Key Shrouding",
michael@0 912 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 913 OD( pkcs12KeyBagID, SEC_OID_PKCS12_KEY_BAG_ID,
michael@0 914 "PKCS #12 Key Bag ID",
michael@0 915 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 916 OD( pkcs12CertAndCRLBagID, SEC_OID_PKCS12_CERT_AND_CRL_BAG_ID,
michael@0 917 "PKCS #12 Cert And CRL Bag ID",
michael@0 918 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 919 OD( pkcs12SecretBagID, SEC_OID_PKCS12_SECRET_BAG_ID,
michael@0 920 "PKCS #12 Secret Bag ID",
michael@0 921 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 922 OD( pkcs12X509CertCRLBag, SEC_OID_PKCS12_X509_CERT_CRL_BAG,
michael@0 923 "PKCS #12 X509 Cert CRL Bag",
michael@0 924 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 925 OD( pkcs12SDSICertBag, SEC_OID_PKCS12_SDSI_CERT_BAG,
michael@0 926 "PKCS #12 SDSI Cert Bag",
michael@0 927 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 928 OD( pkcs12PBEWithSha1And128BitRC4,
michael@0 929 SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4,
michael@0 930 "PKCS #12 PBE With SHA-1 and 128 Bit RC4",
michael@0 931 CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4, INVALID_CERT_EXTENSION ),
michael@0 932 OD( pkcs12PBEWithSha1And40BitRC4,
michael@0 933 SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4,
michael@0 934 "PKCS #12 PBE With SHA-1 and 40 Bit RC4",
michael@0 935 CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4, INVALID_CERT_EXTENSION ),
michael@0 936 OD( pkcs12PBEWithSha1AndTripleDESCBC,
michael@0 937 SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC,
michael@0 938 "PKCS #12 PBE With SHA-1 and Triple DES-CBC",
michael@0 939 CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC, INVALID_CERT_EXTENSION ),
michael@0 940 OD( pkcs12PBEWithSha1And128BitRC2CBC,
michael@0 941 SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC,
michael@0 942 "PKCS #12 PBE With SHA-1 and 128 Bit RC2 CBC",
michael@0 943 CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC, INVALID_CERT_EXTENSION ),
michael@0 944 OD( pkcs12PBEWithSha1And40BitRC2CBC,
michael@0 945 SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC,
michael@0 946 "PKCS #12 PBE With SHA-1 and 40 Bit RC2 CBC",
michael@0 947 CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC, INVALID_CERT_EXTENSION ),
michael@0 948 OD( pkcs12RSAEncryptionWith128BitRC4,
michael@0 949 SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_128_BIT_RC4,
michael@0 950 "PKCS #12 RSA Encryption with 128 Bit RC4",
michael@0 951 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 952 OD( pkcs12RSAEncryptionWith40BitRC4,
michael@0 953 SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_40_BIT_RC4,
michael@0 954 "PKCS #12 RSA Encryption with 40 Bit RC4",
michael@0 955 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 956 OD( pkcs12RSAEncryptionWithTripleDES,
michael@0 957 SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_TRIPLE_DES,
michael@0 958 "PKCS #12 RSA Encryption with Triple DES",
michael@0 959 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 960 OD( pkcs12RSASignatureWithSHA1Digest,
michael@0 961 SEC_OID_PKCS12_RSA_SIGNATURE_WITH_SHA1_DIGEST,
michael@0 962 "PKCS #12 RSA Encryption with Triple DES",
michael@0 963 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 964
michael@0 965 /* DSA signatures */
michael@0 966 OD( ansix9DSASignature, SEC_OID_ANSIX9_DSA_SIGNATURE,
michael@0 967 "ANSI X9.57 DSA Signature", CKM_DSA, INVALID_CERT_EXTENSION ),
michael@0 968 OD( ansix9DSASignaturewithSHA1Digest,
michael@0 969 SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST,
michael@0 970 "ANSI X9.57 DSA Signature with SHA-1 Digest",
michael@0 971 CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),
michael@0 972 OD( bogusDSASignaturewithSHA1Digest,
michael@0 973 SEC_OID_BOGUS_DSA_SIGNATURE_WITH_SHA1_DIGEST,
michael@0 974 "FORTEZZA DSA Signature with SHA-1 Digest",
michael@0 975 CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),
michael@0 976
michael@0 977 /* verisign oids */
michael@0 978 OD( verisignUserNotices, SEC_OID_VERISIGN_USER_NOTICES,
michael@0 979 "Verisign User Notices",
michael@0 980 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 981
michael@0 982 /* pkix oids */
michael@0 983 OD( pkixCPSPointerQualifier, SEC_OID_PKIX_CPS_POINTER_QUALIFIER,
michael@0 984 "PKIX CPS Pointer Qualifier",
michael@0 985 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 986 OD( pkixUserNoticeQualifier, SEC_OID_PKIX_USER_NOTICE_QUALIFIER,
michael@0 987 "PKIX User Notice Qualifier",
michael@0 988 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 989
michael@0 990 OD( pkixOCSP, SEC_OID_PKIX_OCSP,
michael@0 991 "PKIX Online Certificate Status Protocol",
michael@0 992 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 993 OD( pkixOCSPBasicResponse, SEC_OID_PKIX_OCSP_BASIC_RESPONSE,
michael@0 994 "OCSP Basic Response", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 995 OD( pkixOCSPNonce, SEC_OID_PKIX_OCSP_NONCE,
michael@0 996 "OCSP Nonce Extension", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 997 OD( pkixOCSPCRL, SEC_OID_PKIX_OCSP_CRL,
michael@0 998 "OCSP CRL Reference Extension",
michael@0 999 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1000 OD( pkixOCSPResponse, SEC_OID_PKIX_OCSP_RESPONSE,
michael@0 1001 "OCSP Response Types Extension",
michael@0 1002 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1003 OD( pkixOCSPNoCheck, SEC_OID_PKIX_OCSP_NO_CHECK,
michael@0 1004 "OCSP No Check Extension",
michael@0 1005 CKM_INVALID_MECHANISM, SUPPORTED_CERT_EXTENSION ),
michael@0 1006 OD( pkixOCSPArchiveCutoff, SEC_OID_PKIX_OCSP_ARCHIVE_CUTOFF,
michael@0 1007 "OCSP Archive Cutoff Extension",
michael@0 1008 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1009 OD( pkixOCSPServiceLocator, SEC_OID_PKIX_OCSP_SERVICE_LOCATOR,
michael@0 1010 "OCSP Service Locator Extension",
michael@0 1011 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1012
michael@0 1013 OD( pkixRegCtrlRegToken, SEC_OID_PKIX_REGCTRL_REGTOKEN,
michael@0 1014 "PKIX CRMF Registration Control, Registration Token",
michael@0 1015 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1016 OD( pkixRegCtrlAuthenticator, SEC_OID_PKIX_REGCTRL_AUTHENTICATOR,
michael@0 1017 "PKIX CRMF Registration Control, Registration Authenticator",
michael@0 1018 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1019 OD( pkixRegCtrlPKIPubInfo, SEC_OID_PKIX_REGCTRL_PKIPUBINFO,
michael@0 1020 "PKIX CRMF Registration Control, PKI Publication Info",
michael@0 1021 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1022 OD( pkixRegCtrlPKIArchOptions,
michael@0 1023 SEC_OID_PKIX_REGCTRL_PKI_ARCH_OPTIONS,
michael@0 1024 "PKIX CRMF Registration Control, PKI Archive Options",
michael@0 1025 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1026 OD( pkixRegCtrlOldCertID, SEC_OID_PKIX_REGCTRL_OLD_CERT_ID,
michael@0 1027 "PKIX CRMF Registration Control, Old Certificate ID",
michael@0 1028 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1029 OD( pkixRegCtrlProtEncKey, SEC_OID_PKIX_REGCTRL_PROTOCOL_ENC_KEY,
michael@0 1030 "PKIX CRMF Registration Control, Protocol Encryption Key",
michael@0 1031 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1032 OD( pkixRegInfoUTF8Pairs, SEC_OID_PKIX_REGINFO_UTF8_PAIRS,
michael@0 1033 "PKIX CRMF Registration Info, UTF8 Pairs",
michael@0 1034 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1035 OD( pkixRegInfoCertReq, SEC_OID_PKIX_REGINFO_CERT_REQUEST,
michael@0 1036 "PKIX CRMF Registration Info, Certificate Request",
michael@0 1037 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1038 OD( pkixExtendedKeyUsageServerAuth,
michael@0 1039 SEC_OID_EXT_KEY_USAGE_SERVER_AUTH,
michael@0 1040 "TLS Web Server Authentication Certificate",
michael@0 1041 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1042 OD( pkixExtendedKeyUsageClientAuth,
michael@0 1043 SEC_OID_EXT_KEY_USAGE_CLIENT_AUTH,
michael@0 1044 "TLS Web Client Authentication Certificate",
michael@0 1045 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1046 OD( pkixExtendedKeyUsageCodeSign, SEC_OID_EXT_KEY_USAGE_CODE_SIGN,
michael@0 1047 "Code Signing Certificate",
michael@0 1048 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1049 OD( pkixExtendedKeyUsageEMailProtect,
michael@0 1050 SEC_OID_EXT_KEY_USAGE_EMAIL_PROTECT,
michael@0 1051 "E-Mail Protection Certificate",
michael@0 1052 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1053 OD( pkixExtendedKeyUsageTimeStamp,
michael@0 1054 SEC_OID_EXT_KEY_USAGE_TIME_STAMP,
michael@0 1055 "Time Stamping Certifcate",
michael@0 1056 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1057 OD( pkixOCSPResponderExtendedKeyUsage, SEC_OID_OCSP_RESPONDER,
michael@0 1058 "OCSP Responder Certificate",
michael@0 1059 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
michael@0 1060
michael@0 1061 /* Netscape Algorithm OIDs */
michael@0 1062
michael@0 1063 OD( netscapeSMimeKEA, SEC_OID_NETSCAPE_SMIME_KEA,
michael@0 1064 "Netscape S/MIME KEA", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1065
michael@0 1066 /* Skipjack OID -- ### mwelch temporary */
michael@0 1067 OD( skipjackCBC, SEC_OID_FORTEZZA_SKIPJACK,
michael@0 1068 "Skipjack CBC64", CKM_SKIPJACK_CBC64, INVALID_CERT_EXTENSION ),
michael@0 1069
michael@0 1070 /* pkcs12 v2 oids */
michael@0 1071 OD( pkcs12V2PBEWithSha1And128BitRC4,
michael@0 1072 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC4,
michael@0 1073 "PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4",
michael@0 1074 CKM_PBE_SHA1_RC4_128, INVALID_CERT_EXTENSION ),
michael@0 1075 OD( pkcs12V2PBEWithSha1And40BitRC4,
michael@0 1076 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC4,
michael@0 1077 "PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4",
michael@0 1078 CKM_PBE_SHA1_RC4_40, INVALID_CERT_EXTENSION ),
michael@0 1079 OD( pkcs12V2PBEWithSha1And3KeyTripleDEScbc,
michael@0 1080 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC,
michael@0 1081 "PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC",
michael@0 1082 CKM_PBE_SHA1_DES3_EDE_CBC, INVALID_CERT_EXTENSION ),
michael@0 1083 OD( pkcs12V2PBEWithSha1And2KeyTripleDEScbc,
michael@0 1084 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_2KEY_TRIPLE_DES_CBC,
michael@0 1085 "PKCS #12 V2 PBE With SHA-1 And 2KEY Triple DES-CBC",
michael@0 1086 CKM_PBE_SHA1_DES2_EDE_CBC, INVALID_CERT_EXTENSION ),
michael@0 1087 OD( pkcs12V2PBEWithSha1And128BitRC2cbc,
michael@0 1088 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC,
michael@0 1089 "PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC",
michael@0 1090 CKM_PBE_SHA1_RC2_128_CBC, INVALID_CERT_EXTENSION ),
michael@0 1091 OD( pkcs12V2PBEWithSha1And40BitRC2cbc,
michael@0 1092 SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC,
michael@0 1093 "PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC",
michael@0 1094 CKM_PBE_SHA1_RC2_40_CBC, INVALID_CERT_EXTENSION ),
michael@0 1095 OD( pkcs12SafeContentsID, SEC_OID_PKCS12_SAFE_CONTENTS_ID,
michael@0 1096 "PKCS #12 Safe Contents ID",
michael@0 1097 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1098 OD( pkcs12PKCS8ShroudedKeyBagID,
michael@0 1099 SEC_OID_PKCS12_PKCS8_SHROUDED_KEY_BAG_ID,
michael@0 1100 "PKCS #12 Safe Contents ID",
michael@0 1101 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1102 OD( pkcs12V1KeyBag, SEC_OID_PKCS12_V1_KEY_BAG_ID,
michael@0 1103 "PKCS #12 V1 Key Bag",
michael@0 1104 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1105 OD( pkcs12V1PKCS8ShroudedKeyBag,
michael@0 1106 SEC_OID_PKCS12_V1_PKCS8_SHROUDED_KEY_BAG_ID,
michael@0 1107 "PKCS #12 V1 PKCS8 Shrouded Key Bag",
michael@0 1108 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1109 OD( pkcs12V1CertBag, SEC_OID_PKCS12_V1_CERT_BAG_ID,
michael@0 1110 "PKCS #12 V1 Cert Bag",
michael@0 1111 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1112 OD( pkcs12V1CRLBag, SEC_OID_PKCS12_V1_CRL_BAG_ID,
michael@0 1113 "PKCS #12 V1 CRL Bag",
michael@0 1114 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1115 OD( pkcs12V1SecretBag, SEC_OID_PKCS12_V1_SECRET_BAG_ID,
michael@0 1116 "PKCS #12 V1 Secret Bag",
michael@0 1117 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1118 OD( pkcs12V1SafeContentsBag, SEC_OID_PKCS12_V1_SAFE_CONTENTS_BAG_ID,
michael@0 1119 "PKCS #12 V1 Safe Contents Bag",
michael@0 1120 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1121
michael@0 1122 OD( pkcs9X509Certificate, SEC_OID_PKCS9_X509_CERT,
michael@0 1123 "PKCS #9 X509 Certificate",
michael@0 1124 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1125 OD( pkcs9SDSICertificate, SEC_OID_PKCS9_SDSI_CERT,
michael@0 1126 "PKCS #9 SDSI Certificate",
michael@0 1127 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1128 OD( pkcs9X509CRL, SEC_OID_PKCS9_X509_CRL,
michael@0 1129 "PKCS #9 X509 CRL", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1130 OD( pkcs9FriendlyName, SEC_OID_PKCS9_FRIENDLY_NAME,
michael@0 1131 "PKCS #9 Friendly Name",
michael@0 1132 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1133 OD( pkcs9LocalKeyID, SEC_OID_PKCS9_LOCAL_KEY_ID,
michael@0 1134 "PKCS #9 Local Key ID",
michael@0 1135 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1136 OD( pkcs12KeyUsageAttr, SEC_OID_BOGUS_KEY_USAGE,
michael@0 1137 "Bogus Key Usage", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1138 OD( dhPublicKey, SEC_OID_X942_DIFFIE_HELMAN_KEY,
michael@0 1139 "Diffie-Helman Public Key", CKM_DH_PKCS_DERIVE,
michael@0 1140 INVALID_CERT_EXTENSION ),
michael@0 1141 OD( netscapeNickname, SEC_OID_NETSCAPE_NICKNAME,
michael@0 1142 "Netscape Nickname", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1143
michael@0 1144 /* Cert Server specific OIDs */
michael@0 1145 OD( netscapeRecoveryRequest, SEC_OID_NETSCAPE_RECOVERY_REQUEST,
michael@0 1146 "Recovery Request OID",
michael@0 1147 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1148
michael@0 1149 OD( nsExtAIACertRenewal, SEC_OID_CERT_RENEWAL_LOCATOR,
michael@0 1150 "Certificate Renewal Locator OID", CKM_INVALID_MECHANISM,
michael@0 1151 INVALID_CERT_EXTENSION ),
michael@0 1152
michael@0 1153 OD( nsExtCertScopeOfUse, SEC_OID_NS_CERT_EXT_SCOPE_OF_USE,
michael@0 1154 "Certificate Scope-of-Use Extension", CKM_INVALID_MECHANISM,
michael@0 1155 SUPPORTED_CERT_EXTENSION ),
michael@0 1156
michael@0 1157 /* CMS stuff */
michael@0 1158 OD( cmsESDH, SEC_OID_CMS_EPHEMERAL_STATIC_DIFFIE_HELLMAN,
michael@0 1159 "Ephemeral-Static Diffie-Hellman", CKM_INVALID_MECHANISM /* XXX */,
michael@0 1160 INVALID_CERT_EXTENSION ),
michael@0 1161 OD( cms3DESwrap, SEC_OID_CMS_3DES_KEY_WRAP,
michael@0 1162 "CMS Triple DES Key Wrap", CKM_INVALID_MECHANISM /* XXX */,
michael@0 1163 INVALID_CERT_EXTENSION ),
michael@0 1164 OD( cmsRC2wrap, SEC_OID_CMS_RC2_KEY_WRAP,
michael@0 1165 "CMS RC2 Key Wrap", CKM_INVALID_MECHANISM /* XXX */,
michael@0 1166 INVALID_CERT_EXTENSION ),
michael@0 1167 OD( smimeEncryptionKeyPreference, SEC_OID_SMIME_ENCRYPTION_KEY_PREFERENCE,
michael@0 1168 "S/MIME Encryption Key Preference",
michael@0 1169 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1170
michael@0 1171 /* AES algorithm OIDs */
michael@0 1172 OD( aes128_ECB, SEC_OID_AES_128_ECB,
michael@0 1173 "AES-128-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),
michael@0 1174 OD( aes128_CBC, SEC_OID_AES_128_CBC,
michael@0 1175 "AES-128-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),
michael@0 1176 OD( aes192_ECB, SEC_OID_AES_192_ECB,
michael@0 1177 "AES-192-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),
michael@0 1178 OD( aes192_CBC, SEC_OID_AES_192_CBC,
michael@0 1179 "AES-192-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),
michael@0 1180 OD( aes256_ECB, SEC_OID_AES_256_ECB,
michael@0 1181 "AES-256-ECB", CKM_AES_ECB, INVALID_CERT_EXTENSION ),
michael@0 1182 OD( aes256_CBC, SEC_OID_AES_256_CBC,
michael@0 1183 "AES-256-CBC", CKM_AES_CBC, INVALID_CERT_EXTENSION ),
michael@0 1184
michael@0 1185 /* More bogus DSA OIDs */
michael@0 1186 OD( sdn702DSASignature, SEC_OID_SDN702_DSA_SIGNATURE,
michael@0 1187 "SDN.702 DSA Signature", CKM_DSA_SHA1, INVALID_CERT_EXTENSION ),
michael@0 1188
michael@0 1189 OD( ms_smimeEncryptionKeyPreference,
michael@0 1190 SEC_OID_MS_SMIME_ENCRYPTION_KEY_PREFERENCE,
michael@0 1191 "Microsoft S/MIME Encryption Key Preference",
michael@0 1192 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1193
michael@0 1194 OD( sha256, SEC_OID_SHA256, "SHA-256", CKM_SHA256, INVALID_CERT_EXTENSION),
michael@0 1195 OD( sha384, SEC_OID_SHA384, "SHA-384", CKM_SHA384, INVALID_CERT_EXTENSION),
michael@0 1196 OD( sha512, SEC_OID_SHA512, "SHA-512", CKM_SHA512, INVALID_CERT_EXTENSION),
michael@0 1197
michael@0 1198 OD( pkcs1SHA256WithRSAEncryption, SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,
michael@0 1199 "PKCS #1 SHA-256 With RSA Encryption", CKM_SHA256_RSA_PKCS,
michael@0 1200 INVALID_CERT_EXTENSION ),
michael@0 1201 OD( pkcs1SHA384WithRSAEncryption, SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION,
michael@0 1202 "PKCS #1 SHA-384 With RSA Encryption", CKM_SHA384_RSA_PKCS,
michael@0 1203 INVALID_CERT_EXTENSION ),
michael@0 1204 OD( pkcs1SHA512WithRSAEncryption, SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION,
michael@0 1205 "PKCS #1 SHA-512 With RSA Encryption", CKM_SHA512_RSA_PKCS,
michael@0 1206 INVALID_CERT_EXTENSION ),
michael@0 1207
michael@0 1208 OD( aes128_KEY_WRAP, SEC_OID_AES_128_KEY_WRAP,
michael@0 1209 "AES-128 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),
michael@0 1210 OD( aes192_KEY_WRAP, SEC_OID_AES_192_KEY_WRAP,
michael@0 1211 "AES-192 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),
michael@0 1212 OD( aes256_KEY_WRAP, SEC_OID_AES_256_KEY_WRAP,
michael@0 1213 "AES-256 Key Wrap", CKM_NSS_AES_KEY_WRAP, INVALID_CERT_EXTENSION),
michael@0 1214
michael@0 1215 /* Elliptic Curve Cryptography (ECC) OIDs */
michael@0 1216 OD( ansix962ECPublicKey, SEC_OID_ANSIX962_EC_PUBLIC_KEY,
michael@0 1217 "X9.62 elliptic curve public key", CKM_ECDH1_DERIVE,
michael@0 1218 INVALID_CERT_EXTENSION ),
michael@0 1219 OD( ansix962SignaturewithSHA1Digest,
michael@0 1220 SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE,
michael@0 1221 "X9.62 ECDSA signature with SHA-1", CKM_ECDSA_SHA1,
michael@0 1222 INVALID_CERT_EXTENSION ),
michael@0 1223
michael@0 1224 /* Named curves */
michael@0 1225
michael@0 1226 /* ANSI X9.62 named elliptic curves (prime field) */
michael@0 1227 OD( ansiX962prime192v1, SEC_OID_ANSIX962_EC_PRIME192V1,
michael@0 1228 "ANSI X9.62 elliptic curve prime192v1 (aka secp192r1, NIST P-192)",
michael@0 1229 CKM_INVALID_MECHANISM,
michael@0 1230 INVALID_CERT_EXTENSION ),
michael@0 1231 OD( ansiX962prime192v2, SEC_OID_ANSIX962_EC_PRIME192V2,
michael@0 1232 "ANSI X9.62 elliptic curve prime192v2",
michael@0 1233 CKM_INVALID_MECHANISM,
michael@0 1234 INVALID_CERT_EXTENSION ),
michael@0 1235 OD( ansiX962prime192v3, SEC_OID_ANSIX962_EC_PRIME192V3,
michael@0 1236 "ANSI X9.62 elliptic curve prime192v3",
michael@0 1237 CKM_INVALID_MECHANISM,
michael@0 1238 INVALID_CERT_EXTENSION ),
michael@0 1239 OD( ansiX962prime239v1, SEC_OID_ANSIX962_EC_PRIME239V1,
michael@0 1240 "ANSI X9.62 elliptic curve prime239v1",
michael@0 1241 CKM_INVALID_MECHANISM,
michael@0 1242 INVALID_CERT_EXTENSION ),
michael@0 1243 OD( ansiX962prime239v2, SEC_OID_ANSIX962_EC_PRIME239V2,
michael@0 1244 "ANSI X9.62 elliptic curve prime239v2",
michael@0 1245 CKM_INVALID_MECHANISM,
michael@0 1246 INVALID_CERT_EXTENSION ),
michael@0 1247 OD( ansiX962prime239v3, SEC_OID_ANSIX962_EC_PRIME239V3,
michael@0 1248 "ANSI X9.62 elliptic curve prime239v3",
michael@0 1249 CKM_INVALID_MECHANISM,
michael@0 1250 INVALID_CERT_EXTENSION ),
michael@0 1251 OD( ansiX962prime256v1, SEC_OID_ANSIX962_EC_PRIME256V1,
michael@0 1252 "ANSI X9.62 elliptic curve prime256v1 (aka secp256r1, NIST P-256)",
michael@0 1253 CKM_INVALID_MECHANISM,
michael@0 1254 INVALID_CERT_EXTENSION ),
michael@0 1255
michael@0 1256 /* SECG named elliptic curves (prime field) */
michael@0 1257 OD( secgECsecp112r1, SEC_OID_SECG_EC_SECP112R1,
michael@0 1258 "SECG elliptic curve secp112r1",
michael@0 1259 CKM_INVALID_MECHANISM,
michael@0 1260 INVALID_CERT_EXTENSION ),
michael@0 1261 OD( secgECsecp112r2, SEC_OID_SECG_EC_SECP112R2,
michael@0 1262 "SECG elliptic curve secp112r2",
michael@0 1263 CKM_INVALID_MECHANISM,
michael@0 1264 INVALID_CERT_EXTENSION ),
michael@0 1265 OD( secgECsecp128r1, SEC_OID_SECG_EC_SECP128R1,
michael@0 1266 "SECG elliptic curve secp128r1",
michael@0 1267 CKM_INVALID_MECHANISM,
michael@0 1268 INVALID_CERT_EXTENSION ),
michael@0 1269 OD( secgECsecp128r2, SEC_OID_SECG_EC_SECP128R2,
michael@0 1270 "SECG elliptic curve secp128r2",
michael@0 1271 CKM_INVALID_MECHANISM,
michael@0 1272 INVALID_CERT_EXTENSION ),
michael@0 1273 OD( secgECsecp160k1, SEC_OID_SECG_EC_SECP160K1,
michael@0 1274 "SECG elliptic curve secp160k1",
michael@0 1275 CKM_INVALID_MECHANISM,
michael@0 1276 INVALID_CERT_EXTENSION ),
michael@0 1277 OD( secgECsecp160r1, SEC_OID_SECG_EC_SECP160R1,
michael@0 1278 "SECG elliptic curve secp160r1",
michael@0 1279 CKM_INVALID_MECHANISM,
michael@0 1280 INVALID_CERT_EXTENSION ),
michael@0 1281 OD( secgECsecp160r2, SEC_OID_SECG_EC_SECP160R2,
michael@0 1282 "SECG elliptic curve secp160r2",
michael@0 1283 CKM_INVALID_MECHANISM,
michael@0 1284 INVALID_CERT_EXTENSION ),
michael@0 1285 OD( secgECsecp192k1, SEC_OID_SECG_EC_SECP192K1,
michael@0 1286 "SECG elliptic curve secp192k1",
michael@0 1287 CKM_INVALID_MECHANISM,
michael@0 1288 INVALID_CERT_EXTENSION ),
michael@0 1289 OD( secgECsecp224k1, SEC_OID_SECG_EC_SECP224K1,
michael@0 1290 "SECG elliptic curve secp224k1",
michael@0 1291 CKM_INVALID_MECHANISM,
michael@0 1292 INVALID_CERT_EXTENSION ),
michael@0 1293 OD( secgECsecp224r1, SEC_OID_SECG_EC_SECP224R1,
michael@0 1294 "SECG elliptic curve secp224r1 (aka NIST P-224)",
michael@0 1295 CKM_INVALID_MECHANISM,
michael@0 1296 INVALID_CERT_EXTENSION ),
michael@0 1297 OD( secgECsecp256k1, SEC_OID_SECG_EC_SECP256K1,
michael@0 1298 "SECG elliptic curve secp256k1",
michael@0 1299 CKM_INVALID_MECHANISM,
michael@0 1300 INVALID_CERT_EXTENSION ),
michael@0 1301 OD( secgECsecp384r1, SEC_OID_SECG_EC_SECP384R1,
michael@0 1302 "SECG elliptic curve secp384r1 (aka NIST P-384)",
michael@0 1303 CKM_INVALID_MECHANISM,
michael@0 1304 INVALID_CERT_EXTENSION ),
michael@0 1305 OD( secgECsecp521r1, SEC_OID_SECG_EC_SECP521R1,
michael@0 1306 "SECG elliptic curve secp521r1 (aka NIST P-521)",
michael@0 1307 CKM_INVALID_MECHANISM,
michael@0 1308 INVALID_CERT_EXTENSION ),
michael@0 1309
michael@0 1310 /* ANSI X9.62 named elliptic curves (characteristic two field) */
michael@0 1311 OD( ansiX962c2pnb163v1, SEC_OID_ANSIX962_EC_C2PNB163V1,
michael@0 1312 "ANSI X9.62 elliptic curve c2pnb163v1",
michael@0 1313 CKM_INVALID_MECHANISM,
michael@0 1314 INVALID_CERT_EXTENSION ),
michael@0 1315 OD( ansiX962c2pnb163v2, SEC_OID_ANSIX962_EC_C2PNB163V2,
michael@0 1316 "ANSI X9.62 elliptic curve c2pnb163v2",
michael@0 1317 CKM_INVALID_MECHANISM,
michael@0 1318 INVALID_CERT_EXTENSION ),
michael@0 1319 OD( ansiX962c2pnb163v3, SEC_OID_ANSIX962_EC_C2PNB163V3,
michael@0 1320 "ANSI X9.62 elliptic curve c2pnb163v3",
michael@0 1321 CKM_INVALID_MECHANISM,
michael@0 1322 INVALID_CERT_EXTENSION ),
michael@0 1323 OD( ansiX962c2pnb176v1, SEC_OID_ANSIX962_EC_C2PNB176V1,
michael@0 1324 "ANSI X9.62 elliptic curve c2pnb176v1",
michael@0 1325 CKM_INVALID_MECHANISM,
michael@0 1326 INVALID_CERT_EXTENSION ),
michael@0 1327 OD( ansiX962c2tnb191v1, SEC_OID_ANSIX962_EC_C2TNB191V1,
michael@0 1328 "ANSI X9.62 elliptic curve c2tnb191v1",
michael@0 1329 CKM_INVALID_MECHANISM,
michael@0 1330 INVALID_CERT_EXTENSION ),
michael@0 1331 OD( ansiX962c2tnb191v2, SEC_OID_ANSIX962_EC_C2TNB191V2,
michael@0 1332 "ANSI X9.62 elliptic curve c2tnb191v2",
michael@0 1333 CKM_INVALID_MECHANISM,
michael@0 1334 INVALID_CERT_EXTENSION ),
michael@0 1335 OD( ansiX962c2tnb191v3, SEC_OID_ANSIX962_EC_C2TNB191V3,
michael@0 1336 "ANSI X9.62 elliptic curve c2tnb191v3",
michael@0 1337 CKM_INVALID_MECHANISM,
michael@0 1338 INVALID_CERT_EXTENSION ),
michael@0 1339 OD( ansiX962c2onb191v4, SEC_OID_ANSIX962_EC_C2ONB191V4,
michael@0 1340 "ANSI X9.62 elliptic curve c2onb191v4",
michael@0 1341 CKM_INVALID_MECHANISM,
michael@0 1342 INVALID_CERT_EXTENSION ),
michael@0 1343 OD( ansiX962c2onb191v5, SEC_OID_ANSIX962_EC_C2ONB191V5,
michael@0 1344 "ANSI X9.62 elliptic curve c2onb191v5",
michael@0 1345 CKM_INVALID_MECHANISM,
michael@0 1346 INVALID_CERT_EXTENSION ),
michael@0 1347 OD( ansiX962c2pnb208w1, SEC_OID_ANSIX962_EC_C2PNB208W1,
michael@0 1348 "ANSI X9.62 elliptic curve c2pnb208w1",
michael@0 1349 CKM_INVALID_MECHANISM,
michael@0 1350 INVALID_CERT_EXTENSION ),
michael@0 1351 OD( ansiX962c2tnb239v1, SEC_OID_ANSIX962_EC_C2TNB239V1,
michael@0 1352 "ANSI X9.62 elliptic curve c2tnb239v1",
michael@0 1353 CKM_INVALID_MECHANISM,
michael@0 1354 INVALID_CERT_EXTENSION ),
michael@0 1355 OD( ansiX962c2tnb239v2, SEC_OID_ANSIX962_EC_C2TNB239V2,
michael@0 1356 "ANSI X9.62 elliptic curve c2tnb239v2",
michael@0 1357 CKM_INVALID_MECHANISM,
michael@0 1358 INVALID_CERT_EXTENSION ),
michael@0 1359 OD( ansiX962c2tnb239v3, SEC_OID_ANSIX962_EC_C2TNB239V3,
michael@0 1360 "ANSI X9.62 elliptic curve c2tnb239v3",
michael@0 1361 CKM_INVALID_MECHANISM,
michael@0 1362 INVALID_CERT_EXTENSION ),
michael@0 1363 OD( ansiX962c2onb239v4, SEC_OID_ANSIX962_EC_C2ONB239V4,
michael@0 1364 "ANSI X9.62 elliptic curve c2onb239v4",
michael@0 1365 CKM_INVALID_MECHANISM,
michael@0 1366 INVALID_CERT_EXTENSION ),
michael@0 1367 OD( ansiX962c2onb239v5, SEC_OID_ANSIX962_EC_C2ONB239V5,
michael@0 1368 "ANSI X9.62 elliptic curve c2onb239v5",
michael@0 1369 CKM_INVALID_MECHANISM,
michael@0 1370 INVALID_CERT_EXTENSION ),
michael@0 1371 OD( ansiX962c2pnb272w1, SEC_OID_ANSIX962_EC_C2PNB272W1,
michael@0 1372 "ANSI X9.62 elliptic curve c2pnb272w1",
michael@0 1373 CKM_INVALID_MECHANISM,
michael@0 1374 INVALID_CERT_EXTENSION ),
michael@0 1375 OD( ansiX962c2pnb304w1, SEC_OID_ANSIX962_EC_C2PNB304W1,
michael@0 1376 "ANSI X9.62 elliptic curve c2pnb304w1",
michael@0 1377 CKM_INVALID_MECHANISM,
michael@0 1378 INVALID_CERT_EXTENSION ),
michael@0 1379 OD( ansiX962c2tnb359v1, SEC_OID_ANSIX962_EC_C2TNB359V1,
michael@0 1380 "ANSI X9.62 elliptic curve c2tnb359v1",
michael@0 1381 CKM_INVALID_MECHANISM,
michael@0 1382 INVALID_CERT_EXTENSION ),
michael@0 1383 OD( ansiX962c2pnb368w1, SEC_OID_ANSIX962_EC_C2PNB368W1,
michael@0 1384 "ANSI X9.62 elliptic curve c2pnb368w1",
michael@0 1385 CKM_INVALID_MECHANISM,
michael@0 1386 INVALID_CERT_EXTENSION ),
michael@0 1387 OD( ansiX962c2tnb431r1, SEC_OID_ANSIX962_EC_C2TNB431R1,
michael@0 1388 "ANSI X9.62 elliptic curve c2tnb431r1",
michael@0 1389 CKM_INVALID_MECHANISM,
michael@0 1390 INVALID_CERT_EXTENSION ),
michael@0 1391
michael@0 1392 /* SECG named elliptic curves (characterisitic two field) */
michael@0 1393 OD( secgECsect113r1, SEC_OID_SECG_EC_SECT113R1,
michael@0 1394 "SECG elliptic curve sect113r1",
michael@0 1395 CKM_INVALID_MECHANISM,
michael@0 1396 INVALID_CERT_EXTENSION ),
michael@0 1397 OD( secgECsect113r2, SEC_OID_SECG_EC_SECT113R2,
michael@0 1398 "SECG elliptic curve sect113r2",
michael@0 1399 CKM_INVALID_MECHANISM,
michael@0 1400 INVALID_CERT_EXTENSION ),
michael@0 1401 OD( secgECsect131r1, SEC_OID_SECG_EC_SECT131R1,
michael@0 1402 "SECG elliptic curve sect131r1",
michael@0 1403 CKM_INVALID_MECHANISM,
michael@0 1404 INVALID_CERT_EXTENSION ),
michael@0 1405 OD( secgECsect131r2, SEC_OID_SECG_EC_SECT131R2,
michael@0 1406 "SECG elliptic curve sect131r2",
michael@0 1407 CKM_INVALID_MECHANISM,
michael@0 1408 INVALID_CERT_EXTENSION ),
michael@0 1409 OD( secgECsect163k1, SEC_OID_SECG_EC_SECT163K1,
michael@0 1410 "SECG elliptic curve sect163k1 (aka NIST K-163)",
michael@0 1411 CKM_INVALID_MECHANISM,
michael@0 1412 INVALID_CERT_EXTENSION ),
michael@0 1413 OD( secgECsect163r1, SEC_OID_SECG_EC_SECT163R1,
michael@0 1414 "SECG elliptic curve sect163r1",
michael@0 1415 CKM_INVALID_MECHANISM,
michael@0 1416 INVALID_CERT_EXTENSION ),
michael@0 1417 OD( secgECsect163r2, SEC_OID_SECG_EC_SECT163R2,
michael@0 1418 "SECG elliptic curve sect163r2 (aka NIST B-163)",
michael@0 1419 CKM_INVALID_MECHANISM,
michael@0 1420 INVALID_CERT_EXTENSION ),
michael@0 1421 OD( secgECsect193r1, SEC_OID_SECG_EC_SECT193R1,
michael@0 1422 "SECG elliptic curve sect193r1",
michael@0 1423 CKM_INVALID_MECHANISM,
michael@0 1424 INVALID_CERT_EXTENSION ),
michael@0 1425 OD( secgECsect193r2, SEC_OID_SECG_EC_SECT193R2,
michael@0 1426 "SECG elliptic curve sect193r2",
michael@0 1427 CKM_INVALID_MECHANISM,
michael@0 1428 INVALID_CERT_EXTENSION ),
michael@0 1429 OD( secgECsect233k1, SEC_OID_SECG_EC_SECT233K1,
michael@0 1430 "SECG elliptic curve sect233k1 (aka NIST K-233)",
michael@0 1431 CKM_INVALID_MECHANISM,
michael@0 1432 INVALID_CERT_EXTENSION ),
michael@0 1433 OD( secgECsect233r1, SEC_OID_SECG_EC_SECT233R1,
michael@0 1434 "SECG elliptic curve sect233r1 (aka NIST B-233)",
michael@0 1435 CKM_INVALID_MECHANISM,
michael@0 1436 INVALID_CERT_EXTENSION ),
michael@0 1437 OD( secgECsect239k1, SEC_OID_SECG_EC_SECT239K1,
michael@0 1438 "SECG elliptic curve sect239k1",
michael@0 1439 CKM_INVALID_MECHANISM,
michael@0 1440 INVALID_CERT_EXTENSION ),
michael@0 1441 OD( secgECsect283k1, SEC_OID_SECG_EC_SECT283K1,
michael@0 1442 "SECG elliptic curve sect283k1 (aka NIST K-283)",
michael@0 1443 CKM_INVALID_MECHANISM,
michael@0 1444 INVALID_CERT_EXTENSION ),
michael@0 1445 OD( secgECsect283r1, SEC_OID_SECG_EC_SECT283R1,
michael@0 1446 "SECG elliptic curve sect283r1 (aka NIST B-283)",
michael@0 1447 CKM_INVALID_MECHANISM,
michael@0 1448 INVALID_CERT_EXTENSION ),
michael@0 1449 OD( secgECsect409k1, SEC_OID_SECG_EC_SECT409K1,
michael@0 1450 "SECG elliptic curve sect409k1 (aka NIST K-409)",
michael@0 1451 CKM_INVALID_MECHANISM,
michael@0 1452 INVALID_CERT_EXTENSION ),
michael@0 1453 OD( secgECsect409r1, SEC_OID_SECG_EC_SECT409R1,
michael@0 1454 "SECG elliptic curve sect409r1 (aka NIST B-409)",
michael@0 1455 CKM_INVALID_MECHANISM,
michael@0 1456 INVALID_CERT_EXTENSION ),
michael@0 1457 OD( secgECsect571k1, SEC_OID_SECG_EC_SECT571K1,
michael@0 1458 "SECG elliptic curve sect571k1 (aka NIST K-571)",
michael@0 1459 CKM_INVALID_MECHANISM,
michael@0 1460 INVALID_CERT_EXTENSION ),
michael@0 1461 OD( secgECsect571r1, SEC_OID_SECG_EC_SECT571R1,
michael@0 1462 "SECG elliptic curve sect571r1 (aka NIST B-571)",
michael@0 1463 CKM_INVALID_MECHANISM,
michael@0 1464 INVALID_CERT_EXTENSION ),
michael@0 1465
michael@0 1466 OD( netscapeAOLScreenname, SEC_OID_NETSCAPE_AOLSCREENNAME,
michael@0 1467 "AOL Screenname", CKM_INVALID_MECHANISM,
michael@0 1468 INVALID_CERT_EXTENSION ),
michael@0 1469
michael@0 1470 OD( x520SurName, SEC_OID_AVA_SURNAME,
michael@0 1471 "X520 Title", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1472 OD( x520SerialNumber, SEC_OID_AVA_SERIAL_NUMBER,
michael@0 1473 "X520 Serial Number", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1474 OD( x520StreetAddress, SEC_OID_AVA_STREET_ADDRESS,
michael@0 1475 "X520 Street Address", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1476 OD( x520Title, SEC_OID_AVA_TITLE,
michael@0 1477 "X520 Title", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1478 OD( x520PostalAddress, SEC_OID_AVA_POSTAL_ADDRESS,
michael@0 1479 "X520 Postal Address", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1480 OD( x520PostalCode, SEC_OID_AVA_POSTAL_CODE,
michael@0 1481 "X520 Postal Code", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1482 OD( x520PostOfficeBox, SEC_OID_AVA_POST_OFFICE_BOX,
michael@0 1483 "X520 Post Office Box", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1484 OD( x520GivenName, SEC_OID_AVA_GIVEN_NAME,
michael@0 1485 "X520 Given Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1486 OD( x520Initials, SEC_OID_AVA_INITIALS,
michael@0 1487 "X520 Initials", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1488 OD( x520GenerationQualifier, SEC_OID_AVA_GENERATION_QUALIFIER,
michael@0 1489 "X520 Generation Qualifier",
michael@0 1490 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1491 OD( x520HouseIdentifier, SEC_OID_AVA_HOUSE_IDENTIFIER,
michael@0 1492 "X520 House Identifier",
michael@0 1493 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1494 OD( x520Pseudonym, SEC_OID_AVA_PSEUDONYM,
michael@0 1495 "X520 Pseudonym", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1496
michael@0 1497 /* More OIDs */
michael@0 1498 OD( pkixCAIssuers, SEC_OID_PKIX_CA_ISSUERS,
michael@0 1499 "PKIX CA issuers access method",
michael@0 1500 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1501 OD( pkcs9ExtensionRequest, SEC_OID_PKCS9_EXTENSION_REQUEST,
michael@0 1502 "PKCS #9 Extension Request",
michael@0 1503 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1504
michael@0 1505 /* more ECC Signature Oids */
michael@0 1506 OD( ansix962SignatureRecommended,
michael@0 1507 SEC_OID_ANSIX962_ECDSA_SIGNATURE_RECOMMENDED_DIGEST,
michael@0 1508 "X9.62 ECDSA signature with recommended digest", CKM_INVALID_MECHANISM,
michael@0 1509 INVALID_CERT_EXTENSION ),
michael@0 1510 OD( ansix962SignatureSpecified,
michael@0 1511 SEC_OID_ANSIX962_ECDSA_SIGNATURE_SPECIFIED_DIGEST,
michael@0 1512 "X9.62 ECDSA signature with specified digest", CKM_ECDSA,
michael@0 1513 INVALID_CERT_EXTENSION ),
michael@0 1514 OD( ansix962SignaturewithSHA224Digest,
michael@0 1515 SEC_OID_ANSIX962_ECDSA_SHA224_SIGNATURE,
michael@0 1516 "X9.62 ECDSA signature with SHA224", CKM_INVALID_MECHANISM,
michael@0 1517 INVALID_CERT_EXTENSION ),
michael@0 1518 OD( ansix962SignaturewithSHA256Digest,
michael@0 1519 SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE,
michael@0 1520 "X9.62 ECDSA signature with SHA256", CKM_INVALID_MECHANISM,
michael@0 1521 INVALID_CERT_EXTENSION ),
michael@0 1522 OD( ansix962SignaturewithSHA384Digest,
michael@0 1523 SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE,
michael@0 1524 "X9.62 ECDSA signature with SHA384", CKM_INVALID_MECHANISM,
michael@0 1525 INVALID_CERT_EXTENSION ),
michael@0 1526 OD( ansix962SignaturewithSHA512Digest,
michael@0 1527 SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE,
michael@0 1528 "X9.62 ECDSA signature with SHA512", CKM_INVALID_MECHANISM,
michael@0 1529 INVALID_CERT_EXTENSION ),
michael@0 1530
michael@0 1531 /* More id-ce and id-pe OIDs from RFC 3280 */
michael@0 1532 OD( x509HoldInstructionCode, SEC_OID_X509_HOLD_INSTRUCTION_CODE,
michael@0 1533 "CRL Hold Instruction Code", CKM_INVALID_MECHANISM,
michael@0 1534 UNSUPPORTED_CERT_EXTENSION ),
michael@0 1535 OD( x509DeltaCRLIndicator, SEC_OID_X509_DELTA_CRL_INDICATOR,
michael@0 1536 "Delta CRL Indicator", CKM_INVALID_MECHANISM,
michael@0 1537 FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 1538 OD( x509IssuingDistributionPoint, SEC_OID_X509_ISSUING_DISTRIBUTION_POINT,
michael@0 1539 "Issuing Distribution Point", CKM_INVALID_MECHANISM,
michael@0 1540 FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 1541 OD( x509CertIssuer, SEC_OID_X509_CERT_ISSUER,
michael@0 1542 "Certificate Issuer Extension",CKM_INVALID_MECHANISM,
michael@0 1543 FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 1544 OD( x509FreshestCRL, SEC_OID_X509_FRESHEST_CRL,
michael@0 1545 "Freshest CRL", CKM_INVALID_MECHANISM,
michael@0 1546 UNSUPPORTED_CERT_EXTENSION ),
michael@0 1547 OD( x509InhibitAnyPolicy, SEC_OID_X509_INHIBIT_ANY_POLICY,
michael@0 1548 "Inhibit Any Policy", CKM_INVALID_MECHANISM,
michael@0 1549 FAKE_SUPPORTED_CERT_EXTENSION ),
michael@0 1550 OD( x509SubjectInfoAccess, SEC_OID_X509_SUBJECT_INFO_ACCESS,
michael@0 1551 "Subject Info Access", CKM_INVALID_MECHANISM,
michael@0 1552 UNSUPPORTED_CERT_EXTENSION ),
michael@0 1553
michael@0 1554 /* Camellia algorithm OIDs */
michael@0 1555 OD( camellia128_CBC, SEC_OID_CAMELLIA_128_CBC,
michael@0 1556 "CAMELLIA-128-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),
michael@0 1557 OD( camellia192_CBC, SEC_OID_CAMELLIA_192_CBC,
michael@0 1558 "CAMELLIA-192-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),
michael@0 1559 OD( camellia256_CBC, SEC_OID_CAMELLIA_256_CBC,
michael@0 1560 "CAMELLIA-256-CBC", CKM_CAMELLIA_CBC, INVALID_CERT_EXTENSION ),
michael@0 1561
michael@0 1562 /* PKCS 5 v2 OIDS */
michael@0 1563 OD( pkcs5Pbkdf2, SEC_OID_PKCS5_PBKDF2,
michael@0 1564 "PKCS #5 Password Based Key Dervive Function v2 ",
michael@0 1565 CKM_PKCS5_PBKD2, INVALID_CERT_EXTENSION ),
michael@0 1566 OD( pkcs5Pbes2, SEC_OID_PKCS5_PBES2,
michael@0 1567 "PKCS #5 Password Based Encryption v2 ",
michael@0 1568 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1569 OD( pkcs5Pbmac1, SEC_OID_PKCS5_PBMAC1,
michael@0 1570 "PKCS #5 Password Based Authentication v1 ",
michael@0 1571 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1572 OD( hmac_sha1, SEC_OID_HMAC_SHA1, "HMAC SHA-1",
michael@0 1573 CKM_SHA_1_HMAC, INVALID_CERT_EXTENSION ),
michael@0 1574 OD( hmac_sha224, SEC_OID_HMAC_SHA224, "HMAC SHA-224",
michael@0 1575 CKM_SHA224_HMAC, INVALID_CERT_EXTENSION ),
michael@0 1576 OD( hmac_sha256, SEC_OID_HMAC_SHA256, "HMAC SHA-256",
michael@0 1577 CKM_SHA256_HMAC, INVALID_CERT_EXTENSION ),
michael@0 1578 OD( hmac_sha384, SEC_OID_HMAC_SHA384, "HMAC SHA-384",
michael@0 1579 CKM_SHA384_HMAC, INVALID_CERT_EXTENSION ),
michael@0 1580 OD( hmac_sha512, SEC_OID_HMAC_SHA512, "HMAC SHA-512",
michael@0 1581 CKM_SHA512_HMAC, INVALID_CERT_EXTENSION ),
michael@0 1582
michael@0 1583 /* SIA extension OIDs */
michael@0 1584 OD( x509SIATimeStamping, SEC_OID_PKIX_TIMESTAMPING,
michael@0 1585 "SIA Time Stamping", CKM_INVALID_MECHANISM,
michael@0 1586 INVALID_CERT_EXTENSION ),
michael@0 1587 OD( x509SIACaRepository, SEC_OID_PKIX_CA_REPOSITORY,
michael@0 1588 "SIA CA Repository", CKM_INVALID_MECHANISM,
michael@0 1589 INVALID_CERT_EXTENSION ),
michael@0 1590
michael@0 1591 OD( isoSHA1WithRSASignature, SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE,
michael@0 1592 "ISO SHA-1 with RSA Signature",
michael@0 1593 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1594
michael@0 1595 /* SEED algorithm OIDs */
michael@0 1596 OD( seed_CBC, SEC_OID_SEED_CBC,
michael@0 1597 "SEED-CBC", CKM_SEED_CBC, INVALID_CERT_EXTENSION),
michael@0 1598
michael@0 1599 OD( x509CertificatePoliciesAnyPolicy, SEC_OID_X509_ANY_POLICY,
michael@0 1600 "Certificate Policies AnyPolicy",
michael@0 1601 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1602
michael@0 1603 OD( pkcs1RSAOAEPEncryption, SEC_OID_PKCS1_RSA_OAEP_ENCRYPTION,
michael@0 1604 "PKCS #1 RSA-OAEP Encryption", CKM_RSA_PKCS_OAEP,
michael@0 1605 INVALID_CERT_EXTENSION ),
michael@0 1606
michael@0 1607 OD( pkcs1MGF1, SEC_OID_PKCS1_MGF1,
michael@0 1608 "PKCS #1 MGF1 Mask Generation Function", CKM_INVALID_MECHANISM,
michael@0 1609 INVALID_CERT_EXTENSION ),
michael@0 1610
michael@0 1611 OD( pkcs1PSpecified, SEC_OID_PKCS1_PSPECIFIED,
michael@0 1612 "PKCS #1 RSA-OAEP Explicitly Specified Encoding Parameters",
michael@0 1613 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1614
michael@0 1615 OD( pkcs1RSAPSSSignature, SEC_OID_PKCS1_RSA_PSS_SIGNATURE,
michael@0 1616 "PKCS #1 RSA-PSS Signature", CKM_RSA_PKCS_PSS,
michael@0 1617 INVALID_CERT_EXTENSION ),
michael@0 1618
michael@0 1619 OD( pkcs1SHA224WithRSAEncryption, SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION,
michael@0 1620 "PKCS #1 SHA-224 With RSA Encryption", CKM_SHA224_RSA_PKCS,
michael@0 1621 INVALID_CERT_EXTENSION ),
michael@0 1622
michael@0 1623 OD( sha224, SEC_OID_SHA224, "SHA-224", CKM_SHA224, INVALID_CERT_EXTENSION),
michael@0 1624
michael@0 1625 OD( evIncorporationLocality, SEC_OID_EV_INCORPORATION_LOCALITY,
michael@0 1626 "Jurisdiction of Incorporation Locality Name",
michael@0 1627 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1628 OD( evIncorporationState, SEC_OID_EV_INCORPORATION_STATE,
michael@0 1629 "Jurisdiction of Incorporation State Name",
michael@0 1630 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1631 OD( evIncorporationCountry, SEC_OID_EV_INCORPORATION_COUNTRY,
michael@0 1632 "Jurisdiction of Incorporation Country Name",
michael@0 1633 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1634 OD( x520BusinessCategory, SEC_OID_BUSINESS_CATEGORY,
michael@0 1635 "Business Category",
michael@0 1636 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1637
michael@0 1638 OD( nistDSASignaturewithSHA224Digest,
michael@0 1639 SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA224_DIGEST,
michael@0 1640 "DSA with SHA-224 Signature",
michael@0 1641 CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),
michael@0 1642 OD( nistDSASignaturewithSHA256Digest,
michael@0 1643 SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA256_DIGEST,
michael@0 1644 "DSA with SHA-256 Signature",
michael@0 1645 CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),
michael@0 1646 OD( msExtendedKeyUsageTrustListSigning,
michael@0 1647 SEC_OID_MS_EXT_KEY_USAGE_CTL_SIGNING,
michael@0 1648 "Microsoft Trust List Signing",
michael@0 1649 CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
michael@0 1650 OD( x520Name, SEC_OID_AVA_NAME,
michael@0 1651 "X520 Name", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION )
michael@0 1652 };
michael@0 1653
michael@0 1654 /* PRIVATE EXTENDED SECOID Table
michael@0 1655 * This table is private. Its structure is opaque to the outside.
michael@0 1656 * It is indexed by the same SECOidTag as the oids table above.
michael@0 1657 * Every member of this struct must have accessor functions (set, get)
michael@0 1658 * and those functions must operate by value, not by reference.
michael@0 1659 * The addresses of the contents of this table must not be exposed
michael@0 1660 * by the accessor functions.
michael@0 1661 */
michael@0 1662 typedef struct privXOidStr {
michael@0 1663 PRUint32 notPolicyFlags; /* ones complement of policy flags */
michael@0 1664 } privXOid;
michael@0 1665
michael@0 1666 static privXOid xOids[SEC_OID_TOTAL];
michael@0 1667
michael@0 1668 /*
michael@0 1669 * now the dynamic table. The dynamic table gets build at init time.
michael@0 1670 * and conceivably gets modified if the user loads new crypto modules.
michael@0 1671 * All this static data, and the allocated data to which it points,
michael@0 1672 * is protected by a global reader/writer lock.
michael@0 1673 * The c language guarantees that global and static data that is not
michael@0 1674 * explicitly initialized will be initialized with zeros. If we
michael@0 1675 * initialize it with zeros, the data goes into the initialized data
michael@0 1676 * secment, and increases the size of the library. By leaving it
michael@0 1677 * uninitialized, it is allocated in BSS, and does NOT increase the
michael@0 1678 * library size.
michael@0 1679 */
michael@0 1680
michael@0 1681 typedef struct dynXOidStr {
michael@0 1682 SECOidData data;
michael@0 1683 privXOid priv;
michael@0 1684 } dynXOid;
michael@0 1685
michael@0 1686 static NSSRWLock * dynOidLock;
michael@0 1687 static PLArenaPool * dynOidPool;
michael@0 1688 static PLHashTable * dynOidHash;
michael@0 1689 static dynXOid ** dynOidTable; /* not in the pool */
michael@0 1690 static int dynOidEntriesAllocated;
michael@0 1691 static int dynOidEntriesUsed;
michael@0 1692
michael@0 1693 /* Creates NSSRWLock and dynOidPool at initialization time.
michael@0 1694 */
michael@0 1695 static SECStatus
michael@0 1696 secoid_InitDynOidData(void)
michael@0 1697 {
michael@0 1698 SECStatus rv = SECSuccess;
michael@0 1699
michael@0 1700 dynOidLock = NSSRWLock_New(1, "dynamic OID data");
michael@0 1701 if (!dynOidLock) {
michael@0 1702 return SECFailure; /* Error code should already be set. */
michael@0 1703 }
michael@0 1704 dynOidPool = PORT_NewArena(2048);
michael@0 1705 if (!dynOidPool) {
michael@0 1706 rv = SECFailure /* Error code should already be set. */;
michael@0 1707 }
michael@0 1708 return rv;
michael@0 1709 }
michael@0 1710
michael@0 1711 /* Add oidData to hash table. Caller holds write lock dynOidLock. */
michael@0 1712 static SECStatus
michael@0 1713 secoid_HashDynamicOiddata(const SECOidData * oid)
michael@0 1714 {
michael@0 1715 PLHashEntry *entry;
michael@0 1716
michael@0 1717 if (!dynOidHash) {
michael@0 1718 dynOidHash = PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,
michael@0 1719 PL_CompareValues, NULL, NULL);
michael@0 1720 if ( !dynOidHash ) {
michael@0 1721 return SECFailure;
michael@0 1722 }
michael@0 1723 }
michael@0 1724
michael@0 1725 entry = PL_HashTableAdd( dynOidHash, &oid->oid, (void *)oid );
michael@0 1726 return entry ? SECSuccess : SECFailure;
michael@0 1727 }
michael@0 1728
michael@0 1729
michael@0 1730 /*
michael@0 1731 * Lookup a Dynamic OID. Dynamic OID's still change slowly, so it's
michael@0 1732 * cheaper to rehash the table when it changes than it is to do the loop
michael@0 1733 * each time.
michael@0 1734 */
michael@0 1735 static SECOidData *
michael@0 1736 secoid_FindDynamic(const SECItem *key)
michael@0 1737 {
michael@0 1738 SECOidData *ret = NULL;
michael@0 1739
michael@0 1740 if (dynOidHash) {
michael@0 1741 NSSRWLock_LockRead(dynOidLock);
michael@0 1742 if (dynOidHash) { /* must check it again with lock held. */
michael@0 1743 ret = (SECOidData *)PL_HashTableLookup(dynOidHash, key);
michael@0 1744 }
michael@0 1745 NSSRWLock_UnlockRead(dynOidLock);
michael@0 1746 }
michael@0 1747 if (ret == NULL) {
michael@0 1748 PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);
michael@0 1749 }
michael@0 1750 return ret;
michael@0 1751 }
michael@0 1752
michael@0 1753 static dynXOid *
michael@0 1754 secoid_FindDynamicByTag(SECOidTag tagnum)
michael@0 1755 {
michael@0 1756 dynXOid *dxo = NULL;
michael@0 1757 int tagNumDiff;
michael@0 1758
michael@0 1759 if (tagnum < SEC_OID_TOTAL) {
michael@0 1760 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 1761 return NULL;
michael@0 1762 }
michael@0 1763 tagNumDiff = tagnum - SEC_OID_TOTAL;
michael@0 1764
michael@0 1765 if (dynOidTable) {
michael@0 1766 NSSRWLock_LockRead(dynOidLock);
michael@0 1767 if (dynOidTable != NULL && /* must check it again with lock held. */
michael@0 1768 tagNumDiff < dynOidEntriesUsed) {
michael@0 1769 dxo = dynOidTable[tagNumDiff];
michael@0 1770 }
michael@0 1771 NSSRWLock_UnlockRead(dynOidLock);
michael@0 1772 }
michael@0 1773 if (dxo == NULL) {
michael@0 1774 PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);
michael@0 1775 }
michael@0 1776 return dxo;
michael@0 1777 }
michael@0 1778
michael@0 1779 /*
michael@0 1780 * This routine is thread safe now.
michael@0 1781 */
michael@0 1782 SECOidTag
michael@0 1783 SECOID_AddEntry(const SECOidData * src)
michael@0 1784 {
michael@0 1785 SECOidData * dst;
michael@0 1786 dynXOid **table;
michael@0 1787 SECOidTag ret = SEC_OID_UNKNOWN;
michael@0 1788 SECStatus rv;
michael@0 1789 int tableEntries;
michael@0 1790 int used;
michael@0 1791
michael@0 1792 if (!src || !src->oid.data || !src->oid.len || \
michael@0 1793 !src->desc || !strlen(src->desc)) {
michael@0 1794 PORT_SetError(SEC_ERROR_INVALID_ARGS);
michael@0 1795 return ret;
michael@0 1796 }
michael@0 1797 if (src->supportedExtension != INVALID_CERT_EXTENSION &&
michael@0 1798 src->supportedExtension != UNSUPPORTED_CERT_EXTENSION &&
michael@0 1799 src->supportedExtension != SUPPORTED_CERT_EXTENSION ) {
michael@0 1800 PORT_SetError(SEC_ERROR_INVALID_ARGS);
michael@0 1801 return ret;
michael@0 1802 }
michael@0 1803
michael@0 1804 if (!dynOidPool || !dynOidLock) {
michael@0 1805 PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
michael@0 1806 return ret;
michael@0 1807 }
michael@0 1808
michael@0 1809 NSSRWLock_LockWrite(dynOidLock);
michael@0 1810
michael@0 1811 /* We've just acquired the write lock, and now we call FindOIDTag
michael@0 1812 ** which will acquire and release the read lock. NSSRWLock has been
michael@0 1813 ** designed to allow this very case without deadlock. This approach
michael@0 1814 ** makes the test for the presence of the OID, and the subsequent
michael@0 1815 ** addition of the OID to the table a single atomic write operation.
michael@0 1816 */
michael@0 1817 ret = SECOID_FindOIDTag(&src->oid);
michael@0 1818 if (ret != SEC_OID_UNKNOWN) {
michael@0 1819 /* we could return an error here, but I chose not to do that.
michael@0 1820 ** This way, if we add an OID to the shared library's built in
michael@0 1821 ** list of OIDs in some future release, and that OID is the same
michael@0 1822 ** as some OID that a program has been adding, the program will
michael@0 1823 ** not suddenly stop working.
michael@0 1824 */
michael@0 1825 goto done;
michael@0 1826 }
michael@0 1827
michael@0 1828 table = dynOidTable;
michael@0 1829 tableEntries = dynOidEntriesAllocated;
michael@0 1830 used = dynOidEntriesUsed;
michael@0 1831
michael@0 1832 if (used + 1 > tableEntries) {
michael@0 1833 dynXOid ** newTable;
michael@0 1834 int newTableEntries = tableEntries + 16;
michael@0 1835
michael@0 1836 newTable = (dynXOid **)PORT_Realloc(table,
michael@0 1837 newTableEntries * sizeof(dynXOid *));
michael@0 1838 if (newTable == NULL) {
michael@0 1839 goto done;
michael@0 1840 }
michael@0 1841 dynOidTable = table = newTable;
michael@0 1842 dynOidEntriesAllocated = tableEntries = newTableEntries;
michael@0 1843 }
michael@0 1844
michael@0 1845 /* copy oid structure */
michael@0 1846 dst = (SECOidData *)PORT_ArenaZNew(dynOidPool, dynXOid);
michael@0 1847 if (!dst) {
michael@0 1848 goto done;
michael@0 1849 }
michael@0 1850 rv = SECITEM_CopyItem(dynOidPool, &dst->oid, &src->oid);
michael@0 1851 if (rv != SECSuccess) {
michael@0 1852 goto done;
michael@0 1853 }
michael@0 1854 dst->desc = PORT_ArenaStrdup(dynOidPool, src->desc);
michael@0 1855 if (!dst->desc) {
michael@0 1856 goto done;
michael@0 1857 }
michael@0 1858 dst->offset = (SECOidTag)(used + SEC_OID_TOTAL);
michael@0 1859 dst->mechanism = src->mechanism;
michael@0 1860 dst->supportedExtension = src->supportedExtension;
michael@0 1861
michael@0 1862 rv = secoid_HashDynamicOiddata(dst);
michael@0 1863 if (rv == SECSuccess) {
michael@0 1864 table[used++] = (dynXOid *)dst;
michael@0 1865 dynOidEntriesUsed = used;
michael@0 1866 ret = dst->offset;
michael@0 1867 }
michael@0 1868 done:
michael@0 1869 NSSRWLock_UnlockWrite(dynOidLock);
michael@0 1870 return ret;
michael@0 1871 }
michael@0 1872
michael@0 1873
michael@0 1874 /* normal static table processing */
michael@0 1875 static PLHashTable *oidhash = NULL;
michael@0 1876 static PLHashTable *oidmechhash = NULL;
michael@0 1877
michael@0 1878 static PLHashNumber
michael@0 1879 secoid_HashNumber(const void *key)
michael@0 1880 {
michael@0 1881 return (PLHashNumber) key;
michael@0 1882 }
michael@0 1883
michael@0 1884 static void
michael@0 1885 handleHashAlgSupport(char * envVal)
michael@0 1886 {
michael@0 1887 char * myVal = PORT_Strdup(envVal); /* Get a copy we can alter */
michael@0 1888 char * arg = myVal;
michael@0 1889
michael@0 1890 while (arg && *arg) {
michael@0 1891 char * nextArg = PL_strpbrk(arg, ";");
michael@0 1892 PRUint32 notEnable;
michael@0 1893
michael@0 1894 if (nextArg) {
michael@0 1895 while (*nextArg == ';') {
michael@0 1896 *nextArg++ = '\0';
michael@0 1897 }
michael@0 1898 }
michael@0 1899 notEnable = (*arg == '-') ? NSS_USE_ALG_IN_CERT_SIGNATURE : 0;
michael@0 1900 if ((*arg == '+' || *arg == '-') && *++arg) {
michael@0 1901 int i;
michael@0 1902
michael@0 1903 for (i = 1; i < SEC_OID_TOTAL; i++) {
michael@0 1904 if (oids[i].desc && strstr(arg, oids[i].desc)) {
michael@0 1905 xOids[i].notPolicyFlags = notEnable |
michael@0 1906 (xOids[i].notPolicyFlags & ~NSS_USE_ALG_IN_CERT_SIGNATURE);
michael@0 1907 }
michael@0 1908 }
michael@0 1909 }
michael@0 1910 arg = nextArg;
michael@0 1911 }
michael@0 1912 PORT_Free(myVal); /* can handle NULL argument OK */
michael@0 1913 }
michael@0 1914
michael@0 1915 SECStatus
michael@0 1916 SECOID_Init(void)
michael@0 1917 {
michael@0 1918 PLHashEntry *entry;
michael@0 1919 const SECOidData *oid;
michael@0 1920 int i;
michael@0 1921 char * envVal;
michael@0 1922 volatile char c; /* force a reference that won't get optimized away */
michael@0 1923
michael@0 1924 c = __nss_util_rcsid[0] + __nss_util_sccsid[0];
michael@0 1925
michael@0 1926 if (oidhash) {
michael@0 1927 return SECSuccess; /* already initialized */
michael@0 1928 }
michael@0 1929
michael@0 1930 if (!PR_GetEnv("NSS_ALLOW_WEAK_SIGNATURE_ALG")) {
michael@0 1931 /* initialize any policy flags that are disabled by default */
michael@0 1932 xOids[SEC_OID_MD2 ].notPolicyFlags = ~0;
michael@0 1933 xOids[SEC_OID_MD4 ].notPolicyFlags = ~0;
michael@0 1934 xOids[SEC_OID_MD5 ].notPolicyFlags = ~0;
michael@0 1935 xOids[SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
michael@0 1936 xOids[SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
michael@0 1937 xOids[SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
michael@0 1938 xOids[SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC].notPolicyFlags = ~0;
michael@0 1939 xOids[SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC].notPolicyFlags = ~0;
michael@0 1940 }
michael@0 1941
michael@0 1942 envVal = PR_GetEnv("NSS_HASH_ALG_SUPPORT");
michael@0 1943 if (envVal)
michael@0 1944 handleHashAlgSupport(envVal);
michael@0 1945
michael@0 1946 if (secoid_InitDynOidData() != SECSuccess) {
michael@0 1947 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 1948 PORT_Assert(0); /* this function should never fail */
michael@0 1949 return SECFailure;
michael@0 1950 }
michael@0 1951
michael@0 1952 oidhash = PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,
michael@0 1953 PL_CompareValues, NULL, NULL);
michael@0 1954 oidmechhash = PL_NewHashTable(0, secoid_HashNumber, PL_CompareValues,
michael@0 1955 PL_CompareValues, NULL, NULL);
michael@0 1956
michael@0 1957 if ( !oidhash || !oidmechhash) {
michael@0 1958 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 1959 PORT_Assert(0); /*This function should never fail. */
michael@0 1960 return(SECFailure);
michael@0 1961 }
michael@0 1962
michael@0 1963 for ( i = 0; i < SEC_OID_TOTAL; i++ ) {
michael@0 1964 oid = &oids[i];
michael@0 1965
michael@0 1966 PORT_Assert ( oid->offset == i );
michael@0 1967
michael@0 1968 entry = PL_HashTableAdd( oidhash, &oid->oid, (void *)oid );
michael@0 1969 if ( entry == NULL ) {
michael@0 1970 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 1971 PORT_Assert(0); /*This function should never fail. */
michael@0 1972 return(SECFailure);
michael@0 1973 }
michael@0 1974
michael@0 1975 if ( oid->mechanism != CKM_INVALID_MECHANISM ) {
michael@0 1976 entry = PL_HashTableAdd( oidmechhash,
michael@0 1977 (void *)oid->mechanism, (void *)oid );
michael@0 1978 if ( entry == NULL ) {
michael@0 1979 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 1980 PORT_Assert(0); /* This function should never fail. */
michael@0 1981 return(SECFailure);
michael@0 1982 }
michael@0 1983 }
michael@0 1984 }
michael@0 1985
michael@0 1986 PORT_Assert (i == SEC_OID_TOTAL);
michael@0 1987
michael@0 1988 return(SECSuccess);
michael@0 1989 }
michael@0 1990
michael@0 1991 SECOidData *
michael@0 1992 SECOID_FindOIDByMechanism(unsigned long mechanism)
michael@0 1993 {
michael@0 1994 SECOidData *ret;
michael@0 1995
michael@0 1996 PR_ASSERT(oidhash != NULL);
michael@0 1997
michael@0 1998 ret = PL_HashTableLookupConst ( oidmechhash, (void *)mechanism);
michael@0 1999 if ( ret == NULL ) {
michael@0 2000 PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
michael@0 2001 }
michael@0 2002
michael@0 2003 return (ret);
michael@0 2004 }
michael@0 2005
michael@0 2006 SECOidData *
michael@0 2007 SECOID_FindOID(const SECItem *oid)
michael@0 2008 {
michael@0 2009 SECOidData *ret;
michael@0 2010
michael@0 2011 PR_ASSERT(oidhash != NULL);
michael@0 2012
michael@0 2013 ret = PL_HashTableLookupConst ( oidhash, oid );
michael@0 2014 if ( ret == NULL ) {
michael@0 2015 ret = secoid_FindDynamic(oid);
michael@0 2016 if (ret == NULL) {
michael@0 2017 PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);
michael@0 2018 }
michael@0 2019 }
michael@0 2020
michael@0 2021 return(ret);
michael@0 2022 }
michael@0 2023
michael@0 2024 SECOidTag
michael@0 2025 SECOID_FindOIDTag(const SECItem *oid)
michael@0 2026 {
michael@0 2027 SECOidData *oiddata;
michael@0 2028
michael@0 2029 oiddata = SECOID_FindOID (oid);
michael@0 2030 if (oiddata == NULL)
michael@0 2031 return SEC_OID_UNKNOWN;
michael@0 2032
michael@0 2033 return oiddata->offset;
michael@0 2034 }
michael@0 2035
michael@0 2036 /* This really should return const. */
michael@0 2037 SECOidData *
michael@0 2038 SECOID_FindOIDByTag(SECOidTag tagnum)
michael@0 2039 {
michael@0 2040 if (tagnum >= SEC_OID_TOTAL) {
michael@0 2041 return (SECOidData *)secoid_FindDynamicByTag(tagnum);
michael@0 2042 }
michael@0 2043
michael@0 2044 PORT_Assert((unsigned int)tagnum < SEC_OID_TOTAL);
michael@0 2045 return (SECOidData *)(&oids[tagnum]);
michael@0 2046 }
michael@0 2047
michael@0 2048 PRBool SECOID_KnownCertExtenOID (SECItem *extenOid)
michael@0 2049 {
michael@0 2050 SECOidData * oidData;
michael@0 2051
michael@0 2052 oidData = SECOID_FindOID (extenOid);
michael@0 2053 if (oidData == (SECOidData *)NULL)
michael@0 2054 return (PR_FALSE);
michael@0 2055 return ((oidData->supportedExtension == SUPPORTED_CERT_EXTENSION) ?
michael@0 2056 PR_TRUE : PR_FALSE);
michael@0 2057 }
michael@0 2058
michael@0 2059
michael@0 2060 const char *
michael@0 2061 SECOID_FindOIDTagDescription(SECOidTag tagnum)
michael@0 2062 {
michael@0 2063 const SECOidData *oidData = SECOID_FindOIDByTag(tagnum);
michael@0 2064 return oidData ? oidData->desc : 0;
michael@0 2065 }
michael@0 2066
michael@0 2067 /* --------- opaque extended OID table accessor functions ---------------*/
michael@0 2068 /*
michael@0 2069 * Any of these functions may return SECSuccess or SECFailure with the error
michael@0 2070 * code set to SEC_ERROR_UNKNOWN_OBJECT_TYPE if the SECOidTag is out of range.
michael@0 2071 */
michael@0 2072
michael@0 2073 static privXOid *
michael@0 2074 secoid_FindXOidByTag(SECOidTag tagnum)
michael@0 2075 {
michael@0 2076 if (tagnum >= SEC_OID_TOTAL) {
michael@0 2077 dynXOid *dxo = secoid_FindDynamicByTag(tagnum);
michael@0 2078 return (dxo ? &dxo->priv : NULL);
michael@0 2079 }
michael@0 2080
michael@0 2081 PORT_Assert((unsigned int)tagnum < SEC_OID_TOTAL);
michael@0 2082 return &xOids[tagnum];
michael@0 2083 }
michael@0 2084
michael@0 2085 /* The Get function outputs the 32-bit value associated with the SECOidTag.
michael@0 2086 * Flags bits are the NSS_USE_ALG_ #defines in "secoidt.h".
michael@0 2087 * Default value for any algorithm is 0xffffffff (enabled for all purposes).
michael@0 2088 * No value is output if function returns SECFailure.
michael@0 2089 */
michael@0 2090 SECStatus
michael@0 2091 NSS_GetAlgorithmPolicy(SECOidTag tag, PRUint32 *pValue)
michael@0 2092 {
michael@0 2093 privXOid * pxo = secoid_FindXOidByTag(tag);
michael@0 2094 if (!pxo)
michael@0 2095 return SECFailure;
michael@0 2096 if (!pValue) {
michael@0 2097 PORT_SetError(SEC_ERROR_INVALID_ARGS);
michael@0 2098 return SECFailure;
michael@0 2099 }
michael@0 2100 *pValue = ~(pxo->notPolicyFlags);
michael@0 2101 return SECSuccess;
michael@0 2102 }
michael@0 2103
michael@0 2104 /* The Set function modifies the stored value according to the following
michael@0 2105 * algorithm:
michael@0 2106 * policy[tag] = (policy[tag] & ~clearBits) | setBits;
michael@0 2107 */
michael@0 2108 SECStatus
michael@0 2109 NSS_SetAlgorithmPolicy(SECOidTag tag, PRUint32 setBits, PRUint32 clearBits)
michael@0 2110 {
michael@0 2111 privXOid * pxo = secoid_FindXOidByTag(tag);
michael@0 2112 PRUint32 policyFlags;
michael@0 2113 if (!pxo)
michael@0 2114 return SECFailure;
michael@0 2115 /* The stored policy flags are the ones complement of the flags as
michael@0 2116 * seen by the user. This is not atomic, but these changes should
michael@0 2117 * be done rarely, e.g. at initialization time.
michael@0 2118 */
michael@0 2119 policyFlags = ~(pxo->notPolicyFlags);
michael@0 2120 policyFlags = (policyFlags & ~clearBits) | setBits;
michael@0 2121 pxo->notPolicyFlags = ~policyFlags;
michael@0 2122 return SECSuccess;
michael@0 2123 }
michael@0 2124
michael@0 2125 /* --------- END OF opaque extended OID table accessor functions ---------*/
michael@0 2126
michael@0 2127 /* for now, this is only used in a single place, so it can remain static */
michael@0 2128 static PRBool parentForkedAfterC_Initialize;
michael@0 2129
michael@0 2130 #define SKIP_AFTER_FORK(x) if (!parentForkedAfterC_Initialize) x
michael@0 2131
michael@0 2132 /*
michael@0 2133 * free up the oid tables.
michael@0 2134 */
michael@0 2135 SECStatus
michael@0 2136 SECOID_Shutdown(void)
michael@0 2137 {
michael@0 2138 if (oidhash) {
michael@0 2139 PL_HashTableDestroy(oidhash);
michael@0 2140 oidhash = NULL;
michael@0 2141 }
michael@0 2142 if (oidmechhash) {
michael@0 2143 PL_HashTableDestroy(oidmechhash);
michael@0 2144 oidmechhash = NULL;
michael@0 2145 }
michael@0 2146 /* Have to handle the case where the lock was created, but
michael@0 2147 ** the pool wasn't.
michael@0 2148 ** I'm not going to attempt to create the lock, just to protect
michael@0 2149 ** the destruction of data that probably isn't initialized anyway.
michael@0 2150 */
michael@0 2151 if (dynOidLock) {
michael@0 2152 SKIP_AFTER_FORK(NSSRWLock_LockWrite(dynOidLock));
michael@0 2153 if (dynOidHash) {
michael@0 2154 PL_HashTableDestroy(dynOidHash);
michael@0 2155 dynOidHash = NULL;
michael@0 2156 }
michael@0 2157 if (dynOidPool) {
michael@0 2158 PORT_FreeArena(dynOidPool, PR_FALSE);
michael@0 2159 dynOidPool = NULL;
michael@0 2160 }
michael@0 2161 if (dynOidTable) {
michael@0 2162 PORT_Free(dynOidTable);
michael@0 2163 dynOidTable = NULL;
michael@0 2164 }
michael@0 2165 dynOidEntriesAllocated = 0;
michael@0 2166 dynOidEntriesUsed = 0;
michael@0 2167
michael@0 2168 SKIP_AFTER_FORK(NSSRWLock_UnlockWrite(dynOidLock));
michael@0 2169 SKIP_AFTER_FORK(NSSRWLock_Destroy(dynOidLock));
michael@0 2170 dynOidLock = NULL;
michael@0 2171 } else {
michael@0 2172 /* Since dynOidLock doesn't exist, then all the data it protects
michael@0 2173 ** should be uninitialized. We'll check that (in DEBUG builds),
michael@0 2174 ** and then make sure it is so, in case NSS is reinitialized.
michael@0 2175 */
michael@0 2176 PORT_Assert(!dynOidHash && !dynOidPool && !dynOidTable && \
michael@0 2177 !dynOidEntriesAllocated && !dynOidEntriesUsed);
michael@0 2178 dynOidHash = NULL;
michael@0 2179 dynOidPool = NULL;
michael@0 2180 dynOidTable = NULL;
michael@0 2181 dynOidEntriesAllocated = 0;
michael@0 2182 dynOidEntriesUsed = 0;
michael@0 2183 }
michael@0 2184 memset(xOids, 0, sizeof xOids);
michael@0 2185 return SECSuccess;
michael@0 2186 }
michael@0 2187
michael@0 2188 void UTIL_SetForkState(PRBool forked)
michael@0 2189 {
michael@0 2190 parentForkedAfterC_Initialize = forked;
michael@0 2191 }
michael@0 2192
michael@0 2193 const char *
michael@0 2194 NSSUTIL_GetVersion(void)
michael@0 2195 {
michael@0 2196 return NSSUTIL_VERSION;
michael@0 2197 }

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial