You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

310 lines
7.6 KiB

4 years ago
  1. # coding: utf-8
  2. """
  3. ASN.1 type classes for the time stamp protocol (TSP). Exports the following
  4. items:
  5. - TimeStampReq()
  6. - TimeStampResp()
  7. Also adds TimeStampedData() support to asn1crypto.cms.ContentInfo(),
  8. TimeStampedData() and TSTInfo() support to
  9. asn1crypto.cms.EncapsulatedContentInfo() and some oids and value parsers to
  10. asn1crypto.cms.CMSAttribute().
  11. Other type classes are defined that help compose the types listed above.
  12. """
  13. from __future__ import unicode_literals, division, absolute_import, print_function
  14. from .algos import DigestAlgorithm
  15. from .cms import (
  16. CMSAttribute,
  17. CMSAttributeType,
  18. ContentInfo,
  19. ContentType,
  20. EncapsulatedContentInfo,
  21. )
  22. from .core import (
  23. Any,
  24. BitString,
  25. Boolean,
  26. Choice,
  27. GeneralizedTime,
  28. IA5String,
  29. Integer,
  30. ObjectIdentifier,
  31. OctetString,
  32. Sequence,
  33. SequenceOf,
  34. SetOf,
  35. UTF8String,
  36. )
  37. from .crl import CertificateList
  38. from .x509 import (
  39. Attributes,
  40. CertificatePolicies,
  41. GeneralName,
  42. GeneralNames,
  43. )
  44. # The structures in this file are based on https://tools.ietf.org/html/rfc3161,
  45. # https://tools.ietf.org/html/rfc4998, https://tools.ietf.org/html/rfc5544,
  46. # https://tools.ietf.org/html/rfc5035, https://tools.ietf.org/html/rfc2634
  47. class Version(Integer):
  48. _map = {
  49. 0: 'v0',
  50. 1: 'v1',
  51. 2: 'v2',
  52. 3: 'v3',
  53. 4: 'v4',
  54. 5: 'v5',
  55. }
  56. class MessageImprint(Sequence):
  57. _fields = [
  58. ('hash_algorithm', DigestAlgorithm),
  59. ('hashed_message', OctetString),
  60. ]
  61. class Accuracy(Sequence):
  62. _fields = [
  63. ('seconds', Integer, {'optional': True}),
  64. ('millis', Integer, {'implicit': 0, 'optional': True}),
  65. ('micros', Integer, {'implicit': 1, 'optional': True}),
  66. ]
  67. class Extension(Sequence):
  68. _fields = [
  69. ('extn_id', ObjectIdentifier),
  70. ('critical', Boolean, {'default': False}),
  71. ('extn_value', OctetString),
  72. ]
  73. class Extensions(SequenceOf):
  74. _child_spec = Extension
  75. class TSTInfo(Sequence):
  76. _fields = [
  77. ('version', Version),
  78. ('policy', ObjectIdentifier),
  79. ('message_imprint', MessageImprint),
  80. ('serial_number', Integer),
  81. ('gen_time', GeneralizedTime),
  82. ('accuracy', Accuracy, {'optional': True}),
  83. ('ordering', Boolean, {'default': False}),
  84. ('nonce', Integer, {'optional': True}),
  85. ('tsa', GeneralName, {'explicit': 0, 'optional': True}),
  86. ('extensions', Extensions, {'implicit': 1, 'optional': True}),
  87. ]
  88. class TimeStampReq(Sequence):
  89. _fields = [
  90. ('version', Version),
  91. ('message_imprint', MessageImprint),
  92. ('req_policy', ObjectIdentifier, {'optional': True}),
  93. ('nonce', Integer, {'optional': True}),
  94. ('cert_req', Boolean, {'default': False}),
  95. ('extensions', Extensions, {'implicit': 0, 'optional': True}),
  96. ]
  97. class PKIStatus(Integer):
  98. _map = {
  99. 0: 'granted',
  100. 1: 'granted_with_mods',
  101. 2: 'rejection',
  102. 3: 'waiting',
  103. 4: 'revocation_warning',
  104. 5: 'revocation_notification',
  105. }
  106. class PKIFreeText(SequenceOf):
  107. _child_spec = UTF8String
  108. class PKIFailureInfo(BitString):
  109. _map = {
  110. 0: 'bad_alg',
  111. 2: 'bad_request',
  112. 5: 'bad_data_format',
  113. 14: 'time_not_available',
  114. 15: 'unaccepted_policy',
  115. 16: 'unaccepted_extensions',
  116. 17: 'add_info_not_available',
  117. 25: 'system_failure',
  118. }
  119. class PKIStatusInfo(Sequence):
  120. _fields = [
  121. ('status', PKIStatus),
  122. ('status_string', PKIFreeText, {'optional': True}),
  123. ('fail_info', PKIFailureInfo, {'optional': True}),
  124. ]
  125. class TimeStampResp(Sequence):
  126. _fields = [
  127. ('status', PKIStatusInfo),
  128. ('time_stamp_token', ContentInfo),
  129. ]
  130. class MetaData(Sequence):
  131. _fields = [
  132. ('hash_protected', Boolean),
  133. ('file_name', UTF8String, {'optional': True}),
  134. ('media_type', IA5String, {'optional': True}),
  135. ('other_meta_data', Attributes, {'optional': True}),
  136. ]
  137. class TimeStampAndCRL(SequenceOf):
  138. _fields = [
  139. ('time_stamp', EncapsulatedContentInfo),
  140. ('crl', CertificateList, {'optional': True}),
  141. ]
  142. class TimeStampTokenEvidence(SequenceOf):
  143. _child_spec = TimeStampAndCRL
  144. class DigestAlgorithms(SequenceOf):
  145. _child_spec = DigestAlgorithm
  146. class EncryptionInfo(Sequence):
  147. _fields = [
  148. ('encryption_info_type', ObjectIdentifier),
  149. ('encryption_info_value', Any),
  150. ]
  151. class PartialHashtree(SequenceOf):
  152. _child_spec = OctetString
  153. class PartialHashtrees(SequenceOf):
  154. _child_spec = PartialHashtree
  155. class ArchiveTimeStamp(Sequence):
  156. _fields = [
  157. ('digest_algorithm', DigestAlgorithm, {'implicit': 0, 'optional': True}),
  158. ('attributes', Attributes, {'implicit': 1, 'optional': True}),
  159. ('reduced_hashtree', PartialHashtrees, {'implicit': 2, 'optional': True}),
  160. ('time_stamp', ContentInfo),
  161. ]
  162. class ArchiveTimeStampSequence(SequenceOf):
  163. _child_spec = ArchiveTimeStamp
  164. class EvidenceRecord(Sequence):
  165. _fields = [
  166. ('version', Version),
  167. ('digest_algorithms', DigestAlgorithms),
  168. ('crypto_infos', Attributes, {'implicit': 0, 'optional': True}),
  169. ('encryption_info', EncryptionInfo, {'implicit': 1, 'optional': True}),
  170. ('archive_time_stamp_sequence', ArchiveTimeStampSequence),
  171. ]
  172. class OtherEvidence(Sequence):
  173. _fields = [
  174. ('oe_type', ObjectIdentifier),
  175. ('oe_value', Any),
  176. ]
  177. class Evidence(Choice):
  178. _alternatives = [
  179. ('tst_evidence', TimeStampTokenEvidence, {'implicit': 0}),
  180. ('ers_evidence', EvidenceRecord, {'implicit': 1}),
  181. ('other_evidence', OtherEvidence, {'implicit': 2}),
  182. ]
  183. class TimeStampedData(Sequence):
  184. _fields = [
  185. ('version', Version),
  186. ('data_uri', IA5String, {'optional': True}),
  187. ('meta_data', MetaData, {'optional': True}),
  188. ('content', OctetString, {'optional': True}),
  189. ('temporal_evidence', Evidence),
  190. ]
  191. class IssuerSerial(Sequence):
  192. _fields = [
  193. ('issuer', GeneralNames),
  194. ('serial_number', Integer),
  195. ]
  196. class ESSCertID(Sequence):
  197. _fields = [
  198. ('cert_hash', OctetString),
  199. ('issuer_serial', IssuerSerial, {'optional': True}),
  200. ]
  201. class ESSCertIDs(SequenceOf):
  202. _child_spec = ESSCertID
  203. class SigningCertificate(Sequence):
  204. _fields = [
  205. ('certs', ESSCertIDs),
  206. ('policies', CertificatePolicies, {'optional': True}),
  207. ]
  208. class SetOfSigningCertificates(SetOf):
  209. _child_spec = SigningCertificate
  210. class ESSCertIDv2(Sequence):
  211. _fields = [
  212. ('hash_algorithm', DigestAlgorithm, {'default': {'algorithm': 'sha256'}}),
  213. ('cert_hash', OctetString),
  214. ('issuer_serial', IssuerSerial, {'optional': True}),
  215. ]
  216. class ESSCertIDv2s(SequenceOf):
  217. _child_spec = ESSCertIDv2
  218. class SigningCertificateV2(Sequence):
  219. _fields = [
  220. ('certs', ESSCertIDv2s),
  221. ('policies', CertificatePolicies, {'optional': True}),
  222. ]
  223. class SetOfSigningCertificatesV2(SetOf):
  224. _child_spec = SigningCertificateV2
  225. EncapsulatedContentInfo._oid_specs['tst_info'] = TSTInfo
  226. EncapsulatedContentInfo._oid_specs['timestamped_data'] = TimeStampedData
  227. ContentInfo._oid_specs['timestamped_data'] = TimeStampedData
  228. ContentType._map['1.2.840.113549.1.9.16.1.4'] = 'tst_info'
  229. ContentType._map['1.2.840.113549.1.9.16.1.31'] = 'timestamped_data'
  230. CMSAttributeType._map['1.2.840.113549.1.9.16.2.12'] = 'signing_certificate'
  231. CMSAttribute._oid_specs['signing_certificate'] = SetOfSigningCertificates
  232. CMSAttributeType._map['1.2.840.113549.1.9.16.2.47'] = 'signing_certificate_v2'
  233. CMSAttribute._oid_specs['signing_certificate_v2'] = SetOfSigningCertificatesV2