Internet Engineering Task Force (IETF) S. Turner
Request for Comments: 6031 IECA
Category: Standards Track R. Housley
ISSN: 2070-1721 Vigil Security
December 2010
Internet Engineering Task Force (IETF) S. Turner
Request for Comments: 6031 IECA
Category: Standards Track R. Housley
ISSN: 2070-1721 Vigil Security
December 2010
Cryptographic Message Syntax (CMS) Symmetric Key Package Content Type
加密消息语法（CMS）对称密钥包内容类型
Abstract
摘要
This document defines the symmetric key format content type. It is transport independent. The Cryptographic Message Syntax (CMS) can be used to digitally sign, digest, authenticate, or encrypt this content type.
本文档定义了对称密钥格式内容类型。它是独立于运输的。加密消息语法（CMS）可用于对此内容类型进行数字签名、摘要、身份验证或加密。
Status of This Memo
关于下段备忘
This is an Internet Standards Track document.
这是一份互联网标准跟踪文件。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。有关互联网标准的更多信息，请参见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6031.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc6031.
Copyright Notice
版权公告
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2010 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction...................................................3
1.1. Requirements Terminology..................................3
1.2. ASN.1 Syntax Notation.....................................3
2. Symmetric Key Package Content Type.............................3
3. PSKC Attributes................................................4
3.1. PSKC Key Package Attributes...............................5
3.1.1. Device Information Attributes........................5
3.1.2. Cryptographic Module Information Attributes..........8
3.2. PSKC Key Attributes.......................................8
3.2.1. Key Identifier.......................................8
3.2.2. Algorithm............................................9
3.2.3. Issuer...............................................9
3.2.4. Key Profile Identifier...............................9
3.2.5. Key Reference Identifier.............................9
3.2.6. Friendly Name.......................................10
3.2.7. Algorithm Parameters................................10
3.2.8. Counter.............................................12
3.2.9. Time................................................13
3.2.10. Time Interval......................................13
3.2.11. Time Drift.........................................13
3.2.12. Value MAC..........................................13
3.2.13. Key User Id........................................14
3.3. Key Policy Attributes....................................14
3.3.1. Key Start Date......................................14
3.3.2. Key Expiry Date.....................................15
3.3.3. Number of Transactions..............................15
3.3.4. Key Usage...........................................15
3.3.5. PIN Policy..........................................16
4. Key Encoding..................................................18
4.1. AES Key Encoding.........................................18
4.2. Triple-DES Key Encoding..................................18
5. Security Considerations.......................................19
6. IANA Considerations...........................................19
7. References....................................................19
7.1. Normative References.....................................19
7.2. Informative References...................................21
Appendix A. ASN.1 Module.........................................22
A.1. Symmetric Key Package ASN.1 Module.......................22
A.2. PSKC ASN.1 Module........................................23
1. Introduction...................................................3
1.1. Requirements Terminology..................................3
1.2. ASN.1 Syntax Notation.....................................3
2. Symmetric Key Package Content Type.............................3
3. PSKC Attributes................................................4
3.1. PSKC Key Package Attributes...............................5
3.1.1. Device Information Attributes........................5
3.1.2. Cryptographic Module Information Attributes..........8
3.2. PSKC Key Attributes.......................................8
3.2.1. Key Identifier.......................................8
3.2.2. Algorithm............................................9
3.2.3. Issuer...............................................9
3.2.4. Key Profile Identifier...............................9
3.2.5. Key Reference Identifier.............................9
3.2.6. Friendly Name.......................................10
3.2.7. Algorithm Parameters................................10
3.2.8. Counter.............................................12
3.2.9. Time................................................13
3.2.10. Time Interval......................................13
3.2.11. Time Drift.........................................13
3.2.12. Value MAC..........................................13
3.2.13. Key User Id........................................14
3.3. Key Policy Attributes....................................14
3.3.1. Key Start Date......................................14
3.3.2. Key Expiry Date.....................................15
3.3.3. Number of Transactions..............................15
3.3.4. Key Usage...........................................15
3.3.5. PIN Policy..........................................16
4. Key Encoding..................................................18
4.1. AES Key Encoding.........................................18
4.2. Triple-DES Key Encoding..................................18
5. Security Considerations.......................................19
6. IANA Considerations...........................................19
7. References....................................................19
7.1. Normative References.....................................19
7.2. Informative References...................................21
Appendix A. ASN.1 Module.........................................22
A.1. Symmetric Key Package ASN.1 Module.......................22
A.2. PSKC ASN.1 Module........................................23
This document defines the symmetric key format content type. It is transport independent. The Cryptographic Message Syntax (CMS) [RFC5652] can be used to digitally sign, digest, authenticate, or encrypt this content type.
本文档定义了对称密钥格式内容类型。它是独立于运输的。加密消息语法（CMS）[RFC5652]可用于对此内容类型进行数字签名、摘要、身份验证或加密。
The use cases that motivated the attributes in this work are elaborated in [RFC6030]. They are omitted to avoid duplication.
[RFC6030]详细阐述了本工作中激发属性的用例。省略它们是为了避免重复。
This document also includes ASN.1 definitions of the Extensible Markup Language (XML) element and attributes defined in [RFC6030].
本文档还包括[RFC6030]中定义的可扩展标记语言（XML）元素和属性的ASN.1定义。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
The key package is defined using the ASN.1 in [X.680], [X.681], [X.682], and [X.683].
密钥包是使用[X.680]、[X.681]、[X.682]和[X.683]中的ASN.1定义的。
The symmetric key package content type is used to transfer one or more plaintext symmetric keys from one party to another. A symmetric key package MAY be encapsulated in one or more CMS protecting content types. This content type MUST be Distinguished Encoding Rules (DER) encoded [X.690].
对称密钥包内容类型用于将一个或多个明文对称密钥从一方传输到另一方。对称密钥包可以封装在一个或多个保护内容类型的CMS中。此内容类型必须采用可分辨编码规则（DER）编码[X.690]。
The symmetric key package content type has the following syntax:
对称密钥包内容类型具有以下语法：
ct-symmetric-key-package CONTENT-TYPE ::=
{ TYPE SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
ct-symmetric-key-package CONTENT-TYPE ::=
{ TYPE SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 }
SymmetricKeyPackage ::= SEQUENCE {
version KeyPkgVersion DEFAULT v1,
sKeyPkgAttrs [0] SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyPkgAttributes }} OPTIONAL,
sKeys SymmetricKeys,
... }
SymmetricKeyPackage ::= SEQUENCE {
version KeyPkgVersion DEFAULT v1,
sKeyPkgAttrs [0] SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyPkgAttributes }} OPTIONAL,
sKeys SymmetricKeys,
... }
SymmetricKeys ::= SEQUENCE SIZE (1..MAX) OF OneSymmetricKey
SymmetricKeys ::= SEQUENCE SIZE (1..MAX) OF OneSymmetricKey
OneSymmetricKey ::= SEQUENCE {
sKeyAttrs SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyAttributes }} OPTIONAL,
sKey OCTET STRING OPTIONAL }
( WITH COMPONENTS { ..., sKeyAttrs PRESENT } |
WITH COMPONENTS { ..., sKey PRESENT } )
OneSymmetricKey ::= SEQUENCE {
sKeyAttrs SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyAttributes }} OPTIONAL,
sKey OCTET STRING OPTIONAL }
( WITH COMPONENTS { ..., sKeyAttrs PRESENT } |
WITH COMPONENTS { ..., sKey PRESENT } )
KeyPkgVersion ::= INTEGER { v1(1) } ( v1, ... )
KeyPkgVersion ::= INTEGER { v1(1) } ( v1, ... )
The SymmetricKeyPackage fields are used as follows:
SymmetricKeyPackage字段的使用方式如下：
- version identifies the version of the symmetric key package content structure. For this version of the specification, the default value, v1, MUST be used.
- 版本标识对称密钥包内容结构的版本。对于此版本的规范，必须使用默认值v1。
- sKeyPkgAttrs optionally provides attributes that apply to all of the symmetric keys in the package. The SKeyPkgAttributes information object set restricts the attributes allowed in sKeyPkgAttrs. If an attribute appears here, then it MUST NOT also be included in sKeyAttrs.
- SkeypkAttrs可选地提供应用于包中所有对称密钥的属性。SkeypkAttributes信息对象集限制SkeypkAttributes中允许的属性。如果此处出现属性，则该属性也不得包含在sKeyAttrs中。
- sKeys contains a sequence of OneSymmetricKey values. This structure is discussed below.
- SKEY包含一系列OneSymmetricKey值。下面讨论这种结构。
The OneSymmetricKey fields are used as follows:
OneSymmetricKey字段的使用方式如下：
- sKeyAttrs optionally provides attributes that apply to one symmetric key. The SKeyAttributes information object set restricts the attributes permitted in sKeyAttrs. If an attribute appears here, then it MUST NOT also be included in sKeyPkgAttrs.
- sKeyAttrs可选地提供应用于一个对称密钥的属性。SKeyAttributes信息对象集限制sKeyAttrs中允许的属性。如果此处出现属性，则该属性也不得包含在SkeypkAttrs中。
- sKey optionally contains the key value encoded as an OCTET STRING.
- sKey可选地包含编码为八位字节字符串的键值。
The OneSymmetricKey field MUST include sKeyAttrs, sKey, or sKeyAttrs and sKey.
OneSymmetricKey字段必须包括SkeyAtrs、sKey或SkeyAtrs和sKey。
The following attributes are defined to assist those using the symmetric key package defined in this document as part of a Dynamic Symmetric Key Provision Protocol (DSKPP) [RFC6063] with Portable Symmetric Key Container (PSKC) attributes. [RFC6030] should be consulted for the definitive attribute descriptions. The attributes fall into three categories. The first category includes attributes that apply to a key package, and these attributes will generally appear in sKeyPkgAttrs. The second category includes attributes that
定义以下属性是为了帮助那些使用本文档中定义的对称密钥包（作为具有可移植对称密钥容器（PSKC）属性的动态对称密钥提供协议（DSKPP）[RFC6063]的一部分）的人。应参考[RFC6030]了解最终属性描述。这些属性分为三类。第一类包括应用于密钥包的属性，这些属性通常会出现在SkeypkAttrs中。第二类包括
apply to a particular key, and these attributes will generally appear in sKeyAttrs. The third category includes attributes that apply to a key policy. Of the attributes defined, only the Key Identifier (Section 3.2.1) and Algorithm (Section 3.2.2) key attributes MUST be included. All other attributes are OPTIONAL.
应用于特定的键，这些属性通常会出现在sKeyAttrs中。第三类包括应用于密钥策略的属性。在定义的属性中，只有关键标识符（第3.2.1节）和算法（第3.2.2节）关键属性必须包括在内。所有其他属性都是可选的。
Like PSKC, the Symmetric Key Content Type supports extensibility. Primarily, this is accomplished through the definition and inclusion of new attributes, but in some instances in which the attribute contains more than one type, the ASN.1 "..." extensibility mechanism is employed.
与PSKC一样，对称密钥内容类型支持可扩展性。这主要是通过定义和包含新属性来实现的，但在某些情况下，如果属性包含多个类型，则使用ASN.1“…”扩展机制。
A straightforward approach to conversion from XML types to ASN.1 is employed. The <xs:string> type converts to UTF8String; the XML <xs:dateTime> type converts to GeneralizedTime; and the XML integer types convert to INTEGER or BinaryTime [RFC6019].
采用了一种从XML类型转换为ASN.1的简单方法。<xs:string>类型转换为UTF8String；XML<xs:dateTime>类型转换为GeneralizedTime；XML整数类型转换为整数或二进制时间[RFC6019]。
PSKC key package attributes apply to an entire key package. These attributes can be categorized by two different attribute collections: device information and cryptographic module attributes. All of these key package attributes are OPTIONAL.
PSKC密钥包属性应用于整个密钥包。这些属性可以通过两种不同的属性集合进行分类：设备信息和加密模块属性。所有这些关键包属性都是可选的。
Device Information attributes, when taken together, MUST uniquely identify a device to which the Symmetric Key Package is provisioned.
设备信息属性组合在一起时，必须唯一标识向其提供对称密钥包的设备。
The Manufacturer attribute indicates the manufacturer of the device. Values for Manufacturer MUST be taken from either [OATHMAN] prefixes (i.e., the left column) or from the IANA Private Enterprise Number Registry [IANAPENREG], using the Organization value. When the value is taken from [OATHMAN] "oath." MUST be prepended to the value (e.g., "oath.<values from [OATHMAN]>"). When the value is taken from [IANAPENREG], "iana." MUST be prepended to the value (e.g., "iana.<Organization value from [IANAPENREG]>"). The attribute definition is as follows:
“制造商”属性表示设备的制造商。制造商的值必须取自[OATHMAN]前缀（即左列）或IANA私有企业编号注册处[IANAPENREG]，使用组织值。当值取自[OATHMAN]时，必须在值前面加上“宣誓”。（例如，“宣誓。<values from[OATHMAN]>”）。当值取自[IANAPENREG]时，必须在值前面加上“iana.”（例如，“iana.<Organization value from[IANAPENREG]>”）。属性定义如下所示：
at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
The Serial Number attribute indicates the serial number of the device. The attribute definition is as follows:
序列号属性表示设备的序列号。属性定义如下所示：
at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
The Model attribute indicates the model of the device. The attribute definition is as follows:
Model属性表示设备的型号。属性定义如下所示：
at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model }
at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model }
id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
The Issue Number attribute contains an issue number to distinguish between two devices with the same serial number. The attribute definition is as follows:
“问题编号”属性包含一个问题编号，用于区分具有相同序列号的两个设备。属性定义如下所示：
at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
The Device Binding attribute provides an opaque identifier that allows keys to be bound to the device or to a class of devices.
Device Binding属性提供一个不透明标识符，允许将密钥绑定到设备或一类设备。
When loading keys into a device, the attribute's value MUST be checked against information provided to the user via out-of-band mechanisms. The implementation then ensures that the correct device or class of device is being used with respect to the provisioned key.
将密钥加载到设备时，必须根据通过带外机制提供给用户的信息检查属性值。然后，该实现确保针对所提供的密钥使用正确的设备或设备类别。
at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
When included in sKeyPkgAttrs, the Device Start Date attribute indicates the start date for a device. The date MUST be represented in a form that matches the dateTime production in "canonical representation" [XMLSCHEMA]. Implementations SHOULD NOT rely on time resolution finer than milliseconds and MUST NOT generate time instants that specify leap seconds. Keys that are on the device SHOULD only be used when the current date is on or after the device start date. The attribute definition is as follows:
当包含在sKeyPkgAttrs中时，“设备开始日期”属性表示设备的开始日期。日期必须以与“规范表示”[XMLSCHEMA]中的日期时间产品相匹配的形式表示。实现不应依赖于小于毫秒的时间分辨率，并且不得生成指定闰秒的时间实例。仅当当前日期在设备开始日期当天或之后时，才应使用设备上的密钥。属性定义如下所示：
at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
Note that usage enforcement of the keys with respect to the dates MAY only happen on the validation server as some devices, such as smart cards, do not have an internal clock. Systems thus SHOULD NOT rely upon the device to enforce key usage date restrictions.
请注意，由于某些设备（如智能卡）没有内部时钟，因此只能在验证服务器上使用与日期相关的密钥。因此，系统不应依赖设备强制执行密钥使用日期限制。
When included in sKeyPkgAttrs, the Device Expiry Date attribute indicates the expiry date for a device. The date MUST be represented in a form that matches the dateTime production in "canonical representation" [XMLSCHEMA]. Implementations SHOULD NOT rely on time resolution finer than milliseconds and MUST NOT generate time instants that specify leap seconds. Keys that are on the device SHOULD only be used when the current date is before the device expiry date. The attribute definition is as follows:
当包含在SkeypkAttrs中时，“设备到期日”属性表示设备的到期日。日期必须以与“规范表示”[XMLSCHEMA]中的日期时间产品相匹配的形式表示。实现不应依赖于小于毫秒的时间分辨率，并且不得生成指定闰秒的时间实例。仅当当前日期在设备到期日期之前时，才应使用设备上的密钥。属性定义如下所示：
at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 } Note
that usage enforcement of the keys with respect to the dates MAY only
happen on the validation server as some devices, such as smart cards,
do not have an internal clock. Systems thus SHOULD NOT rely upon the
device to enforce key usage date restrictions.
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 } Note
that usage enforcement of the keys with respect to the dates MAY only
happen on the validation server as some devices, such as smart cards,
do not have an internal clock. Systems thus SHOULD NOT rely upon the
device to enforce key usage date restrictions.
The Device User Id attribute indicates the user with whom the device is associated using a distinguished name, as defined in [RFC4514]. For example: UID=jsmith,DC=example,DC=net. The attribute definition is as follows:
设备用户Id属性表示使用可分辨名称与设备关联的用户，如[RFC4514]中所定义。例如：UID=jsmith，DC=example，DC=net。属性定义如下所示：
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
As specified in [RFC6030], there are no semantics associated with this element, i.e., there are no checks enforcing that only a specific user can use this device. As such, this element is for informational purposes only.
如[RFC6030]所述，没有与此元素相关的语义，即没有强制执行只有特定用户才能使用此设备的检查。因此，此元素仅供参考。
Cryptographic Module attributes uniquely identify a cryptographic module. This is useful when the device contains more than one cryptographic module. At this time, only one attribute is defined.
加密模块属性唯一标识加密模块。当设备包含多个加密模块时，这非常有用。此时，只定义了一个属性。
When included in sKeyPkgAttrs, the Cryptographic Module Identifier attribute uniquely identifies the cryptographic module to which the key is being or was provisioned. The attribute definition is as follows:
当包含在SkeypkAttrs中时，Cryptographic Module Identifier属性唯一标识正在或已向其提供密钥的加密模块。属性定义如下所示：
at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
PSKC key attributes apply to a specific key. As noted earlier, the Key Identifier (Section 3.2.1) and Algorithm (Section 3.2.2) key attributes are REQUIRED. All other attributes are OPTIONAL.
PSKC密钥属性应用于特定密钥。如前所述，需要密钥标识符（第3.2.1节）和算法（第3.2.2节）密钥属性。所有其他属性都是可选的。
When included in sKeyAttrs, the Key Identifier attribute identifies the key in the context of key provisioning exchanges between two parties. This means that if PSKC is used in multiple interactions between a sending and receiving party, using different containers referencing the same keys, the KeyId MUST use the same KeyId values (e.g., after initial provisioning, if a system wants to update key metadata values in the other system, the KeyId value of the key where the metadata is to be updates MUST be the same as the original KeyId value provisioned). The attribute definition is as follows:
当包含在sKeyAttrs中时，密钥标识符属性在双方之间的密钥供应交换上下文中标识密钥。这意味着，如果在发送方和接收方之间的多个交互中使用PSKC，并且使用引用相同密钥的不同容器，则KeyId必须使用相同的KeyId值（例如，初始设置后，如果一个系统要更新另一个系统中的密钥元数据值，则要更新元数据的密钥的KeyId值必须与设置的原始KeyId值相同）。属性定义如下：
at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
The Algorithm attribute uniquely identifies the PSKC algorithm profile. [RFC6030] defines two algorithm profiles "HOTP" and "PIN". The attribute definition is as follows:
“算法”属性唯一标识PSKC算法配置文件。[RFC6030]定义了两个算法配置文件“HOTP”和“PIN”。属性定义如下所示：
at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
The Issuer attribute names the entity that issued the key. The attribute definition is as follows:
Issuer属性命名发出密钥的实体。属性定义如下所示：
at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
The Key Profile Identifier attribute carries a unique identifier used between the sending and receiving parties to establish a set of key attribute values that are not transmitted within the container but are agreed upon between the two parties out of band. This attribute will then represent the unique reference to a set of key attribute values.
密钥配置文件标识符属性携带在发送方和接收方之间使用的唯一标识符，以建立一组密钥属性值，这些密钥属性值不是在容器内传输的，而是在带外双方之间商定的。然后，该属性将表示对一组关键属性值的唯一引用。
at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
The Key Reference attribute refers to an external key to be used with a key derivation scheme and no specific key value (secret) is transported; only the reference to the external master key is used (e.g., the PKCS #11 key label).
密钥引用属性是指与密钥派生方案一起使用的外部密钥，并且不传输特定的密钥值（secret）；仅使用对外部主密钥的引用（例如PKCS#11密钥标签）。
at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
The Friendly Name attribute contains a human-readable name for the secret key. The attribute definition is as follows:
Friendly Name属性包含密钥的可读名称。属性定义如下所示：
at-pskc-friendlyName ATTRIBUTE ::= {
TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
at-pskc-friendlyName ATTRIBUTE ::= {
TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
The Friendly Name attribute has the following syntax:
友好名称属性具有以下语法：
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
The text is encoded in UTF-8 [RFC3629], which accommodates most of the world's writing systems. The friendlyNameLangTag field identifies the language used to express the friendlyName. When the friendlyNameLangTag field is absent, English, whose associated language tag is "en", is used. The value of the friendlyNameLangTag field MUST be a language tag, as described in [RFC5646].
文本采用UTF-8[RFC3629]编码，可容纳世界上大多数书写系统。FriendlyNameTag字段标识用于表示friendlyName的语言。当friendlyNameLangTag字段不存在时，将使用关联语言标记为“en”的英语。friendlyNameLangTag字段的值必须是语言标记，如[RFC5646]中所述。
The Algorithm Parameters attribute contains parameters that influence the result of the algorithmic computation, for example, response truncation and format in One-Time Password (OTP) and Challenge/Response (CR) algorithms.
“算法参数”属性包含影响算法计算结果的参数，例如，一次性密码（OTP）和质询/响应（CR）算法中的响应截断和格式。
at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParams }
at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParams }
id-pskc-algorithmParams OBJECT IDENTIFIER ::= { id-pskc 15 }
id-pskc-algorithmParams OBJECT IDENTIFIER ::= { id-pskc 15 }
The Algorithm Parameters attribute has the following syntax:
“算法参数”属性具有以下语法：
PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String,
challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat,
... }
PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String,
challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat,
... }
ChallengeFormat ::= SEQUENCE {
encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX),
max INTEGER (0..MAX),
... }
ChallengeFormat ::= SEQUENCE {
encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX),
max INTEGER (0..MAX),
... }
Encoding ::= UTF8STRING ("DECIMAL" | "HEXADECIMAL" |
"ALPHANUMERIC" |"BASE64" |"BINARY")
Encoding ::= UTF8STRING ("DECIMAL" | "HEXADECIMAL" |
"ALPHANUMERIC" |"BASE64" |"BINARY")
ResponseFormat ::= SEQUENCE {
encoding Encoding,
length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE,
... }
ResponseFormat ::= SEQUENCE {
encoding Encoding,
length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE,
... }
The fields in PSKCAlgorithmParameters have the following meanings:
PSKCAlgorithmParameters中的字段具有以下含义：
o Suite defines additional characteristics of the algorithm used, which are algorithm specific. For example, in an HMAC-based (Hashed Message Authentication Code) OTP algorithm it could designate the strength of the hash algorithm used (SHA1, SHA256, etc.). Please refer to the algorithm profile specification [RFC6030] for the exact semantics of the value for each algorithm profile.
o 套件定义了所用算法的其他特性，这些特性是特定于算法的。例如，在基于HMAC（哈希消息认证码）的OTP算法中，它可以指定所用哈希算法的强度（SHA1、SHA256等）。请参考算法配置文件规范[RFC6030]，了解每个算法配置文件的值的确切语义。
o ChallengeFormat defines the characteristics of the challenge in a CR usage scenario, whereby the following fields are defined:
o ChallengeFormat定义CR使用场景中质询的特征，其中定义了以下字段：
o encoding specifies the encoding of the challenge accepted by the device and MUST be one of the following values: DECIMAL, HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. The BASE64 encoding is done as in Section 4 of [RFC4648].
o 编码指定设备接受的质询的编码，并且必须是以下值之一：十进制、十六进制、字母数字、BASE64或二进制。BASE64编码按照[RFC4648]的第4节进行。
o checkDigit indicates whether a device needs to check the appended Luhn check digit, as defined in [ISOIEC7812], contained in a challenge. The checkDigit MUST NOT be present if the encoding value is anything other than 'DECIMAL'. A value of TRUE indicates that the device will check the appended Luhn check digit in a provided challenge. A value of FALSE indicates that the device will not check the appended Luhn check digit in the challenge.
o checkDigit表示设备是否需要检查[ISOIEC7812]中定义的、包含在质询中的附加Luhn校验位。如果编码值不是“DECIMAL”，则校验位不得存在。值为TRUE表示设备将在提供的质询中检查附加的Luhn校验位。值FALSE表示设备不会检查质询中附加的Luhn校验位。
o min defines the minimum size of the challenge accepted by the device for CR mode. If encoding is 'DECIMAL', 'HEXADECIMAL', or 'ALPHANUMERIC', this value indicates the minimum number of digits/characters. If encoding is 'BASE64' or 'BINARY', this value indicates the minimum number of bytes of the unencoded value.
o min定义设备在CR模式下接受的质询的最小大小。如果编码为“十进制”、“十六进制”或“字母数字”，则此值表示最小位数/字符数。如果编码为“BASE64”或“BINARY”，则此值表示未编码值的最小字节数。
o max defines the maximum size of the challenge accepted by the device for CR mode. If encoding is 'DECIMAL', 'HEXADECIMAL', or 'ALPHANUMERIC', this value indicates the maximum number of digits/characters. If the encoding is 'BASE64' or 'BINARY', this value indicates the maximum number of bytes of the unencoded value.
o max定义设备在CR模式下接受的质询的最大大小。如果编码为“十进制”、“十六进制”或“字母数字”，则此值表示最大位数/字符数。如果编码为“BASE64”或“BINARY”，则此值表示未编码值的最大字节数。
o ResponseFormat defines the characteristics of the result of a computation and defines the format of the OTP or the response to a challenge. For cases where the key is a personal identification number (PIN) value, this element contains the format of the PIN itself (e.g., DECIMAL, length 4 for a 4 digit PIN). The following fields are defined:
o ResponseFormat定义计算结果的特征，并定义OTP或质询响应的格式。对于密钥为个人识别号（PIN）值的情况，此元素包含PIN本身的格式（例如，十进制，4位PIN的长度为4）。定义了以下字段：
o encoding specifies the encoding of the response generated by the device and MUST be one of the following values: DECIMAL, HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. BASE64 is defined as in Section 4 of [RFC4648].
o 编码指定设备生成的响应的编码，并且必须是以下值之一：十进制、十六进制、字母数字、BASE64或二进制。BASE64的定义见[RFC4648]第4节。
o length defines the length of the response generated by the device. If encoding is 'DECIMAL', 'HEXADECIMAL', or 'ALPHANUMERIC', this value indicates the number of digits/characters. If encoding is 'BASE64' or 'BINARY', this value indicates the number of bytes of the unencoded value.
o 长度定义设备生成的响应的长度。如果编码为“十进制”、“十六进制”或“字母数字”，则此值表示位数/字符数。如果编码为“BASE64”或“BINARY”，则此值表示未编码值的字节数。
o checkDigit indicates whether the device needs to append a Luhn check digit, as defined in [ISOIEC7812], to the response. This is only valid if the encoding attribute is 'DECIMAL'. If the value is TRUE, then the device will append a Luhn check digit to the response. If the value is FALSE, then the device will not append a Luhn check digit to the response.
o checkDigit表示设备是否需要向响应追加[ISOIEC7812]中定义的Luhn校验位。这仅在编码属性为“DECIMAL”时有效。如果该值为TRUE，则设备将在响应中附加一个Luhn校验位。如果该值为FALSE，则设备不会在响应中附加Luhn校验位。
The Counter attribute contains the event counter for event-based OTP algorithms. The attribute definition is as follows:
计数器属性包含基于事件的OTP算法的事件计数器。属性定义如下所示：
at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter }
at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
The Time attribute conveys the time for time-based OTP algorithms. If the Time Interval attribute is included, then this element carries the number of time intervals passed for a specific start point. If the time interval is used, then this element carries the number of time intervals passed from a specific start point, normally it is algorithm dependent. It uses the BinaryTime syntax from [RFC6019]. The attribute definition is as follows:
时间属性表示基于时间的OTP算法的时间。如果包含Time Interval属性，则此元素包含为特定起点传递的时间间隔数。如果使用时间间隔，则此元素包含从特定起点经过的时间间隔数，通常取决于算法。它使用[RFC6019]中的二进制时间语法。属性定义如下所示：
at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time }
at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
The Time Interval attribute conveys the time interval value for time-based OTP algorithms in seconds (e.g., a value of 30 for this would indicate a time interval of 30 seconds). It is an integer. The attribute definition is as follows:
“时间间隔”属性以秒为单位传递基于时间的OTP算法的时间间隔值（例如，30表示30秒的时间间隔）。它是一个整数。属性定义如下所示：
at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
The Time Drift attribute contains the device clock drift value for time-based OTP algorithms. It is an integer, either positive or negative, that indicates the number of time intervals that a validation server has established that the device clock drifted after the last successful authentication. The attribute definition is as follows:
时间漂移属性包含基于时间的OTP算法的设备时钟漂移值。它是一个整数，可以是正的，也可以是负的，表示验证服务器在上次成功身份验证后确定设备时钟漂移的时间间隔数。属性定义如下所示：
at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
The Value MAC attribute is a Message Authentication Code (MAC) generated from the encrypted value in the case that the encryption algorithm does not support integrity checks (e.g., AES-CBC does not provide integrity while AES Key Wrap with a message length indicator (MLI) does). The attribute definition is as follows:
值MAC属性是在加密算法不支持完整性检查（例如，AES-CBC不提供完整性，而AES密钥使用消息长度指示符（MLI）包装）的情况下，从加密值生成的消息认证码（MAC）。属性定义如下所示：
at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
ValueMac ::= SEQUENCE {
macAlgorithm UTF8String,
mac UTF8String }
ValueMac ::= SEQUENCE {
macAlgorithm UTF8String,
mac UTF8String }
The fields in ValueMac have the following meanings:
ValueMac中的字段具有以下含义：
o macAlgorithm identifies the MAC algorithm used to generate the value placed in digest.
o macAlgorithm识别用于生成放置在摘要中的值的MAC算法。
o mac is the base64-encoded, as specified in Section 4 of [RFC4648], mac value.
o mac是按照[RFC4648]mac值第4节的规定编码的base64。
The Key User Id attribute indicates the user with whom the key is associated using a distinguished name, as defined in [RFC4514]. For example, UID=jsmith,DC=example,DC=net. The attribute definition is as follows:
密钥用户Id属性表示使用[RFC4514]中定义的可分辨名称与密钥关联的用户。例如，UID=jsmith，DC=example，DC=net。属性定义如下所示：
at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
As specified in [RFC6030], there are no semantics associated with this element, i.e., there are no checks enforcing that only a specific user can use this key. As such, this element is for informational purposes only.
如[RFC6030]中所述，没有与此元素相关的语义，即没有强制执行只有特定用户才能使用此密钥的检查。因此，此元素仅供参考。
Key policy attributes indicate a policy that can be attached to a key. These attributes are defined in the subsections that follow.
密钥策略属性表示可以附加到密钥的策略。这些属性在下面的小节中定义。
When included in sKeyAttrs, the Key Start Date attribute indicates the start of the key's validity period. The date MUST be represented in a form that matches the dateTime production in "canonical representation" [XMLSCHEMA]. Implementations SHOULD NOT rely on time resolution finer than milliseconds and MUST NOT generate time instants that specify leap seconds. The attribute definition is as follows:
当包含在sKeyAttrs中时，“密钥开始日期”属性表示密钥有效期的开始。日期必须以与“规范表示”[XMLSCHEMA]中的日期时间产品相匹配的形式表示。实现不应依赖于小于毫秒的时间分辨率，并且不得生成指定闰秒的时间实例。属性定义如下所示：
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
When included in sKeyAttrs, the Key Expiry Date attribute indicates the end of the key's validity period. The date MUST be represented in a form that matches the dateTime production in "canonical representation" [XMLSCHEMA]. Implementations SHOULD NOT rely on time resolution finer than milliseconds and MUST NOT generate time instants that specify leap seconds. The attribute definition is as follows:
当包含在sKeyAttrs中时，密钥到期日期属性表示密钥有效期的结束。日期必须以与“规范表示”[XMLSCHEMA]中的日期时间产品相匹配的形式表示。实现不应依赖于小于毫秒的时间分辨率，并且不得生成指定闰秒的时间实例。属性定义如下所示：
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
The Number of Transactions attribute indicates the maximum number of times a key carried within the package can be used. When this element is omitted, there is no restriction regarding the number of times a key can be used. The attribute definition is as follows:
Number of Transactions属性表示包中携带的密钥可以使用的最大次数。如果省略此元素，则对密钥的使用次数没有限制。属性定义如下所示：
at-pskc-noOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-noOfTransactions }
at-pskc-noOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-noOfTransactions }
id-pskc-noOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
id-pskc-noOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
The Key Usage attribute constrains the intended usage of the key. The recipient MUST enforce the key usage. The attribute definition is as follows:
“密钥用法”属性约束密钥的预期用法。收件人必须强制使用密钥。属性定义如下所示：
at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate")
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate")
The fields in PSKCKeyUsage have the following meanings:
PSKCKeyUsage中的字段具有以下含义：
o OTP: The key MUST only be used for OTP generation.
o OTP：密钥只能用于生成OTP。
o CR: The key MUST only be used for Challenge/Response purposes.
o CR：密钥只能用于质询/响应目的。
o Encrypt: The key MUST only be used for data encryption purposes.
o 加密：密钥只能用于数据加密目的。
o Integrity: The key MUST only be used to generate a keyed message digest for data integrity or authentication purposes.
o 完整性：密钥必须仅用于生成用于数据完整性或身份验证目的的密钥消息摘要。
o Verify: The key MUST only be used to verify a keyed message digest for data integrity or authentication purposes (is the converse of Integrity).
o 验证：密钥必须仅用于出于数据完整性或身份验证目的验证密钥消息摘要（与完整性相反）。
o Unlock: The key MUST only be used for an inverse Challenge/Response in the case in which a user has locked the device by entering an incorrect PIN too many times (for devices with PIN-input capability).
o 解锁：只有在用户多次输入错误PIN锁定设备的情况下（对于具有PIN输入功能的设备），钥匙才能用于反向质询/响应。
o Decrypt: The key MUST only be used for data decryption purposes.
o 解密：密钥只能用于数据解密目的。
o KeyWrap: The key MUST only be used for key wrap purposes.
o 密钥换行：密钥只能用于密钥换行目的。
o Unwrap: The key MUST only be used for key unwrap purposes.
o 展开：密钥只能用于密钥展开目的。
o Derive: The key MUST only be used with a key derivation function to derive a new key (see also Section 8.2.4 of [NIST800-57]).
o 派生：密钥只能与密钥派生函数一起使用，以派生新密钥（另请参见[NIST800-57]第8.2.4节）。
o Generate: The key MUST only be used to generate a new key based on a random number and the previous value of the key (see also Section 8.1.5.2.1 of [NIST800-57]).
o 生成：密钥只能用于根据随机数和密钥的先前值生成新密钥（另请参见[NIST800-57]第8.1.5.2.1节）。
The PIN Policy attribute allows policy about the PIN usage to be associated with the key. The attribute definition is as follows:
PIN策略属性允许有关PIN使用的策略与密钥相关联。属性定义如下所示：
at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL }
PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL }
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append" |
"Algorithmic")
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append" |
"Algorithmic")
The fields in PIN Policy have the following meanings:
PIN策略中的字段具有以下含义：
o pinKeyId uniquely identifies the key held within this container that contains the value of the PIN that protects the key.
o pinKeyId唯一标识此容器中包含保护密钥的PIN值的密钥。
o pinUsageMode indicates the way the PIN is used during the usage of the key. The following values are defined in [RFC6030]: Local, Prepend, Append, and Algorithmic.
o pinUsageMode表示在使用密钥期间使用PIN的方式。[RFC6030]中定义了以下值：Local、Prepend、Append和Algorithmic。
o maxFailedAttempts indicates the maximum number of times the PIN may be entered incorrectly before it MUST NOT be possible to use the key anymore (reasonable values are in the positive integer range of at least 2 and no more than 10).
o maxFailedAttempts表示在不能再使用密钥之前，PIN可能被错误输入的最大次数（合理值在至少2到不超过10的正整数范围内）。
o minLength indicates the minimum length of a PIN that can be set to protect the associated key. It MUST NOT be possible to set a PIN shorter than this value. If pinEncoding is 'DECIMAL', 'HEXADECIMAL', or 'ALPHANUMERIC', this value indicates the number of digits/ characters. If pinEncoding is 'BASE64' or 'BINARY', this value indicates the number of bytes of the unencoded value.
o minLength表示可设置为保护关联密钥的PIN的最小长度。不能将管脚设置为小于此值。如果PINENCODE为“十进制”、“十六进制”或“字母数字”，则此值表示位数/字符数。如果pinencode为“BASE64”或“BINARY”，则此值表示未编码值的字节数。
o maxLength indicates the maximum length of a PIN that can be set to protect this key. It MUST NOT be possible to set a PIN longer than this value. If pinEncoding is 'DECIMAL', 'HEXADECIMAL', or 'ALPHANUMERIC', this value indicates the number of digits/characters. If the pinEncoding is 'BASE64' or 'BINARY', this value indicates the number of bytes of the unencoded value.
o maxLength表示可设置为保护此密钥的PIN的最大长度。不能将管脚设置为长于此值。如果PINENCODE为“十进制”、“十六进制”或“字母数字”，则此值表示位数/字符数。如果pinencode为“BASE64”或“BINARY”，则该值表示未编码值的字节数。
o pinEncoding is based on Encoding, which is defined in Section 3.2.7, and specifies encoding of the PIN and MUST be one of the following values: DECIMAL, HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY.
o PiNencode基于第3.2.7节中定义的编码，并指定PIN的编码，并且必须是以下值之一：十进制、十六进制、字母数字、BASE64或二进制。
If pinUsageMode is set to "Local", then the device MUST enforce the restriction indicated in maxFailedAttempts, minLength, maxLength, and pinEncoding; otherwise, it MUST be enforced on the server side.
如果pinUsageMode设置为“本地”，则设备必须强制执行maxFailedAttempts、minLength、maxLength和Pinencode中指示的限制；否则，必须在服务器端强制执行。
Two parties receiving the same key as an sKey OCTET STRING must make use of the key in exactly the same way in order to interoperate. To ensure that this occurs, it is necessary to define a correspondence between the abstract syntax of sKey and the notation in the standard algorithm description that defines how the key is used. The next sections establish that correspondence for the AES algorithm [FIPS197] and the Triple Data Encryption Algorithm (TDEA or Triple DES) [SP800-67].
接收与sKey八位字节字符串相同密钥的双方必须以完全相同的方式使用密钥，以便进行互操作。为了确保发生这种情况，有必要定义sKey的抽象语法与标准算法描述中定义密钥使用方式的符号之间的对应关系。下一节将确定AES算法[FIPS197]和三重数据加密算法（TDEA或三重DES）[SP800-67]的对应关系。
[FIPS197], Section 5.2, titled "Key Expansion", uses the input key as an array of bytes indexed starting at 0. The first octet of sKey SHALL become the key byte in the AES, labeled index 0 in [FIPS197]; the succeeding octets of sKey SHALL become key bytes in AES, in increasing index order.
[FIPS197]第5.2节标题为“密钥扩展”，将输入密钥用作从0开始索引的字节数组。sKey的第一个八位字节应成为AES中的关键字节，在[FIPS197]中标记为索引0；sKey的后续八位字节将以递增的索引顺序成为AES中的关键字节。
Proper parsing and key load of the contents of sKey for AES SHALL be determined by using the following sKey OCTET STRING to generate and match the key expansion test vectors in [FIPS197], Appendix A, for AES Cipher Key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
AES sKey内容的正确解析和密钥加载应通过使用以下sKey八位字节字符串来确定，以生成并匹配[FIPS197]附录A中AES密码密钥的密钥扩展测试向量：2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
Tag Length Value 04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
标签长度值04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
A Triple-DES key consists of three keys for the cryptographic engine (Key1, Key2, and Key3) that are each 64 bits (56 key bits and 8 parity bits); the three keys are also collectively referred to as a key bundle [SP800-67]. A key bundle may employ either two or three independent keys. When only two independent keys are employed (called two-key Triple DES), the same value is used for Key1 and Key3.
三重DES密钥由加密引擎的三个密钥（密钥1、密钥2和密钥3）组成，每个密钥为64位（56个密钥位和8个奇偶校验位）；这三个密钥也统称为密钥包[SP800-67]。密钥包可以使用两个或三个独立的密钥。当仅使用两个独立键（称为双键三重DES）时，相同的值用于键1和键3。
Each key in a Triple-DES key bundle is expanded into a key schedule according to a procedure defined in [SP800-67], Appendix A. That procedure numbers the bits in the key from 1 to 64, with number 1 being the leftmost, or most significant bit (MSB). The first octet of sKey SHALL be bits 1 through 8 of Key1 with bit 1 being the MSB. The second octet of sKey SHALL be bits 9 through 16 of Key1, and so forth, so that the trailing octet of sKey SHALL be bits 57 through 64 of Key3 (or Key2 for two-key Triple DES).
根据附录a[SP800-67]中定义的程序，三重DES密钥束中的每个密钥都被扩展为密钥计划。该程序将密钥中的位从1到64进行编号，数字1为最左边或最高有效位（MSB）。sKey的第一个八位字节应为Key1的第1位到第8位，第1位为MSB。sKey的第二个八位字节应为Key1的第9位到第16位，依此类推，因此sKey的后续八位字节应为Key3的第57位到第64位（或两个三重键的Key2）。
Proper parsing and key load of the contents of sKey for Triple DES SHALL be determined by using the following sKey OCTET STRING to generate and match the key expansion test vectors in [SP800-67], Appendix B, for the key bundle:
三重DES的sKey内容的正确解析和密钥加载应通过使用以下sKey八位组字符串来确定，以生成并匹配[SP800-67]附录B中密钥束的密钥扩展测试向量：
Key1 = 0123456789ABCDEF
Key1 = 0123456789ABCDEF
Key2 = 23456789ABCDEF01
Key2 = 23456789ABCDEF01
Key3 = 456789ABCDEF0123
Key3 = 456789ABCDEF0123
Tag Length Value 04 24 0123456789ABCDEF 23456789ABCDEF01 456789ABCDEF0123
标签长度值04 24 0123456789ABCDEF 23456789ABCDEF01 4567889ABCDEF0123
Implementers of this protocol are strongly encouraged to consider generally accepted principles of secure key management when integrating this capability within an overall security architecture.
该协议的实施者被强烈鼓励考虑在整体安全体系结构中集成该能力时普遍接受的安全密钥管理原则。
The symmetric key package contents are not protected. This content type can be combined with a security protocol to protect the contents of the package. One possibility is to include this content type in place of a PSKC package in [RFC6063] exchanges. In this case, the algorithm requirements are found in those documents. Another possibility is to encapsulate this content type in a CMS [RFC5652] protecting content type.
对称密钥包内容不受保护。此内容类型可以与安全协议结合使用，以保护包的内容。一种可能性是在[RFC6063]交换中包含此内容类型以代替PSKC包。在这种情况下，算法要求可以在这些文档中找到。另一种可能是将此内容类型封装在CMS[RFC5652]保护内容类型中。
This document makes use of object identifiers to identify a CMS content type (Appendix A.1), the ASN.1 version of the PSKC attributes (Appendix A.2), and the ASN.1 modules found in Appendix A.1 and A.2.
本文件利用对象标识符识别CMS内容类型（附录a.1）、PSKC属性的ASN.1版本（附录a.2）以及附录a.1和a.2中的ASN.1模块。
All OIDs are registered in an arc delegated by RSADSI to the SMIME Working Group.
所有OID都在RSADSI委托给SMIME工作组的arc中注册。
[FIPS197] National Institute of Standards. "FIPS Pub 197: Advanced Encryption Standard (AES)", 26 November 2001.
[FIPS197]国家标准协会。“FIPS Pub 197：高级加密标准（AES）”，2001年11月26日。
[IANAPENREG] IANA, "Private Enterprise Numbers", <http://www.iana.org>.
[IANAPENREG]IANA，“私营企业编号”<http://www.iana.org>.
[ISOIEC7812] ISO, "ISO/IEC 7812-1:2006 Identification cards -- Identification of issuers -- Part 1: Numbering system", October 2006, <http://www.iso.org/iso/iso_catalogue/ catalogue_tc/catalogue_detail.htm?csnumber=39698>.
[ISOIEC7812]ISO，“ISO/IEC 7812-1:2006识别卡——发卡机构的识别——第1部分：编号系统”，2006年10月<http://www.iso.org/iso/iso_catalogue/ catalog\u tc/catalog\u detail.htm？csnumber=39698>。
[OATHMAN] OATH, "List of OATH Manufacturer Prefixes (omp)", April 2009, <http://www.openauthentication.org/ oath-id/prefixes>.
[OATHMAN]宣誓，“宣誓制造商前缀列表（omp）”，2009年4月<http://www.openauthentication.org/ 誓言id/前缀>。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[RFC3629]Yergeau，F.，“UTF-8，ISO 10646的转换格式”，STD 63，RFC 3629，2003年11月。
[RFC4514] Zeilenga, K., Ed., "Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names", RFC 4514, June 2006.
[RFC4514]Zeilenga，K.，Ed.“轻量级目录访问协议（LDAP）：可分辨名称的字符串表示”，RFC4514，2006年6月。
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, October 2006.
[RFC4648]Josefsson，S.，“Base16、Base32和Base64数据编码”，RFC4648，2006年10月。
[RFC5646] Phillips, A., Ed., and M. Davis, Ed., "Tags for Identifying Languages", BCP 47, RFC 5646, September 2009.
[RFC5646]Phillips，A.，Ed.，和M.Davis，Ed.，“识别语言的标签”，BCP 47，RFC 5646，2009年9月。
[RFC5911] Hoffman, P. and J. Schaad, "New ASN.1 Modules for Cryptographic Message Syntax (CMS) and S/MIME", RFC 5911, June 2010.
[RFC5911]Hoffman，P.和J.Schaad，“用于加密消息语法（CMS）和S/MIME的新ASN.1模块”，RFC 59112010年6月。
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010.
[RFC5912]Hoffman，P.和J.Schaad，“使用X.509（PKIX）的公钥基础设施的新ASN.1模块”，RFC 5912，2010年6月。
[RFC6019] Housley, R., "BinaryTime: An Alternate Format for Representing Date and Time in ASN.1", RFC 6019, September 2010.
[RFC6019]Housley，R.，“二进制时间：在ASN.1中表示日期和时间的替代格式”，RFC 6019，2010年9月。
[RFC6030] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric Key Container (PSKC)", RFC 6030, October 2010.
[RFC6030]Hoyer，P.，Pei，M.和S.Machani，“便携式对称密钥容器（PSKC）”，RFC 603012010年10月。
[SP800-67] National Institute of Standards and Technology, "NIST Special Publication 800-67 Version 1.1: Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher", NIST Special Publication 800-67, May 2008.
[SP800-67]国家标准与技术研究所，“NIST特别出版物800-67版本1.1：三重数据加密算法（TDEA）分组密码建议”，NIST特别出版物800-67，2008年5月。
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824- 1:2002. Information Technology - Abstract Syntax Notation One.
[X.680]ITU-T建议X.680（2002）| ISO/IEC 8824-1:2002。信息技术.抽象语法符号1。
[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824- 2:2002. Information Technology - Abstract Syntax Notation One: Information Object Specification.
[X.681]ITU-T建议X.681（2002）| ISO/IEC 8824-2:2002。信息技术.抽象语法符号1:信息对象规范。
[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824- 3:2002. Information Technology - Abstract Syntax Notation One: Constraint Specification.
[X.682]ITU-T建议X.682（2002）| ISO/IEC 8824-3:2002。信息技术.抽象语法符号1:约束规范。
[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824- 4:2002. Information Technology - Abstract Syntax Notation One: Parameterization of ASN.1 Specifications.
[X.683]ITU-T建议X.683（2002）| ISO/IEC 8824-4:2002。信息技术.抽象语法符号1:ASN.1规范的参数化。
[X.690] ITU-T Recommendation X.690 (2002) | ISO/IEC 8825- 1:2002. Information Technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER).
[X.690]ITU-T建议X.690（2002）| ISO/IEC 8825-1:2002。信息技术.ASN.1编码规则：基本编码规则（BER）、规范编码规则（CER）和区分编码规则（DER）的规范。
[XMLSCHEMA] Malhotra, A. and P. Biron, "XML Schema Part 2: Datatypes Second Edition", World Wide Web Consortium Recommendation REC-xmlschema-2-20041082, October 2004, <http://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.
[XMLSCHEMA]Malhotra，A.和P.Biron，“XML模式第2部分：数据类型第二版”，万维网联盟建议REC-XMLSCHEMA-2-20041082，2004年10月<http://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.
[NIST800-57] National Institute of Standards and Technology, "NIST Special Publication 800-57, Recommendation for Key Management - Part 1: General (Revised)", NIST Special Publication 800-57, March 2007.
[NIST 800-57]国家标准与技术研究所，“NIST特别出版物800-57，关键管理建议-第1部分：总则（修订）”，NIST特别出版物800-57，2007年3月。
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70, RFC 5652, September 2009.
[RFC5652]Housley，R.，“加密消息语法（CMS）”，STD 70，RFC 56522009年9月。
[RFC6063] Doherty, A., Pei, M., Machani, S., and M. Nystrom, "Dynamic Symmetric Key Provisioning Protocol (DSKPP)", RFC 6063, December 2010.
[RFC6063]Doherty，A.，Pei，M.，Machani，S.，和M.Nystrom，“动态对称密钥供应协议（DSKPP）”，RFC 6063，2010年12月。
This appendix provides the normative ASN.1 definitions for the structures described in this specification using ASN.1 as defined in [X.680], [X.681], [X.682], and [X.683].
本附录使用[X.680]、[X.681]、[X.682]和[X.683]中定义的ASN.1为本规范中描述的结构提供了规范性ASN.1定义。
SymmetricKeyPackageModulev1
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-symmetricKeyPkgV1(33) }
SymmetricKeyPackageModulev1
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-symmetricKeyPkgV1(33) }
DEFINITIONS IMPLICIT TAGS ::=
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
开始
-- EXPORTS ALL
--全部出口
IMPORTS
进口
-- From New PKIX ASN.1 [RFC5912]
--来自新的PKIX ASN.1[RFC5912]
ATTRIBUTE
FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) }
ATTRIBUTE
FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) }
-- From New SMIME ASN.1 [RFC5911]
--来自新SMIME ASN.1[RFC5911]
CONTENT-TYPE, Attribute{}
FROM CryptographicMessageSyntax-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-cms-2004-02(41) }
CONTENT-TYPE, Attribute{}
FROM CryptographicMessageSyntax-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-cms-2004-02(41) }
;
;
ContentSet CONTENT-TYPE ::= {
ct-symmetric-key-package,
... -- Expect additional content types --
}
ContentSet CONTENT-TYPE ::= {
ct-symmetric-key-package,
... -- Expect additional content types --
}
ct-symmetric-key-package CONTENT-TYPE ::=
{ TYPE SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
ct-symmetric-key-package CONTENT-TYPE ::=
{ TYPE SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 }
SymmetricKeyPackage ::= SEQUENCE {
version KeyPkgVersion DEFAULT v1,
sKeyPkgAttrs [0] SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyPkgAttributes }} OPTIONAL,
sKeys SymmetricKeys,
... }
SymmetricKeyPackage ::= SEQUENCE {
version KeyPkgVersion DEFAULT v1,
sKeyPkgAttrs [0] SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyPkgAttributes }} OPTIONAL,
sKeys SymmetricKeys,
... }
SymmetricKeys ::= SEQUENCE SIZE (1..MAX) OF OneSymmetricKey
SymmetricKeys ::= SEQUENCE SIZE (1..MAX) OF OneSymmetricKey
OneSymmetricKey ::= SEQUENCE {
sKeyAttrs SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyAttributes }} OPTIONAL,
sKey OCTET STRING OPTIONAL }
( WITH COMPONENTS { ..., sKeyAttrs PRESENT } |
WITH COMPONENTS { ..., sKey PRESENT } )
OneSymmetricKey ::= SEQUENCE {
sKeyAttrs SEQUENCE SIZE (1..MAX) OF Attribute
{{ SKeyAttributes }} OPTIONAL,
sKey OCTET STRING OPTIONAL }
( WITH COMPONENTS { ..., sKeyAttrs PRESENT } |
WITH COMPONENTS { ..., sKey PRESENT } )
KeyPkgVersion ::= INTEGER { v1(1) } ( v1, ... )
KeyPkgVersion ::= INTEGER { v1(1) } ( v1, ... )
SKeyPkgAttributes ATTRIBUTE ::= { ... }
SKeyPkgAttributes ATTRIBUTE ::= { ... }
SKeyAttributes ATTRIBUTE ::= { ... }
SKeyAttributes ATTRIBUTE ::= { ... }
END
终止
PSKCAttributesModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-pskcAttributesModule(53) }
PSKCAttributesModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-pskcAttributesModule(53) }
DEFINITIONS IMPLICIT TAGS ::=
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
开始
-- EXPORTS ALL
--全部出口
IMPORTS
进口
-- From New PKIX ASN.1 [RFC5912]
--来自新的PKIX ASN.1[RFC5912]
ATTRIBUTE
FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) }
ATTRIBUTE
FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) }
-- From BinaryTime [RFC6019]
--从二进制时间[RFC6019]
BinaryTime
FROM BinarySigningTimeModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-binarySigningTime(27) }
BinaryTime
FROM BinarySigningTimeModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-binarySigningTime(27) }
-- From New SMIME ASN.1 [RFC5911]
--来自新SMIME ASN.1[RFC5911]
id-smime
FROM SecureMimeMessageV3dot1-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-msg-v3dot1-02(39) }
id-smime
FROM SecureMimeMessageV3dot1-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-msg-v3dot1-02(39) }
;
;
-- -- PSKC Attributes OIDs are taken from the SMIME Arc. --
----PSKC属性OID取自SMIME弧--
id-pskc OBJECT IDENTIFIER ::= { id-smime 12 }
id-pskc OBJECT IDENTIFIER ::= { id-smime 12 }
-- -- Merge SKeyPKGAttributes to the set of attributes for sKeyPkgAttrs --
----将SkeypkAttributes合并到SkeypkAttrs的属性集--
SKeyPkgAttributes ATTRIBUTE ::= {
at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model |
at-pskc-issueNo | at-pskc-deviceBinding |
at-pskc-deviceStartDate | at-pskc-deviceExpiryDate |
at-pskc-moduleId | at-pskc-deviceUserId, ... }
SKeyPkgAttributes ATTRIBUTE ::= {
at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model |
at-pskc-issueNo | at-pskc-deviceBinding |
at-pskc-deviceStartDate | at-pskc-deviceExpiryDate |
at-pskc-moduleId | at-pskc-deviceUserId, ... }
-- -- Merge SKeyAttributes to the set of attributes for sKeyAttrs --
----将SKeyAttributes合并到sKeyAttrs的属性集--
SKeyAttributes ATTRIBUTE ::= {
at-pskc-keyId | at-pskc-algorithm | at-pskc-issuer |
at-pskc-keyProfileId | at-pskc-keyReference |
at-pskc-friendlyName | at-pskc-algorithmParameters |
at-pskc-counter | at-pskc-time | at-pskc-timeInterval |
at-pskc-timeDrift | at-pskc-valueMAC | at-pskc-keyUserId |
at-pskc-keyStartDate | at-pskc-keyExpiryDate |
at-pskc-numberOfTransactions | at-pskc-keyUsage |
at-pskc-pinPolicy, ... }
SKeyAttributes ATTRIBUTE ::= {
at-pskc-keyId | at-pskc-algorithm | at-pskc-issuer |
at-pskc-keyProfileId | at-pskc-keyReference |
at-pskc-friendlyName | at-pskc-algorithmParameters |
at-pskc-counter | at-pskc-time | at-pskc-timeInterval |
at-pskc-timeDrift | at-pskc-valueMAC | at-pskc-keyUserId |
at-pskc-keyStartDate | at-pskc-keyExpiryDate |
at-pskc-numberOfTransactions | at-pskc-keyUsage |
at-pskc-pinPolicy, ... }
at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model }
at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model }
id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
at-pskc-friendlyName ATTRIBUTE ::= {
TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
at-pskc-friendlyName ATTRIBUTE ::= {
TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParameters }
at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParameters }
id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { id-pskc 15 }
id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { id-pskc 15 }
PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String,
challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat,
... }
PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String,
challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat,
... }
ChallengeFormat ::= SEQUENCE {
encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX),
max INTEGER (0..MAX),
... }
ChallengeFormat ::= SEQUENCE {
encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX),
max INTEGER (0..MAX),
... }
Encoding ::= UTF8String ("DECIMAL" | "HEXADECIMAL" |
"ALPHANUMERIC" | "BASE64" | "BINARY" )
Encoding ::= UTF8String ("DECIMAL" | "HEXADECIMAL" |
"ALPHANUMERIC" | "BASE64" | "BINARY" )
ResponseFormat ::= SEQUENCE {
encoding Encoding,
length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE,
... }
ResponseFormat ::= SEQUENCE {
encoding Encoding,
length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE,
... }
at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter }
at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time }
at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
ValueMac ::= SEQUENCE {
macAlgorithm UTF8String,
mac UTF8String }
ValueMac ::= SEQUENCE {
macAlgorithm UTF8String,
mac UTF8String }
at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
at-pskc-numberOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-numberOfTransactions }
at-pskc-numberOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-numberOfTransactions }
id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate")
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate")
at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL }
PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL }
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append"|
"Algorithmic")
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append"|
"Algorithmic")
END
终止
Authors' Addresses
作者地址
Sean Turner IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA
Sean Turner IECA，Inc.美国弗吉尼亚州费尔法克斯市努特利街3057号106室，邮编22031
EMail: turners@ieca.com
EMail: turners@ieca.com
Russell Housley Vigil Security, LLC 918 Spring Knoll Drive Herndon, VA 20170 USA
Russell Housley Vigil Security，LLC 918 Spring Knoll Drive Herndon，弗吉尼亚州，邮编20170
EMail: housley@vigilsec.com
EMail: housley@vigilsec.com