Skip to content

Commit 8c0b931

Browse files
douzzerdouzzer
authored
Merge pull request #8652 from kareem-wolfssl/zd19563_2
Add some FPKI test OIDs which are currently being used in DoD JITC certificates.
2 parents 1b240e2 + 038eab6 commit 8c0b931

5 files changed

Lines changed: 76 additions & 2 deletions

File tree

‎certs/fpki-certpol-cert.der‎

112 Bytes
Binary file not shown.

‎certs/renewcerts.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
# client-crl-dist.pem
3030
# entity-no-ca-bool-cert.pem
3131
# fpki-cert.der
32+
# fpki-certpol-cert.der
3233
# rid-cert.der
3334
# updates the following crls:
3435
# crl/cliCrl.pem

‎certs/renewcerts/wolfssl.cnf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ authorityKeyIdentifier = keyid
362362
keyUsage = critical, digitalSignature
363363
extendedKeyUsage = critical, clientAuth, 1.3.6.1.4.1.311.20.2.2, 1.3.6.1.5.2.3.4, 1.3.6.1.5.5.7.3.21
364364
subjectAltName = @FASC_UUID_altname
365-
certificatePolicies = 1.3.6.1.4.1.6449.1.2.1.3.4, 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.40, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45, 2.16.840.1.101.2.1.11.5, 2.16.840.1.101.2.1.11.9, 2.16.840.1.101.2.1.11.10, 2.16.840.1.101.2.1.11.17, 2.16.840.1.101.2.1.11.18, 2.16.840.1.101.2.1.11.19, 2.16.840.1.101.2.1.11.20, 2.16.840.1.101.2.1.11.31, 2.16.840.1.101.2.1.11.36, 2.16.840.1.101.2.1.11.37, 2.16.840.1.101.2.1.11.38, 2.16.840.1.101.2.1.11.39, 2.16.840.1.101.2.1.11.40, 2.16.840.1.101.2.1.11.41, 2.16.840.1.101.2.1.11.42, 2.16.840.1.101.2.1.11.43, 2.16.840.1.101.2.1.11.44, 2.16.840.1.101.2.1.11.59, 2.16.840.1.101.2.1.11.60, 2.16.840.1.101.2.1.11.61, 2.16.840.1.101.2.1.11.62, 2.16.840.1.101.3.2.1.12.1, 2.16.840.1.101.3.2.1.12.2, 2.16.840.1.101.3.2.1.12.3, 2.16.840.1.101.3.2.1.12.4, 2.16.840.1.101.3.2.1.12.5, 2.16.840.1.101.3.2.1.12.6, 2.16.840.1.101.3.2.1.12.8, 2.16.840.1.101.3.2.1.12.9, 2.16.840.1.101.3.2.1.12.10, 2.16.840.1.101.3.2.1.3.4, 2.16.840.1.101.3.2.1.3.7, 2.16.840.1.101.3.2.1.3.12, 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.16, 2.16.840.1.101.3.2.1.3.18, 2.16.840.1.101.3.2.1.3.20, 2.16.840.1.101.3.2.1.3.36, 2.16.840.1.101.3.2.1.3.38, 2.16.840.1.101.3.2.1.3.39, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45, 2.16.840.1.101.3.2.1.3.47, 2.16.840.1.101.3.2.1.6.4, 2.16.840.1.101.3.2.1.6.12, 2.16.840.1.101.3.2.1.6.38, 2.16.840.1.101.3.2.1.5.4, 2.16.840.1.101.3.2.1.5.5, 2.16.840.1.101.3.2.1.5.10, 2.16.840.1.101.3.2.1.5.12, 1.3.6.1.4.1.73.15.3.1.12, 1.3.6.1.4.1.73.15.3.1.17, 1.3.6.1.4.1.45606.3.1.12, 1.3.6.1.4.1.45606.3.1.20, 1.3.6.1.4.1.45606.3.1.22, 1.3.6.1.4.1.25054.3.1.12, 1.3.6.1.4.1.25054.3.1.14, 1.3.6.1.4.1.25054.3.1.20, 1.3.6.1.4.1.25054.3.1.22, 1.3.6.1.4.1.24019.1.1.1.2, 1.3.6.1.4.1.24019.1.1.1.3, 1.3.6.1.4.1.24019.1.1.1.7, 1.3.6.1.4.1.24019.1.1.1.9, 1.3.6.1.4.1.24019.1.1.1.18, 1.3.6.1.4.1.24019.1.1.1.19, 1.3.6.1.4.1.38099.1.1.1.2, 1.3.6.1.4.1.38099.1.1.1.5, 1.3.6.1.4.1.38099.1.1.1.7, 2.16.840.1.113733.1.7.23.3.1.7, 2.16.840.1.113733.1.7.23.3.1.13, 2.16.840.1.113733.1.7.23.3.1.18, 2.16.840.1.113733.1.7.23.3.1.20, 2.16.840.1.113733.1.7.23.3.1.36, 2.16.840.1.114027.200.3.10.7.2, 2.16.840.1.114027.200.3.10.7.4, 2.16.840.1.114027.200.3.10.7.6, 2.16.840.1.114027.200.3.10.7.9, 2.16.840.1.114027.200.3.10.7.16, 1.3.6.1.4.1.13948.1.1.1.6, 2.16.840.1.113839.0.100.12.1, 2.16.840.1.113839.0.100.12.2, 2.16.840.1.113839.0.100.18.0, 2.16.840.1.113839.0.100.18.1, 2.16.840.1.113839.0.100.18.2, 2.16.840.1.113839.0.100.20.1, 1.3.6.1.4.1.103.100.1.1.3.3, 1.3.6.1.4.1.16334.509.2.8, 1.3.6.1.4.1.16334.509.2.9, 1.3.6.1.4.1.16334.509.2.11, 1.3.6.1.4.1.16334.509.2.14, 1.3.6.1.4.1.1569.10.1.12, 1.3.6.1.4.1.1569.10.1.18, 1.3.6.1.4.1.26769.10.1.12, 1.3.6.1.4.1.26769.10.1.18, 1.3.6.1.4.1.3922.1.1.1.12, 1.3.6.1.4.1.3922.1.1.1.18, 1.3.6.1.4.1.3922.1.1.1.20, 1.3.6.1.4.1.3922.1.1.1.38, 1.2.36.1.334.1.2.1.2, 1.2.36.1.334.1.2.1.3, 1.2.36.1.334.1.2.2.2, 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3
365+
certificatePolicies = 1.3.6.1.4.1.6449.1.2.1.3.4, 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.40, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45, 2.16.840.1.101.2.1.11.5, 2.16.840.1.101.2.1.11.9, 2.16.840.1.101.2.1.11.10, 2.16.840.1.101.2.1.11.17, 2.16.840.1.101.2.1.11.18, 2.16.840.1.101.2.1.11.19, 2.16.840.1.101.2.1.11.20, 2.16.840.1.101.2.1.11.31, 2.16.840.1.101.2.1.11.36, 2.16.840.1.101.2.1.11.37, 2.16.840.1.101.2.1.11.38, 2.16.840.1.101.2.1.11.39, 2.16.840.1.101.2.1.11.40, 2.16.840.1.101.2.1.11.41, 2.16.840.1.101.2.1.11.42, 2.16.840.1.101.2.1.11.43, 2.16.840.1.101.2.1.11.44, 2.16.840.1.101.2.1.11.59, 2.16.840.1.101.2.1.11.60, 2.16.840.1.101.2.1.11.61, 2.16.840.1.101.2.1.11.62, 2.16.840.1.101.3.2.1.12.1, 2.16.840.1.101.3.2.1.12.2, 2.16.840.1.101.3.2.1.12.3, 2.16.840.1.101.3.2.1.12.4, 2.16.840.1.101.3.2.1.12.5, 2.16.840.1.101.3.2.1.12.6, 2.16.840.1.101.3.2.1.12.8, 2.16.840.1.101.3.2.1.12.9, 2.16.840.1.101.3.2.1.12.10, 2.16.840.1.101.3.2.1.3.4, 2.16.840.1.101.3.2.1.3.7, 2.16.840.1.101.3.2.1.3.12, 2.16.840.1.101.3.2.1.3.13, 2.16.840.1.101.3.2.1.3.16, 2.16.840.1.101.3.2.1.3.18, 2.16.840.1.101.3.2.1.3.20, 2.16.840.1.101.3.2.1.3.36, 2.16.840.1.101.3.2.1.3.38, 2.16.840.1.101.3.2.1.3.39, 2.16.840.1.101.3.2.1.3.41, 2.16.840.1.101.3.2.1.3.45, 2.16.840.1.101.3.2.1.3.47, 2.16.840.1.101.3.2.1.6.1, 2.16.840.1.101.3.2.1.6.2, 2.16.840.1.101.3.2.1.6.3, 2.16.840.1.101.3.2.1.6.4, 2.16.840.1.101.3.2.1.6.12, 2.16.840.1.101.3.2.1.6.38, 2.16.840.1.101.3.2.1.5.4, 2.16.840.1.101.3.2.1.5.5, 2.16.840.1.101.3.2.1.5.10, 2.16.840.1.101.3.2.1.5.12, 1.3.6.1.4.1.73.15.3.1.12, 1.3.6.1.4.1.73.15.3.1.17, 1.3.6.1.4.1.45606.3.1.12, 1.3.6.1.4.1.45606.3.1.20, 1.3.6.1.4.1.45606.3.1.22, 1.3.6.1.4.1.25054.3.1.12, 1.3.6.1.4.1.25054.3.1.14, 1.3.6.1.4.1.25054.3.1.20, 1.3.6.1.4.1.25054.3.1.22, 1.3.6.1.4.1.24019.1.1.1.2, 1.3.6.1.4.1.24019.1.1.1.3, 1.3.6.1.4.1.24019.1.1.1.7, 1.3.6.1.4.1.24019.1.1.1.9, 1.3.6.1.4.1.24019.1.1.1.18, 1.3.6.1.4.1.24019.1.1.1.19, 1.3.6.1.4.1.38099.1.1.1.2, 1.3.6.1.4.1.38099.1.1.1.5, 1.3.6.1.4.1.38099.1.1.1.7, 2.16.840.1.113733.1.7.23.3.1.7, 2.16.840.1.113733.1.7.23.3.1.13, 2.16.840.1.113733.1.7.23.3.1.18, 2.16.840.1.113733.1.7.23.3.1.20, 2.16.840.1.113733.1.7.23.3.1.36, 2.16.840.1.114027.200.3.10.7.2, 2.16.840.1.114027.200.3.10.7.4, 2.16.840.1.114027.200.3.10.7.6, 2.16.840.1.114027.200.3.10.7.9, 2.16.840.1.114027.200.3.10.7.16, 1.3.6.1.4.1.13948.1.1.1.6, 2.16.840.1.113839.0.100.12.1, 2.16.840.1.113839.0.100.12.2, 2.16.840.1.113839.0.100.18.0, 2.16.840.1.113839.0.100.18.1, 2.16.840.1.113839.0.100.18.2, 2.16.840.1.113839.0.100.20.1, 1.3.6.1.4.1.103.100.1.1.3.3, 1.3.6.1.4.1.16334.509.2.8, 1.3.6.1.4.1.16334.509.2.9, 1.3.6.1.4.1.16334.509.2.11, 1.3.6.1.4.1.16334.509.2.14, 1.3.6.1.4.1.1569.10.1.12, 1.3.6.1.4.1.1569.10.1.18, 1.3.6.1.4.1.26769.10.1.12, 1.3.6.1.4.1.26769.10.1.18, 1.3.6.1.4.1.3922.1.1.1.12, 1.3.6.1.4.1.3922.1.1.1.18, 1.3.6.1.4.1.3922.1.1.1.20, 1.3.6.1.4.1.3922.1.1.1.38, 1.2.36.1.334.1.2.1.2, 1.2.36.1.334.1.2.1.3, 1.2.36.1.334.1.2.2.2, 2.16.528.1.1003.1.2.5.1, 2.16.528.1.1003.1.2.5.2, 2.16.528.1.1003.1.2.5.3, 2.16.840.1.101.3.2.1.48.11, 2.16.840.1.101.3.2.1.48.13, 2.16.840.1.101.3.2.1.48.86, 2.16.840.1.101.3.2.1.48.109, 2.16.840.1.101.3.2.1.48.110
366366
subjectDirectoryAttributes = ASN1:SEQUENCE:SubjDirAttr
367367
policyConstraints = requireExplicitPolicy:0
368368
2.16.840.1.101.3.6.10.1 = ASN1:SEQUENCE:PIVCertExt

‎wolfcrypt/src/asn.c‎

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4516,6 +4516,19 @@ static const byte extCertPolicyIsrgDomainValid[] =
45164516
static const byte extCertPolicyFpkiPiviAuthOid[] =
45174517
CERT_POLICY_TYPE_OID_BASE(45);
45184518

4519+
/* Federal PKI Test OIDs - 2.16.840.1.101.3.2.1.48.x */
4520+
#define TEST_CERT_POLICY_TYPE_OID_BASE(num) {96, 134, 72, 1, 101, 3, 2, 1, 48, num}
4521+
static const byte extCertPolicyFpkiAuthTestOid[] =
4522+
TEST_CERT_POLICY_TYPE_OID_BASE(11);
4523+
static const byte extCertPolicyFpkiCardauthTestOid[] =
4524+
TEST_CERT_POLICY_TYPE_OID_BASE(13);
4525+
static const byte extCertPolicyFpkiPivContentTestOid[] =
4526+
TEST_CERT_POLICY_TYPE_OID_BASE(86);
4527+
static const byte extCertPolicyFpkiAuthDerivedTestOid[] =
4528+
TEST_CERT_POLICY_TYPE_OID_BASE(109);
4529+
static const byte extCertPolicyFpkiAuthDerivedHwTestOid[] =
4530+
TEST_CERT_POLICY_TYPE_OID_BASE(110);
4531+
45194532
/* DoD PKI OIDs - 2.16.840.1.101.2.1.11.X */
45204533
#define DOD_POLICY_TYPE_OID_BASE(num) {96, 134, 72, 1, 101, 2, 1, 11, num}
45214534
static const byte extCertPolicyDodMediumOid[] =
@@ -4584,6 +4597,12 @@ static const byte extCertPolicyIsrgDomainValid[] =
45844597

45854598
/* Department of State PKI OIDs - 2.16.840.1.101.3.2.1.6.X */
45864599
#define STATE_POLICY_TYPE_OID_BASE(num) {96, 134, 72, 1, 101, 3, 2, 1, 6, num}
4600+
static const byte extCertPolicyStateBasicOid[] =
4601+
STATE_POLICY_TYPE_OID_BASE(1);
4602+
static const byte extCertPolicyStateLowOid[] =
4603+
STATE_POLICY_TYPE_OID_BASE(2);
4604+
static const byte extCertPolicyStateModerateOid[] =
4605+
STATE_POLICY_TYPE_OID_BASE(3);
45874606
static const byte extCertPolicyStateHighOid[] =
45884607
STATE_POLICY_TYPE_OID_BASE(4);
45894608
static const byte extCertPolicyStateMedHwOid[] =
@@ -5601,6 +5620,26 @@ const byte* OidFromId(word32 id, word32 type, word32* oidSz)
56015620
oid = extCertPolicyFpkiPiviAuthOid;
56025621
*oidSz = sizeof(extCertPolicyFpkiPiviAuthOid);
56035622
break;
5623+
case CP_FPKI_AUTH_TEST_OID:
5624+
oid = extCertPolicyFpkiAuthTestOid;
5625+
*oidSz = sizeof(extCertPolicyFpkiAuthTestOid);
5626+
break;
5627+
case CP_FPKI_CARDAUTH_TEST_OID:
5628+
oid = extCertPolicyFpkiCardauthTestOid;
5629+
*oidSz = sizeof(extCertPolicyFpkiCardauthTestOid);
5630+
break;
5631+
case CP_FPKI_PIV_CONTENT_TEST_OID:
5632+
oid = extCertPolicyFpkiPivContentTestOid;
5633+
*oidSz = sizeof(extCertPolicyFpkiPivContentTestOid);
5634+
break;
5635+
case CP_FPKI_PIV_AUTH_DERIVED_TEST_OID:
5636+
oid = extCertPolicyFpkiAuthDerivedTestOid;
5637+
*oidSz = sizeof(extCertPolicyFpkiAuthDerivedTestOid);
5638+
break;
5639+
case CP_FPKI_PIV_AUTH_DERIVED_HW_TEST_OID:
5640+
oid = extCertPolicyFpkiAuthDerivedHwTestOid;
5641+
*oidSz = sizeof(extCertPolicyFpkiAuthDerivedHwTestOid);
5642+
break;
56045643
case CP_DOD_MEDIUM_OID:
56055644
oid = extCertPolicyDodMediumOid;
56065645
*oidSz = sizeof(extCertPolicyDodMediumOid);
@@ -5723,6 +5762,18 @@ const byte* OidFromId(word32 id, word32 type, word32* oidSz)
57235762
break;
57245763

57255764
/* Department of State PKI OIDs */
5765+
case CP_STATE_BASIC_OID:
5766+
oid = extCertPolicyStateBasicOid;
5767+
*oidSz = sizeof(extCertPolicyStateBasicOid);
5768+
break;
5769+
case CP_STATE_LOW_OID:
5770+
oid = extCertPolicyStateLowOid;
5771+
*oidSz = sizeof(extCertPolicyStateLowOid);
5772+
break;
5773+
case CP_STATE_MODERATE_OID:
5774+
oid = extCertPolicyStateModerateOid;
5775+
*oidSz = sizeof(extCertPolicyStateModerateOid);
5776+
break;
57265777
case CP_STATE_HIGH_OID:
57275778
oid = extCertPolicyStateHighOid;
57285779
*oidSz = sizeof(extCertPolicyStateHighOid);
@@ -6636,6 +6687,12 @@ static word32 fpkiCertPolOid(const byte* oid, word32 oidSz, word32 oidSum) {
66366687
sizeof(extCertPolicyComodoLtdOid)) == 0)
66376688
return CP_COMODO_OID;
66386689
break;
6690+
case CP_FPKI_HIGH_ASSURANCE_OID:
6691+
if ((word32)sizeof(extCertPolicyStateBasicOid) == (word32)oidSz &&
6692+
XMEMCMP(oid, extCertPolicyStateBasicOid,
6693+
sizeof(extCertPolicyStateBasicOid)) == 0)
6694+
return CP_STATE_BASIC_OID;
6695+
break;
66396696
case CP_FPKI_COMMON_DEVICES_HARDWARE_OID:
66406697
if ((word32)sizeof(extCertPolicyDodPeerInteropOid) == (word32)oidSz &&
66416698
XMEMCMP(oid, extCertPolicyDodPeerInteropOid,
@@ -6663,7 +6720,7 @@ static word32 fpkiCertPolOid(const byte* oid, word32 oidSz, word32 oidSum) {
66636720
XMEMCMP(oid, extCertPolicyDodMediumHardware112Oid,
66646721
sizeof(extCertPolicyDodMediumHardware112Oid)) == 0)
66656722
return CP_DOD_MEDIUM_HARDWARE_112_OID;
6666-
if ((word32)sizeof(extCertPolicyCertipathHighhwOid) == (word32)oidSz &&
6723+
else if ((word32)sizeof(extCertPolicyCertipathHighhwOid) == (word32)oidSz &&
66676724
XMEMCMP(oid, extCertPolicyCertipathHighhwOid,
66686725
sizeof(extCertPolicyCertipathHighhwOid)) == 0)
66696726
return CP_CERTIPATH_HIGHHW_OID;
@@ -6738,6 +6795,12 @@ static word32 fpkiCertPolOid(const byte* oid, word32 oidSz, word32 oidSum) {
67386795
sizeof(extCertPolicyCarillonAivcontentOid)) == 0)
67396796
return CP_CARILLON_AIVCONTENT_OID;
67406797
break;
6798+
case CP_TREAS_MEDIUMHW_OID:
6799+
if ((word32)sizeof(extCertPolicyStateModerateOid) == (word32)oidSz &&
6800+
XMEMCMP(oid, extCertPolicyStateModerateOid,
6801+
sizeof(extCertPolicyStateModerateOid)) == 0)
6802+
return CP_STATE_MODERATE_OID;
6803+
break;
67416804
case CP_CIS_ICECAP_HW_OID:
67426805
if ((word32)sizeof(extCertPolicyNlModIrrefutabilityOid) == (word32)oidSz &&
67436806
XMEMCMP(oid, extCertPolicyNlModIrrefutabilityOid,

‎wolfssl/wolfcrypt/asn.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1442,6 +1442,13 @@ enum CertificatePolicy_Sum {
14421442
CP_FPKI_PIVI_AUTH_OID = 458, /* 2.16.840.1.101.3.2.1.3.45 */
14431443
CP_FPKI_COMMON_PIVI_CONTENT_SIGNING_OID = 460, /* 2.16.840.1.101.3.2.1.3.47 */
14441444

1445+
/* Federal PKI Test OIDs */
1446+
CP_FPKI_AUTH_TEST_OID = 469, /* 2.16.840.1.101.3.2.1.48.11 */
1447+
CP_FPKI_CARDAUTH_TEST_OID = 471, /* 2.16.840.1.101.3.2.1.48.13 */
1448+
CP_FPKI_PIV_CONTENT_TEST_OID = 544, /* 2.16.840.1.101.3.2.1.48.86 */
1449+
CP_FPKI_PIV_AUTH_DERIVED_TEST_OID = 567, /* 2.16.840.1.101.3.2.1.48.109 */
1450+
CP_FPKI_PIV_AUTH_DERIVED_HW_TEST_OID = 568, /* 2.16.840.1.101.3.2.1.48.110 */
1451+
14451452
/* DoD PKI OIDs */
14461453
CP_DOD_MEDIUM_OID = 423, /* 2.16.840.1.101.2.1.11.5 */
14471454
CP_DOD_MEDIUM_HARDWARE_OID = 427, /* 2.16.840.1.101.2.1.11.9 */
@@ -1477,6 +1484,9 @@ enum CertificatePolicy_Sum {
14771484
CP_ECA_MEDIUM_HARDWARE_SHA256_OID = 432, /* 2.16.840.1.101.3.2.1.12.10 */
14781485

14791486
/* Department of State PKI OIDs */
1487+
CP_STATE_BASIC_OID = 100417, /* 2.16.840.1.101.3.2.1.6.1 */
1488+
CP_STATE_LOW_OID = 418, /* 2.16.840.1.101.3.2.1.6.2 */
1489+
CP_STATE_MODERATE_OID = 100419, /* 2.16.840.1.101.3.2.1.6.3 */
14801490
CP_STATE_HIGH_OID = 100420, /* 2.16.840.1.101.3.2.1.6.4 */
14811491
CP_STATE_MEDHW_OID = 101428, /* 2.16.840.1.101.3.2.1.6.12 */
14821492
CP_STATE_MEDDEVHW_OID = 101454, /* 2.16.840.1.101.3.2.1.6.38 */

0 commit comments

Comments
 (0)