structured_pkix/
oid.rs

1//! The object identifiers this crate names.
2//!
3//! Written as the bytes they are encoded with, because that is what a
4//! document carries and what identity is compared on. A test renders every
5//! one of them back to the dotted form in its documentation, so a mistyped
6//! byte is caught here rather than in a certificate that quietly fails to
7//! match the extension it is.
8
9use structured_asn1::Oid;
10
11// Attribute types that appear in a distinguished name.
12
13/// `2.5.4.3`, the common name.
14pub const COMMON_NAME: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x03]);
15
16/// `2.5.4.4`, a surname.
17pub const SURNAME: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x04]);
18
19/// `2.5.4.5`, a serial number carried as a name attribute, which is not the certificate's serial number.
20pub const SERIAL_NUMBER: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x05]);
21
22/// `2.5.4.6`, a country, as a two-letter code.
23pub const COUNTRY: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x06]);
24
25/// `2.5.4.7`, a locality.
26pub const LOCALITY: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x07]);
27
28/// `2.5.4.8`, a state or province.
29pub const STATE_OR_PROVINCE: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x08]);
30
31/// `2.5.4.9`, a street address.
32pub const STREET_ADDRESS: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x09]);
33
34/// `2.5.4.10`, an organization.
35pub const ORGANIZATION: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x0a]);
36
37/// `2.5.4.11`, an organizational unit.
38pub const ORGANIZATIONAL_UNIT: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x0b]);
39
40/// `2.5.4.12`, a title.
41pub const TITLE: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x0c]);
42
43/// `2.5.4.42`, a given name.
44pub const GIVEN_NAME: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x2a]);
45
46/// `2.5.4.43`, initials.
47pub const INITIALS: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x2b]);
48
49/// `2.5.4.44`, a generation qualifier.
50pub const GENERATION_QUALIFIER: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x2c]);
51
52/// `2.5.4.46`, a qualifier that tells two otherwise equal names apart.
53pub const DN_QUALIFIER: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x2e]);
54
55/// `2.5.4.65`, a pseudonym.
56pub const PSEUDONYM: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x41]);
57
58/// `2.5.4.97`, the organization identifier a qualified certificate carries, which is how a legal entity is identified rather than described.
59pub const ORGANIZATION_IDENTIFIER: Oid<'static> = Oid::from_bytes(&[0x55, 0x04, 0x61]);
60
61/// `1.2.840.113549.1.9.1`, an electronic mail address, deprecated in favour of the subject alternative name.
62pub const EMAIL_ADDRESS: Oid<'static> =
63    Oid::from_bytes(&[0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01]);
64
65/// `0.9.2342.19200300.100.1.25`, one component of a domain name.
66pub const DOMAIN_COMPONENT: Oid<'static> =
67    Oid::from_bytes(&[0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x19]);
68
69/// `0.9.2342.19200300.100.1.1`, a user identifier.
70pub const USER_ID: Oid<'static> =
71    Oid::from_bytes(&[0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x01]);
72
73// Extensions, by the identifier that appears in the certificate.
74
75/// `2.5.29.9`, attributes of the subject that are not part of its name.
76pub const SUBJECT_DIRECTORY_ATTRIBUTES: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x09]);
77
78/// `2.5.29.14`, an identifier for the subject's public key.
79pub const SUBJECT_KEY_IDENTIFIER: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x0e]);
80
81/// `2.5.29.15`, what the key may be used for.
82pub const KEY_USAGE: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x0f]);
83
84/// `2.5.29.16`, when the private key may be used, which is not when the certificate is valid.
85pub const PRIVATE_KEY_USAGE_PERIOD: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x10]);
86
87/// `2.5.29.17`, further names for the subject.
88pub const SUBJECT_ALT_NAME: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x11]);
89
90/// `2.5.29.18`, further names for the issuer.
91pub const ISSUER_ALT_NAME: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x12]);
92
93/// `2.5.29.19`, whether this is a certification authority, and how deep a path below it may go.
94pub const BASIC_CONSTRAINTS: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x13]);
95
96/// `2.5.29.30`, the name space a certification authority may certify within.
97pub const NAME_CONSTRAINTS: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x1e]);
98
99/// `2.5.29.31`, where revocation lists are published.
100pub const CRL_DISTRIBUTION_POINTS: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x1f]);
101
102/// Monotonic CRL number, RFC 5280 §5.2.3.
103pub const CRL_NUMBER: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x14]);
104/// CRL entry revocation reason, RFC 5280 §5.3.1.
105pub const CRL_REASON: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x15]);
106/// CRL entry invalidity date, RFC 5280 §5.3.2.
107pub const INVALIDITY_DATE: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x18]);
108/// Delta CRL base number, RFC 5280 §5.2.4.
109pub const DELTA_CRL_INDICATOR: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x1b]);
110/// CRL distribution point and scope, RFC 5280 §5.2.5.
111pub const ISSUING_DISTRIBUTION_POINT: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x1c]);
112/// Indirect CRL entry issuer, RFC 5280 §5.3.3.
113pub const CERTIFICATE_ISSUER: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x1d]);
114
115/// `2.5.29.32`, the policies this certificate was issued under.
116pub const CERTIFICATE_POLICIES: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x20]);
117
118/// `2.5.29.33`, policies of one domain treated as equivalent to policies of another.
119pub const POLICY_MAPPINGS: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x21]);
120
121/// `2.5.29.35`, an identifier for the key that signed this certificate.
122pub const AUTHORITY_KEY_IDENTIFIER: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x23]);
123
124/// `2.5.29.36`, limits on policy processing below this certificate.
125pub const POLICY_CONSTRAINTS: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x24]);
126
127/// `2.5.29.37`, further purposes the key may be used for.
128pub const EXT_KEY_USAGE: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x25]);
129
130/// `2.5.29.46`, where the delta revocation list is published.
131pub const FRESHEST_CRL: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x2e]);
132
133/// `2.5.29.54`, how far down the path the any-policy identifier stops being accepted.
134pub const INHIBIT_ANY_POLICY: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x36]);
135
136/// `2.5.29.60`, the CRL keeps entries of certificates that expired at or
137/// after a stated time (X.509 `expiredCertsOnCRL`).
138pub const EXPIRED_CERTS_ON_CRL: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x3c]);
139
140/// `1.3.6.1.5.5.7.1.1`, where the issuer's certificate and status service are published.
141pub const AUTHORITY_INFO_ACCESS: Oid<'static> =
142    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01]);
143
144/// `1.3.6.1.5.5.7.1.11`, where services belonging to the subject are published.
145pub const SUBJECT_INFO_ACCESS: Oid<'static> =
146    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x0b]);
147
148/// `1.3.6.1.5.5.7.1.3`, statements about the certificate as a qualified certificate.
149pub const QC_STATEMENTS: Oid<'static> =
150    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x03]);
151
152// Access methods, naming what sits at a location an access description points to.
153
154/// `1.3.6.1.5.5.7.48.1`, a status service.
155pub const OCSP: Oid<'static> = Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01]);
156
157/// Mandatory basic OCSP response syntax (RFC6960 §4.2.1).
158pub const OCSP_BASIC: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 1]);
159
160/// Request/response nonce (RFC9654 §2.1).
161pub const OCSP_NONCE: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 2]);
162
163/// Assertion CRL references (RFC6960 §4.4.2).
164pub const OCSP_CRL: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 3]);
165
166/// Responder certificate revocation exemption (RFC6960 §4.2.2.2.1).
167pub const OCSP_NO_CHECK: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 5]);
168
169/// Status retention boundary of one assertion (RFC6960 §4.4.4).
170pub const OCSP_ARCHIVE_CUTOFF: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 6]);
171
172/// Revoked status also covers non-issued certificates (RFC6960 §4.4.8).
173pub const OCSP_EXTENDED_REVOKE: Oid<'static> = Oid::from_bytes(&[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 9]);
174
175/// `1.3.6.1.5.5.7.48.2`, the issuer's own certificate.
176pub const CA_ISSUERS: Oid<'static> =
177    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02]);
178
179/// `1.3.6.1.5.5.7.48.3`, a timestamping service.
180pub const TIME_STAMPING_ACCESS: Oid<'static> =
181    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x03]);
182
183/// `1.3.6.1.5.5.7.48.5`, a repository of certificates.
184pub const CA_REPOSITORY: Oid<'static> =
185    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x05]);
186
187// Extended key usages.
188
189/// `2.5.29.37.0`, any purpose.
190pub const ANY_EXTENDED_KEY_USAGE: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x25, 0x00]);
191
192/// `1.3.6.1.5.5.7.3.1`, authenticating a server.
193pub const SERVER_AUTH: Oid<'static> =
194    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01]);
195
196/// `1.3.6.1.5.5.7.3.2`, authenticating a client.
197pub const CLIENT_AUTH: Oid<'static> =
198    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02]);
199
200/// `1.3.6.1.5.5.7.3.3`, signing code.
201pub const CODE_SIGNING: Oid<'static> =
202    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x03]);
203
204/// `1.3.6.1.5.5.7.3.4`, protecting electronic mail.
205pub const EMAIL_PROTECTION: Oid<'static> =
206    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x04]);
207
208/// `1.3.6.1.5.5.7.3.8`, signing timestamps.
209pub const TIME_STAMPING: Oid<'static> =
210    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08]);
211
212/// `1.3.6.1.5.5.7.3.9`, signing status responses.
213pub const OCSP_SIGNING: Oid<'static> =
214    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x09]);
215
216// Policies and their qualifiers.
217
218/// `2.5.29.32.0`, the policy that stands for any of them.
219pub const ANY_POLICY: Oid<'static> = Oid::from_bytes(&[0x55, 0x1d, 0x20, 0x00]);
220
221/// `1.3.6.1.5.5.7.2.1`, a pointer to the practice statement, which is a location and is never fetched here.
222pub const CPS_QUALIFIER: Oid<'static> =
223    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01]);
224
225/// `1.3.6.1.5.5.7.2.2`, a notice meant to be shown to a person.
226pub const USER_NOTICE_QUALIFIER: Oid<'static> =
227    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x02]);
228
229// Qualified certificate statements, as ETSI EN 319 412-5 defines them.
230
231/// `0.4.0.1862.1.1`, the certificate is claimed to be a qualified certificate under the Regulation.
232pub const QC_COMPLIANCE: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x01]);
233
234/// `0.4.0.1862.1.2`, a limit on the value of transactions the certificate may be used for.
235pub const QC_LIMIT_VALUE: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x02]);
236
237/// `0.4.0.1862.1.3`, how long the issuer keeps the material needed to check this certificate.
238pub const QC_RETENTION_PERIOD: Oid<'static> =
239    Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x03]);
240
241/// `0.4.0.1862.1.4`, the private key is held in a qualified signature creation device.
242pub const QC_SSCD: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x04]);
243
244/// `0.4.0.1862.1.5`, where the disclosure statements are published.
245pub const QC_PDS: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x05]);
246
247/// `0.4.0.1862.1.6`, which kind of qualified certificate this is.
248pub const QC_TYPE: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x06]);
249
250/// `0.4.0.1862.1.7`, the national legislation the certificate is qualified under.
251pub const QC_CC_LEGISLATION: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x07]);
252
253/// `0.4.0.1862.1.6.1`, a certificate for an electronic signature, made by a natural person.
254pub const QCT_ESIGN: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x06, 0x01]);
255
256/// `0.4.0.1862.1.6.2`, a certificate for an electronic seal, made by a legal person.
257pub const QCT_ESEAL: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x06, 0x02]);
258
259/// `0.4.0.1862.1.6.3`, a certificate for website authentication.
260pub const QCT_WEB: Oid<'static> = Oid::from_bytes(&[0x04, 0x00, 0x8e, 0x46, 0x01, 0x06, 0x03]);
261
262/// `1.3.6.1.5.5.7.11.1`, the first version of the statement carrying semantics for the subject's identifiers.
263pub const PKIX_QC_SYNTAX_V1: Oid<'static> =
264    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x0b, 0x01]);
265
266/// `1.3.6.1.5.5.7.11.2`, the second version of that statement.
267pub const PKIX_QC_SYNTAX_V2: Oid<'static> =
268    Oid::from_bytes(&[0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x0b, 0x02]);
269
270/// `0.4.0.194121.1.1`, the subject's identifiers are read as those of a natural person.
271pub const SEMANTICS_NATURAL_PERSON: Oid<'static> =
272    Oid::from_bytes(&[0x04, 0x00, 0x8b, 0xec, 0x49, 0x01, 0x01]);
273
274/// `0.4.0.194121.1.2`, the subject's identifiers are read as those of a legal person.
275pub const SEMANTICS_LEGAL_PERSON: Oid<'static> =
276    Oid::from_bytes(&[0x04, 0x00, 0x8b, 0xec, 0x49, 0x01, 0x02]);
277
278// Public key algorithms, as far as saying what kind of key a certificate carries. What may be verified with one, and how, belongs to the algorithm registry rather than here.
279
280/// `1.2.840.113549.1.1.1`, an RSA key.
281pub const RSA_ENCRYPTION: Oid<'static> =
282    Oid::from_bytes(&[0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01]);
283
284/// `1.2.840.113549.1.1.10`, an RSA key restricted to the probabilistic signature scheme.
285pub const RSASSA_PSS: Oid<'static> =
286    Oid::from_bytes(&[0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0a]);
287
288/// `1.2.840.10045.2.1`, a key on an elliptic curve named by the parameters.
289pub const EC_PUBLIC_KEY: Oid<'static> =
290    Oid::from_bytes(&[0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01]);
291
292/// `1.3.101.112`, an Ed25519 key.
293pub const ED25519: Oid<'static> = Oid::from_bytes(&[0x2b, 0x65, 0x70]);
294
295/// `1.3.101.113`, an Ed448 key.
296pub const ED448: Oid<'static> = Oid::from_bytes(&[0x2b, 0x65, 0x71]);
297
298// Digest algorithms, the identifiers `algorithm::digest` resolves.
299
300/// `1.3.14.3.2.26`, SHA-1.
301pub const SHA1: Oid<'static> = Oid::from_bytes(&[0x2b, 0x0e, 0x03, 0x02, 0x1a]);
302
303/// `2.16.840.1.101.3.4.2.1`, SHA-256.
304pub const SHA256: Oid<'static> =
305    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01]);
306
307/// `2.16.840.1.101.3.4.2.2`, SHA-384.
308pub const SHA384: Oid<'static> =
309    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02]);
310
311/// `2.16.840.1.101.3.4.2.3`, SHA-512.
312pub const SHA512: Oid<'static> =
313    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03]);
314
315/// `2.16.840.1.101.3.4.2.4`, SHA-224.
316pub const SHA224: Oid<'static> =
317    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04]);
318
319/// `2.16.840.1.101.3.4.2.5`, SHA-512/224.
320pub const SHA512_224: Oid<'static> =
321    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x05]);
322
323/// `2.16.840.1.101.3.4.2.6`, SHA-512/256.
324pub const SHA512_256: Oid<'static> =
325    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x06]);
326
327/// `2.16.840.1.101.3.4.2.7`, SHA3-224 (RFC 9688 §2).
328pub const SHA3_224: Oid<'static> =
329    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x07]);
330
331/// `2.16.840.1.101.3.4.2.8`, SHA3-256 (RFC 9688 §2).
332pub const SHA3_256: Oid<'static> =
333    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08]);
334
335/// `2.16.840.1.101.3.4.2.9`, SHA3-384 (RFC 9688 §2).
336pub const SHA3_384: Oid<'static> =
337    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09]);
338
339/// `2.16.840.1.101.3.4.2.10`, SHA3-512 (RFC 9688 §2).
340pub const SHA3_512: Oid<'static> =
341    Oid::from_bytes(&[0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0a]);
342
343#[cfg(test)]
344mod tests;
structured_pkix/oid.rs

structured_pkix/
oid.rs
