From 0059177d185c48eb1b79e6a470b6e0ddd06bde75 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Wed, 3 Jun 2026 14:39:22 -0600 Subject: [PATCH 1/8] adding asn1 functionality. testing has been set up matches flag names with openssl. added help to explain oid command added comments to header file resolved configure.ac merge conflict added oid support to header includes added man page for asn1parse and fixed more skoll oid are properly handled Made -out output DER of input after processing Removed extra fmt file and put all in parse custom oid now compiled out for 5.9.2 added header to include.am fenrir fixes moved oid table added WOLFSSL_ASN_PRINT to windows build skoll fixes --- .gitignore | 2 +- Makefile.am | 2 + configure.ac | 29 + ide/winvs/user_settings.h | 1 + manpages/wolfssl-asn1parse.1 | 87 + src/asn1/clu_asn1_parse.c | 674 ++++ src/asn1/clu_asn1_setup.c | 344 ++ src/clu_main.c | 6 + src/include.am | 5 +- src/tools/clu_funcs.c | 30 + src/x509/clu_config.c | 37 +- tests/asn1/asn1-test.py | 408 +++ tests/asn1/include.am | 6 + tests/run_tests_parallel.py | 0 tests/wolfclu_test.py | 26 + wolfCLU.vcxproj | 4 + wolfCLU.vcxproj.filters | 3 + wolfclu/asn1/clu_asn1.h | 76 + wolfclu/asn1/clu_oid_name_table.h | 5576 +++++++++++++++++++++++++++++ wolfclu/clu_header_main.h | 18 + wolfclu/clu_optargs.h | 7 + wolfclu/include.am | 5 +- 22 files changed, 7320 insertions(+), 26 deletions(-) create mode 100644 manpages/wolfssl-asn1parse.1 create mode 100644 src/asn1/clu_asn1_parse.c create mode 100644 src/asn1/clu_asn1_setup.c create mode 100644 tests/asn1/asn1-test.py create mode 100644 tests/asn1/include.am mode change 100644 => 100755 tests/run_tests_parallel.py create mode 100644 wolfclu/asn1/clu_asn1.h create mode 100644 wolfclu/asn1/clu_oid_name_table.h diff --git a/.gitignore b/.gitignore index 3902801f..747bf182 100644 --- a/.gitignore +++ b/.gitignore @@ -11,7 +11,7 @@ config.log config.status configure configure~ -clu_src/config.h.in* +wolfclu/config.h.in* *.lo *.Plo *.o diff --git a/Makefile.am b/Makefile.am index 6ef17b86..ccf8c9d4 100644 --- a/Makefile.am +++ b/Makefile.am @@ -53,6 +53,7 @@ man_MANS+= manpages/wolfssl-hash.1 man_MANS+= manpages/wolfssl-enc.1 man_MANS+= manpages/wolfssl-ca.1 man_MANS+= manpages/wolfssl-x509.1 +man_MANS+= manpages/wolfssl-asn1parse.1 man_MANS+= manpages/wolfssl-req.1 man_MANS+= manpages/wolfssl-verify.1 man_MANS+= manpages/wolfssl-crl.1 @@ -95,6 +96,7 @@ include tests/dsa/include.am include tests/pkey/include.am include tests/dgst/include.am include tests/rand/include.am +include tests/asn1/include.am include tests/base64/include.am include tests/ocsp/include.am include tests/ocsp-scgi/include.am diff --git a/configure.ac b/configure.ac index be7ccf6c..68a458d1 100644 --- a/configure.ac +++ b/configure.ac @@ -95,6 +95,19 @@ AC_ARG_ENABLE([manpages], AM_CONDITIONAL([ENABLE_MANPAGES], [test "x$ENABLED_MANPAGES" != "xno"]) +# OID Name Table Build +ENABLED_OIDTABLE_DEFAULT=no +AC_ARG_ENABLE([oid-table], + [AS_HELP_STRING([--enable-oid-table],[Enable OID-to-name lookup table (default: disabled)])], + [ ENABLED_OIDTABLE=$enableval ], + [ ENABLED_OIDTABLE=$ENABLED_OIDTABLE_DEFAULT ] + ) + +if test "$ENABLED_OIDTABLE" = "yes" +then + AM_CFLAGS="$AM_CFLAGS -DHAVE_OID_TABLE" +fi + #wolfssl AC_MSG_CHECKING([for wolfSSL]) @@ -145,6 +158,21 @@ AC_CHECK_FUNC([wc_EncodeObjectId], [], [AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"]) +# wc_EncodeObjectId is not usable in libwolfssl <= 5.9.2, so disable it based +# on the version when the symbol is present but too old. +AC_MSG_CHECKING([whether libwolfssl version supports wc_EncodeObjectId]) +AC_COMPILE_IFELSE( + [AC_LANG_PROGRAM( + [[#include ]], + [[ + #if LIBWOLFSSL_VERSION_HEX <= 0x05009002 + #error "libwolfssl version too old for wc_EncodeObjectId" + #endif + ]])], + [AC_MSG_RESULT([yes])], + [AC_MSG_RESULT([no]) + AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"]) + ############################################### # # @@ -213,3 +241,4 @@ echo " * C Flags: $CFLAGS" echo " * CPP Flags: $CPPFLAGS" echo " * LIB Flags: $LIB" echo " * Debug enabled: $ax_enable_debug" +echo " * OID Name Table: $ENABLED_OIDTABLE" diff --git a/ide/winvs/user_settings.h b/ide/winvs/user_settings.h index 5f2aaeab..2e315b33 100644 --- a/ide/winvs/user_settings.h +++ b/ide/winvs/user_settings.h @@ -40,6 +40,7 @@ #define WOLFSSL_WC_DILITHIUM #define WOLFSSL_EXPERIMENTAL_SETTINGS #define WOLFSSL_DUAL_ALG_CERTS +#define WOLFSSL_ASN_PRINT #define HAVE_TLS_EXTENSIONS #define HAVE_SNI diff --git a/manpages/wolfssl-asn1parse.1 b/manpages/wolfssl-asn1parse.1 new file mode 100644 index 00000000..56b606c7 --- /dev/null +++ b/manpages/wolfssl-asn1parse.1 @@ -0,0 +1,87 @@ +.\" Manpage for wolfssl asn1parse. +.\" Contact facts@wolfssl.com to correct errors or typos. +.TH wolfSSL SSL1 "June 2026" "0.2.0" "wolfssl asn1parse man page" +.SH NAME +wolfssl-asn1parse, asn1parse \- ASN.1 parsing utility +.SH SYNOPSIS +wolfssl asn1parse [-in file] [-inform DER|PEM|B64] [-out file] [-oid file] [-offset n] [-length n] [-strparse n[,n...]] [-i] [-dump] [-noout] [-help] +.SH DESCRIPTION +Parses an ASN.1 encoded structure (for example a certificate, key, or CRL) +and prints a human readable listing of its tags, lengths, and contents. +Input may be read in DER, PEM, or Base64 form. +.SH GENERAL OPTIONS +-help print the asn1parse help summary and exit. +.br +.LP +-oid file file of extra OID definitions. Each line uses the +.br + format: . +.br + To use the built in OID table, configure wolfCLU with +.br + --enable-oid-table. +.SH I/O OPTIONS +-in file input file to read the ASN.1 structure from. +.br +.LP +-inform DER|PEM|B64 input file format. One of DER, PEM, or B64 (Base64). +.br +.LP +-out file output file for the ASN.1 DER data after processing. +.br + Best used with -strparse. +.br +.LP +-noout do not print the parsed output. +.br +.LP +-offset n offset into the file at which to begin parsing. +.br +.LP +-length n number of bytes to parse. +.br +.LP +-strparse n[,n...] offset to an OCTET/BIT STRING to parse. A comma +.br + separated list may be given, e.g. -strparse 702,64. +.SH FORMATTING OPTIONS +-i indent the output according to structure depth. +.br +.LP +-dump print unknown data in hex form. +.SH OUTPUT +Each line is formatted as: +.RS + 0: 4 [1187] (0) SEQUENCE +.RE +.LP +where the first number is the offset, the second is the header length, the +value in brackets is the data length, and the value in parentheses is the +depth. Brackets indicate constructed types and a plus indicates a primitive +type. +.SH EXAMPLES +Parse a DER encoded certificate with indented output: +.RS +wolfssl asn1parse -inform DER -in cert.der -i +.RE +.LP +Parse a PEM file and dump unknown data as hex: +.RS +wolfssl asn1parse -in cert.pem -inform PEM -dump +.RE +.SH SEE ALSO +.BR wolfssl-x509(1) ", " wolfssl-req(1) +.SH NOTES +Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and without +NO_FILESYSTEM. The -oid option additionally requires object id encoding +support (NO_WC_ENCODE_OBJECT_ID must not be defined). For OpenSSL +compatibility the tool reserves additional flags (e.g. -genstr, -genconf, +-item, -strictpem, -dlimit) that are not yet implemented. +.SH BUGS +No known bugs at this time. +.SH AUTHOR +wolfSSL, Inc. (facts@wolfssl.com) +.SH COPYRIGHT +Copyright 2026 wolfSSL Inc. All rights reserved. +.SH REPORTING BUGS +Report wolfssl bugs to support@wolfssl.com diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c new file mode 100644 index 00000000..a276cd7c --- /dev/null +++ b/src/asn1/clu_asn1_parse.c @@ -0,0 +1,674 @@ +/* clu_asn1_parse.c + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) + + +static int Asn1Print(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts) +{ + int ret = WOLFCLU_SUCCESS; + Asn1PrintOptions PrintOpts = {0}; + + /* wc_Asn1_Init (called once in wolfCLU_Asn1Parse) leaves the output + * file as XBADFILE; point it at stdout and wire up the OID-to-name + * callback before printing the tree. */ + if (wc_Asn1_SetFile(asn1, stdout) != 0) + return WOLFCLU_FATAL_ERROR; + + if (wc_Asn1_SetOidToNameCb(asn1, opts->nameCb) != 0) + return WOLFCLU_FATAL_ERROR; + + if (wc_Asn1PrintOptions_Init(&PrintOpts) != 0) + return WOLFCLU_FATAL_ERROR; + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_INDENT, + opts->indent) != 0) + return WOLFCLU_FATAL_ERROR; + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH, + 1) != 0) + return WOLFCLU_FATAL_ERROR; + + /* this shows the hex in a readable print out and hides text data + * so there is no double reporting on BIT STRING and OCTET STRINGS */ + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_DATA, + opts->dump) != 0) + return WOLFCLU_FATAL_ERROR; + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_OID, + opts->dump) != 0) + return WOLFCLU_FATAL_ERROR; + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_NO_TEXT, + opts->dump) != 0) + return WOLFCLU_FATAL_ERROR; + + ret = wc_Asn1_PrintAll(asn1, &PrintOpts, asn1->data, asn1->max); + + if (ret == 0) { + ret = WOLFCLU_SUCCESS; + } + else { + wolfCLU_LogError("%s", wc_GetErrorString(ret)); + ret = WOLFCLU_FATAL_ERROR; + } + return ret; +} + +enum { + /* Expecting tag part of ASN.1 item. */ + ASN_PART_TAG = 0, + /* Expecting length part of ASN.1 item. */ + ASN_PART_LENGTH, + /* Expecting data part of ASN.1 item. */ + ASN_PART_DATA, +}; + + +/* Apply the -strparse offsets in po->strParse in order. Each entry is an + * absolute byte offset from the current position to an OCTET STRING or BIT + * STRING whose contents are themselves ASN.1; the parser descends into that + * content so the next offset (and the final print) operate on the nested + * structure. Returns WOLFCLU_SUCCESS on success or a negative error code. + */ +static int StrParse(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* po) +{ + int ret = WOLFCLU_SUCCESS; + word32 idx = 0; + + for (; idx < po->strParseSz; idx++) { + int len; + + /* Need at least one byte (the tag) available at the jump target. */ + if (po->strParse[idx] >= asn1->max) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse %u with value %u " + "tried to jump to invalid location. " + "Unable to parse", idx, po->strParse[idx]); + break; + } + + /* Advance into the buffer and shrink the remaining length to match so + * later bounds checks stay accurate. */ + asn1->data = asn1->data + po->strParse[idx]; + asn1->max = asn1->max - po->strParse[idx]; + + /* Mask off the constructed bit to compare the base tag. */ + asn1->item.tag = asn1->data[asn1->curr] & (byte)~ASN_CONSTRUCTED; + + if (asn1->item.tag != ASN_OCTET_STRING && + asn1->item.tag != ASN_BIT_STRING) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse %u with value %u " + "did not find an octet string " + "unable to parse", idx, po->strParse[idx]); + break; + } + + asn1->curr++; + + asn1->part = ASN_PART_LENGTH; + + /* Decode length and step over it. */ + if (GetLength(asn1->data, &asn1->curr, &len, asn1->max) < 0) { + ret = WOLFCLU_FATAL_ERROR; + break; + } + + /* The decoded length must fit within the bytes remaining after the + * tag and length octets. */ + if (len < 0 || (word32)len > asn1->max - asn1->curr) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse %u decoded length runs past the end " + "of the buffer. Unable to parse", idx); + break; + } + + if (asn1->item.tag == ASN_BIT_STRING) { + if (len < 1) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse %u BIT STRING has no content", idx); + break; + } + asn1->curr++; + len--; + } + + /* reset data structure to treat the new data as a fresh object */ + asn1->data = asn1->data + (asn1->curr); + asn1->curr = 0; + asn1->depth = 0; + asn1->max = len; + asn1->part = ASN_PART_TAG; + } + + return ret; +} + +/* Apply data altering options to raw input before printing + * + * return WOLFCLU_SUCCESS on success, + * WOLFLCU_FATAL_ERROR otherwise */ +static int Asn1Fmt(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts, + byte* data, word32 dataSz) +{ + int ret = WOLFCLU_SUCCESS; + /* Reject an offset that points past the end of the buffer. Both values + * are word32, so an out-of-range offset would make the length below + * underflow and produce a near-4GB out-of-bounds read. */ + if (opts->offset > dataSz) { + wolfCLU_LogError("-offset %u is past the end of the input (%u bytes)", + opts->offset, dataSz); + return WOLFCLU_FATAL_ERROR; + } + + /* A user supplied length must fit within the bytes remaining after the + * offset. */ + if (opts->length > 0 && opts->length > dataSz - opts->offset) { + wolfCLU_LogError("-length %u runs past the end of the input " + "(%u bytes remaining after offset)", + opts->length, dataSz - opts->offset); + return WOLFCLU_FATAL_ERROR; + } + + /* Store the starting point of the data to parse. */ + asn1->data = data + opts->offset; + if (opts->length > 0) { + /* Use user specified maximum length. */ + asn1->max = opts->length; + } + else { + /* Maximum length is up to end from offset. */ + asn1->max = dataSz - opts->offset; + } + + if (ret == WOLFCLU_SUCCESS && opts->strParseSz != 0) { + ret = StrParse(asn1, opts); + } + + return ret; +} + +/* Writes the ASN.1 DER encoding to the output file in po->outputfile, + * applying the offset/length bounds from po to data/dataSz. Prints the + * tree output to stdout + * + * Returns WOLFCLU_SUCCESS on success. + * */ +static int wolfCLU_Asn1Write(Asn1* asn1, + const WOLFCLU_ASN1_PARSE_OPTIONS* opts, byte* data, word32 dataSz) +{ + int ret = WOLFCLU_SUCCESS; + + if (asn1 == NULL || opts == NULL || data == NULL) { + wolfCLU_LogError("Illegal null argument. Could not write asn1 data"); + return WOLFCLU_FATAL_ERROR; + } + + /* Handle offsets, strparse, etc... */ + ret = Asn1Fmt(asn1, opts, data, dataSz); + + if (ret == WOLFCLU_SUCCESS && opts->outputFile != NULL) { + if (XFWRITE(asn1->data, 1, asn1->max, opts->outputFile) != asn1->max) { + wolfCLU_LogError("Unable to write to file passed by -out"); + ret = WOLFCLU_FATAL_ERROR; + } + } + + if (!opts->noOut && ret == WOLFCLU_SUCCESS) { + ret = Asn1Print(asn1, opts); + } + + return ret; +} + + + +/* Find the next PEM block. + * + * @param [in] data PEM data. + * @param [in] offset Offset into data to start looking. + * @param [in] len Length of PEM data. + * @param [out] start Start of Base64 encoding. + * @param [out] end End of Base64 encoding. + */ +static int FindPem(unsigned char* data, word32 offset, word32 len, + word32* start, word32* end) +{ + int ret = WOLFCLU_SUCCESS; + word32 i = 0; + word32 j = 0; + + /* Find header. */ + for (i = offset; i < len; i++) { + if ((data[i] == '-') && + (XSTRNCMP((char*)data + i, "-----BEGIN", 10) == 0)) { + i += (sizeof("-----BEGIN") - 1); /* Skip -----BEGIN text */ + break; + } + } + if (i == len) { + /* Got to end without finding PEM header. */ + wolfCLU_LogError("No PEM header found"); + ret = WOLFCLU_FATAL_ERROR; + } + if (ret == WOLFCLU_SUCCESS) { + /* Confirm header. */ + for (; i < len; i++) { + if ((data[i] == '-') && + (XSTRNCMP((char*)data + i, "-----", 5) == 0)) { + break; + } + } + if (i == len) { + /* Got to end without finding rest of PEM header. */ + wolfCLU_LogError("Invalid PEM header"); + ret = WOLFCLU_FATAL_ERROR; + } + i += sizeof("-----") - 1; + } + if (ret == WOLFCLU_SUCCESS) { + /* Find footer. */ + for (j = i + 1; j < len; j++) { + if ((data[j] == '-') && + (XSTRNCMP((char*)data + j, "-----END", 8) == 0)) { + break; + } + } + if (j >= len) { + /* Got to end without finding PEM footer. */ + wolfCLU_LogError("No PEM footer found"); + ret = WOLFCLU_FATAL_ERROR; + } + } + + if (ret == WOLFCLU_SUCCESS) { + /* Return start and end indices. */ + *start = i; + *end = j; + } + return ret; +} + +/* Allocate buffer to read returns length of file read if success. + * and returns negative code on failure. */ +static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) +{ + long fileLen; + + if (fp == NULL) { + return WOLFCLU_FATAL_ERROR; + } + + if (XFSEEK(fp, 0,SEEK_END) != 0) { + return WOLFCLU_FATAL_ERROR; + } + + /* XFTELL returns a signed long; check it before narrowing to word32 so an + * error (-1) or empty file is not mistaken for a ~4GB length. */ + fileLen = XFTELL(fp); + if (fileLen <= 0) { + return WOLFCLU_FATAL_ERROR; + } + + /* A file at or below 0xFFFFFFEU still lets the +1 for the null terminator + * fit in a int (windows); anything larger would overflow the length below, so + * reject it here rather than allocate and read a near-2GB buffer. */ + if (fileLen > (0xFFFFFFEU)) { + wolfCLU_LogError("File is longer than 0xFFFFFFEU byte max"); + return WOLFCLU_FATAL_ERROR; + } + + if (XFSEEK(fp, 0,SEEK_SET) != 0) { + return WOLFCLU_FATAL_ERROR; + } + /* add 1 for null terminator */ + *buffer = (byte*)XMALLOC(fileLen + 1, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + if(*buffer == NULL) { + return MEMORY_E; + } + + if (XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) { + XFREE(*buffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + *buffer = NULL; + return WOLFCLU_FATAL_ERROR; + } + (*buffer)[fileLen] = '\0';/* add null terminator */ + + if (bufLen != NULL) { + *bufLen = (word32)fileLen; + } + return fileLen; +} + +static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME* p) +{ + if (p->dataBuffer != NULL) { + XFREE(p->dataBuffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + } + + if (p->entries != NULL) { + XFREE(p->entries , HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + } + + wc_ForceZero(p, sizeof(*p)); + + return WOLFCLU_SUCCESS; +} + +/* take in dot separated oid string and fill it with Der encoding * +* return wolfCLU_SUCCESS on success */ +static int OidToDer(char* oid, word32* oidSz) +{ +#ifndef NO_WC_ENCODE_OBJECT_ID + int ret = WOLFCLU_SUCCESS; + int err; + int idx = 0; + char* token; + char* end; + word32* arc = (word32*)XMALLOC(sizeof(*arc) * *oidSz, + HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + if (arc == NULL) { + return MEMORY_E; + } + + token = XSTRTOK(oid, ".", &end); + while (token != NULL && ret == WOLFCLU_SUCCESS) { + word32 tmp = 0; + if (wolfCLU_StrToWord32(token, XSTRLEN(token), &tmp) + == WOLFCLU_SUCCESS) { + arc[idx++] = tmp; + } + else{ + wolfCLU_LogError("Could not parse oid dot form"); + ret = WOLFCLU_FATAL_ERROR; + break; + } + token = XSTRTOK(NULL, ".", &end); + } + + if (ret == WOLFCLU_SUCCESS) { + /* oid is overwritten by and replaces with DER encoding */ + XMEMSET(oid, '\0', *oidSz); + if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) { + wolfCLU_LogError("%s", wc_GetErrorString(err)); + ret = WOLFCLU_FATAL_ERROR; + } + } + + + XFREE(arc, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + return ret; +#else + wolfCLU_LogError("Old Version of wolfSSL %s must be greater than 5.9.2 to " + "use custom oids", WOLFSSL_VERSION); + (void)oid; + (void)oidSz; + return WOLFCLU_FATAL_ERROR; +#endif + +} + +/* return WOLFCLU_SUCCESS if successful + * if this function returns success you must call + * WOLFCLU_OID_TO_NAME_free. */ +static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) +{ +#ifndef NO_WC_ENCODE_OBJECT_ID + int ret = WOLFCLU_SUCCESS; + OidName* tmpPtr; + byte* fileBuffer; + char* tracker; + char* token; + char* oid; + + if (newOids == NULL) { + wolfCLU_LogError("WOLFCLU_OID_TO_NAME was null"); + return WOLFCLU_FATAL_ERROR; + } + + XMEMSET(newOids, 0, sizeof(*newOids)); + + if (asn1_ReadFile(fp, &fileBuffer, NULL) < 0) { + wolfCLU_LogError("Error reading -oid file"); + return WOLFCLU_FATAL_ERROR; + } + + /* file format is \n + * we load the first token and go until error or all lines are hit + * and loaded */ + token = XSTRTOK((char*)fileBuffer, " ", &tracker); + while (ret == WOLFCLU_SUCCESS && token != NULL) { + word32 len; + oid = token; + len = XSTRLEN(oid); + + ret = OidToDer(oid, &len); + if (ret != WOLFCLU_SUCCESS) { + wolfCLU_LogError("Could not convert Oid : %s to der check line %u", + token, newOids->len + 1); + break; + } + + /* skip short name */ + token = XSTRTOK(NULL, " ", &tracker); + if (token == NULL) { + wolfCLU_LogError("malformed tokens, check line %u for bad " + "formatting; wanted short name", newOids->len + 1); + ret = WOLFCLU_FATAL_ERROR; + break; + } + + token = XSTRTOK(NULL, "\n", &tracker); + if (token == NULL) { + wolfCLU_LogError("malformed tokens, check line %u for bad " + "formatting; wanted long name", newOids->len + 1); + ret = WOLFCLU_FATAL_ERROR; + break; + } + + /* realloc array if need more slots */ + if (newOids->len >= newOids->cap) { + + tmpPtr = XREALLOC(newOids->entries, + sizeof(OidName) * (newOids->cap + 10), + HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + + if (tmpPtr == NULL) { + ret = MEMORY_E; + break; + } + else { + newOids->entries = tmpPtr; + newOids->cap += 10; + } + } + + newOids->entries[newOids->len].name = token; + newOids->entries[newOids->len].oid = (byte*)oid; + newOids->entries[newOids->len].len = len; + newOids->len++; + + token = XSTRTOK(NULL, " ", &tracker); + } + + newOids->dataBuffer = fileBuffer; + + if (ret != WOLFCLU_SUCCESS) { + wolfCLU_LogError("Error parsing file passed to -oid flag"); + WOLFCLU_OID_TO_NAME_free(newOids); + } + + return ret; +#else + (void)newOids; + (void)fp; + return OidToDer(NULL, NULL); +#endif +} + +/* Callback that wolfSSL uses to assign byte oids to names */ +static WOLFCLU_OID_TO_NAME AdditionalOidNames = {0}; +static const char* OidToNameCallback (unsigned char* oid, word32 len) +{ + word32 i; + for (i = 0; i < AdditionalOidNames.len; i++){ + if ((len == AdditionalOidNames.entries[i].len) && + (XMEMCMP(oid, AdditionalOidNames.entries[i].oid, len) == 0)) { + return AdditionalOidNames.entries[i].name; + } + } + + for (i = 0; i < oid_names_len; i++){ + if ((len == oid_name_table[i].len) && + (XMEMCMP(oid, oid_name_table[i].oid, len) == 0)) { + return oid_name_table[i].name; + } + } + + return NULL; +} + +/* Decode the input data from base64 based on file type */ +static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS* po, + byte** inputFileBuffer, word32* inputFileLen) +{ + int ret = WOLFCLU_SUCCESS; + word32 i = 0; + word32 j = 0; + + if (po == NULL) + return WOLFCLU_FATAL_ERROR; + + switch (po->inForm){ + case WOLFCLU_ASN1_PEM: + /* Find start and end of PEM Base64 data. */ + ret = FindPem(*inputFileBuffer, j, *inputFileLen, &i, &j); + /* Decode data between header and footer. */ + if ((ret == WOLFCLU_SUCCESS) && + (Base64_Decode((*inputFileBuffer) + i, j - i, + *inputFileBuffer, inputFileLen) != 0)) { + wolfCLU_LogError("PEM input is not base64 encoded"); + ret = WOLFCLU_FATAL_ERROR; + } + break; + + case WOLFCLU_ASN1_B64: + if (Base64_Decode(*inputFileBuffer, *inputFileLen, + *inputFileBuffer, inputFileLen) != 0) { + wolfCLU_LogError("input is not base64 encoded"); + ret = WOLFCLU_FATAL_ERROR; + } + break; + + case WOLFCLU_ASN1_DER: + /* DER is parsed as-is; this is also the default when -inform is + * not supplied (asn1Config.inForm is initialized to DER). */ + break; + + default: + wolfCLU_LogError("Unsupported input format"); + ret = WOLFCLU_FATAL_ERROR; + break; + } + + return ret; +} + +#endif + + +/* Performs the ASN.1 operation described by parseOptions: decodes the input + * (DER, base64 or PEM), applies the offset/length/string-parse selections, and + * writes the formatted structure to the configured output target(s). + * Returns WOLFCLU_SUCCESS on success. */ +int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* po) +{ +#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) + int ret = WOLFCLU_SUCCESS; + byte* inputFileBuffer = NULL; + word32 inputFileLen = 0; + po->nameCb = OidToNameCallback; + Asn1 asn1Master = {0}; + + if (po->oidFile != NULL) { + ret = WOLFCLU_OID_TO_NAME_initWFile(&AdditionalOidNames, po->oidFile); + } + + if (ret == WOLFCLU_SUCCESS && po->noOut && po->outputFile == NULL) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("No output file given and -noout set"); + } + + if (ret == WOLFCLU_SUCCESS) { + ret = wc_Asn1_Init(&asn1Master) == 0 ? + WOLFCLU_SUCCESS : WOLFCLU_FATAL_ERROR; + } + + if (ret == WOLFCLU_SUCCESS) { + if (po->inputFile == NULL) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Must have input via file passed to -in"); + } + + if (ret == WOLFCLU_SUCCESS) { + if (asn1_ReadFile(po->inputFile, &inputFileBuffer, + &inputFileLen) < 0){ + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Could not open input file"); + } + } + } + + if (ret == WOLFCLU_SUCCESS) { + ret = HandleProcessing(po, &inputFileBuffer, &inputFileLen); + } + + if (ret == WOLFCLU_SUCCESS) { + ret = wolfCLU_Asn1Write(&asn1Master, po, inputFileBuffer, inputFileLen); + } + + if (inputFileBuffer != NULL) { + XFREE(inputFileBuffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + } + WOLFCLU_OID_TO_NAME_free(&AdditionalOidNames); + return ret; +#else +#if !defined(WOLFSSL_ASN_PRINT) + wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot Parse Asn1."); +#endif +#if defined(NO_FILESYSTEM) + wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot Parse Asn1."); +#endif + return WOLFCLU_FATAL_ERROR; +#endif +} + diff --git a/src/asn1/clu_asn1_setup.c b/src/asn1/clu_asn1_setup.c new file mode 100644 index 00000000..5851fb00 --- /dev/null +++ b/src/asn1/clu_asn1_setup.c @@ -0,0 +1,344 @@ +/* clu_asn1_setup.c + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#include +#include +#include +#include +#include +#include +#include + + +#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) + +static const struct option asn1_options[] = { + { "-oid", required_argument, 0, WOLFCLU_OID }, + { "-inform", required_argument, 0, WOLFCLU_INFORM }, + { "-in", required_argument, 0, WOLFCLU_INFILE }, + { "-out", required_argument, 0, WOLFCLU_OUTFILE }, + { "-offset", required_argument, 0, WOLFCLU_OFFSET }, + { "-length", required_argument, 0, WOLFCLU_LENGTH }, + { "-strparse", required_argument, 0, WOLFCLU_STRPARSE }, + { "-noout", no_argument, 0, WOLFCLU_NOOUT }, + { "-i", no_argument, 0, WOLFCLU_INDENT }, + { "-dump", no_argument, 0, WOLFCLU_DUMP }, + { "-help", no_argument, 0, WOLFCLU_HELP }, + { 0, 0, 0, 0 } /* terminal element */ +}; + +static void wolfCLU_Asn1Help(void) +{ + WOLFCLU_LOG(WOLFCLU_L0, "./wolfssl asn1parse"); + WOLFCLU_LOG(WOLFCLU_L0, "General Options:"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-help Display this text"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-oid File of extra oid " + "definitions"); + wolfCLU_Log(WOLFCLU_L0, "\t To use built in Oid Table " + "configure with:"); + wolfCLU_Log(WOLFCLU_L0, "\t --enable-oid-table"); + + WOLFCLU_LOG(WOLFCLU_L0, "\nI/O Options:"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-inform Input file format " + "- [DER, PEM, B64]"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-in Input file"); + WOLFCLU_LOG( + WOLFCLU_L0, + "\t-out Output file for the Asn1 Der data " + "after processing"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-noout Do not print output"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-offset Offset in to the file " + "to begin parsing"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-length Number of bytes to parse"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-strparse Offset to OCTET/BIT STRING " + "to parse\n " + "\t\t can be used with a list. " + "Ex:-strparse 702,64"); + WOLFCLU_LOG(WOLFCLU_L0, "\nFormatting Options:"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-i Indents the output"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-dump Unknown data in hex form"); + WOLFCLU_LOG(WOLFCLU_L0, "\nOutput:"); + WOLFCLU_LOG(WOLFCLU_L0, " Offset v v Data Length"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) ┌SEQUENCE"); + WOLFCLU_LOG(WOLFCLU_L0, " Header Length ^ Depth ^"); + WOLFCLU_LOG(WOLFCLU_L0, "\n Brackets indicate constructed " + "types"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) ┌SEQUENCE"); + WOLFCLU_LOG(WOLFCLU_L0, "\n Pluses indicate primitive types"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 + 7 (0) ┌INTEGER"); + WOLFCLU_LOG(WOLFCLU_L0, "\nOid File:\n"); + WOLFCLU_LOG(WOLFCLU_L0, " Pass in a file to -oid in this format:") + WOLFCLU_LOG(WOLFCLU_L0, " 1.2.3.4 shortName Long name with " + "spaces"); + WOLFCLU_LOG(WOLFCLU_L0, " 5.6.7.8 shortName2 spaces with " + "name long\n"); + WOLFCLU_LOG(WOLFCLU_L0, " Entry Fields:"); + WOLFCLU_LOG(WOLFCLU_L0, " "); +} + +/* close all files opened during setup returns WOLFCLU_SUCCESS */ +static int Asn1ParseOptions_clean_up(WOLFCLU_ASN1_PARSE_OPTIONS *opt) +{ + if (opt->oidFile != NULL) { + XFCLOSE(opt->oidFile); + } + + if (opt->inputFile != NULL) { + XFCLOSE(opt->inputFile); + } + + if (opt->outputFile != NULL) { + XFCLOSE(opt->outputFile); + } + + *opt = (WOLFCLU_ASN1_PARSE_OPTIONS){ 0 }; + + return WOLFCLU_SUCCESS; +} + + +static int checkFileArg(const char *file, const char *flag, const char *mode, + XFILE *file_out) +{ + int ret = WOLFCLU_FATAL_ERROR; + + if (file != NULL) { + XFILE f = XFOPEN(file, mode); + if (f != NULL) { + if (*file_out != NULL) { + wolfCLU_LogError("File for %s was already opened", flag); + XFCLOSE(f); + return WOLFCLU_FATAL_ERROR; + } + *file_out = f; + ret = WOLFCLU_SUCCESS; + } + } + + if (ret != WOLFCLU_SUCCESS) { + file = file && (file[0] != '-') ? file : "*missing*"; + wolfCLU_LogError("%s argument either missing argument or " + "file does not exist : %s", + flag, file); + } + + return ret; +} + +/* check, parse, and set comma separated list for -strparse + * return WOLFCLU_SUCCESS if successful */ +static int checkStrParse(const char *arg, word32 *outSz, const word32 cap, + word32 *out) +{ + int ret = WOLFCLU_SUCCESS; + char *end; + char *token; + unsigned long len; + char* tmp; + + if (out == NULL || arg == NULL || outSz == NULL) { + return WOLFCLU_FATAL_ERROR; + } + + len = XSTRLEN(arg) + 1; + tmp = (char *)XMALLOC(len, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + + if (tmp == NULL) { + return MEMORY_E; + } + + XMEMCPY(tmp, arg, len); + + token = XSTRTOK(tmp, ",", &end); + while (token != NULL && ret == WOLFCLU_SUCCESS) { + word32 val = 0; + if (wolfCLU_StrToWord32(token, XSTRLEN(token), &val) != + WOLFCLU_SUCCESS) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError( + "Not a valid integer value passed to -strparse. %s", arg); + } + else if (*outSz >= cap) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Too many values passed to -strparse. " + "Max is %u : %s", cap, arg); + } + else { + out[(*outSz)++] = val; + } + token = XSTRTOK(NULL, ",", &end); + } + + XFREE(tmp, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + return ret; +} + +/* check and set the arg currently in optarg to the out + * return WOLFCLU_SUCCESS if successful */ +static int checkWord32Arg(const char *arg, const char *flagName, word32 *out) +{ + int ret = WOLFCLU_FATAL_ERROR; + + if (arg != NULL) { + ret = wolfCLU_StrToWord32(arg, XSTRLEN(arg), out); + } + + if (ret != WOLFCLU_SUCCESS) { + arg = arg && (arg[0] != '-') ? arg : "*missing*"; + wolfCLU_LogError("%s argument either missing argument or " + "is not a non negative integer : %s", + flagName, arg); + } + + return ret; +} + +/* takes optarg as inform and places inform id in inform_id returns + * WOLFCLU_SUCCESS if successful and a fatal error if not successful */ +static int checkInForm(char *inform, word8 *inform_id_out) +{ + int ret = WOLFCLU_FATAL_ERROR; + if (inform != NULL && XSTRLEN(inform) == 3) { + wolfCLU_convertToLower(inform, (int)XSTRLEN(inform)); + if (XSTRCMP(inform, "pem") == 0) { + *inform_id_out = WOLFCLU_ASN1_PEM; + ret = WOLFCLU_SUCCESS; + } + else if (XSTRCMP(inform, "der") == 0) { + *inform_id_out = WOLFCLU_ASN1_DER; + ret = WOLFCLU_SUCCESS; + } + else if (XSTRCMP(inform, "b64") == 0) { + *inform_id_out = WOLFCLU_ASN1_B64; + ret = WOLFCLU_SUCCESS; + } + } + + if (ret != WOLFCLU_SUCCESS) { + inform = inform && (inform[0] != '-') ? inform : (char*)"*missing*"; + wolfCLU_LogError("-inform argument either missing or is not valid " + "value : %s", inform); + } + return ret; +} +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ + +/* return WOLFCLU_SUCCESS on success */ +int wolfCLU_Asn1Setup(int argc, char *argv[]) +{ +#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) + int ret = WOLFCLU_SUCCESS; + int option; + int longIndex = 1; + static WOLFCLU_ASN1_PARSE_OPTIONS asn1Config = { 0 }; + + opterr = 0; + optind = 0; + while ((option = wolfCLU_GetOpt(argc, argv, "", asn1_options, + &longIndex)) != END_OF_ARGS && + ret == WOLFCLU_SUCCESS) { + switch (option) { + case WOLFCLU_INFORM: + ret = checkInForm(optarg, &asn1Config.inForm); + break; + + case WOLFCLU_OUTFILE: + ret = + checkFileArg(optarg, "-out", "wb", &asn1Config.outputFile); + break; + + case WOLFCLU_INFILE: + ret = checkFileArg(optarg, "-in", "rb", &asn1Config.inputFile); + break; + + case WOLFCLU_OID: +#ifndef NO_WC_ENCODE_OBJECT_ID + ret = checkFileArg(optarg, "-oid", "rb", &asn1Config.oidFile); +#else + wolfCLU_LogError("wolfSSL is not configured to " + "handle encoding oids"); + ret = WOLFCLU_FATAL_ERROR; +#endif /* NO_WC_ENCODE_OBJECT_ID */ + break; + + case WOLFCLU_OFFSET: + ret = checkWord32Arg(optarg, "-offset", &asn1Config.offset); + break; + + case WOLFCLU_LENGTH: + ret = checkWord32Arg(optarg, "-length", &asn1Config.length); + if (ret == WOLFCLU_SUCCESS && asn1Config.length == 0) { + wolfCLU_LogError("-length arg must be greater than 0"); + ret = WOLFCLU_FATAL_ERROR; + } + break; + + case WOLFCLU_STRPARSE: + ret = checkStrParse(optarg, &asn1Config.strParseSz, + WOLFCLU_ASN1_STR_PARSE_CAP, + asn1Config.strParse); + break; + + case WOLFCLU_NOOUT: + asn1Config.noOut = 1; + break; + + case WOLFCLU_DUMP: + asn1Config.dump = 1; + break; + + case WOLFCLU_INDENT: + asn1Config.indent = 1; + break; + + case WOLFCLU_HELP: + wolfCLU_Asn1Help(); + Asn1ParseOptions_clean_up(&asn1Config); + return WOLFCLU_SUCCESS; + + case ARG_FOUND_TWICE: + ret = WOLFCLU_FATAL_ERROR; + break; + + case '?': + default: + /* Unreachable */ + wolfCLU_LogError("Error getting arguments"); + ret = WOLFCLU_FATAL_ERROR; + break; + } + } + + if (ret == WOLFCLU_SUCCESS) { + ret = wolfCLU_Asn1Parse(&asn1Config); + } + + Asn1ParseOptions_clean_up(&asn1Config); + return ret; +#else +#if !defined(WOLFSSL_ASN_PRINT) + wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot parse Asn1."); +#endif /* !defined(WOLFSSL_ASN_PRINT) */ +#if defined(NO_FILESYSTEM) + wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot parse Asn1."); +#endif /* defined(NO_FILESYSTEM) */ + return WOLFCLU_FATAL_ERROR; +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ +} diff --git a/src/clu_main.c b/src/clu_main.c index 61e01772..8f72af8a 100644 --- a/src/clu_main.c +++ b/src/clu_main.c @@ -29,6 +29,7 @@ #include #include #include +#include #ifdef _WIN32 char* optarg; @@ -75,6 +76,7 @@ static const struct option mode_options[] = { {"rand", no_argument, 0, WOLFCLU_RAND }, {"dsaparam", no_argument, 0, WOLFCLU_DSA }, {"dhparam", no_argument, 0, WOLFCLU_DH }, + {"asn1parse", no_argument, 0, WOLFCLU_ASN1 }, #if defined(HAVE_OCSP) && defined(HAVE_OCSP_RESPONDER) {"ocsp", no_argument, 0, WOLFCLU_OCSP }, #endif @@ -328,6 +330,10 @@ int main(int argc, char** argv) ret = wolfCLU_Base64Setup(argc, argv); break; + case WOLFCLU_ASN1: + ret = wolfCLU_Asn1Setup(argc, argv); + break; + case WOLFCLU_HELP: /* only print for -help if no mode has been declared */ WOLFCLU_LOG(WOLFCLU_L0, "Main help menu:"); diff --git a/src/include.am b/src/include.am index 776b7c65..0ddf1513 100644 --- a/src/include.am +++ b/src/include.am @@ -48,6 +48,9 @@ wolfssl_SOURCES = src/clu_main.c \ src/tools/clu_http.c \ src/tools/clu_scgi.c \ src/tools/clu_pem_der.c \ - src/ocsp/clu_ocsp.c + src/ocsp/clu_ocsp.c \ + src/asn1/clu_asn1_setup.c \ + src/asn1/clu_asn1_parse.c + diff --git a/src/tools/clu_funcs.c b/src/tools/clu_funcs.c index 71c74c8a..b9438880 100644 --- a/src/tools/clu_funcs.c +++ b/src/tools/clu_funcs.c @@ -77,6 +77,7 @@ static const struct option crypt_algo_options[] = { WOLFCLU_LOG(WOLFCLU_L0, "-help Help, print out this help menu"); WOLFCLU_LOG(WOLFCLU_L0, " "); WOLFCLU_LOG(WOLFCLU_L0, "Only set one of the following.\n"); + WOLFCLU_LOG(WOLFCLU_L0, "asn1parse Used for parsing certificates as ASN1"); WOLFCLU_LOG(WOLFCLU_L0, "ca Used for signing certificates"); WOLFCLU_LOG(WOLFCLU_L0, "crl Used for parsing CRL files"); WOLFCLU_LOG(WOLFCLU_L0, "bench Benchmark one of the algorithms"); @@ -1312,6 +1313,35 @@ int wolfCLU_GetOpt(int argc, char** argv, const char *options, } +/* Parse a base-10 string into a word32, rejecting non-digits and overflow. + * On success *out is set; on failure *out is left unchanged. Callers log + * their own context-specific error message. + */ +int wolfCLU_StrToWord32(const char* arg, unsigned long strSz, word32* out) +{ + word32 val = 0; + if (arg == NULL || out == NULL || strSz == 0) { + return WOLFCLU_FATAL_ERROR; + } + + for (word32 i = 0; i < strSz; i++) { + word32 digit; + if (*arg < '0' || *arg > '9') { + return WOLFCLU_FATAL_ERROR; + } + digit = (word32)(*arg - '0'); + /* Detect word32 overflow before val = val * 10 + digit. */ + if (val > (0xFFFFFFFFU - digit) / 10) { + return WOLFCLU_FATAL_ERROR; + } + val = (val * 10) + digit; + arg++; + } + + *out = val; + return WOLFCLU_SUCCESS; +} + /* Stream-hash data read from bioIn using hashType and write the digest to * outDigest. On entry *outDigestSz is the capacity of outDigest; on success diff --git a/src/x509/clu_config.c b/src/x509/clu_config.c index 780e56db..14cb2590 100644 --- a/src/x509/clu_config.c +++ b/src/x509/clu_config.c @@ -24,6 +24,8 @@ #include #include #include +#include +#include #ifndef WOLFCLU_NO_FILESYSTEM @@ -347,7 +349,7 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, byte oid[ASN1_OID_DOTTED_MAX_SZ]; word32 oidSz = ASN1_OID_DOTTED_MAX_SZ; word32 decodedCount = 0; - word16 decoded[ASN1_OID_DOTTED_MAX_SZ]; + word32 decoded[ASN1_OID_DOTTED_MAX_SZ]; if (XSTRNCMP(name, "IP", 2) == 0) { ipStr = wolfSSL_a2i_IPADDRESS(value); @@ -395,8 +397,8 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, token = XSTRTOK(ridDup, ".", &ptr); while (token != NULL) { - char* digit; - int n; + word32 n; + if (decodedCount >= ASN1_OID_DOTTED_MAX_SZ) { wolfCLU_LogError("RID has too many components " @@ -405,29 +407,14 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, ret = WOLFCLU_FATAL_ERROR; break; } - /* require decimal-digits-only token so that things - * like "1a" or "abc" are rejected instead of being - * silently coerced by XATOI */ - for (digit = token; *digit != '\0'; digit++) { - if (*digit < '0' || *digit > '9') { - wolfCLU_LogError("Non-numeric RID " - "component '%s' in: %s", token, - value); - ret = WOLFCLU_FATAL_ERROR; - break; - } - } - if (ret != WOLFCLU_SUCCESS) { - break; - } - n = XATOI(token); - if (n < 0 || n > 0xFFFF) { - wolfCLU_LogError("RID component out of range " - "[0, 65535]: %s", token); + if (wolfCLU_StrToWord32(token, XSTRLEN(token), &n) != + WOLFCLU_SUCCESS) { + wolfCLU_LogError("RID component not a valid 32 bit" + " integer : %s", token); ret = WOLFCLU_FATAL_ERROR; break; } - decoded[decodedCount] = (word16)n; + decoded[decodedCount] = n; decodedCount++; token = XSTRTOK(NULL, ".", &ptr); } @@ -457,6 +444,10 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, wolfCLU_LogError("Couldn't encode RID. OID encoding is not" " compiled in"); + #if LIBWOLFSSL_VERSION_HEX <= 0x05009002 + wolfCLU_LogError("Old Version of wolfSSL %s must be greater " + "than 5.9.2 to use custom oids", WOLFSSL_VERSION); + #endif return WOLFCLU_FATAL_ERROR; #endif diff --git a/tests/asn1/asn1-test.py b/tests/asn1/asn1-test.py new file mode 100644 index 00000000..ee50fb1b --- /dev/null +++ b/tests/asn1/asn1-test.py @@ -0,0 +1,408 @@ +#!/usr/bin/env python3 +"""asn1parse tests for wolfCLU.""" + +import base64 +import functools +import os +import sys +import unittest + +sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..")) +from wolfclu_test import ( + CERTS_DIR, + config_defines, + run_wolfssl, + test_main, + truncate_sparse, +) + +# Two top-level DER INTEGERs (42, then 43): 02 01 2a 02 01 2b. +# Used to confirm -length truncates parsing and -offset skips ahead: the +# items are independent and minimally sized, so the count of "INTEGER" lines +# in the output is a direct measure of how much of the buffer was parsed. +TWO_INTEGERS = bytes([0x02, 0x01, 0x2a, 0x02, 0x01, 0x2b]) + +# Error fragment emitted when -oid is used in a build that compiled out OID +# encoding (see clu_asn1_setup.c). +_NO_OID_ENCODE_MSG = "not configured to handle encoding oids" + + +@functools.lru_cache(maxsize=None) +def oid_encoding_supported(): + """True when the build can DER-encode the OIDs from an -oid file. + + -oid relies on wc_EncodeObjectId, which is compiled out via + NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.1 (set in configure.ac). + In that build -oid reports a fatal error instead of encoding anything. + The flag is a -D in AM_CFLAGS rather than a config.h define, so it cannot + be read via config_defines(); probe the binary directly instead. A + nonexistent file is enough: the disabled path errors during argument + handling before the file is ever opened. + """ + result = run_wolfssl("asn1parse", "-oid", "asn1-oid-probe.nonexistent") + return _NO_OID_ENCODE_MSG not in (result.stdout + result.stderr) + + +class TestBasicFunctions(unittest.TestCase): + + @classmethod + def setUpClass(cls): + if not os.path.isdir(CERTS_DIR): + raise unittest.SkipTest("certs directory not found") + + cls.der = os.path.join(CERTS_DIR, "ca-cert.der") + cls.pem = os.path.join(CERTS_DIR, "ca-cert.pem") + + # Skip when asn1parse is not compiled in (needs WOLFSSL_ASN_PRINT). + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", cls.der) + if "Cannot Parse Asn1" in (result.stdout + result.stderr): + raise unittest.SkipTest("asn1parse support not compiled in") + + # Reference output produced from the DER form of the cert. + cls.der_output = result.stdout + + def test_DER(self): + """Parse a DER input and confirm the ASN.1 structure is printed.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("SEQUENCE", result.stdout) + + def test_PEM(self): + """PEM input of the same cert yields the same parse as DER.""" + result = run_wolfssl("asn1parse", "-inform", "PEM", "-in", self.pem) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, self.der_output) + + def test_base64(self): + """Base64 (non-PEM) input yields the same parse as DER.""" + b64_file = "test-asn1.b64" + self.addCleanup(lambda: os.remove(b64_file) + if os.path.exists(b64_file) else None) + with open(self.der, "rb") as f: + with open(b64_file, "w") as out: + out.write(base64.encodebytes(f.read()).decode()) + + result = run_wolfssl("asn1parse", "-inform", "B64", "-in", b64_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, self.der_output) + + def test_out_arg_is_DER(self): + """The -out file is the processed DER that was input""" + out_file = "test-asn1.out" + open(out_file, "w").close() + self.addCleanup(lambda: os.remove(out_file) + if os.path.exists(out_file) else None) + result = run_wolfssl("asn1parse", "-inform", "DER", "-noout", "-in", self.der, + "-out", out_file) + self.assertEqual(result.returncode, 0, result.stderr) + with open(out_file, "rb") as out: + with open(self.der, "rb") as infile: + self.assertEqual(str(out.read()), str(infile.read())) + + def test_out_arg(self): + """The -out flag (output file must exist) runs without error.""" + out_file = "test-asn1.out" + open(out_file, "w").close() + self.addCleanup(lambda: os.remove(out_file) + if os.path.exists(out_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-out", out_file) + self.assertEqual(result.returncode, 0, result.stderr) + + def test_noout_suppresses_stdout(self): + """-noout suppresses stdout but the -out file still gets the DER.""" + out_file = "test-asn1-noout.out" + self.addCleanup(lambda: os.remove(out_file) + if os.path.exists(out_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-out", out_file, "-noout") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, "") + + with open(out_file, "rb") as out: + with open(self.der, "rb") as infile: + self.assertEqual(out.read(), infile.read()) + + def test_noout_without_out_errors(self): + """-noout with no -out leaves no targets and is rejected.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-noout") + self.assertNotEqual(result.returncode, 0) + + def test_offset(self): + """An offset changes where parsing begins.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-offset", "4") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("SEQUENCE", result.stdout) + self.assertNotEqual(result.stdout, self.der_output) + + def test_strparse_octet_string(self): + """-strparse onto an OCTET/BIT STRING node succeeds. + + Build OCTET STRING { INTEGER 42 }: + 04 03 02 01 2a + -strparse 0 descends into the OCTET STRING at offset 0 and prints the + wrapped INTEGER, with no dependence on the bytes of any shipped cert. + """ + der_file = "test-asn1-strparse-octet.der" + with open(der_file, "wb") as f: + f.write(bytes([0x04, 0x03, 0x02, 0x01, 0x2a])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-strparse", "0") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("INTEGER", result.stdout) + + def test_strparse_nested_octet_strings(self): + """A comma-separated -strparse list drills through nested OCTET STRINGs. + + Build OCTET STRING { OCTET STRING { INTEGER 42 } }: + 04 05 04 03 02 01 2a + Each list entry is an offset (relative to the current substructure) of + an OCTET/BIT STRING to descend into, so "0,0" peels both wrappers and + leaves the INTEGER to be printed. + """ + der_file = "test-asn1-nested.der" + with open(der_file, "wb") as f: + f.write(bytes([0x04, 0x05, 0x04, 0x03, 0x02, 0x01, 0x2a])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + # Two levels: descend through both wrappers to the INTEGER. + r = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-strparse", "0,0") + self.assertEqual(r.returncode, 0, r.stderr) + self.assertIn("INTEGER", r.stdout) + self.assertNotIn("OCTET STRING", r.stdout) + + def test_strparse_bit_string(self): + """-strparse into a BIT STRING skips its leading unused-bits octet. + + Build BIT STRING { INTEGER 42 }: + 03 04 00 02 01 2a + The 0x00 unused-bits octet is not part of the nested DER, so -strparse + must step over it to reach and print the wrapped INTEGER. + """ + der_file = "test-asn1-strparse-bit.der" + with open(der_file, "wb") as f: + f.write(bytes([0x03, 0x04, 0x00, 0x02, 0x01, 0x2a])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-strparse", "0") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("INTEGER", result.stdout) + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_oid(self): + """A custom OID definition file maps an unknown OID to its name. + + The callback is only consulted for OIDs wolfSSL does not already + know, so use an arbitrary unknown OID (1.3.111111.5) encoded as a bare + OBJECT IDENTIFIER and confirm the supplied long name is printed. + """ + # DER: 06 05 2b 86 e4 07 05 == OBJECT IDENTIFIER 1.3.111111.5 + # 111111 base-128 = 6, 100, 7 -> 0x86 0xe4 0x07. + der_file = "test-asn1-unknown-oid.der" + with open(der_file, "wb") as f: + f.write(bytes([0x06, 0x05, 0x2b, 0x86, 0xe4, 0x07, 0x05])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + oid_file = "test-asn1-oid.conf" + with open(oid_file, "w") as f: + f.write("1.3.111111.5 myShort MyUnknownOid") + self.addCleanup(lambda: os.remove(oid_file) + if os.path.exists(oid_file) else None) + + # Without the mapping the OID prints in dotted-decimal form. + baseline = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) + self.assertEqual(baseline.returncode, 0, baseline.stderr) + self.assertIn("1.3.111111.5", baseline.stdout) + self.assertNotIn("MyUnknownOid", baseline.stdout) + + # With the mapping the custom long name is resolved. + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-oid", oid_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyUnknownOid", result.stdout) + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_oid_multibyte_first_subidentifier(self): + """A custom OID whose first subidentifier needs base-128 encoding maps. + + For OID 2.100.3 the first subidentifier is 40*2 + 100 = 180, which + exceeds 127 and must be encoded over two base-128 bytes (0x81 0x34). + Regression test: a single-byte encoding truncates and the -oid + mapping silently fails to match. + """ + # DER: 06 03 81 34 03 == OBJECT IDENTIFIER 2.100.3 + der_file = "test-asn1-arc2-oid.der" + with open(der_file, "wb") as f: + f.write(bytes([0x06, 0x03, 0x81, 0x34, 0x03])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + oid_file = "test-asn1-arc2-oid.conf" + with open(oid_file, "w") as f: + f.write("2.100.3 myShort MyArc2Oid\n") + self.addCleanup(lambda: os.remove(oid_file) + if os.path.exists(oid_file) else None) + + # Without the mapping the OID prints in dotted-decimal form. + baseline = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) + self.assertEqual(baseline.returncode, 0, baseline.stderr) + self.assertIn("2.100.3", baseline.stdout) + self.assertNotIn("MyArc2Oid", baseline.stdout) + + # With the mapping the custom long name is resolved, which only + # happens if the conf OID was DER-encoded to the same bytes. + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-oid", oid_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyArc2Oid", result.stdout) + + @unittest.skipUnless("HAVE_OID_TABLE" in config_defines(), + "built with --enable-oid-table") + def test_builtin_oid_table(self): + """The built-in OID table resolves an OID with no -oid file supplied. + + Exercises the second loop in OidToNameCallback (the static + oid_name_table), which is only compiled with --enable-oid-table. + 2.16.840.1.114171.500.9 ("Wells Fargo EV policy") is in the table but + not otherwise known to wolfSSL, so the callback is consulted and the + table name must be printed without any -oid mapping. + """ + # DER: 06 0a 60 86 48 01 86 fb 7b 83 74 09 + # == OBJECT IDENTIFIER 2.16.840.1.114171.500.9 + der_file = "test-asn1-builtin-oid.der" + with open(der_file, "wb") as f: + f.write(bytes([0x06, 0x0a, 0x60, 0x86, 0x48, 0x01, 0x86, 0xfb, + 0x7b, 0x83, 0x74, 0x09])) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("Wells Fargo EV policy", result.stdout) + + def test_length_truncates(self): + """A valid -length stops parsing at the byte limit. + + TWO_INTEGERS holds two independent top-level INTEGERs. Parsed whole, + both appear; with -length 3 (exactly the first INTEGER's TLV) only the + first is parsed, confirming the limit is honoured rather than ignored. + """ + der_file = "test-asn1-twoint.der" + with open(der_file, "wb") as f: + f.write(TWO_INTEGERS) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + full = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) + self.assertEqual(full.returncode, 0, full.stderr) + self.assertEqual(full.stdout.count("INTEGER"), 2) + + truncated = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-length", "3") + self.assertEqual(truncated.returncode, 0, truncated.stderr) + self.assertEqual(truncated.stdout.count("INTEGER"), 1) + + def test_offset_skips_leading_bytes(self): + """A valid -offset begins parsing past the skipped bytes. + + With -offset 3 the first INTEGER's TLV in TWO_INTEGERS is skipped, so + only the second INTEGER remains to be parsed. + """ + der_file = "test-asn1-twoint-off.der" + with open(der_file, "wb") as f: + f.write(TWO_INTEGERS) + self.addCleanup(lambda: os.remove(der_file) + if os.path.exists(der_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-offset", "3") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout.count("INTEGER"), 1) + + def test_offset_past_end(self): + """An -offset past the end of the input is rejected, not read OOB.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-offset", "9999999") + self.assertNotEqual(result.returncode, 0) + + def test_length_too_large(self): + """A -length larger than the remaining input is rejected.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-length", "9999999") + self.assertNotEqual(result.returncode, 0) + + def test_negative_integer_arg(self): + """A non-integer / negative argument to -offset is rejected.""" + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-offset", "-5") + self.assertNotEqual(result.returncode, 0) + + def test_strparse_non_octet_string(self): + """-strparse onto a non-OCTET/BIT STRING node errors out.""" + # The top-level node of the cert is a SEQUENCE, not an OCTET STRING. + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-strparse", "0") + self.assertNotEqual(result.returncode, 0) + + def test_input_file_too_large(self): + """A file larger than the 0xFFFFFFFEU byte max is rejected up front. + + asn1_ReadFile caps the input at 0xFFFFFFFEU bytes so that the +1 for the + null terminator still fits in a word32. A file one byte over that limit + (0xFFFFFFFFU) must be refused before any ~4GB buffer is allocated or + read, so the check has to fire on file size alone. The file is created + sparse (no real disk use) via truncate; skip if the platform/filesystem + cannot represent a file that large. + """ + big_file = "test-asn1-toobig.der" + # 0xFFFFFFF == one byte past the 0xFFFFFFEU maximum accepted length. + size = 0xFFFFFFF + try: + with open(big_file, "wb") as f: + truncate_sparse(f, size) + except (OSError, OverflowError) as e: + if os.path.exists(big_file): + os.remove(big_file) + raise unittest.SkipTest( + "cannot create a {}-byte sparse file: {}".format(size, e)) + self.addCleanup(lambda: os.remove(big_file) + if os.path.exists(big_file) else None) + + # A filesystem may silently cap the length; only meaningful if the file + # really reports a size past the limit. + if os.path.getsize(big_file) != size: + raise unittest.SkipTest("filesystem did not honour the sparse size") + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", big_file) + self.assertNotEqual(result.returncode, 0) + self.assertIn("longer than", result.stdout + result.stderr) + + def test_malformed_oid_file(self): + """A malformed -oid definition file is rejected.""" + oid_file = "test-asn1-bad-oid.conf" + with open(oid_file, "w") as f: + # Missing the short and long name tokens. + f.write("1.2.3.4\n") + self.addCleanup(lambda: os.remove(oid_file) + if os.path.exists(oid_file) else None) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, + "-oid", oid_file) + self.assertNotEqual(result.returncode, 0) + + +if __name__ == "__main__": + test_main() diff --git a/tests/asn1/include.am b/tests/asn1/include.am new file mode 100644 index 00000000..159599e6 --- /dev/null +++ b/tests/asn1/include.am @@ -0,0 +1,6 @@ +# vim:ft=automake +# included from top level Makefile.am +# ALl path should be given relative to root directory + +dist_noinst_SCRIPTS+=tests/asn1/asn1-test.py + diff --git a/tests/run_tests_parallel.py b/tests/run_tests_parallel.py old mode 100644 new mode 100755 diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index 6909c2e3..f19be35b 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -181,6 +181,32 @@ def truncate_sparse(fileobj, size): raise ctypes.WinError() +def config_defines(): + """Return the set of macros defined in the generated wolfclu/config.h. + + Some features are compile-time options (e.g. --enable-oid-table sets + HAVE_OID_TABLE) with no runtime flag to query, so tests that exercise + those paths need to read the build configuration. config.h lives in the + build directory, which differs from the source tree under distcheck; + honour WOLFCLU_BUILDDIR, then fall back to the current working directory + and the source tree. Disabled options appear as `/* #undef NAME */`, + which this deliberately does not count as defined. + """ + defined = set() + builddir = os.environ.get("WOLFCLU_BUILDDIR") or os.getcwd() + for base in (builddir, _PROJECT_ROOT): + path = os.path.join(base, "wolfclu", "config.h") + if not os.path.isfile(path): + continue + with open(path) as f: + for line in f: + parts = line.split() + if len(parts) >= 2 and parts[0] == "#define": + defined.add(parts[1]) + break + return defined + + def test_main(): """Run tests with automake-compatible exit codes. diff --git a/wolfCLU.vcxproj b/wolfCLU.vcxproj index 8faba25e..ce833578 100644 --- a/wolfCLU.vcxproj +++ b/wolfCLU.vcxproj @@ -187,6 +187,8 @@ + + @@ -207,6 +209,8 @@ + + diff --git a/wolfCLU.vcxproj.filters b/wolfCLU.vcxproj.filters index 9c43d2c1..5ce9c503 100644 --- a/wolfCLU.vcxproj.filters +++ b/wolfCLU.vcxproj.filters @@ -203,6 +203,9 @@ Header Files + + Header Files + Header Files diff --git a/wolfclu/asn1/clu_asn1.h b/wolfclu/asn1/clu_asn1.h new file mode 100644 index 00000000..bd7d56e4 --- /dev/null +++ b/wolfclu/asn1/clu_asn1.h @@ -0,0 +1,76 @@ +/* clu_asn1.h + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + +#ifndef CLU_ASN1_H +#define CLU_ASN1_H + +#ifndef WOLFSSL_USER_SETTINGS +#include +#endif +#include +#include +#include +#include +#include +#include + +/* number of str parse "digs" allowed */ +#ifndef WOLFCLU_ASN1_STR_PARSE_CAP + #define WOLFCLU_ASN1_STR_PARSE_CAP 10 +#endif + +typedef struct WOLFCLU_ASN1_PARSE_OPTIONS +#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT) +{ + XFILE inputFile; + XFILE outputFile; + XFILE oidFile; + Asn1OidToNameCb nameCb; + word32 strParse[WOLFCLU_ASN1_STR_PARSE_CAP]; + word32 strParseSz; + word32 length; + word32 offset; + word8 inForm; + word8 dump; + word8 indent; + word8 noOut; +} +#endif +WOLFCLU_ASN1_PARSE_OPTIONS; + +enum { +WOLFCLU_ASN1_DER = 0, +WOLFCLU_ASN1_B64, +WOLFCLU_ASN1_PEM, +}; + +/* Entry point for the asn1parse command. Parses argc/argv into a + * WOLFCLU_ASN1_PARSE_OPTIONS struct and hands off to wolfCLU_Asn1Parse(). + * Returns WOLFCLU_SUCCESS on success. */ +int wolfCLU_Asn1Setup(int argc, char* argv[]); + +/* Performs the ASN.1 operation described by parseOptions: decodes the input + * (DER, base64 or PEM), applies the offset/length/string-parse selections, and + * writes the formatted structure to the configured output target(s). + * Returns WOLFCLU_SUCCESS on success. */ +int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* parseOptions); + +#endif diff --git a/wolfclu/asn1/clu_oid_name_table.h b/wolfclu/asn1/clu_oid_name_table.h new file mode 100644 index 00000000..dbaa6417 --- /dev/null +++ b/wolfclu/asn1/clu_oid_name_table.h @@ -0,0 +1,5576 @@ +#ifndef CLU_OID_NAME_TABLE_H +#define CLU_OID_NAME_TABLE_H + +#ifdef HAVE_CONFIG_H + #include +#endif +#include + +typedef struct OidName{ + byte* oid; + word32 len; + const char* name; +} OidName; + +typedef struct WOLFCLU_OID_TO_NAME{ + /* oid and name point in to databuffer */ + OidName* entries; + /* buffer that holds all oid and name strings in OidName struct */ + byte* dataBuffer; + word32 len; + word32 cap; +}WOLFCLU_OID_TO_NAME; + +#if defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) && \ + defined(WOLFSSL_ASN_PRINT) +/* taken from examples/asn1/oid_names.h in wolfssl */ +static const OidName oid_name_table[] = { + { (byte*)"\x02\x82\x06\x01\x0a", 5, + "Telesec" }, + { (byte*)"\x02\x82\x06\x01\x0a\x00", 6, + "extension" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01", 6, + "mechanism" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00", 7, + "authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x01", 8, + "passwordAuthentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x02", 8, + "protectedPasswordAuthentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x03", 8, + "oneWayX509Authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x04", 8, + "twoWayX509Authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x05", 8, + "threeWayX509Authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x06", 8, + "oneWayISO9798Authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x07", 8, + "twoWayISO9798Authentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x00\x08", 8, + "telekomAuthentication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01", 7, + "signature" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x01", 8, + "md4WithRSAAndISO9697" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x02", 8, + "md4WithRSAAndTelesecSignatureStandard" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x03", 8, + "md5WithRSAAndISO9697" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x04", 8, + "md5WithRSAAndTelesecSignatureStandard" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x05", 8, + "ripemd160WithRSAAndTelekomSignatureStandard" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x01\x09", 8, + "hbciRsaSignature" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02", 7, + "encryption" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x00", 8, + "none" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x01", 8, + "rsaTelesec" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02", 8, + "des" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02\x01", 9, + "desECB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02\x02", 9, + "desCBC" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02\x03", 9, + "desOFB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02\x04", 9, + "desCFB8" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x02\x05", 9, + "desCFB64" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03", 8, + "des3" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03\x01", 9, + "des3ECB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03\x02", 9, + "des3CBC" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03\x03", 9, + "des3OFB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03\x04", 9, + "des3CFB8" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x03\x05", 9, + "des3CFB64" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x04", 8, + "magenta" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05", 8, + "idea" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05\x01", 9, + "ideaECB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05\x02", 9, + "ideaCBC" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05\x03", 9, + "ideaOFB" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05\x04", 9, + "ideaCFB8" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x02\x05\x05", 9, + "ideaCFB64" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03", 7, + "oneWayFunction" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x01", 8, + "md4" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x02", 8, + "md5" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x03", 8, + "sqModNX509" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x04", 8, + "sqModNISO" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x05", 8, + "ripemd128" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x06", 8, + "hashUsingBlockCipher" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x07", 8, + "mac" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x03\x08", 8, + "ripemd160" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x04", 7, + "fecFunction" }, + { (byte*)"\x02\x82\x06\x01\x0a\x01\x04\x01", 8, + "reedSolomon" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02", 6, + "module" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x00", 7, + "algorithms" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x01", 7, + "attributeTypes" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x02", 7, + "certificateTypes" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x03", 7, + "messageTypes" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x04", 7, + "plProtocol" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x05", 7, + "smeAndComponentsOfSme" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x06", 7, + "fec" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x07", 7, + "usefulDefinitions" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x08", 7, + "stefiles" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x09", 7, + "sadmib" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x0a", 7, + "electronicOrder" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x0b", 7, + "telesecTtpAsymmetricApplication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x0c", 7, + "telesecTtpBasisApplication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x0d", 7, + "telesecTtpMessages" }, + { (byte*)"\x02\x82\x06\x01\x0a\x02\x0e", 7, + "telesecTtpTimeStampApplication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03", 6, + "objectClass" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x00", 7, + "telesecOtherName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x01", 7, + "directory" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x02", 7, + "directoryType" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x03", 7, + "directoryGroup" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x04", 7, + "directoryUser" }, + { (byte*)"\x02\x82\x06\x01\x0a\x03\x05", 7, + "symmetricKeyEntry" }, + { (byte*)"\x02\x82\x06\x01\x0a\x04", 6, + "package" }, + { (byte*)"\x02\x82\x06\x01\x0a\x05", 6, + "parameter" }, + { (byte*)"\x02\x82\x06\x01\x0a\x06", 6, + "nameBinding" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07", 6, + "attribute" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x00", 7, + "applicationGroupIdentifier" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x01", 7, + "certificateType" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x02", 7, + "telesecCertificate" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x03", 7, + "certificateNumber" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x04", 7, + "certificateRevocationList" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x05", 7, + "creationDate" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x06", 7, + "issuer" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x07", 7, + "namingAuthority" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x08", 7, + "publicKeyDirectory" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x09", 7, + "securityDomain" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0a", 7, + "subject" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0b", 7, + "timeOfRevocation" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0c", 7, + "userGroupReference" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0d", 7, + "validity" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0e", 7, + "zert93" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x0f", 7, + "securityMessEnv" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x10", 7, + "anonymizedPublicKeyDirectory" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x11", 7, + "telesecGivenName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x12", 7, + "nameAdditions" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x13", 7, + "telesecPostalCode" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x14", 7, + "nameDistinguisher" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x15", 7, + "telesecCertificateList" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x16", 7, + "teletrustCertificateList" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x17", 7, + "x509CertificateList" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x18", 7, + "timeOfIssue" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x19", 7, + "physicalCardNumber" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1a", 7, + "fileType" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1b", 7, + "ctlFileIsArchive" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1c", 7, + "emailAddress" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1d", 7, + "certificateTemplateList" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1e", 7, + "directoryName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x1f", 7, + "directoryTypeName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x20", 7, + "directoryGroupName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x21", 7, + "directoryUserName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x22", 7, + "revocationFlag" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x23", 7, + "symmetricKeyEntryName" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x24", 7, + "glNumber" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x25", 7, + "goNumber" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x26", 7, + "gKeyData" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x27", 7, + "zKeyData" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x28", 7, + "ktKeyData" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x29", 7, + "ktKeyNumber" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x33", 7, + "timeOfRevocationGen" }, + { (byte*)"\x02\x82\x06\x01\x0a\x07\x34", 7, + "liabilityText" }, + { (byte*)"\x02\x82\x06\x01\x0a\x08", 6, + "attributeGroup" }, + { (byte*)"\x02\x82\x06\x01\x0a\x09", 6, + "action" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0a", 6, + "notification" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0b", 6, + "snmp-mibs" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0b\x01", 7, + "securityApplication" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c", 6, + "certAndCrlExtensionDefinitions" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x00", 7, + "liabilityLimitationFlag" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x01", 7, + "telesecCertIdExt" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x02", 7, + "Telesec policyIdentifier" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x03", 7, + "telesecPolicyQualifierID" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x04", 7, + "telesecCRLFilteredExt" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x05", 7, + "telesecCRLFilterExt" }, + { (byte*)"\x02\x82\x06\x01\x0a\x0c\x06", 7, + "telesecNamingAuthorityExt" }, + { (byte*)"\x04\x00\x7f\x00\x07", 5, + "bsi" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01", 6, + "bsiEcc" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01", 7, + "bsifieldType" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x01", 8, + "bsiPrimeField" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02", 8, + "bsiCharacteristicTwoField" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x02", 9, + "bsiECTLVKeyFormat" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x02\x01", 10, + "bsiECTLVPublicKey" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x03", 9, + "bsiCharacteristicTwoBasis" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x03\x01", 10, + "bsiGnBasis" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x03\x02", 10, + "bsiTpBasis" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x02\x03\x03", 10, + "bsiPpBasis" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01", 9, + "bsiEcdsaSignatures" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x01", 10, + "bsiEcdsaWithSHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x02", 10, + "bsiEcdsaWithSHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x03", 10, + "bsiEcdsaWithSHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x04", 10, + "bsiEcdsaWithSHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x05", 10, + "bsiEcdsaWithSHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x04\x01\x06", 10, + "bsiEcdsaWithRIPEMD160" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01", 10, + "bsiEckaEgX963KDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x01", 11, + "bsiEckaEgX963KDFWithSHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x02", 11, + "bsiEckaEgX963KDFWithSHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x03", 11, + "bsiEckaEgX963KDFWithSHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x04", 11, + "bsiEckaEgX963KDFWithSHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x05", 11, + "bsiEckaEgX963KDFWithSHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x01\x06", 11, + "bsiEckaEgX963KDFWithRIPEMD160" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x02", 10, + "bsiEckaEgSessionKDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x02\x01", 11, + "bsiEckaEgSessionKDFWith3DES" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x02\x02", 11, + "bsiEckaEgSessionKDFWithAES128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x02\x03", 11, + "bsiEckaEgSessionKDFWithAES192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x01\x02\x04", 11, + "bsiEckaEgSessionKDFWithAES256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02", 9, + "bsiEckaDH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01", 10, + "bsiEckaDHX963KDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x01", 11, + "bsiEckaDHX963KDFWithSHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x02", 11, + "bsiEckaDHX963KDFWithSHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x03", 11, + "bsiEckaDHX963KDFWithSHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x04", 11, + "bsiEckaDHX963KDFWithSHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x05", 11, + "bsiEckaDHX963KDFWithSHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x01\x06", 11, + "bsiEckaDHX963KDFWithRIPEMD160" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x02", 10, + "bsiEckaDHSessionKDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x02\x01", 11, + "bsiEckaDHSessionKDFWith3DES" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x02\x02", 11, + "bsiEckaDHSessionKDFWithAES128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x02\x03", 11, + "bsiEckaDHSessionKDFWithAES192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x01\x05\x02\x02\x04", 11, + "bsiEckaDHSessionKDFWithAES256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x02", 7, + "bsiEcKeyType" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x02\x01", 8, + "bsiEcPublicKey" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x05\x01", 8, + "bsiKaeg" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x05\x01\x01", 9, + "bsiKaegWithX963KDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x01\x05\x01\x02", 9, + "bsiKaegWith3DESKDF" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x01", 8, + "bsiPK" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x01\x01", 9, + "bsiPK_DH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x01\x02", 9, + "bsiPK_ECDH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02", 8, + "bsiTA" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01", 9, + "bsiTA_RSA" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x01", 10, + "bsiTA_RSAv1_5_SHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x02", 10, + "bsiTA_RSAv1_5_SHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x03", 10, + "bsiTA_RSAPSS_SHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x04", 10, + "bsiTA_RSAPSS_SHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x05", 10, + "bsiTA_RSAv1_5_SHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x01\x06", 10, + "bsiTA_RSAPSS_SHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02", 9, + "bsiTA_ECDSA" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02\x01", 10, + "bsiTA_ECDSA_SHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02\x02", 10, + "bsiTA_ECDSA_SHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02\x03", 10, + "bsiTA_ECDSA_SHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02\x04", 10, + "bsiTA_ECDSA_SHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x02\x02\x05", 10, + "bsiTA_ECDSA_SHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03", 8, + "bsiCA" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x01", 9, + "bsiCA_DH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x01\x01", 10, + "bsiCA_DH_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x01\x02", 10, + "bsiCA_DH_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x01\x03", 10, + "bsiCA_DH_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x01\x04", 10, + "bsiCA_DH_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x02", 9, + "bsiCA_ECDH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x02\x01", 10, + "bsiCA_ECDH_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x02\x02", 10, + "bsiCA_ECDH_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x02\x03", 10, + "bsiCA_ECDH_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x03\x02\x04", 10, + "bsiCA_ECDH_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04", 8, + "bsiPACE" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x01", 9, + "bsiPACE_DH_GM" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x01\x01", 10, + "bsiPACE_DH_GM_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x01\x02", 10, + "bsiPACE_DH_GM_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x01\x03", 10, + "bsiPACE_DH_GM_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x01\x04", 10, + "bsiPACE_DH_GM_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x02", 9, + "bsiPACE_ECDH_GM" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x02\x01", 10, + "bsiPACE_ECDH_GM_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x02\x02", 10, + "bsiPACE_ECDH_GM_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x02\x03", 10, + "bsiPACE_ECDH_GM_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x02\x04", 10, + "bsiPACE_ECDH_GM_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x03", 9, + "bsiPACE_DH_IM" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x03\x01", 10, + "bsiPACE_DH_IM_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x03\x02", 10, + "bsiPACE_DH_IM_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x03\x03", 10, + "bsiPACE_DH_IM_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x03\x04", 10, + "bsiPACE_DH_IM_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x04", 9, + "bsiPACE_ECDH_IM" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x04\x01", 10, + "bsiPACE_ECDH_IM_3DES_CBC_CBC" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x04\x02", 10, + "bsiPACE_ECDH_IM_AES_CBC_CMAC_128" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x04\x03", 10, + "bsiPACE_ECDH_IM_AES_CBC_CMAC_192" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x04\x04\x04", 10, + "bsiPACE_ECDH_IM_AES_CBC_CMAC_256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05", 8, + "bsiRI" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01", 9, + "bsiRI_DH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01\x01", 10, + "bsiRI_DH_SHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01\x02", 10, + "bsiRI_DH_SHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01\x03", 10, + "bsiRI_DH_SHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01\x04", 10, + "bsiRI_DH_SHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x01\x05", 10, + "bsiRI_DH_SHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02", 9, + "bsiRI_ECDH" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02\x01", 10, + "bsiRI_ECDH_SHA1" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02\x02", 10, + "bsiRI_ECDH_SHA224" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02\x03", 10, + "bsiRI_ECDH_SHA256" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02\x04", 10, + "bsiRI_ECDH_SHA384" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x05\x02\x05", 10, + "bsiRI_ECDH_SHA512" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x06", 8, + "bsiCardInfo" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x07", 8, + "bsiEidSecurity" }, + { (byte*)"\x04\x00\x7f\x00\x07\x02\x02\x08", 8, + "bsiPT" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x02", 8, + "bsiEACRoles" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x02\x01", 9, + "bsiEACRolesIS" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x02\x02", 9, + "bsiEACRolesAT" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x02\x03", 9, + "bsiEACRolesST" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03", 8, + "bsiTAv2ce" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03\x01", 9, + "bsiTAv2ceDescription" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03\x01\x01", 10, + "bsiTAv2ceDescriptionPlainText" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03\x01\x02", 10, + "bsiTAv2ceDescriptionIA5String" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03\x01\x03", 10, + "bsiTAv2ceDescriptionOctetString" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x03\x02", 9, + "bsiTAv2ceTerminalSector" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x04", 8, + "bsiAuxData" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x04\x01", 9, + "bsiAuxDataBirthday" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x04\x02", 9, + "bsiAuxDataExpireDate" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x04\x03", 9, + "bsiAuxDataCommunityID" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05", 8, + "bsiDefectList" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x01", 9, + "bsiDefectAuthDefect" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x01\x01", 10, + "bsiDefectCertRevoked" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x01\x02", 10, + "bsiDefectCertReplaced" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x01\x03", 10, + "bsiDefectChipAuthKeyRevoked" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x01\x04", 10, + "bsiDefectActiveAuthKeyRevoked" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x02", 9, + "bsiDefectEPassportDefect" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x02\x01", 10, + "bsiDefectEPassportDGMalformed" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x02\x02", 10, + "bsiDefectSODInvalid" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x03", 9, + "bsiDefectEIDDefect" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x03\x01", 10, + "bsiDefectEIDDGMalformed" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x03\x02", 10, + "bsiDefectEIDIntegrity" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x04", 9, + "bsiDefectDocumentDefect" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x04\x01", 10, + "bsiDefectCardSecurityMalformed" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x04\x02", 10, + "bsiDefectChipSecurityMalformed" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x05\x04\x03", 10, + "bsiDefectPowerDownReq" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x01\x06", 8, + "bsiListContentDescription" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x02\x01", 8, + "bsiSecurityObject" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x02\x02", 8, + "bsiBlackList" }, + { (byte*)"\x04\x00\x7f\x00\x07\x03\x04\x02\x02", 9, + "bsiSignedUpdateDeviceAdmin" }, + { (byte*)"\x04\x00\x7f\x00\x07\x04\x01\x01\x01", 9, + "bsiCertReqMsgs" }, + { (byte*)"\x04\x00\x7f\x00\x07\x04\x01\x01\x02", 9, + "bsiCertReqMsgswithOuterSignature" }, + { (byte*)"\x04\x00\x7f\x00\x07\x04\x01\x01\x03", 9, + "bsiAuthorizedCertReqMsgs" }, + { (byte*)"\x04\x00\x7f\x00\x07\x04\x01\x02\x02", 9, + "bsiSignedRevReqs" }, + { (byte*)"\x04\x00\x8e\x46", 4, + "etsiQcsProfile" }, + { (byte*)"\x04\x00\x8e\x46\x01", 5, + "etsiQcs" }, + { (byte*)"\x04\x00\x8e\x46\x01\x01", 6, + "etsiQcsCompliance" }, + { (byte*)"\x04\x00\x8e\x46\x01\x02", 6, + "etsiQcsLimitValue" }, + { (byte*)"\x04\x00\x8e\x46\x01\x03", 6, + "etsiQcsRetentionPeriod" }, + { (byte*)"\x04\x00\x8e\x46\x01\x04", 6, + "etsiQcsQcSSCD" }, + { (byte*)"\x04\x00\x8e\x46\x01\x05", 6, + "etsiQcsQcPDS" }, + { (byte*)"\x04\x00\x8e\x46\x01\x06", 6, + "etsiQcsQcType" }, + { (byte*)"\x04\x00\x8e\x46\x01\x06\x01", 7, + "etsiQcsQctEsign" }, + { (byte*)"\x04\x00\x8e\x46\x01\x06\x02", 7, + "etsiQcsQctEseal" }, + { (byte*)"\x04\x00\x8e\x46\x01\x06\x03", 7, + "etsiQcsQctWeb" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x01", 6, + "normalisedCertificatePolicy" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x02", 6, + "normalisedCertificatePolicyPlus" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x03", 6, + "lightweightCertificatePolicy" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x04", 6, + "evCertificatePolicy" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x05", 6, + "evCertificatePolicyPlus" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x06", 6, + "dvCertificatePolicy" }, + { (byte*)"\x04\x00\x8f\x7a\x01\x07", 6, + "ovCertificatePolicy" }, + { (byte*)"\x04\x00\x8b\xec\x40\x01\x00", 7, + "qcpNatural" }, + { (byte*)"\x04\x00\x8b\xec\x40\x01\x01", 7, + "qcpLegal" }, + { (byte*)"\x04\x00\x8b\xec\x40\x01\x02", 7, + "qcpNaturalQscd" }, + { (byte*)"\x04\x00\x8b\xec\x40\x01\x03", 7, + "qcpLegalQscd" }, + { (byte*)"\x04\x00\x8b\xec\x40\x01\x04", 7, + "qcpWeb" }, + { (byte*)"\x04\x00\x8b\xec\x49\x01\x01", 7, + "qcsSemanticsIdNatural" }, + { (byte*)"\x04\x00\x8b\xec\x49\x01\x02", 7, + "qcsSemanticsIdLegal" }, + { (byte*)"\x04\x00\x8b\xec\x49\x01\x03", 7, + "qcsSemanticsIdeIDASNatural" }, + { (byte*)"\x04\x00\x8b\xec\x49\x01\x04", 7, + "qcsSemanticsIdeIDASLegal" }, + { (byte*)"\x09\x92\x26\x89\x93\xf2\x2c\x64\x01\x01", 10, + "userID" }, + { (byte*)"\x09\x92\x26\x89\x93\xf2\x2c\x64\x01\x03", 10, + "rfc822Mailbox" }, + { (byte*)"\x09\x92\x26\x89\x93\xf2\x2c\x64\x01\x19", 10, + "domainComponent" }, + { (byte*)"\x28\xcf\x06\x03\x00\x31", 6, + "ripemd160" }, + { (byte*)"\x28\xcf\x06\x03\x00\x32", 6, + "ripemd128" }, + { (byte*)"\x28\xcf\x06\x03\x00\x37", 6, + "whirlpool" }, + { (byte*)"\x28\x81\x8c\x71\x02", 5, + "iso18033-2" }, + { (byte*)"\x28\x81\x8c\x71\x02\x02", 6, + "kem" }, + { (byte*)"\x28\x81\x8c\x71\x02\x02\x04", 7, + "kemRSA" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01", 7, + "qgpki" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01", 8, + "qgpkiPolicies" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01", 9, + "qgpkiMedIntermedCA" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01\x01", 10, + "qgpkiMedIntermedIndividual" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01\x02", 10, + "qgpkiMedIntermedDeviceControl" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01\x03", 10, + "qgpkiMedIntermedDevice" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01\x04", 10, + "qgpkiMedIntermedAuthorisedParty" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x01\x05", 10, + "qgpkiMedIntermedDeviceSystem" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02", 9, + "qgpkiMedIssuingCA" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x01", 10, + "qgpkiMedIssuingIndividual" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x02", 10, + "qgpkiMedIssuingDeviceControl" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x03", 10, + "qgpkiMedIssuingDevice" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x04", 10, + "qgpkiMedIssuingAuthorisedParty" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x05", 10, + "qgpkiMedIssuingClientAuth" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x06", 10, + "qgpkiMedIssuingServerAuth" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x07", 10, + "qgpkiMedIssuingDataProt" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x02\x08", 10, + "qgpkiMedIssuingTokenAuth" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x03", 9, + "qgpkiBasicIntermedCA" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x03\x01", 10, + "qgpkiBasicIntermedDeviceSystem" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x04", 9, + "qgpkiBasicIssuingCA" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x04\x01", 10, + "qgpkiBasicIssuingClientAuth" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x04\x02", 10, + "qgpkiBasicIssuingServerAuth" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x01\x04\x03", 10, + "qgpkiBasicIssuingDataSigning" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x02", 8, + "qgpkiAssuranceLevel" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x02\x01", 9, + "qgpkiAssuranceRudimentary" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x02\x02", 9, + "qgpkiAssuranceBasic" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x02\x03", 9, + "qgpkiAssuranceMedium" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x02\x04", 9, + "qgpkiAssuranceHigh" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x03", 8, + "qgpkiCertFunction" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x03\x01", 9, + "qgpkiFunctionIndividual" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x03\x02", 9, + "qgpkiFunctionDevice" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x03\x03", 9, + "qgpkiFunctionAuthorisedParty" }, + { (byte*)"\x2a\x24\x01\x03\x01\x01\x01\x03\x04", 9, + "qgpkiFunctionDeviceControl" }, + { (byte*)"\x2a\x24\x01\x03\x01\x02", 6, + "qpspki" }, + { (byte*)"\x2a\x24\x01\x03\x01\x02\x01", 7, + "qpspkiPolicies" }, + { (byte*)"\x2a\x24\x01\x03\x01\x02\x01\x02", 8, + "qpspkiPolicyBasic" }, + { (byte*)"\x2a\x24\x01\x03\x01\x02\x01\x03", 8, + "qpspkiPolicyMedium" }, + { (byte*)"\x2a\x24\x01\x03\x01\x02\x01\x04", 8, + "qpspkiPolicyHigh" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02", 7, + "qtmrpki" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x01", 8, + "qtmrpkiPolicies" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02", 8, + "qtmrpkiPurpose" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02\x01", 9, + "qtmrpkiIndividual" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02\x02", 9, + "qtmrpkiDeviceControl" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02\x03", 9, + "qtmrpkiDevice" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02\x04", 9, + "qtmrpkiAuthorisedParty" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x02\x05", 9, + "qtmrpkiDeviceSystem" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03", 8, + "qtmrpkiDevice" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03\x01", 9, + "qtmrpkiDriverLicense" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03\x02", 9, + "qtmrpkiIndustryAuthority" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03\x03", 9, + "qtmrpkiMarineLicense" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03\x04", 9, + "qtmrpkiAdultProofOfAge" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x03\x05", 9, + "qtmrpkiSam" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04", 8, + "qtmrpkiAuthorisedParty" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04\x01", 9, + "qtmrpkiTransportInspector" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04\x02", 9, + "qtmrpkiPoliceOfficer" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04\x03", 9, + "qtmrpkiSystem" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04\x04", 9, + "qtmrpkiLiquorLicensingInspector" }, + { (byte*)"\x2a\x24\x01\x03\x01\x03\x02\x04\x05", 9, + "qtmrpkiMarineEnforcementOfficer" }, + { (byte*)"\x2a\x24\x01\x82\x4d\x01", 6, + "australianBusinessNumber" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x02", 9, + "signetPersonal" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x03", 9, + "signetBusiness" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x04", 9, + "signetLegal" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x0a", 9, + "signetPilot" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x0b", 9, + "signetIntraNet" }, + { (byte*)"\x2a\x24\xa0\xf2\xa0\x7d\x01\x01\x14", 9, + "signetPolicy" }, + { (byte*)"\x2a\x24\xa4\x97\xa3\x53\x01\x64\x01\x01", 10, + "certificatesAustraliaPolicy" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x02\x01", 10, + "bignPubkey" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x03\x01", 10, + "bignParamB1" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x03\x02", 10, + "bignParamB2" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x03\x03", 10, + "bignParamB3" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x0b", 9, + "bignWithHSpec" }, + { (byte*)"\x2a\x70\x00\x02\x00\x22\x65\x2d\x0c", 9, + "bignWithHBelt" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01", 6, + "gmtCryptographicAlgorithm" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x64", 7, + "gmtBlockCipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x66", 7, + "sm1Cipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x67", 7, + "ssf33Cipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x68", 7, + "sm4Cipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x81\x48", 8, + "gmtStreamCipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x81\x49", 8, + "zucCipher" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2c", 8, + "gmtPublicKeyCryptography" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2d", 8, + "sm2ECC" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2d\x01", 9, + "sm2-1DigitalSignature" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2d\x02", 9, + "sm2-2KeyExchange" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2d\x03", 9, + "sm2-3PublicKeyEncryption" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2e", 8, + "gmtSM9IBE" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2e\x01", 9, + "sm9-1DigitalSignature" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2e\x02", 9, + "sm9-2KeyExchange" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x82\x2e\x03", 9, + "sm9-3PublicKeyEncryption" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x10", 8, + "gmtHashAlgorithm" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x11", 8, + "sm3Hash" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x11\x01", 9, + "sm3HashWithoutKey" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x11\x02", 9, + "sm3HashWithKey" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x74", 8, + "gmtDigestSigning" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x75", 8, + "sm2withSM3" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x01\x83\x78", 8, + "rsaWithSM3" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x04\x03", 7, + "gmtCertificateAuthority" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06", 6, + "gmtStandardClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01", 7, + "gmtFoundationClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x01", 8, + "gmtAlgorithmClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x01\x01", 9, + "zucStandard" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x01\x02", 9, + "sm4Standard" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x01\x03", 9, + "sm2Standard" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x01\x04", 9, + "sm3Standard" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x02", 8, + "gmtIDClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x02\x01", 9, + "gmtCryptoID" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x03", 8, + "gmtOperationModes" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x04", 8, + "gmtSecurityMechanism" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x04\x01", 9, + "gmtSM2Specification" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x01\x04\x02", 9, + "gmtSM2CryptographicMessageSyntax" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x02", 7, + "gmtDeviceClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x03", 7, + "gmtServiceClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x04", 7, + "gmtInfrastructure" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x05", 7, + "gmtTestingClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x05\x01", 8, + "gmtRandomTestingClass" }, + { (byte*)"\x2a\x81\x1c\xcf\x55\x06\x06", 7, + "gmtManagementClass" }, + { (byte*)"\x2a\x83\x08\x8c\x9a\x4b\x3d\x01\x01\x01", 10, + "mitsubishiSecurityAlgorithm" }, + { (byte*)"\x2a\x83\x08\x8c\x9a\x4b\x3d\x01\x01\x01\x01", 11, + "misty1-cbc" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01", 7, + "kisaAlgorithm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x01", 8, + "kcdsa" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x02", 8, + "has160" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x03", 8, + "seedECB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x04", 8, + "seedCBC" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x05", 8, + "seedOFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x06", 8, + "seedCFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x07", 8, + "seedMAC" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x08", 8, + "kcdsaWithHAS160" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x09", 8, + "kcdsaWithSHA1" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0a", 8, + "pbeWithHAS160AndSEED-ECB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0b", 8, + "pbeWithHAS160AndSEED-CBC" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0c", 8, + "pbeWithHAS160AndSEED-CFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0d", 8, + "pbeWithHAS160AndSEED-OFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0e", 8, + "pbeWithSHA1AndSEED-ECB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x0f", 8, + "pbeWithSHA1AndSEED-CBC" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x10", 8, + "pbeWithSHA1AndSEED-CFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x11", 8, + "pbeWithSHA1AndSEED-OFB" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x14", 8, + "rsaWithHAS160" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x01\x15", 8, + "kcdsa1" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x02", 7, + "npkiCP" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x02\x01", 8, + "npkiSignaturePolicy" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x03", 7, + "npkiKP" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x04", 7, + "npkiAT" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x05", 7, + "npkiLCA" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x05\x01", 8, + "npkiSignKorea" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x05\x02", 8, + "npkiSignGate" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x05\x03", 8, + "npkiNcaSign" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x06", 7, + "npkiON" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x07", 7, + "npkiAPP" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x07\x01", 8, + "npkiSMIME" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x07\x01\x01", 9, + "npkiSMIMEAlgo" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x07\x01\x01\x01", 10, + "npkiCmsSEEDWrap" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a", 7, + "npki" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01", 8, + "npkiAttribute" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01\x01", 9, + "npkiIdentifyData" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01\x01\x01", 10, + "npkiVID" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01\x01\x02", 10, + "npkiEncryptedVID" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01\x01\x03", 10, + "npkiRandomNum" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x44\x0a\x01\x01\x04", 10, + "npkiVID" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01", 8, + "aria1AlgorithmModes" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x01", 9, + "aria128-ecb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x02", 9, + "aria128-cbc" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x03", 9, + "aria128-cfb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x04", 9, + "aria128-ofb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x05", 9, + "aria128-ctr" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x06", 9, + "aria192-ecb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x07", 9, + "aria192-cbc" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x08", 9, + "aria192-cfb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x09", 9, + "aria192-ofb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0a", 9, + "aria192-ctr" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0b", 9, + "aria256-ecb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0c", 9, + "aria256-cbc" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0d", 9, + "aria256-cfb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0e", 9, + "aria256-ofb" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x0f", 9, + "aria256-ctr" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x15", 9, + "aria128-cmac" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x16", 9, + "aria192-cmac" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x17", 9, + "aria256-cmac" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x1f", 9, + "aria128-ocb2" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x20", 9, + "aria192-ocb2" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x21", 9, + "aria256-ocb2" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x22", 9, + "aria128-gcm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x23", 9, + "aria192-gcm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x24", 9, + "aria256-gcm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x25", 9, + "aria128-ccm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x26", 9, + "aria192-ccm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x27", 9, + "aria256-ccm" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x28", 9, + "aria128-keywrap" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x29", 9, + "aria192-keywrap" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x2a", 9, + "aria256-keywrap" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x2b", 9, + "aria128-keywrapWithPad" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x2c", 9, + "aria192-keywrapWithPad" }, + { (byte*)"\x2a\x83\x1a\x8c\x9a\x6e\x01\x01\x2d", 9, + "aria256-keywrapWithPad" }, + { (byte*)"\x2a\x85\x03\x02\x02\x03", 6, + "gostSignature" }, + { (byte*)"\x2a\x85\x03\x02\x02\x04", 6, + "gost94Signature" }, + { (byte*)"\x2a\x85\x03\x02\x02\x13", 6, + "gostPublicKey" }, + { (byte*)"\x2a\x85\x03\x02\x02\x14", 6, + "gost94PublicKey" }, + { (byte*)"\x2a\x85\x03\x02\x02\x15", 6, + "gostCipher" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x00", 7, + "testCipherParams" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x01", 7, + "cryptoProCipherA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x02", 7, + "cryptoProCipherB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x03", 7, + "cryptoProCipherC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x04", 7, + "cryptoProCipherD" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x05", 7, + "oscar11Cipher" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x06", 7, + "oscar10Cipher" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x07", 7, + "ric1Cipher" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x0c", 7, + "tc26CipherA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x0d", 7, + "tc26CipherB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x0e", 7, + "tc26CipherC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x0f", 7, + "tc26CipherD" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x10", 7, + "tc26CipherE" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1f\x11", 7, + "tc26CipherF" }, + { (byte*)"\x2a\x85\x03\x07\x01\x02\x05\x01\x01", 9, + "tc26CipherZ" }, + { (byte*)"\x2a\x85\x03\x02\x02\x09", 6, + "gostDigest" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1e\x00", 7, + "testDigestParams" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1e\x01", 7, + "cryptoProDigestA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1e\x02", 7, + "cryptoProDigestB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1e\x03", 7, + "cryptoProDigestC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x1e\x04", 7, + "cryptoProDigestD" }, + { (byte*)"\x2a\x85\x03\x02\x02\x20\x02", 7, + "cryptoPro94SignA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x20\x03", 7, + "cryptoPro94SignB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x20\x04", 7, + "cryptoPro94SignC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x20\x05", 7, + "cryptoPro94SignD" }, + { (byte*)"\x2a\x85\x03\x02\x02\x21\x01", 7, + "cryptoPro94SignXA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x21\x02", 7, + "cryptoPro94SignXB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x21\x03", 7, + "cryptoPro94SignXC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x23\x00", 7, + "testSignParams" }, + { (byte*)"\x2a\x85\x03\x02\x02\x23\x01", 7, + "cryptoProSignA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x23\x02", 7, + "cryptoProSignB" }, + { (byte*)"\x2a\x85\x03\x02\x02\x23\x03", 7, + "cryptoProSignC" }, + { (byte*)"\x2a\x85\x03\x02\x02\x24\x00", 7, + "cryptoProSignXA" }, + { (byte*)"\x2a\x85\x03\x02\x02\x24\x01", 7, + "cryptoProSignXB" }, + { (byte*)"\x2a\x85\x03\x07\x01\x02\x01\x01\x01", 9, + "cryptoPro2012Sign256A" }, + { (byte*)"\x2a\x85\x03\x07\x01\x02\x01\x02\x01", 9, + "cryptoPro2012Sign512A" }, + { (byte*)"\x2a\x85\x03\x07\x01\x02\x01\x02\x02", 9, + "cryptoPro2012Sign512B" }, + { (byte*)"\x2a\x85\x03\x07\x01\x02\x01\x02\x03", 9, + "cryptoPro2012Sign512C" }, + { (byte*)"\x2a\x85\x03\x02\x02\x0e\x00", 7, + "nullMeshing" }, + { (byte*)"\x2a\x85\x03\x02\x02\x0e\x01", 7, + "cryptoProMeshing" }, + { (byte*)"\x2a\x85\x03\x02\x02\x0a", 6, + "hmacGost" }, + { (byte*)"\x2a\x85\x03\x02\x02\x0d\x00", 7, + "gostWrap" }, + { (byte*)"\x2a\x85\x03\x02\x02\x0d\x01", 7, + "cryptoProWrap" }, + { (byte*)"\x2a\x85\x03\x02\x02\x60", 6, + "cryptoProECDHWrap" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x01\x01", 8, + "gost2012PublicKey256" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x01\x02", 8, + "gost2012PublicKey512" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x02\x02", 8, + "gost2012Digest256" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x02\x03", 8, + "gost2012Digest512" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x03\x02", 8, + "gost2012Signature256" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x03\x03", 8, + "gost2012Signature512" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x06\x01", 8, + "cryptoProECDH256" }, + { (byte*)"\x2a\x85\x03\x07\x01\x01\x06\x02", 8, + "cryptoProECDH512" }, + { (byte*)"\x2a\x85\x03\x64\x71\x01", 6, + "cryptoProClassSignToolKC1" }, + { (byte*)"\x2a\x85\x03\x64\x71\x02", 6, + "cryptoProClassSignToolKC2" }, + { (byte*)"\x2a\x85\x03\x64\x71\x03", 6, + "cryptoProClassSignToolKC3" }, + { (byte*)"\x2a\x85\x03\x64\x71\x04", 6, + "cryptoProClassSignToolKB1" }, + { (byte*)"\x2a\x85\x03\x64\x71\x05", 6, + "cryptoProClassSignToolKB2" }, + { (byte*)"\x2a\x85\x03\x64\x71\x06", 6, + "cryptoProClassSignToolKA1" }, + { (byte*)"\x2a\x85\x70\x22\x01", 5, + "seis-cp" }, + { (byte*)"\x2a\x85\x70\x22\x01\x01", 6, + "SEIS high-assurance policyIdentifier" }, + { (byte*)"\x2a\x85\x70\x22\x01\x02", 6, + "SEIS GAK policyIdentifier" }, + { (byte*)"\x2a\x85\x70\x22\x02", 5, + "SEIS pe" }, + { (byte*)"\x2a\x85\x70\x22\x03", 5, + "SEIS at" }, + { (byte*)"\x2a\x85\x70\x22\x03\x01", 6, + "SEIS at-personalIdentifier" }, + { (byte*)"\x2a\x86\x48\xce\x38\x01", 6, + "module" }, + { (byte*)"\x2a\x86\x48\xce\x38\x01\x01", 7, + "x9f1-cert-mgmt" }, + { (byte*)"\x2a\x86\x48\xce\x38\x02", 6, + "holdinstruction" }, + { (byte*)"\x2a\x86\x48\xce\x38\x02\x01", 7, + "holdinstruction-none" }, + { (byte*)"\x2a\x86\x48\xce\x38\x02\x02", 7, + "callissuer" }, + { (byte*)"\x2a\x86\x48\xce\x38\x02\x03", 7, + "reject" }, + { (byte*)"\x2a\x86\x48\xce\x38\x02\x04", 7, + "pickupToken" }, + { (byte*)"\x2a\x86\x48\xce\x38\x03", 6, + "attribute" }, + { (byte*)"\x2a\x86\x48\xce\x38\x03\x01", 7, + "countersignature" }, + { (byte*)"\x2a\x86\x48\xce\x38\x03\x02", 7, + "attribute-cert" }, + { (byte*)"\x2a\x86\x48\xce\x38\x04", 6, + "algorithm" }, + { (byte*)"\x2a\x86\x48\xce\x38\x04\x01", 7, + "dsa" }, + { (byte*)"\x2a\x86\x48\xce\x38\x04\x02", 7, + "dsa-match" }, + { (byte*)"\x2a\x86\x48\xce\x38\x04\x03", 7, + "dsaWithSha1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01", 6, + "fieldType" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x01", 7, + "prime-field" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x02", 7, + "characteristic-two-field" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x02\x03", 8, + "characteristic-two-basis" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x02\x03\x01", 9, + "onBasis" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x02\x03\x02", 9, + "tpBasis" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x01\x02\x03\x03", 9, + "ppBasis" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x02", 6, + "publicKeyType" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x02\x01", 7, + "ecPublicKey" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x01", 8, + "c2pnb163v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x02", 8, + "c2pnb163v2" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x03", 8, + "c2pnb163v3" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x05", 8, + "c2tnb191v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x06", 8, + "c2tnb191v2" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x07", 8, + "c2tnb191v3" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x0a", 8, + "c2pnb208w1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x0b", 8, + "c2tnb239v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x0c", 8, + "c2tnb239v2" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x0d", 8, + "c2tnb239v3" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x10", 8, + "c2pnb272w1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x12", 8, + "c2tnb359v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x13", 8, + "c2pnb368w1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x00\x14", 8, + "c2tnb431r1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x01", 8, + "prime192v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x02", 8, + "prime192v2" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x03", 8, + "prime192v3" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x04", 8, + "prime239v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x05", 8, + "prime239v2" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x06", 8, + "prime239v3" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x03\x01\x07", 8, + "prime256v1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x01", 7, + "ecdsaWithSHA1" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x02", 7, + "ecdsaWithRecommended" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x03", 7, + "ecdsaWithSpecified" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x03\x01", 8, + "ecdsaWithSHA224" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x03\x02", 8, + "ecdsaWithSHA256" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x03\x03", 8, + "ecdsaWithSHA384" }, + { (byte*)"\x2a\x86\x48\xce\x3d\x04\x03\x04", 8, + "ecdsaWithSHA512" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x01", 6, + "fieldType" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x01\x01", 7, + "gf-prime" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x02", 6, + "numberType" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x02\x01", 7, + "dhPublicKey" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03", 6, + "scheme" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x01", 7, + "dhStatic" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x02", 7, + "dhEphem" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x03", 7, + "dhHybrid1" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x04", 7, + "dhHybrid2" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x05", 7, + "mqv2" }, + { (byte*)"\x2a\x86\x48\xce\x3e\x03\x06", 7, + "mqv1" }, + { (byte*)"\x2a\x86\x48\xce\x51\x02\x02", 7, + "?" }, + { (byte*)"\x2a\x86\x48\xce\x51\x02\x03", 7, + "healthcareLicense" }, + { (byte*)"\x2a\x86\x48\xce\x51\x02\x03\x01\x01", 9, + "license?" }, + { (byte*)"\x2a\x86\x48\xce\x56", 5, + "iec62351" }, + { (byte*)"\x2a\x86\x48\xce\x56\x08", 6, + "iec62351_8" }, + { (byte*)"\x2a\x86\x48\xce\x56\x08\x01", 7, + "iecUserRoles" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07", 7, + "nsn" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x41", 8, + "nsn-ce" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x41\x00", 9, + "entrustVersInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42", 8, + "nsn-alg" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42\x03", 9, + "cast3CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42\x0a", 9, + "cast5CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42\x0b", 9, + "cast5MAC" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42\x0c", 9, + "pbeWithMD5AndCAST5-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x42\x0d", 9, + "passwordBasedMac" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x43", 8, + "nsn-oc" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x43\x00", 9, + "entrustUser" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x44", 8, + "nsn-at" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x44\x00", 9, + "entrustCAInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf6\x7d\x07\x44\x0a", 9, + "attributeCertificate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01", 8, + "pkcs-1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x01", 9, + "rsaEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x02", 9, + "md2WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x03", 9, + "md4WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x04", 9, + "md5WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x05", 9, + "sha1WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x07", 9, + "rsaOAEP" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x08", 9, + "pkcs1-MGF" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x09", 9, + "rsaOAEP-pSpecified" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0a", 9, + "rsaPSS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0b", 9, + "sha256WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0c", 9, + "sha384WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0d", 9, + "sha512WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x0e", 9, + "sha224WithRSAEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x01\x06", 9, + "rsaOAEPEncryptionSET" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x02", 8, + "bsafeRsaEncr" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x03", 8, + "pkcs-3" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x03\x01", 9, + "dhKeyAgreement" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05", 8, + "pkcs-5" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x01", 9, + "pbeWithMD2AndDES-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x03", 9, + "pbeWithMD5AndDES-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x04", 9, + "pbeWithMD2AndRC2-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x06", 9, + "pbeWithMD5AndRC2-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x09", 9, + "pbeWithMD5AndXOR" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x0a", 9, + "pbeWithSHAAndDES-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x0c", 9, + "pkcs5PBKDF2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x0d", 9, + "pkcs5PBES2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x05\x0e", 9, + "pkcs5PBMAC1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07", 8, + "pkcs-7" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x01", 9, + "data" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x02", 9, + "signedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x03", 9, + "envelopedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x04", 9, + "signedAndEnvelopedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x05", 9, + "digestedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x06", 9, + "encryptedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x07", 9, + "dataWithAttributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x07\x08", 9, + "encryptedPrivateKeyInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09", 8, + "pkcs-9" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01", 9, + "emailAddress" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x02", 9, + "unstructuredName" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x03", 9, + "contentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x04", 9, + "messageDigest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x05", 9, + "signingTime" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x06", 9, + "countersignature" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x07", 9, + "challengePassword" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x08", 9, + "unstructuredAddress" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x09", 9, + "extendedCertificateAttributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0a", 9, + "issuerAndSerialNumber" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0b", 9, + "passwordCheck" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0c", 9, + "publicKey" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0d", 9, + "signingDescription" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0e", 9, + "extensionRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f", 9, + "sMIMECapabilities" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x01", 10, + "preferSignedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x02", 10, + "canNotDecryptAny" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x03", 10, + "receiptRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x04", 10, + "receipt" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x05", 10, + "contentHints" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x0f\x06", 10, + "mlExpansionHistory" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10", 9, + "id-sMIME" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00", 10, + "id-mod" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x01", 11, + "id-mod-cms" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x02", 11, + "id-mod-ess" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x03", 11, + "id-mod-oid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x04", 11, + "id-mod-msg-v3" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x05", 11, + "id-mod-ets-eSignature-88" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x06", 11, + "id-mod-ets-eSignature-97" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x07", 11, + "id-mod-ets-eSigPolicy-88" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x00\x08", 11, + "id-mod-ets-eSigPolicy-88" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01", 10, + "contentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x00", 11, + "anyContentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x01", 11, + "receipt" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x02", 11, + "authData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x03", 11, + "publishCert" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x04", 11, + "tSTInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x05", 11, + "tDTInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x06", 11, + "contentInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x07", 11, + "dVCSRequestData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x08", 11, + "dVCSResponseData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x09", 11, + "compressedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0a", 11, + "scvpCertValRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0b", 11, + "scvpCertValResponse" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0c", 11, + "scvpValPolRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0d", 11, + "scvpValPolResponse" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0e", 11, + "attrCertEncAttrs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x0f", 11, + "tSReq" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x10", 11, + "firmwarePackage" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x11", 11, + "firmwareLoadReceipt" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x12", 11, + "firmwareLoadError" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x13", 11, + "contentCollection" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x14", 11, + "contentWithAttrs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x15", 11, + "encKeyWithID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x16", 11, + "encPEPSI" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x17", 11, + "authEnvelopedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x18", 11, + "routeOriginAttest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x19", 11, + "symmetricKeyPackage" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1a", 11, + "rpkiManifest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1b", 11, + "asciiTextWithCRLF" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1c", 11, + "xml" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1d", 11, + "pdf" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1e", 11, + "postscript" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x1f", 11, + "timestampedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x20", 11, + "asAdjacencyAttest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x21", 11, + "rpkiTrustAnchor" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x22", 11, + "trustAnchorList" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x23", 11, + "rpkiGhostbusters" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x24", 11, + "resourceTaggedAttest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x25", 11, + "utf8TextWithCRLF" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x26", 11, + "htmlWithCRLF" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x27", 11, + "epub" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x28", 11, + "animaJSONVoucher" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x29", 11, + "mudType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2a", 11, + "sztpConveyedInfoXML" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2b", 11, + "sztpConveyedInfoJSON" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2c", 11, + "cbor" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2d", 11, + "cborSequence" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2e", 11, + "animaCBORVoucher" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x2f", 11, + "geofeedCSVwithCRLF" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x30", 11, + "rpkiSignedChecklist" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x01\x31", 11, + "rpkiASPA" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02", 10, + "authenticatedAttributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x01", 11, + "receiptRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x02", 11, + "securityLabel" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x03", 11, + "mlExpandHistory" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x04", 11, + "contentHint" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x05", 11, + "msgSigDigest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x06", 11, + "encapContentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x07", 11, + "contentIdentifier" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x08", 11, + "macValue" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x09", 11, + "equivalentLabels" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0a", 11, + "contentReference" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0b", 11, + "encrypKeyPref" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0c", 11, + "signingCertificate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0d", 11, + "smimeEncryptCerts" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0e", 11, + "timeStampToken" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x0f", 11, + "sigPolicyId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x10", 11, + "commitmentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x11", 11, + "signerLocation" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x12", 11, + "signerAttr" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x13", 11, + "otherSigCert" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x14", 11, + "contentTimestamp" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x15", 11, + "certificateRefs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x16", 11, + "revocationRefs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x17", 11, + "certValues" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x18", 11, + "revocationValues" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x19", 11, + "escTimeStamp" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1a", 11, + "certCRLTimestamp" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1b", 11, + "archiveTimeStamp" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1c", 11, + "signatureType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1d", 11, + "dvcsDvc" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1e", 11, + "cekReference" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x1f", 11, + "maxCEKDecrypts" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x20", 11, + "kekDerivationAlg" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x21", 11, + "intendedRecipients" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x22", 11, + "cmcUnsignedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x23", 11, + "fwPackageID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x24", 11, + "fwTargetHardwareIDs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x25", 11, + "fwDecryptKeyID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x26", 11, + "fwImplCryptAlgs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x27", 11, + "fwWrappedFirmwareKey" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x28", 11, + "fwCommunityIdentifiers" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x29", 11, + "fwPkgMessageDigest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2a", 11, + "fwPackageInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2b", 11, + "fwImplCompressAlgs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2c", 11, + "etsAttrCertificateRefs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2d", 11, + "etsAttrRevocationRefs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2e", 11, + "binarySigningTime" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x2f", 11, + "signingCertificateV2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x30", 11, + "etsArchiveTimeStampV2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x31", 11, + "erInternal" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x32", 11, + "erExternal" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x33", 11, + "multipleSignatures" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x34", 11, + "cmsAlgorithmProtect" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x35", 11, + "setKeyInformation" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x36", 11, + "asymmDecryptKeyID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x37", 11, + "secureHeaderFieldsIdentifier" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x38", 11, + "otpChallenge" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x39", 11, + "revocationChallenge" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x02\x3a", 11, + "estIdentityLinking" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x01", 11, + "esDHwith3DES" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x02", 11, + "esDHwithRC2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x03", 11, + "3desWrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x04", 11, + "rc2Wrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x05", 11, + "esDH" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x06", 11, + "cms3DESwrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x07", 11, + "cmsRC2wrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x08", 11, + "zlib" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x09", 11, + "pwriKEK" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0a", 11, + "ssDH" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0b", 11, + "hmacWith3DESwrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0c", 11, + "hmacWithAESwrap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0d", 11, + "md5XorExperiment" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0e", 11, + "rsaKEM" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x0f", 11, + "authEnc128" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x10", 11, + "authEnc256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x11", 11, + "hssLmsHashSig" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x12", 11, + "chaCha20Poly1305" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x13", 11, + "ecdhHKDF-SHA256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x14", 11, + "ecdhHKDF-SHA384" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x15", 11, + "ecdhHKDF-SHA512" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x16", 11, + "aesSIV-CMAC-256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x17", 11, + "aesSIV-CMAC-384" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x18", 11, + "aesSIV-CMAC-512" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x19", 11, + "aesSIV-CMAC-wrap256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x1a", 11, + "aesSIV-CMAC-wrap384" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x1b", 11, + "aesSIV-CMAC-wrap512" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x1c", 11, + "hkdfWithSha256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x1d", 11, + "hkdfWithSha384" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x03\x1e", 11, + "hkdfWithSha512" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x04\x01", 11, + "certDist-ldap" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x05\x01", 11, + "sigPolicyQualifier-spuri x" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x05\x02", 11, + "sigPolicyQualifier-spUserNotice" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x01", 11, + "proofOfOrigin" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x02", 11, + "proofOfReceipt" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x03", 11, + "proofOfDelivery" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x04", 11, + "proofOfSender" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x05", 11, + "proofOfApproval" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x06\x06", 11, + "proofOfCreation" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x07\x01", 11, + "testAmoco" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x07\x02", 11, + "testCaterpillar" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x07\x03", 11, + "testWhirlpool" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x07\x04", 11, + "testWhirlpoolCategories" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x01", 11, + "glUseKEK" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x02", 11, + "glDelete" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x03", 11, + "glAddMember" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x04", 11, + "glDeleteMember" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x05", 11, + "glRekey" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x06", 11, + "glAddOwner" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x07", 11, + "glRemoveOwner" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x08", 11, + "glkCompromise" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x09", 11, + "glkRefresh" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0a", 11, + "glFailInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0b", 11, + "glaQueryRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0c", 11, + "glaQueryResponse" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0d", 11, + "glProvideCert" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0e", 11, + "glUpdateCert" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x08\x0f", 11, + "glKey" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x09", 10, + "signatureTypeIdentifier" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x09\x01", 11, + "originatorSig" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x09\x02", 11, + "domainSig" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x09\x03", 11, + "additionalAttributesSig" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x09\x04", 11, + "reviewSig" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x01", 11, + "envelopedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x02", 11, + "signedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x03", 11, + "certsOnly" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x04", 11, + "signedReceipt" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x05", 11, + "envelopedX400" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x06", 11, + "signedX400" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0a\x07", 11, + "compressedData" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0b", 10, + "capabilities" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0b\x01", 11, + "preferBinaryInside" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c", 10, + "pskcAttributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x01", 11, + "pskcManufacturer" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x02", 11, + "pskcSerialNo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x03", 11, + "pskcModel" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x04", 11, + "pskcIssueno" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x05", 11, + "pskcDevicebinding" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x06", 11, + "pskcDevicestartdate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x07", 11, + "pskcDeviceexpirydate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x08", 11, + "pskcModuleid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x09", 11, + "pskcKeyid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0a", 11, + "pskcAlgorithm" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0b", 11, + "pskcIssuer" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0c", 11, + "pskcKeyprofileid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0d", 11, + "pskcKeyreference" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0e", 11, + "pskcFriendlyname" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x0f", 11, + "pskcAlgorithmparams" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x10", 11, + "pskcCounter" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x11", 11, + "pskcTime" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x12", 11, + "pskcTimeinterval" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x13", 11, + "pskcTimedrift" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x14", 11, + "pskcValuemac" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x15", 11, + "pskcKeystartdate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x16", 11, + "pskcKeyexpirydate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x17", 11, + "pskcNooftransactions" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x18", 11, + "pskcKeyusages" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x19", 11, + "pskcPinpolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x1a", 11, + "pskcDeviceuserid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0c\x1b", 11, + "pskcKeyuserid" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0d", 10, + "otherRecipientInfoIds" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0d\x01", 11, + "keyTransPSK" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x10\x0d\x02", 11, + "keyAgreePSK" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x14", 9, + "friendlyName (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x15", 9, + "localKeyID (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x16", 9, + "certTypes (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x16\x01", 10, + "x509Certificate (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x16\x02", 10, + "sdsiCertificate (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x17", 9, + "crlTypes (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x17\x01", 10, + "x509Crl (for PKCS #12)" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x18", 9, + "pkcs9objectClass" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19", 9, + "pkcs9attributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19\x01", 10, + "pkcs15Token" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19\x02", 10, + "encryptedPrivateKeyInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19\x03", 10, + "randomNonce" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19\x04", 10, + "sequenceNumber" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x19\x05", 10, + "pkcs7PDU" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x1a", 9, + "pkcs9syntax" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x1b", 9, + "pkcs9matchingRules" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x09\x34", 9, + "cmsAlgorithmProtection" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c", 8, + "pkcs-12" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01", 9, + "pkcs-12-PbeIds" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x01", 10, + "pbeWithSHAAnd128BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x02", 10, + "pbeWithSHAAnd40BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x03", 10, + "pbeWithSHAAnd3-KeyTripleDES-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x04", 10, + "pbeWithSHAAnd2-KeyTripleDES-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x05", 10, + "pbeWithSHAAnd128BitRC2-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x01\x06", 10, + "pbeWithSHAAnd40BitRC2-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x02", 9, + "pkcs-12-ESPVKID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x02\x01", 10, + "pkcs-12-PKCS8KeyShrouding" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03", 9, + "pkcs-12-BagIds" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03\x01", 10, + "pkcs-12-keyBagId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03\x02", 10, + "pkcs-12-certAndCRLBagId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03\x03", 10, + "pkcs-12-secretBagId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03\x04", 10, + "pkcs-12-safeContentsId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x03\x05", 10, + "pkcs-12-pkcs-8ShroudedKeyBagId" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x04", 9, + "pkcs-12-CertBagID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x04\x01", 10, + "pkcs-12-X509CertCRLBagID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x04\x02", 10, + "pkcs-12-SDSICertBagID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05", 9, + "pkcs-12-OID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01", 10, + "pkcs-12-PBEID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x01", 11, + "pkcs-12-PBEWithSha1And128BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x02", 11, + "pkcs-12-PBEWithSha1And40BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x03", 11, + "pkcs-12-PBEWithSha1AndTripleDESCBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x04", 11, + "pkcs-12-PBEWithSha1And128BitRC2CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x05", 11, + "pkcs-12-PBEWithSha1And40BitRC2CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x06", 11, + "pkcs-12-PBEWithSha1AndRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x01\x07", 11, + "pkcs-12-PBEWithSha1AndRC2CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x02", 10, + "pkcs-12-EnvelopingID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x02\x01", 11, + "pkcs-12-RSAEncryptionWith128BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x02\x02", 11, + "pkcs-12-RSAEncryptionWith40BitRC4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x02\x03", 11, + "pkcs-12-RSAEncryptionWithTripleDES" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x03", 10, + "pkcs-12-SignatureID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x05\x03\x01", 11, + "pkcs-12-RSASignatureWithSHA1Digest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a", 9, + "pkcs-12Version1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01", 10, + "pkcs-12BadIds" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x01", 11, + "pkcs-12-keyBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x02", 11, + "pkcs-12-pkcs-8ShroudedKeyBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x03", 11, + "pkcs-12-certBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x04", 11, + "pkcs-12-crlBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x05", 11, + "pkcs-12-secretBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0c\x0a\x01\x06", 11, + "pkcs-12-safeContentsBag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0f\x01", 9, + "pkcs15modules" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0f\x02", 9, + "pkcs15attributes" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0f\x03", 9, + "pkcs15contentType" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x01\x0f\x03\x01", 10, + "pkcs15content" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02", 7, + "digestAlgorithm" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x02", 8, + "md2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x04", 8, + "md4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x05", 8, + "md5" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x07", 8, + "hmacWithSHA1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x08", 8, + "hmacWithSHA224" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x09", 8, + "hmacWithSHA256" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x0a", 8, + "hmacWithSHA384" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x02\x0b", 8, + "hmacWithSHA512" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03", 7, + "encryptionAlgorithm" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x02", 8, + "rc2CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x03", 8, + "rc2ECB" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x04", 8, + "rc4" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x05", 8, + "rc4WithMAC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x06", 8, + "desx-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x07", 8, + "des-EDE3-CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x08", 8, + "rc5CBC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x09", 8, + "rc5-CBCPad" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x0d\x03\x0a", 8, + "desCDMF" }, + { (byte*)"\x2a\x86\x48\x86\xfa\x65\x01\x06\x01", 9, + "Identrus unknown policyIdentifier" }, + { (byte*)"\x2a\x86\x48\x86\xfa\x65\x04\x01", 8, + "identrusOCSP" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x02\x81\x71", 10, + "deliveryMechanism" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x02\x82\x19", 10, + "ntSecurityDescriptor" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x00", 9, + "site-Addressing" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x0d", 9, + "classSchema" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x0e", 9, + "attributeSchema" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x11", 9, + "mailbox-Agent" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x16", 9, + "mailbox" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x17", 9, + "container" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x03\x2e", 9, + "mailRecipient" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x81\x11", 10, + "revision" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x2f", 10, + "pKIDefaultKeySpec" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x30", 10, + "pKIKeyUsage" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x31", 10, + "pKIMaxIssuingDepth" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x32", 10, + "pKICriticalExtensions" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x33", 10, + "pKIExpirationPeriod" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x34", 10, + "pKIOverlapPeriod" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x35", 10, + "pKIExtendedKeyUsage" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x36", 10, + "pKIDefaultCSPs" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8a\x37", 10, + "pKIEnrollmentAccess" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x15", 10, + "msPKI-RA-Signature" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x16", 10, + "msPKI-Enrollment-Flag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x17", 10, + "msPKI-Private-Key-Flag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x18", 10, + "msPKI-Certificate-Name-Flag" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x19", 10, + "msPKI-Minimal-Key-Size" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1a", 10, + "msPKI-Template-Schema-Version" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1b", 10, + "msPKI-Template-Minor-Revision" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1c", 10, + "msPKI-Cert-Template-OID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1d", 10, + "msPKI-Supersede-Templates" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1e", 10, + "msPKI-RA-Policies" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8b\x1f", 10, + "msPKI-Certificate-Policy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8d\x0a", 10, + "msPKI-Certificate-Application-Policy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x01\x04\x8d\x0b", 10, + "msPKI-RA-Application-Policies" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x04\x03", 8, + "microsoftExcel" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x04\x04", 8, + "titledWithOID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x14\x04\x05", 8, + "microsoftPowerPoint" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01", 7, + "adobeAcrobat" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01", 8, + "acrobatSecurity" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x01", 9, + "pdfPassword" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x02", 9, + "pdfDefaultSigningCredential" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x03", 9, + "pdfDefaultEncryptionCredential" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x04", 9, + "pdfPasswordTimeout" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x05", 9, + "pdfAuthenticDocumentsTrust" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x06", 9, + "pdfDynamicContentTrust" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x07", 9, + "pdfUbiquityTrust" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x08", 9, + "pdfRevocationInfoArchival" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x09", 9, + "pdfX509Extension" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x09\x01", 10, + "pdfTimeStamp" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x09\x02", 10, + "pdfArchiveRevInfo" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x01\x0a", 9, + "pdfPPLKLiteCredential" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x02", 8, + "acrobatCPS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x02\x01", 9, + "pdfAuthenticDocumentsCPS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x02\x02", 9, + "pdfTestCPS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x02\x03", 9, + "pdfUbiquityCPS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x02\x04", 9, + "pdfAdhocCPS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x07", 8, + "acrobatUbiquity" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x07\x01", 9, + "pdfUbiquitySubRights" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x2f\x01\x09", 8, + "acrobatExtension" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x5c\x72\x01\x07", 9, + "adobePKCS7" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64", 7, + "appleDataSecurity" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01", 8, + "appleTrustPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x01", 9, + "appleISignTP" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x02", 9, + "appleX509Basic" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x03", 9, + "appleSSLPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x04", 9, + "appleLocalCertGenPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x05", 9, + "appleCSRGenPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x06", 9, + "appleCRLPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x07", 9, + "appleOCSPPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x08", 9, + "appleSMIMEPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x09", 9, + "appleEAPPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0a", 9, + "appleSWUpdateSigningPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0b", 9, + "appleIPSecPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0c", 9, + "appleIChatPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0d", 9, + "appleResourceSignPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0e", 9, + "applePKINITClientPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x0f", 9, + "applePKINITServerPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x10", 9, + "appleCodeSigningPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x01\x11", 9, + "applePackageSigningPolicy" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02", 8, + "appleSecurityAlgorithm" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x01", 9, + "appleFEE" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x02", 9, + "appleASC" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x03", 9, + "appleFEE_MD5" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x04", 9, + "appleFEE_SHA1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x05", 9, + "appleFEED" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x06", 9, + "appleFEEDEXP" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x02\x07", 9, + "appleECDSA" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x03", 8, + "appleDotMacCertificate" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x03\x01", 9, + "appleDotMacCertificateRequest" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x03\x02", 9, + "appleDotMacCertificateExtension" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x03\x03", 9, + "appleDotMacCertificateRequestValues" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04", 8, + "appleExtendedKeyUsage" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x01", 9, + "appleCodeSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x01\x01", 10, + "appleCodeSigningDevelopment" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x01\x02", 10, + "appleSoftwareUpdateSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x01\x03", 10, + "appleCodeSigningThirdParty" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x01\x04", 10, + "appleResourceSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x02", 9, + "appleIChatSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x03", 9, + "appleIChatEncryption" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x04", 9, + "appleSystemIdentity" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x05", 9, + "appleCryptoEnv" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x05\x01", 10, + "appleCryptoProductionEnv" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x05\x02", 10, + "appleCryptoMaintenanceEnv" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x05\x03", 10, + "appleCryptoTestEnv" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x05\x04", 10, + "appleCryptoDevelopmentEnv" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x06", 9, + "appleCryptoQoS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x06\x01", 10, + "appleCryptoTier0QoS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x06\x02", 10, + "appleCryptoTier1QoS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x06\x03", 10, + "appleCryptoTier2QoS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x04\x06\x04", 10, + "appleCryptoTier3QoS" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x05", 8, + "appleCertificatePolicies" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x05\x01", 9, + "appleCertificatePolicyID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x05\x02", 9, + "appleDotMacCertificatePolicyID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x05\x03", 9, + "appleADCCertificatePolicyID" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x06", 8, + "appleCertificateExtensions" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x06\x01", 9, + "appleCertificateExtensionCodeSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x06\x01\x01", 10, + "appleCertificateExtensionAppleSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x06\x01\x02", 10, + "appleCertificateExtensionADCDeveloperSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x06\x01\x03", 10, + "appleCertificateExtensionADCAppleSigning" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x0f\x01", 9, + "appleCustomCertificateExtension1" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x0f\x02", 9, + "appleCustomCertificateExtension2" }, + { (byte*)"\x2a\x86\x48\x86\xf7\x63\x64\x0f\x03", 9, + "appleCustomCertificateExtension3" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x04", 10, + "spcIndirectDataContext" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x0a", 10, + "spcAgencyInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x0b", 10, + "spcStatementType" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x0c", 10, + "spcSpOpusInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x0e", 10, + "certReqExtensions" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x0f", 10, + "spcPEImageData" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x12", 10, + "spcRawFileData" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x13", 10, + "spcStructuredStorageData" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x14", 10, + "spcJavaClassData (type 1)" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x15", 10, + "individualCodeSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x16", 10, + "commercialCodeSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x19", 10, + "spcLink (type 2)" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x1a", 10, + "spcMinimalCriteriaInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x1b", 10, + "spcFinancialCriteriaInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x1c", 10, + "spcLink (type 3)" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x1d", 10, + "spcHashInfoObjID" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x01\x1e", 10, + "spcSipInfoObjID" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x02", 9, + "ctl" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x01", 10, + "ctlTrustedCodesigningCAList" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x02", 10, + "ctlTrustedClientAuthCAList" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x03", 10, + "ctlTrustedServerAuthCAList" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x03\x02\x01", 10, + "timestampRequest" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x01", 9, + "certTrustList" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x01\x01", 10, + "sortedCtl" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x02", 9, + "nextUpdateLocation" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x01", 10, + "certTrustListSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x02", 10, + "timeStampSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x03", 10, + "serverGatedCrypto" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x03\x01", 11, + "serialized" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x04", 10, + "encryptedFileSystem" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x05", 10, + "whqlCrypto" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x06", 10, + "nt5Crypto" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x07", 10, + "oemWHQLCrypto" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x08", 10, + "embeddedNTCrypto" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x09", 10, + "rootListSigner" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0a", 10, + "qualifiedSubordination" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0b", 10, + "keyRecovery" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0c", 10, + "documentSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0d", 10, + "lifetimeSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0e", 10, + "mobileDeviceSoftware" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x0f", 10, + "smartDisplay" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x10", 10, + "cspSignature" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x03\x04\x01", 11, + "efsRecovery" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x04\x01", 10, + "yesnoTrustAttr" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x05\x01", 10, + "drm" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x05\x02", 10, + "drmIndividualization" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x06\x01", 10, + "licenses" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x06\x02", 10, + "licenseServer" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x07\x01", 10, + "keyidRdn" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x08\x01", 10, + "removeCertificate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x09\x01", 10, + "crossCertDistPoints" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0a\x01", 10, + "cmcAddAttributes" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0b", 9, + "certPropIdPrefix" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0b\x04", 10, + "certMd5HashPropId" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0b\x14", 10, + "certKeyIdentifierPropId" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0b\x1c", 10, + "certIssuerSerialNumberMd5HashPropId" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0b\x1d", 10, + "certSubjectNameMd5HashPropId" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0a\x0c\x01", 10, + "anyApplicationPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0c", 8, + "catalog" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0c\x01\x01", 10, + "catalogList" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0c\x01\x02", 10, + "catalogListMember" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0c\x02\x01", 10, + "catalogNameValueObjID" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0c\x02\x02", 10, + "catalogMemberInfoObjID" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0d\x01", 9, + "renewalCertificate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0d\x02\x01", 10, + "enrolmentNameValuePair" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0d\x02\x02", 10, + "enrolmentCSP" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x0d\x02\x03", 10, + "osVersion" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x10\x04", 9, + "microsoftRecipientInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x11\x01", 9, + "pkcs12KeyProviderNameAttr" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x11\x02", 9, + "localMachineKeyset" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x11\x03", 9, + "pkcs12ExtendedAttributes" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x01", 9, + "autoEnrollCtlUsage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x02", 9, + "enrollCerttypeExtension" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x02\x01", 10, + "enrollmentAgent" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x02\x02", 10, + "smartcardLogon" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x02\x03", 10, + "userPrincipalName" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x14\x03", 9, + "certManifold" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x01", 9, + "cAKeyCertIndexPair" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x02", 9, + "certSrvPreviousCertHash" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x03", 9, + "crlVirtualBase" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x04", 9, + "crlNextPublish" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x05", 9, + "caExchange" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x06", 9, + "keyRecovery" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x07", 9, + "certificateTemplate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x09", 9, + "rdnDummySigner" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0a", 9, + "applicationCertPolicies" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0b", 9, + "applicationPolicyMappings" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0c", 9, + "applicationPolicyConstraints" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0d", 9, + "archivedKey" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0e", 9, + "crlSelfCDP" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x0f", 9, + "requireCertChainPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x10", 9, + "archivedKeyCertHash" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x11", 9, + "issuedCertHash" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x13", 9, + "dsEmailReplication" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x14", 9, + "requestClientInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x15", 9, + "encryptedKeyHash" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x15\x16", 9, + "certsrvCrossCaVersion" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x19\x01", 9, + "ntdsReplication" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x19\x02", 9, + "ntdsCASecurityExt" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x19\x02\x01", 10, + "ntdsObjectSID" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x1f\x01", 9, + "productUpdate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x2f\x01\x01", 10, + "systemHealth" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x2f\x01\x03", 10, + "systemHealthLoophole" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x3c\x01\x01", 10, + "rootProgramFlags" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x3d\x01\x01", 10, + "kernelModeCodeSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x3c\x02\x01\x01", 11, + "jurisdictionOfIncorporationL" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x3c\x02\x01\x02", 11, + "jurisdictionOfIncorporationSP" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x3c\x02\x01\x03", 11, + "jurisdictionOfIncorporationC" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x4c\x83\x7d\x01\x01", 12, + "microsoftCPS" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58", 8, + "capiCom" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x01", 9, + "capiComVersion" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x02", 9, + "capiComAttribute" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x02\x01", 10, + "capiComDocumentName" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x02\x02", 10, + "capiComDocumentDescription" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x03", 9, + "capiComEncryptedData" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x37\x58\x03\x01", 10, + "capiComEncryptedContent" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x3c\x07\x01\x01", 10, + "ascom" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x3c\x07\x01\x01\x01", 11, + "ideaECB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x3c\x07\x01\x01\x02", 11, + "ideaCBC" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x3c\x07\x01\x01\x03", 11, + "ideaCFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x3c\x07\x01\x01\x04", 11, + "ideaOFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x03\x02", 9, + "euroControlUntrustedEA" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03", 9, + "euroControlEARootCA" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03\x01", 10, + "euroControlEABridgeCA" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03\x01\x01", 11, + "euroControlEAIssuingCA" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03\x01\x01\x01", 12, + "euroControlEAClientCertificate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03\x01\x01\x02", 12, + "euroControlEAServerCertificate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x3b\x04\x03\x01\x01\x03", 12, + "euroControlEASWIMSigningCertificate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x92\x7c\x0a\x01\x01", 10, + "UNINETT policyIdentifier" }, + { (byte*)"\x2b\x06\x01\x04\x01\x95\x18\x0a", 8, + "ICE-TEL policyIdentifier" }, + { (byte*)"\x2b\x06\x01\x04\x01\x95\x62\x01\x01\x01", 10, + "ICE-TEL Italian policyIdentifier" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x01\x01", 10, + "blowfishECB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x01\x02", 10, + "blowfishCBC" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x01\x03", 10, + "blowfishCFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x01\x04", 10, + "blowfishOFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x02\x01", 10, + "elgamal" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x02\x01\x01", 11, + "elgamalWithSHA-1" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x01\x02\x01\x02", 11, + "elgamalWithRIPEMD-160" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x03\x01\x01", 10, + "cryptlibPresenceCheck" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x03\x01\x02", 10, + "pkiBoot" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x03\x01\x04", 10, + "crlExtReason" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x03\x01\x05", 10, + "keyFeatures" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01", 9, + "cryptlibContent" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x01", 10, + "cryptlibConfigData" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x02", 10, + "cryptlibUserIndex" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x03", 10, + "cryptlibUserInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x04", 10, + "rtcsRequest" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x05", 10, + "rtcsResponse" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x04\x01\x06", 10, + "rtcsResponseExt" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x2a\xd7\x24\x01", 11, + "mpeg-1" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x36\xdd\x24\x36", 11, + "TSA policy \"Anything that arrives, we sign\"" }, + { (byte*)"\x2b\x06\x01\x04\x01\x97\x55\x58\x59\x5a\x5a\x59", 12, + "xYZZY policyIdentifier" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9a\x49\x08\x01\x01", 10, + "pgpExtension" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07", 8, + "eciaAscX12Edi" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07\x01", 9, + "plainEDImessage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07\x02", 9, + "signedEDImessage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07\x05", 9, + "integrityEDImessage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07\x41", 9, + "iaReceiptMessage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x07\x61", 9, + "iaStatusMessage" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x08", 8, + "eciaEdifact" }, + { (byte*)"\x2b\x06\x01\x04\x01\x9b\x78\x09", 8, + "eciaNonEdi" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32", 7, + "Globalsign" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01", 8, + "globalsignPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x0a", 9, + "globalsignDVPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x14", 9, + "globalsignOVPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x1e", 9, + "globalsignTSAPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x28", 9, + "globalsignClientCertPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x32", 9, + "globalsignCodeSignPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x3c", 9, + "globalsignRootSignPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x46", 9, + "globalsignTrustedRootPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x50", 9, + "globalsignEDIClientPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x51", 9, + "globalsignEDIServerPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x5a", 9, + "globalsignTPMRootPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x5f", 9, + "globalsignOCSPPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa9\x3d\x01", 8, + "edelWebPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa9\x3d\x01\x02", 9, + "edelWebCustomerPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa9\x3d\x01\x02\x01", 10, + "edelWebClepsydrePolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa9\x3d\x01\x02\x02", 10, + "edelWebExperimentalTSAPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa9\x3d\x01\x02\x03", 10, + "edelWebOpenEvidenceTSAPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xaa\x60", 7, + "timeproof" }, + { (byte*)"\x2b\x06\x01\x04\x01\xaa\x60\x01", 8, + "tss" }, + { (byte*)"\x2b\x06\x01\x04\x01\xaa\x60\x01\x01", 9, + "tss80" }, + { (byte*)"\x2b\x06\x01\x04\x01\xaa\x60\x01\x02", 9, + "tss380" }, + { (byte*)"\x2b\x06\x01\x04\x01\xaa\x60\x01\x03", 9, + "tss400" }, + { (byte*)"\x2b\x06\x01\x04\x01\xad\x0a\x00\x03", 9, + "secondaryPractices" }, + { (byte*)"\x2b\x06\x01\x04\x01\xad\x0a\x00\x04", 9, + "physicianIdentifiers" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb2\x31\x01\x02\x01\x03\x01", 12, + "comodoPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb2\x31\x01\x02\x02\x0f", 11, + "wotrustPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb2\x31\x01\x03\x05\x02", 11, + "comodoCertifiedDeliveryService" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb2\x31\x02\x01\x01", 10, + "comodoTimestampingPolicy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xc0\x6d\x03\x05\x01", 10, + "validityModelChain" }, + { (byte*)"\x2b\x06\x01\x04\x01\xc0\x6d\x03\x05\x02", 10, + "validityModelShell" }, + { (byte*)"\x2b\x06\x01\x04\x01\xc0\x27\x01", 8, + "rolUnicoNacional" }, + { (byte*)"\x2b\x06\x01\x04\x01\xd6\x79\x02\x04\x02", 10, + "googleSignedCertificateTimestamp" }, + { (byte*)"\x2b\x06\x01\x04\x01\xd6\x79\x02\x04\x03", 10, + "googlePrecertificatePoison" }, + { (byte*)"\x2b\x06\x01\x04\x01\xd6\x79\x02\x04\x04", 10, + "googlePrecertificateCA" }, + { (byte*)"\x2b\x06\x01\x04\x01\xd6\x79\x02\x04\x05", 10, + "googleOcspSignedCertificateTimestamp" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47", 7, + "gnu" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x01", 8, + "gnuRadius" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x02\x01", 10, + "gpgX509StandaloneCert" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x02\x02", 10, + "gpgX509WellKnownPrivateKey" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x02\x0a", 10, + "gpgX509PgpKdfKekParm" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x03\x01", 10, + "gpgCtPgpKeyblock" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x04\x01\x01", 11, + "gpgFingerprint" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x04\x01\x02", 11, + "gpgSubFingerprint" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x04\x01\x03", 11, + "gpgMailbox" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x04\x01\x04", 11, + "gpgSubCertID" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x05\x01", 10, + "gpgNtds" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x06\x01", 10, + "gpgX509PgpUseCert" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x06\x02", 10, + "gpgX509PgpUseSign" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x06\x03", 10, + "gpgX509PgpUseEncr" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x06\x04", 10, + "gpgX509PgpUseAuth" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x02\x85\xeb\xa0\x1d", 12, + "gpgInvalidOid" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x03", 8, + "gnuRadar" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x04\x0b", 9, + "scrypt" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0c", 8, + "gnuDigestAlgorithm" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0c\x02", 9, + "tiger" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d", 8, + "gnuEncryptionAlgorithm" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02", 9, + "serpent" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x01", 10, + "serpent128_ECB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x02", 10, + "serpent128_CBC" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x03", 10, + "serpent128_OFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x04", 10, + "serpent128_CFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x15", 10, + "serpent192_ECB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x16", 10, + "serpent192_CBC" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x17", 10, + "serpent192_OFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x18", 10, + "serpent192_CFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x29", 10, + "serpent256_ECB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x2a", 10, + "serpent256_CBC" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x2b", 10, + "serpent256_OFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0d\x02\x2c", 10, + "serpent256_CFB" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0f\x01", 9, + "curve25519" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0f\x02", 9, + "curve448" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0f\x03", 9, + "curve25519ph" }, + { (byte*)"\x2b\x06\x01\x04\x01\xda\x47\x0f\x04", 9, + "curve448ph" }, + { (byte*)"\x2b\x06\x01\x04\x01\xff\x4e\x83\x7d\x01\x01", 11, + "Northrop Grumman extKeyUsage?" }, + { (byte*)"\x2b\x06\x01\x04\x01\xff\x4e\x83\x7d\x02\x01", 11, + "ngcClass1" }, + { (byte*)"\x2b\x06\x01\x04\x01\xff\x4e\x83\x7d\x02\x02", 11, + "ngcClass2" }, + { (byte*)"\x2b\x06\x01\x04\x01\xff\x4e\x83\x7d\x02\x03", 11, + "ngcClass3" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb8\x4d\x01\x04\x02\x01\x01", 13, + "safenetUsageLimit" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb8\x4d\x01\x04\x02\x01\x02", 13, + "safenetEndDate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb8\x4d\x01\x04\x02\x01\x03", 13, + "safenetStartDate" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb8\x4d\x01\x04\x02\x01\x04", 13, + "safenetAdminCert" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb8\x4d\x01\x04\x02\x02\x01", 13, + "safenetKeyDigest" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03", 9, + "carillonSecurity" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x01", 10, + "carillonCommercialPKI" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x02", 10, + "carillonCommercialTSA" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x03", 10, + "carillonCommercialSCVP" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x03\x01", 11, + "carillonSCVPExtendedStatusInfo" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x04", 10, + "carillonCommercialCMS" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x04\x01", 11, + "carillonExtKeyUsageCIVCardAuth" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x04\x02", 11, + "carillonExtKeyUsageCIVContentSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x05", 10, + "carillonCommercialLSAP" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x05\x01", 11, + "carillonExtKeyUsageLSAPCodeSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x06", 10, + "carillonCommercialCE" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x07", 10, + "carillonCommercialLicense" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x07\x01", 11, + "carillonExtKeyUsageLicenseSigning" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xc3\x5e\x03\x08", 10, + "carillonCommercialSecret" }, + { (byte*)"\x2b\x06\x01\x04\x01\x83\x92\x1b\x02\x01", 10, + "hashOfRootKey" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x01", 7, + "authData" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x02", 7, + "dHKeyData" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x03", 7, + "rkeyData" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x04", 7, + "keyPurposeClientAuth" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x05", 7, + "keyPurposeKdc" }, + { (byte*)"\x2b\x06\x01\x05\x02\x03\x06", 7, + "kdf" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07", 6, + "pkix" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x00\x0c", 8, + "attributeCert" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01", 7, + "privateExtension" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x01", 8, + "authorityInfoAccess" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x02", 8, + "biometricInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x03", 8, + "qcStatements" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x04", 8, + "acAuditIdentity" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x05", 8, + "acTargeting" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x06", 8, + "acAaControls" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x07", 8, + "ipAddrBlocks" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x08", 8, + "autonomousSysIds" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x09", 8, + "routerIdentifier" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0a", 8, + "acProxying" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0b", 8, + "subjectInfoAccess" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0c", 8, + "logoType" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0d", 8, + "wlanSSID" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0e", 8, + "proxyCertInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x0f", 8, + "acPolicies" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x10", 8, + "certificateWarranty" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x12", 8, + "cmsContentConstraints" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x13", 8, + "otherCerts" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x14", 8, + "wrappedApexContinKey" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x15", 8, + "clearanceConstraints" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x16", 8, + "skiSemantics" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x17", 8, + "noSecrecyAfforded" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x18", 8, + "tlsFeature" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x19", 8, + "manufacturerUsageDescription" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1a", 8, + "tnAuthList" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1b", 8, + "jwtClaimConstraints" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1c", 8, + "ipAddrBlocksV2" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1d", 8, + "autonomousSysIdsV2" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1e", 8, + "manufacturerUsageDescriptionSigner" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x1f", 8, + "acmeIdentifier" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x20", 8, + "masaURL" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x21", 8, + "enhancedJWTClaimConstraints" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x01\x22", 8, + "nfTypes" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02", 7, + "policyQualifierIds" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02\x01", 8, + "cps" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02\x02", 8, + "unotice" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02\x03", 8, + "textNotice" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02\x04", 8, + "acps" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x02\x05", 8, + "acunotice" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03", 7, + "keyPurpose" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x01", 8, + "serverAuth" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x02", 8, + "clientAuth" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x03", 8, + "codeSigning" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x04", 8, + "emailProtection" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x05", 8, + "ipsecEndSystem" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x06", 8, + "ipsecTunnel" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x07", 8, + "ipsecUser" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x08", 8, + "timeStamping" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x09", 8, + "ocspSigning" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0a", 8, + "dvcs" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0b", 8, + "sbgpCertAAServerAuth" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0c", 8, + "scvpResponder" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0d", 8, + "eapOverPPP" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0e", 8, + "eapOverLAN" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x0f", 8, + "scvpServer" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x10", 8, + "scvpClient" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x11", 8, + "ipsecIKE" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x12", 8, + "capwapAC" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x13", 8, + "capwapWTP" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x14", 8, + "sipDomain" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x15", 8, + "secureShellClient" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x16", 8, + "secureShellServer" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x17", 8, + "sendRouter" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x18", 8, + "sendProxiedRouter" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x19", 8, + "sendOwner" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1a", 8, + "sendProxiedOwner" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1b", 8, + "cmcCA" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1c", 8, + "cmcRA" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1d", 8, + "cmcArchive" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1e", 8, + "bgpsecRouter" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x1f", 8, + "bimi" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x20", 8, + "cmKGA" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x21", 8, + "rpcTLSClient" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x22", 8, + "rpcTLSServer" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x23", 8, + "bundleSecurity" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x03\x24", 8, + "documentSigning" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04", 7, + "cmpInformationTypes" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x01", 8, + "caProtEncCert" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x02", 8, + "signKeyPairTypes" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x03", 8, + "encKeyPairTypes" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x04", 8, + "preferredSymmAlg" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x05", 8, + "caKeyUpdateInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x06", 8, + "currentCRL" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x07", 8, + "unsupportedOIDs" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0a", 8, + "keyPairParamReq" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0b", 8, + "keyPairParamRep" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0c", 8, + "revPassphrase" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0d", 8, + "implicitConfirm" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0e", 8, + "confirmWaitTime" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x0f", 8, + "origPKIMessage" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x04\x10", 8, + "suppLangTags" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05", 7, + "crmfRegistration" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01", 8, + "regCtrl" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x01", 9, + "regToken" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x02", 9, + "authenticator" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x03", 9, + "pkiPublicationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x04", 9, + "pkiArchiveOptions" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x05", 9, + "oldCertID" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x06", 9, + "protocolEncrKey" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x07", 9, + "altCertTemplate" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x01\x08", 9, + "wtlsTemplate" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x02", 8, + "utf8Pairs" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x02\x01", 9, + "utf8Pairs" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x05\x02\x02", 9, + "certReq" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06", 7, + "algorithms" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x01", 8, + "des40" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x02", 8, + "noSignature" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x03", 8, + "dhSigHmacSha1" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x04", 8, + "dhPop" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x05", 8, + "dhPopSha224" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x06", 8, + "dhPopSha256" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x07", 8, + "dhPopSha384" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x08", 8, + "dhPopSha512" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x0f", 8, + "dhPopStaticSha224HmacSha224" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x10", 8, + "dhPopStaticSha256HmacSha256" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x11", 8, + "dhPopStaticSha384HmacSha384" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x12", 8, + "dhPopStaticSha512HmacSha512" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x19", 8, + "ecdhPopStaticSha224HmacSha224" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x1a", 8, + "ecdhPopStaticSha256HmacSha256" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x1b", 8, + "ecdhPopStaticSha384HmacSha384" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x1c", 8, + "ecdhPopStaticSha512HmacSha512" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x1e", 8, + "rsaPssShake128" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x1f", 8, + "rsaPssShake256" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x20", 8, + "ecdsaShake128" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x06\x21", 8, + "ecdsaShake256" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x07", 7, + "cmcControls" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08", 7, + "otherNames" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x01", 8, + "personalData" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x02", 8, + "userGroup" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x03", 8, + "permanentIdentifier" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x05", 8, + "xmppAddr" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x06", 8, + "SIM" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x07", 8, + "dnsSRV" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x08", 8, + "naiRealm" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x09", 8, + "smtpUTF8Mailbox" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x0a", 8, + "acpNodeName" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x08\x0b", 8, + "bundleEID" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09", 7, + "personalData" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09\x01", 8, + "dateOfBirth" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09\x02", 8, + "placeOfBirth" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09\x03", 8, + "gender" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09\x04", 8, + "countryOfCitizenship" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x09\x05", 8, + "countryOfResidence" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a", 7, + "attributeCertificate" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x01", 8, + "authenticationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x02", 8, + "accessIdentity" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x03", 8, + "chargingIdentity" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x04", 8, + "group" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x05", 8, + "role" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0a\x06", 8, + "wlanSSID" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0b", 7, + "personalData" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0b\x01", 8, + "pkixQCSyntax-v1" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0b\x02", 8, + "pkixQCSyntax-v2" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0c", 7, + "pkixCCT" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0c\x02", 8, + "pkiData" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0c\x03", 8, + "pkiResponse" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x0e\x02", 8, + "resourceCertificatePolicy" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11", 7, + "scvpCheck" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x01", 8, + "scvpCheckBuildPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x02", 8, + "scvpCheckBuildValidPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x03", 8, + "scvpCheckBuildStatusCheckedPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x04", 8, + "scvpCheckBuildAaPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x05", 8, + "scvpCheckBuildValidAaPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x06", 8, + "scvpCheckBuildStatusCheckedAaPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x11\x07", 8, + "scvpCheckStatusCheckAcAndBuildStatusCheckedAaPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12", 7, + "scvpWantBack" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x01", 8, + "scvpWantbackBestCertPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x02", 8, + "scvpWantbackRevocationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x04", 8, + "scvpWantbackPublicKeyInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x05", 8, + "scvpWantbackAaCertPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x06", 8, + "scvpWantbackAaRevocationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x07", 8, + "scvpWantbackAcRevocationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x09", 8, + "scvpWantbackRelayedResponses" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x0a", 8, + "scvpWantbackCert" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x0b", 8, + "scvpWantbackAcCert" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x0c", 8, + "scvpWantbackAllCertPaths" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x0d", 8, + "scvpWantbackEeRevocationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x12\x0e", 8, + "scvpWantbackCAsRevocationInfo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13", 7, + "scvpValPolicy" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x01", 8, + "scvpDefaultValPolicy" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02", 8, + "scvpNameValAlg" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x01", 9, + "scvpNameErrorNameMismatch" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x02", 9, + "scvpNameErrorNoName" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x03", 9, + "scvpNameErrorUnknownAlg" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x04", 9, + "scvpNameErrorBadName" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x05", 9, + "scvpNameErrorBadNameType" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x02\x06", 9, + "scvpNameErrorMixedNames" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03", 8, + "scvpBasicValAlg" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x01", 9, + "scvpValErrorExpired" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x02", 9, + "scvpValErrorNotYetValid" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x03", 9, + "scvpValErrorWrongTrustAnchor" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x04", 9, + "scvpValErrorNoValidCertPath" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x05", 9, + "scvpValErrorRevoked" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x09", 9, + "scvpValErrorInvalidKeyPurpose" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x0a", 9, + "scvpValErrorInvalidKeyUsage" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x13\x03\x0b", 9, + "scvpValErrorInvalidCertPolicy" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x14", 7, + "logo" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x14\x01", 8, + "logoLoyalty" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x14\x02", 8, + "logoBackground" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01", 8, + "ocsp" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x01", 9, + "ocspBasic" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x02", 9, + "ocspNonce" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x03", 9, + "ocspCRL" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x04", 9, + "ocspResponse" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x05", 9, + "ocspNoCheck" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x06", 9, + "ocspArchiveCutoff" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x01\x07", 9, + "ocspServiceLocator" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x02", 8, + "caIssuers" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x03", 8, + "timeStamping" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x04", 8, + "dvcs" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x05", 8, + "caRepository" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x07", 8, + "signedObjectRepository" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x0a", 8, + "rpkiManifest" }, + { (byte*)"\x2b\x06\x01\x05\x05\x07\x30\x0b", 8, + "signedObject" }, + { (byte*)"\x2b\x06\x01\x05\x05\x08\x01\x01", 8, + "hmacMD5" }, + { (byte*)"\x2b\x06\x01\x05\x05\x08\x01\x02", 8, + "hmacSHA" }, + { (byte*)"\x2b\x06\x01\x05\x05\x08\x01\x03", 8, + "hmacTiger" }, + { (byte*)"\x2b\x06\x01\x05\x05\x08\x02\x02", 8, + "iKEIntermediate" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x01", 7, + "decEncryptionAlgorithm" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x01\x02", 8, + "decDEA" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x02", 7, + "decHashAlgorithm" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x02\x01", 8, + "decMD2" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x02\x02", 8, + "decMD4" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x03", 7, + "decSignatureAlgorithm" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x03\x01", 8, + "decMD2withRSA" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x03\x02", 8, + "decMD4withRSA" }, + { (byte*)"\x2b\x0c\x02\x87\x73\x07\x03\x03", 8, + "decDEAMAC" }, + { (byte*)"\x2b\x0e\x02\x1a\x05", 5, + "sha" }, + { (byte*)"\x2b\x0e\x03\x02\x01\x01", 6, + "rsa" }, + { (byte*)"\x2b\x0e\x03\x02\x02", 5, + "md4WitRSA" }, + { (byte*)"\x2b\x0e\x03\x02\x03", 5, + "md5WithRSA" }, + { (byte*)"\x2b\x0e\x03\x02\x04", 5, + "md4WithRSAEncryption" }, + { (byte*)"\x2b\x0e\x03\x02\x02\x01", 6, + "sqmod-N" }, + { (byte*)"\x2b\x0e\x03\x02\x03\x01", 6, + "sqmod-NwithRSA" }, + { (byte*)"\x2b\x0e\x03\x02\x06", 5, + "desECB" }, + { (byte*)"\x2b\x0e\x03\x02\x07", 5, + "desCBC" }, + { (byte*)"\x2b\x0e\x03\x02\x08", 5, + "desOFB" }, + { (byte*)"\x2b\x0e\x03\x02\x09", 5, + "desCFB" }, + { (byte*)"\x2b\x0e\x03\x02\x0a", 5, + "desMAC" }, + { (byte*)"\x2b\x0e\x03\x02\x0b", 5, + "rsaSignature" }, + { (byte*)"\x2b\x0e\x03\x02\x0c", 5, + "dsa" }, + { (byte*)"\x2b\x0e\x03\x02\x0d", 5, + "dsaWithSHA" }, + { (byte*)"\x2b\x0e\x03\x02\x0e", 5, + "mdc2WithRSASignature" }, + { (byte*)"\x2b\x0e\x03\x02\x0f", 5, + "shaWithRSASignature" }, + { (byte*)"\x2b\x0e\x03\x02\x10", 5, + "dhWithCommonModulus" }, + { (byte*)"\x2b\x0e\x03\x02\x11", 5, + "desEDE" }, + { (byte*)"\x2b\x0e\x03\x02\x12", 5, + "sha" }, + { (byte*)"\x2b\x0e\x03\x02\x13", 5, + "mdc-2" }, + { (byte*)"\x2b\x0e\x03\x02\x14", 5, + "dsaCommon" }, + { (byte*)"\x2b\x0e\x03\x02\x15", 5, + "dsaCommonWithSHA" }, + { (byte*)"\x2b\x0e\x03\x02\x16", 5, + "rsaKeyTransport" }, + { (byte*)"\x2b\x0e\x03\x02\x17", 5, + "keyed-hash-seal" }, + { (byte*)"\x2b\x0e\x03\x02\x18", 5, + "md2WithRSASignature" }, + { (byte*)"\x2b\x0e\x03\x02\x19", 5, + "md5WithRSASignature" }, + { (byte*)"\x2b\x0e\x03\x02\x1a", 5, + "sha1" }, + { (byte*)"\x2b\x0e\x03\x02\x1b", 5, + "dsaWithSHA1" }, + { (byte*)"\x2b\x0e\x03\x02\x1c", 5, + "dsaWithCommonSHA1" }, + { (byte*)"\x2b\x0e\x03\x02\x1d", 5, + "sha-1WithRSAEncryption" }, + { (byte*)"\x2b\x0e\x03\x03\x01", 5, + "simple-strong-auth-mechanism" }, + { (byte*)"\x2b\x0e\x07\x02\x01\x01", 6, + "ElGamal" }, + { (byte*)"\x2b\x0e\x07\x02\x03\x01", 6, + "md2WithRSA" }, + { (byte*)"\x2b\x0e\x07\x02\x03\x02", 6, + "md2WithElGamal" }, + { (byte*)"\x2b\x12\x00\x02\x12\x01", 6, + "hostIDMapping" }, + { (byte*)"\x2b\x1b\x10", 3, + "icaoSecurity" }, + { (byte*)"\x2b\x1b\x10\x00", 4, + "icaoSecurity" }, + { (byte*)"\x2b\x1b\x10\x00\x01\x01\x01\x01\x01\x01\x00", 11, + "icaoTestValidationPolicy" }, + { (byte*)"\x2b\x1b\x10\x01", 4, + "icaoCertPolicy" }, + { (byte*)"\x2b\x1b\x10\x01\x02", 5, + "icaoIATFRootCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01", 7, + "icaoIdentityAssurance" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x01", 8, + "icaoIdentityAssuranceLow" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x02", 8, + "icaoIdentityAssuranceLowDevice" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x03", 8, + "icaoIdentityAssuranceLowTSPMediated" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x04", 8, + "icaoIdentityAssuranceMedium" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x05", 8, + "icaoIdentityAssuranceMediumDevice" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x06", 8, + "icaoIdentityAssuranceMediumTSPMediated" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x07", 8, + "icaoIdentityAssuranceMediumHardware" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x08", 8, + "icaoIdentityAssuranceMediumDeviceHardware" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x09", 8, + "icaoIdentityAssuranceHigh" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x0a", 8, + "icaoIdentityAssuranceHighCardAuth" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x00\x01\x0b", 8, + "icaoIdentityAssuranceHighContentSigning" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01", 6, + "icaoIATFBridgeCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x00", 7, + "icaoCAODRootCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01", 7, + "icaoCAODBridgeCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01", 8, + "icaoUSBridgeCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01\x01", 9, + "icaoFAARootCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01\x01\x01", 10, + "icaoFAAIssuingCA" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01\x01\x01\x01", 11, + "icaoFAAClientCertificate" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01\x01\x01\x02", 11, + "icaoFAAServerCertificate" }, + { (byte*)"\x2b\x1b\x10\x01\x02\x01\x01\x01\x01\x01\x03", 11, + "icaoFAASWIMSigningCertificate" }, + { (byte*)"\x2b\x1b\x10\x01\x04\x01\x01", 7, + "icaoSWIMSigning" }, + { (byte*)"\x2b\x24\x01", 3, + "document" }, + { (byte*)"\x2b\x24\x01\x01", 4, + "finalVersion" }, + { (byte*)"\x2b\x24\x01\x02", 4, + "draft" }, + { (byte*)"\x2b\x24\x02", 3, + "sio" }, + { (byte*)"\x2b\x24\x02\x01", 4, + "sedu" }, + { (byte*)"\x2b\x24\x03", 3, + "algorithm" }, + { (byte*)"\x2b\x24\x03\x01", 4, + "encryptionAlgorithm" }, + { (byte*)"\x2b\x24\x03\x01\x01", 5, + "des" }, + { (byte*)"\x2b\x24\x03\x01\x01\x01", 6, + "desECB_pad" }, + { (byte*)"\x2b\x24\x03\x01\x01\x01\x01", 7, + "desECB_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x01\x02\x01", 7, + "desCBC_pad" }, + { (byte*)"\x2b\x24\x03\x01\x01\x02\x01\x01", 8, + "desCBC_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x03", 5, + "des_3" }, + { (byte*)"\x2b\x24\x03\x01\x03\x01\x01", 7, + "des_3ECB_pad" }, + { (byte*)"\x2b\x24\x03\x01\x03\x01\x01\x01", 8, + "des_3ECB_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x03\x02\x01", 7, + "des_3CBC_pad" }, + { (byte*)"\x2b\x24\x03\x01\x03\x02\x01\x01", 8, + "des_3CBC_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x02", 5, + "idea" }, + { (byte*)"\x2b\x24\x03\x01\x02\x01", 6, + "ideaECB" }, + { (byte*)"\x2b\x24\x03\x01\x02\x01\x01", 7, + "ideaECB_pad" }, + { (byte*)"\x2b\x24\x03\x01\x02\x01\x01\x01", 8, + "ideaECB_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x02\x02", 6, + "ideaCBC" }, + { (byte*)"\x2b\x24\x03\x01\x02\x02\x01", 7, + "ideaCBC_pad" }, + { (byte*)"\x2b\x24\x03\x01\x02\x02\x01\x01", 8, + "ideaCBC_ISOpad" }, + { (byte*)"\x2b\x24\x03\x01\x02\x03", 6, + "ideaOFB" }, + { (byte*)"\x2b\x24\x03\x01\x02\x04", 6, + "ideaCFB" }, + { (byte*)"\x2b\x24\x03\x01\x04", 5, + "rsaEncryption" }, + { (byte*)"\x2b\x24\x03\x01\x04\x84\x00\x11", 8, + "rsaEncryptionWithlmod512expe17" }, + { (byte*)"\x2b\x24\x03\x01\x05", 5, + "bsi-1" }, + { (byte*)"\x2b\x24\x03\x01\x05\x01", 6, + "bsi_1ECB_pad" }, + { (byte*)"\x2b\x24\x03\x01\x05\x02", 6, + "bsi_1CBC_pad" }, + { (byte*)"\x2b\x24\x03\x01\x05\x02\x01", 7, + "bsi_1CBC_PEMpad" }, + { (byte*)"\x2b\x24\x03\x02", 4, + "hashAlgorithm" }, + { (byte*)"\x2b\x24\x03\x02\x01", 5, + "ripemd160" }, + { (byte*)"\x2b\x24\x03\x02\x02", 5, + "ripemd128" }, + { (byte*)"\x2b\x24\x03\x02\x03", 5, + "ripemd256" }, + { (byte*)"\x2b\x24\x03\x02\x04", 5, + "mdc2singleLength" }, + { (byte*)"\x2b\x24\x03\x02\x05", 5, + "mdc2doubleLength" }, + { (byte*)"\x2b\x24\x03\x03", 4, + "signatureAlgorithm" }, + { (byte*)"\x2b\x24\x03\x03\x01", 5, + "rsaSignature" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01", 6, + "rsaSignatureWithsha1" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x84\x00\x02", 9, + "rsaSignatureWithsha1_l512_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x85\x00\x02", 9, + "rsaSignatureWithsha1_l640_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x86\x00\x02", 9, + "rsaSignatureWithsha1_l768_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x87\x00\x02", 9, + "rsaSignatureWithsha1_l896_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x88\x00\x02", 9, + "rsaSignatureWithsha1_l1024_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x84\x00\x03", 9, + "rsaSignatureWithsha1_l512_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x85\x00\x03", 9, + "rsaSignatureWithsha1_l640_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x86\x00\x03", 9, + "rsaSignatureWithsha1_l768_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x87\x00\x03", 9, + "rsaSignatureWithsha1_l896_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x88\x00\x03", 9, + "rsaSignatureWithsha1_l1024_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x84\x00\x05", 9, + "rsaSignatureWithsha1_l512_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x85\x00\x05", 9, + "rsaSignatureWithsha1_l640_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x86\x00\x05", 9, + "rsaSignatureWithsha1_l768_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x87\x00\x05", 9, + "rsaSignatureWithsha1_l896_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x88\x00\x05", 9, + "rsaSignatureWithsha1_l1024_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x84\x00\x09", 9, + "rsaSignatureWithsha1_l512_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x85\x00\x09", 9, + "rsaSignatureWithsha1_l640_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x86\x00\x09", 9, + "rsaSignatureWithsha1_l768_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x87\x00\x09", 9, + "rsaSignatureWithsha1_l896_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x88\x00\x09", 9, + "rsaSignatureWithsha1_l1024_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x84\x00\x0b", 9, + "rsaSignatureWithsha1_l512_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x85\x00\x0b", 9, + "rsaSignatureWithsha1_l640_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x86\x00\x0b", 9, + "rsaSignatureWithsha1_l768_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x87\x00\x0b", 9, + "rsaSignatureWithsha1_l896_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x01\x88\x00\x0b", 9, + "rsaSignatureWithsha1_l1024_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02", 6, + "rsaSignatureWithripemd160" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x84\x00\x02", 9, + "rsaSignatureWithripemd160_l512_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x85\x00\x02", 9, + "rsaSignatureWithripemd160_l640_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x86\x00\x02", 9, + "rsaSignatureWithripemd160_l768_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x87\x00\x02", 9, + "rsaSignatureWithripemd160_l896_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x88\x00\x02", 9, + "rsaSignatureWithripemd160_l1024_l2" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x84\x00\x03", 9, + "rsaSignatureWithripemd160_l512_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x85\x00\x03", 9, + "rsaSignatureWithripemd160_l640_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x86\x00\x03", 9, + "rsaSignatureWithripemd160_l768_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x87\x00\x03", 9, + "rsaSignatureWithripemd160_l896_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x88\x00\x03", 9, + "rsaSignatureWithripemd160_l1024_l3" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x84\x00\x05", 9, + "rsaSignatureWithripemd160_l512_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x85\x00\x05", 9, + "rsaSignatureWithripemd160_l640_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x86\x00\x05", 9, + "rsaSignatureWithripemd160_l768_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x87\x00\x05", 9, + "rsaSignatureWithripemd160_l896_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x88\x00\x05", 9, + "rsaSignatureWithripemd160_l1024_l5" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x84\x00\x09", 9, + "rsaSignatureWithripemd160_l512_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x85\x00\x09", 9, + "rsaSignatureWithripemd160_l640_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x86\x00\x09", 9, + "rsaSignatureWithripemd160_l768_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x87\x00\x09", 9, + "rsaSignatureWithripemd160_l896_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x88\x00\x09", 9, + "rsaSignatureWithripemd160_l1024_l9" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x84\x00\x0b", 9, + "rsaSignatureWithripemd160_l512_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x85\x00\x0b", 9, + "rsaSignatureWithripemd160_l640_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x86\x00\x0b", 9, + "rsaSignatureWithripemd160_l768_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x87\x00\x0b", 9, + "rsaSignatureWithripemd160_l896_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x02\x88\x00\x0b", 9, + "rsaSignatureWithripemd160_l1024_l11" }, + { (byte*)"\x2b\x24\x03\x03\x01\x03", 6, + "rsaSignatureWithrimpemd128" }, + { (byte*)"\x2b\x24\x03\x03\x01\x04", 6, + "rsaSignatureWithrimpemd256" }, + { (byte*)"\x2b\x24\x03\x03\x02", 5, + "ecsieSign" }, + { (byte*)"\x2b\x24\x03\x03\x02\x01", 6, + "ecsieSignWithsha1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x02", 6, + "ecsieSignWithripemd160" }, + { (byte*)"\x2b\x24\x03\x03\x02\x03", 6, + "ecsieSignWithmd2" }, + { (byte*)"\x2b\x24\x03\x03\x02\x04", 6, + "ecsieSignWithmd5" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x01", 9, + "brainpoolP160r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x02", 9, + "brainpoolP160t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x03", 9, + "brainpoolP192r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x04", 9, + "brainpoolP192t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x05", 9, + "brainpoolP224r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x06", 9, + "brainpoolP224t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x07", 9, + "brainpoolP256r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x08", 9, + "brainpoolP256t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x09", 9, + "brainpoolP320r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x0a", 9, + "brainpoolP320t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x0b", 9, + "brainpoolP384r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x0c", 9, + "brainpoolP384t1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x0d", 9, + "brainpoolP512r1" }, + { (byte*)"\x2b\x24\x03\x03\x02\x08\x01\x01\x0e", 9, + "brainpoolP512t1" }, + { (byte*)"\x2b\x24\x03\x04", 4, + "signatureScheme" }, + { (byte*)"\x2b\x24\x03\x04\x01", 5, + "sigS_ISO9796-1" }, + { (byte*)"\x2b\x24\x03\x04\x02", 5, + "sigS_ISO9796-2" }, + { (byte*)"\x2b\x24\x03\x04\x02\x01", 6, + "sigS_ISO9796-2Withred" }, + { (byte*)"\x2b\x24\x03\x04\x02\x02", 6, + "sigS_ISO9796-2Withrsa" }, + { (byte*)"\x2b\x24\x03\x04\x02\x03", 6, + "sigS_ISO9796-2Withrnd" }, + { (byte*)"\x2b\x24\x04", 3, + "attribute" }, + { (byte*)"\x2b\x24\x05", 3, + "policy" }, + { (byte*)"\x2b\x24\x06", 3, + "api" }, + { (byte*)"\x2b\x24\x06\x01", 4, + "manufacturer-specific_api" }, + { (byte*)"\x2b\x24\x06\x01\x01", 5, + "utimaco-api" }, + { (byte*)"\x2b\x24\x06\x02", 4, + "functionality-specific_api" }, + { (byte*)"\x2b\x24\x07", 3, + "keymgmnt" }, + { (byte*)"\x2b\x24\x07\x01", 4, + "keyagree" }, + { (byte*)"\x2b\x24\x07\x01\x01", 5, + "bsiPKE" }, + { (byte*)"\x2b\x24\x07\x02", 4, + "keytrans" }, + { (byte*)"\x2b\x24\x07\x02\x01", 5, + "encISO9796-2Withrsa" }, + { (byte*)"\x2b\x24\x08\x01\x01", 5, + "Teletrust SigGConform policyIdentifier" }, + { (byte*)"\x2b\x24\x08\x02\x01", 5, + "directoryService" }, + { (byte*)"\x2b\x24\x08\x03\x01", 5, + "dateOfCertGen" }, + { (byte*)"\x2b\x24\x08\x03\x02", 5, + "procuration" }, + { (byte*)"\x2b\x24\x08\x03\x03", 5, + "admission" }, + { (byte*)"\x2b\x24\x08\x03\x04", 5, + "monetaryLimit" }, + { (byte*)"\x2b\x24\x08\x03\x05", 5, + "declarationOfMajority" }, + { (byte*)"\x2b\x24\x08\x03\x06", 5, + "integratedCircuitCardSerialNumber" }, + { (byte*)"\x2b\x24\x08\x03\x07", 5, + "pKReference" }, + { (byte*)"\x2b\x24\x08\x03\x08", 5, + "restriction" }, + { (byte*)"\x2b\x24\x08\x03\x09", 5, + "retrieveIfAllowed" }, + { (byte*)"\x2b\x24\x08\x03\x0a", 5, + "requestedCertificate" }, + { (byte*)"\x2b\x24\x08\x03\x0b", 5, + "namingAuthorities" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01", 6, + "rechtWirtschaftSteuern" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x01", 7, + "rechtsanwaeltin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x02", 7, + "rechtsanwalt" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x03", 7, + "rechtsBeistand" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x04", 7, + "steuerBeraterin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x05", 7, + "steuerBerater" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x06", 7, + "steuerBevollmaechtigte" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x07", 7, + "steuerBevollmaechtigter" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x08", 7, + "notarin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x09", 7, + "notar" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0a", 7, + "notarVertreterin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0b", 7, + "notarVertreter" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0c", 7, + "notariatsVerwalterin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0d", 7, + "notariatsVerwalter" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0e", 7, + "wirtschaftsPrueferin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x0f", 7, + "wirtschaftsPruefer" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x10", 7, + "vereidigteBuchprueferin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x11", 7, + "vereidigterBuchpruefer" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x12", 7, + "patentAnwaeltin" }, + { (byte*)"\x2b\x24\x08\x03\x0b\x01\x13", 7, + "patentAnwalt" }, + { (byte*)"\x2b\x24\x08\x03\x0c", 5, + "certInDirSince" }, + { (byte*)"\x2b\x24\x08\x03\x0d", 5, + "certHash" }, + { (byte*)"\x2b\x24\x08\x03\x0e", 5, + "nameAtBirth" }, + { (byte*)"\x2b\x24\x08\x03\x0f", 5, + "additionalInformation" }, + { (byte*)"\x2b\x24\x08\x04\x01", 5, + "personalData" }, + { (byte*)"\x2b\x24\x08\x04\x08", 5, + "restriction" }, + { (byte*)"\x2b\x24\x08\x05\x01\x01\x01", 7, + "rsaIndicateSHA1" }, + { (byte*)"\x2b\x24\x08\x05\x01\x01\x02", 7, + "rsaIndicateRIPEMD160" }, + { (byte*)"\x2b\x24\x08\x05\x01\x01\x03", 7, + "rsaWithSHA1" }, + { (byte*)"\x2b\x24\x08\x05\x01\x01\x04", 7, + "rsaWithRIPEMD160" }, + { (byte*)"\x2b\x24\x08\x05\x01\x02\x01", 7, + "dsaExtended" }, + { (byte*)"\x2b\x24\x08\x05\x01\x02\x02", 7, + "dsaWithRIPEMD160" }, + { (byte*)"\x2b\x24\x08\x06\x01", 5, + "cert" }, + { (byte*)"\x2b\x24\x08\x06\x02", 5, + "certRef" }, + { (byte*)"\x2b\x24\x08\x06\x03", 5, + "attrCert" }, + { (byte*)"\x2b\x24\x08\x06\x04", 5, + "attrRef" }, + { (byte*)"\x2b\x24\x08\x06\x05", 5, + "fileName" }, + { (byte*)"\x2b\x24\x08\x06\x06", 5, + "storageTime" }, + { (byte*)"\x2b\x24\x08\x06\x07", 5, + "fileSize" }, + { (byte*)"\x2b\x24\x08\x06\x08", 5, + "location" }, + { (byte*)"\x2b\x24\x08\x06\x09", 5, + "sigNumber" }, + { (byte*)"\x2b\x24\x08\x06\x0a", 5, + "autoGen" }, + { (byte*)"\x2b\x24\x08\x07\x01\x01", 6, + "ptAdobeILL" }, + { (byte*)"\x2b\x24\x08\x07\x01\x02", 6, + "ptAmiPro" }, + { (byte*)"\x2b\x24\x08\x07\x01\x03", 6, + "ptAutoCAD" }, + { (byte*)"\x2b\x24\x08\x07\x01\x04", 6, + "ptBinary" }, + { (byte*)"\x2b\x24\x08\x07\x01\x05", 6, + "ptBMP" }, + { (byte*)"\x2b\x24\x08\x07\x01\x06", 6, + "ptCGM" }, + { (byte*)"\x2b\x24\x08\x07\x01\x07", 6, + "ptCorelCRT" }, + { (byte*)"\x2b\x24\x08\x07\x01\x08", 6, + "ptCorelDRW" }, + { (byte*)"\x2b\x24\x08\x07\x01\x09", 6, + "ptCorelEXC" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0a", 6, + "ptCorelPHT" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0b", 6, + "ptDraw" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0c", 6, + "ptDVI" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0d", 6, + "ptEPS" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0e", 6, + "ptExcel" }, + { (byte*)"\x2b\x24\x08\x07\x01\x0f", 6, + "ptGEM" }, + { (byte*)"\x2b\x24\x08\x07\x01\x10", 6, + "ptGIF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x11", 6, + "ptHPGL" }, + { (byte*)"\x2b\x24\x08\x07\x01\x12", 6, + "ptJPEG" }, + { (byte*)"\x2b\x24\x08\x07\x01\x13", 6, + "ptKodak" }, + { (byte*)"\x2b\x24\x08\x07\x01\x14", 6, + "ptLaTeX" }, + { (byte*)"\x2b\x24\x08\x07\x01\x15", 6, + "ptLotus" }, + { (byte*)"\x2b\x24\x08\x07\x01\x16", 6, + "ptLotusPIC" }, + { (byte*)"\x2b\x24\x08\x07\x01\x17", 6, + "ptMacPICT" }, + { (byte*)"\x2b\x24\x08\x07\x01\x18", 6, + "ptMacWord" }, + { (byte*)"\x2b\x24\x08\x07\x01\x19", 6, + "ptMSWfD" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1a", 6, + "ptMSWord" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1b", 6, + "ptMSWord2" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1c", 6, + "ptMSWord6" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1d", 6, + "ptMSWord8" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1e", 6, + "ptPDF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x1f", 6, + "ptPIF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x20", 6, + "ptPostscript" }, + { (byte*)"\x2b\x24\x08\x07\x01\x21", 6, + "ptRTF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x22", 6, + "ptSCITEX" }, + { (byte*)"\x2b\x24\x08\x07\x01\x23", 6, + "ptTAR" }, + { (byte*)"\x2b\x24\x08\x07\x01\x24", 6, + "ptTarga" }, + { (byte*)"\x2b\x24\x08\x07\x01\x25", 6, + "ptTeX" }, + { (byte*)"\x2b\x24\x08\x07\x01\x26", 6, + "ptText" }, + { (byte*)"\x2b\x24\x08\x07\x01\x27", 6, + "ptTIFF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x28", 6, + "ptTIFF-FC" }, + { (byte*)"\x2b\x24\x08\x07\x01\x29", 6, + "ptUID" }, + { (byte*)"\x2b\x24\x08\x07\x01\x2a", 6, + "ptUUEncode" }, + { (byte*)"\x2b\x24\x08\x07\x01\x2b", 6, + "ptWMF" }, + { (byte*)"\x2b\x24\x08\x07\x01\x2c", 6, + "ptWordPerfect" }, + { (byte*)"\x2b\x24\x08\x07\x01\x2d", 6, + "ptWPGrph" }, + { (byte*)"\x2b\x65\x01\x04", 4, + "thawte-ce" }, + { (byte*)"\x2b\x65\x01\x04\x01", 5, + "strongExtranet" }, + { (byte*)"\x2b\x65\x6e", 3, + "curveX25519" }, + { (byte*)"\x2b\x65\x6f", 3, + "curveX448" }, + { (byte*)"\x2b\x65\x70", 3, + "curveEd25519" }, + { (byte*)"\x2b\x65\x71", 3, + "curveEd448" }, + { (byte*)"\x2b\x65\x72", 3, + "curveEd25519ph" }, + { (byte*)"\x2b\x65\x73", 3, + "curveEd448ph" }, + { (byte*)"\x2b\x81\x04\x00\x01", 5, + "sect163k1" }, + { (byte*)"\x2b\x81\x04\x00\x02", 5, + "sect163r1" }, + { (byte*)"\x2b\x81\x04\x00\x03", 5, + "sect239k1" }, + { (byte*)"\x2b\x81\x04\x00\x04", 5, + "sect113r1" }, + { (byte*)"\x2b\x81\x04\x00\x05", 5, + "sect113r2" }, + { (byte*)"\x2b\x81\x04\x00\x06", 5, + "secp112r1" }, + { (byte*)"\x2b\x81\x04\x00\x07", 5, + "secp112r2" }, + { (byte*)"\x2b\x81\x04\x00\x08", 5, + "secp160r1" }, + { (byte*)"\x2b\x81\x04\x00\x09", 5, + "secp160k1" }, + { (byte*)"\x2b\x81\x04\x00\x0a", 5, + "secp256k1" }, + { (byte*)"\x2b\x81\x04\x00\x0f", 5, + "sect163r2" }, + { (byte*)"\x2b\x81\x04\x00\x10", 5, + "sect283k1" }, + { (byte*)"\x2b\x81\x04\x00\x11", 5, + "sect283r1" }, + { (byte*)"\x2b\x81\x04\x00\x16", 5, + "sect131r1" }, + { (byte*)"\x2b\x81\x04\x00\x17", 5, + "sect131r2" }, + { (byte*)"\x2b\x81\x04\x00\x18", 5, + "sect193r1" }, + { (byte*)"\x2b\x81\x04\x00\x19", 5, + "sect193r2" }, + { (byte*)"\x2b\x81\x04\x00\x1a", 5, + "sect233k1" }, + { (byte*)"\x2b\x81\x04\x00\x1b", 5, + "sect233r1" }, + { (byte*)"\x2b\x81\x04\x00\x1c", 5, + "secp128r1" }, + { (byte*)"\x2b\x81\x04\x00\x1d", 5, + "secp128r2" }, + { (byte*)"\x2b\x81\x04\x00\x1e", 5, + "secp160r2" }, + { (byte*)"\x2b\x81\x04\x00\x1f", 5, + "secp192k1" }, + { (byte*)"\x2b\x81\x04\x00\x20", 5, + "secp224k1" }, + { (byte*)"\x2b\x81\x04\x00\x21", 5, + "secp224r1" }, + { (byte*)"\x2b\x81\x04\x00\x22", 5, + "secp384r1" }, + { (byte*)"\x2b\x81\x04\x00\x23", 5, + "secp521r1" }, + { (byte*)"\x2b\x81\x04\x00\x24", 5, + "sect409k1" }, + { (byte*)"\x2b\x81\x04\x00\x25", 5, + "sect409r1" }, + { (byte*)"\x2b\x81\x04\x00\x26", 5, + "sect571k1" }, + { (byte*)"\x2b\x81\x04\x00\x27", 5, + "sect571r1" }, + { (byte*)"\x2b\x81\x04\x01\x0b\x00", 6, + "ecdhX963KDF-SHA224" }, + { (byte*)"\x2b\x81\x04\x01\x0b\x01", 6, + "ecdhX963KDF-SHA256" }, + { (byte*)"\x2b\x81\x04\x01\x0b\x02", 6, + "ecdhX963KDF-SHA384" }, + { (byte*)"\x2b\x81\x04\x01\x0b\x03", 6, + "ecdhX963KDF-SHA512" }, + { (byte*)"\x2b\x81\x04\x01\x0e\x00", 6, + "eccofactordhX963KDF-SHA224" }, + { (byte*)"\x2b\x81\x04\x01\x0e\x01", 6, + "eccofactordhX963KDF-SHA256" }, + { (byte*)"\x2b\x81\x04\x01\x0e\x02", 6, + "eccofactordhX963KDF-SHA384" }, + { (byte*)"\x2b\x81\x04\x01\x0e\x03", 6, + "eccofactordhX963KDF-SHA512" }, + { (byte*)"\x2b\x81\x04\x01\x0f\x00", 6, + "ecmqv-X963KDF-SHA224" }, + { (byte*)"\x2b\x81\x04\x01\x0f\x01", 6, + "ecmqv-X963KDF-SHA256" }, + { (byte*)"\x2b\x81\x04\x01\x0f\x02", 6, + "ecmqv-X963KDF-SHA384" }, + { (byte*)"\x2b\x81\x04\x01\x0f\x03", 6, + "ecmqv-X963KDF-SHA512" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x2c", 8, + "x944" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x2c\x01", 9, + "x944Components" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x2c\x01\x01", 10, + "x944Kdf2" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x2c\x01\x02", 10, + "x944Kdf3" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54", 8, + "x984" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x00", 9, + "x984Module" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x00\x01", 10, + "x984Biometrics" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x00\x02", 10, + "x984CMS" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x00\x03", 10, + "x984Identifiers" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01", 9, + "x984Biometric" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x00", 10, + "biometricUnknownType" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x01", 10, + "biometricBodyOdor" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x02", 10, + "biometricDNA" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x03", 10, + "biometricEarShape" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x04", 10, + "biometricFacialFeatures" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x05", 10, + "biometricFingerImage" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x06", 10, + "biometricFingerGeometry" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x07", 10, + "biometricHandGeometry" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x08", 10, + "biometricIrisFeatures" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x09", 10, + "biometricKeystrokeDynamics" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0a", 10, + "biometricPalm" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0b", 10, + "biometricRetina" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0c", 10, + "biometricSignature" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0d", 10, + "biometricSpeechPattern" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0e", 10, + "biometricThermalImage" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x0f", 10, + "biometricVeinPattern" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x10", 10, + "biometricThermalFaceImage" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x11", 10, + "biometricThermalHandImage" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x12", 10, + "biometricLipMovement" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x01\x13", 10, + "biometricGait" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x03", 9, + "x984MatchingMethod" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04", 9, + "x984FormatOwner" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x00", 10, + "x984CbeffOwner" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01", 10, + "x984IbiaOwner" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x01", 11, + "ibiaOwnerSAFLINK" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x02", 11, + "ibiaOwnerBioscrypt" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x03", 11, + "ibiaOwnerVisionics" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x04", 11, + "ibiaOwnerInfineonTechnologiesAG" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x05", 11, + "ibiaOwnerIridianTechnologies" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x06", 11, + "ibiaOwnerVeridicom" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x07", 11, + "ibiaOwnerCyberSIGN" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x08", 11, + "ibiaOwnereCryp" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x09", 11, + "ibiaOwnerFingerprintCardsAB" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0a", 11, + "ibiaOwnerSecuGen" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0b", 11, + "ibiaOwnerPreciseBiometric" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0c", 11, + "ibiaOwnerIdentix" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0d", 11, + "ibiaOwnerDERMALOG" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0e", 11, + "ibiaOwnerLOGICO" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x0f", 11, + "ibiaOwnerNIST" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x10", 11, + "ibiaOwnerA3Vision" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x11", 11, + "ibiaOwnerNEC" }, + { (byte*)"\x2b\x81\x05\x10\x86\x48\x09\x54\x04\x01\x12", 11, + "ibiaOwnerSTMicroelectronics" }, + { (byte*)"\x2b\x81\x1e\x91\x99\x84\x05\x00\x00\x00\x01\x02\x02", 13, + "qcpSK" }, + { (byte*)"\x55\x04\x00", 3, + "objectClass" }, + { (byte*)"\x55\x04\x01", 3, + "aliasedEntryName" }, + { (byte*)"\x55\x04\x02", 3, + "knowledgeInformation" }, + { (byte*)"\x55\x04\x03", 3, + "commonName" }, + { (byte*)"\x55\x04\x04", 3, + "surname" }, + { (byte*)"\x55\x04\x05", 3, + "serialNumber" }, + { (byte*)"\x55\x04\x06", 3, + "countryName" }, + { (byte*)"\x55\x04\x07", 3, + "localityName" }, + { (byte*)"\x55\x04\x07\x01", 4, + "collectiveLocalityName" }, + { (byte*)"\x55\x04\x08", 3, + "stateOrProvinceName" }, + { (byte*)"\x55\x04\x08\x01", 4, + "collectiveStateOrProvinceName" }, + { (byte*)"\x55\x04\x09", 3, + "streetAddress" }, + { (byte*)"\x55\x04\x09\x01", 4, + "collectiveStreetAddress" }, + { (byte*)"\x55\x04\x0a", 3, + "organizationName" }, + { (byte*)"\x55\x04\x0a\x01", 4, + "collectiveOrganizationName" }, + { (byte*)"\x55\x04\x0b", 3, + "organizationalUnitName" }, + { (byte*)"\x55\x04\x0b\x01", 4, + "collectiveOrganizationalUnitName" }, + { (byte*)"\x55\x04\x0c", 3, + "title" }, + { (byte*)"\x55\x04\x0d", 3, + "description" }, + { (byte*)"\x55\x04\x0e", 3, + "searchGuide" }, + { (byte*)"\x55\x04\x0f", 3, + "businessCategory" }, + { (byte*)"\x55\x04\x10", 3, + "postalAddress" }, + { (byte*)"\x55\x04\x10\x01", 4, + "collectivePostalAddress" }, + { (byte*)"\x55\x04\x11", 3, + "postalCode" }, + { (byte*)"\x55\x04\x11\x01", 4, + "collectivePostalCode" }, + { (byte*)"\x55\x04\x12", 3, + "postOfficeBox" }, + { (byte*)"\x55\x04\x12\x01", 4, + "collectivePostOfficeBox" }, + { (byte*)"\x55\x04\x13", 3, + "physicalDeliveryOfficeName" }, + { (byte*)"\x55\x04\x13\x01", 4, + "collectivePhysicalDeliveryOfficeName" }, + { (byte*)"\x55\x04\x14", 3, + "telephoneNumber" }, + { (byte*)"\x55\x04\x14\x01", 4, + "collectiveTelephoneNumber" }, + { (byte*)"\x55\x04\x15", 3, + "telexNumber" }, + { (byte*)"\x55\x04\x15\x01", 4, + "collectiveTelexNumber" }, + { (byte*)"\x55\x04\x16", 3, + "teletexTerminalIdentifier" }, + { (byte*)"\x55\x04\x16\x01", 4, + "collectiveTeletexTerminalIdentifier" }, + { (byte*)"\x55\x04\x17", 3, + "facsimileTelephoneNumber" }, + { (byte*)"\x55\x04\x17\x01", 4, + "collectiveFacsimileTelephoneNumber" }, + { (byte*)"\x55\x04\x18", 3, + "x121Address" }, + { (byte*)"\x55\x04\x19", 3, + "internationalISDNNumber" }, + { (byte*)"\x55\x04\x19\x01", 4, + "collectiveInternationalISDNNumber" }, + { (byte*)"\x55\x04\x1a", 3, + "registeredAddress" }, + { (byte*)"\x55\x04\x1b", 3, + "destinationIndicator" }, + { (byte*)"\x55\x04\x1c", 3, + "preferredDeliveryMehtod" }, + { (byte*)"\x55\x04\x1d", 3, + "presentationAddress" }, + { (byte*)"\x55\x04\x1e", 3, + "supportedApplicationContext" }, + { (byte*)"\x55\x04\x1f", 3, + "member" }, + { (byte*)"\x55\x04\x20", 3, + "owner" }, + { (byte*)"\x55\x04\x21", 3, + "roleOccupant" }, + { (byte*)"\x55\x04\x22", 3, + "seeAlso" }, + { (byte*)"\x55\x04\x23", 3, + "userPassword" }, + { (byte*)"\x55\x04\x24", 3, + "userCertificate" }, + { (byte*)"\x55\x04\x25", 3, + "caCertificate" }, + { (byte*)"\x55\x04\x26", 3, + "authorityRevocationList" }, + { (byte*)"\x55\x04\x27", 3, + "certificateRevocationList" }, + { (byte*)"\x55\x04\x28", 3, + "crossCertificatePair" }, + { (byte*)"\x55\x04\x29", 3, + "name" }, + { (byte*)"\x55\x04\x2a", 3, + "givenName" }, + { (byte*)"\x55\x04\x2b", 3, + "initials" }, + { (byte*)"\x55\x04\x2c", 3, + "generationQualifier" }, + { (byte*)"\x55\x04\x2d", 3, + "uniqueIdentifier" }, + { (byte*)"\x55\x04\x2e", 3, + "dnQualifier" }, + { (byte*)"\x55\x04\x2f", 3, + "enhancedSearchGuide" }, + { (byte*)"\x55\x04\x30", 3, + "protocolInformation" }, + { (byte*)"\x55\x04\x31", 3, + "distinguishedName" }, + { (byte*)"\x55\x04\x32", 3, + "uniqueMember" }, + { (byte*)"\x55\x04\x33", 3, + "houseIdentifier" }, + { (byte*)"\x55\x04\x34", 3, + "supportedAlgorithms" }, + { (byte*)"\x55\x04\x35", 3, + "deltaRevocationList" }, + { (byte*)"\x55\x04\x36", 3, + "dmdName" }, + { (byte*)"\x55\x04\x37", 3, + "clearance" }, + { (byte*)"\x55\x04\x38", 3, + "defaultDirQop" }, + { (byte*)"\x55\x04\x39", 3, + "attributeIntegrityInfo" }, + { (byte*)"\x55\x04\x3a", 3, + "attributeCertificate" }, + { (byte*)"\x55\x04\x3b", 3, + "attributeCertificateRevocationList" }, + { (byte*)"\x55\x04\x3c", 3, + "confKeyInfo" }, + { (byte*)"\x55\x04\x3d", 3, + "aACertificate" }, + { (byte*)"\x55\x04\x3e", 3, + "attributeDescriptorCertificate" }, + { (byte*)"\x55\x04\x3f", 3, + "attributeAuthorityRevocationList" }, + { (byte*)"\x55\x04\x40", 3, + "familyInformation" }, + { (byte*)"\x55\x04\x41", 3, + "pseudonym" }, + { (byte*)"\x55\x04\x42", 3, + "communicationsService" }, + { (byte*)"\x55\x04\x43", 3, + "communicationsNetwork" }, + { (byte*)"\x55\x04\x44", 3, + "certificationPracticeStmt" }, + { (byte*)"\x55\x04\x45", 3, + "certificatePolicy" }, + { (byte*)"\x55\x04\x46", 3, + "pkiPath" }, + { (byte*)"\x55\x04\x47", 3, + "privPolicy" }, + { (byte*)"\x55\x04\x48", 3, + "role" }, + { (byte*)"\x55\x04\x49", 3, + "delegationPath" }, + { (byte*)"\x55\x04\x4a", 3, + "protPrivPolicy" }, + { (byte*)"\x55\x04\x4b", 3, + "xMLPrivilegeInfo" }, + { (byte*)"\x55\x04\x4c", 3, + "xmlPrivPolicy" }, + { (byte*)"\x55\x04\x4d", 3, + "uuidpair" }, + { (byte*)"\x55\x04\x4e", 3, + "tagOid" }, + { (byte*)"\x55\x04\x4f", 3, + "uiiFormat" }, + { (byte*)"\x55\x04\x50", 3, + "uiiInUrh" }, + { (byte*)"\x55\x04\x51", 3, + "contentUrl" }, + { (byte*)"\x55\x04\x52", 3, + "permission" }, + { (byte*)"\x55\x04\x53", 3, + "uri" }, + { (byte*)"\x55\x04\x54", 3, + "pwdAttribute" }, + { (byte*)"\x55\x04\x55", 3, + "userPwd" }, + { (byte*)"\x55\x04\x56", 3, + "urn" }, + { (byte*)"\x55\x04\x57", 3, + "url" }, + { (byte*)"\x55\x04\x58", 3, + "utmCoordinates" }, + { (byte*)"\x55\x04\x59", 3, + "urnC" }, + { (byte*)"\x55\x04\x5a", 3, + "uii" }, + { (byte*)"\x55\x04\x5b", 3, + "epc" }, + { (byte*)"\x55\x04\x5c", 3, + "tagAfi" }, + { (byte*)"\x55\x04\x5d", 3, + "epcFormat" }, + { (byte*)"\x55\x04\x5e", 3, + "epcInUrn" }, + { (byte*)"\x55\x04\x5f", 3, + "ldapUrl" }, + { (byte*)"\x55\x04\x60", 3, + "tagLocation" }, + { (byte*)"\x55\x04\x61", 3, + "organizationIdentifier" }, + { (byte*)"\x55\x04\x62", 3, + "countryCode3c" }, + { (byte*)"\x55\x04\x63", 3, + "countryCode3n" }, + { (byte*)"\x55\x04\x64", 3, + "dnsName" }, + { (byte*)"\x55\x04\x65", 3, + "eepkCertificateRevocationList" }, + { (byte*)"\x55\x04\x66", 3, + "eeAttrCertificateRevocationList" }, + { (byte*)"\x55\x04\x67", 3, + "supportedPublicKeyAlgorithms" }, + { (byte*)"\x55\x04\x68", 3, + "intEmail" }, + { (byte*)"\x55\x04\x69", 3, + "jid" }, + { (byte*)"\x55\x04\x6a", 3, + "objectIdentifier" }, + { (byte*)"\x55\x06\x00", 3, + "top" }, + { (byte*)"\x55\x06\x01", 3, + "alias" }, + { (byte*)"\x55\x06\x02", 3, + "country" }, + { (byte*)"\x55\x06\x03", 3, + "locality" }, + { (byte*)"\x55\x06\x04", 3, + "organization" }, + { (byte*)"\x55\x06\x05", 3, + "organizationalUnit" }, + { (byte*)"\x55\x06\x06", 3, + "person" }, + { (byte*)"\x55\x06\x07", 3, + "organizationalPerson" }, + { (byte*)"\x55\x06\x08", 3, + "organizationalRole" }, + { (byte*)"\x55\x06\x09", 3, + "groupOfNames" }, + { (byte*)"\x55\x06\x0a", 3, + "residentialPerson" }, + { (byte*)"\x55\x06\x0b", 3, + "applicationProcess" }, + { (byte*)"\x55\x06\x0c", 3, + "applicationEntity" }, + { (byte*)"\x55\x06\x0d", 3, + "dSA" }, + { (byte*)"\x55\x06\x0e", 3, + "device" }, + { (byte*)"\x55\x06\x0f", 3, + "strongAuthenticationUser" }, + { (byte*)"\x55\x06\x10", 3, + "certificateAuthority" }, + { (byte*)"\x55\x06\x11", 3, + "groupOfUniqueNames" }, + { (byte*)"\x55\x06\x15", 3, + "pkiUser" }, + { (byte*)"\x55\x06\x16", 3, + "pkiCA" }, + { (byte*)"\x55\x08\x01\x01", 4, + "rsa" }, + { (byte*)"\x55\x1d\x01", 3, + "authorityKeyIdentifier" }, + { (byte*)"\x55\x1d\x02", 3, + "keyAttributes" }, + { (byte*)"\x55\x1d\x03", 3, + "certificatePolicies" }, + { (byte*)"\x55\x1d\x04", 3, + "keyUsageRestriction" }, + { (byte*)"\x55\x1d\x05", 3, + "policyMapping" }, + { (byte*)"\x55\x1d\x06", 3, + "subtreesConstraint" }, + { (byte*)"\x55\x1d\x07", 3, + "subjectAltName" }, + { (byte*)"\x55\x1d\x08", 3, + "issuerAltName" }, + { (byte*)"\x55\x1d\x09", 3, + "subjectDirectoryAttributes" }, + { (byte*)"\x55\x1d\x0a", 3, + "basicConstraints" }, + { (byte*)"\x55\x1d\x0b", 3, + "nameConstraints" }, + { (byte*)"\x55\x1d\x0c", 3, + "policyConstraints" }, + { (byte*)"\x55\x1d\x0d", 3, + "basicConstraints" }, + { (byte*)"\x55\x1d\x0e", 3, + "subjectKeyIdentifier" }, + { (byte*)"\x55\x1d\x0f", 3, + "keyUsage" }, + { (byte*)"\x55\x1d\x10", 3, + "privateKeyUsagePeriod" }, + { (byte*)"\x55\x1d\x11", 3, + "subjectAltName" }, + { (byte*)"\x55\x1d\x12", 3, + "issuerAltName" }, + { (byte*)"\x55\x1d\x13", 3, + "basicConstraints" }, + { (byte*)"\x55\x1d\x14", 3, + "cRLNumber" }, + { (byte*)"\x55\x1d\x15", 3, + "cRLReason" }, + { (byte*)"\x55\x1d\x16", 3, + "expirationDate" }, + { (byte*)"\x55\x1d\x17", 3, + "instructionCode" }, + { (byte*)"\x55\x1d\x18", 3, + "invalidityDate" }, + { (byte*)"\x55\x1d\x19", 3, + "cRLDistributionPoints" }, + { (byte*)"\x55\x1d\x1a", 3, + "issuingDistributionPoint" }, + { (byte*)"\x55\x1d\x1b", 3, + "deltaCRLIndicator" }, + { (byte*)"\x55\x1d\x1c", 3, + "issuingDistributionPoint" }, + { (byte*)"\x55\x1d\x1d", 3, + "certificateIssuer" }, + { (byte*)"\x55\x1d\x1e", 3, + "nameConstraints" }, + { (byte*)"\x55\x1d\x1f", 3, + "cRLDistributionPoints" }, + { (byte*)"\x55\x1d\x20", 3, + "certificatePolicies" }, + { (byte*)"\x55\x1d\x20\x00", 4, + "anyPolicy" }, + { (byte*)"\x55\x1d\x21", 3, + "policyMappings" }, + { (byte*)"\x55\x1d\x22", 3, + "policyConstraints" }, + { (byte*)"\x55\x1d\x23", 3, + "authorityKeyIdentifier" }, + { (byte*)"\x55\x1d\x24", 3, + "policyConstraints" }, + { (byte*)"\x55\x1d\x25", 3, + "extKeyUsage" }, + { (byte*)"\x55\x1d\x25\x00", 4, + "anyExtendedKeyUsage" }, + { (byte*)"\x55\x1d\x26", 3, + "authorityAttributeIdentifier" }, + { (byte*)"\x55\x1d\x27", 3, + "roleSpecCertIdentifier" }, + { (byte*)"\x55\x1d\x28", 3, + "cRLStreamIdentifier" }, + { (byte*)"\x55\x1d\x29", 3, + "basicAttConstraints" }, + { (byte*)"\x55\x1d\x2a", 3, + "delegatedNameConstraints" }, + { (byte*)"\x55\x1d\x2b", 3, + "timeSpecification" }, + { (byte*)"\x55\x1d\x2c", 3, + "cRLScope" }, + { (byte*)"\x55\x1d\x2d", 3, + "statusReferrals" }, + { (byte*)"\x55\x1d\x2e", 3, + "freshestCRL" }, + { (byte*)"\x55\x1d\x2f", 3, + "orderedList" }, + { (byte*)"\x55\x1d\x30", 3, + "attributeDescriptor" }, + { (byte*)"\x55\x1d\x31", 3, + "userNotice" }, + { (byte*)"\x55\x1d\x32", 3, + "sOAIdentifier" }, + { (byte*)"\x55\x1d\x33", 3, + "baseUpdateTime" }, + { (byte*)"\x55\x1d\x34", 3, + "acceptableCertPolicies" }, + { (byte*)"\x55\x1d\x35", 3, + "deltaInfo" }, + { (byte*)"\x55\x1d\x36", 3, + "inhibitAnyPolicy" }, + { (byte*)"\x55\x1d\x37", 3, + "targetInformation" }, + { (byte*)"\x55\x1d\x38", 3, + "noRevAvail" }, + { (byte*)"\x55\x1d\x39", 3, + "acceptablePrivilegePolicies" }, + { (byte*)"\x55\x1d\x3a", 3, + "toBeRevoked" }, + { (byte*)"\x55\x1d\x3b", 3, + "revokedGroups" }, + { (byte*)"\x55\x1d\x3c", 3, + "expiredCertsOnCRL" }, + { (byte*)"\x55\x1d\x3d", 3, + "indirectIssuer" }, + { (byte*)"\x55\x1d\x3e", 3, + "noAssertion" }, + { (byte*)"\x55\x1d\x3f", 3, + "aAissuingDistributionPoint" }, + { (byte*)"\x55\x1d\x40", 3, + "issuedOnBehalfOf" }, + { (byte*)"\x55\x1d\x41", 3, + "singleUse" }, + { (byte*)"\x55\x1d\x42", 3, + "groupAC" }, + { (byte*)"\x55\x1d\x43", 3, + "allowedAttAss" }, + { (byte*)"\x55\x1d\x44", 3, + "attributeMappings" }, + { (byte*)"\x55\x1d\x45", 3, + "holderNameConstraints" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x01", 8, + "privateKeySmartCard" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x02", 8, + "privateKeySoftToken" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x03", 8, + "sslEvident. Also assigned as BuyPass EV policy" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x04", 8, + "sslBusinessPlus" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x05", 8, + "privateKeyHardToken" }, + { (byte*)"\x60\x84\x42\x01\x1a\x01\x03\x06", 8, + "privateKeyHSM" }, + { (byte*)"\x60\x85\x54\x01\x02\x02\x04\x01", 8, + "personalDataInfo" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x01", 9, + "sdnsSignatureAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x02", 9, + "fortezzaSignatureAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x03", 9, + "sdnsConfidentialityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x04", 9, + "fortezzaConfidentialityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x05", 9, + "sdnsIntegrityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x06", 9, + "fortezzaIntegrityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x07", 9, + "sdnsTokenProtectionAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x08", 9, + "fortezzaTokenProtectionAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x09", 9, + "sdnsKeyManagementAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0a", 9, + "fortezzaKeyManagementAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0b", 9, + "sdnsKMandSigAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0c", 9, + "fortezzaKMandSigAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0d", 9, + "suiteASignatureAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0e", 9, + "suiteAConfidentialityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x0f", 9, + "suiteAIntegrityAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x10", 9, + "suiteATokenProtectionAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x11", 9, + "suiteAKeyManagementAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x12", 9, + "suiteAKMandSigAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x13", 9, + "fortezzaUpdatedSigAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x14", 9, + "fortezzaKMandUpdSigAlgorithms" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x15", 9, + "fortezzaUpdatedIntegAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x16", 9, + "keyExchangeAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x17", 9, + "fortezzaWrap80Algorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x01\x18", 9, + "kEAKeyEncryptionAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x01", 9, + "rfc822MessageFormat" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x02", 9, + "emptyContent" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x03", 9, + "cspContentType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x2a", 9, + "mspRev3ContentType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x30", 9, + "mspContentType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x31", 9, + "mspRekeyAgentProtocol" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x32", 9, + "mspMMP" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x42", 9, + "mspRev3-1ContentType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x48", 9, + "forwardedMSPMessageBodyPart" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x49", 9, + "mspForwardedMessageParameters" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4a", 9, + "forwardedCSPMsgBodyPart" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4b", 9, + "cspForwardedMessageParameters" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4c", 9, + "mspMMP2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4e\x02", 10, + "encryptedKeyPackage" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4e\x03", 10, + "keyPackageReceipt" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x02\x4e\x06", 10, + "keyPackageError" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x01", 9, + "sdnsSecurityPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x02", 9, + "sdnsPRBAC" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x03", 9, + "mosaicPRBAC" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a", 9, + "siSecurityPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x00", 10, + "siNASP" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x01", 10, + "siELCO" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x02", 10, + "siTK" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x03", 10, + "siDSAP" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x04", 10, + "siSSSS" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x05", 10, + "siDNASP" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x06", 10, + "siBYEMAN" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x07", 10, + "siREL-US" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x08", 10, + "siREL-AUS" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x09", 10, + "siREL-CAN" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x0a", 10, + "siREL_UK" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x0b", 10, + "siREL-NZ" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0a\x0c", 10, + "siGeneric" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b", 9, + "genser" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b\x00", 10, + "genserNations" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b\x01", 10, + "genserComsec" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b\x02", 10, + "genserAcquisition" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b\x03", 10, + "genserSecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0b\x03\x00", 11, + "genserTagSetName" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0c", 9, + "defaultSecurityPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d", 9, + "capcoMarkings" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d\x00", 10, + "capcoSecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d\x00\x01", 11, + "capcoTagSetName1" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d\x00\x02", 11, + "capcoTagSetName2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d\x00\x03", 11, + "capcoTagSetName3" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x03\x0d\x00\x04", 11, + "capcoTagSetName4" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x01", 9, + "sdnsKeyManagementCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x02", 9, + "sdnsUserSignatureCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x03", 9, + "sdnsKMandSigCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x04", 9, + "fortezzaKeyManagementCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x05", 9, + "fortezzaKMandSigCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x06", 9, + "fortezzaUserSignatureCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x07", 9, + "fortezzaCASignatureCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x08", 9, + "sdnsCASignatureCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x0a", 9, + "auxiliaryVector" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x0b", 9, + "mlReceiptPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x0c", 9, + "mlMembership" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x0d", 9, + "mlAdministrators" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x0e", 9, + "alid" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x14", 9, + "janUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x15", 9, + "febUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x16", 9, + "marUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x17", 9, + "aprUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x18", 9, + "mayUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x19", 9, + "junUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1a", 9, + "julUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1b", 9, + "augUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1c", 9, + "sepUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1d", 9, + "octUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1e", 9, + "novUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x1f", 9, + "decUKMs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x28", 9, + "metaSDNSckl" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x29", 9, + "sdnsCKL" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2a", 9, + "metaSDNSsignatureCKL" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2b", 9, + "sdnsSignatureCKL" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2c", 9, + "sdnsCertificateRevocationList" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2d", 9, + "fortezzaCertificateRevocationList" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2e", 9, + "fortezzaCKL" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x2f", 9, + "alExemptedAddressProcessor" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x30", 9, + "guard" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x31", 9, + "algorithmsSupported" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x32", 9, + "suiteAKeyManagementCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x33", 9, + "suiteAKMandSigCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x34", 9, + "suiteAUserSignatureCertificate" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x35", 9, + "prbacInfo" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x36", 9, + "prbacCAConstraints" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x37", 9, + "sigOrKMPrivileges" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x38", 9, + "commPrivileges" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x39", 9, + "labeledAttribute" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x3a", 9, + "policyInformationFile" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x3b", 9, + "secPolicyInformationFile" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x3c", 9, + "cAClearanceConstraint" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x41", 9, + "keyPkgIdAndReceiptReq" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x42", 9, + "contentDecryptKeyID" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x46", 9, + "kpCrlPointers" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x47", 9, + "kpKeyProvinceV2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x05\x48", 9, + "kpManifest" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x07\x01", 9, + "cspExtns" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x07\x01\x00", 10, + "cspCsExtn" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x08\x01", 9, + "mISSISecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x08\x02", 9, + "standardSecurityLabelPrivileges" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x08\x03\x01", 10, + "enumeratedPermissiveAttrs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x08\x03\x03", 10, + "informativeAttrs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x08\x03\x04", 10, + "enumeratedRestrictiveAttrs" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0a\x01", 9, + "sigPrivileges" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0a\x02", 9, + "kmPrivileges" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0a\x03", 9, + "namedTagSetPrivilege" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x01", 9, + "ukDemo" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x02", 9, + "usDODClass2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x03", 9, + "usMediumPilot" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x04", 9, + "usDODClass4" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x05", 9, + "usDODClass3" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0b\x06", 9, + "usDODClass5" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00", 9, + "testSecurityPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x01", 10, + "tsp1" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x01\x00", 11, + "tsp1SecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x01\x00\x00", 12, + "tsp1TagSetZero" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x01\x00\x01", 12, + "tsp1TagSetOne" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x01\x00\x02", 12, + "tsp1TagSetTwo" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x02", 10, + "tsp2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x02\x00", 11, + "tsp2SecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x02\x00\x00", 12, + "tsp2TagSetZero" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x02\x00\x01", 12, + "tsp2TagSetOne" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x02\x00\x02", 12, + "tsp2TagSetTwo" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x03", 10, + "kafka" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x03\x00", 11, + "kafkaSecurityCategories" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x03\x00\x01", 12, + "kafkaTagSetName1" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x03\x00\x02", 12, + "kafkaTagSetName2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x00\x03\x00\x03", 12, + "kafkaTagSetName3" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0c\x01\x01", 10, + "tcp1" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x01", 9, + "kmaKeyAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x03", 9, + "kmaTSECNomenclature" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x05", 9, + "kmaKeyDistPeriod" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x06", 9, + "kmaKeyValidityPeriod" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x07", 9, + "kmaKeyDuration" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x0b", 9, + "kmaSplitID" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x0c", 9, + "kmaKeyPkgType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x0d", 9, + "kmaKeyPurpose" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x0e", 9, + "kmaKeyUse" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x0f", 9, + "kmaTransportKey" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x10", 9, + "kmaKeyPkgReceiversV2" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x13", 9, + "kmaOtherCertFormats" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x14", 9, + "kmaUsefulCerts" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x15", 9, + "kmaKeyWrapAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x0d\x16", 9, + "kmaSigUsageV3" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x10\x00", 9, + "dn" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x16", 8, + "errorCodes" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x16\x01", 9, + "missingKeyType" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x16\x02", 9, + "privacyMarkTooLong" }, + { (byte*)"\x60\x86\x48\x01\x65\x02\x01\x16\x03", 9, + "unrecognizedSecurityPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x01", 7, + "slabel" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02", 7, + "pki" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01", 8, + "NIST policyIdentifier" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x03\x01", 10, + "fbcaRudimentaryPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x03\x02", 10, + "fbcaBasicPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x03\x03", 10, + "fbcaMediumPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x03\x04", 10, + "fbcaHighPolicy" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x01", 10, + "nistTestPolicy1" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x02", 10, + "nistTestPolicy2" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x03", 10, + "nistTestPolicy3" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x04", 10, + "nistTestPolicy4" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x05", 10, + "nistTestPolicy5" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x01\x30\x06", 10, + "nistTestPolicy6" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x02", 8, + "gak" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x02\x01", 9, + "kRAKey" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x03", 8, + "extensions" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x03\x01", 9, + "kRTechnique" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x03\x02", 9, + "kRecoveryCapable" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x03\x03", 9, + "kR" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x04", 8, + "keyRecoverySchemes" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x02\x05", 8, + "krapola" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x03", 7, + "arpa" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04", 7, + "nistAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01", 8, + "aes" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x01", 9, + "aes128-ECB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x02", 9, + "aes128-CBC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x03", 9, + "aes128-OFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x04", 9, + "aes128-CFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x05", 9, + "aes128-wrap" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x06", 9, + "aes128-GCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x07", 9, + "aes128-CCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x08", 9, + "aes128-wrap-pad" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x09", 9, + "aes128-GMAC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x15", 9, + "aes192-ECB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x16", 9, + "aes192-CBC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x17", 9, + "aes192-OFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x18", 9, + "aes192-CFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x19", 9, + "aes192-wrap" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x1a", 9, + "aes192-GCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x1b", 9, + "aes192-CCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x1c", 9, + "aes192-wrap-pad" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x1d", 9, + "aes192-GMAC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x29", 9, + "aes256-ECB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2a", 9, + "aes256-CBC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2b", 9, + "aes256-OFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2c", 9, + "aes256-CFB" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2d", 9, + "aes256-wrap" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2e", 9, + "aes256-GCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x2f", 9, + "aes256-CCM" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x30", 9, + "aes256-wrap-pad" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x01\x31", 9, + "aes256-GMAC" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02", 8, + "hashAlgos" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x01", 9, + "sha-256" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x02", 9, + "sha-384" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x03", 9, + "sha-512" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x04", 9, + "sha-224" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x07", 9, + "sha3-224" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x08", 9, + "sha3-256" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x09", 9, + "sha3-384" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x0a", 9, + "sha3-512" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x0b", 9, + "shake128" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x0c", 9, + "shake256" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x11", 9, + "shake128len" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x12", 9, + "shake256len" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x13", 9, + "kmacShake128" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x02\x14", 9, + "kmacShake256" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x03\x01", 9, + "dsaWithSha224" }, + { (byte*)"\x60\x86\x48\x01\x65\x03\x04\x03\x02", 9, + "dsaWithSha256" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08", 10, + "novellAlgorithm" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x16", 11, + "desCbcIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x17", 11, + "desCbcPadIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x18", 11, + "desEDE2CbcIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x19", 11, + "desEDE2CbcPadIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1a", 11, + "desEDE3CbcIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1b", 11, + "desEDE3CbcPadIV8" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1c", 11, + "rc5CbcPad" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1d", 11, + "md2WithRSAEncryptionBSafe1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1e", 11, + "md5WithRSAEncryptionBSafe1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x1f", 11, + "sha1WithRSAEncryptionBSafe1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x20", 11, + "lmDigest" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x28", 11, + "md2" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x32", 11, + "md5" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x33", 11, + "ikeHmacWithSHA1-RSA" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x34", 11, + "ikeHmacWithMD5-RSA" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x45", 11, + "rc2CbcPad" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x52", 11, + "sha-1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x5c", 11, + "rc2BSafe1Cbc" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x5f", 11, + "md4" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x81\x02", 12, + "md4Packet" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x81\x03", 12, + "rsaEncryptionBsafe1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x81\x04", 12, + "nwPassword" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x02\x08\x81\x05", 12, + "novellObfuscate-1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x09", 9, + "pki" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x09\x04", 10, + "pkiAttributeType" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x09\x04\x01", 11, + "securityAttributes" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x37\x01\x09\x04\x02", 11, + "relianceLimit" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01", 8, + "cert-extension" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x01", 9, + "netscape-cert-type" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x02", 9, + "netscape-base-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x03", 9, + "netscape-revocation-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x04", 9, + "netscape-ca-revocation-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x07", 9, + "netscape-cert-renewal-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x08", 9, + "netscape-ca-policy-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x09", 9, + "HomePage-url" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x0a", 9, + "EntityLogo" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x0b", 9, + "UserPicture" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x0c", 9, + "netscape-ssl-server-name" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x01\x0d", 9, + "netscape-comment" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02", 8, + "data-type" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x01", 9, + "dataGIF" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x02", 9, + "dataJPEG" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x03", 9, + "dataURL" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x04", 9, + "dataHTML" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x05", 9, + "certSequence" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x02\x06", 9, + "certURL" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03", 8, + "directory" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01", 9, + "ldapDefinitions" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01\x01", 10, + "carLicense" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01\x02", 10, + "departmentNumber" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01\x03", 10, + "employeeNumber" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01\x04", 10, + "employeeType" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x01\x81\x58", 11, + "userPKCS12" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x03\x02\x02", 10, + "inetOrgPerson" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x42\x04\x01", 9, + "serverGatedCrypto" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x06\x03", 10, + "verisignCZAG" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x06\x06", 10, + "verisignInBox" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x06\x0b", 10, + "verisignOnsiteJurisdictionHash" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x06\x0d", 10, + "Unknown Verisign VPN extension" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x06\x0f", 10, + "verisignServerID" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x07\x01\x01", 11, + "verisignCertPolicies95Qualifier1" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x07\x01\x01\x01", 12, + "verisignCPSv1notice" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x07\x01\x01\x02", 12, + "verisignCPSv1nsi" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x08\x01", 10, + "verisignISSStrongCrypto" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01", 8, + "pki" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09", 9, + "pkcs7Attribute" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x02", 10, + "messageType" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x03", 10, + "pkiStatus" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x04", 10, + "failInfo" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x05", 10, + "senderNonce" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x06", 10, + "recipientNonce" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x07", 10, + "transID" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x09\x08", 10, + "extensionReq" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x4d\x02", 8, + "intelCDSA" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01", 8, + "digiCertNonEVCerts" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x01", 9, + "digiCertOVCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x02", 9, + "digiCertDVCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x0b", 9, + "digiCertFederatedDeviceCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x03\x00\x01", 11, + "digiCertGlobalCAPolicy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x03\x00\x02", 11, + "digiCertHighAssuranceEVCAPolicy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x03\x00\x03", 11, + "digiCertGlobalRootCAPolicy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x01\x03\x00\x04", 11, + "digiCertAssuredIDRootCAPolicy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x02", 9, + "digiCertEVCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x03", 9, + "digiCertObjectSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x03\x01", 10, + "digiCertCodeSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x03\x02", 10, + "digiCertEVCodeSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x03\x0b", 10, + "digiCertKernelCodeSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x03\x15", 10, + "digiCertDocumentSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04", 9, + "digiCertClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x01\x01", 11, + "digiCertLevel1PersonalClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x01\x02", 11, + "digiCertLevel1EnterpriseClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x02", 10, + "digiCertLevel2ClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x03\x01", 11, + "digiCertLevel3USClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x03\x02", 11, + "digiCertLevel3CBPClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x04\x01", 11, + "digiCertLevel4USClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x04\x02", 11, + "digiCertLevel4CBPClientCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x05\x01", 11, + "digiCertPIVHardwareCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x05\x02", 11, + "digiCertPIVCardAuthCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x04\x05\x03", 11, + "digiCertPIVContentSigningCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x04\x1f", 9, + "digiCertGridClassicCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x04\x1f\x05", 10, + "digiCertGridIntegratedCert" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x1f\x04\x1f\x01", 11, + "digiCertGridHostCert" }, + { (byte*)"\x67\x2a\x00", 3, + "contentType" }, + { (byte*)"\x67\x2a\x00\x00", 4, + "panData" }, + { (byte*)"\x67\x2a\x00\x01", 4, + "panToken" }, + { (byte*)"\x67\x2a\x00\x02", 4, + "panOnly" }, + { (byte*)"\x67\x2a\x01", 3, + "msgExt" }, + { (byte*)"\x67\x2a\x02", 3, + "field" }, + { (byte*)"\x67\x2a\x02\x00", 4, + "fullName" }, + { (byte*)"\x67\x2a\x02\x01", 4, + "givenName" }, + { (byte*)"\x67\x2a\x02\x02", 4, + "familyName" }, + { (byte*)"\x67\x2a\x02\x03", 4, + "birthFamilyName" }, + { (byte*)"\x67\x2a\x02\x04", 4, + "placeName" }, + { (byte*)"\x67\x2a\x02\x05", 4, + "identificationNumber" }, + { (byte*)"\x67\x2a\x02\x06", 4, + "month" }, + { (byte*)"\x67\x2a\x02\x07", 4, + "date" }, + { (byte*)"\x67\x2a\x02\x08", 4, + "address" }, + { (byte*)"\x67\x2a\x02\x09", 4, + "telephone" }, + { (byte*)"\x67\x2a\x02\x0a", 4, + "amount" }, + { (byte*)"\x67\x2a\x02\x0b", 4, + "accountNumber" }, + { (byte*)"\x67\x2a\x02\x0c", 4, + "passPhrase" }, + { (byte*)"\x67\x2a\x03", 3, + "attribute" }, + { (byte*)"\x67\x2a\x03\x00", 4, + "cert" }, + { (byte*)"\x67\x2a\x03\x00\x00", 5, + "rootKeyThumb" }, + { (byte*)"\x67\x2a\x03\x00\x01", 5, + "additionalPolicy" }, + { (byte*)"\x67\x2a\x04", 3, + "algorithm" }, + { (byte*)"\x67\x2a\x05", 3, + "policy" }, + { (byte*)"\x67\x2a\x05\x00", 4, + "root" }, + { (byte*)"\x67\x2a\x06", 3, + "module" }, + { (byte*)"\x67\x2a\x07", 3, + "certExt" }, + { (byte*)"\x67\x2a\x07\x00", 4, + "hashedRootKey" }, + { (byte*)"\x67\x2a\x07\x01", 4, + "certificateType" }, + { (byte*)"\x67\x2a\x07\x02", 4, + "merchantData" }, + { (byte*)"\x67\x2a\x07\x03", 4, + "cardCertRequired" }, + { (byte*)"\x67\x2a\x07\x04", 4, + "tunneling" }, + { (byte*)"\x67\x2a\x07\x05", 4, + "setExtensions" }, + { (byte*)"\x67\x2a\x07\x06", 4, + "setQualifier" }, + { (byte*)"\x67\x2a\x08", 3, + "brand" }, + { (byte*)"\x67\x2a\x08\x01", 4, + "IATA-ATA" }, + { (byte*)"\x67\x2a\x08\x04", 4, + "VISA" }, + { (byte*)"\x67\x2a\x08\x05", 4, + "MasterCard" }, + { (byte*)"\x67\x2a\x08\x1e", 4, + "Diners" }, + { (byte*)"\x67\x2a\x08\x22", 4, + "AmericanExpress" }, + { (byte*)"\x67\x2a\x08\xae\x7b", 5, + "Novus" }, + { (byte*)"\x67\x2a\x09", 3, + "vendor" }, + { (byte*)"\x67\x2a\x09\x00", 4, + "GlobeSet" }, + { (byte*)"\x67\x2a\x09\x01", 4, + "IBM" }, + { (byte*)"\x67\x2a\x09\x02", 4, + "CyberCash" }, + { (byte*)"\x67\x2a\x09\x03", 4, + "Terisa" }, + { (byte*)"\x67\x2a\x09\x04", 4, + "RSADSI" }, + { (byte*)"\x67\x2a\x09\x05", 4, + "VeriFone" }, + { (byte*)"\x67\x2a\x09\x06", 4, + "TrinTech" }, + { (byte*)"\x67\x2a\x09\x07", 4, + "BankGate" }, + { (byte*)"\x67\x2a\x09\x08", 4, + "GTE" }, + { (byte*)"\x67\x2a\x09\x09", 4, + "CompuSource" }, + { (byte*)"\x67\x2a\x09\x0a", 4, + "Griffin" }, + { (byte*)"\x67\x2a\x09\x0b", 4, + "Certicom" }, + { (byte*)"\x67\x2a\x09\x0c", 4, + "OSS" }, + { (byte*)"\x67\x2a\x09\x0d", 4, + "TenthMountain" }, + { (byte*)"\x67\x2a\x09\x0e", 4, + "Antares" }, + { (byte*)"\x67\x2a\x09\x0f", 4, + "ECC" }, + { (byte*)"\x67\x2a\x09\x10", 4, + "Maithean" }, + { (byte*)"\x67\x2a\x09\x11", 4, + "Netscape" }, + { (byte*)"\x67\x2a\x09\x12", 4, + "Verisign" }, + { (byte*)"\x67\x2a\x09\x13", 4, + "BlueMoney" }, + { (byte*)"\x67\x2a\x09\x14", 4, + "Lacerte" }, + { (byte*)"\x67\x2a\x09\x15", 4, + "Fujitsu" }, + { (byte*)"\x67\x2a\x09\x16", 4, + "eLab" }, + { (byte*)"\x67\x2a\x09\x17", 4, + "Entrust" }, + { (byte*)"\x67\x2a\x09\x18", 4, + "VIAnet" }, + { (byte*)"\x67\x2a\x09\x19", 4, + "III" }, + { (byte*)"\x67\x2a\x09\x1a", 4, + "OpenMarket" }, + { (byte*)"\x67\x2a\x09\x1b", 4, + "Lexem" }, + { (byte*)"\x67\x2a\x09\x1c", 4, + "Intertrader" }, + { (byte*)"\x67\x2a\x09\x1d", 4, + "Persimmon" }, + { (byte*)"\x67\x2a\x09\x1e", 4, + "NABLE" }, + { (byte*)"\x67\x2a\x09\x1f", 4, + "espace-net" }, + { (byte*)"\x67\x2a\x09\x20", 4, + "Hitachi" }, + { (byte*)"\x67\x2a\x09\x21", 4, + "Microsoft" }, + { (byte*)"\x67\x2a\x09\x22", 4, + "NEC" }, + { (byte*)"\x67\x2a\x09\x23", 4, + "Mitsubishi" }, + { (byte*)"\x67\x2a\x09\x24", 4, + "NCR" }, + { (byte*)"\x67\x2a\x09\x25", 4, + "e-COMM" }, + { (byte*)"\x67\x2a\x09\x26", 4, + "Gemplus" }, + { (byte*)"\x67\x2a\x0a", 3, + "national" }, + { (byte*)"\x67\x2a\x0a\x83\x08", 5, + "Japan" }, + { (byte*)"\x67\x2b\x01\x04", 4, + "wTLS-ECC" }, + { (byte*)"\x67\x2b\x01\x04\x01", 5, + "wTLS-ECC-curve1" }, + { (byte*)"\x67\x2b\x01\x04\x06", 5, + "wTLS-ECC-curve6" }, + { (byte*)"\x67\x2b\x01\x04\x08", 5, + "wTLS-ECC-curve8" }, + { (byte*)"\x67\x2b\x01\x04\x09", 5, + "wTLS-ECC-curve9" }, + { (byte*)"\x67\x81\x05", 3, + "tCPA" }, + { (byte*)"\x67\x81\x05\x01", 4, + "tcgSpecVersion" }, + { (byte*)"\x67\x81\x05\x02", 4, + "tcgAttribute" }, + { (byte*)"\x67\x81\x05\x02\x01", 5, + "tcgTpmManufacturer" }, + { (byte*)"\x67\x81\x05\x02\x02", 5, + "tcgTpmModel" }, + { (byte*)"\x67\x81\x05\x02\x03", 5, + "tcgTpmVersion" }, + { (byte*)"\x67\x81\x05\x02\x04", 5, + "tcgPlatformManufacturer" }, + { (byte*)"\x67\x81\x05\x02\x05", 5, + "tcgPlatformModel" }, + { (byte*)"\x67\x81\x05\x02\x06", 5, + "tcgPlatformVersion" }, + { (byte*)"\x67\x81\x05\x02\x07", 5, + "tcgComponentManufacturer" }, + { (byte*)"\x67\x81\x05\x02\x08", 5, + "tcgComponentModel" }, + { (byte*)"\x67\x81\x05\x02\x09", 5, + "tcgComponentVersion" }, + { (byte*)"\x67\x81\x05\x02\x0a", 5, + "tcgSecurityQualities" }, + { (byte*)"\x67\x81\x05\x02\x0b", 5, + "tcgTpmProtectionProfile" }, + { (byte*)"\x67\x81\x05\x02\x0c", 5, + "tcgTpmSecurityTarget" }, + { (byte*)"\x67\x81\x05\x02\x0d", 5, + "tcgFoundationProtectionProfile" }, + { (byte*)"\x67\x81\x05\x02\x0e", 5, + "tcgFoundationSecurityTarget" }, + { (byte*)"\x67\x81\x05\x02\x0f", 5, + "tcgTpmIdLabel" }, + { (byte*)"\x67\x81\x05\x02\x10", 5, + "tcgTpmSpecification" }, + { (byte*)"\x67\x81\x05\x02\x12", 5, + "tcgTpmSecurityAssertions" }, + { (byte*)"\x67\x81\x05\x03", 4, + "tcgProtocol" }, + { (byte*)"\x67\x81\x05\x03\x01", 5, + "tcgPrttTpmIdProtocol" }, + { (byte*)"\x67\x81\x05\x08\x01", 5, + "tcgEKCertificate" }, + { (byte*)"\x67\x81\x05\x0a\x01\x01\x01", 7, + "tcgObject" }, + { (byte*)"\x67\x81\x06\x01\x04\x02\x01", 7, + "postSignumRootQCA" }, + { (byte*)"\x67\x81\x06\x01\x02\x02\x03", 7, + "postSignumPublicCA" }, + { (byte*)"\x67\x81\x06\x01\x02\x01\x08\x81\x52", 9, + "postSignumCommercialServerPolicy" }, + { (byte*)"\x67\x81\x08\x01\x01\x01", 6, + "mRTDSignatureData" }, + { (byte*)"\x67\x81\x0c\x01\x01", 5, + "evGuidelines" }, + { (byte*)"\x67\x81\x0c\x01\x02\x01", 6, + "domainValidated" }, + { (byte*)"\x67\x81\x0c\x01\x02\x02", 6, + "subjectIdentityValidated" }, + { (byte*)"\x67\x81\x0c\x01\x04\x01", 6, + "codeSigningRequirements" }, + { (byte*)"\x81\x06\x8d\x6f\x02", 5, + "hashedRootKey" }, + { (byte*)"\x81\x06\x8d\x6f\x03", 5, + "certificateType" }, + { (byte*)"\x81\x06\x8d\x6f\x04", 5, + "merchantData" }, + { (byte*)"\x81\x06\x8d\x6f\x05", 5, + "cardCertRequired" }, + { (byte*)"\x81\x06\x8d\x6f\x06", 5, + "tunneling" }, + { (byte*)"\x81\x06\x8d\x6f\x07", 5, + "setQualifier" }, + { (byte*)"\x81\x06\x8d\x6f\x63", 5, + "setData" }, + { (byte*)"\x2a\x28\x00\x11\x01\x16", 6, + "A-Trust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x8f\x09\x02\x01", 10, + "AffirmTrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x8f\x09\x02\x02", 10, + "AffirmTrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x8f\x09\x02\x03", 10, + "AffirmTrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\x8f\x09\x02\x04", 10, + "AffirmTrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x87\x2e\x0a\x0e\x02\x01\x02", 13, + "Camerfirma EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\x87\x2e\x0a\x08\x0c\x01\x02", 13, + "Camerfirma EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xad\x5a\x02\x05\x02\x03\x01", 13, + "CertPlus EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb2\x31\x01\x02\x01\x05\x01", 12, + "Comodo EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xb1\x3e\x01\x64\x01", 10, + "Cybertrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa5\x34\x02\x81\x4a\x01", 11, + "D-TRUST EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6c\x02\x01", 9, + "DigiCert EV policy" }, + { (byte*)"\x60\x84\x10\x01\x87\x69\x01\x01\x01\x0c\x06\x01\x01\x01", 14, + "DigiNotar EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfa\x6c\x0a\x01\x02", 10, + "Entrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xf0\x22\x01\x06", 9, + "GeoTrust EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xa0\x32\x01\x01", 9, + "GlobalSign EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6d\x01\x07\x17\x03", 11, + "GoDaddy EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xf3\x39\x06\x01\x01", 10, + "Izenpe EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xf3\x39\x06\x01\x02", 10, + "Izenpe EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x86\x0e\x01\x02\x01\x08\x01", 12, + "Network Solutions EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xbe\x58\x00\x02\x64\x01\x02", 12, + "QuoVadis EV policy" }, + { (byte*)"\x2a\x83\x08\x8c\x9b\x1b\x64\x85\x51\x01", 10, + "Security Communication (SECOM) EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x6e\x01\x07\x17\x03", 11, + "Starfield EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x81\xb5\x37\x01\x01\x01", 11, + "StartCom EV policy" }, + { (byte*)"\x60\x85\x74\x01\x59\x01\x02\x01\x01", 9, + "SwissSign EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\xbd\x47\x0d\x18\x01", 10, + "T-TeleSec EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x07\x30\x01", 11, + "Thawte EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfd\x64\x01\x01\x02\x04\x01", 12, + "TrustWave EV policy" }, + { (byte*)"\x2b\x06\x01\x04\x01\x82\xbf\x25\x01\x01\x16\x03", 12, + "TWCA EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xf8\x45\x01\x07\x17\x06", 11, + "VeriSign EV policy" }, + { (byte*)"\x60\x86\x48\x01\x86\xfb\x7b\x83\x74\x09", 10, + "Wells Fargo EV policy" }, +}; + +static const word32 oid_names_len = + (sizeof(oid_name_table) / sizeof(*oid_name_table)); + +#else + +static const OidName oid_name_table[1] = {0}; +static const word32 oid_names_len = 0; + +#endif /* defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) && + defined(WOLFSSL_ASN_PRINT) */ + +#endif /* CLU_OID_NAME_TABLE_H */ + diff --git a/wolfclu/clu_header_main.h b/wolfclu/clu_header_main.h index 50c1844e..9372e06a 100644 --- a/wolfclu/clu_header_main.h +++ b/wolfclu/clu_header_main.h @@ -112,6 +112,14 @@ extern "C" { #include #endif +/* API break introduced in 5.9.3 so compile out affected functionality + * when using previous version */ +#if LIBWOLFSSL_VERSION_HEX <= 0x05009002 +#ifndef NO_WC_ENCODE_OBJECT_ID + #define NO_WC_ENCODE_OBJECT_ID +#endif +#endif + #include #define BLOCK_SIZE 16384 @@ -450,6 +458,16 @@ int wolfCLU_streamHashBio(WOLFSSL_BIO* bioIn, enum wc_HashType hashType, int wolfCLU_hmacHash(WOLFSSL_HMAC_CTX *ctx, void* key, word32 keyLen, enum wc_HashType alg, WOLFSSL_BIO* in, byte* out, word32* outSz); +/* convert string to word32. + * + * @param str input string of digits. + * @param strSz size of input string. + * @param out pointer to word32 that out put will be placed in on success. + * @return wolfCLU_FATAL_ERROR of str contains non-digit + * characters or overflows word32 size. + * */ +int wolfCLU_StrToWord32(const char* arg, unsigned long strSz, word32* out); + /** * @brief Used to create a hash from a specified algorithm * diff --git a/wolfclu/clu_optargs.h b/wolfclu/clu_optargs.h index ef77a8fd..7c488a79 100644 --- a/wolfclu/clu_optargs.h +++ b/wolfclu/clu_optargs.h @@ -49,6 +49,7 @@ enum { WOLFCLU_DSA, WOLFCLU_DH, WOLFCLU_OCSP, + WOLFCLU_ASN1, WOLFCLU_VERSION, WOLFCLU_CONNECT, @@ -142,6 +143,12 @@ enum { WOLFCLU_LEVEL, WOLFCLU_HEIGHT, WOLFCLU_LAYER, + WOLFCLU_OID, + WOLFCLU_OFFSET, + WOLFCLU_STRPARSE, + WOLFCLU_LENGTH, + WOLFCLU_INDENT, + WOLFCLU_DUMP, }; /* algos */ diff --git a/wolfclu/include.am b/wolfclu/include.am index ffd25213..8dfd59ac 100644 --- a/wolfclu/include.am +++ b/wolfclu/include.am @@ -19,5 +19,8 @@ nobase_include_HEADERS+=wolfclu/version.h \ wolfclu/sign-verify/clu_sign.h \ wolfclu/sign-verify/clu_verify.h \ wolfclu/sign-verify/clu_sign_verify_setup.h \ - wolfclu/certgen/clu_certgen.h + wolfclu/certgen/clu_certgen.h \ + wolfclu/asn1/clu_asn1.h + +noinst_HEADERS += wolfclu/asn1/clu_oid_name_table.h From cb819ec4040ee780a7c26bb203e62f75702ffdf7 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Mon, 27 Jul 2026 15:36:53 -0600 Subject: [PATCH 2/8] review fixes and skoll fixes --- .github/workflows/ci.yml | 2 + configure.ac | 16 --- manpages/wolfssl-asn1parse.1 | 4 +- manpages/wolfssl.1 | 1 + src/asn1/clu_asn1_parse.c | 230 ++++++++++++++++++----------------- src/asn1/clu_asn1_setup.c | 18 +-- src/x509/clu_config.c | 1 - tests/asn1/asn1-test.py | 17 ++- tests/asn1/include.am | 2 +- tests/wolfclu_test.py | 4 +- 10 files changed, 146 insertions(+), 149 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dfc0a93b..52deb0c8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,9 @@ jobs: - '--enable-wolfclu --enable-experimental --enable-dilithium' - '--enable-wolfclu --enable-smallstack --enable-experimental --enable-dilithium' - '--enable-all' + sanitize: ['CC="cc -fsanitize=address" CFLAGS="-g"'] + include: - os: ubuntu-latest config: '--enable-wolfclu' diff --git a/configure.ac b/configure.ac index 68a458d1..90e968b5 100644 --- a/configure.ac +++ b/configure.ac @@ -158,22 +158,6 @@ AC_CHECK_FUNC([wc_EncodeObjectId], [], [AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"]) -# wc_EncodeObjectId is not usable in libwolfssl <= 5.9.2, so disable it based -# on the version when the symbol is present but too old. -AC_MSG_CHECKING([whether libwolfssl version supports wc_EncodeObjectId]) -AC_COMPILE_IFELSE( - [AC_LANG_PROGRAM( - [[#include ]], - [[ - #if LIBWOLFSSL_VERSION_HEX <= 0x05009002 - #error "libwolfssl version too old for wc_EncodeObjectId" - #endif - ]])], - [AC_MSG_RESULT([yes])], - [AC_MSG_RESULT([no]) - AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"]) - - ############################################### # # # Need a genKey check # diff --git a/manpages/wolfssl-asn1parse.1 b/manpages/wolfssl-asn1parse.1 index 56b606c7..ce7f0e94 100644 --- a/manpages/wolfssl-asn1parse.1 +++ b/manpages/wolfssl-asn1parse.1 @@ -74,9 +74,7 @@ wolfssl asn1parse -in cert.pem -inform PEM -dump .SH NOTES Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and without NO_FILESYSTEM. The -oid option additionally requires object id encoding -support (NO_WC_ENCODE_OBJECT_ID must not be defined). For OpenSSL -compatibility the tool reserves additional flags (e.g. -genstr, -genconf, --item, -strictpem, -dlimit) that are not yet implemented. +support (NO_WC_ENCODE_OBJECT_ID must not be defined). .SH BUGS No known bugs at this time. .SH AUTHOR diff --git a/manpages/wolfssl.1 b/manpages/wolfssl.1 index e2254846..dc6031f7 100644 --- a/manpages/wolfssl.1 +++ b/manpages/wolfssl.1 @@ -55,6 +55,7 @@ Certificates and CAs req generate certificate requests / self-signed certs verify verify an X.509 certificate chain crl parse and verify Certificate Revocation Lists + asn1parse print out a human readable print out of a given cert Keys genkey generate cryptographic keys diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c index a276cd7c..e1220ddd 100644 --- a/src/asn1/clu_asn1_parse.c +++ b/src/asn1/clu_asn1_parse.c @@ -35,11 +35,10 @@ #if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) - -static int Asn1Print(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts) +static int Asn1Print(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts) { int ret = WOLFCLU_SUCCESS; - Asn1PrintOptions PrintOpts = {0}; + Asn1PrintOptions PrintOpts = { 0 }; /* wc_Asn1_Init (called once in wolfCLU_Asn1Parse) leaves the output * file as XBADFILE; point it at stdout and wire up the OID-to-name @@ -53,22 +52,21 @@ static int Asn1Print(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts) if (wc_Asn1PrintOptions_Init(&PrintOpts) != 0) return WOLFCLU_FATAL_ERROR; if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_INDENT, - opts->indent) != 0) + opts->indent) != 0) return WOLFCLU_FATAL_ERROR; - if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH, - 1) != 0) + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH, 1) != 0) return WOLFCLU_FATAL_ERROR; /* this shows the hex in a readable print out and hides text data * so there is no double reporting on BIT STRING and OCTET STRINGS */ if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_DATA, - opts->dump) != 0) + opts->dump) != 0) return WOLFCLU_FATAL_ERROR; if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_OID, - opts->dump) != 0) + opts->dump) != 0) return WOLFCLU_FATAL_ERROR; if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_NO_TEXT, - opts->dump) != 0) + opts->dump) != 0) return WOLFCLU_FATAL_ERROR; ret = wc_Asn1_PrintAll(asn1, &PrintOpts, asn1->data, asn1->max); @@ -92,14 +90,13 @@ enum { ASN_PART_DATA, }; - /* Apply the -strparse offsets in po->strParse in order. Each entry is an * absolute byte offset from the current position to an OCTET STRING or BIT * STRING whose contents are themselves ASN.1; the parser descends into that * content so the next offset (and the final print) operate on the nested * structure. Returns WOLFCLU_SUCCESS on success or a negative error code. */ -static int StrParse(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* po) +static int StrParse(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *po) { int ret = WOLFCLU_SUCCESS; word32 idx = 0; @@ -111,25 +108,27 @@ static int StrParse(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* po) if (po->strParse[idx] >= asn1->max) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("-strparse %u with value %u " - "tried to jump to invalid location. " - "Unable to parse", idx, po->strParse[idx]); + "tried to jump to invalid location. " + "Unable to parse", + idx, po->strParse[idx]); break; } /* Advance into the buffer and shrink the remaining length to match so * later bounds checks stay accurate. */ asn1->data = asn1->data + po->strParse[idx]; - asn1->max = asn1->max - po->strParse[idx]; + asn1->max = asn1->max - po->strParse[idx]; /* Mask off the constructed bit to compare the base tag. */ asn1->item.tag = asn1->data[asn1->curr] & (byte)~ASN_CONSTRUCTED; if (asn1->item.tag != ASN_OCTET_STRING && - asn1->item.tag != ASN_BIT_STRING) { + asn1->item.tag != ASN_BIT_STRING) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("-strparse %u with value %u " - "did not find an octet string " - "unable to parse", idx, po->strParse[idx]); + "did not find an octet string " + "unable to parse", + idx, po->strParse[idx]); break; } @@ -143,21 +142,24 @@ static int StrParse(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* po) break; } + if (len <= 0) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Asn1 stucture for -strparse %u has a length of 0", + idx); + break; + } + /* The decoded length must fit within the bytes remaining after the * tag and length octets. */ - if (len < 0 || (word32)len > asn1->max - asn1->curr) { + if ((word32)len > asn1->max - asn1->curr) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("-strparse %u decoded length runs past the end " - "of the buffer. Unable to parse", idx); + "of the buffer. Unable to parse", + idx); break; } if (asn1->item.tag == ASN_BIT_STRING) { - if (len < 1) { - ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("-strparse %u BIT STRING has no content", idx); - break; - } asn1->curr++; len--; } @@ -177,16 +179,16 @@ static int StrParse(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* po) * * return WOLFCLU_SUCCESS on success, * WOLFLCU_FATAL_ERROR otherwise */ -static int Asn1Fmt(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts, - byte* data, word32 dataSz) +static int Asn1Fmt(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts, + byte *data, word32 dataSz) { int ret = WOLFCLU_SUCCESS; /* Reject an offset that points past the end of the buffer. Both values * are word32, so an out-of-range offset would make the length below * underflow and produce a near-4GB out-of-bounds read. */ - if (opts->offset > dataSz) { + if (opts->offset >= dataSz) { wolfCLU_LogError("-offset %u is past the end of the input (%u bytes)", - opts->offset, dataSz); + opts->offset, dataSz); return WOLFCLU_FATAL_ERROR; } @@ -194,8 +196,8 @@ static int Asn1Fmt(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts, * offset. */ if (opts->length > 0 && opts->length > dataSz - opts->offset) { wolfCLU_LogError("-length %u runs past the end of the input " - "(%u bytes remaining after offset)", - opts->length, dataSz - opts->offset); + "(%u bytes remaining after offset)", + opts->length, dataSz - opts->offset); return WOLFCLU_FATAL_ERROR; } @@ -223,8 +225,8 @@ static int Asn1Fmt(Asn1* asn1, const WOLFCLU_ASN1_PARSE_OPTIONS* opts, * * Returns WOLFCLU_SUCCESS on success. * */ -static int wolfCLU_Asn1Write(Asn1* asn1, - const WOLFCLU_ASN1_PARSE_OPTIONS* opts, byte* data, word32 dataSz) +static int wolfCLU_Asn1Write(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts, + byte *data, word32 dataSz) { int ret = WOLFCLU_SUCCESS; @@ -250,8 +252,6 @@ static int wolfCLU_Asn1Write(Asn1* asn1, return ret; } - - /* Find the next PEM block. * * @param [in] data PEM data. @@ -260,8 +260,8 @@ static int wolfCLU_Asn1Write(Asn1* asn1, * @param [out] start Start of Base64 encoding. * @param [out] end End of Base64 encoding. */ -static int FindPem(unsigned char* data, word32 offset, word32 len, - word32* start, word32* end) +static int FindPem(unsigned char *data, word32 offset, word32 len, + word32 *start, word32 *end) { int ret = WOLFCLU_SUCCESS; word32 i = 0; @@ -270,7 +270,7 @@ static int FindPem(unsigned char* data, word32 offset, word32 len, /* Find header. */ for (i = offset; i < len; i++) { if ((data[i] == '-') && - (XSTRNCMP((char*)data + i, "-----BEGIN", 10) == 0)) { + (XSTRNCMP((char *)data + i, "-----BEGIN", 10) == 0)) { i += (sizeof("-----BEGIN") - 1); /* Skip -----BEGIN text */ break; } @@ -284,7 +284,7 @@ static int FindPem(unsigned char* data, word32 offset, word32 len, /* Confirm header. */ for (; i < len; i++) { if ((data[i] == '-') && - (XSTRNCMP((char*)data + i, "-----", 5) == 0)) { + (XSTRNCMP((char *)data + i, "-----", 5) == 0)) { break; } } @@ -299,7 +299,7 @@ static int FindPem(unsigned char* data, word32 offset, word32 len, /* Find footer. */ for (j = i + 1; j < len; j++) { if ((data[j] == '-') && - (XSTRNCMP((char*)data + j, "-----END", 8) == 0)) { + (XSTRNCMP((char *)data + j, "-----END", 8) == 0)) { break; } } @@ -320,7 +320,7 @@ static int FindPem(unsigned char* data, word32 offset, word32 len, /* Allocate buffer to read returns length of file read if success. * and returns negative code on failure. */ -static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) +static long asn1_ReadFile(XFILE fp, byte **buffer, word32 *bufLen) { long fileLen; @@ -328,7 +328,7 @@ static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) return WOLFCLU_FATAL_ERROR; } - if (XFSEEK(fp, 0,SEEK_END) != 0) { + if (XFSEEK(fp, 0, SEEK_END) != 0) { return WOLFCLU_FATAL_ERROR; } @@ -339,20 +339,20 @@ static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) return WOLFCLU_FATAL_ERROR; } - /* A file at or below 0xFFFFFFEU still lets the +1 for the null terminator + /* A file at or below 0x7FFFFFFEU still lets the +1 for the null terminator * fit in a int (windows); anything larger would overflow the length below, so * reject it here rather than allocate and read a near-2GB buffer. */ - if (fileLen > (0xFFFFFFEU)) { - wolfCLU_LogError("File is longer than 0xFFFFFFEU byte max"); + if (fileLen > (0x7FFFFFFEU)) { + wolfCLU_LogError("File is longer than 0x7FFFFFFEU byte max"); return WOLFCLU_FATAL_ERROR; } - if (XFSEEK(fp, 0,SEEK_SET) != 0) { + if (XFSEEK(fp, 0, SEEK_SET) != 0) { return WOLFCLU_FATAL_ERROR; } /* add 1 for null terminator */ - *buffer = (byte*)XMALLOC(fileLen + 1, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); - if(*buffer == NULL) { + *buffer = (byte *)XMALLOC(fileLen + 1, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + if (*buffer == NULL) { return MEMORY_E; } @@ -361,7 +361,7 @@ static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) *buffer = NULL; return WOLFCLU_FATAL_ERROR; } - (*buffer)[fileLen] = '\0';/* add null terminator */ + (*buffer)[fileLen] = '\0'; /* add null terminator */ if (bufLen != NULL) { *bufLen = (word32)fileLen; @@ -369,14 +369,14 @@ static long asn1_ReadFile(XFILE fp, byte** buffer, word32* bufLen) return fileLen; } -static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME* p) +static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME *p) { if (p->dataBuffer != NULL) { XFREE(p->dataBuffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); } if (p->entries != NULL) { - XFREE(p->entries , HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + XFREE(p->entries, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); } wc_ForceZero(p, sizeof(*p)); @@ -386,16 +386,24 @@ static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME* p) /* take in dot separated oid string and fill it with Der encoding * * return wolfCLU_SUCCESS on success */ -static int OidToDer(char* oid, word32* oidSz) +static int OidToDer(char *oid, word32 *oidSz) { #ifndef NO_WC_ENCODE_OBJECT_ID int ret = WOLFCLU_SUCCESS; int err; int idx = 0; - char* token; - char* end; - word32* arc = (word32*)XMALLOC(sizeof(*arc) * *oidSz, - HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + char *token; + char *end; + word32 arcCap = 1; + const char *p = oid; + while (*p != '\0') { + if (*p == '.') { + arcCap++; + } + p++; + } + word32 *arc = (word32 *)XMALLOC(sizeof(*arc) * arcCap, HEAP_HINT, + DYNAMIC_TYPE_TMP_BUFFER); if (arc == NULL) { return MEMORY_E; } @@ -403,11 +411,11 @@ static int OidToDer(char* oid, word32* oidSz) token = XSTRTOK(oid, ".", &end); while (token != NULL && ret == WOLFCLU_SUCCESS) { word32 tmp = 0; - if (wolfCLU_StrToWord32(token, XSTRLEN(token), &tmp) - == WOLFCLU_SUCCESS) { + if (wolfCLU_StrToWord32(token, XSTRLEN(token), &tmp) == + WOLFCLU_SUCCESS) { arc[idx++] = tmp; } - else{ + else { wolfCLU_LogError("Could not parse oid dot form"); ret = WOLFCLU_FATAL_ERROR; break; @@ -418,7 +426,7 @@ static int OidToDer(char* oid, word32* oidSz) if (ret == WOLFCLU_SUCCESS) { /* oid is overwritten by and replaces with DER encoding */ XMEMSET(oid, '\0', *oidSz); - if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) { + if ((err = wc_EncodeObjectId(arc, idx, (byte *)oid, oidSz)) != 0) { wolfCLU_LogError("%s", wc_GetErrorString(err)); ret = WOLFCLU_FATAL_ERROR; } @@ -429,26 +437,26 @@ static int OidToDer(char* oid, word32* oidSz) return ret; #else wolfCLU_LogError("Old Version of wolfSSL %s must be greater than 5.9.2 to " - "use custom oids", WOLFSSL_VERSION); + "use custom oids", + WOLFSSL_VERSION); (void)oid; (void)oidSz; return WOLFCLU_FATAL_ERROR; -#endif - +#endif /*NO_WC_ENCODE_OBJECT_ID*/ } /* return WOLFCLU_SUCCESS if successful * if this function returns success you must call * WOLFCLU_OID_TO_NAME_free. */ -static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) +static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME *newOids, XFILE fp) { #ifndef NO_WC_ENCODE_OBJECT_ID int ret = WOLFCLU_SUCCESS; - OidName* tmpPtr; - byte* fileBuffer; - char* tracker; - char* token; - char* oid; + OidName *tmpPtr; + byte *fileBuffer; + char *tracker; + char *token; + char *oid; if (newOids == NULL) { wolfCLU_LogError("WOLFCLU_OID_TO_NAME was null"); @@ -465,7 +473,7 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) /* file format is \n * we load the first token and go until error or all lines are hit * and loaded */ - token = XSTRTOK((char*)fileBuffer, " ", &tracker); + token = XSTRTOK((char *)fileBuffer, " ", &tracker); while (ret == WOLFCLU_SUCCESS && token != NULL) { word32 len; oid = token; @@ -474,15 +482,16 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) ret = OidToDer(oid, &len); if (ret != WOLFCLU_SUCCESS) { wolfCLU_LogError("Could not convert Oid : %s to der check line %u", - token, newOids->len + 1); + token, newOids->len + 1); break; } /* skip short name */ token = XSTRTOK(NULL, " ", &tracker); - if (token == NULL) { + if (token == NULL || XSTRSTR(token, "\n") != NULL) { wolfCLU_LogError("malformed tokens, check line %u for bad " - "formatting; wanted short name", newOids->len + 1); + "formatting; wanted short name", + newOids->len + 1); ret = WOLFCLU_FATAL_ERROR; break; } @@ -490,17 +499,17 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) token = XSTRTOK(NULL, "\n", &tracker); if (token == NULL) { wolfCLU_LogError("malformed tokens, check line %u for bad " - "formatting; wanted long name", newOids->len + 1); + "formatting; wanted long name", + newOids->len + 1); ret = WOLFCLU_FATAL_ERROR; break; } /* realloc array if need more slots */ if (newOids->len >= newOids->cap) { - tmpPtr = XREALLOC(newOids->entries, - sizeof(OidName) * (newOids->cap + 10), - HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); + sizeof(OidName) * (newOids->cap + 10), HEAP_HINT, + DYNAMIC_TYPE_TMP_BUFFER); if (tmpPtr == NULL) { ret = MEMORY_E; @@ -508,12 +517,12 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) } else { newOids->entries = tmpPtr; - newOids->cap += 10; + newOids->cap += 10; } } newOids->entries[newOids->len].name = token; - newOids->entries[newOids->len].oid = (byte*)oid; + newOids->entries[newOids->len].oid = (byte *)oid; newOids->entries[newOids->len].len = len; newOids->len++; @@ -532,24 +541,25 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME* newOids, XFILE fp) (void)newOids; (void)fp; return OidToDer(NULL, NULL); -#endif +#endif /* NO_WC_ENCODE_OBJECT_ID */ } /* Callback that wolfSSL uses to assign byte oids to names */ -static WOLFCLU_OID_TO_NAME AdditionalOidNames = {0}; -static const char* OidToNameCallback (unsigned char* oid, word32 len) +static WOLFCLU_OID_TO_NAME asn1parse_AdditionalOidNames = { 0 }; +static const char *OidToNameCallback(unsigned char *oid, word32 len) { word32 i; - for (i = 0; i < AdditionalOidNames.len; i++){ - if ((len == AdditionalOidNames.entries[i].len) && - (XMEMCMP(oid, AdditionalOidNames.entries[i].oid, len) == 0)) { - return AdditionalOidNames.entries[i].name; + for (i = 0; i < asn1parse_AdditionalOidNames.len; i++) { + if ((len == asn1parse_AdditionalOidNames.entries[i].len) && + (XMEMCMP(oid, asn1parse_AdditionalOidNames.entries[i].oid, len) == + 0)) { + return asn1parse_AdditionalOidNames.entries[i].name; } } - for (i = 0; i < oid_names_len; i++){ + for (i = 0; i < oid_names_len; i++) { if ((len == oid_name_table[i].len) && - (XMEMCMP(oid, oid_name_table[i].oid, len) == 0)) { + (XMEMCMP(oid, oid_name_table[i].oid, len) == 0)) { return oid_name_table[i].name; } } @@ -558,8 +568,8 @@ static const char* OidToNameCallback (unsigned char* oid, word32 len) } /* Decode the input data from base64 based on file type */ -static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS* po, - byte** inputFileBuffer, word32* inputFileLen) +static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS *po, + byte **inputFileBuffer, word32 *inputFileLen) { int ret = WOLFCLU_SUCCESS; word32 i = 0; @@ -568,22 +578,22 @@ static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS* po, if (po == NULL) return WOLFCLU_FATAL_ERROR; - switch (po->inForm){ + switch (po->inForm) { case WOLFCLU_ASN1_PEM: /* Find start and end of PEM Base64 data. */ ret = FindPem(*inputFileBuffer, j, *inputFileLen, &i, &j); /* Decode data between header and footer. */ if ((ret == WOLFCLU_SUCCESS) && - (Base64_Decode((*inputFileBuffer) + i, j - i, - *inputFileBuffer, inputFileLen) != 0)) { + (Base64_Decode((*inputFileBuffer) + i, j - i, *inputFileBuffer, + inputFileLen) != 0)) { wolfCLU_LogError("PEM input is not base64 encoded"); ret = WOLFCLU_FATAL_ERROR; } break; case WOLFCLU_ASN1_B64: - if (Base64_Decode(*inputFileBuffer, *inputFileLen, - *inputFileBuffer, inputFileLen) != 0) { + if (Base64_Decode(*inputFileBuffer, *inputFileLen, *inputFileBuffer, + inputFileLen) != 0) { wolfCLU_LogError("input is not base64 encoded"); ret = WOLFCLU_FATAL_ERROR; } @@ -602,35 +612,38 @@ static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS* po, return ret; } - -#endif - +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ /* Performs the ASN.1 operation described by parseOptions: decodes the input * (DER, base64 or PEM), applies the offset/length/string-parse selections, and * writes the formatted structure to the configured output target(s). * Returns WOLFCLU_SUCCESS on success. */ -int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* po) +int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) { #if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) int ret = WOLFCLU_SUCCESS; - byte* inputFileBuffer = NULL; + byte *inputFileBuffer = NULL; word32 inputFileLen = 0; - po->nameCb = OidToNameCallback; - Asn1 asn1Master = {0}; + Asn1 asn1Master = { 0 }; + + if (po == NULL) + return USER_INPUT_ERROR; if (po->oidFile != NULL) { - ret = WOLFCLU_OID_TO_NAME_initWFile(&AdditionalOidNames, po->oidFile); + ret = WOLFCLU_OID_TO_NAME_initWFile(&asn1parse_AdditionalOidNames, + po->oidFile); } + po->nameCb = OidToNameCallback; + if (ret == WOLFCLU_SUCCESS && po->noOut && po->outputFile == NULL) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("No output file given and -noout set"); } if (ret == WOLFCLU_SUCCESS) { - ret = wc_Asn1_Init(&asn1Master) == 0 ? - WOLFCLU_SUCCESS : WOLFCLU_FATAL_ERROR; + ret = wc_Asn1_Init(&asn1Master) == 0 ? WOLFCLU_SUCCESS + : WOLFCLU_FATAL_ERROR; } if (ret == WOLFCLU_SUCCESS) { @@ -640,8 +653,8 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* po) } if (ret == WOLFCLU_SUCCESS) { - if (asn1_ReadFile(po->inputFile, &inputFileBuffer, - &inputFileLen) < 0){ + if (asn1_ReadFile(po->inputFile, &inputFileBuffer, &inputFileLen) < + 0) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("Could not open input file"); } @@ -659,7 +672,7 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* po) if (inputFileBuffer != NULL) { XFREE(inputFileBuffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); } - WOLFCLU_OID_TO_NAME_free(&AdditionalOidNames); + WOLFCLU_OID_TO_NAME_free(&asn1parse_AdditionalOidNames); return ret; #else #if !defined(WOLFSSL_ASN_PRINT) @@ -669,6 +682,5 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS* po) wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot Parse Asn1."); #endif return WOLFCLU_FATAL_ERROR; -#endif +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ } - diff --git a/src/asn1/clu_asn1_setup.c b/src/asn1/clu_asn1_setup.c index 5851fb00..0f9399ab 100644 --- a/src/asn1/clu_asn1_setup.c +++ b/src/asn1/clu_asn1_setup.c @@ -84,7 +84,7 @@ static void wolfCLU_Asn1Help(void) WOLFCLU_LOG(WOLFCLU_L0, "\n Pluses indicate primitive types"); WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 + 7 (0) ┌INTEGER"); WOLFCLU_LOG(WOLFCLU_L0, "\nOid File:\n"); - WOLFCLU_LOG(WOLFCLU_L0, " Pass in a file to -oid in this format:") + WOLFCLU_LOG(WOLFCLU_L0, " Pass in a file to -oid in this format:"); WOLFCLU_LOG(WOLFCLU_L0, " 1.2.3.4 shortName Long name with " "spaces"); WOLFCLU_LOG(WOLFCLU_L0, " 5.6.7.8 shortName2 spaces with " @@ -108,7 +108,7 @@ static int Asn1ParseOptions_clean_up(WOLFCLU_ASN1_PARSE_OPTIONS *opt) XFCLOSE(opt->outputFile); } - *opt = (WOLFCLU_ASN1_PARSE_OPTIONS){ 0 }; + wc_ForceZero(opt, sizeof(WOLFCLU_ASN1_PARSE_OPTIONS)); return WOLFCLU_SUCCESS; } @@ -119,14 +119,14 @@ static int checkFileArg(const char *file, const char *flag, const char *mode, { int ret = WOLFCLU_FATAL_ERROR; + if (*file_out != NULL) { + wolfCLU_LogError("File for %s was already opened", flag); + return WOLFCLU_FATAL_ERROR; + } + if (file != NULL) { XFILE f = XFOPEN(file, mode); if (f != NULL) { - if (*file_out != NULL) { - wolfCLU_LogError("File for %s was already opened", flag); - XFCLOSE(f); - return WOLFCLU_FATAL_ERROR; - } *file_out = f; ret = WOLFCLU_SUCCESS; } @@ -182,8 +182,8 @@ static int checkStrParse(const char *arg, word32 *outSz, const word32 cap, } else { out[(*outSz)++] = val; + token = XSTRTOK(NULL, ",", &end); } - token = XSTRTOK(NULL, ",", &end); } XFREE(tmp, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); @@ -247,6 +247,7 @@ int wolfCLU_Asn1Setup(int argc, char *argv[]) int ret = WOLFCLU_SUCCESS; int option; int longIndex = 1; + /* reduce stack size */ static WOLFCLU_ASN1_PARSE_OPTIONS asn1Config = { 0 }; opterr = 0; @@ -315,6 +316,7 @@ int wolfCLU_Asn1Setup(int argc, char *argv[]) case ARG_FOUND_TWICE: ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Arg found twice for asn1parse"); break; case '?': diff --git a/src/x509/clu_config.c b/src/x509/clu_config.c index 14cb2590..0a1990dc 100644 --- a/src/x509/clu_config.c +++ b/src/x509/clu_config.c @@ -24,7 +24,6 @@ #include #include #include -#include #include #ifndef WOLFCLU_NO_FILESYSTEM diff --git a/tests/asn1/asn1-test.py b/tests/asn1/asn1-test.py index ee50fb1b..f7734aed 100644 --- a/tests/asn1/asn1-test.py +++ b/tests/asn1/asn1-test.py @@ -32,7 +32,7 @@ def oid_encoding_supported(): """True when the build can DER-encode the OIDs from an -oid file. -oid relies on wc_EncodeObjectId, which is compiled out via - NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.1 (set in configure.ac). + NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.2 (set in configure.ac). In that build -oid reports a fatal error instead of encoding anything. The flag is a -D in AM_CFLAGS rather than a config.h define, so it cannot be read via config_defines(); probe the binary directly instead. A @@ -89,7 +89,6 @@ def test_base64(self): def test_out_arg_is_DER(self): """The -out file is the processed DER that was input""" out_file = "test-asn1.out" - open(out_file, "w").close() self.addCleanup(lambda: os.remove(out_file) if os.path.exists(out_file) else None) result = run_wolfssl("asn1parse", "-inform", "DER", "-noout", "-in", self.der, @@ -97,7 +96,7 @@ def test_out_arg_is_DER(self): self.assertEqual(result.returncode, 0, result.stderr) with open(out_file, "rb") as out: with open(self.der, "rb") as infile: - self.assertEqual(str(out.read()), str(infile.read())) + self.assertEqual(out.read(), infile.read()) def test_out_arg(self): """The -out flag (output file must exist) runs without error.""" @@ -270,7 +269,7 @@ def test_oid_multibyte_first_subidentifier(self): self.assertIn("MyArc2Oid", result.stdout) @unittest.skipUnless("HAVE_OID_TABLE" in config_defines(), - "built with --enable-oid-table") + "built without --enable-oid-table") def test_builtin_oid_table(self): """The built-in OID table resolves an OID with no -oid file supplied. @@ -358,18 +357,18 @@ def test_strparse_non_octet_string(self): self.assertNotEqual(result.returncode, 0) def test_input_file_too_large(self): - """A file larger than the 0xFFFFFFFEU byte max is rejected up front. + """A file larger than the 0x7FFFFFFEU byte max is rejected up front. - asn1_ReadFile caps the input at 0xFFFFFFFEU bytes so that the +1 for the + asn1_ReadFile caps the input at 0x7FFFFFFEU bytes so that the +1 for the null terminator still fits in a word32. A file one byte over that limit - (0xFFFFFFFFU) must be refused before any ~4GB buffer is allocated or + (0x7FFFFFFFU) must be refused before any ~2GB buffer is allocated or read, so the check has to fire on file size alone. The file is created sparse (no real disk use) via truncate; skip if the platform/filesystem cannot represent a file that large. """ big_file = "test-asn1-toobig.der" - # 0xFFFFFFF == one byte past the 0xFFFFFFEU maximum accepted length. - size = 0xFFFFFFF + # 0x7FFFFFFF == one byte past the 0x7FFFFFFEU maximum accepted length. + size = 0x7FFFFFFF try: with open(big_file, "wb") as f: truncate_sparse(f, size) diff --git a/tests/asn1/include.am b/tests/asn1/include.am index 159599e6..0ae02d44 100644 --- a/tests/asn1/include.am +++ b/tests/asn1/include.am @@ -1,6 +1,6 @@ # vim:ft=automake # included from top level Makefile.am -# ALl path should be given relative to root directory +# All path should be given relative to root directory dist_noinst_SCRIPTS+=tests/asn1/asn1-test.py diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index f19be35b..5e262b1b 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -182,7 +182,7 @@ def truncate_sparse(fileobj, size): def config_defines(): - """Return the set of macros defined in the generated wolfclu/config.h. + """Return the set of macros defined in the generated src/config.h. Some features are compile-time options (e.g. --enable-oid-table sets HAVE_OID_TABLE) with no runtime flag to query, so tests that exercise @@ -195,7 +195,7 @@ def config_defines(): defined = set() builddir = os.environ.get("WOLFCLU_BUILDDIR") or os.getcwd() for base in (builddir, _PROJECT_ROOT): - path = os.path.join(base, "wolfclu", "config.h") + path = os.path.join(base, "src", "config.h") if not os.path.isfile(path): continue with open(path) as f: From 3b7d366a4caf36231983294325df86b7e1b58b37 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Wed, 29 Jul 2026 14:52:18 -0600 Subject: [PATCH 3/8] Github review and invert of oid table --- .github/workflows/ci.yml | 22 ++++++++++++++++++++-- .gitignore | 2 -- configure.ac | 9 +++++---- manpages/wolfssl-asn1parse.1 | 4 ++-- src/asn1/clu_asn1_parse.c | 10 +++++----- src/asn1/clu_asn1_setup.c | 20 ++++++++++---------- tests/asn1/asn1-test.py | 4 ++-- tests/wolfclu_test.py | 5 +++-- wolfclu/asn1/clu_oid_name_table.h | 20 ++++++++++++++++++++ 9 files changed, 67 insertions(+), 29 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52deb0c8..abfaa40c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,6 +24,13 @@ jobs: - '--enable-all' sanitize: ['CC="cc -fsanitize=address" CFLAGS="-g"'] + # Single-valued on purpose: --disable-oid-table only affects wolfCLU's + # own compilation, so sweeping it across every wolfSSL config would + # rebuild wolfSSL 12 extra times to test the same code. It gets one + # dedicated job via include below. Keeping the key here (rather than + # omitting it) means that include entry overwrites an original matrix + # value, so it adds a job instead of mutating an existing one. + wolfCLUOpts: [''] include: - os: ubuntu-latest @@ -33,7 +40,17 @@ jobs: config: '--enable-wolfclu' sanitize: '' - name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }}) + - os: ubuntu-latest + config: '--enable-wolfclu' + sanitize: 'CC="cc -fsanitize=address"' + wolfCLUOpts: '--disable-oid-table' + + - os: macos-latest + config: '--enable-wolfclu' + sanitize: 'CC="cc -fsanitize=address"' + wolfCLUOpts: '--disable-oid-table' + + name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})${{ matrix.wolfCLUOpts && format(' [{0}]', matrix.wolfCLUOpts) || '' }} runs-on: ${{ matrix.os }} timeout-minutes: 10 @@ -75,7 +92,8 @@ jobs: working-directory: ./wolfclu run: | ./autogen.sh - ./configure ${{ matrix.sanitize }} --with-wolfssl=$GITHUB_WORKSPACE/build-dir + ./configure ${{ matrix.wolfCLUOpts }} ${{ matrix.sanitize }} \ + --with-wolfssl=$GITHUB_WORKSPACE/build-dir make -j - name: Run tests diff --git a/.gitignore b/.gitignore index 747bf182..5040a030 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,5 @@ -clu_src/stamp* libtool wolfssl_clu-config -clu_src/config.h Makefile Makefile.in aclocal.m4 diff --git a/configure.ac b/configure.ac index 90e968b5..a7eb5c9b 100644 --- a/configure.ac +++ b/configure.ac @@ -96,16 +96,17 @@ AC_ARG_ENABLE([manpages], AM_CONDITIONAL([ENABLE_MANPAGES], [test "x$ENABLED_MANPAGES" != "xno"]) # OID Name Table Build -ENABLED_OIDTABLE_DEFAULT=no +ENABLED_OIDTABLE_DEFAULT=yes AC_ARG_ENABLE([oid-table], - [AS_HELP_STRING([--enable-oid-table],[Enable OID-to-name lookup table (default: disabled)])], + [AS_HELP_STRING([--disable-oid-table],[Disable OID-to-name lookup table (default: enabled)])], [ ENABLED_OIDTABLE=$enableval ], [ ENABLED_OIDTABLE=$ENABLED_OIDTABLE_DEFAULT ] ) -if test "$ENABLED_OIDTABLE" = "yes" +if test "x$ENABLED_OIDTABLE" != "xno" then - AM_CFLAGS="$AM_CFLAGS -DHAVE_OID_TABLE" + AC_DEFINE([HAVE_OID_TABLE], [1], + [Enable OID-to-name lookup table]) fi diff --git a/manpages/wolfssl-asn1parse.1 b/manpages/wolfssl-asn1parse.1 index ce7f0e94..46eacdb0 100644 --- a/manpages/wolfssl-asn1parse.1 +++ b/manpages/wolfssl-asn1parse.1 @@ -17,9 +17,9 @@ Input may be read in DER, PEM, or Base64 form. .br format: . .br - To use the built in OID table, configure wolfCLU with + The built in OID table is used unless wolfCLU was .br - --enable-oid-table. + configured with --disable-oid-table. .SH I/O OPTIONS -in file input file to read the ASN.1 structure from. .br diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c index e1220ddd..e7ec3019 100644 --- a/src/asn1/clu_asn1_parse.c +++ b/src/asn1/clu_asn1_parse.c @@ -33,7 +33,7 @@ #include #include -#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) +#if defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) static int Asn1Print(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts) { @@ -612,7 +612,7 @@ static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS *po, return ret; } -#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ /* Performs the ASN.1 operation described by parseOptions: decodes the input * (DER, base64 or PEM), applies the offset/length/string-parse selections, and @@ -620,7 +620,7 @@ static int HandleProcessing(const WOLFCLU_ASN1_PARSE_OPTIONS *po, * Returns WOLFCLU_SUCCESS on success. */ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) { -#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) +#if defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) int ret = WOLFCLU_SUCCESS; byte *inputFileBuffer = NULL; word32 inputFileLen = 0; @@ -678,9 +678,9 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) #if !defined(WOLFSSL_ASN_PRINT) wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot Parse Asn1."); #endif -#if defined(NO_FILESYSTEM) +#if defined(WOLFCLU_NO_FILESYSTEM) wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot Parse Asn1."); #endif return WOLFCLU_FATAL_ERROR; -#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ } diff --git a/src/asn1/clu_asn1_setup.c b/src/asn1/clu_asn1_setup.c index 0f9399ab..4d6e3eeb 100644 --- a/src/asn1/clu_asn1_setup.c +++ b/src/asn1/clu_asn1_setup.c @@ -27,7 +27,7 @@ #include -#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) +#if defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) static const struct option asn1_options[] = { { "-oid", required_argument, 0, WOLFCLU_OID }, @@ -51,9 +51,9 @@ static void wolfCLU_Asn1Help(void) WOLFCLU_LOG(WOLFCLU_L0, "\t-help Display this text"); WOLFCLU_LOG(WOLFCLU_L0, "\t-oid File of extra oid " "definitions"); - wolfCLU_Log(WOLFCLU_L0, "\t To use built in Oid Table " - "configure with:"); - wolfCLU_Log(WOLFCLU_L0, "\t --enable-oid-table"); + wolfCLU_Log(WOLFCLU_L0, "\t The built in Oid Table is " + "on unless configured"); + wolfCLU_Log(WOLFCLU_L0, "\t with: --disable-oid-table"); WOLFCLU_LOG(WOLFCLU_L0, "\nI/O Options:"); WOLFCLU_LOG(WOLFCLU_L0, "\t-inform Input file format " @@ -238,12 +238,12 @@ static int checkInForm(char *inform, word8 *inform_id_out) } return ret; } -#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ /* return WOLFCLU_SUCCESS on success */ int wolfCLU_Asn1Setup(int argc, char *argv[]) { -#if defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) +#if defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) int ret = WOLFCLU_SUCCESS; int option; int longIndex = 1; @@ -338,9 +338,9 @@ int wolfCLU_Asn1Setup(int argc, char *argv[]) #if !defined(WOLFSSL_ASN_PRINT) wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot parse Asn1."); #endif /* !defined(WOLFSSL_ASN_PRINT) */ -#if defined(NO_FILESYSTEM) - wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot parse Asn1."); -#endif /* defined(NO_FILESYSTEM) */ +#if defined(WOLFCLU_NO_FILESYSTEM) + wolfCLU_LogError("WOLFCLU_NO_FILESYSTEM option is set. Cannot parse Asn1."); +#endif /* defined(WOLFCLU_NO_FILESYSTEM) */ return WOLFCLU_FATAL_ERROR; -#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(NO_FILESYSTEM) */ +#endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ } diff --git a/tests/asn1/asn1-test.py b/tests/asn1/asn1-test.py index f7734aed..9c289baa 100644 --- a/tests/asn1/asn1-test.py +++ b/tests/asn1/asn1-test.py @@ -269,12 +269,12 @@ def test_oid_multibyte_first_subidentifier(self): self.assertIn("MyArc2Oid", result.stdout) @unittest.skipUnless("HAVE_OID_TABLE" in config_defines(), - "built without --enable-oid-table") + "built with --disable-oid-table") def test_builtin_oid_table(self): """The built-in OID table resolves an OID with no -oid file supplied. Exercises the second loop in OidToNameCallback (the static - oid_name_table), which is only compiled with --enable-oid-table. + oid_name_table), which is not compiled with --disable-oid-table. 2.16.840.1.114171.500.9 ("Wells Fargo EV policy") is in the table but not otherwise known to wolfSSL, so the callback is consulted and the table name must be printed without any -oid mapping. diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index 5e262b1b..9dbf5794 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -184,8 +184,9 @@ def truncate_sparse(fileobj, size): def config_defines(): """Return the set of macros defined in the generated src/config.h. - Some features are compile-time options (e.g. --enable-oid-table sets - HAVE_OID_TABLE) with no runtime flag to query, so tests that exercise + Some features are compile-time options (e.g. the OID name table sets + HAVE_OID_TABLE unless --disable-oid-table) with no runtime flag to + query, so tests that exercise those paths need to read the build configuration. config.h lives in the build directory, which differs from the source tree under distcheck; honour WOLFCLU_BUILDDIR, then fall back to the current working directory diff --git a/wolfclu/asn1/clu_oid_name_table.h b/wolfclu/asn1/clu_oid_name_table.h index dbaa6417..a61f6bbc 100644 --- a/wolfclu/asn1/clu_oid_name_table.h +++ b/wolfclu/asn1/clu_oid_name_table.h @@ -1,3 +1,23 @@ +/* clu_oid_name_table.h + * + * Copyright (C) 2006-2025 wolfSSL Inc. + * + * This file is part of wolfSSL. + * + * wolfSSL is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfSSL is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA + */ + #ifndef CLU_OID_NAME_TABLE_H #define CLU_OID_NAME_TABLE_H From 1f88858008c85a23a22511702b278529265912b8 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Wed, 29 Jul 2026 17:01:27 -0600 Subject: [PATCH 4/8] runtime check for oid table --- tests/asn1/asn1-test.py | 11 ++++----- tests/wolfclu_test.py | 55 +++++++++++++++++++++-------------------- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/tests/asn1/asn1-test.py b/tests/asn1/asn1-test.py index 9c289baa..7ffd8a96 100644 --- a/tests/asn1/asn1-test.py +++ b/tests/asn1/asn1-test.py @@ -10,7 +10,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..")) from wolfclu_test import ( CERTS_DIR, - config_defines, + have_oid_table, run_wolfssl, test_main, truncate_sparse, @@ -34,10 +34,9 @@ def oid_encoding_supported(): -oid relies on wc_EncodeObjectId, which is compiled out via NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.2 (set in configure.ac). In that build -oid reports a fatal error instead of encoding anything. - The flag is a -D in AM_CFLAGS rather than a config.h define, so it cannot - be read via config_defines(); probe the binary directly instead. A - nonexistent file is enough: the disabled path errors during argument - handling before the file is ever opened. + The flag is a -D in AM_CFLAGS, so probe the binary for the behaviour + instead. A nonexistent file is enough: the disabled path errors during + argument handling before the file is ever opened. """ result = run_wolfssl("asn1parse", "-oid", "asn1-oid-probe.nonexistent") return _NO_OID_ENCODE_MSG not in (result.stdout + result.stderr) @@ -268,7 +267,7 @@ def test_oid_multibyte_first_subidentifier(self): self.assertEqual(result.returncode, 0, result.stderr) self.assertIn("MyArc2Oid", result.stdout) - @unittest.skipUnless("HAVE_OID_TABLE" in config_defines(), + @unittest.skipUnless(have_oid_table(), "built with --disable-oid-table") def test_builtin_oid_table(self): """The built-in OID table resolves an OID with no -oid file supplied. diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index 9dbf5794..a3590574 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -4,6 +4,7 @@ import platform import subprocess import sys +import tempfile import unittest import socket @@ -88,6 +89,33 @@ def run_wolfssl(*args, stdin_data=None, timeout=60): return subprocess.run(cmd, **kwargs) +# A bare OBJECT IDENTIFIER (06 05 02 82 06 01 0a == 0.2.262.1.10) used to probe +# for the built-in OID table. The OID is the first entry of oid_name_table in +# wolfclu/asn1/clu_oid_name_table.h and is not one wolfSSL knows internally, so +# the table's name for it is printed only when the table is compiled in. +_OID_TABLE_PROBE_DER = bytes([0x06, 0x05, 0x02, 0x82, 0x06, 0x01, 0x0a]) +_OID_TABLE_PROBE_NAME = "Telesec" + + +def have_oid_table(): + """True when the build includes the built-in OID-to-name table. + + The table is a compile-time option (HAVE_OID_TABLE, compiled out by + --disable-oid-table) with no runtime flag to query, so probe the binary + for the behaviour itself: asn1parse a lone OBJECT IDENTIFIER that the + table names and check whether that name is printed. Without the table the + OID prints in dotted-decimal form instead. Uses a different table entry + than the OID-table tests assert on, so those tests still fail rather than + silently skip if the table stops resolving. + """ + with tempfile.TemporaryDirectory() as tmpdir: + der = os.path.join(tmpdir, "oid-table-probe.der") + with open(der, "wb") as f: + f.write(_OID_TABLE_PROBE_DER) + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der) + return _OID_TABLE_PROBE_NAME in result.stdout + + def is_fips(): """True when linked against a FIPS wolfSSL build (per `wolfssl -v`).""" r = run_wolfssl("-v") @@ -181,33 +209,6 @@ def truncate_sparse(fileobj, size): raise ctypes.WinError() -def config_defines(): - """Return the set of macros defined in the generated src/config.h. - - Some features are compile-time options (e.g. the OID name table sets - HAVE_OID_TABLE unless --disable-oid-table) with no runtime flag to - query, so tests that exercise - those paths need to read the build configuration. config.h lives in the - build directory, which differs from the source tree under distcheck; - honour WOLFCLU_BUILDDIR, then fall back to the current working directory - and the source tree. Disabled options appear as `/* #undef NAME */`, - which this deliberately does not count as defined. - """ - defined = set() - builddir = os.environ.get("WOLFCLU_BUILDDIR") or os.getcwd() - for base in (builddir, _PROJECT_ROOT): - path = os.path.join(base, "src", "config.h") - if not os.path.isfile(path): - continue - with open(path) as f: - for line in f: - parts = line.split() - if len(parts) >= 2 and parts[0] == "#define": - defined.add(parts[1]) - break - return defined - - def test_main(): """Run tests with automake-compatible exit codes. From fe986c2acc46c3f09e6b9c40302a384a733895e5 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Thu, 30 Jul 2026 09:56:32 -0600 Subject: [PATCH 5/8] Define change and new compile-time oid table check --- ide/winvs/user_settings.h | 2 ++ manpages/wolfssl-asn1parse.1 | 7 +++--- src/asn1/clu_asn1_parse.c | 2 +- tests/wolfclu_test.py | 37 +++++++++++++------------------ wolfclu/asn1/clu_asn1.h | 2 +- wolfclu/asn1/clu_oid_name_table.h | 4 ++-- 6 files changed, 26 insertions(+), 28 deletions(-) diff --git a/ide/winvs/user_settings.h b/ide/winvs/user_settings.h index 2e315b33..2bd0f21a 100644 --- a/ide/winvs/user_settings.h +++ b/ide/winvs/user_settings.h @@ -57,4 +57,6 @@ #define HAVE_OCSP #define HAVE_OCSP_RESPONDER +#define HAVE_OID_TABLE + #endif /* _WIN_USER_SETTINGS_H_ */ diff --git a/manpages/wolfssl-asn1parse.1 b/manpages/wolfssl-asn1parse.1 index 46eacdb0..8e612fc0 100644 --- a/manpages/wolfssl-asn1parse.1 +++ b/manpages/wolfssl-asn1parse.1 @@ -72,9 +72,10 @@ wolfssl asn1parse -in cert.pem -inform PEM -dump .SH SEE ALSO .BR wolfssl-x509(1) ", " wolfssl-req(1) .SH NOTES -Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and without -NO_FILESYSTEM. The -oid option additionally requires object id encoding -support (NO_WC_ENCODE_OBJECT_ID must not be defined). +Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and wolfCLU is +built with filesystem support (not WOLFCLU_NO_FILESYSTEM). The -oid option +additionally requires object id encoding support (NO_WC_ENCODE_OBJECT_ID +must not be defined). .SH BUGS No known bugs at this time. .SH AUTHOR diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c index e7ec3019..63a50acd 100644 --- a/src/asn1/clu_asn1_parse.c +++ b/src/asn1/clu_asn1_parse.c @@ -679,7 +679,7 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot Parse Asn1."); #endif #if defined(WOLFCLU_NO_FILESYSTEM) - wolfCLU_LogError("NO_FILESYSTEM option is set. Cannot Parse Asn1."); + wolfCLU_LogError("WOLFCLU_NO_FILESYSTEM option is set. Cannot Parse Asn1."); #endif return WOLFCLU_FATAL_ERROR; #endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index a3590574..c075b68e 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -89,31 +89,26 @@ def run_wolfssl(*args, stdin_data=None, timeout=60): return subprocess.run(cmd, **kwargs) -# A bare OBJECT IDENTIFIER (06 05 02 82 06 01 0a == 0.2.262.1.10) used to probe -# for the built-in OID table. The OID is the first entry of oid_name_table in -# wolfclu/asn1/clu_oid_name_table.h and is not one wolfSSL knows internally, so -# the table's name for it is printed only when the table is compiled in. -_OID_TABLE_PROBE_DER = bytes([0x06, 0x05, 0x02, 0x82, 0x06, 0x01, 0x0a]) -_OID_TABLE_PROBE_NAME = "Telesec" - def have_oid_table(): """True when the build includes the built-in OID-to-name table. - - The table is a compile-time option (HAVE_OID_TABLE, compiled out by - --disable-oid-table) with no runtime flag to query, so probe the binary - for the behaviour itself: asn1parse a lone OBJECT IDENTIFIER that the - table names and check whether that name is printed. Without the table the - OID prints in dotted-decimal form instead. Uses a different table entry - than the OID-table tests assert on, so those tests still fail rather than - silently skip if the table stops resolving. """ - with tempfile.TemporaryDirectory() as tmpdir: - der = os.path.join(tmpdir, "oid-table-probe.der") - with open(der, "wb") as f: - f.write(_OID_TABLE_PROBE_DER) - result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der) - return _OID_TABLE_PROBE_NAME in result.stdout + # The string you want to look for + table_entry = "Security Communication (SECOM) EV policy" + + # Convert the text string into bytes (usually UTF-8 or ASCII) + table_entry_bytes = table_entry.encode('utf-8') + + with open(WOLFSSL_BIN, 'rb') as file: + file_content = file.read() + + # Find the starting byte position + position = file_content.find(table_entry_bytes) + + if position != -1: + return 1 + else: + return 0 def is_fips(): diff --git a/wolfclu/asn1/clu_asn1.h b/wolfclu/asn1/clu_asn1.h index bd7d56e4..0a2076a2 100644 --- a/wolfclu/asn1/clu_asn1.h +++ b/wolfclu/asn1/clu_asn1.h @@ -38,7 +38,7 @@ #endif typedef struct WOLFCLU_ASN1_PARSE_OPTIONS -#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT) +#if !defined(WOLFCLU_NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT) { XFILE inputFile; XFILE outputFile; diff --git a/wolfclu/asn1/clu_oid_name_table.h b/wolfclu/asn1/clu_oid_name_table.h index a61f6bbc..57b33a93 100644 --- a/wolfclu/asn1/clu_oid_name_table.h +++ b/wolfclu/asn1/clu_oid_name_table.h @@ -41,7 +41,7 @@ typedef struct WOLFCLU_OID_TO_NAME{ word32 cap; }WOLFCLU_OID_TO_NAME; -#if defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) && \ +#if defined(HAVE_OID_TABLE) && !defined(WOLFCLU_NO_FILESYSTEM) && \ defined(WOLFSSL_ASN_PRINT) /* taken from examples/asn1/oid_names.h in wolfssl */ static const OidName oid_name_table[] = { @@ -5589,7 +5589,7 @@ static const word32 oid_names_len = static const OidName oid_name_table[1] = {0}; static const word32 oid_names_len = 0; -#endif /* defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) && +#endif /* defined(HAVE_OID_TABLE) && !defined(WOLFCLU_NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT) */ #endif /* CLU_OID_NAME_TABLE_H */ From 9cd0aab0279c71850ea607fa8242c3720255c8e3 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Wed, 5 Aug 2026 13:56:30 -0600 Subject: [PATCH 6/8] new runtime check for OID table --- tests/wolfclu_test.py | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-) diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index c075b68e..59cdf7f3 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -4,7 +4,6 @@ import platform import subprocess import sys -import tempfile import unittest import socket @@ -89,26 +88,15 @@ def run_wolfssl(*args, stdin_data=None, timeout=60): return subprocess.run(cmd, **kwargs) - def have_oid_table(): """True when the build includes the built-in OID-to-name table. - """ - # The string you want to look for - table_entry = "Security Communication (SECOM) EV policy" - - # Convert the text string into bytes (usually UTF-8 or ASCII) - table_entry_bytes = table_entry.encode('utf-8') - with open(WOLFSSL_BIN, 'rb') as file: - file_content = file.read() - - # Find the starting byte position - position = file_content.find(table_entry_bytes) - - if position != -1: - return 1 - else: - return 0 + HAVE_OID_TABLE is compile-time only (--disable-oid-table) with no runtime + flag to query, so search the binary for a name only the table supplies. + """ + oid_table_probe_name = b"Security Communication (SECOM) EV policy" + with open(WOLFSSL_BIN, "rb") as f: + return oid_table_probe_name in f.read() def is_fips(): From a1326549c8fea4b4d285ddcb3a7e63a0e06de659 Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Mon, 5 Oct 2026 10:40:01 -0600 Subject: [PATCH 7/8] rewrote to align with new wolfSSL --- src/asn1/clu_asn1_parse.c | 2 +- wolfclu/asn1/clu_asn1.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c index 63a50acd..2647bf9b 100644 --- a/src/asn1/clu_asn1_parse.c +++ b/src/asn1/clu_asn1_parse.c @@ -426,7 +426,7 @@ static int OidToDer(char *oid, word32 *oidSz) if (ret == WOLFCLU_SUCCESS) { /* oid is overwritten by and replaces with DER encoding */ XMEMSET(oid, '\0', *oidSz); - if ((err = wc_EncodeObjectId(arc, idx, (byte *)oid, oidSz)) != 0) { + if ((err = wc_EncodeObjectId32(arc, idx, (byte *)oid, oidSz)) != 0) { wolfCLU_LogError("%s", wc_GetErrorString(err)); ret = WOLFCLU_FATAL_ERROR; } diff --git a/wolfclu/asn1/clu_asn1.h b/wolfclu/asn1/clu_asn1.h index 0a2076a2..f41016cb 100644 --- a/wolfclu/asn1/clu_asn1.h +++ b/wolfclu/asn1/clu_asn1.h @@ -34,7 +34,7 @@ /* number of str parse "digs" allowed */ #ifndef WOLFCLU_ASN1_STR_PARSE_CAP - #define WOLFCLU_ASN1_STR_PARSE_CAP 10 + #define WOLFCLU_ASN1_STR_PARSE_CAP 30 #endif typedef struct WOLFCLU_ASN1_PARSE_OPTIONS From 89607e057c84d7a2a5edf926eeae25784494506e Mon Sep 17 00:00:00 2001 From: Aidan Keefe Date: Mon, 26 Oct 2026 14:18:48 -0600 Subject: [PATCH 8/8] Asn1 parse update Added many test to catch up to new needs! and changed behavior to be more clear and consistant with openSSL. --- .github/workflows/ci.yml | 11 +- certs/nested.der | Bin 0 -> 131 bytes configure.ac | 8 +- manpages/wolfssl-asn1parse.1 | 46 ++- manpages/wolfssl.1 | 2 +- src/asn1/clu_asn1_parse.c | 391 ++++++++++---------- src/asn1/clu_asn1_setup.c | 79 ++-- src/tools/clu_funcs.c | 89 ++++- src/x509/clu_config.c | 81 +--- tests/asn1/asn1-test.py | 595 +++++++++++++++++++++++------- tests/wolfclu_test.py | 11 + tests/x509/x509-req-test.py | 36 ++ wolfCLU.vcxproj.filters | 9 + wolfclu/asn1/clu_asn1.h | 6 +- wolfclu/asn1/clu_oid_name_table.h | 3 - wolfclu/clu_header_main.h | 37 +- 16 files changed, 934 insertions(+), 470 deletions(-) create mode 100644 certs/nested.der diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abfaa40c..55cca0b4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,14 +42,21 @@ jobs: - os: ubuntu-latest config: '--enable-wolfclu' - sanitize: 'CC="cc -fsanitize=address"' + sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"' wolfCLUOpts: '--disable-oid-table' - os: macos-latest config: '--enable-wolfclu' - sanitize: 'CC="cc -fsanitize=address"' + sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"' wolfCLUOpts: '--disable-oid-table' + # wolfSSL master exports wc_EncodeObjectId32, so force the word16 + # wc_EncodeObjectId fallback that released wolfSSL builds use. + - os: ubuntu-latest + config: '--enable-wolfclu' + sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"' + wolfCLUOpts: 'CPPFLAGS="-DTRUNCATED_ENCODE_OBJECT_ID"' + name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})${{ matrix.wolfCLUOpts && format(' [{0}]', matrix.wolfCLUOpts) || '' }} runs-on: ${{ matrix.os }} timeout-minutes: 10 diff --git a/certs/nested.der b/certs/nested.der new file mode 100644 index 0000000000000000000000000000000000000000..f9c1fc04905cd55399ae0679c8cf91a2401d92c3 GIT binary patch literal 131 zcmXqLY+zz!6c)}&tV}IZFjUZ0$S*BPEy~R=E@4h%Fi2)%WD@3uNS2i6E94~Qu=pGJ zGBGj>Gx-=ZyD%6yGBL8iRG28_BqpWiu;?0SGcmIANN48dL5xx;NUY4sPfP(C4>8M> PjZ>@5qwPB{BO@aKq&Xri literal 0 HcmV?d00001 diff --git a/configure.ac b/configure.ac index a7eb5c9b..ce457406 100644 --- a/configure.ac +++ b/configure.ac @@ -105,8 +105,7 @@ AC_ARG_ENABLE([oid-table], if test "x$ENABLED_OIDTABLE" != "xno" then - AC_DEFINE([HAVE_OID_TABLE], [1], - [Enable OID-to-name lookup table]) + AM_CFLAGS="$AM_CFLAGS -DHAVE_OID_TABLE" fi @@ -158,6 +157,11 @@ AC_CHECK_FUNC([wolfSSL_X509_REQ_print], AC_CHECK_FUNC([wc_EncodeObjectId], [], [AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"]) +# wolfSSL releases only have the word16 wc_EncodeObjectId, which truncates +# OID arcs above 65535; wc_EncodeObjectId32 encodes the full word32 arc +AC_CHECK_FUNC([wc_EncodeObjectId32], + [], + [AM_CFLAGS="$AM_CFLAGS -DTRUNCATED_ENCODE_OBJECT_ID"]) ############################################### # # diff --git a/manpages/wolfssl-asn1parse.1 b/manpages/wolfssl-asn1parse.1 index 8e612fc0..a6b001b7 100644 --- a/manpages/wolfssl-asn1parse.1 +++ b/manpages/wolfssl-asn1parse.1 @@ -4,7 +4,7 @@ .SH NAME wolfssl-asn1parse, asn1parse \- ASN.1 parsing utility .SH SYNOPSIS -wolfssl asn1parse [-in file] [-inform DER|PEM|B64] [-out file] [-oid file] [-offset n] [-length n] [-strparse n[,n...]] [-i] [-dump] [-noout] [-help] +wolfssl asn1parse -in file [-inform DER|PEM|B64] [-out file] [-oid file] [-offset n] [-length n] [-strparse n[,n...]] [-i] [-dump] [-noout] [-help] .SH DESCRIPTION Parses an ASN.1 encoded structure (for example a certificate, key, or CRL) and prints a human readable listing of its tags, lengths, and contents. @@ -16,15 +16,27 @@ Input may be read in DER, PEM, or Base64 form. -oid file file of extra OID definitions. Each line uses the .br format: . +.br + shortName is accepted for compatibility but only the +.br + long name is printed. .br The built in OID table is used unless wolfCLU was .br configured with --disable-oid-table. +.br + Names wolfSSL already knows take precedence over both +.br + the -oid file and the built in table. .SH I/O OPTIONS -in file input file to read the ASN.1 structure from. +.br + Required. .br .LP -inform DER|PEM|B64 input file format. One of DER, PEM, or B64 (Base64). +.br + Defaults to DER. .br .LP -out file output file for the ASN.1 DER data after processing. @@ -32,23 +44,39 @@ Input may be read in DER, PEM, or Base64 form. Best used with -strparse. .br .LP --noout do not print the parsed output. +-noout do not print the parsed output. Requires -out. .br .LP --offset n offset into the file at which to begin parsing. +-offset n offset into the DER data at which to begin parsing. +.br + For PEM and B64 input this is an offset into the +.br + decoded DER, not the file. With -strparse it is an +.br + offset into the nested structure. .br .LP --length n number of bytes to parse. +-length n number of bytes of DER data to parse. A length past +.br + the end of the data is reduced to the bytes remaining. .br .LP -strparse n[,n...] offset to an OCTET/BIT STRING to parse. A comma .br separated list may be given, e.g. -strparse 702,64. +.br + -strparse is applied first, starting from the +.br + beginning of the input, and -offset and -length then +.br + select bytes within the nested result. .SH FORMATTING OPTIONS --i indent the output according to structure depth. +-i indent the output by structure depth instead of +.br + drawing branches. .br .LP --dump print unknown data in hex form. +-dump print data in hex form. .SH OUTPUT Each line is formatted as: .RS @@ -65,7 +93,7 @@ Parse a DER encoded certificate with indented output: wolfssl asn1parse -inform DER -in cert.der -i .RE .LP -Parse a PEM file and dump unknown data as hex: +Parse a PEM file and print data in hex form: .RS wolfssl asn1parse -in cert.pem -inform PEM -dump .RE @@ -74,8 +102,8 @@ wolfssl asn1parse -in cert.pem -inform PEM -dump .SH NOTES Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and wolfCLU is built with filesystem support (not WOLFCLU_NO_FILESYSTEM). The -oid option -additionally requires object id encoding support (NO_WC_ENCODE_OBJECT_ID -must not be defined). +additionally requires object id encoding support (wolfSSL built with +HAVE_OID_ENCODING, and NO_WC_ENCODE_OBJECT_ID not defined). .SH BUGS No known bugs at this time. .SH AUTHOR diff --git a/manpages/wolfssl.1 b/manpages/wolfssl.1 index dc6031f7..c97271b3 100644 --- a/manpages/wolfssl.1 +++ b/manpages/wolfssl.1 @@ -55,7 +55,7 @@ Certificates and CAs req generate certificate requests / self-signed certs verify verify an X.509 certificate chain crl parse and verify Certificate Revocation Lists - asn1parse print out a human readable print out of a given cert + asn1parse parse and print ASN.1 (DER/PEM/Base64) structures Keys genkey generate cryptographic keys diff --git a/src/asn1/clu_asn1_parse.c b/src/asn1/clu_asn1_parse.c index 2647bf9b..fa30d0ce 100644 --- a/src/asn1/clu_asn1_parse.c +++ b/src/asn1/clu_asn1_parse.c @@ -51,21 +51,23 @@ static int Asn1Print(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts) if (wc_Asn1PrintOptions_Init(&PrintOpts) != 0) return WOLFCLU_FATAL_ERROR; + /* wolfSSL only honours the indent when branch drawing is off, so -i + * swaps the default branch drawing for an indent of one space per + * depth. */ if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_INDENT, opts->indent) != 0) return WOLFCLU_FATAL_ERROR; - if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH, 1) != 0) + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH, + !opts->indent) != 0) return WOLFCLU_FATAL_ERROR; - /* this shows the hex in a readable print out and hides text data - * so there is no double reporting on BIT STRING and OCTET STRINGS */ + /* this shows the hex in a readable print out and hides only the text + * form of INTEGER, BIT STRING and OCTET STRING data so it is not reported + * twice; OID names and string values are still printed */ if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_DATA, opts->dump) != 0) return WOLFCLU_FATAL_ERROR; - if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_OID, - opts->dump) != 0) - return WOLFCLU_FATAL_ERROR; - if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_NO_TEXT, + if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_SHOW_NO_DUMP_TEXT, opts->dump) != 0) return WOLFCLU_FATAL_ERROR; @@ -81,95 +83,98 @@ static int Asn1Print(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts) return ret; } -enum { - /* Expecting tag part of ASN.1 item. */ - ASN_PART_TAG = 0, - /* Expecting length part of ASN.1 item. */ - ASN_PART_LENGTH, - /* Expecting data part of ASN.1 item. */ - ASN_PART_DATA, -}; - /* Apply the -strparse offsets in po->strParse in order. Each entry is an * absolute byte offset from the current position to an OCTET STRING or BIT * STRING whose contents are themselves ASN.1; the parser descends into that * content so the next offset (and the final print) operate on the nested - * structure. Returns WOLFCLU_SUCCESS on success or a negative error code. + * structure. Only asn1->data and asn1->max are updated, as they are all + * Asn1Print reads. Returns WOLFCLU_SUCCESS on success or a negative error + * code. */ static int StrParse(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *po) { int ret = WOLFCLU_SUCCESS; - word32 idx = 0; + word32 i; - for (; idx < po->strParseSz; idx++) { + for (i = 0; i < po->strParseSz; i++) { + const byte *data; + word32 max; + word32 idx = 0; + byte tag; int len; /* Need at least one byte (the tag) available at the jump target. */ - if (po->strParse[idx] >= asn1->max) { + if (po->strParse[i] >= asn1->max) { ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("-strparse %u with value %u " + wolfCLU_LogError("-strparse entry %u (offset %u) " "tried to jump to invalid location. " "Unable to parse", - idx, po->strParse[idx]); + i + 1, po->strParse[i]); break; } /* Advance into the buffer and shrink the remaining length to match so * later bounds checks stay accurate. */ - asn1->data = asn1->data + po->strParse[idx]; - asn1->max = asn1->max - po->strParse[idx]; - - /* Mask off the constructed bit to compare the base tag. */ - asn1->item.tag = asn1->data[asn1->curr] & (byte)~ASN_CONSTRUCTED; + data = asn1->data + po->strParse[i]; + max = asn1->max - po->strParse[i]; - if (asn1->item.tag != ASN_OCTET_STRING && - asn1->item.tag != ASN_BIT_STRING) { + /* Only primitive strings are accepted: a constructed (BER) string + * holds segments, not the nested DER directly. */ + tag = data[idx++]; + if (tag != ASN_OCTET_STRING && tag != ASN_BIT_STRING) { ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("-strparse %u with value %u " - "did not find an octet string " - "unable to parse", - idx, po->strParse[idx]); + wolfCLU_LogError("-strparse entry %u (offset %u) did not find an " + "OCTET STRING or BIT STRING. Unable to parse", + i + 1, po->strParse[i]); break; } - asn1->curr++; - - asn1->part = ASN_PART_LENGTH; - - /* Decode length and step over it. */ - if (GetLength(asn1->data, &asn1->curr, &len, asn1->max) < 0) { + /* Decode length and step over it. GetLength also fails when the + * length runs past max. */ + if (GetLength(data, &idx, &len, max) < 0) { ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse entry %u (offset %u) has an invalid " + "length encoding or its length runs past the " + "end of the buffer", + i + 1, po->strParse[i]); break; } if (len <= 0) { ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("Asn1 stucture for -strparse %u has a length of 0", - idx); + wolfCLU_LogError("-strparse entry %u (offset %u) has a length " + "of 0", i + 1, po->strParse[i]); break; } - /* The decoded length must fit within the bytes remaining after the - * tag and length octets. */ - if ((word32)len > asn1->max - asn1->curr) { + /* Defence in depth: GetLength already rejects a length that does + * not fit within the bytes remaining after the tag and length + * octets. */ + if ((word32)len > max - idx) { ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("-strparse %u decoded length runs past the end " - "of the buffer. Unable to parse", - idx); + wolfCLU_LogError("-strparse entry %u (offset %u) decoded length " + "runs past the end of the buffer. Unable to " + "parse", i + 1, po->strParse[i]); break; } - if (asn1->item.tag == ASN_BIT_STRING) { - asn1->curr++; + /* A BIT STRING only holds nested DER when its leading unused-bits + * octet is 0 and something follows it. */ + if (tag == ASN_BIT_STRING) { + if (len < 2 || data[idx] != 0) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("-strparse entry %u (offset %u) BIT STRING " + "has no nested DER (empty or non-zero unused " + "bits)", i + 1, po->strParse[i]); + break; + } + idx++; len--; } - /* reset data structure to treat the new data as a fresh object */ - asn1->data = asn1->data + (asn1->curr); - asn1->curr = 0; - asn1->depth = 0; - asn1->max = len; - asn1->part = ASN_PART_TAG; + /* treat the string contents as a fresh object */ + asn1->data = (byte *)data + idx; + asn1->max = (word32)len; } return ret; @@ -178,49 +183,52 @@ static int StrParse(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *po) /* Apply data altering options to raw input before printing * * return WOLFCLU_SUCCESS on success, - * WOLFLCU_FATAL_ERROR otherwise */ + * WOLFCLU_FATAL_ERROR otherwise */ static int Asn1Fmt(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts, byte *data, word32 dataSz) { int ret = WOLFCLU_SUCCESS; - /* Reject an offset that points past the end of the buffer. Both values - * are word32, so an out-of-range offset would make the length below - * underflow and produce a near-4GB out-of-bounds read. */ - if (opts->offset >= dataSz) { - wolfCLU_LogError("-offset %u is past the end of the input (%u bytes)", - opts->offset, dataSz); - return WOLFCLU_FATAL_ERROR; - } - /* A user supplied length must fit within the bytes remaining after the - * offset. */ - if (opts->length > 0 && opts->length > dataSz - opts->offset) { - wolfCLU_LogError("-length %u runs past the end of the input " - "(%u bytes remaining after offset)", - opts->length, dataSz - opts->offset); + /* e.g. a PEM header and footer with no body between them */ + if (dataSz == 0) { + wolfCLU_LogError("No data to parse"); return WOLFCLU_FATAL_ERROR; } - /* Store the starting point of the data to parse. */ - asn1->data = data + opts->offset; - if (opts->length > 0) { - /* Use user specified maximum length. */ - asn1->max = opts->length; + /* -strparse descends from the start of the whole input and + * -offset/-length then select bytes within the result. */ + asn1->data = data; + asn1->max = dataSz; + + if (opts->strParseSz != 0) { + ret = StrParse(asn1, opts); } - else { - /* Maximum length is up to end from offset. */ - asn1->max = dataSz - opts->offset; + + /* Reject an offset that points past the end of the buffer. Both values + * are word32, so an out-of-range offset would make the length below + * underflow and produce a near-4GB out-of-bounds read. */ + if (ret == WOLFCLU_SUCCESS && opts->offset >= asn1->max) { + wolfCLU_LogError("-offset %u is past the end of the data to parse " + "(%u bytes)", opts->offset, asn1->max); + ret = WOLFCLU_FATAL_ERROR; } - if (ret == WOLFCLU_SUCCESS && opts->strParseSz != 0) { - ret = StrParse(asn1, opts); + if (ret == WOLFCLU_SUCCESS) { + asn1->data += opts->offset; + asn1->max -= opts->offset; + /* A user supplied length that runs past the end is clamped to the + * bytes remaining. */ + if (opts->length > 0 && opts->length < asn1->max) { + asn1->max = opts->length; + } } return ret; } -/* Writes the ASN.1 DER encoding to the output file in po->outputfile, - * applying the offset/length bounds from po to data/dataSz. Prints the +/* Writes the ASN.1 DER encoding to the output file in po->outputPath, + * applying -strparse and then the offset/length bounds from po to + * data/dataSz. Prints the * tree output to stdout * * Returns WOLFCLU_SUCCESS on success. @@ -238,11 +246,22 @@ static int wolfCLU_Asn1Write(Asn1 *asn1, const WOLFCLU_ASN1_PARSE_OPTIONS *opts, /* Handle offsets, strparse, etc... */ ret = Asn1Fmt(asn1, opts, data, dataSz); - if (ret == WOLFCLU_SUCCESS && opts->outputFile != NULL) { - if (XFWRITE(asn1->data, 1, asn1->max, opts->outputFile) != asn1->max) { - wolfCLU_LogError("Unable to write to file passed by -out"); + if (ret == WOLFCLU_SUCCESS && opts->outputPath != NULL) { + /* opened here, after the input is in memory, so -out may be the + * same file as -in */ + XFILE out = XFOPEN(opts->outputPath, "wb"); + if (out == XBADFILE) { + wolfCLU_LogError("Unable to open file passed by -out : %s", + opts->outputPath); ret = WOLFCLU_FATAL_ERROR; } + else { + if (XFWRITE(asn1->data, 1, asn1->max, out) != asn1->max) { + wolfCLU_LogError("Unable to write to file passed by -out"); + ret = WOLFCLU_FATAL_ERROR; + } + XFCLOSE(out); + } } if (!opts->noOut && ret == WOLFCLU_SUCCESS) { @@ -319,7 +338,8 @@ static int FindPem(unsigned char *data, word32 offset, word32 len, } /* Allocate buffer to read returns length of file read if success. - * and returns negative code on failure. */ + * and returns negative code on failure. An empty file succeeds with a + * length of 0; the caller decides whether that is an error. */ static long asn1_ReadFile(XFILE fp, byte **buffer, word32 *bufLen) { long fileLen; @@ -333,9 +353,9 @@ static long asn1_ReadFile(XFILE fp, byte **buffer, word32 *bufLen) } /* XFTELL returns a signed long; check it before narrowing to word32 so an - * error (-1) or empty file is not mistaken for a ~4GB length. */ + * error (-1) is not mistaken for a ~4GB length. */ fileLen = XFTELL(fp); - if (fileLen <= 0) { + if (fileLen < 0) { return WOLFCLU_FATAL_ERROR; } @@ -356,7 +376,8 @@ static long asn1_ReadFile(XFILE fp, byte **buffer, word32 *bufLen) return MEMORY_E; } - if (XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) { + if (fileLen > 0 && + XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) { XFREE(*buffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); *buffer = NULL; return WOLFCLU_FATAL_ERROR; @@ -379,84 +400,24 @@ static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME *p) XFREE(p->entries, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); } - wc_ForceZero(p, sizeof(*p)); + XMEMSET(p, 0, sizeof(*p)); return WOLFCLU_SUCCESS; } -/* take in dot separated oid string and fill it with Der encoding * -* return wolfCLU_SUCCESS on success */ -static int OidToDer(char *oid, word32 *oidSz) -{ -#ifndef NO_WC_ENCODE_OBJECT_ID - int ret = WOLFCLU_SUCCESS; - int err; - int idx = 0; - char *token; - char *end; - word32 arcCap = 1; - const char *p = oid; - while (*p != '\0') { - if (*p == '.') { - arcCap++; - } - p++; - } - word32 *arc = (word32 *)XMALLOC(sizeof(*arc) * arcCap, HEAP_HINT, - DYNAMIC_TYPE_TMP_BUFFER); - if (arc == NULL) { - return MEMORY_E; - } - - token = XSTRTOK(oid, ".", &end); - while (token != NULL && ret == WOLFCLU_SUCCESS) { - word32 tmp = 0; - if (wolfCLU_StrToWord32(token, XSTRLEN(token), &tmp) == - WOLFCLU_SUCCESS) { - arc[idx++] = tmp; - } - else { - wolfCLU_LogError("Could not parse oid dot form"); - ret = WOLFCLU_FATAL_ERROR; - break; - } - token = XSTRTOK(NULL, ".", &end); - } - - if (ret == WOLFCLU_SUCCESS) { - /* oid is overwritten by and replaces with DER encoding */ - XMEMSET(oid, '\0', *oidSz); - if ((err = wc_EncodeObjectId32(arc, idx, (byte *)oid, oidSz)) != 0) { - wolfCLU_LogError("%s", wc_GetErrorString(err)); - ret = WOLFCLU_FATAL_ERROR; - } - } - - - XFREE(arc, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); - return ret; -#else - wolfCLU_LogError("Old Version of wolfSSL %s must be greater than 5.9.2 to " - "use custom oids", - WOLFSSL_VERSION); - (void)oid; - (void)oidSz; - return WOLFCLU_FATAL_ERROR; -#endif /*NO_WC_ENCODE_OBJECT_ID*/ -} +#define OID_FILE_IS_SPACE(c) ((c) == ' ' || (c) == '\t' || (c) == '\r') /* return WOLFCLU_SUCCESS if successful * if this function returns success you must call * WOLFCLU_OID_TO_NAME_free. */ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME *newOids, XFILE fp) { -#ifndef NO_WC_ENCODE_OBJECT_ID +#ifdef WOLFCLU_OID_ENCODE int ret = WOLFCLU_SUCCESS; - OidName *tmpPtr; byte *fileBuffer; - char *tracker; - char *token; - char *oid; + char *line; + char *nextLine; + word32 lineNum = 0; if (newOids == NULL) { wolfCLU_LogError("WOLFCLU_OID_TO_NAME was null"); @@ -473,60 +434,75 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME *newOids, XFILE fp) /* file format is \n * we load the first token and go until error or all lines are hit * and loaded */ - token = XSTRTOK((char *)fileBuffer, " ", &tracker); - while (ret == WOLFCLU_SUCCESS && token != NULL) { - word32 len; - oid = token; - len = XSTRLEN(oid); - - ret = OidToDer(oid, &len); - if (ret != WOLFCLU_SUCCESS) { - wolfCLU_LogError("Could not convert Oid : %s to der check line %u", - token, newOids->len + 1); - break; + /* walk lines by hand rather than XSTRTOK so blank lines are counted */ + for (line = (char *)fileBuffer; ret == WOLFCLU_SUCCESS && line != NULL; + line = nextLine) { + OidName *currentName; + char *lineCursor = NULL; + char *oid; + char *shortName; + char *longName; + char *lineEnd; + word32 oidSz; + + lineNum++; + nextLine = XSTRSTR(line, "\n"); + if (nextLine != NULL) { + *nextLine++ = '\0'; } - /* skip short name */ - token = XSTRTOK(NULL, " ", &tracker); - if (token == NULL || XSTRSTR(token, "\n") != NULL) { + /* trim surrounding whitespace, including the '\r' of CRLF files */ + while (OID_FILE_IS_SPACE(*line)) { + line++; + } + lineEnd = line + XSTRLEN(line); + while (lineEnd > line && OID_FILE_IS_SPACE(lineEnd[-1])) { + *--lineEnd = '\0'; + } + if (*line == '\0') { + continue; /* blank line */ + } + + oid = XSTRTOK(line, " \t", &lineCursor); + shortName = XSTRTOK(NULL, " \t", &lineCursor); + /* long name is the rest of the line and may contain spaces */ + longName = XSTRTOK(NULL, "\n", &lineCursor); + while (longName != NULL && OID_FILE_IS_SPACE(*longName)) { + longName++; + } + if (shortName == NULL || longName == NULL || *longName == '\0') { wolfCLU_LogError("malformed tokens, check line %u for bad " - "formatting; wanted short name", - newOids->len + 1); + "formatting; wanted " + "", lineNum); ret = WOLFCLU_FATAL_ERROR; break; } - token = XSTRTOK(NULL, "\n", &tracker); - if (token == NULL) { - wolfCLU_LogError("malformed tokens, check line %u for bad " - "formatting; wanted long name", - newOids->len + 1); + /* DER is never longer than the dotted form, so encode in place */ + oidSz = (word32)XSTRLEN(oid); + if (wolfCLU_OidStrToDer(oid, (byte *)oid, &oidSz) != WOLFCLU_SUCCESS) { + wolfCLU_LogError("Could not convert Oid to der check line %u", + lineNum); ret = WOLFCLU_FATAL_ERROR; break; } - /* realloc array if need more slots */ - if (newOids->len >= newOids->cap) { - tmpPtr = XREALLOC(newOids->entries, - sizeof(OidName) * (newOids->cap + 10), HEAP_HINT, - DYNAMIC_TYPE_TMP_BUFFER); - - if (tmpPtr == NULL) { + if (newOids->cap <= newOids->len) { + OidName *tmp; + tmp = (OidName *)XREALLOC(newOids->entries, + sizeof(*newOids->entries) * (newOids->cap + 10), HEAP_HINT, + DYNAMIC_TYPE_TMP_BUFFER); + if (tmp == NULL) { ret = MEMORY_E; break; } - else { - newOids->entries = tmpPtr; - newOids->cap += 10; - } + newOids->entries = tmp; + newOids->cap += 10; } - - newOids->entries[newOids->len].name = token; - newOids->entries[newOids->len].oid = (byte *)oid; - newOids->entries[newOids->len].len = len; - newOids->len++; - - token = XSTRTOK(NULL, " ", &tracker); + currentName = &newOids->entries[newOids->len++]; + currentName->name = longName; + currentName->oid = (byte *)oid; + currentName->len = oidSz; } newOids->dataBuffer = fileBuffer; @@ -540,8 +516,9 @@ static int WOLFCLU_OID_TO_NAME_initWFile(WOLFCLU_OID_TO_NAME *newOids, XFILE fp) #else (void)newOids; (void)fp; - return OidToDer(NULL, NULL); -#endif /* NO_WC_ENCODE_OBJECT_ID */ + wolfCLU_LogError("wolfSSL is not configured to handle encoding oids"); + return WOLFCLU_FATAL_ERROR; +#endif /* WOLFCLU_OID_ENCODE */ } /* Callback that wolfSSL uses to assign byte oids to names */ @@ -634,9 +611,11 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) po->oidFile); } - po->nameCb = OidToNameCallback; + if (po->nameCb == NULL) { + po->nameCb = OidToNameCallback; + } - if (ret == WOLFCLU_SUCCESS && po->noOut && po->outputFile == NULL) { + if (ret == WOLFCLU_SUCCESS && po->noOut && po->outputPath == NULL) { ret = WOLFCLU_FATAL_ERROR; wolfCLU_LogError("No output file given and -noout set"); } @@ -656,7 +635,11 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) if (asn1_ReadFile(po->inputFile, &inputFileBuffer, &inputFileLen) < 0) { ret = WOLFCLU_FATAL_ERROR; - wolfCLU_LogError("Could not open input file"); + wolfCLU_LogError("Could not read input file"); + } + else if (inputFileLen == 0) { + ret = WOLFCLU_FATAL_ERROR; + wolfCLU_LogError("Input file is empty"); } } } @@ -667,6 +650,12 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) if (ret == WOLFCLU_SUCCESS) { ret = wolfCLU_Asn1Write(&asn1Master, po, inputFileBuffer, inputFileLen); + /* DER is the default, so a PEM file passed without -inform lands + * here; the buffer is untouched (and null terminated) for DER */ + if (ret != WOLFCLU_SUCCESS && po->inForm == WOLFCLU_ASN1_DER && + XSTRSTR((char *)inputFileBuffer, "-----BEGIN") != NULL) { + wolfCLU_LogError("Input looks like PEM, try -inform PEM"); + } } if (inputFileBuffer != NULL) { @@ -676,10 +665,10 @@ int wolfCLU_Asn1Parse(WOLFCLU_ASN1_PARSE_OPTIONS *po) return ret; #else #if !defined(WOLFSSL_ASN_PRINT) - wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot Parse Asn1."); + wolfCLU_LogError("WOLFSSL_ASN_PRINT option not set. Cannot parse Asn1."); #endif #if defined(WOLFCLU_NO_FILESYSTEM) - wolfCLU_LogError("WOLFCLU_NO_FILESYSTEM option is set. Cannot Parse Asn1."); + wolfCLU_LogError("WOLFCLU_NO_FILESYSTEM option is set. Cannot parse Asn1."); #endif return WOLFCLU_FATAL_ERROR; #endif /* defined(WOLFSSL_ASN_PRINT) && !defined(WOLFCLU_NO_FILESYSTEM) */ diff --git a/src/asn1/clu_asn1_setup.c b/src/asn1/clu_asn1_setup.c index 4d6e3eeb..009ba0a4 100644 --- a/src/asn1/clu_asn1_setup.c +++ b/src/asn1/clu_asn1_setup.c @@ -51,38 +51,46 @@ static void wolfCLU_Asn1Help(void) WOLFCLU_LOG(WOLFCLU_L0, "\t-help Display this text"); WOLFCLU_LOG(WOLFCLU_L0, "\t-oid File of extra oid " "definitions"); - wolfCLU_Log(WOLFCLU_L0, "\t The built in Oid Table is " + WOLFCLU_LOG(WOLFCLU_L0, "\t The built in Oid Table is " "on unless configured"); - wolfCLU_Log(WOLFCLU_L0, "\t with: --disable-oid-table"); + WOLFCLU_LOG(WOLFCLU_L0, "\t with: --disable-oid-table"); WOLFCLU_LOG(WOLFCLU_L0, "\nI/O Options:"); WOLFCLU_LOG(WOLFCLU_L0, "\t-inform Input file format " "- [DER, PEM, B64]"); - WOLFCLU_LOG(WOLFCLU_L0, "\t-in Input file"); + WOLFCLU_LOG(WOLFCLU_L0, "\t Defaults to DER"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-in Input file (required)"); WOLFCLU_LOG( WOLFCLU_L0, "\t-out Output file for the Asn1 Der data " "after processing"); - WOLFCLU_LOG(WOLFCLU_L0, "\t-noout Do not print output"); - WOLFCLU_LOG(WOLFCLU_L0, "\t-offset Offset in to the file " - "to begin parsing"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-noout Do not print output " + "(requires -out)"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-offset Offset in to the DER " + "data to begin parsing"); WOLFCLU_LOG(WOLFCLU_L0, "\t-length Number of bytes to parse"); WOLFCLU_LOG(WOLFCLU_L0, "\t-strparse Offset to OCTET/BIT STRING " - "to parse\n " - "\t\t can be used with a list. " + "to parse"); + WOLFCLU_LOG(WOLFCLU_L0, "\t can be used with a list. " "Ex:-strparse 702,64"); + WOLFCLU_LOG(WOLFCLU_L0, "\t -strparse is applied " + "first, then -offset/-length"); WOLFCLU_LOG(WOLFCLU_L0, "\nFormatting Options:"); - WOLFCLU_LOG(WOLFCLU_L0, "\t-i Indents the output"); - WOLFCLU_LOG(WOLFCLU_L0, "\t-dump Unknown data in hex form"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-i Indent by depth instead of " + "drawing branches"); + WOLFCLU_LOG(WOLFCLU_L0, "\t-dump Print data in hex form"); WOLFCLU_LOG(WOLFCLU_L0, "\nOutput:"); WOLFCLU_LOG(WOLFCLU_L0, " Offset v v Data Length"); - WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) ┌SEQUENCE"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) " + "\xe2\x94\x8c" "SEQUENCE"); WOLFCLU_LOG(WOLFCLU_L0, " Header Length ^ Depth ^"); WOLFCLU_LOG(WOLFCLU_L0, "\n Brackets indicate constructed " "types"); - WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) ┌SEQUENCE"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 [1187] (0) " + "\xe2\x94\x8c" "SEQUENCE"); WOLFCLU_LOG(WOLFCLU_L0, "\n Pluses indicate primitive types"); - WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 + 7 (0) ┌INTEGER"); + WOLFCLU_LOG(WOLFCLU_L0, " 0: 4 + 7 (0) " + "\xe2\x94\x8c" "INTEGER"); WOLFCLU_LOG(WOLFCLU_L0, "\nOid File:\n"); WOLFCLU_LOG(WOLFCLU_L0, " Pass in a file to -oid in this format:"); WOLFCLU_LOG(WOLFCLU_L0, " 1.2.3.4 shortName Long name with " @@ -91,6 +99,9 @@ static void wolfCLU_Asn1Help(void) "name long\n"); WOLFCLU_LOG(WOLFCLU_L0, " Entry Fields:"); WOLFCLU_LOG(WOLFCLU_L0, " "); + WOLFCLU_LOG(WOLFCLU_L0, " Only the long name is printed, and names " + "wolfSSL already knows"); + WOLFCLU_LOG(WOLFCLU_L0, " take precedence over the file."); } /* close all files opened during setup returns WOLFCLU_SUCCESS */ @@ -104,11 +115,7 @@ static int Asn1ParseOptions_clean_up(WOLFCLU_ASN1_PARSE_OPTIONS *opt) XFCLOSE(opt->inputFile); } - if (opt->outputFile != NULL) { - XFCLOSE(opt->outputFile); - } - - wc_ForceZero(opt, sizeof(WOLFCLU_ASN1_PARSE_OPTIONS)); + XMEMSET(opt, 0, sizeof(*opt)); return WOLFCLU_SUCCESS; } @@ -135,7 +142,7 @@ static int checkFileArg(const char *file, const char *flag, const char *mode, if (ret != WOLFCLU_SUCCESS) { file = file && (file[0] != '-') ? file : "*missing*"; wolfCLU_LogError("%s argument either missing argument or " - "file does not exist : %s", + "file could not be opened : %s", flag, file); } @@ -148,12 +155,15 @@ static int checkStrParse(const char *arg, word32 *outSz, const word32 cap, word32 *out) { int ret = WOLFCLU_SUCCESS; - char *end; char *token; unsigned long len; char* tmp; - if (out == NULL || arg == NULL || outSz == NULL) { + if (arg == NULL) { + wolfCLU_LogError("-strparse argument missing argument"); + return WOLFCLU_FATAL_ERROR; + } + if (out == NULL || outSz == NULL) { return WOLFCLU_FATAL_ERROR; } @@ -166,9 +176,14 @@ static int checkStrParse(const char *arg, word32 *outSz, const word32 cap, XMEMCPY(tmp, arg, len); - token = XSTRTOK(tmp, ",", &end); - while (token != NULL && ret == WOLFCLU_SUCCESS) { + /* split by hand rather than XSTRTOK so empty entries are rejected */ + token = tmp; + while (ret == WOLFCLU_SUCCESS) { word32 val = 0; + char *comma = XSTRSTR(token, ","); + if (comma != NULL) { + *comma = '\0'; + } if (wolfCLU_StrToWord32(token, XSTRLEN(token), &val) != WOLFCLU_SUCCESS) { ret = WOLFCLU_FATAL_ERROR; @@ -182,7 +197,10 @@ static int checkStrParse(const char *arg, word32 *outSz, const word32 cap, } else { out[(*outSz)++] = val; - token = XSTRTOK(NULL, ",", &end); + if (comma == NULL) { + break; + } + token = comma + 1; } } @@ -261,8 +279,13 @@ int wolfCLU_Asn1Setup(int argc, char *argv[]) break; case WOLFCLU_OUTFILE: - ret = - checkFileArg(optarg, "-out", "wb", &asn1Config.outputFile); + if (optarg == NULL || optarg[0] == '-') { + wolfCLU_LogError("-out argument missing argument"); + ret = WOLFCLU_FATAL_ERROR; + } + else { + asn1Config.outputPath = optarg; + } break; case WOLFCLU_INFILE: @@ -270,13 +293,13 @@ int wolfCLU_Asn1Setup(int argc, char *argv[]) break; case WOLFCLU_OID: -#ifndef NO_WC_ENCODE_OBJECT_ID +#ifdef WOLFCLU_OID_ENCODE ret = checkFileArg(optarg, "-oid", "rb", &asn1Config.oidFile); #else wolfCLU_LogError("wolfSSL is not configured to " "handle encoding oids"); ret = WOLFCLU_FATAL_ERROR; -#endif /* NO_WC_ENCODE_OBJECT_ID */ +#endif /* WOLFCLU_OID_ENCODE */ break; case WOLFCLU_OFFSET: diff --git a/src/tools/clu_funcs.c b/src/tools/clu_funcs.c index b9438880..e23c1ed5 100644 --- a/src/tools/clu_funcs.c +++ b/src/tools/clu_funcs.c @@ -77,7 +77,7 @@ static const struct option crypt_algo_options[] = { WOLFCLU_LOG(WOLFCLU_L0, "-help Help, print out this help menu"); WOLFCLU_LOG(WOLFCLU_L0, " "); WOLFCLU_LOG(WOLFCLU_L0, "Only set one of the following.\n"); - WOLFCLU_LOG(WOLFCLU_L0, "asn1parse Used for parsing certificates as ASN1"); + WOLFCLU_LOG(WOLFCLU_L0, "asn1parse Parse and print ASN.1 structures"); WOLFCLU_LOG(WOLFCLU_L0, "ca Used for signing certificates"); WOLFCLU_LOG(WOLFCLU_L0, "crl Used for parsing CRL files"); WOLFCLU_LOG(WOLFCLU_L0, "bench Benchmark one of the algorithms"); @@ -1343,6 +1343,93 @@ int wolfCLU_StrToWord32(const char* arg, unsigned long strSz, word32* out) } +/* Encode a dotted-decimal OID string into DER content octets. Shared by + * asn1parse -oid files and RID alt names so both validate the same way. */ +int wolfCLU_OidStrToDer(const char* oidStr, byte* out, word32* outSz) +{ +#ifdef WOLFCLU_OID_ENCODE + word32 arcs[ASN1_OID_DOTTED_MAX_SZ]; +#ifdef TRUNCATED_ENCODE_OBJECT_ID + word16 arcs16[ASN1_OID_DOTTED_MAX_SZ]; + word32 i; +#endif + word32 arcCount = 0; + const char* p; + const char* dot; + int err; + + if (oidStr == NULL || out == NULL || outSz == NULL) { + return WOLFCLU_FATAL_ERROR; + } + + for (p = oidStr; p != NULL; p = (dot != NULL) ? dot + 1 : NULL) { + word32 segSz; + + dot = XSTRSTR(p, "."); + segSz = (dot != NULL) ? (word32)(dot - p) : (word32)XSTRLEN(p); + + if (arcCount >= ASN1_OID_DOTTED_MAX_SZ) { + wolfCLU_LogError("OID has too many components (max %d): %s", + ASN1_OID_DOTTED_MAX_SZ, oidStr); + return WOLFCLU_FATAL_ERROR; + } + if (wolfCLU_StrToWord32(p, segSz, &arcs[arcCount]) != + WOLFCLU_SUCCESS) { + wolfCLU_LogError("OID component not a valid 32 bit integer : " + "%.*s", (int)segSz, p); + return WOLFCLU_FATAL_ERROR; + } + arcCount++; + } + + /* the first two arcs share one subidentifier, 40 * arcs[0] + arcs[1] */ + if (arcCount < 2) { + wolfCLU_LogError("OID needs at least two components: %s", oidStr); + return WOLFCLU_FATAL_ERROR; + } + if (arcs[0] > 2) { + wolfCLU_LogError("OID first component must be 0, 1 or 2: %s", oidStr); + return WOLFCLU_FATAL_ERROR; + } + if (arcs[0] < 2 && arcs[1] > 39) { + wolfCLU_LogError("OID second component must be below 40 when the " + "first is 0 or 1: %s", oidStr); + return WOLFCLU_FATAL_ERROR; + } + if (arcs[1] > 0xFFFFFFFFU - (arcs[0] * 40)) { + wolfCLU_LogError("OID second component too large: %s", oidStr); + return WOLFCLU_FATAL_ERROR; + } + +#ifdef TRUNCATED_ENCODE_OBJECT_ID + for (i = 0; i < arcCount; i++) { + if (arcs[i] > 0xFFFF) { + wolfCLU_LogError("OID arc %u would be truncated, this wolfSSL " + "lacks wc_EncodeObjectId32", arcs[i]); + return WOLFCLU_FATAL_ERROR; + } + arcs16[i] = (word16)arcs[i]; + } + err = wc_EncodeObjectId(arcs16, arcCount, out, outSz); +#else + err = wc_EncodeObjectId32(arcs, arcCount, out, outSz); +#endif + if (err != 0) { + wolfCLU_LogError("Could not encode OID: %s", wc_GetErrorString(err)); + return WOLFCLU_FATAL_ERROR; + } + + return WOLFCLU_SUCCESS; +#else + (void)oidStr; + (void)out; + (void)outSz; + wolfCLU_LogError("Couldn't encode OID. OID encoding is not compiled in"); + return WOLFCLU_FATAL_ERROR; +#endif /* WOLFCLU_OID_ENCODE */ +} + + /* Stream-hash data read from bioIn using hashType and write the digest to * outDigest. On entry *outDigestSz is the capacity of outDigest; on success * it is updated to the actual digest length. */ diff --git a/src/x509/clu_config.c b/src/x509/clu_config.c index 0a1990dc..08f4b409 100644 --- a/src/x509/clu_config.c +++ b/src/x509/clu_config.c @@ -342,13 +342,12 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, int ret = WOLFCLU_SUCCESS; WOLFSSL_ASN1_STRING *ipStr = NULL; WOLFSSL_ASN1_OBJECT *ridObj = NULL; - char *token, *ptr, *s = NULL; + char *s = NULL; int sSz = 0; int type = 0; - byte oid[ASN1_OID_DOTTED_MAX_SZ]; - word32 oidSz = ASN1_OID_DOTTED_MAX_SZ; - word32 decodedCount = 0; - word32 decoded[ASN1_OID_DOTTED_MAX_SZ]; + /* a word32 arc takes at most 5 base-128 bytes */ + byte oid[ASN1_OID_DOTTED_MAX_SZ * 5]; + word32 oidSz = sizeof(oid); if (XSTRNCMP(name, "IP", 2) == 0) { ipStr = wolfSSL_a2i_IPADDRESS(value); @@ -380,76 +379,14 @@ static int wolfCLU_addAltName(WOLFSSL_X509* x509, const char* name, else if (XSTRNCMP(name, "RID", 3) == 0) { if ((ridObj = wolfSSL_OBJ_txt2obj(value, 0)) == NULL) { - #if defined(HAVE_OID_ENCODING) && !defined(NO_WC_ENCODE_OBJECT_ID) - /* If RID value is not named OID, manually encode - * dotted OID into byte array. Tokenize a copy so the - * original value stays intact for error messages. */ - int ridLen = (int)XSTRLEN(value); - char* ridDup = (char*)XMALLOC(ridLen + 1, NULL, - DYNAMIC_TYPE_TMP_BUFFER); - if (ridDup == NULL) { - wolfCLU_LogError("Failed to allocate memory for RID"); - return MEMORY_E; - } - XMEMCPY(ridDup, value, ridLen + 1); - - token = XSTRTOK(ridDup, ".", &ptr); - - while (token != NULL) { - word32 n; - - - if (decodedCount >= ASN1_OID_DOTTED_MAX_SZ) { - wolfCLU_LogError("RID has too many components " - "(max %d): %s", - ASN1_OID_DOTTED_MAX_SZ, value); - ret = WOLFCLU_FATAL_ERROR; - break; - } - if (wolfCLU_StrToWord32(token, XSTRLEN(token), &n) != - WOLFCLU_SUCCESS) { - wolfCLU_LogError("RID component not a valid 32 bit" - " integer : %s", token); - ret = WOLFCLU_FATAL_ERROR; - break; - } - decoded[decodedCount] = n; - decodedCount++; - token = XSTRTOK(NULL, ".", &ptr); - } - - XFREE(ridDup, NULL, DYNAMIC_TYPE_TMP_BUFFER); - - if (ret != WOLFCLU_SUCCESS) { - return ret; - } - - if (wc_EncodeObjectId(decoded, decodedCount, oid, &oidSz) - == 0) { - s = (char*)oid; - sSz = (int)oidSz; - } - else { + /* If RID value is not named OID, manually encode the dotted + * OID into a byte array. */ + if (wolfCLU_OidStrToDer(value, oid, &oidSz) != WOLFCLU_SUCCESS) { wolfCLU_LogError("bad RID found %s", value); return WOLFCLU_FATAL_ERROR; } - #else - (void)token; - (void)ptr; - (void)decoded; - (void)decodedCount; - (void)oid; - (void)oidSz; - - wolfCLU_LogError("Couldn't encode RID. OID encoding is not" - " compiled in"); - #if LIBWOLFSSL_VERSION_HEX <= 0x05009002 - wolfCLU_LogError("Old Version of wolfSSL %s must be greater " - "than 5.9.2 to use custom oids", WOLFSSL_VERSION); - #endif - return WOLFCLU_FATAL_ERROR; - - #endif + s = (char*)oid; + sSz = (int)oidSz; } else { s = (char*)wolfSSL_OBJ_get0_data(ridObj); diff --git a/tests/asn1/asn1-test.py b/tests/asn1/asn1-test.py index 7ffd8a96..a49c874a 100644 --- a/tests/asn1/asn1-test.py +++ b/tests/asn1/asn1-test.py @@ -11,6 +11,7 @@ from wolfclu_test import ( CERTS_DIR, have_oid_table, + oid_arcs_truncated, run_wolfssl, test_main, truncate_sparse, @@ -31,9 +32,9 @@ def oid_encoding_supported(): """True when the build can DER-encode the OIDs from an -oid file. - -oid relies on wc_EncodeObjectId, which is compiled out via - NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.2 (set in configure.ac). - In that build -oid reports a fatal error instead of encoding anything. + -oid relies on wc_EncodeObjectId, which configure compiles out via + NO_WC_ENCODE_OBJECT_ID when the linked wolfSSL does not export it. In + that build -oid reports a fatal error instead of encoding anything. The flag is a -D in AM_CFLAGS, so probe the binary for the behaviour instead. A nonexistent file is enough: the disabled path errors during argument handling before the file is ever opened. @@ -52,14 +53,36 @@ def setUpClass(cls): cls.der = os.path.join(CERTS_DIR, "ca-cert.der") cls.pem = os.path.join(CERTS_DIR, "ca-cert.pem") - # Skip when asn1parse is not compiled in (needs WOLFSSL_ASN_PRINT). + # Skip when asn1parse is not compiled in (needs WOLFSSL_ASN_PRINT and a + # filesystem). Every such path logs "Cannot parse Asn1." result = run_wolfssl("asn1parse", "-inform", "DER", "-in", cls.der) - if "Cannot Parse Asn1" in (result.stdout + result.stderr): + if "cannot parse asn1" in (result.stdout + result.stderr).lower(): raise unittest.SkipTest("asn1parse support not compiled in") # Reference output produced from the DER form of the cert. cls.der_output = result.stdout + def _write_der(self, name, data): + """Write data to name, remove it at cleanup, and return name.""" + with open(name, "wb") as f: + f.write(data) + self.addCleanup(lambda: os.remove(name) + if os.path.exists(name) else None) + return name + + def _write_text(self, name, text): + """Text-mode _write_der, for -oid files.""" + return self._write_der(name, text.encode()) + + def _remove_at_cleanup(self, name): + self.addCleanup(lambda: os.remove(name) + if os.path.exists(name) else None) + return name + + def _assert_fails_with(self, result, msg): + self.assertNotEqual(result.returncode, 0) + self.assertIn(msg, result.stdout + result.stderr) + def test_DER(self): """Parse a DER input and confirm the ASN.1 structure is printed.""" result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der) @@ -67,16 +90,18 @@ def test_DER(self): self.assertIn("SEQUENCE", result.stdout) def test_PEM(self): - """PEM input of the same cert yields the same parse as DER.""" - result = run_wolfssl("asn1parse", "-inform", "PEM", "-in", self.pem) - self.assertEqual(result.returncode, 0, result.stderr) - self.assertEqual(result.stdout, self.der_output) + """PEM input of the same cert yields the same parse as DER, and + -inform is case insensitive.""" + for inform in ("PEM", "pem"): + with self.subTest(inform=inform): + result = run_wolfssl("asn1parse", "-inform", inform, + "-in", self.pem) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, self.der_output) def test_base64(self): """Base64 (non-PEM) input yields the same parse as DER.""" - b64_file = "test-asn1.b64" - self.addCleanup(lambda: os.remove(b64_file) - if os.path.exists(b64_file) else None) + b64_file = self._remove_at_cleanup("test-asn1.b64") with open(self.der, "rb") as f: with open(b64_file, "w") as out: out.write(base64.encodebytes(f.read()).decode()) @@ -85,34 +110,39 @@ def test_base64(self): self.assertEqual(result.returncode, 0, result.stderr) self.assertEqual(result.stdout, self.der_output) - def test_out_arg_is_DER(self): - """The -out file is the processed DER that was input""" - out_file = "test-asn1.out" - self.addCleanup(lambda: os.remove(out_file) - if os.path.exists(out_file) else None) - result = run_wolfssl("asn1parse", "-inform", "DER", "-noout", "-in", self.der, - "-out", out_file) + def test_strparse_octet_string(self): + """-strparse onto an OCTET STRING prints and -out writes exactly the + nested DER. + + Build OCTET STRING { INTEGER 42 }: + 04 03 02 01 2a + -strparse 0 descends into the OCTET STRING at offset 0, with no + dependence on the bytes of any shipped cert. + """ + der_file = self._write_der("test-asn1-strparse-out.der", + bytes([0x04, 0x03, 0x02, 0x01, 0x2a])) + out_file = self._remove_at_cleanup("test-asn1-strparse.out") + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-strparse", "0", "-out", out_file) self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("INTEGER", result.stdout) + self.assertNotIn("OCTET STRING", result.stdout) with open(out_file, "rb") as out: - with open(self.der, "rb") as infile: - self.assertEqual(out.read(), infile.read()) - - def test_out_arg(self): - """The -out flag (output file must exist) runs without error.""" - out_file = "test-asn1.out" - open(out_file, "w").close() - self.addCleanup(lambda: os.remove(out_file) - if os.path.exists(out_file) else None) + self.assertEqual(out.read(), bytes([0x02, 0x01, 0x2a])) + def test_indent(self): + """-i swaps branch drawing for indentation, changing the output.""" result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, - "-out", out_file) + "-i") self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("SEQUENCE", result.stdout) + self.assertNotEqual(result.stdout, self.der_output) def test_noout_suppresses_stdout(self): - """-noout suppresses stdout but the -out file still gets the DER.""" - out_file = "test-asn1-noout.out" - self.addCleanup(lambda: os.remove(out_file) - if os.path.exists(out_file) else None) + """-noout suppresses stdout but the -out file still gets the input + DER.""" + out_file = self._remove_at_cleanup("test-asn1-noout.out") result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, "-out", out_file, "-noout") @@ -129,53 +159,62 @@ def test_noout_without_out_errors(self): "-noout") self.assertNotEqual(result.returncode, 0) - def test_offset(self): - """An offset changes where parsing begins.""" - result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, - "-offset", "4") + def test_strparse_mixed_nesting(self): + """-strparse drills through alternating BIT/OCTET STRING wrappers. + + Each comma-separated entry is an offset, relative to the current + substructure, of the string to descend into. certs/nested.der nests + five SEQUENCE layers, each wrapping the next in a BIT STRING or OCTET + STRING: + 27 -> BIT STRING in layer 1 + 20 -> OCTET STRING in layer 2 + 9 -> BIT STRING in layer 3 + 20 -> OCTET STRING in layer 4 + leaving only the innermost layer 5 SEQUENCE to be printed. + """ + nested = os.path.join(CERTS_DIR, "nested.der") + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", nested, + "-strparse", "27,20,9,20") self.assertEqual(result.returncode, 0, result.stderr) - self.assertIn("SEQUENCE", result.stdout) - self.assertNotEqual(result.stdout, self.der_output) + self.assertIn("innermost payload - layer 5", result.stdout) + self.assertIn("rsaEncryption", result.stdout) + self.assertNotIn("layer 1 - outermost", result.stdout) + self.assertNotIn("layer 4 label", result.stdout) - def test_strparse_octet_string(self): - """-strparse onto an OCTET/BIT STRING node succeeds. + def test_strparse_cap(self): + """-strparse accepts WOLFCLU_ASN1_STR_PARSE_CAP (30) offsets, not 31. - Build OCTET STRING { INTEGER 42 }: - 04 03 02 01 2a - -strparse 0 descends into the OCTET STRING at offset 0 and prints the - wrapped INTEGER, with no dependence on the bytes of any shipped cert. + Wrap INTEGER 42 in 30 OCTET STRINGs so "0" repeated 30 times peels + every wrapper; one more entry exceeds the cap and is rejected while + parsing arguments. """ - der_file = "test-asn1-strparse-octet.der" - with open(der_file, "wb") as f: - f.write(bytes([0x04, 0x03, 0x02, 0x01, 0x2a])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) + cap = 30 + der = bytes([0x02, 0x01, 0x2a]) + for _ in range(cap): + der = bytes([0x04, len(der)]) + der + der_file = self._write_der("test-asn1-strparse-cap.der", der) result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, - "-strparse", "0") + "-strparse", ",".join(["0"] * cap)) self.assertEqual(result.returncode, 0, result.stderr) self.assertIn("INTEGER", result.stdout) + self.assertNotIn("OCTET STRING", result.stdout) - def test_strparse_nested_octet_strings(self): - """A comma-separated -strparse list drills through nested OCTET STRINGs. - - Build OCTET STRING { OCTET STRING { INTEGER 42 } }: - 04 05 04 03 02 01 2a - Each list entry is an offset (relative to the current substructure) of - an OCTET/BIT STRING to descend into, so "0,0" peels both wrappers and - leaves the INTEGER to be printed. - """ - der_file = "test-asn1-nested.der" - with open(der_file, "wb") as f: - f.write(bytes([0x04, 0x05, 0x04, 0x03, 0x02, 0x01, 0x2a])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) - # Two levels: descend through both wrappers to the INTEGER. - r = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, - "-strparse", "0,0") - self.assertEqual(r.returncode, 0, r.stderr) - self.assertIn("INTEGER", r.stdout) - self.assertNotIn("OCTET STRING", r.stdout) + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-strparse", ",".join(["0"] * (cap + 1))) + self.assertNotEqual(result.returncode, 0) + self.assertIn("Too many values passed to -strparse", + result.stdout + result.stderr) + + def test_strparse_empty_entry(self): + """Empty -strparse entries are rejected, not silently skipped.""" + for arg in ("", ",", "0,,0", "0,"): + with self.subTest(arg=arg): + result = run_wolfssl("asn1parse", "-inform", "DER", + "-in", self.der, "-strparse", arg) + self.assertNotEqual(result.returncode, 0) + self.assertIn("Not a valid integer value", + result.stdout + result.stderr) def test_strparse_bit_string(self): """-strparse into a BIT STRING skips its leading unused-bits octet. @@ -185,11 +224,8 @@ def test_strparse_bit_string(self): The 0x00 unused-bits octet is not part of the nested DER, so -strparse must step over it to reach and print the wrapped INTEGER. """ - der_file = "test-asn1-strparse-bit.der" - with open(der_file, "wb") as f: - f.write(bytes([0x03, 0x04, 0x00, 0x02, 0x01, 0x2a])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) + der_file = self._write_der("test-asn1-strparse-bit.der", + bytes([0x03, 0x04, 0x00, 0x02, 0x01, 0x2a])) result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, "-strparse", "0") @@ -198,38 +234,44 @@ def test_strparse_bit_string(self): @unittest.skipUnless(oid_encoding_supported(), "built without wc_EncodeObjectId (-oid disabled)") - def test_oid(self): - """A custom OID definition file maps an unknown OID to its name. + def test_oid_file_whitespace(self): + """-oid files tolerate blank lines, CRLF endings and tab separators. - The callback is only consulted for OIDs wolfSSL does not already - know, so use an arbitrary unknown OID (1.3.111111.5) encoded as a bare - OBJECT IDENTIFIER and confirm the supplied long name is printed. + Blank lines (including whitespace-only and bare CRLF lines), a + trailing extra newline and tab separators must all be skipped or + accepted, and the CRLF '\\r' and surrounding spaces must not end up in + the printed long name. """ - # DER: 06 05 2b 86 e4 07 05 == OBJECT IDENTIFIER 1.3.111111.5 - # 111111 base-128 = 6, 100, 7 -> 0x86 0xe4 0x07. - der_file = "test-asn1-unknown-oid.der" - with open(der_file, "wb") as f: - f.write(bytes([0x06, 0x05, 0x2b, 0x86, 0xe4, 0x07, 0x05])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) - - oid_file = "test-asn1-oid.conf" - with open(oid_file, "w") as f: - f.write("1.3.111111.5 myShort MyUnknownOid") - self.addCleanup(lambda: os.remove(oid_file) - if os.path.exists(oid_file) else None) + # DER: 06 04 2b ce 0f 05 == OBJECT IDENTIFIER 1.3.9999.5 + der_file = self._write_der("test-asn1-ws-oid.der", + bytes([0x06, 0x04, 0x2b, 0xce, 0x0f, 0x05])) - # Without the mapping the OID prints in dotted-decimal form. - baseline = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) - self.assertEqual(baseline.returncode, 0, baseline.stderr) - self.assertIn("1.3.111111.5", baseline.stdout) - self.assertNotIn("MyUnknownOid", baseline.stdout) + oid_file = self._write_der("test-asn1-ws-oid.conf", + b"1.2.3.4 a First Oid\r\n" + b"\r\n" + b" \t \n" + b" 1.3.9999.5\tmyShort\t My Ws Oid \r\n" + b"\n\n") - # With the mapping the custom long name is resolved. result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, "-oid", oid_file) self.assertEqual(result.returncode, 0, result.stderr) - self.assertIn("MyUnknownOid", result.stdout) + self.assertIn(":My Ws Oid\n", result.stdout) + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_dump_keeps_oid_names(self): + """-dump still prints OID names, including ones from -oid files.""" + # DER: 06 04 2b ce 0f 05 == OBJECT IDENTIFIER 1.3.9999.5 + der_file = self._write_der("test-asn1-dump-oid.der", + bytes([0x06, 0x04, 0x2b, 0xce, 0x0f, 0x05])) + oid_file = self._write_text("test-asn1-dump-oid.conf", + "1.3.9999.5 myShort MyDumpOid\n") + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-oid", oid_file, "-dump") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyDumpOid", result.stdout) @unittest.skipUnless(oid_encoding_supported(), "built without wc_EncodeObjectId (-oid disabled)") @@ -242,17 +284,11 @@ def test_oid_multibyte_first_subidentifier(self): mapping silently fails to match. """ # DER: 06 03 81 34 03 == OBJECT IDENTIFIER 2.100.3 - der_file = "test-asn1-arc2-oid.der" - with open(der_file, "wb") as f: - f.write(bytes([0x06, 0x03, 0x81, 0x34, 0x03])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) - - oid_file = "test-asn1-arc2-oid.conf" - with open(oid_file, "w") as f: - f.write("2.100.3 myShort MyArc2Oid\n") - self.addCleanup(lambda: os.remove(oid_file) - if os.path.exists(oid_file) else None) + der_file = self._write_der("test-asn1-arc2-oid.der", + bytes([0x06, 0x03, 0x81, 0x34, 0x03])) + + oid_file = self._write_text("test-asn1-arc2-oid.conf", + "2.100.3 myShort MyArc2Oid\n") # Without the mapping the OID prints in dotted-decimal form. baseline = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) @@ -267,6 +303,108 @@ def test_oid_multibyte_first_subidentifier(self): self.assertEqual(result.returncode, 0, result.stderr) self.assertIn("MyArc2Oid", result.stdout) + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_oid_multibyte_first_subidentifier_large_arc(self): + """A custom OID with a two-byte first subidentifier and a >16-bit arc. + + 2.100.111111.5 combines the 2.100 first subidentifier (180, two + base-128 bytes) with an arc too large for the word16 + wc_EncodeObjectId, so the mapping only matches if wolfCLU_OidStrToDer + encodes every arc in full via wc_EncodeObjectId32. A build without + wc_EncodeObjectId32 must reject the arc instead of truncating it. + """ + # DER: 06 06 81 34 86 e4 07 05 == OBJECT IDENTIFIER 2.100.111111.5 + der_file = self._write_der("test-asn1-arc2-large-oid.der", + bytes([0x06, 0x06, 0x81, 0x34, 0x86, 0xe4, + 0x07, 0x05])) + + oid_file = self._write_text("test-asn1-arc2-large-oid.conf", + "2.100.111111.5 myShort MyCustomOid\n") + + baseline = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) + self.assertEqual(baseline.returncode, 0, baseline.stderr) + self.assertNotIn("MyCustomOid", baseline.stdout) + + result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, + "-oid", oid_file) + if oid_arcs_truncated(): + self.assertNotEqual(result.returncode, 0) + self.assertIn("OID arc 111111 would be truncated", + result.stdout + result.stderr) + return + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyCustomOid", result.stdout) + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_oid_invalid_arcs(self): + """wolfCLU_OidStrToDer rejects invalid dotted OIDs. + + -oid files and req -addext RID share this encoder, so its validation + is covered once here. The first two arcs share one subidentifier + (40 * arc0 + arc1), so arc0 must be 0-2 and arc1 below 40 unless + arc0 is 2; arcs must fit in 32 bits, and at most + ASN1_OID_DOTTED_MAX_SZ (16) arcs are allowed. + """ + cases = [ + ("3.1 s Bad", "first component must be 0, 1 or 2"), + ("1.40 s Bad", "second component must be below 40"), + ("2.4294967295 s Bad", "second component too large"), + ("1 s Bad", "needs at least two components"), + ("1..2 s Bad", "not a valid 32 bit integer"), + ("2.999.4294967296 s Bad", "not a valid 32 bit integer"), + ("2.999." + ".".join(str(i) for i in range(1, 16)) + " s Bad", + "too many components"), + ] + oid_file = self._remove_at_cleanup("test-asn1-bad-arc-oid.conf") + for line, msg in cases: + with self.subTest(line=line): + with open(oid_file, "w") as f: + f.write(line + "\n") + result = run_wolfssl("asn1parse", "-inform", "DER", + "-in", self.der, "-oid", oid_file) + self.assertNotEqual(result.returncode, 0) + self.assertIn(msg, result.stdout + result.stderr) + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_oid_file_many_entries(self): + """An -oid file larger than one allocation chunk is fully loaded. + + Entries are stored in chunks of 10, so 25 entries grow the array + twice. Only the last entry maps the OID in the input, so its name is + printed only if every grow kept the earlier entries and the count. + """ + # DER: 06 04 2b ce 0f 05 == OBJECT IDENTIFIER 1.3.9999.5 + der_file = self._write_der("test-asn1-many-oid.der", + bytes([0x06, 0x04, 0x2b, 0xce, 0x0f, 0x05])) + lines = ["1.3.9998.{0} s{0} Filler{0}\n".format(i) for i in range(24)] + lines.append("1.3.9999.5 myShort MyLastOid\n") + oid_file = self._write_text("test-asn1-many-oid.conf", "".join(lines)) + + result = run_wolfssl("asn1parse", "-in", der_file, "-oid", oid_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyLastOid", result.stdout) + + @unittest.skipUnless(have_oid_table() and oid_encoding_supported(), + "needs the built-in OID table and -oid support") + def test_oid_file_overrides_builtin_table(self): + """An -oid entry is searched before the built-in table.""" + # DER: OBJECT IDENTIFIER 2.16.756.1.89.1.2.1.1, which the built-in + # table names "SwissSign EV policy". Every arc fits in 16 bits, so + # the OID also encodes in TRUNCATED_ENCODE_OBJECT_ID builds. + der_file = self._write_der("test-asn1-override-oid.der", + bytes([0x06, 0x09, 0x60, 0x85, 0x74, 0x01, + 0x59, 0x01, 0x02, 0x01, 0x01])) + oid_file = self._write_text("test-asn1-override-oid.conf", + "2.16.756.1.89.1.2.1.1 s MyOverride\n") + + result = run_wolfssl("asn1parse", "-in", der_file, "-oid", oid_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("MyOverride", result.stdout) + self.assertNotIn("SwissSign EV policy", result.stdout) + @unittest.skipUnless(have_oid_table(), "built with --disable-oid-table") def test_builtin_oid_table(self): @@ -280,12 +418,9 @@ def test_builtin_oid_table(self): """ # DER: 06 0a 60 86 48 01 86 fb 7b 83 74 09 # == OBJECT IDENTIFIER 2.16.840.1.114171.500.9 - der_file = "test-asn1-builtin-oid.der" - with open(der_file, "wb") as f: - f.write(bytes([0x06, 0x0a, 0x60, 0x86, 0x48, 0x01, 0x86, 0xfb, - 0x7b, 0x83, 0x74, 0x09])) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) + der_file = self._write_der("test-asn1-builtin-oid.der", + bytes([0x06, 0x0a, 0x60, 0x86, 0x48, 0x01, + 0x86, 0xfb, 0x7b, 0x83, 0x74, 0x09])) result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) self.assertEqual(result.returncode, 0, result.stderr) @@ -298,11 +433,7 @@ def test_length_truncates(self): both appear; with -length 3 (exactly the first INTEGER's TLV) only the first is parsed, confirming the limit is honoured rather than ignored. """ - der_file = "test-asn1-twoint.der" - with open(der_file, "wb") as f: - f.write(TWO_INTEGERS) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) + der_file = self._write_der("test-asn1-twoint.der", TWO_INTEGERS) full = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file) self.assertEqual(full.returncode, 0, full.stderr) @@ -319,28 +450,58 @@ def test_offset_skips_leading_bytes(self): With -offset 3 the first INTEGER's TLV in TWO_INTEGERS is skipped, so only the second INTEGER remains to be parsed. """ - der_file = "test-asn1-twoint-off.der" - with open(der_file, "wb") as f: - f.write(TWO_INTEGERS) - self.addCleanup(lambda: os.remove(der_file) - if os.path.exists(der_file) else None) + der_file = self._write_der("test-asn1-twoint-off.der", TWO_INTEGERS) result = run_wolfssl("asn1parse", "-inform", "DER", "-in", der_file, "-offset", "3") self.assertEqual(result.returncode, 0, result.stderr) self.assertEqual(result.stdout.count("INTEGER"), 1) - def test_offset_past_end(self): - """An -offset past the end of the input is rejected, not read OOB.""" - result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, - "-offset", "9999999") - self.assertNotEqual(result.returncode, 0) + def test_strparse_then_offset_length(self): + """-strparse runs first, then -offset/-length pick within the result. + + Bytes: INTEGER 42, then OCTET STRING { INTEGER 43, INTEGER 44 }: + 02 01 2a 04 06 02 01 2b 02 01 2c + The -strparse offset counts from the start of the input even when + -offset is given, and -offset/-length then apply to the six nested + bytes. Applying -offset first would land -strparse 3 + on 0x01 and fail. + """ + der_file = self._write_der("test-asn1-strparse-window.der", + bytes([0x02, 0x01, 0x2a, 0x04, 0x06, 0x02, + 0x01, 0x2b, 0x02, 0x01, 0x2c])) + + result = run_wolfssl("asn1parse", "-in", der_file, + "-offset", "3", "-strparse", "3") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout.count("INTEGER"), 1) + self.assertIn(":2c", result.stdout) + + result = run_wolfssl("asn1parse", "-in", der_file, + "-strparse", "3", "-length", "3") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout.count("INTEGER"), 1) + self.assertIn(":2b", result.stdout) + + # A -length past the nested data is clamped to it. + result = run_wolfssl("asn1parse", "-in", der_file, + "-strparse", "3", "-length", "99") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout.count("INTEGER"), 2) + self.assertNotIn(":2a", result.stdout) + + # -offset is checked against the nested data, not the whole input. + result = run_wolfssl("asn1parse", "-in", der_file, + "-strparse", "3", "-offset", "6") + self._assert_fails_with(result, "past the end of the data to parse") def test_length_too_large(self): - """A -length larger than the remaining input is rejected.""" + """A -length larger than the remaining input is clamped, so the whole + input is parsed.""" result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, "-length", "9999999") - self.assertNotEqual(result.returncode, 0) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, self.der_output) def test_negative_integer_arg(self): """A non-integer / negative argument to -offset is rejected.""" @@ -359,7 +520,7 @@ def test_input_file_too_large(self): """A file larger than the 0x7FFFFFFEU byte max is rejected up front. asn1_ReadFile caps the input at 0x7FFFFFFEU bytes so that the +1 for the - null terminator still fits in a word32. A file one byte over that limit + null terminator still fits in an int/long on Windows. A file one byte over that limit (0x7FFFFFFFU) must be refused before any ~2GB buffer is allocated or read, so the check has to fire on file size alone. The file is created sparse (no real disk use) via truncate; skip if the platform/filesystem @@ -390,17 +551,167 @@ def test_input_file_too_large(self): def test_malformed_oid_file(self): """A malformed -oid definition file is rejected.""" - oid_file = "test-asn1-bad-oid.conf" - with open(oid_file, "w") as f: - # Missing the short and long name tokens. - f.write("1.2.3.4\n") - self.addCleanup(lambda: os.remove(oid_file) - if os.path.exists(oid_file) else None) + # Missing the short and long name tokens. + oid_file = self._write_text("test-asn1-bad-oid.conf", "1.2.3.4\n") result = run_wolfssl("asn1parse", "-inform", "DER", "-in", self.der, "-oid", oid_file) self.assertNotEqual(result.returncode, 0) + def test_dump_alone(self): + """-dump prints the data as hex and drops the INTEGER text form.""" + der_file = self._write_der("test-asn1-dump.der", TWO_INTEGERS) + plain = run_wolfssl("asn1parse", "-in", der_file) + self.assertEqual(plain.returncode, 0, plain.stderr) + self.assertIn(":2a", plain.stdout) + + result = run_wolfssl("asn1parse", "-in", der_file, "-dump") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("0000: 2a", result.stdout) + self.assertIn("0000: 2b", result.stdout) + self.assertNotIn(":2a", result.stdout) + + def test_help(self): + result = run_wolfssl("asn1parse", "-help") + self.assertEqual(result.returncode, 0, result.stderr) + self.assertIn("-strparse", result.stdout + result.stderr) + + def test_inform_invalid(self): + """An unknown or missing -inform value is rejected.""" + for args in (("-inform", "XYZ"), ("-inform",)): + with self.subTest(args=args): + result = run_wolfssl("asn1parse", "-in", self.der, *args) + self._assert_fails_with(result, "-inform argument either " + "missing or is not valid value") + + def test_missing_in(self): + result = run_wolfssl("asn1parse", "-inform", "DER") + self._assert_fails_with(result, "Must have input via file passed " + "to -in") + + def test_nonexistent_in(self): + result = run_wolfssl("asn1parse", "-in", "asn1-missing.nonexistent") + self._assert_fails_with(result, "file could not be opened") + + def test_empty_in(self): + der_file = self._write_der("test-asn1-empty.der", b"") + result = run_wolfssl("asn1parse", "-in", der_file) + self._assert_fails_with(result, "Input file is empty") + + def test_pem_errors(self): + """Malformed PEM input is rejected with the specific reason.""" + cases = ( + (b"AgEq\n-----END X-----\n", "No PEM header found"), + (b"-----BEGIN X-----\nAgEq\n", "No PEM footer found"), + (b"-----BEGIN X\nAgEq\n", "Invalid PEM header"), + (b"-----BEGIN X-----\n!!!!\n-----END X-----\n", + "PEM input is not base64 encoded"), + (b"-----BEGIN X-----\n-----END X-----\n", "No data to parse"), + ) + for i, (data, msg) in enumerate(cases): + with self.subTest(msg=msg): + pem_file = self._write_der("test-asn1-bad{}.pem".format(i), + data) + result = run_wolfssl("asn1parse", "-inform", "PEM", + "-in", pem_file) + self._assert_fails_with(result, msg) + + def test_b64_not_base64(self): + """-inform B64 on input that is not base64 is rejected.""" + b64_file = self._write_der("test-asn1-bad.b64", b"!!!!\n") + result = run_wolfssl("asn1parse", "-inform", "B64", "-in", b64_file) + self._assert_fails_with(result, "input is not base64 encoded") + + def test_length_zero(self): + result = run_wolfssl("asn1parse", "-in", self.der, "-length", "0") + self._assert_fails_with(result, "-length arg must be greater than 0") + + def test_strparse_missing_arg(self): + """-strparse as the final argument reports the missing value.""" + result = run_wolfssl("asn1parse", "-in", self.der, "-strparse") + self._assert_fails_with(result, "-strparse argument missing argument") + + def test_out_unopenable(self): + """An -out path that cannot be created is reported.""" + result = run_wolfssl("asn1parse", "-in", self.der, "-out", + os.path.join("asn1-no-such-dir.nonexistent", + "out.der")) + self._assert_fails_with(result, "Unable to open file passed by -out") + + def test_pem_without_inform_hint(self): + """PEM parsed as the default DER suggests -inform PEM.""" + result = run_wolfssl("asn1parse", "-in", self.pem) + self._assert_fails_with(result, "try -inform PEM") + + def test_strparse_past_end(self): + """-strparse beyond the input is rejected before any read.""" + der_file = self._write_der("test-asn1-strparse-past.der", + bytes([0x02, 0x01, 0x2a])) + result = run_wolfssl("asn1parse", "-in", der_file, "-strparse", "5") + self._assert_fails_with(result, "tried to jump to invalid location") + + def test_strparse_bit_string_no_nested_der(self): + """A BIT STRING that is empty or has non-zero unused bits holds no + nested DER.""" + cases = ( + ("empty", bytes([0x03, 0x01, 0x00])), + ("unused", bytes([0x03, 0x02, 0x01, 0x00])), + ) + for name, data in cases: + with self.subTest(case=name): + der_file = self._write_der( + "test-asn1-strparse-{}.der".format(name), data) + result = run_wolfssl("asn1parse", "-in", der_file, + "-strparse", "0") + self._assert_fails_with(result, "BIT STRING has no nested DER") + + def test_strparse_constructed_octet_string(self): + """A constructed (BER) OCTET STRING is not descended into.""" + der_file = self._write_der("test-asn1-strparse-cons.der", + bytes([0x24, 0x03, 0x02, 0x01, 0x2a])) + result = run_wolfssl("asn1parse", "-in", der_file, "-strparse", "0") + self._assert_fails_with(result, "did not find an OCTET STRING or " + "BIT STRING") + + def test_strparse_length_past_window(self): + """An OCTET STRING length running past the input is rejected.""" + der_file = self._write_der("test-asn1-strparse-len.der", + bytes([0x04, 0x05, 0x02, 0x01, 0x2a])) + result = run_wolfssl("asn1parse", "-in", der_file, "-strparse", "0") + self._assert_fails_with(result, "invalid length encoding") + + def test_arg_found_twice(self): + result = run_wolfssl("asn1parse", "-in", self.der, "-in", self.der) + self._assert_fails_with(result, "Arg found twice for asn1parse") + + def test_out_same_as_in(self): + """-out naming the -in file overwrites it only after it is read.""" + der_file = self._write_der("test-asn1-inout.der", TWO_INTEGERS) + result = run_wolfssl("asn1parse", "-in", der_file, "-out", der_file, + "-offset", "3", "-noout") + self.assertEqual(result.returncode, 0, result.stderr) + with open(der_file, "rb") as f: + self.assertEqual(f.read(), TWO_INTEGERS[3:]) + + def test_offset_past_end(self): + """An -offset past the end of the input is rejected, not read OOB, + and an existing -out file is left as it was.""" + out_file = self._write_der("test-asn1-keep.out", b"keep") + result = run_wolfssl("asn1parse", "-in", self.der, "-out", out_file, + "-offset", "9999999") + self._assert_fails_with(result, "past the end of the data to parse") + with open(out_file, "rb") as f: + self.assertEqual(f.read(), b"keep") + + @unittest.skipUnless(oid_encoding_supported(), + "built without wc_EncodeObjectId (-oid disabled)") + def test_empty_oid_file(self): + """An empty -oid file adds no names rather than failing.""" + oid_file = self._write_der("test-asn1-empty-oid.conf", b"") + result = run_wolfssl("asn1parse", "-in", self.der, "-oid", oid_file) + self.assertEqual(result.returncode, 0, result.stderr) + self.assertEqual(result.stdout, self.der_output) + if __name__ == "__main__": test_main() diff --git a/tests/wolfclu_test.py b/tests/wolfclu_test.py index 59cdf7f3..01c3e500 100644 --- a/tests/wolfclu_test.py +++ b/tests/wolfclu_test.py @@ -99,6 +99,17 @@ def have_oid_table(): return oid_table_probe_name in f.read() +def oid_arcs_truncated(): + """True when OID arcs above 65535 are rejected rather than encoded. + + configure sets TRUNCATED_ENCODE_OBJECT_ID when the linked wolfSSL lacks + wc_EncodeObjectId32, which is compile-time only, so search the binary for + the error message only that build carries. + """ + with open(WOLFSSL_BIN, "rb") as f: + return b"lacks wc_EncodeObjectId32" in f.read() + + def is_fips(): """True when linked against a FIPS wolfSSL build (per `wolfssl -v`).""" r = run_wolfssl("-v") diff --git a/tests/x509/x509-req-test.py b/tests/x509/x509-req-test.py index 82b1153e..e5347f71 100644 --- a/tests/x509/x509-req-test.py +++ b/tests/x509/x509-req-test.py @@ -433,6 +433,10 @@ def _addext_san_line(self, addext, crt_name): "-subj", "CN=test", "-addext", addext, "-x509", "-out", crt) + # RIDs that wolfSSL_OBJ_txt2obj rejects need wolfCLU_OidStrToDer + if (r.returncode != 0 and + "OID encoding is not compiled in" in r.stdout + r.stderr): + self.skipTest("built without OID encoding support") self.assertEqual(r.returncode, 0, r.stderr) r2 = run_wolfssl("x509", "-in", crt, "-text", "-noout") @@ -466,6 +470,38 @@ def test_req_addext_san_rid(self): self.assertIsNotNone(san, "SAN not found in cert output") self.assertIn("Registered ID:1.2.3.4", san) + def test_req_addext_san_rid_manual_encode(self): + """A dotted RID wolfSSL_OBJ_txt2obj rejects is encoded by wolfCLU. + + txt2obj refuses a second arc above 127, so 2.999.1 (the X.660 + example arc) falls through to wolfCLU_OidStrToDer. The encoder's + validation and large-arc handling are covered in asn1-test.py. + """ + san = self._addext_san_line("subjectAltName=RID:2.999.1", + "test_req_addext_rid_manual.crt") + self.assertIsNotNone(san, "SAN not found in cert output") + self.assertIn("Registered ID:2.999.1", san) + + def test_req_addext_san_rid_manual_encode_max_components(self): + """A manually encoded RID with ASN1_OID_DOTTED_MAX_SZ (16) arcs.""" + rid = "2.999." + ".".join(str(i) for i in range(1, 15)) + san = self._addext_san_line("subjectAltName=RID:" + rid, + "test_req_addext_rid_16arcs.crt") + self.assertIsNotNone(san, "SAN not found in cert output") + self.assertIn("Registered ID:" + rid, san) + + def test_req_addext_san_rid_invalid(self): + """An invalid dotted RID is rejected rather than encoded.""" + crt = _tmp("test_req_addext_rid_bad.crt") + self._clean(crt) + r = run_wolfssl("req", "-new", "-days", "3650", + "-key", os.path.join(CERTS_DIR, "server-key.pem"), + "-subj", "CN=test", + "-addext", "subjectAltName=RID:3.1", + "-x509", "-out", crt) + self.assertNotEqual(r.returncode, 0) + self.assertIn("bad RID found", r.stdout + r.stderr) + def test_req_addext_san_ipv6(self): """req -addext subjectAltName=IP: keeps colons in the value. diff --git a/wolfCLU.vcxproj.filters b/wolfCLU.vcxproj.filters index 5ce9c503..ab6e9eba 100644 --- a/wolfCLU.vcxproj.filters +++ b/wolfCLU.vcxproj.filters @@ -129,6 +129,12 @@ Source Files + + Source Files + + + Source Files + Source Files @@ -206,6 +212,9 @@ Header Files + + Header Files + Header Files diff --git a/wolfclu/asn1/clu_asn1.h b/wolfclu/asn1/clu_asn1.h index f41016cb..7c9c3127 100644 --- a/wolfclu/asn1/clu_asn1.h +++ b/wolfclu/asn1/clu_asn1.h @@ -41,7 +41,11 @@ typedef struct WOLFCLU_ASN1_PARSE_OPTIONS #if !defined(WOLFCLU_NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT) { XFILE inputFile; - XFILE outputFile; + /* -out is opened only once the -offset/-length/-strparse selection + * succeeds, so a failed selection leaves it untouched and -in may name + * the same file. As with OpenSSL, the DER is written before it is + * parsed, so a parse failure after that still overwrites -out. */ + const char* outputPath; XFILE oidFile; Asn1OidToNameCb nameCb; word32 strParse[WOLFCLU_ASN1_STR_PARSE_CAP]; diff --git a/wolfclu/asn1/clu_oid_name_table.h b/wolfclu/asn1/clu_oid_name_table.h index 57b33a93..4ffb298d 100644 --- a/wolfclu/asn1/clu_oid_name_table.h +++ b/wolfclu/asn1/clu_oid_name_table.h @@ -21,9 +21,6 @@ #ifndef CLU_OID_NAME_TABLE_H #define CLU_OID_NAME_TABLE_H -#ifdef HAVE_CONFIG_H - #include -#endif #include typedef struct OidName{ diff --git a/wolfclu/clu_header_main.h b/wolfclu/clu_header_main.h index 9372e06a..c85f49b3 100644 --- a/wolfclu/clu_header_main.h +++ b/wolfclu/clu_header_main.h @@ -112,12 +112,21 @@ extern "C" { #include #endif -/* API break introduced in 5.9.3 so compile out affected functionality - * when using previous version */ -#if LIBWOLFSSL_VERSION_HEX <= 0x05009002 -#ifndef NO_WC_ENCODE_OBJECT_ID - #define NO_WC_ENCODE_OBJECT_ID +/* dotted OID strings can be DER encoded (wolfCLU_OidStrToDer). configure + * sets NO_WC_ENCODE_OBJECT_ID when wolfSSL does not export the encoder and + * TRUNCATED_ENCODE_OBJECT_ID when it lacks wc_EncodeObjectId32 */ +#if defined(HAVE_OID_ENCODING) && !defined(NO_WC_ENCODE_OBJECT_ID) + #define WOLFCLU_OID_ENCODE #endif + +/* builds without configure (user_settings.h, e.g. the Visual Studio project) + * can't probe for wc_EncodeObjectId32. No release up to 5.9.4 exports it, so + * fall back to the word16 encoder there; define WOLFCLU_ENCODE_OBJECT_ID32 + * when building against a newer wolfSSL master that has it. */ +#if defined(WOLFSSL_USER_SETTINGS) && !defined(TRUNCATED_ENCODE_OBJECT_ID) && \ + !defined(WOLFCLU_ENCODE_OBJECT_ID32) && \ + LIBWOLFSSL_VERSION_HEX <= 0x05009004 + #define TRUNCATED_ENCODE_OBJECT_ID #endif #include @@ -460,14 +469,26 @@ int wolfCLU_hmacHash(WOLFSSL_HMAC_CTX *ctx, void* key, word32 keyLen, /* convert string to word32. * - * @param str input string of digits. + * @param arg input string of digits. * @param strSz size of input string. * @param out pointer to word32 that out put will be placed in on success. - * @return wolfCLU_FATAL_ERROR of str contains non-digit - * characters or overflows word32 size. + * @return WOLFCLU_SUCCESS on success, WOLFCLU_FATAL_ERROR if arg + * contains non-digit characters or overflows word32 size. * */ int wolfCLU_StrToWord32(const char* arg, unsigned long strSz, word32* out); +/* convert dotted-decimal OID string to DER content octets (no tag/length). + * + * @param oidStr dotted OID such as "1.2.840.113549", at most + * ASN1_OID_DOTTED_MAX_SZ components. + * @param out buffer for the encoding, may alias oidStr since the + * whole string is parsed before out is written. + * @param outSz in: size of out, out: size of the encoding. + * @return WOLFCLU_SUCCESS on success, WOLFCLU_FATAL_ERROR on + * failure (the reason is logged unless an argument is NULL). + * */ +int wolfCLU_OidStrToDer(const char* oidStr, byte* out, word32* outSz); + /** * @brief Used to create a hash from a specified algorithm *