Appendix B. 1993 ASN.1 Structures and OIDs


B.1 Explicitly Tagged Module, 1993 Syntax

PKIX1Explicit93 {iso(1) identified-organization(3) dod(6) internet(1)
   security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-93(3)}


DEFINITIONS EXPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL --

IMPORTS
        authorityKeyIdentifier, subjectKeyIdentifier, keyUsage,
           extendedKeyUsage, privateKeyUsagePeriod, certificatePolicies,
           policyMappings, subjectAltName, issuerAltName,
           basicConstraints, nameConstraints, policyConstraints,
           cRLDistributionPoints, subjectDirectoryAttributes,
           cRLNumber, reasonCode, instructionCode, invalidityDate,
           issuingDistributionPoint, certificateIssuer,
           deltaCRLIndicator, authorityInfoAccess, id-ce
           FROM PKIX1Implicit93 {iso(1) identified-organization(3)
           dod(6) internet(1) security(5) mechanisms(5) pkix(7)
           id-mod(0) id-pkix1-implicit-93(4)} ;

--
                   --  Locally defined OIDs  --

id-pkix  OBJECT IDENTIFIER  ::=
         { iso(1) identified-organization(3) dod(6) internet(1)
                    security(5) mechanisms(5) pkix(7) }

-- PKIX arcs
-- arc for private certificate extensions
id-pe OBJECT IDENTIFIER  ::=  { id-pkix 1 }
 -- arc for policy qualifier types
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
-- arc for extended key purpose OIDS
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- arc for access descriptors
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }

-- policyQualifierIds for Internet policy qualifiers
id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
        -- OID for CPS qualifier

id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }
        -- OID for user notice qualifier

-- based on excerpts from AuthenticationFramework
--    {joint-iso-ccitt ds(5) modules(1) authenticationFramework(7) 2}

               -- Public Key Certificate --

Certificate            ::=   SIGNED { SEQUENCE {
   version                 [0]   Version DEFAULT v1,
   serialNumber                  CertificateSerialNumber,
   signature                     AlgorithmIdentifier,
   issuer                        Name,
   validity                      Validity,
   subject                       Name,
   subjectPublicKeyInfo          SubjectPublicKeyInfo,
   issuerUniqueIdentifier  [1]   IMPLICIT UniqueIdentifier OPTIONAL,
                              ---if present, version shall be v2 or v3--
   subjectUniqueIdentifier [2]   IMPLICIT UniqueIdentifier OPTIONAL,
                              ---if present, version shall be v2 or v3--
   extensions              [3]   Extensions OPTIONAL
                              --if present, version shall be v3--}  }

UniqueIdentifier        ::=  BIT STRING

Version                 ::=  INTEGER { v1(0), v2(1), v3(2) }

CertificateSerialNumber ::=  INTEGER

Validity                        ::=     SEQUENCE {
   notBefore            Time,
   notAfter             Time }

Time ::= CHOICE {
        utcTime         UTCTime,
        generalTime             GeneralizedTime }

SubjectPublicKeyInfo    ::=     SEQUENCE{
   algorithm            AlgorithmIdentifier,
   subjectPublicKey     BIT STRING}

Extensions        ::=   SEQUENCE SIZE (1..MAX) OF Extension

Extension         ::=   SEQUENCE {
   extnId            EXTENSION.&id ({ExtensionSet}),
   critical          BOOLEAN DEFAULT FALSE,
   extnValue         OCTET STRING }
                -- contains a DER encoding of a value of type

                -- &ExtnType for the
                -- extension object identified by extnId --

-- The following information object set is defined to constrain the
-- set of legal certificate extensions.

ExtensionSet    EXTENSION       ::=     { authorityKeyIdentifier |
                                        subjectKeyIdentifier |
                                        keyUsage |
                                        extendedKeyUsage |
                                        privateKeyUsagePeriod |
                                        certificatePolicies |
                                        policyMappings |
                                        subjectAltName |
                                        issuerAltName |
                                        basicConstraints |
                                        nameConstraints |
                                        policyConstraints |
                                        cRLDistributionPoints |
                                        subjectDirectoryAttributes |
                                        authorityInfoAccess }

EXTENSION       ::=     CLASS {
   &id          OBJECT IDENTIFIER UNIQUE,
   &ExtnType }
WITH SYNTAX  {
   SYNTAX               &ExtnType
   IDENTIFIED BY        &id }

                  -- Certificate Revocation List --

CertificateList ::=    SIGNED { SEQUENCE {
   version                Version  OPTIONAL, -- if present, shall be v2
   signature              AlgorithmIdentifier,
   issuer                 Name,
   thisUpdate             Time,
   nextUpdate             Time OPTIONAL,
   revokedCertificates    SEQUENCE OF SEQUENCE {
   userCertificate        CertificateSerialNumber,
   revocationDate         Time,
   crlEntryExtensions     EntryExtensions OPTIONAL } OPTIONAL,
   crlExtensions          [0]   CRLExtensions OPTIONAL }}

CRLExtensions        ::=        SEQUENCE SIZE (1..MAX) OF CRLExtension

CRLExtension         ::=        SEQUENCE {
   extnId            EXTENSION.&id ({CRLExtensionSet}),
   critical          BOOLEAN DEFAULT FALSE,

   extnValue         OCTET STRING }
                -- contains a DER encoding of a value of type
                -- &ExtnType for the
                -- extension object identified by extnId --

-- The following information object set is defined to constrain the
-- set of legal CRL extensions.

CRLExtensionSet EXTENSION       ::=     { authorityKeyIdentifier |
                                        issuerAltName |
                                        cRLNumber |
                                        deltaCRLIndicator |
                                        issuingDistributionPoint }

-- EXTENSION defined above for certificates

EntryExtensions        ::=      SEQUENCE SIZE (1..MAX) OF EntryExtension

EntryExtension         ::=      SEQUENCE {
   extnId            EXTENSION.&id ({EntryExtensionSet}),
   critical          BOOLEAN DEFAULT FALSE,
   extnValue         OCTET STRING }
                -- contains a DER encoding of a value of type
                -- &ExtnType for the
                -- extension object identified by extnId --

-- The following information object set is defined to constrain the
-- set of legal CRL entry extensions.

EntryExtensionSet       EXTENSION       ::=     { reasonCode |
                                                instructionCode |
                                                invalidityDate |
                                                certificateIssuer }

         -- information object classes used in the defintion --
                    -- of certificates and CRLs --

-- Parameterized Type SIGNED --

  SIGNED { ToBeSigned } ::= SEQUENCE {
     toBeSigned  ToBeSigned,
     algorithm   AlgorithmIdentifier,
     signature   BIT STRING
  }

-- Definition of AlgorithmIdentifier
-- ISO definition was:
--

-- AlgorithmIdentifier     ::=  SEQUENCE {
--   algorithm          ALGORITHM.&id({SupportedAlgorithms}),
--   parameters         ALGORITHM.&Type({SupportedAlgorithms}
--                                         { @algorithm}) OPTIONAL }
-- Definition of ALGORITHM
-- ALGORITHM    ::=     TYPE-IDENTIFIER

-- The following PKIX definition replaces the X.509 definition
--

AlgorithmIdentifier     ::=  SEQUENCE {
   algorithm            ALGORITHM-ID.&id({SupportedAlgorithms}),
   parameters           ALGORITHM-ID.&Type({SupportedAlgorithms}
                                           { @algorithm}) OPTIONAL }

-- Definition of ALGORITHM-ID

 ALGORITHM-ID ::= CLASS {
     &id    OBJECT IDENTIFIER UNIQUE,
     &Type  OPTIONAL
  }
     WITH SYNTAX { OID &id [PARMS &Type] }

-- The definition of SupportedAlgorithms may be modified as this
-- document does not specify a mandatory algorithm set.  In addition,
-- the set is specified as extensible, since additional algorithms
-- may be supported

SupportedAlgorithms     ALGORITHM-ID  ::=       { ..., -- extensible
                                            rsaPublicKey |
                                            rsaSHA-1  |
                                            rsaMD5 |
                                            rsaMD2 |
                                            dssPublicKey |
                                            dsaSHA-1 |
                                            dhPublicKey }

-- OIDs and parameter structures for ALGORITHM-IDs used
-- in this specification

rsaPublicKey ALGORITHM-ID ::= { OID rsaEncryption PARMS NULL }

rsaSHA-1 ALGORITHM-ID ::= { OID sha1WithRSAEncryption PARMS NULL }

rsaMD5 ALGORITHM-ID ::= { OID md5WithRSAEncryption PARMS NULL  }

rsaMD2 ALGORITHM-ID ::= { OID md2WithRSAEncryption PARMS NULL  }

dssPublicKey ALGORITHM-ID ::= { OID id-dsa PARMS Dss-Parms }

dsaSHA-1 ALGORITHM-ID ::= { OID id-dsa-with-sha1 }

dhPublicKey ALGORITHM-ID ::= {OID dhpublicnumber PARMS DomainParameters}

-- algorithm identifiers and parameter structures

pkcs-1 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }

rsaEncryption OBJECT IDENTIFIER ::=  { pkcs-1 1 }

md2WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 2 }

md5WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 4 }

sha1WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 5 }

id-dsa-with-sha1 OBJECT IDENTIFIER ::=  {
     iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }

Dss-Sig-Value  ::=  SEQUENCE  {
     r       INTEGER,
     s       INTEGER  }

dhpublicnumber OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }

DomainParameters ::= SEQUENCE {
     p       INTEGER, -- odd prime, p=jq +1
     g       INTEGER, -- generator, g
     q       INTEGER, -- factor of p-1
     j       INTEGER OPTIONAL, -- subgroup factor, j>= 2
     validationParms  ValidationParms OPTIONAL }

ValidationParms ::= SEQUENCE {
     seed             BIT STRING,
     pgenCounter      INTEGER }

id-dsa OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }

Dss-Parms  ::=  SEQUENCE  {
     p             INTEGER,
     q             INTEGER,
     g             INTEGER  }

     -- The ASN.1 in this section supports the Name type
     -- and the directoryAttribute extension

-- attribute data types --

Attribute       ::=     SEQUENCE {
        type            ATTRIBUTE.&id ({SupportedAttributes}),
        values  SET SIZE (1 .. MAX) OF ATTRIBUTE.&Type
                        ({SupportedAttributes}{@type})}

AttributeTypeAndValue           ::=     SEQUENCE {
        type            ATTRIBUTE.&id ({SupportedAttributes}),
        value   ATTRIBUTE.&Type ({SupportedAttributes}{@type})}

-- naming data types --

Name            ::=     CHOICE { -- only one possibility for now --
                                        rdnSequence  RDNSequence }

RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

RelativeDistinguishedName       ::=
                SET SIZE (1 .. MAX) OF AttributeTypeAndValue

ID     ::=    OBJECT IDENTIFIER

-- ATTRIBUTE information object class specification
--  Note: This has been greatly simplified for PKIX !!

ATTRIBUTE               ::=     CLASS {
        &Type,
        &id                     OBJECT IDENTIFIER UNIQUE }
WITH SYNTAX {
        WITH SYNTAX &Type ID &id }

-- suggested naming attributes
--      Definition of the following information object set may be
--    augmented to meet local requirements.  Note that deleting
--    members of the set may prevent interoperability with
--    conforming implementations.

SupportedAttributes     ATTRIBUTE       ::=     {
                name | commonName | surname | givenName | initials |
                generationQualifier | dnQualifier | countryName |
                localityName | stateOrProvinceName | organizationName |
                        organizationalUnitName | title | pkcs9email }

name ATTRIBUTE  ::=     {

        WITH SYNTAX                     DirectoryString { ub-name }
        ID                              id-at-name }

commonName ATTRIBUTE    ::=     {
        WITH SYNTAX                     DirectoryString {ub-common-name}
        ID                              id-at-commonName }

surname ATTRIBUTE       ::=             {
        WITH SYNTAX                     DirectoryString {ub-name}
        ID                              id-at-surname }

givenName ATTRIBUTE     ::=             {
        WITH SYNTAX                     DirectoryString {ub-name}
        ID                              id-at-givenName }

initials ATTRIBUTE      ::=             {
        WITH SYNTAX                     DirectoryString {ub-name}
        ID                              id-at-initials }

generationQualifier ATTRIBUTE   ::=             {
        WITH SYNTAX                     DirectoryString {ub-name}
        ID                              id-at-generationQualifier}

dnQualifier ATTRIBUTE   ::=     {
        WITH SYNTAX                     PrintableString
        ID                              id-at-dnQualifier }


countryName ATTRIBUTE   ::=     {
        WITH SYNTAX                     PrintableString (SIZE (2))
                                                -- IS 3166 codes only
        ID                              id-at-countryName }

localityName ATTRIBUTE  ::=     {
        WITH SYNTAX             DirectoryString {ub-locality-name}
        ID                      id-at-localityName }

stateOrProvinceName ATTRIBUTE   ::=     {
        WITH SYNTAX             DirectoryString {ub-state-name}
        ID                      id-at-stateOrProvinceName }

organizationName ATTRIBUTE      ::=     {
        WITH SYNTAX             DirectoryString {ub-organization-name}
        ID                      id-at-organizationName }

organizationalUnitName ATTRIBUTE        ::=     {
        WITH SYNTAX  DirectoryString {ub-organizational-unit-name}
        ID                      id-at-organizationalUnitName }

title ATTRIBUTE ::=                     {
        WITH SYNTAX             DirectoryString {ub-title}
        ID                      id-at-title }

 -- Legacy attributes

pkcs9email ATTRIBUTE ::= {
        WITH SYNTAX                     PHGString,
        ID                              emailAddress }

PHGString ::= IA5String (SIZE(1..ub-emailaddress-length))

pkcs-9 OBJECT IDENTIFIER ::=
       { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 }

emailAddress OBJECT IDENTIFIER ::= { pkcs-9 1 }

    -- object identifiers for Name type and directory attribute support

-- Object identifier assignments --

id-at   OBJECT IDENTIFIER       ::=     {joint-iso-ccitt(2) ds(5) 4}

-- Attributes --

id-at-commonName        OBJECT IDENTIFIER       ::=     {id-at 3}
id-at-surname           OBJECT IDENTIFIER       ::=     {id-at 4}
id-at-countryName       OBJECT IDENTIFIER       ::=     {id-at 6}
id-at-localityName      OBJECT IDENTIFIER       ::=     {id-at 7}
id-at-stateOrProvinceName     OBJECT IDENTIFIER ::= {id-at 8}
id-at-organizationName        OBJECT IDENTIFIER ::= {id-at 10}
id-at-organizationalUnitName  OBJECT IDENTIFIER ::= {id-at 11}
id-at-title             OBJECT IDENTIFIER       ::=     {id-at 12}
id-at-name              OBJECT IDENTIFIER       ::=     {id-at 41}
id-at-givenName         OBJECT IDENTIFIER       ::=     {id-at 42}
id-at-initials          OBJECT IDENTIFIER       ::=     {id-at 43}
id-at-generationQualifier   OBJECT IDENTIFIER   ::=     {id-at 44}
id-at-dnQualifier       OBJECT IDENTIFIER       ::=     {id-at 46}

-- Directory string type, used extensively in Name types --

DirectoryString { INTEGER:maxSize } ::= CHOICE {
        teletexString           TeletexString (SIZE (1..maxSize)),
        printableString         PrintableString (SIZE (1..maxSize)),
        universalString         UniversalString (SIZE (1..maxSize)),
        bmpString               BMPString (SIZE(1..maxSize)),
        utf8String              UTF8String (SIZE(1..maxSize))
                            }

     -- End of ASN.1 for Name type and directory attribute support --

     -- The ASN.1 in this section supports X.400 style names   --
     -- for implementations that use the x400Address component --
     -- of GeneralName.                                        --

ORAddress ::= SEQUENCE {
   built-in-standard-attributes BuiltInStandardAttributes,
   built-in-domain-defined-attributes
                        BuiltInDomainDefinedAttributes OPTIONAL,
   -- see also teletex-domain-defined-attributes
   extension-attributes ExtensionAttributes OPTIONAL }

--  The OR-address is semantically absent from the OR-name if the
--  built-in-standard-attribute sequence is empty and the
--  built-in-domain-defined-attributes and extension-attributes are
--  both omitted.

--      Built-in Standard Attributes

BuiltInStandardAttributes ::= SEQUENCE {
   country-name CountryName OPTIONAL,
   administration-domain-name AdministrationDomainName OPTIONAL,
   network-address      [0] NetworkAddress OPTIONAL,
   -- see also extended-network-address
   terminal-identifier  [1] TerminalIdentifier OPTIONAL,
   private-domain-name  [2] PrivateDomainName OPTIONAL,
   organization-name    [3] OrganizationName OPTIONAL,
   -- see also teletex-organization-name
   numeric-user-identifier      [4] NumericUserIdentifier OPTIONAL,
   personal-name        [5] PersonalName OPTIONAL,
   -- see also teletex-personal-name
   organizational-unit-names    [6] OrganizationalUnitNames OPTIONAL
   -- see also teletex-organizational-unit-names -- }

CountryName ::= [APPLICATION 1] CHOICE {
   x121-dcc-code NumericString
                (SIZE (ub-country-name-numeric-length)),
   iso-3166-alpha2-code PrintableString
                (SIZE (ub-country-name-alpha-length)) }

AdministrationDomainName ::= [APPLICATION 2] CHOICE {
   numeric NumericString (SIZE (0..ub-domain-name-length)),
   printable PrintableString (SIZE (0..ub-domain-name-length)) }

NetworkAddress ::= X121Address
-- see also extended-network-address

X121Address ::= NumericString (SIZE (1..ub-x121-address-length))

TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))

PrivateDomainName ::= CHOICE {
   numeric NumericString (SIZE (1..ub-domain-name-length)),
   printable PrintableString (SIZE (1..ub-domain-name-length)) }

OrganizationName ::= PrintableString
                           (SIZE (1..ub-organization-name-length))
-- see also teletex-organization-name

NumericUserIdentifier ::= NumericString
                             (SIZE (1..ub-numeric-user-id-length))

PersonalName ::= SET {
   surname    [0] PrintableString (SIZE (1..ub-surname-length)),
   given-name [1] PrintableString
                        (SIZE (1..ub-given-name-length)) OPTIONAL,
   initials   [2] PrintableString
                        (SIZE (1..ub-initials-length)) OPTIONAL,
   generation-qualifier [3] PrintableString
                (SIZE (1..ub-generation-qualifier-length)) OPTIONAL}
-- see also teletex-personal-name

OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
                                        OF OrganizationalUnitName
-- see also teletex-organizational-unit-names

OrganizationalUnitName ::= PrintableString (SIZE
                        (1..ub-organizational-unit-name-length))

--      Built-in Domain-defined Attributes
BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
                                (1..ub-domain-defined-attributes) OF
                                BuiltInDomainDefinedAttribute

BuiltInDomainDefinedAttribute ::= SEQUENCE {
   type PrintableString (SIZE
                (1..ub-domain-defined-attribute-type-length)),
   value PrintableString (SIZE
                (1..ub-domain-defined-attribute-value-length)) }

--      Extension Attributes

ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes)
                                        OF ExtensionAttribute
ExtensionAttribute ::= SEQUENCE {

        extension-attribute-type [0] EXTENSION-ATTRIBUTE.&id
                                        ({ExtensionAttributeTable}),
        extension-attribute-value [1] EXTENSION-ATTRIBUTE.&Type
             ({ExtensionAttributeTable} {@extension-attribute-type}) }

EXTENSION-ATTRIBUTE ::= CLASS {
        &id     INTEGER (0..ub-extension-attributes) UNIQUE,
        &Type }
WITH SYNTAX {&Type IDENTIFIED BY &id}

ExtensionAttributeTable EXTENSION-ATTRIBUTE ::= {
        common-name |
        teletex-common-name |
        teletex-organization-name |
        teletex-personal-name |
        teletex-organizational-unit-names |
        teletex-domain-defined-attributes |
        pds-name |
        physical-delivery-country-name |
        postal-code |
        physical-delivery-office-name |
        physical-delivery-office-number |
        extension-OR-address-components |
        physical-delivery-personal-name |
        physical-delivery-organization-name |
        extension-physical-delivery-address-components |
        unformatted-postal-address |
        street-address |
        post-office-box-address |
        poste-restante-address |
        unique-postal-name |
        local-postal-attributes |
        extended-network-address |
        terminal-type }

--      Extension Standard Attributes

common-name EXTENSION-ATTRIBUTE ::= {CommonName IDENTIFIED BY 1}

CommonName ::= PrintableString (SIZE (1..ub-common-name-length))

teletex-common-name EXTENSION-ATTRIBUTE ::=
                {TeletexCommonName IDENTIFIED BY 2}

TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))

teletex-organization-name EXTENSION-ATTRIBUTE ::=
                {TeletexOrganizationName IDENTIFIED BY 3}

TeletexOrganizationName ::=
                TeletexString (SIZE (1..ub-organization-name-length))

teletex-personal-name EXTENSION-ATTRIBUTE ::=
                {TeletexPersonalName IDENTIFIED BY 4}

TeletexPersonalName ::= SET {
   surname [0] TeletexString (SIZE (1..ub-surname-length)),
   given-name [1] TeletexString
                (SIZE (1..ub-given-name-length)) OPTIONAL,
   initials [2] TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
   generation-qualifier [3] TeletexString (SIZE
                (1..ub-generation-qualifier-length)) OPTIONAL }

teletex-organizational-unit-names EXTENSION-ATTRIBUTE ::=
   {TeletexOrganizationalUnitNames IDENTIFIED BY 5}

TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
        (1..ub-organizational-units) OF TeletexOrganizationalUnitName

TeletexOrganizationalUnitName ::= TeletexString
                        (SIZE (1..ub-organizational-unit-name-length))

pds-name EXTENSION-ATTRIBUTE ::= {PDSName IDENTIFIED BY 7}

PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))

physical-delivery-country-name EXTENSION-ATTRIBUTE ::=
   {PhysicalDeliveryCountryName IDENTIFIED BY 8}

PhysicalDeliveryCountryName ::= CHOICE {
   x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
   iso-3166-alpha2-code PrintableString
                        (SIZE (ub-country-name-alpha-length)) }

postal-code EXTENSION-ATTRIBUTE ::= {PostalCode IDENTIFIED BY 9}

PostalCode ::= CHOICE {
   numeric-code NumericString (SIZE (1..ub-postal-code-length)),
   printable-code PrintableString (SIZE (1..ub-postal-code-length)) }

physical-delivery-office-name EXTENSION-ATTRIBUTE ::=
                        {PhysicalDeliveryOfficeName IDENTIFIED BY 10}

PhysicalDeliveryOfficeName ::= PDSParameter

physical-delivery-office-number EXTENSION-ATTRIBUTE ::=
   {PhysicalDeliveryOfficeNumber IDENTIFIED BY 11}

PhysicalDeliveryOfficeNumber ::= PDSParameter

extension-OR-address-components EXTENSION-ATTRIBUTE ::=
   {ExtensionORAddressComponents IDENTIFIED BY 12}

ExtensionORAddressComponents ::= PDSParameter

physical-delivery-personal-name EXTENSION-ATTRIBUTE ::=
   {PhysicalDeliveryPersonalName IDENTIFIED BY 13}

PhysicalDeliveryPersonalName ::= PDSParameter

physical-delivery-organization-name EXTENSION-ATTRIBUTE ::=
   {PhysicalDeliveryOrganizationName IDENTIFIED BY 14}

PhysicalDeliveryOrganizationName ::= PDSParameter

extension-physical-delivery-address-components EXTENSION-ATTRIBUTE ::=
   {ExtensionPhysicalDeliveryAddressComponents IDENTIFIED BY 15}

ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter

unformatted-postal-address EXTENSION-ATTRIBUTE ::=
                        {UnformattedPostalAddress IDENTIFIED BY 16}

UnformattedPostalAddress ::= SET {
   printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
           PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
   teletex-string TeletexString (SIZE
                         (1..ub-unformatted-address-length)) OPTIONAL }

street-address EXTENSION-ATTRIBUTE ::=
                {StreetAddress IDENTIFIED BY 17}

StreetAddress ::= PDSParameter

post-office-box-address EXTENSION-ATTRIBUTE ::=
                {PostOfficeBoxAddress IDENTIFIED BY 18}

PostOfficeBoxAddress ::= PDSParameter

poste-restante-address EXTENSION-ATTRIBUTE ::=
                {PosteRestanteAddress IDENTIFIED BY 19}

PosteRestanteAddress ::= PDSParameter

unique-postal-name EXTENSION-ATTRIBUTE ::=
                {UniquePostalName IDENTIFIED BY 20}

UniquePostalName ::= PDSParameter

local-postal-attributes EXTENSION-ATTRIBUTE ::=
                {LocalPostalAttributes IDENTIFIED BY 21}

LocalPostalAttributes ::= PDSParameter

PDSParameter ::= SET {
   printable-string PrintableString
            (SIZE(1..ub-pds-parameter-length)) OPTIONAL,
   teletex-string TeletexString
            (SIZE(1..ub-pds-parameter-length)) OPTIONAL }

extended-network-address EXTENSION-ATTRIBUTE ::=
                {ExtendedNetworkAddress IDENTIFIED BY 22}

ExtendedNetworkAddress ::= CHOICE {
        e163-4-address SEQUENCE {
                number [0] NumericString
                   (SIZE (1..ub-e163-4-number-length)),
                sub-address [1] NumericString
                   (SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL},
        psap-address [0] PresentationAddress }

PresentationAddress ::= SEQUENCE {
        pSelector       [0] EXPLICIT OCTET STRING OPTIONAL,
        sSelector       [1] EXPLICIT OCTET STRING OPTIONAL,
        tSelector       [2] EXPLICIT OCTET STRING OPTIONAL,
        nAddresses      [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING}


terminal-type EXTENSION-ATTRIBUTE ::= {TerminalType IDENTIFIED BY 23}

TerminalType ::= INTEGER {
   telex (3),
   teletex (4),
   g3-facsimile (5),
   g4-facsimile (6),
   ia5-terminal (7),
   videotex (8) } (0..ub-integer-options)

--      Extension Domain-defined Attributes

teletex-domain-defined-attributes EXTENSION-ATTRIBUTE ::=
   {TeletexDomainDefinedAttributes IDENTIFIED BY 6}

TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
   (1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute

TeletexDomainDefinedAttribute ::= SEQUENCE {
    type TeletexString
         (SIZE (1..ub-domain-defined-attribute-type-length)),
    value TeletexString
         (SIZE (1..ub-domain-defined-attribute-value-length)) }

--  specifications of Upper Bounds
--  shall be regarded as mandatory
--  from Annex B of ITU-T X.411
--  Reference Definition of MTS Parameter Upper Bounds

--      Upper Bounds
ub-name INTEGER ::=     32768
ub-common-name  INTEGER ::=     64
ub-locality-name        INTEGER ::=     128
ub-state-name   INTEGER ::=     128
ub-organization-name    INTEGER ::=     64
ub-organizational-unit-name     INTEGER ::=     64
ub-title        INTEGER ::=     64
ub-match        INTEGER ::=     128

ub-emailaddress-length INTEGER ::= 128

ub-common-name-length INTEGER ::= 64
ub-country-name-alpha-length INTEGER ::= 2
ub-country-name-numeric-length INTEGER ::= 3
ub-domain-defined-attributes INTEGER ::= 4
ub-domain-defined-attribute-type-length INTEGER ::= 8
ub-domain-defined-attribute-value-length INTEGER ::= 128
ub-domain-name-length INTEGER ::= 16
ub-extension-attributes INTEGER ::= 256
ub-e163-4-number-length INTEGER ::= 15
ub-e163-4-sub-address-length INTEGER ::= 40
ub-generation-qualifier-length INTEGER ::= 3
ub-given-name-length INTEGER ::= 16
ub-initials-length INTEGER ::= 5
ub-integer-options INTEGER ::= 256
ub-numeric-user-id-length INTEGER ::= 32
ub-organization-name-length INTEGER ::= 64
ub-organizational-unit-name-length INTEGER ::= 32
ub-organizational-units INTEGER ::= 4
ub-pds-name-length INTEGER ::= 16
ub-pds-parameter-length INTEGER ::= 30
ub-pds-physical-address-lines INTEGER ::= 6
ub-postal-code-length INTEGER ::= 16
ub-surname-length INTEGER ::= 40
ub-terminal-id-length INTEGER ::= 24
ub-unformatted-address-length INTEGER ::= 180

ub-x121-address-length INTEGER ::= 16

-- Note - upper bounds on TeletexString are measured in characters.
-- A significantly greater number of octets will be required to hold
-- such a value.  As a minimum, 16 octets, or twice the specified upper
-- bound, whichever is the larger, should be allowed.

END

B.2 Implicitly Tagged Module, 1993 Syntax


PKIX1Implicit93  {iso(1) identified-organization(3) dod(6) internet(1)
   security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-implicit-93(4)}

DEFINITIONS IMPLICIT TAGS::=

BEGIN

--EXPORTS ALL --

IMPORTS
        id-pe, id-qt, id-kp, id-ad, id-qt-unotice,
                ORAddress, Name, RelativeDistinguishedName,
                CertificateSerialNumber, CertificateList,
                AlgorithmIdentifier, ub-name, DirectoryString,
                Attribute, EXTENSION
                FROM PKIX1Explicit93 {iso(1) identified-organization(3)
                dod(6) internet(1) security(5) mechanisms(5) pkix(7)
                id-mod(0) id-pkix1-explicit-93(3)};

-- Key and policy information extensions --

authorityKeyIdentifier EXTENSION ::= {
        SYNTAX          AuthorityKeyIdentifier
        IDENTIFIED BY   id-ce-authorityKeyIdentifier }

AuthorityKeyIdentifier ::= SEQUENCE {
    keyIdentifier               [0] KeyIdentifier            OPTIONAL,
    authorityCertIssuer         [1] GeneralNames             OPTIONAL,
    authorityCertSerialNumber   [2] CertificateSerialNumber  OPTIONAL }
        ( WITH COMPONENTS       {..., authorityCertIssuer PRESENT,
                                authorityCertSerialNumber PRESENT} |
         WITH COMPONENTS        {..., authorityCertIssuer ABSENT,
                                authorityCertSerialNumber ABSENT} )

KeyIdentifier ::= OCTET STRING

subjectKeyIdentifier EXTENSION ::= {
        SYNTAX          SubjectKeyIdentifier
        IDENTIFIED BY   id-ce-subjectKeyIdentifier }

SubjectKeyIdentifier ::= KeyIdentifier

keyUsage EXTENSION ::= {
        SYNTAX  KeyUsage
        IDENTIFIED BY id-ce-keyUsage }

KeyUsage ::= BIT STRING {
        digitalSignature     (0),
        nonRepudiation       (1),
        keyEncipherment      (2),
        dataEncipherment     (3),
        keyAgreement         (4),
        keyCertSign          (5),
        cRLSign              (6),
      encipherOnly         (7),
      decipherOnly         (8) }

extendedKeyUsage EXTENSION ::= {
        SYNTAX SEQUENCE SIZE (1..MAX) OF KeyPurposeId
        IDENTIFIED BY id-ce-extKeyUsage }

KeyPurposeId ::= OBJECT IDENTIFIER

-- PKIX-defined extended key purpose OIDs
id-kp-serverAuth      OBJECT IDENTIFIER ::= { id-kp 1 }
id-kp-clientAuth      OBJECT IDENTIFIER ::= { id-kp 2 }
id-kp-codeSigning     OBJECT IDENTIFIER ::= { id-kp 3 }
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
id-kp-ipsecEndSystem  OBJECT IDENTIFIER ::= { id-kp 5 }
id-kp-ipsecTunnel     OBJECT IDENTIFIER ::= { id-kp 6 }
id-kp-ipsecUser       OBJECT IDENTIFIER ::= { id-kp 7 }
id-kp-timeStamping    OBJECT IDENTIFIER ::= { id-kp 8 }

privateKeyUsagePeriod EXTENSION ::= {
        SYNTAX  PrivateKeyUsagePeriod
        IDENTIFIED BY { id-ce-privateKeyUsagePeriod } }

PrivateKeyUsagePeriod ::= SEQUENCE {
        notBefore       [0]     GeneralizedTime OPTIONAL,
        notAfter        [1]     GeneralizedTime OPTIONAL }
        ( WITH COMPONENTS       {..., notBefore PRESENT} |
        WITH COMPONENTS         {..., notAfter PRESENT} )

certificatePolicies EXTENSION ::= {
        SYNTAX  CertificatePoliciesSyntax
        IDENTIFIED BY id-ce-certificatePolicies }

CertificatePoliciesSyntax ::=
                SEQUENCE SIZE (1..MAX) OF PolicyInformation

PolicyInformation ::= SEQUENCE {
        policyIdentifier   CertPolicyId,
        policyQualifiers   SEQUENCE SIZE (1..MAX) OF
                PolicyQualifierInfo OPTIONAL }

CertPolicyId ::= OBJECT IDENTIFIER

PolicyQualifierInfo ::= SEQUENCE {
        policyQualifierId       CERT-POLICY-QUALIFIER.&id
                                    ({SupportedPolicyQualifiers}),
        qualifier               CERT-POLICY-QUALIFIER.&Qualifier
                                    ({SupportedPolicyQualifiers}
                                    {@policyQualifierId})OPTIONAL }

SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::= { noticeToUser |
                                                      pointerToCPS }

CERT-POLICY-QUALIFIER ::= CLASS {
        &id             OBJECT IDENTIFIER UNIQUE,
        &Qualifier      OPTIONAL }
WITH SYNTAX {
        POLICY-QUALIFIER-ID     &id
        [QUALIFIER-TYPE &Qualifier] }

policyMappings EXTENSION ::= {
        SYNTAX  PolicyMappingsSyntax
        IDENTIFIED BY id-ce-policyMappings }

PolicyMappingsSyntax ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
        issuerDomainPolicy           CertPolicyId,
        subjectDomainPolicy          CertPolicyId }

-- Certificate subject and certificate issuer attributes extensions --

subjectAltName EXTENSION ::= {
        SYNTAX  GeneralNames
        IDENTIFIED BY id-ce-subjectAltName }

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

GeneralName ::= CHOICE {
        otherName                   [0] INSTANCE OF OTHER-NAME,
        rfc822Name                  [1] IA5String,
        dNSName                     [2] IA5String,
        x400Address                 [3] ORAddress,
        directoryName               [4] Name,
        ediPartyName                [5] EDIPartyName,
        uniformResourceIdentifier   [6] IA5String,
        iPAddress                   [7] OCTET STRING,
        registeredID                [8] OBJECT IDENTIFIER }

OTHER-NAME ::= TYPE-IDENTIFIER

EDIPartyName ::= SEQUENCE {
        nameAssigner        [0] DirectoryString {ub-name} OPTIONAL,
        partyName           [1] DirectoryString {ub-name} }

issuerAltName EXTENSION ::= {
        SYNTAX  GeneralNames
        IDENTIFIED BY id-ce-issuerAltName }

subjectDirectoryAttributes EXTENSION ::= {
        SYNTAX  AttributesSyntax
        IDENTIFIED BY id-ce-subjectDirectoryAttributes }

AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute

-- Certification path constraints extensions --

basicConstraints EXTENSION ::= {
        SYNTAX  BasicConstraintsSyntax
        IDENTIFIED BY id-ce-basicConstraints }

BasicConstraintsSyntax ::= SEQUENCE {
        cA                      BOOLEAN DEFAULT FALSE,
        pathLenConstraint       INTEGER (0..MAX) OPTIONAL }

nameConstraints EXTENSION ::= {
        SYNTAX  NameConstraintsSyntax
        IDENTIFIED BY id-ce-nameConstraints }

NameConstraintsSyntax ::= SEQUENCE {
        permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
        excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }

GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree

GeneralSubtree ::= SEQUENCE {
        base                    GeneralName,
        minimum         [0]     BaseDistance DEFAULT 0,
        maximum         [1]     BaseDistance OPTIONAL }

BaseDistance ::= INTEGER (0..MAX)

policyConstraints EXTENSION ::= {
        SYNTAX  PolicyConstraintsSyntax
        IDENTIFIED BY id-ce-policyConstraints }

PolicyConstraintsSyntax ::= SEQUENCE {
        requireExplicitPolicy   [0] SkipCerts OPTIONAL,
        inhibitPolicyMapping    [1] SkipCerts OPTIONAL }

SkipCerts ::= INTEGER (0..MAX)

-- Basic CRL extensions --

cRLNumber EXTENSION ::= {
        SYNTAX  CRLNumber
        IDENTIFIED BY id-ce-cRLNumber }

CRLNumber ::= INTEGER (0..MAX)

reasonCode EXTENSION ::= {
        SYNTAX  CRLReason
        IDENTIFIED BY id-ce-reasonCode }

CRLReason ::= ENUMERATED {
        unspecified             (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
        removeFromCRL           (8) }

instructionCode EXTENSION ::= {
        SYNTAX  HoldInstruction
        IDENTIFIED BY id-ce-instructionCode }

HoldInstruction ::= OBJECT IDENTIFIER

-- holdinstructions described in this specification, from ANSI x9

-- ANSI x9 arc holdinstruction arc
holdInstruction OBJECT IDENTIFIER ::= {
     joint-iso-ccitt(2) member-body(2) us(840) x9cm(10040) 2}

-- ANSI X9 holdinstructions referenced by this standard
id-holdinstruction-none OBJECT IDENTIFIER ::= {holdInstruction 1}
id-holdinstruction-callissuer OBJECT IDENTIFIER ::= {holdInstruction 2}
id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}

invalidityDate EXTENSION ::= {
        SYNTAX  GeneralizedTime
        IDENTIFIED BY id-ce-invalidityDate }

-- CRL distribution points and delta-CRL extensions --

cRLDistributionPoints EXTENSION ::= {

        SYNTAX  CRLDistPointsSyntax
        IDENTIFIED BY id-ce-cRLDistributionPoints }

CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

DistributionPoint ::= SEQUENCE {
        distributionPoint       [0]     DistributionPointName OPTIONAL,
        reasons         [1]     ReasonFlags OPTIONAL,
        cRLIssuer               [2]     GeneralNames OPTIONAL }

DistributionPointName ::= CHOICE {
        fullName                [0]     GeneralNames,
        nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

ReasonFlags ::= BIT STRING {
        unused                  (0),
        keyCompromise           (1),
        caCompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6) }

issuingDistributionPoint EXTENSION ::= {
        SYNTAX  IssuingDistPointSyntax
        IDENTIFIED BY id-ce-issuingDistributionPoint }

IssuingDistPointSyntax ::= SEQUENCE {
        distributionPoint       [0] DistributionPointName OPTIONAL,
        onlyContainsUserCerts   [1] BOOLEAN DEFAULT FALSE,
        onlyContainsCACerts     [2] BOOLEAN DEFAULT FALSE,
        onlySomeReasons         [3] ReasonFlags OPTIONAL,
        indirectCRL             [4] BOOLEAN DEFAULT FALSE }

certificateIssuer EXTENSION ::= {
        SYNTAX          GeneralNames
        IDENTIFIED BY id-ce-certificateIssuer }

deltaCRLIndicator EXTENSION ::= {
        SYNTAX          BaseCRLNumber
        IDENTIFIED BY id-ce-deltaCRLIndicator }

BaseCRLNumber ::= CRLNumber

-- Object identifier assignments for ISO certificate extensions --
id-ce   OBJECT IDENTIFIER       ::=     {joint-iso-ccitt(2) ds(5) 29}

id-ce-subjectDirectoryAttributes   OBJECT IDENTIFIER ::= {id-ce 9}

id-ce-subjectKeyIdentifier         OBJECT IDENTIFIER ::= {id-ce 14}
id-ce-keyUsage                     OBJECT IDENTIFIER ::= {id-ce 15}
id-ce-privateKeyUsagePeriod        OBJECT IDENTIFIER ::= {id-ce 16}
id-ce-subjectAltName               OBJECT IDENTIFIER ::= {id-ce 17}
id-ce-issuerAltName                OBJECT IDENTIFIER ::= {id-ce 18}
id-ce-basicConstraints             OBJECT IDENTIFIER ::= {id-ce 19}
id-ce-cRLNumber                    OBJECT IDENTIFIER ::= {id-ce 20}
id-ce-reasonCode                   OBJECT IDENTIFIER ::= {id-ce 21}
id-ce-instructionCode              OBJECT IDENTIFIER ::= {id-ce 23}
id-ce-invalidityDate               OBJECT IDENTIFIER ::= {id-ce 24}
id-ce-deltaCRLIndicator            OBJECT IDENTIFIER ::= {id-ce 27}
id-ce-issuingDistributionPoint     OBJECT IDENTIFIER ::= {id-ce 28}
id-ce-certificateIssuer            OBJECT IDENTIFIER ::= {id-ce 29}
id-ce-nameConstraints              OBJECT IDENTIFIER ::= {id-ce 30}
id-ce-cRLDistributionPoints        OBJECT IDENTIFIER ::= {id-ce 31}
id-ce-certificatePolicies          OBJECT IDENTIFIER ::= {id-ce 32}
id-ce-policyMappings               OBJECT IDENTIFIER ::= {id-ce 33}
id-ce-policyConstraints            OBJECT IDENTIFIER ::= {id-ce 36}
id-ce-authorityKeyIdentifier       OBJECT IDENTIFIER ::= {id-ce 35}
id-ce-extKeyUsage                  OBJECT IDENTIFIER ::= {id-ce 37}

-- PKIX 1 extensions

authorityInfoAccess EXTENSION ::= {
        SYNTAX  AuthorityInfoAccessSyntax
        IDENTIFIED BY id-pe-authorityInfoAccess }

AuthorityInfoAccessSyntax  ::=
        SEQUENCE SIZE (1..MAX) OF AccessDescription

AccessDescription  ::=  SEQUENCE {
        accessMethod          OBJECT IDENTIFIER,
        accessLocation        GeneralName  }

id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }

id-ad-ocsp      OBJECT IDENTIFIER ::= { id-ad 1 }
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }

-- PKIX policy qualifier definitions

noticeToUser CERT-POLICY-QUALIFIER ::= {
     POLICY-QUALIFIER-ID    id-qt-cps QUALIFIER-TYPE       CPSuri}

pointerToCPS CERT-POLICY-QUALIFIER ::= {
     POLICY-QUALIFIER-ID    id-qt-unotice QUALIFIER-TYPE   UserNotice}

id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }

id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }

CPSuri ::= IA5String

UserNotice ::= SEQUENCE {
     noticeRef        NoticeReference OPTIONAL,
     explicitText     DisplayText OPTIONAL}

NoticeReference ::= SEQUENCE {
     organization     DisplayText,
     noticeNumbers    SEQUENCE OF INTEGER }

DisplayText ::= CHOICE {
     visibleString    VisibleString  (SIZE (1..200)),
     bmpString        BMPString      (SIZE (1..200)),
     utf8String       UTF8String     (SIZE (1..200)) }


END

Appendix C. ASN.1 Notes

   The construct "SEQUENCE SIZE (1..MAX) OF" appears in several ASN.1
   constructs. A valid ASN.1 sequence will have zero or more entries.
   The SIZE (1..MAX) construct constrains the sequence to have at least
   one entry. MAX indicates the upper bound is unspecified.
   Implementations are free to choose an upper bound that suits their
   environment.

   The construct "positiveInt ::= INTEGER (0..MAX)" defines positiveInt
   as a subtype of INTEGER containing integers greater than or equal to
   zero.  The upper bound is unspecified. Implementations are free to
   select an upper bound that suits their environment.

   The character string type PrintableString supports a very basic Latin
   character set:  the lower case letters 'a' through 'z', upper case
   letters 'A' through 'Z', the digits '0' through '9', eleven special
   characters ' " ( ) + , - . / : ? and space.

   The character string type TeletexString is a superset of
   PrintableString.  TeletexString supports a fairly standard (ascii-
   like) Latin character set, Latin characters with non-spacing accents
   and Japanese characters.

   The character string type UniversalString supports any of the
   characters allowed by ISO 10646-1. ISO 10646 is the Universal
   multiple-octet coded Character Set (UCS).  ISO 10646-1 specifes the
   architecture and the "basic multilingual plane" - a large standard
   character set which includes all major world character standards.

   The character string type UTF8String will be introduced in the 1998
   version of ASN.1.  UTF8String is a universal type and has been
   assigned tag number 12.  The content of UTF8String was defined by RFC
   2044 and updated in RFC 2279, "UTF-8, a transformation Format of ISP
   10646."  ISO is expected to formally add UTF8String to the list of
   choices for DirectoryString in 1998 as well.

   In anticipation of these changes, and in conformance with IETF Best
   Practices codified in RFC 2277, IETF Policy on Character Sets and
   Languages, this document includes UTF8String as a choice in
   DirectoryString and the CPS qualifier extensions.

Appendix D. Examples

   This section contains four examples: three certificates and a CRL.
   The first two certificates and the CRL comprise a minimal
   certification path.

   Section D.1 contains an annotated hex dump of a "self-signed"
   certificate issued by a CA whose distinguished name is
   cn=us,o=gov,ou=nist.  The certificate contains a DSA public key with
   parameters, and is signed by the corresponding DSA private key.

   Section D.2 contains an annotated hex dump of an end-entity
   certificate.  The end entity certificate contains a DSA public key,
   and is signed by the private key corresponding to the "self-signed"
   certificate in section D.1.

   Section D.3 contains a dump of an end entity certificate which
   contains an RSA public key and is signed with RSA and MD5.  This
   certificate is not part of the minimal certification path.

   Section D.4 contains an annotated hex dump of a CRL.  The CRL is
   issued by the CA whose distinguished name is cn=us,o=gov,ou=nist and
   the list of revoked certificates includes the end entity certificate
   presented in D.2.

D.1 Certificate

   This section contains an annotated hex dump of a 699 byte version 3
   certificate.  The certificate contains the following information:
   (a) the serial number is 17 (11 hex);
   (b) the certificate is signed with DSA and the SHA-1 hash algorithm;
   (c) the issuer's distinguished name is OU=nist; O=gov; C=US
   (d) and the subject's distinguished name is OU=nist; O=gov; C=US
   (e) the certificate was issued on June 30, 1997 and will expire on
   December 31, 1997;
   (f) the certificate contains a 1024 bit DSA public key with
   parameters;
   (g) the certificate contains a subject key identifier extension; and
   (h) the certificate is a CA certificate (as indicated through the
   basic constraints extension.)

0000 30 82 02 b7  695: SEQUENCE
0004 30 82 02 77  631: . SEQUENCE    tbscertificate
0008 a0 03          3: . . [0]
0010 02 01          1: . . . INTEGER 2
                     : 02
0013 02 01          1: . . INTEGER 17
                     : 11

0016 30 09          9: . . SEQUENCE
0018 06 07          7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0027 30 2a         42: . . SEQUENCE
0029 31 0b         11: . . . SET
0031 30 09          9: . . . . SEQUENCE
0033 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0038 13 02          2: . . . . . PrintableString  'US'
                     : 55 53
0042 31 0c         12: . . . SET
0044 30 0a         10: . . . . SEQUENCE
0046 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0051 13 03          3: . . . . . PrintableString  'gov'
                     : 67 6f 76
0056 31 0d         13: . . . SET
0058 30 0b         11: . . . . SEQUENCE
0060 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0065 13 04          4: . . . . . PrintableString  'nist'
                     : 6e 69 73 74
0071 30 1e         30: . . SEQUENCE
0073 17 0d         13: . . . UTCTime  '970630000000Z'
                     : 39 37 30 36 33 30 30 30 30 30 30 30 5a
0088 17 0d         13: . . . UTCTime  '971231000000Z'
                     : 39 37 31 32 33 31 30 30 30 30 30 30 5a
0103 30 2a         42: . . SEQUENCE
0105 31 0b         11: . . . SET
0107 30 09          9: . . . . SEQUENCE
0109 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0114 13 02          2: . . . . . PrintableString  'US'
                     : 55 53
0118 31 0c         12: . . . SET
0120 30 0a         10: . . . . SEQUENCE
0122 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0127 13 03          3: . . . . . PrintableString  'gov'
                     : 67 6f 76
0132 31 0d         13: . . . SET
0134 30 0b         11: . . . . SEQUENCE
0136 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0141 13 04          4: . . . . . PrintableString  'nist'
                     : 6e 69 73 74
0147 30 82 01 b4  436: . . SEQUENCE
0151 30 82 01 29  297: . . . SEQUENCE

0155 06 07          7: . . . . OID 1.2.840.10040.4.1: dsa
                     : 2a 86 48 ce 38 04 01
0164 30 82 01 1c  284: . . . . SEQUENCE
0168 02 81 80     128: . . . . . INTEGER
                     : d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
                     : 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
                     : 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03
                     : 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
                     : 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
                     : 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
                     : 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
                     : f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0299 02 14         20: . . . . . INTEGER
                     : a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
                     : 51 0d dc dd
0321 02 81 80     128: . . . . . INTEGER
                     : 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
                     : 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
                     : d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
                     : a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
                     : ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
                     : a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
                     : 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
                     : cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0452 03 81 84     132: . . . BIT STRING  (0 unused bits)
                     : 02 81 80 aa 98 ea 13 94 a2 db f1 5b 7f 98 2f 78
                     : e7 d8 e3 b9 71 86 f6 80 2f 40 39 c3 da 3b 4b 13
                     : 46 26 ee 0d 56 c5 a3 3a 39 b7 7d 33 c2 6b 5c 77
                     : 92 f2 55 65 90 39 cd 1a 3c 86 e1 32 eb 25 bc 91
                     : c4 ff 80 4f 36 61 bd cc e2 61 04 e0 7e 60 13 ca
                     : c0 9c dd e0 ea 41 de 33 c1 f1 44 a9 bc 71 de cf
                     : 59 d4 6e da 44 99 3c 21 64 e4 78 54 9d d0 7b ba
                     : 4e f5 18 4d 5e 39 30 bf e0 d1 f6 f4 83 25 4f 14
                     : aa 71 e1
0587 a3 32         50: . . [3]
0589 30 30         48: . . . SEQUENCE
0591 30 0f          9: . . . . SEQUENCE
0593 06 03          3: . . . . . OID 2.5.29.19: basicConstraints
                     : 55 1d 13
0598 01 01          1: . . . . . TRUE
                     : ff
0601 04 05          5: . . . . . OCTET STRING
                     : 30 03 01 01 ff
0608 30 1d         29: . SEQUENCE
0610 06 03          3: . . . . . OID 2.5.29.14: subjectKeyIdentifier
                     : 55 1d 0e
0615 04 16         22: . . . . . OCTET STRING
                     : 04 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa d5 ff

                     : 1c 21 e4 22 75 d6
0639 30 09          9: . SEQUENCE
0641 06 07          7: . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0650 03 2f         47: . BIT STRING  (0 unused bits)
                     : 30 2c 02 14 a0 66 c1 76 33 99 13 51 8d 93 64 2f
                     : ca 13 73 de 79 1a 7d 33 02 14 5d 90 f6 ce 92 4a
                     : bf 29 11 24 80 28 a6 5a 8e 73 b6 76 02 68

D.2 Certificate

   This section contains an annotated hex dump of a 730 byte version 3
   certificate.  The certificate contains the following information:
   (a) the serial number is 18 (12 hex);
   (b) the certificate is signed with DSA and the SHA-1 hash algorithm;
   (c) the issuer's distinguished name is OU=nist; O=gov; C=US
   (d) and the subject's distinguished name is CN=Tim Polk; OU=nist;
   O=gov; C=US
   (e) the certificate was valid from July 30, 1997 through December 1,
   1997;
   (f) the certificate contains a 1024 bit DSA public key;
   (g) the certificate is an end entity certificate, as the basic
   constraints extension is not present;
   (h) the certificate contains an authority key identifier extension;
   and
   (i) the certificate includes one alternative name - an RFC 822
   address.

0000 30 82 02 d6  726: SEQUENCE
0004 30 82 02 96  662: . SEQUENCE
0008 a0 03          3: . . [0]
0010 02 01          1: . . . INTEGER 2
                     : 02
0013 02 01          1: . . INTEGER 18
                     : 12
0016 30 09          9: . . SEQUENCE
0018 06 07          7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0027 30 2a         42: . . SEQUENCE
0029 31 0b         11: . . . SET
0031 30 09          9: . . . . SEQUENCE
0033 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0038 13 02          2: . . . . . PrintableString  'US'
                     : 55 53
0042 31 0c         12: . . . SET
0044 30 0a         10: . . . . SEQUENCE
0046 06 03          3: . . . . . OID 2.5.4.10: O

                     : 55 04 0a
0051 13 03          3: . . . . . PrintableString  'gov'
                     : 67 6f 76
0056 31 0d         13: . . . SET
0058 30 0b         11: . . . . SEQUENCE
0060 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0065 13 04          4: . . . . . PrintableString  'nist'
                     : 6e 69 73 74
0071 30 1e         30: . . SEQUENCE
0073 17 0d         13: . . . UTCTime  '970730000000Z'
                     : 39 37 30 37 33 30 30 30 30 30 30 30 5a
0088 17 0d         13: . . . UTCTime  '971201000000Z'
                     : 39 37 31 32 30 31 30 30 30 30 30 30 5a
0103 30 3d         61: . . SEQUENCE
0105 31 0b         11: . . . SET
0107 30 09          9: . . . . SEQUENCE
0109 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0114 13 02          2: . . . . . PrintableString  'US'
                     : 55 53
0118 31 0c         12: . . . SET
0120 30 0a         10: . . . . SEQUENCE
0122 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0127 13 03          3: . . . . . PrintableString  'gov'
                     : 67 6f 76
0132 31 0d         13: . . . SET
0134 30 0b         11: . . . . SEQUENCE
0136 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0141 13 04          4: . . . . . PrintableString  'nist'
                     : 6e 69 73 74
0147 31 11         17: . . . SET
0149 30 0f         15: . . . . SEQUENCE
0151 06 03          3: . . . . . OID 2.5.4.3: CN
                     : 55 04 03
0156 13 08          8: . . . . . PrintableString  'Tim Polk'
                     : 54 69 6d 20 50 6f 6c 6b
0166 30 82 01 b4  436: . . SEQUENCE
0170 30 82 01 29  297: . . . SEQUENCE
0174 06 07          7: . . . . OID 1.2.840.10040.4.1: dsa
                     : 2a 86 48 ce 38 04 01
0183 30 82 01 1c  284: . . . . SEQUENCE
0187 02 81 80     128: . . . . . INTEGER
                     : d4 38 02 c5 35 7b d5 0b a1 7e 5d 72 59 63 55 d3
                     : 45 56 ea e2 25 1a 6b c5 a4 ab aa 0b d4 62 b4 d2
                     : 21 b1 95 a2 c6 01 c9 c3 fa 01 6f 79 86 83 3d 03

                     : 61 e1 f1 92 ac bc 03 4e 89 a3 c9 53 4a f7 e2 a6
                     : 48 cf 42 1e 21 b1 5c 2b 3a 7f ba be 6b 5a f7 0a
                     : 26 d8 8e 1b eb ec bf 1e 5a 3f 45 c0 bd 31 23 be
                     : 69 71 a7 c2 90 fe a5 d6 80 b5 24 dc 44 9c eb 4d
                     : f9 da f0 c8 e8 a2 4c 99 07 5c 8e 35 2b 7d 57 8d
0318 02 14         20: . . . . . INTEGER
                     : a7 83 9b f3 bd 2c 20 07 fc 4c e7 e8 9f f3 39 83
                     : 51 0d dc dd
0340 02 81 80     128: . . . . . INTEGER
                     : 0e 3b 46 31 8a 0a 58 86 40 84 e3 a1 22 0d 88 ca
                     : 90 88 57 64 9f 01 21 e0 15 05 94 24 82 e2 10 90
                     : d9 e1 4e 10 5c e7 54 6b d4 0c 2b 1b 59 0a a0 b5
                     : a1 7d b5 07 e3 65 7c ea 90 d8 8e 30 42 e4 85 bb
                     : ac fa 4e 76 4b 78 0e df 6c e5 a6 e1 bd 59 77 7d
                     : a6 97 59 c5 29 a7 b3 3f 95 3e 9d f1 59 2d f7 42
                     : 87 62 3f f1 b8 6f c7 3d 4b b8 8d 74 c4 ca 44 90
                     : cf 67 db de 14 60 97 4a d1 f7 6d 9e 09 94 c4 0d
0471 03 81 84     132: . . . BIT STRING  (0 unused bits)
                     : 02 81 80 a8 63 b1 60 70 94 7e 0b 86 08 93 0c 0d
                     : 08 12 4a 58 a9 af 9a 09 38 54 3b 46 82 fb 85 0d
                     : 18 8b 2a 77 f7 58 e8 f0 1d d2 18 df fe e7 e9 35
                     : c8 a6 1a db 8d 3d 3d f8 73 14 a9 0b 39 c7 95 f6
                     : 52 7d 2d 13 8c ae 03 29 3c 4e 8c b0 26 18 b6 d8
                     : 11 1f d4 12 0c 13 ce 3f f1 c7 05 4e df e1 fc 44
                     : fd 25 34 19 4a 81 0d dd 98 42 ac d3 b6 91 0c 7f
                     : 16 72 a3 a0 8a d7 01 7f fb 9c 93 e8 99 92 c8 42
                     : 47 c6 43
0606 a3 3e         62: . . [3]
0608 30 3c         60: . . . SEQUENCE
0610 30 19         25: . . . . SEQUENCE
0612 06 03          3: . . . . . OID 2.5.29.17: subjectAltName
                     : 55 1d 11
0617 04 12         18: . . . . . OCTET STRING
                     : 30 10 81 0e 77 70 6f 6c 6b 40 6e 69 73 74 2e 67
                     : 6f 76
0637 30 1f         31: . . . . SEQUENCE
0639 06 03          3: . . . . . OID 2.5.29.35: subjectAltName
                     : 55 1d 23
0644 04 18         24: . . . . . OCTET STRING
                     : 30 16 80 14 e7 26 c5 54 cd 5b a3 6f 35 68 95 aa
                     : d5 ff 1c 21 e4 22 75 d6
0670 30 09          9: . SEQUENCE
0672 06 07          7: . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0681 03 2f         47: . BIT STRING  (0 unused bits)
                     : 30 2c 02 14 3c 02 e0 ab d9 5d 05 77 75 15 71 58
                     : 92 29 48 c4 1c 54 df fc 02 14 5b da 53 98 7f c5
                     : 33 df c6 09 b2 7a e3 6f 97 70 1e 14 ed 94

D.3 End-Entity Certificate Using RSA

   This section contains an annotated hex dump of a 675 byte version 3
   certificate.  The certificate contains the following information:
   (a) the serial number is 256;
   (b) the certificate is signed with RSA and the MD2 hash algorithm;
   (c) the issuer's distinguished name is OU=Dept. Arquitectura de
   Computadors; O=Universitat Politecnica de Catalunya; C=ES
   (d) and the subject's distinguished name is CN=Francisco Jordan;
   OU=Dept. Arquitectura de Computadors; O=Universitat Politecnica de
   Catalunya; C=ES
   (e) the certificate was issued on May 21, 1996 and expired on May 21,
   1997;
   (f) the certificate contains a 768 bit RSA public key;
   (g) the certificate is an end entity certificate (not a CA
   certificate);
   (h) the certificate includes an alternative subject name and an
   alternative issuer name - bothe are URLs;
   (i) the certificate include an authority key identifier and
   certificate policies extensions; and
   (j) the certificate includes a critical key usage extension
   specifying the public is intended for generation of digital
   signatures.

0000 30 80           : SEQUENCE   (size undefined)
0002 30 82 02 40  576: . SEQUENCE
0006 a0 03          3: . . [0]
0008 02 01          1: . . . INTEGER 2
                     : 02
0011 02 02          2: . . INTEGER 256
                     : 01 00
0015 30 0d         13: . . SEQUENCE
0017 06 09          9: . . . OID 1.2.840.113549.1.1.2:
                                       MD2WithRSAEncryption
                     : 2a 86 48 86 f7 0d 01 01 02
0028 05 00          0: . . . NULL
0030 30 68         88: . . SEQUENCE
0032 31 0b         11: . . . SET
0034 30 09          9: . . . . SEQUENCE
0036 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0041 13 02          2: . . . . . PrintableString  'ES'
                     : 45 53
0045 31 2d         45: . . . SET
0047 30 2b         43: . . . . SEQUENCE
0049 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0054 13 24         36: . . . . . PrintableString

                     'Universitat Politecnica de Catalunya'
                     : 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
                     : 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
                     : 75 6e 79 61
0092 31 2a         42: . . . SET
0094 30 28         40: . . . . SEQUENCE
0096 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0101 13 21         33: . . . . . PrintableString
                     'OU=Dept. Arquitectura de Computadors'
                     : 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
                     : 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
                     : 73
0136 30 1e         30: . . SEQUENCE
0138 17 0d         13: . . . UTCTime  '960521095826Z'
                     : 39 36 30 37 32 32 31 37 33 38 30 32 5a
0153 17 0d         13: . . . UTCTime  '979521095826Z'
                     : 39 37 30 37 32 32 31 37 33 38 30 32 5a
0168 30 81 83     112: . . SEQUENCE
0171 31 0b         11: . . . SET
0173 30 09          9: . . . . SEQUENCE
0175 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0180 13 02          2: . . . . . PrintableString  'ES'
                     : 45 53
0184 31 2d         12: . . . SET
0186 30 2b         16: . . . . SEQUENCE
0188 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0193 13 24         36: . . . . . PrintableString
                     'Universitat Politecnica de Catalunya'
                     : 55 6e 69 76 65 72 73 69 74 61 74 20 50 6f 6c 69
                     : 74 65 63 6e 69 63 61 20 64 65 20 43 61 74 61 6c
                     : 75 6e 79 61
0231 31 2a         42: . . . SET
0233 30 28         40: . . . . SEQUENCE
0235 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b
0240 13 21         33: . . . . . PrintableString
                     'Dept. Arquitectura de Computadors'
                     : 44 65 70 74 2e 20 41 72 71 75 69 74 65 63 74 75
                     : 72 61 20 64 65 20 43 6f 6d 70 75 74 61 64 6f 72
                     : 73
0275 31 19         22: . . . SET
0277 30 17         20: . . . . SEQUENCE
0279 06 03          3: . . . . . OID 2.5.4.3: CN
                     : 55 04 03
0284 13 10         16: . . . . . PrintableString 'Francisco Jordan'

                     : 46 72 61 6e 63 69 73 63 6f 20 4a 6f 72 64 61 6e
0302 30 7c          2: . . SEQUENCE
0304 30 0d         13: . . . SEQUENCE
0306 06 09          9: . . . . OID 1.2.840.113549.1.1.1: RSAEncryption
                     : 2a 86 48 86 f7 0d 01 01 01
0317 05 00          0: . . . . NULL
0319 03 6b        107: . . . BIT STRING
                     : 00   (0 unused bits)
                     : 30 68 02 61 00 be aa 8b 77 54 a3 af ca 77 9f 2f
                     : b0 cf 43 88 ff a6 6d 79 55 5b 61 8c 68 ec 48 1e
                     : 8a 86 38 a4 fe 19 b8 62 17 1d 9d 0f 47 2c ff 63
                     : 8f 29 91 04 d1 52 bc 7f 67 b6 b2 8f 74 55 c1 33
                     : 21 6c 8f ab 01 95 24 c8 b2 73 93 9d 22 61 50 a9
                     : 35 fb 9d 57 50 32 ef 56 52 50 93 ab b1 88 94 78
                     : 56 15 c6 1c 8b 02 03 01 00 01
0428 a3 81 97     151: . . [3]
0431 30 3c         60: . . . SEQUENCE
0433 30 1f         31: . . . . SEQUENCE
0435 06 03          3: . . . . . OID 2.5.29.35: authorityKeyIdentifier
                     : 55 1d 23
0440 04 14         22: . . . . . OCTET STRING
                     : 30 12 80 10 0e 6b 3a bf 04 ea 04 c3 0e 6b 3a bf
                     : 04 ea 04 c3
0464 30 19         25: . . . . SEQUENCE
0466 06 03          3: . . . . . OID 2.5.29.15: keyUsage
                     : 55 1d 0f
0471 01 01          1: . . . . . TRUE
0474 04 04          4: . . . . . OCTET STRING
                     : 03 02 07 80
0480 30 19         25: . . . . SEQUENCE
0482 06 03          3: . . . . . OID 2.5.29.32: certificatePolicies
                     : 55 1d 20
0487 04 21         33: . . . . . OCTET STRING
                     : 30 1f 30 1d 06 04 2a 84 80 00 30 15 30 07 06 05
                     : 2a 84 80 00 01 30 0a 06 05 2a 84 80 00 02 02 01
                     : 0a
0522 30 1c         28: . . . . SEQUENCE
0524 06 03          3: . . . . . OID 2.5.29.17: subjectAltName
                     : 55 1d 11
0529 04 15         21: . . . . . OCTET STRING
                     : 30 13 86 11 68 74 74 70 3a 2f 2f 61 63 2e 75 70
                     : 63 2e 65 73 2f
0552 30 19         25: . . . . SEQUENCE
0554 06 03          3: . . . . . OID 2.5.29.18: issuerAltName
                     : 55 1d 12
0559 04 12         18: . . . . . OCTET STRING
                     : 30 14 86 12 68 74 74 70 3a 2f 2f 77 77 77 2e 75
                     : 70 63 2e 65

0579 30 80           : . SEQUENCE (indefinite length)
0581 06 07          7: . . OID
0583 05 00          0: . . NULL
0585 00 00          0: . . end of contents marker
0587 03 81 81      47: . BIT STRING
                     : 00      (0 unused bits)
                     : 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
                     : 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
                     : eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
                     : a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
                     : 5c 01 bd b5 41 88 87 7a 0e d3 0e 6b 3a bf 04 ea
                     : 04 cb 5f 61 72 3c a3 bd 78 f5 66 17 fe 37 3a ab
                     : eb 67 bf b7 da a8 38 f6 33 15 71 75 2f b9 8c 91
                     : a0 e4 87 ba 4b 43 a0 22 8f d3 a9 86 43 89 e6 50
0637 00 00          0: . . end of contents marker

D.4 Certificate Revocation List

   This section contains an annotated hex dump of a version 2 CRL with
   one extension (cRLNumber). The CRL was issued by OU=nist;O=gov;C=us
   on July 7, 1996; the next scheduled issuance was August 7, 1996.  The
   CRL includes one revoked certificates: serial number 18 (12 hex).
   The CRL itself is number 18, and it was signed with DSA and SHA-1.

0000 30 81 ba     186: SEQUENCE
0003 30 7c        124: . SEQUENCE
0005 02 01          1: . . INTEGER 1
                     : 01
0008 30 09          9: . . SEQUENCE
0010 06 07          7: . . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0019 30 2a         42: . . SEQUENCE
0021 31 0b         11: . . . SET
0023 30 09          9: . . . . SEQUENCE
0025 06 03          3: . . . . . OID 2.5.4.6: C
                     : 55 04 06
0030 13 02          2: . . . . . PrintableString  'US'
                     : 55 53
0034 31 0c         12: . . . SET
0036 30 0a         10: . . . . SEQUENCE
0038 06 03          3: . . . . . OID 2.5.4.10: O
                     : 55 04 0a
0043 13 03          3: . . . . . PrintableString  'gov'
                     : 67 6f 76
0048 31 0d         13: . . . SET
0050 30 0b         11: . . . . SEQUENCE
0052 06 03          3: . . . . . OID 2.5.4.11: OU
                     : 55 04 0b

0057 13 04          4: . . . . . PrintableString  'nist'
                     : 6e 69 73 74
0063 17 0d         13: . . UTCTime  '970801000000Z'
                     : 39 37 30 38 30 31 30 30 30 30 30 30 5a
0078 17 0d         13: . . UTCTime  '970808000000Z'
                     : 39 37 30 38 30 38 30 30 30 30 30 30 5a
0093 30 22         34: . . SEQUENCE
0095 30 20         32: . . . SEQUENCE
0097 02 01          1: . . . . INTEGER 18
                     : 12
0100 17 0d         13: . . . . UTCTime  '970731000000Z'
                     : 39 37 30 37 33 31 30 30 30 30 30 30 5a
0115 30 0c         12: . . . . SEQUENCE
0117 30 0a         10: . . . . . SEQUENCE
0119 06 03          3: . . . . . . OID 2.5.29.21: reasonCode
                     : 55 1d 15
0124 04 03          3: . . . . . . OCTET STRING
                     : 0a 01 01
0129 30 09          9: . SEQUENCE
0131 06 07          7: . . OID 1.2.840.10040.4.3: dsa-with-sha
                     : 2a 86 48 ce 38 04 03
0140 03 2f         47: . BIT STRING  (0 unused bits)
                     : 30 2c 02 14 9e d8 6b c1 7d c2 c4 02 f5 17 84 f9
                     : 9f 46 7a ca cf b7 05 8a 02 14 9e 43 39 85 dc ea
                     : 14 13 72 93 54 5d 44 44 e5 05 fe 73 9a b2

Appendix E. Authors' Addresses

   Russell Housley
   SPYRUS
   381 Elden Street
   Suite 1120
   Herndon, VA 20170
   USA

   EMail: housley@spyrus.com


   Warwick Ford
   VeriSign, Inc.
   One Alewife Center
   Cambridge, MA 02140
   USA

   EMail: wford@verisign.com


   Tim Polk
   NIST
   Building 820, Room 426
   Gaithersburg, MD 20899
   USA

   EMail: wpolk@nist.gov


   David Solo
   Citicorp
   666 Fifth Ave, 3rd Floor
   New York, NY 10103
   USA

   EMail: david.solo@citicorp.com

Appendix F.  Full Copyright Statement

   Copyright (C) The Internet Society (1999).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.