CDFModule DEFINITIONS ::= BEGIN	


		-- Constants
		pkcs15-ub-identifier   			INTEGER ::= 255
		pkcs15-ub-reference			INTEGER ::= 255
		pkcs15-ub-index				INTEGER ::= 65535
		pkcs15-ub-label				INTEGER ::= pkcs15-ub-identifier
		pkcs15-lb-minPinLength 		INTEGER ::= 4
		pkcs15-ub-minPinLength	 	INTEGER ::= 8
		pkcs15-ub-storedPinLength 		INTEGER ::= 64
		pkcs15-ub-recordLength 		INTEGER ::= 16383
		pkcs15-ub-userConsent  		INTEGER ::= 15
		pkcs15-ub-securityConditions  	INTEGER ::= 255
		pkcs15-ub-seInfo   			INTEGER ::= 255

		-- Basic types
		Identifier ::= OCTET STRING (SIZE (0..pkcs15-ub-identifier))
		Reference ::= INTEGER (0..pkcs15-ub-reference)
		Label ::= UTF8String (SIZE(0..pkcs15-ub-label))
		LabelCERES ::= CHOICE {
    	tipoutf8string		UTF8String (SIZE(0..pkcs15-ub-label)),
   		tipot61string		T61String
    }

--///////////////////////////////////////////////////////////////////////////////////////////////////////////////
--// BEGIN
--///////////////////////////////////////////////////////////////////////////////////////////////////////////////		
--TYPE-IDENTIFIER ::= CLASS {
--      &id OBJECT IDENTIFIER UNIQUE,
--      &Type 
--    } WITH SYNTAX { SYNTAX &Type IDENTIFIED BY &id }
    
		
--PKCS15Object {ClassAttributes, SubClassAttributes, TypeAttributes} ::= SEQUENCE {
		--commonObjectAttributes	CommonObjectAttributes,
		--classAttributes		ClassAttributes,
		--subClassAttributes 		[0] SubClassAttributes OPTIONAL,
		--typeAttributes			[1] TypeAttributes
--}


--CertificateObject {CertAttributes}  PKCS15Object { 
  	--CommonCertificateAttributes, NULL, CertAttributes}
	  --X509CertificateAttributes ::= SEQUENCE {
		--value		ObjectValue { Certificate },
		--subject  		Name OPTIONAL,
		--issuer 		[0] Name OPTIONAL,
		--serialNumber 	CertificateSerialNumber OPTIONAL,
		-- For future extensions
--}

AttributeType ::= OBJECT IDENTIFIER -- ATTRIBUTE.&id

AttributeValue ::= ANY -- ATTRIBUTE.&Type

Attribute ::= SEQUENCE {
	type			AttributeType,
	values			SET OF AttributeValue
		-- at least one value is required -- 
	}

AttributeTypeAndValue ::= SEQUENCE {
	type			AttributeType,
	value			AttributeValue
}
	
-- naming data types 
--Name ::= CHOICE { 
--		rdnSequence  RDNSequence
--}
Name ::= SEQUENCE OF RelativeDistinguishedName

--RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

RelativeDistinguishedName ::= SET OF AttributeTypeAndValue  --SET SIZE (1 .. MAX) OF

UniqueIdentifier ::= BIT STRING


--CertificateSerialNumber ::= INTEGER
CertificateSerialNumber ::= ANY


--ReferencedValue {Type} ::= CHOICE {
        --path	Path,
        --url		URL
 --} (CONSTRAINED BY {Type}) 
 
 ReferencedValuetype ::= CHOICE {
        path	Path,
        url		URL
 } 

URL ::= CHOICE {
        url		PrintableString,
        urlWithDigest [3] SEQUENCE {
        	url		IA5String,
        	digest	DigestInfoWithDefault
        	}
}
DigestInfoWithDefault ::= SEQUENCE {
--        digestAlg	AlgorithmIdentifier {{DigestAlgorithms}} DEFAULT alg-id-sha1,
        digest		OCTET STRING (SIZE(8..128))
    }

Path ::= SEQUENCE {
		path 	OCTET STRING,
		index  	INTEGER (0..pkcs15-ub-index) OPTIONAL,
		--length 	[0] INTEGER (0..pkcs15-ub-index) OPTIONAL
		length 	[0] ANY OPTIONAL
}
--}( WITH COMPONENTS {..., index PRESENT, length PRESENT}| 
--WITH COMPONENTS {..., index ABSENT, length ABSENT})


CertificateObject ::= SEQUENCE {
		commonObjectAttributes	CommonObjectAttributes,
		classAttributes					CommonCertificateAttributes,
--		subClassAttributes 		[0] SubClassAttributes OPTIONAL,
		typeAttributes					[1] X509CertificateAttributes
}


CommonObjectAttributes ::= SEQUENCE {
		--label		Label OPTIONAL,
		label			LabelCERES OPTIONAL,		
		flags  		CommonObjectFlags OPTIONAL,
		authId 		Identifier OPTIONAL,
		...,
		userConsent 	INTEGER (1..pkcs15-ub-userConsent) OPTIONAL,
		accessControlRules	SEQUENCE SIZE (1..MAX) OF AccessControlRule OPTIONAL
} (CONSTRAINED BY {-- authId should be present in the IC card case if flags.private is set. 
		-- It must equal an authID in one AuthRecord in the AODF -- }) 
CommonObjectFlags ::= BIT STRING {
		private		(0),
		modifiable 	(1)
}
AccessControlRule ::= SEQUENCE {
		accessMode		AccessMode,
		securityCondition 	SecurityCondition,
		... -- For future extensions
}
AccessMode ::= BIT STRING {
		read	(0),
		update	(1),
		execute	(2)
}
SecurityCondition ::= CHOICE {
		authId	Identifier,
		not	[0] SecurityCondition,
		and	[1] SEQUENCE SIZE (2..pkcs15-ub-securityConditions) OF SecurityCondition, 
		or 		[2] SEQUENCE SIZE (2..pkcs15-ub-securityConditions) OF SecurityCondition, 
		... -- For future extensions
}


-- Credential Identifiers
--KEY-IDENTIFIER ::= CLASS {
--	&id  INTEGER UNIQUE,
--	&Value
--} WITH SYNTAX {
--SYNTAX &Value IDENTIFIED BY &id
--}

CredentialIdentifier ::= SEQUENCE {
		id  					INTEGER,
	  identValue		ANY
}
--CredentialIdentifier ::= ANY
--CredentialIdentifier {KEY-IDENTIFIER : IdentifierSet} ::= SEQUENCE {
--	idType  KEY-IDENTIFIER.&id ({IdentifierSet}),
--	idValue KEY-IDENTIFIER.&Value ({IdentifierSet}{@idType})
--}


--KeyIdentifiers ::= KEY-IDENTIFIER

-- KeyIdentifiers KEY-IDENTIFIER ::= {
-- issuerAndSerialNumber		|
-- issuerAndSerialNumberHash	|
-- subjectKeyId			|
-- subjectKeyHash 			|
-- issuerKeyHash 			|
-- issuerNameHash 			|
-- subjectNameHash,
-- ...
-- }
-- issuerAndSerialNumber KEY-IDENTIFIER::= 
-- {SYNTAX PKCS15-OPAQUE.&Type IDENTIFIED BY 1}
-- As defined in RFC 2630
-- subjectKeyId KEY-IDENTIFIER ::= 
-- {SYNTAX OCTET STRING IDENTIFIED BY 2}
-- From x509v3 certificate extension
-- issuerAndSerialNumberHash KEY-IDENTIFIER ::= 
-- {SYNTAX OCTET STRING IDENTIFIED BY 3}
-- Assumes SHA-1 hash of DER encoding of IssuerAndSerialNumber
-- subjectKeyHash KEY-IDENTIFIER ::= 
-- {SYNTAX OCTET STRING IDENTIFIED BY 4}
-- issuerKeyHash KEY-IDENTIFIER ::= 
-- {SYNTAX OCTET STRING IDENTIFIED BY 5}
-- issuerNameHash KEY-IDENTIFIER ::=
-- {SYNTAX OCTET STRING IDENTIFIED BY 6}
-- SHA-1 hash of DER-encoded issuer name
-- subjectNameHash KEY-IDENTIFIER ::=
-- {SYNTAX OCTET STRING IDENTIFIED BY 7}
-- SHA-1 hash of DER-encoded subject name


CommonCertificateAttributes ::= SEQUENCE {
		iD 				Identifier, 
		authority			BOOLEAN DEFAULT FALSE,
		identifier 		CredentialIdentifier OPTIONAL,
		--certHash				[0] OOBCertHash OPTIONAL,
		--...,
		trustedUsage 		[1] Usage OPTIONAL,
		--identifiers			[2] SEQUENCE OF CredentialIdentifier{{KeyIdentifiers}} OPTIONAL,
		implicitTrust	 	[3] BOOLEAN DEFAULT FALSE
}
Usage ::= SEQUENCE {
		keyUsage	KeyUsage OPTIONAL,
		extKeyUsage	SEQUENCE SIZE (1..MAX) OF OBJECT IDENTIFIER OPTIONAL
}(WITH COMPONENTS {..., keyUsage PRESENT} |
   WITH COMPONENTS {..., extKeyUsage PRESENT})

KeyUsageFlags ::= BIT STRING {
		encrypt 			(0),
		decrypt 			(1),
		sign 			(2),
		signRecover 		(3),
		wrap 			(4),
		unwrap 			(5),
		verify 			(6),
		verifyRecover  	(7),
		derive 			(8),
		nonRepudiation	(9)
}
KeyUsage ::= BIT STRING {
  digitalSignature(0), nonRepudiation(1), keyEncipherment(2),
  dataEncipherment(3), keyAgreement(4), keyCertSign(5), cRLSign(6),
  encipherOnly(7), decipherOnly(8)
}

   
X509CertificateAttributes ::= SEQUENCE {
			value					ReferencedValuetype,
			--subject  			Name OPTIONAL,			
			subject  			[0] ANY OPTIONAL,			
			--issuer 				[0] Name OPTIONAL,
			--issuer 				[0] Name,
			issuer 				[1] ANY,
			--serialNumber 	CertificateSerialNumber OPTIONAL
			serialNumber 	CertificateSerialNumber
}		


--PathOrObjects {ObjectType} ::= CHOICE {
		--path  	Path,
		--objects  	[0] SEQUENCE OF ObjectType,
		--...,
		--indirect-protected [1] ReferencedValue {EnvelopedData {SEQUENCE OF ObjectType}},
		--direct-protected [2] EnvelopedData {SEQUENCE OF ObjectType}
--}


-- Soft token related types and objects
EnvelopedData {Type} ::= SEQUENCE {
		version		 		INTEGER{v0(0),v1(1),v2(2),v3(3),v4(4)}(v0|v1|v2,...),
		originatorInfo	 		[0] OriginatorInfo OPTIONAL,
		recipientInfos 	 		RecipientInfos,
		encryptedContentInfo	EncryptedContentInfo{Type},
		unprotectedAttrs	 	[1] SET SIZE (1..MAX) OF Attribute OPTIONAL
}
EncryptedContentInfo {Type} ::= SEQUENCE {
		contentType				OBJECT IDENTIFIER,
		contentEncryptionAlgorithm	AlgorithmIdentifier{{ContentEncryptionAlgorithms}}, 
		encryptedContent 			[0] OCTET STRING OPTIONAL
}(CONSTRAINED BY {-- 'encryptedContent' shall be the result of encrypting DER-encoded 
-- value of type -- Type})

	END		   