BT4PT-CertificatesV1-0

Module Info

Reference: BT4PT-CertificatesV1-0
Numeric OID: 1.3.6.1.4.1.17218.1.2.7.1.0

Exports

This module explicitly exports the following symbols:

EndEntityCertificate

Imports

From BT4PT-GeneralElementsV1-0

CompanyCode Data ECPublicKey DataAuthorization UnicodeText DATA-ELEMENT cuperEncoding nullEncoding

From BT4PT-EnvelopeV1-0

IssuerDataElements

Assignments

EndEntityCertificate

SEQUENCE

This sequence contains the following fields:

serial

INTEGER

This type is constrained in the following way:

Range

The value must be greater than or equal to: 1

The value must be less than or equal to: 16777216

issuingSecurityProvider

CompanyCode

caId

INTEGER

This type is constrained in the following way:

Range

The value must be greater than or equal to: 1

The value must be less than or equal to: 65536

validUntilYear

INTEGER

This type is constrained in the following way:

Range

The value must be greater than or equal to: 2026

The value must be less than or equal to: 2281

validUntilDay

INTEGER

This type is constrained in the following way:

Range

The value must be greater than or equal to: 1

The value must be less than or equal to: 366

publicKeyReconstructionData

The public key MUST be of the same EC curve as the issuing certificate's public key. If it is not the certificate MUST be treated as invalid. This public key is calculated as per SEC 4.

CHOICE

The value of this choice may be one of the following:

nistP256

ECPublicKey

This type is concretely parameterised with the following:

len: 32

secp256K1

ECPublicKey

This type is concretely parameterised with the following:

len: 32

nistP384

ECPublicKey

This type is concretely parameterised with the following:

len: 48

nistP521

ECPublicKey

This type is concretely parameterised with the following:

len: 66

extensions

SEQUENCE OF

This type is constrained in the following way:

Size

The length of the value must be greater than or equal to: 0

The length of the value must be less than or equal to: 15

CertificateExtension

CERTIFICATE-EXTENSION

A certificate extension, containing data as specified by its &Type, and encoded into an OCTET STRING as specified by its &encoding. When included in an EndEntityCertificate it is identified by its &id. If &id is not set, then the extension may not appear in an EndEntityCertificate, only an X.509 certificate. When included in an X.509 certificate, it is identified by its &oid. The identifier &id can be of the following forms:

+ + [2-letters uppercase ISO 3166 country code] + [addon, chosen by the national standards body of that country]
_ + [RICS or ERA Organisation Code] + [addon, chosen by this company]
* + [addon] - private use, not guaranteed to avoid clashes.

Any other value only after registration in the appropriate registry. Unregistered values (outside of the national, company, and private use ranges) MUST NOT be used. If an organisation has a RICS or an ERA Organisation Code the private use format MUST NOT be used. All values SHOULD be registered via the UIC Github repository.

OBJECT CLASS

This object class has the following fields:

&id Optional

This field accepts any value of the following type:

VisibleString

This type is constrained in the following way:

Intersection

All the following must be true:

Size

The length of the value must be greater than or equal to: 1

The length of the value must be less than or equal to: 8

AND

Inverse

Any value, except any satisfying the following:

Union

Any of the following can be true:

Single value

The value must be exactly: !I

Single value

The value must be exactly: !C

Single value

The value must be exactly: !P

This field must be unique within an object set.

&oid

This field accepts any value of the following type:

OBJECT IDENTIFIER

This field must be unique within an object set.

&Type

This field accepts any concrete type.

&encoding

This field accepts any value of the following type:

OBJECT IDENTIFIER

CertificateExtension

SEQUENCE

This sequence contains the following fields:

critical

If the data format is not recognised, or can't be processed, and it is marked critical, the certificate MUST be treated as invalid; otherwise, it is permitted to ignore extensions not understood.

BOOLEAN

format

VisibleString

This type is constrained in the following way:

Intersection

All the following must be true:

Size

The length of the value must be greater than or equal to: 1

The length of the value must be less than or equal to: 8

AND

Inverse

Any value, except any satisfying the following:

Union

Any of the following can be true:

Single value

The value must be exactly: !I

Single value

The value must be exactly: !C

Single value

The value must be exactly: !P

This type is constrained in the following way:

Table

The value must come from the &id column of the object set: EECertificateExtensions

value

OCTET STRING

This type is constrained in the following way:

The value must be an encoding of the following type:

ANY

This type is constrained in the following way:

Table

The value must come from the &Type column of the object set: EECertificateExtensions
The row is selected by the value of the fields: format

EECertificateExtensions

OBJECT SET

This object set has the following members:

&id &oid &Type &encoding

SP id-specimenPoison NULL nullEncoding

ID

id-issuerDataAuthorization

DataAuthorization

This type is concretely parameterised with the following:

ElementSet: IssuerDataElements

cuperEncoding

Other members may be added at runtime.

CertificateExtensions

OBJECT SET

This object set has the following members:

&id	&oid	&Type	&encoding
`SP`	id-specimenPoison	NULL	nullEncoding
`ID`	id-issuerDataAuthorization	DataAuthorization This type is concretely parameterised with the following: ElementSet IssuerDataElements	cuperEncoding
No value	id-certificateId	CertificateId	cuperEncoding
No value	id-eeCertCRL	VisibleString	cuperEncoding
Other members may be added at runtime.

bt4ptPkiExt

OBJECT IDENTIFIER

id-specimenPoison

OBJECT IDENTIFIER

specimenPoisonExt

Any barcode signed by a certificate containing this poison marker MUST be considered a specimen barcode, regardless of any other specimen flag.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: SP
&oid: id-specimenPoison
&Type: NULL
&encoding: nullEncoding

id-issuerDataAuthorization

OBJECT IDENTIFIER

issuerDataAuthorizationExt

This extension specifies which issuer data elements may be included in a barcode signed by this certificate, and what constraints apply to them.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id

ID

&oid

id-issuerDataAuthorization

&Type

DataAuthorization

This type is concretely parameterised with the following:

ElementSet: IssuerDataElements

&encoding

cuperEncoding

CertificateId

SEQUENCE

This sequence contains the following fields:

issuingSecurityProvider: CompanyCode
caId: INTEGER
This type is constrained in the following way:

Range

The value must be greater than or equal to: 1

The value must be less than or equal to: 65536

id-certificateId

OBJECT IDENTIFIER

certificateIdExt

This extension is placed in the X.509 certificate of a CA issuing end-entity certificates. It uniquely identifies a key-pair in the BT4PT PKI. A CA certificate MAY be re-issued with updated metadata and the same certificate ID, but a change of public key requires a new certificate ID.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-certificateId
&Type: CertificateId
&encoding: cuperEncoding

id-eeCertCRL

OBJECT IDENTIFIER

eeCertCRLExt

This extension contains the HTTPS URL at which the X.509 Certificate Revocation List for end-entity certificates directly issued by this CA may be retrieved.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-eeCertCRL
&Type: VisibleString
&encoding: cuperEncoding

RevocationNotice

This extension defines a notice to be displayed to inspection staff upon encountering a revoked certificate. It is to be included as an extension to a Certificate Revocation List Entry. Each entry in the localisedNotices SHOULD convey the same information in a different language. The device performing the ticket validation can select which language, of those provided, is most appropriate to be displayed.

SEQUENCE

This sequence contains the following fields:

localisedNotices: SEQUENCE OF UnicodeText

id-revocationNotice

OBJECT IDENTIFIER

revocationNoticeExt

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-revocationNotice
&Type: RevocationNotice
&encoding: cuperEncoding

id-subordinateCertificateRepositoryV1-0

OBJECT IDENTIFIER

subordinateCertificateRepositoryV1-0Ext

This extension contains the HTTPS URL at which the SubordinateCertificateList, defined in the BT4PT-MetadataV1-0 module, containing certificates directly issued by this CA may be retrieved.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-subordinateCertificateRepositoryV1-0
&Type: VisibleString
&encoding: cuperEncoding

LastGoodSignatureCounter

SEQUENCE

This sequence contains the following fields:

hsmId: OCTET STRING
This type is constrained in the following way:

Size

The length of the value must exactly: 8
signatureCounter: OCTET STRING
This type is constrained in the following way:

Size

The length of the value must exactly: 4

id-lastGoodSignatureCounter

OBJECT IDENTIFIER

lastGoodSignatureCounterExt

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-lastGoodSignatureCounter
&Type: LastGoodSignatureCounter
&encoding: cuperEncoding

id-onlineValidationRequiredMarker

OBJECT IDENTIFIER

onlineValidationRequiredMarkerExt

This extension is placed in an X.509 CRL entry. It marks that the private key is likely compromised, and that online (e.g. eTCD) validation MUST be performed to assertain if a ticket is validly issued or not.

OBJECT

This is an object of the class: CERTIFICATE-EXTENSION

This object has the following field values:

&id: No value
&oid: id-onlineValidationRequiredMarker
&Type: NULL
&encoding: nullEncoding

id-trustAnchorMarker

This Extended Key Usage is placed in the X.509 certificate of a Trust Anchor. A certificate must not be accepted by a validation device as a valid point to end the validation chain on unless it is both in its root trust list and it contains this EKU.

OBJECT IDENTIFIER

id-endEntityCAMarker

This Extended Key Usage is placed in the X.509 certificate directly issuing End-Entity Certificates. An end-entity certificate must not be accepted by a validation device, unless it is signed by a certificate containing this Extended Key Usage.

OBJECT IDENTIFIER

id-otherNameCompanyCode

This OID is used in the X.509 GeneralName.otherName to signify a DER-encoded CompanyCode. It may be used in either the Subject Alternative Name or Issuer Alternative Name X.509 extensions.

OBJECT IDENTIFIER

id-certificatePolicyBaseline

By including this OID in an X.509 certificate's Certificate Policies, the issuer is asserting conformance and adherence to the common certificate baseline defined by BT4PT. It MUST be included for all certificates issued under the BT4PT standard.

OBJECT IDENTIFIER

/**
* BT4PT Certificates - DRAFT.
*/
BT4PT-CertificatesV1-0 {
    iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) certificates(7) v1(1) 0
} DEFINITIONS ::= BEGIN

EXPORTS EndEntityCertificate;

IMPORTS CompanyCode, Data, ECPublicKey, DataAuthorization, UnicodeText, DATA-ELEMENT, cuperEncoding, nullEncoding
 FROM BT4PT-GeneralElementsV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) general(1) v1(1) 0 }
 IssuerDataElements
 FROM BT4PT-EnvelopeV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) envelope(2) v1(1) 0 };

EndEntityCertificate ::= SEQUENCE {
    serial                      INTEGER (1..16777216),
    issuingSecurityProvider     CompanyCode,
    caId                        INTEGER (1..65536),
    validUntilYear              INTEGER (2026..2281),
    validUntilDay               INTEGER (1..366),
    /**
    * The public key **MUST** be of the same EC curve as the issuing certificate's public key.
    * If it is not the certificate **MUST** be treated as invalid.
    * This public key is calculated as per [SEC 4](https://www.secg.org/sec4-1.0.pdf).
    */
    publicKeyReconstructionData CHOICE {
        nistP256    [1] ECPublicKey{32},
        secp256K1   [2] ECPublicKey{32},
        nistP384    [3] ECPublicKey{48},
        nistP521    [4] ECPublicKey{66}
    },
    extensions                  SEQUENCE (SIZE(0..15)) OF CertificateExtension
}

/**
* A certificate extension, containing data as specified by its `&Type`, and encoded into an `OCTET STRING` as specified by its `&encoding`.
* When included in an `EndEntityCertificate` it is identified by its `&id`.
* If `&id` is not set, then the extension may not appear in an `EndEntityCertificate`, only an X.509 certificate.
* When included in an X.509 certificate, it is identified by its `&oid`.
* The identifier `&id` can be of the following forms:
* - `+` + [2-letters uppercase ISO 3166 country code] + [addon, chosen by the national standards body of that country]
* - `_` + [RICS or ERA Organisation Code] + [addon, chosen by this company]
* - `*` + [addon] - private use, not guaranteed to avoid clashes.
*
* Any other value only after registration in the appropriate registry.
* Unregistered values (outside of the national, company, and private use ranges) **MUST NOT** be used.
* If an organisation has a RICS or an ERA Organisation Code the private use format **MUST NOT** be used.
* All values **SHOULD** be registered via the UIC Github repository.
*/
CERTIFICATE-EXTENSION ::= CLASS {
    &id VisibleString (SIZE(1..8) ^ (ALL EXCEPT ("!I" | "!C" | "!P"))) UNIQUE OPTIONAL,
    &oid OBJECT IDENTIFIER UNIQUE,
    &Type,
    &encoding OBJECT IDENTIFIER
} WITH SYNTAX {
    &Type [IDENTIFIED BY &id] WITH OID &oid ENCODED WITH &encoding
}

CertificateExtension ::= [APPLICATION 3] SEQUENCE {
    /**
    * If the data format is not recognised, or can't be processed, and it is marked critical, the certificate **MUST** be treated as invalid;
    * otherwise, it is permitted to ignore extensions not understood.
    */
    critical    BOOLEAN,
    format      CERTIFICATE-EXTENSION.&id({EECertificateExtensions}),
    value       OCTET STRING (CONTAINING CERTIFICATE-EXTENSION.&Type({EECertificateExtensions}{@format}))
}

EECertificateExtensions CERTIFICATE-EXTENSION ::= {
    specimenPoisonExt |
    issuerDataAuthorizationExt,
    ...
}

CertificateExtensions CERTIFICATE-EXTENSION ::= {
    specimenPoisonExt |
    issuerDataAuthorizationExt |
    certificateIdExt |
    eeCertCRLExt,
    ...
}

bt4ptPkiExt OBJECT IDENTIFIER ::= {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1)
    uic(17218) fcb(1) bt4pt(2) pkiExt(9)}

id-specimenPoison OBJECT IDENTIFIER ::= {bt4ptPkiExt specimenPoison(0)}

/**
* Any barcode signed by a certificate containing this poison marker **MUST** be considered a specimen barcode,
* regardless of any other specimen flag.
*/
specimenPoisonExt CERTIFICATE-EXTENSION ::= { NULL IDENTIFIED BY "SP" WITH OID id-specimenPoison ENCODED WITH nullEncoding }

id-issuerDataAuthorization OBJECT IDENTIFIER ::= {bt4ptPkiExt issuerDataAuthorization(1)}

/**
* This extension specifies which issuer data elements may be included in a barcode signed by this certificate, and
* what constraints apply to them.
*/
issuerDataAuthorizationExt CERTIFICATE-EXTENSION ::= { DataAuthorization{{IssuerDataElements}} IDENTIFIED BY "ID" WITH OID id-issuerDataAuthorization ENCODED WITH cuperEncoding }

CertificateId ::= SEQUENCE {
    issuingSecurityProvider     CompanyCode,
    caId                        INTEGER (1..65536)
}

id-certificateId OBJECT IDENTIFIER ::= {bt4ptPkiExt certificateId(2)}

/**
* This extension is placed in the X.509 certificate of a CA issuing end-entity certificates.
* It uniquely identifies a key-pair in the BT4PT PKI.
* A CA certificate **MAY** be re-issued with updated metadata and the same certificate ID, but a change of public key
* requires a new certificate ID.
*/
certificateIdExt CERTIFICATE-EXTENSION ::= { CertificateId WITH OID id-certificateId ENCODED WITH cuperEncoding }

id-eeCertCRL OBJECT IDENTIFIER ::= {bt4ptPkiExt eeCertCRL(3)}

/**
* This extension contains the HTTPS URL at which the X.509 Certificate Revocation List for end-entity certificates directly issued by this CA may be retrieved.
*/
eeCertCRLExt CERTIFICATE-EXTENSION ::= { VisibleString WITH OID id-eeCertCRL ENCODED WITH cuperEncoding }

/**
* This extension defines a notice to be displayed to inspection staff upon encountering a revoked certificate.
* It is to be included as an extension to a Certificate Revocation List Entry.
* Each entry in the `localisedNotices` **SHOULD** convey the same information in a different language.
* The device performing the ticket validation can select which language, of those provided, is most appropriate to be
* displayed.
*/
RevocationNotice ::= SEQUENCE {
    localisedNotices    SEQUENCE OF UnicodeText
}

id-revocationNotice OBJECT IDENTIFIER ::= {bt4ptPkiExt revocationNotice(4)}

revocationNoticeExt CERTIFICATE-EXTENSION ::= { RevocationNotice WITH OID id-revocationNotice ENCODED WITH cuperEncoding }

id-subordinateCertificateRepositoryV1-0 OBJECT IDENTIFIER ::= {bt4ptPkiExt subordinateCertificateRepositoryV1-0(5)}

/**
* This extension contains the HTTPS URL at which the `SubordinateCertificateList`, defined in the `BT4PT-MetadataV1-0` module, containing certificates directly issued by this CA may be retrieved.
*/
subordinateCertificateRepositoryV1-0Ext CERTIFICATE-EXTENSION ::= { VisibleString WITH OID id-subordinateCertificateRepositoryV1-0 ENCODED WITH cuperEncoding }

LastGoodSignatureCounter ::= SEQUENCE {
    hsmId               OCTET STRING (SIZE(8)),
    signatureCounter    OCTET STRING (SIZE(4))
}

id-lastGoodSignatureCounter OBJECT IDENTIFIER ::= {bt4ptPkiExt lastGoodSignatureCounter(6)}

lastGoodSignatureCounterExt CERTIFICATE-EXTENSION ::= { LastGoodSignatureCounter WITH OID id-lastGoodSignatureCounter ENCODED WITH cuperEncoding }

id-onlineValidationRequiredMarker OBJECT IDENTIFIER ::= {bt4ptPkiExt onlineValidationRequiredMarker(7)}

/**
* This extension is placed in an X.509 CRL entry.
* It marks that the private key is likely compromised, and that online (e.g. eTCD) validation **MUST** be performed to
* assertain if a ticket is validly issued or not.
*/
onlineValidationRequiredMarkerExt CERTIFICATE-EXTENSION ::= { NULL WITH OID id-onlineValidationRequiredMarker ENCODED WITH nullEncoding }

/**
* This Extended Key Usage is placed in the X.509 certificate of a Trust Anchor.
* A certificate must not be accepted by a validation device as a valid point to end the validation chain on unless it is
* both in its root trust list and it contains this EKU.
*/
id-trustAnchorMarker OBJECT IDENTIFIER ::= {bt4ptPkiExt trustAnchorMarker(8)}

/**
* This Extended Key Usage is placed in the X.509 certificate directly issuing End-Entity Certificates.
* An end-entity certificate must not be accepted by a validation device, unless it is signed by a certificate containing
* this Extended Key Usage.
*/
id-endEntityCAMarker OBJECT IDENTIFIER ::= {bt4ptPkiExt endEntityCAMarker(9)}

/**
* This OID is used in the X.509 `GeneralName.otherName` to signify a DER-encoded `CompanyCode`.
* It may be used in either the Subject Alternative Name or Issuer Alternative Name X.509 extensions.
*/
id-otherNameCompanyCode OBJECT IDENTIFIER ::= {bt4ptPkiExt otherNameCompanyCode(10)}

/**
* By including this OID in an X.509 certificate's Certificate Policies, the issuer is asserting conformance and
* adherence to the common certificate baseline defined by BT4PT.
* It **MUST** be included for all certificates issued under the BT4PT standard.
*/
id-certificatePolicyBaseline OBJECT IDENTIFIER ::= {bt4ptPkiExt certificatePolicyBaseline(11)}

END

Module Info

Exports

Imports

From BT4PT-GeneralElementsV1-0

From BT4PT-EnvelopeV1-0

Assignments

EndEntityCertificate

Range

Range

Range

Range

Size

CERTIFICATE-EXTENSION

Intersection

Size

Inverse

Union

Single value

Single value

Single value

CertificateExtension

Intersection

Size

Inverse

Union

Single value

Single value

Single value

Table

Contents

Table

EECertificateExtensions

CertificateExtensions

bt4ptPkiExt

id-specimenPoison

specimenPoisonExt

id-issuerDataAuthorization

issuerDataAuthorizationExt

CertificateId

Range

id-certificateId

certificateIdExt

id-eeCertCRL

eeCertCRLExt

RevocationNotice

id-revocationNotice

revocationNoticeExt

id-subordinateCertificateRepositoryV1-0

subordinateCertificateRepositoryV1-0Ext

LastGoodSignatureCounter

Size

Size

id-lastGoodSignatureCounter

lastGoodSignatureCounterExt

id-onlineValidationRequiredMarker

onlineValidationRequiredMarkerExt

id-trustAnchorMarker

id-endEntityCAMarker

id-otherNameCompanyCode

id-certificatePolicyBaseline