BT4PT-EnvelopeV1-0

Module Info

Reference: BT4PT-EnvelopeV1-0
Numeric OID: 1.3.6.1.4.1.17218.1.2.2.1.0

Exports

This module explicitly exports the following symbols:

BT4PTEnvelope IssuerDataElements

Imports

Assignments

BT4PTEnvelope

This data structure is the basic entry point of the envelope. A BT4PT envelope SHALL consist of the bytes resulting from encoding this data structure using the ITU-T X.691 Canonical Aligned Packed Encoding Rules.

CHOICE

The value of this choice may be one of the following:

unsigned

This variant contains the list of data elements that the envelope encodes, in an unsigned fashion, with no additional security data.

This variant is SHALL only be used where no security is required. That is, when an unsigned envelope is considered suitable for the application.

SEQUENCE OF

This type is constrained in the following way:

Size

The length of the value must be greater than or equal to: 1

The length of the value must be less than or equal to: 16

Data

This type is concretely parameterised with the following:

ElementSet: IssuerDataElements

This type is constrained in the following way:

Fields

The type must satisfy the following field constraints, other fields are unconstrained:

Field	Presence	Value
format	No stipulation	Inverse Any value, except any satisfying the following: Union Any of the following can be true: Single value The value must be exactly: `!I` OR Single value The value must be exactly: `!C` OR Single value The value must be exactly: `!P`

signed

This variant is used for a signed envelope. It contains the list of data elements that the envelope encodes, along with a signature from the Security Provider, the certificate for the end-entity that output this envelope, and an optional binding of this envelope to a end-device's public key.

SEQUENCE

This sequence contains the following fields:

data: DeviceSignedData
deviceSignature Optional: This field is used as part of the device binding of envelopes. When an envelope is bound to a Presentment Device, it SHALL contain a signature, calculated over the Canonical Aligned Packed Encoding Rules encoding of DeviceSignedData, using the device held private key corresponding to the public key provided in the level2PublicKey field of IssuerSignedData.

If the the deviceBinding field of IssuerSignedData field is unset, and this field is set, the envelope SHALL be construed as invalid. If the the deviceBinding field of IssuerSignedData field is set, and this field is unset, the envelope SHALL be construed as invalid.

Signature

DeviceSignedData

SEQUENCE

This sequence contains the following fields:

data

This field contains the data signed by the Security Provider, in a message recovery fashion. Its inner data is the Canonical Aligned Packed Encoding Rules encoding of IssuerSignedData.

MessageRecoverySignature

certificate

This field contains the end-entity certificate used to sign the data field.

EndEntityCertificate

timestamp Optional

This field contains the timestamp at which the Presentment Device generated the envelope.

This field SHALL be set if IssuerSignedData.deviceBinding is set, otherwise the envelope SHALL be construed as invalid. If this timestamp is more than IssuerSignedData.deviceBinding.validityDuration seconds in the past, the envelope SHALL be construed as invalid.

Timestamp

deviceData Optional

This field contains data elements signed only by the Presentment Device, or not signed at all. Note: the inclusion of device data without the IssuerSignedData.deviceBinding field being set is not an error. It is permissible to include unauthenticated device data, for example as a debugging aid.

SEQUENCE OF

This type is constrained in the following way:

Size

The length of the value must be greater than or equal to: 1

The length of the value must be less than or equal to: 8

Data

This type is concretely parameterised with the following:

ElementSet: DeviceDataElements

This type is constrained in the following way:

Fields

The type must satisfy the following field constraints, other fields are unconstrained:

Field	Presence	Value
format	No stipulation	Inverse Any value, except any satisfying the following: Union Any of the following can be true: Single value The value must be exactly: `!I` OR Single value The value must be exactly: `!C` OR Single value The value must be exactly: `!P`

IssuerSignedData

SEQUENCE

This sequence contains the following fields:

data

This field contains data elements signed by the Security Provider.

SEQUENCE OF

This type is constrained in the following way:

Size

The length of the value must be greater than or equal to: 1

The length of the value must be less than or equal to: 64

Data

This type is concretely parameterised with the following:

ElementSet: IssuerDataElements

This type is constrained in the following way:

Fields

The type must satisfy the following field constraints, other fields are unconstrained:

Field	Presence	Value
format	No stipulation	Inverse Any value, except any satisfying the following: Union Any of the following can be true: Single value The value must be exactly: `!I` OR Single value The value must be exactly: `!C` OR Single value The value must be exactly: `!P`

endOfValidity Optional

This field allows for the encoding of an expiry data for the envelope. After this timestamp the envelope needs to be regenerated by the Security Provider for it to remain valid.

Note: this is different from the ticket validity encoded in a data element. An envelope could be valid for more or for less time than the transport product encoded in a data element.

Timestamp

deviceBinding Optional

This field allows for the binding of a barcode envelope to a specific end-device.

SEQUENCE

This sequence contains the following fields:

level2PublicKey

If device binding is in use, this field SHALL contain the public-key of the Presentment Device.

CHOICE

The value of this choice may be one of the following:

nistP256

A point on the NIST P-256 curve.

ECPublicKey

This type is concretely parameterised with the following:

len: 32

secp256K1

A point on the SEC p256k1 curve.

ECPublicKey

This type is concretely parameterised with the following:

len: 32

nistP384

A point on the NIST P-384 curve.

ECPublicKey

This type is concretely parameterised with the following:

len: 48

nistP521

A point on the NIST P-521 curve.

ECPublicKey

This type is concretely parameterised with the following:

len: 66

ed25519

The compressed encoding of an Ed25519 point.

OCTET STRING

This type is constrained in the following way:

Size

The length of the value must exactly: 32

ed448

The compressed encoding of an Ed448 point.

OCTET STRING

This type is constrained in the following way:

Size

The length of the value must exactly: 57

other

If the public-key is not one of the above types, this variant SHALL be used, and SHALL contain the an X.509 SubjectPublicKeyInfo structure, encoded according to the Distinguished Encoding Rules.

OCTET STRING

validityDuration

This field sets how long, in seconds, an envelope signed by the Presentment Device stays valid after generation.

INTEGER

This type is constrained in the following way:

Range

The value must be greater than or equal to: 1

The value must be less than or equal to: 3600

IssuerDataElements

OBJECT SET

This object set has the following members:

&id	&Type	&encoding	&Constraints
`MMT1`	MultiModalTicket	cuperEncoding	MultiModalTicketConstraints
`FPD1`	FixedPoint	cuperEncoding	FixedPointConstraints
`LUG1`	LuggageTag	cuperEncoding	NULL
`ENC1`	EncryptedData	cuperEncoding	NULL
`HSM1`	HSMTrace	cuperEncoding	NULL
`FCB3`	UicRailTicketData	cuperEncoding	NULL
`FCB2`	UicRailTicketData	cuperEncoding	NULL
`FCB13`	UicRailTicketData	cuperEncoding	NULL
Other members may be added at runtime.

DeviceDataElements

OBJECT SET

This object set has the following members:

&id	&Type	&encoding	&Constraints
`DCD1`	DynamicContent	cuperEncoding	NULL
`DCD1A`	DynamicContent	caperEncoding	NULL
`FDC1`	UicDynamicContentData	cuperEncoding	NULL
Other members may be added at runtime.

ECKNRSignature

Parameterised

Message recovery signature as per ISO/IEC 9796-3:2006 Sec. 13 (ECKNR).

This assignment is parameterised, accepting the following parameters:

len: The length, in bytes, of each of r and s. That is, half the total signature length.

INTEGER

SEQUENCE

This sequence contains the following fields:

r: The output r of the ECKNR signature process.

OCTET STRING
This type is constrained in the following way:

Size

The length of the value must exactly: Parameter len
s: The output s of the ECKNR signature process.

OCTET STRING
This type is constrained in the following way:

Size

The length of the value must exactly: Parameter len
remainder: The non-recoverable data part. That is, the remaining data of the ECKNR signature process.

OCTET STRING

MessageRecoverySignature

This data structure contains a Elliptic Curve KCDSA/Nyberg-Rueppel message recovery signature. Such a signature is defined in ISO/IEC 9796-3:2006 Sec. 13.

CHOICE

The value of this choice may be one of the following:

es256

An ECKNR signature over the NIST P-256 curve with the SHA-256 hash function.

ECKNRSignature

This type is concretely parameterised with the following:

len: 32

es256k

An ECKNR signature over the SEC p256k1 curve with the SHA-256 hash function.

ECKNRSignature

This type is concretely parameterised with the following:

len: 32

es384

An ECKNR signature over the NIST P-384 curve with the SHA-384 hash function.

ECKNRSignature

This type is concretely parameterised with the following:

len: 48

es512

An ECKNR signature over the NIST P-521 curve with the SHA-512 hash function.

ECKNRSignature

This type is concretely parameterised with the following:

len: 66

Signature

This data structure contains a non-message recovery (i.e. standard) signature.

CHOICE

The value of this choice may be one of the following:

es256

An ECDSA signature over the NIST P-256 curve with the SHA-256 hash function.

DSSSignature

This type is concretely parameterised with the following:

len: 32

es256k

An ECDSA signature over the SEC p256k1 curve with the SHA-256 hash function.

DSSSignature

This type is concretely parameterised with the following:

len: 32

es384

An ECDSA signature over the NIST P-384 curve with the SHA-384 hash function.

DSSSignature

This type is concretely parameterised with the following:

len: 48

es512

An ECDSA signature over the NIST P-521 curve with the SHA-512 hash function.

DSSSignature

This type is concretely parameterised with the following:

len: 66

ed25519

An EdDSA signature over the Curve25519 curve.

OCTET STRING

This type is constrained in the following way:

Size

The length of the value must exactly: 64

ed448

An EdDSA signature over the Curve448 curve.

OCTET STRING

This type is constrained in the following way:

Size

The length of the value must exactly: 114

other

If the signature scheme is not one of the above types, this variant SHALL be used.

SEQUENCE

This sequence contains the following fields:

algId: An object identifier specifying which signature scheme is in use.

OBJECT IDENTIFIER
signature: The encoded signature, as per the above algId.

OCTET STRING

/**
* BT4PT Envelope - DRAFT.
*
* The envelope **SHALL** be encoded with the Aligned Packed Encoding Rules, as this makes it easier to work with in constrained environments such as HSMs.
* Data elements within the header **SHOULD** be encoded with the Unaligned Packed Encoding Rules, for space savings.
*/
BT4PT-EnvelopeV1-0 {
    iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) envelope(2) v1(1) 0
} DEFINITIONS ::= BEGIN

EXPORTS BT4PTEnvelope, IssuerDataElements;

IMPORTS CompanyCode, Timestamp, Data, DSSSignature, ECPublicKey, DATA-ELEMENT
 FROM BT4PT-GeneralElementsV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) general(1) v1(1) 0 }
 EndEntityCertificate
 FROM BT4PT-CertificatesV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) certificates(7) v1(1) 0 }
 multiModalTicketData
 FROM BT4PT-MultiModalTicketDataV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) mmtd(3) v1(1) 0 }
 dynamicContentData, dynamicContentDataAligned
 FROM BT4PT-DynamicContentDataV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) dcd(4) v1(1) 0 }
 fixedPointData
 FROM BT4PT-FixedPointDataV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) fpd(5) v1(1) 0 }
 encryptedData
 FROM BT4PT-CertificatesV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) encryptedData(11) v1(1) 0 }
 luggageTag
 FROM BT4PT-CertificatesV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) luggageTag(12) v1(1) 0 }
 hsmTraceData
 FROM BT4PT-HSMTraceV1-0 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) bt4pt(2) hsm(6) v1(1) 0 }
 uicRailTicketData
 FROM RailTicketDataV3 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) modules(0) rtd(2) v3(3) 7 }
 uicRailTicketData
 FROM RailTicketDataV2 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) modules(0) rtd(2) v2(2) 3 }
 uicRailTicketData
 FROM RailTicketDataV1 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) modules(0) rtd(2) v1-3(1) 5 }
 uicDynamicContentData
 FROM DynamicContentDataV1 { iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) uic(17218) fcb(1) modules(0) dcd(3) v1(1) 5 };

/**
* This data structure is the basic entry point of the envelope.
* A BT4PT envelope **SHALL** consist of the bytes resulting from encoding this data structure using the ITU-T X.691
* Canonical Aligned Packed Encoding Rules.
*/
BT4PTEnvelope ::= CHOICE {
    /**
    * This variant contains the list of data elements that the envelope encodes, in an unsigned fashion, with no
    * additional security data.
    *
    * This variant is **SHALL** only be used where no security is required. That is, when an unsigned envelope
    * is considered suitable for the application.
    */
    unsigned    [1] SEQUENCE (SIZE(1..16)) OF Data{{IssuerDataElements}} (WITH COMPONENTS {
        ...,
        format (ALL EXCEPT ("!I" | "!C" | "!P"))
    }),
    /**
    * This variant is used for a signed envelope. It contains the list of data elements that the envelope encodes,
    * along with a signature from the Security Provider, the certificate for the end-entity that output this envelope,
    * and an optional binding of this envelope to a end-device's public key.
    */
    signed      [2] SEQUENCE {
        data            DeviceSignedData,
        /**
        * This field is used as part of the device binding of envelopes. When an envelope is bound to a Presentment
        * Device, it **SHALL** contain a signature, calculated over the Canonical Aligned Packed Encoding Rules encoding
        * of {@link DeviceSignedData}, using the device held private key corresponding to the public key provided in the
        * `level2PublicKey` field of `IssuerSignedData`.
        *
        * If the the `deviceBinding` field of `IssuerSignedData` field is unset, and this field is set, the envelope **SHALL** be
        * construed as invalid.
        * If the the `deviceBinding` field of `IssuerSignedData` field is set, and this field is unset, the envelope **SHALL** be
        * construed as invalid.
        */
        deviceSignature Signature OPTIONAL
    }
}

DeviceSignedData ::= SEQUENCE {
    /**
    * This field contains the data signed by the Security Provider, in a message recovery fashion.
    * Its inner data is the Canonical Aligned Packed Encoding Rules encoding of {@link IssuerSignedData}.
    */
    data        MessageRecoverySignature,
    /**
    * This field contains the end-entity certificate used to sign the `data` field.
    */
    certificate EndEntityCertificate,
    /**
    * This field contains the timestamp at which the Presentment Device generated the envelope.
    *
    * This field **SHALL** be set if `IssuerSignedData.deviceBinding` is set, otherwise the envelope **SHALL** be
    * construed as invalid.
    * If this timestamp is more than `IssuerSignedData.deviceBinding.validityDuration` seconds in the past,
    * the envelope **SHALL** be construed as invalid.
    */
    timestamp   Timestamp   OPTIONAL,
    /**
    * This field contains data elements signed only by the Presentment Device, or not signed at all.
    * Note: the inclusion of device data without the `IssuerSignedData.deviceBinding` field being set is _not_ an error.
    * It is permissible to include unauthenticated device data, for example as a debugging aid.
    */
    deviceData  SEQUENCE (SIZE(1..8)) OF Data{{DeviceDataElements}} (WITH COMPONENTS {
        ...,
        format (ALL EXCEPT ("!I" | "!C" | "!P"))
    }) OPTIONAL
}

IssuerSignedData ::= [APPLICATION 12] SEQUENCE {
    /**
    * This field contains data elements signed by the Security Provider.
    */
    data                SEQUENCE (SIZE(1..64)) OF Data{{IssuerDataElements}} (WITH COMPONENTS {
        ...,
        format (ALL EXCEPT ("!I" | "!C" | "!P"))
    }),
    /**
    * This field allows for the encoding of an expiry data for the envelope. After this timestamp the envelope needs to
    * be regenerated by the Security Provider for it to remain valid.
    *
    * Note: this is different from the ticket validity encoded in a data element. An envelope could be valid for more or
    * for less time than the transport product encoded in a data element.
    */
    endOfValidity       Timestamp   OPTIONAL,
    /**
    * This field allows for the binding of a barcode envelope to a specific end-device.
    */
    deviceBinding       [1] SEQUENCE {
        /**
        * If device binding is in use, this field **SHALL** contain the public-key of the Presentment Device.
        */
        level2PublicKey     CHOICE {
            /**
            * A point on the NIST P-256 curve.
            */
            nistP256    [1] ECPublicKey{32},
            /**
            * A point on the SEC p256k1 curve.
            */
            secp256K1   [2] ECPublicKey{32},
            /**
            * A point on the NIST P-384 curve.
            */
            nistP384    [3] ECPublicKey{48},
            /**
            * A point on the NIST P-521 curve.
            */
            nistP521    [4] ECPublicKey{66},
            /**
            * The compressed encoding of an Ed25519 point.
            */
            ed25519     [5] OCTET STRING (SIZE (32)),
            /**
            * The compressed encoding of an Ed448 point.
            */
            ed448       [6] OCTET STRING (SIZE (57)),
            /**
            * If the public-key is not one of the above types, this variant **SHALL** be used, and **SHALL** contain the
            * an X.509 `SubjectPublicKeyInfo` structure, encoded according to the Distinguished Encoding Rules.
            */
            other       [7] OCTET STRING
        },
        /**
        * This field sets how long, in seconds, an envelope signed by the Presentment Device stays valid after generation.
        */
        validityDuration    INTEGER (1..3600)
   	} OPTIONAL
}

IssuerDataElements DATA-ELEMENT ::= {
    multiModalTicketData |
    fixedPointData |
    luggageTag |
    encryptedData |
    hsmTraceData |
    RailTicketDataV3.uicRailTicketData |
    RailTicketDataV2.uicRailTicketData |
    RailTicketDataV1.uicRailTicketData,
    ...
}

DeviceDataElements DATA-ELEMENT ::= {
    dynamicContentData |
    dynamicContentDataAligned |
    DynamicContentDataV1.uicDynamicContentData,
    ...
}

/**
* Message recovery signature as per ISO/IEC 9796-3:2006 Sec. 13 (ECKNR).
* @len The length, in bytes, of each of `r` and `s`. That is, half the total signature length.
*/
ECKNRSignature{INTEGER: len} ::= SEQUENCE {
    /**
    * The output r of the ECKNR signature process.
    */
    r OCTET STRING (SIZE(len)),
    /**
    * The output s of the ECKNR signature process.
    */
    s OCTET STRING (SIZE(len)),
    /**
    * The non-recoverable data part. That is, the remaining data of the ECKNR signature process.
    */
    remainder OCTET STRING
}

/**
* This data structure contains a Elliptic Curve KCDSA/Nyberg-Rueppel message recovery signature.
* Such a signature is defined in ISO/IEC 9796-3:2006 Sec. 13.
*/
MessageRecoverySignature ::= [APPLICATION 11] CHOICE {
    /**
    * An ECKNR signature over the NIST P-256 curve with the SHA-256 hash function.
    */
    es256   [1] ECKNRSignature{32},
    /**
    * An ECKNR signature over the SEC p256k1 curve with the SHA-256 hash function.
    */
    es256k  [2] ECKNRSignature{32},
    /**
    * An ECKNR signature over the NIST P-384 curve with the SHA-384 hash function.
    */
    es384   [3] ECKNRSignature{48},
    /**
    * An ECKNR signature over the NIST P-521 curve with the SHA-512 hash function.
    */
    es512   [4] ECKNRSignature{66}
}

/**
* This data structure contains a non-message recovery (i.e. standard) signature.
*/
Signature ::= CHOICE {
    /**
    * An ECDSA signature over the NIST P-256 curve with the SHA-256 hash function.
    */
    es256       [1] DSSSignature{32},
    /**
    * An ECDSA signature over the SEC p256k1 curve with the SHA-256 hash function.
    */
    es256k      [2] DSSSignature{32},
    /**
    * An ECDSA signature over the NIST P-384 curve with the SHA-384 hash function.
    */
    es384       [3] DSSSignature{48},
    /**
    * An ECDSA signature over the NIST P-521 curve with the SHA-512 hash function.
    */
    es512       [4] DSSSignature{66},
    /**
    * An EdDSA signature over the Curve25519 curve.
    */
    ed25519     [5] OCTET STRING (SIZE (64)),
    /**
    * An EdDSA signature over the Curve448 curve.
    */
    ed448       [6] OCTET STRING (SIZE (114)),
    /**
    * If the signature scheme is not one of the above types, this variant **SHALL** be used.
    */
    other       [7] SEQUENCE {
        /**
        * An object identifier specifying which signature scheme is in use.
        */
        algId       OBJECT IDENTIFIER,
        /**
        * The encoded signature, as per the above `algId`.
        */
        signature   OCTET STRING
    }
}

END

Module Info

Exports

Imports

From BT4PT-GeneralElementsV1-0

From BT4PT-CertificatesV1-0

From BT4PT-MultiModalTicketDataV1-0

From BT4PT-DynamicContentDataV1-0

From BT4PT-FixedPointDataV1-0

From BT4PT-CertificatesV1-0

From BT4PT-CertificatesV1-0

From BT4PT-HSMTraceV1-0

From RailTicketDataV3

From RailTicketDataV2

From RailTicketDataV1

From DynamicContentDataV1

Assignments

BT4PTEnvelope

Size

Fields

Inverse

Union

Single value

Single value

Single value

DeviceSignedData

Size

Fields

Inverse

Union

Single value

Single value

Single value

IssuerSignedData

Size

Fields

Inverse

Union

Single value

Single value

Single value

Size

Size

Range

IssuerDataElements

DeviceDataElements

ECKNRSignature

Size

Size

MessageRecoverySignature

Signature

Size

Size