-- Id --
-- Definitions from rfc2459/rfc3280

RFC2459 DEFINITIONS ::= BEGIN

IMPORTS heim_any FROM heim;

Version ::=  INTEGER {
	rfc3280_version_1(0),
	rfc3280_version_2(1),
	rfc3280_version_3(2)
}

id-pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
	rsadsi(113549) pkcs(1) 1 }
id-pkcs1-rsaEncryption OBJECT IDENTIFIER ::=		{ id-pkcs-1 1 }
id-pkcs1-md2WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 2 }
id-pkcs1-md5WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 4 }
id-pkcs1-sha1WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 5 }
id-pkcs1-sha256WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 11 }
id-pkcs1-sha384WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 12 }
id-pkcs1-sha512WithRSAEncryption OBJECT IDENTIFIER ::=	{ id-pkcs-1 13 }

id-heim-rsa-pkcs1-x509 OBJECT IDENTIFIER ::= { 1  2 752 43 16 1 }

id-pkcs-2 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
	rsadsi(113549) pkcs(1) 2 }
id-pkcs2-md2 OBJECT IDENTIFIER ::=		{ id-pkcs-2 2 }
id-pkcs2-md4 OBJECT IDENTIFIER ::=		{ id-pkcs-2 4 }
id-pkcs2-md5 OBJECT IDENTIFIER ::=		{ id-pkcs-2 5 }

id-rsa-digestAlgorithm OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) 2 }

id-rsa-digest-md2 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 2 }
id-rsa-digest-md4 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 4 }
id-rsa-digest-md5 OBJECT IDENTIFIER ::= { id-rsa-digestAlgorithm 5 }

id-pkcs-3 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
	rsadsi(113549) pkcs(1) 3 }

id-pkcs3-rc2-cbc OBJECT IDENTIFIER ::=		{ id-pkcs-3 2 }
id-pkcs3-rc4     OBJECT IDENTIFIER ::=		{ id-pkcs-3 4 }
id-pkcs3-des-ede3-cbc OBJECT IDENTIFIER ::=	{ id-pkcs-3 7 }

id-rsadsi-encalg OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
	rsadsi(113549) 3 }

id-rsadsi-rc2-cbc OBJECT IDENTIFIER ::=		{ id-rsadsi-encalg 2 }
id-rsadsi-des-ede3-cbc OBJECT IDENTIFIER ::=	{ id-rsadsi-encalg 7 }

id-secsig-sha-1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
	oiw(14) secsig(3) algorithm(2) 26 }

id-secsig-sha-1WithRSAEncryption OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
	oiw(14) secsig(3) algorithm(2) 29 }

id-nistAlgorithm OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) 4 }
  
id-nist-aes-algs OBJECT IDENTIFIER ::= { id-nistAlgorithm 1 }

id-aes-128-cbc OBJECT IDENTIFIER ::=		{ id-nist-aes-algs 2 }
id-aes-192-cbc OBJECT IDENTIFIER ::=		{ id-nist-aes-algs 22 }
id-aes-256-cbc OBJECT IDENTIFIER ::=		{ id-nist-aes-algs 42 }

id-nist-sha-algs OBJECT IDENTIFIER ::=		{ id-nistAlgorithm 2 }

id-sha256 OBJECT IDENTIFIER ::=			{ id-nist-sha-algs 1 }
id-sha224 OBJECT IDENTIFIER ::=			{ id-nist-sha-algs 4 }
id-sha384 OBJECT IDENTIFIER ::=			{ id-nist-sha-algs 2 }
id-sha512 OBJECT IDENTIFIER ::=			{ id-nist-sha-algs 3 }

id-dhpublicnumber OBJECT IDENTIFIER ::= {
        iso(1) member-body(2) us(840) ansi-x942(10046)
        number-type(2) 1 }

-- ECC

id-ecPublicKey OBJECT IDENTIFIER ::= {
       iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1 }

id-ecDH OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) schemes(1)
       ecdh(12) }

id-ecMQV OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) schemes(1)
       ecmqv(13) }

id-ecdsa-with-SHA512 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
     ecdsa-with-SHA2(3) 4 }

id-ecdsa-with-SHA384 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
     ecdsa-with-SHA2(3) 3 }

id-ecdsa-with-SHA256 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
     ecdsa-with-SHA2(3) 2 }

id-ecdsa-with-SHA224 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4)
     ecdsa-with-SHA2(3) 1 }

id-ecdsa-with-SHA1 OBJECT IDENTIFIER ::= {
     iso(1) member-body(2) us(840) ansi-X9-62(10045) signatures(4) 1 }

-- some EC group ids

id-ec-group-secp256r1 OBJECT IDENTIFIER ::= {
       iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)
       prime(1) 7 }

id-ec-group-secp160r1 OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) 0 8 }

id-ec-group-secp160r2 OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) 0 30 }

id-ec-group-secp224r1 OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) 0 33 }

id-ec-group-secp384r1 OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) 0 34 }

id-ec-group-secp521r1 OBJECT IDENTIFIER ::= {
       iso(1) identified-organization(3) certicom(132) 0 35 }

-- DSA

id-x9-57 OBJECT IDENTIFIER ::= {
        iso(1) member-body(2) us(840) ansi-x942(10046) 4 }

id-dsa OBJECT IDENTIFIER ::=		{ id-x9-57 1 }
id-dsa-with-sha1 OBJECT IDENTIFIER ::=		{ id-x9-57 3 }

-- x.520 names types

id-x520-at 	OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }

id-at-commonName		OBJECT IDENTIFIER ::= { id-x520-at 3 }
id-at-surname			OBJECT IDENTIFIER ::= { id-x520-at 4 }
id-at-serialNumber		OBJECT IDENTIFIER ::= { id-x520-at 5 }
id-at-countryName		OBJECT IDENTIFIER ::= { id-x520-at 6 }
id-at-localityName		OBJECT IDENTIFIER ::= { id-x520-at 7 }
id-at-stateOrProvinceName	OBJECT IDENTIFIER ::= { id-x520-at 8 }
id-at-streetAddress		OBJECT IDENTIFIER ::= { id-x520-at 9 }
id-at-organizationName		OBJECT IDENTIFIER ::= { id-x520-at 10 }
id-at-organizationalUnitName	OBJECT IDENTIFIER ::= { id-x520-at 11 }
id-at-title			OBJECT IDENTIFIER ::= { id-x520-at 12 }
id-at-description		OBJECT IDENTIFIER ::= { id-x520-at 13 }
id-at-name			OBJECT IDENTIFIER ::= { id-x520-at 41 }
id-at-givenName			OBJECT IDENTIFIER ::= { id-x520-at 42 }
id-at-initials			OBJECT IDENTIFIER ::= { id-x520-at 43 }
id-at-generationQualifier	OBJECT IDENTIFIER ::= { id-x520-at 44 }
id-at-pseudonym			OBJECT IDENTIFIER ::= { id-x520-at 65 }
-- RFC 2247
id-Userid		      	OBJECT IDENTIFIER ::=
                          { 0 9 2342 19200300 100 1 1 }
id-domainComponent      	OBJECT IDENTIFIER ::=
                          { 0 9 2342 19200300 100 1 25 }


-- rfc3280

id-x509-ce OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 29}

AlgorithmIdentifier ::= SEQUENCE {
	algorithm	OBJECT IDENTIFIER,
	parameters	heim_any OPTIONAL
}

AttributeType ::=   OBJECT IDENTIFIER

AttributeValue ::=   heim_any

DirectoryString ::= CHOICE {
	ia5String	IA5String,
	teletexString	TeletexString,
	printableString	PrintableString,
	universalString UniversalString,
	utf8String	UTF8String,
	bmpString	BMPString
}

Attribute ::= SEQUENCE {
        type    AttributeType,
        value   SET OF -- AttributeValue -- heim_any
}

AttributeTypeAndValue ::= SEQUENCE {
        type    AttributeType,
        value   DirectoryString
}

RelativeDistinguishedName ::= SET OF AttributeTypeAndValue

RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

Name ::= CHOICE {
	rdnSequence  RDNSequence
}

CertificateSerialNumber ::= INTEGER

Time ::= CHOICE {
     utcTime        UTCTime,
     generalTime    GeneralizedTime
}

Validity ::= SEQUENCE {
     notBefore      Time,
     notAfter       Time
}

UniqueIdentifier  ::=  BIT STRING

SubjectPublicKeyInfo  ::=  SEQUENCE  {
     algorithm            AlgorithmIdentifier,
     subjectPublicKey     BIT STRING
}

Extension  ::=  SEQUENCE  {
     extnID      OBJECT IDENTIFIER,
     critical    BOOLEAN OPTIONAL, -- DEFAULT FALSE XXX
     extnValue   OCTET STRING
}

Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension

TBSCertificate  ::=  SEQUENCE  {
     version         [0]  Version OPTIONAL, -- EXPLICIT nnn DEFAULT 1,
     serialNumber         CertificateSerialNumber,
     signature            AlgorithmIdentifier,
     issuer               Name,
     validity             Validity,
     subject              Name,
     subjectPublicKeyInfo SubjectPublicKeyInfo,
     issuerUniqueID  [1]  IMPLICIT BIT STRING -- UniqueIdentifier -- OPTIONAL,
                          -- If present, version shall be v2 or v3
     subjectUniqueID [2]  IMPLICIT BIT STRING -- UniqueIdentifier -- OPTIONAL,
                          -- If present, version shall be v2 or v3
     extensions      [3]  EXPLICIT Extensions OPTIONAL
                          -- If present, version shall be v3
}

Certificate  ::=  SEQUENCE  {
     tbsCertificate       TBSCertificate,
     signatureAlgorithm   AlgorithmIdentifier,
     signatureValue       BIT STRING
}

Certificates ::= SEQUENCE OF Certificate

ValidationParms ::= SEQUENCE {
	seed		BIT STRING,
	pgenCounter	INTEGER
}

DomainParameters ::= SEQUENCE {
	p		INTEGER, -- odd prime, p=jq +1
	g		INTEGER, -- generator, g
	q		INTEGER OPTIONAL, -- factor of p-1
	j		INTEGER OPTIONAL, -- subgroup factor
	validationParms	ValidationParms OPTIONAL -- ValidationParms
}

-- As defined by PKCS3
DHParameter ::= SEQUENCE {
	prime		INTEGER, -- odd prime, p=jq +1
	base		INTEGER, -- generator, g
	privateValueLength INTEGER OPTIONAL
}

DHPublicKey ::= INTEGER

OtherName ::= SEQUENCE {
	type-id    OBJECT IDENTIFIER,
	value      [0] EXPLICIT heim_any
}

GeneralName ::= CHOICE {
	otherName			[0]     IMPLICIT -- OtherName -- SEQUENCE {
		type-id    OBJECT IDENTIFIER,
		value      [0] EXPLICIT heim_any
	},
	rfc822Name			[1]     IMPLICIT IA5String,
	dNSName				[2]     IMPLICIT IA5String,
--	x400Address			[3]     IMPLICIT ORAddress,--
	directoryName			[4]     IMPLICIT -- Name -- CHOICE {
		rdnSequence  RDNSequence
	},
--	ediPartyName			[5]     IMPLICIT EDIPartyName, --
	uniformResourceIdentifier	[6]     IMPLICIT IA5String,
	iPAddress			[7]     IMPLICIT OCTET STRING,
	registeredID			[8]     IMPLICIT OBJECT IDENTIFIER
}

GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

id-x509-ce-keyUsage OBJECT IDENTIFIER ::=  { id-x509-ce 15 }

KeyUsage ::= BIT STRING {
	digitalSignature	(0),
	nonRepudiation		(1),
	keyEncipherment		(2),
	dataEncipherment	(3),
	keyAgreement		(4),
	keyCertSign		(5),
	cRLSign			(6),
	encipherOnly		(7),
	decipherOnly		(8)
}

id-x509-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=  { id-x509-ce 35 }

KeyIdentifier ::= OCTET STRING

AuthorityKeyIdentifier ::= SEQUENCE {
	keyIdentifier             [0] IMPLICIT OCTET STRING OPTIONAL,
	authorityCertIssuer       [1] IMPLICIT -- GeneralName --
		SEQUENCE -- SIZE (1..MAX) -- OF GeneralName OPTIONAL,
	authorityCertSerialNumber [2] IMPLICIT INTEGER OPTIONAL
}

id-x509-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::=  { id-x509-ce 14 }

SubjectKeyIdentifier ::= KeyIdentifier

id-x509-ce-basicConstraints OBJECT IDENTIFIER ::=  { id-x509-ce 19 }

BasicConstraints ::= SEQUENCE {
	cA                      BOOLEAN OPTIONAL -- DEFAULT FALSE --,
	pathLenConstraint	INTEGER (0..4294967295) OPTIONAL
}

id-x509-ce-nameConstraints OBJECT IDENTIFIER ::=  { id-x509-ce 30 }

BaseDistance ::= INTEGER -- (0..MAX) --

GeneralSubtree ::= SEQUENCE {
	base			GeneralName,
	minimum		[0]	IMPLICIT -- BaseDistance -- INTEGER OPTIONAL -- DEFAULT 0 --,
	maximum		[1]	IMPLICIT -- BaseDistance -- INTEGER OPTIONAL
}

GeneralSubtrees ::= SEQUENCE -- SIZE (1..MAX) -- OF GeneralSubtree

NameConstraints ::= SEQUENCE {
	permittedSubtrees       [0]     IMPLICIT -- GeneralSubtrees -- SEQUENCE OF GeneralSubtree OPTIONAL,
	excludedSubtrees        [1]     IMPLICIT -- GeneralSubtrees -- SEQUENCE OF GeneralSubtree OPTIONAL
}

id-x509-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-x509-ce 16 }
id-x509-ce-certificatePolicies OBJECT IDENTIFIER ::=  { id-x509-ce 32 }
id-x509-ce-policyMappings OBJECT IDENTIFIER ::=  { id-x509-ce 33 }
id-x509-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-x509-ce 17 }
id-x509-ce-issuerAltName OBJECT IDENTIFIER ::=  { id-x509-ce 18 }
id-x509-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=  { id-x509-ce 9 }
id-x509-ce-policyConstraints OBJECT IDENTIFIER ::=  { id-x509-ce 36 }

id-x509-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-x509-ce 37}

ExtKeyUsage ::= SEQUENCE OF OBJECT IDENTIFIER

id-x509-ce-cRLDistributionPoints OBJECT IDENTIFIER ::=  { id-x509-ce 31 }
id-x509-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-x509-ce 27 }
id-x509-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-x509-ce 28 }
id-x509-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-x509-ce 23 }
id-x509-ce-invalidityDate OBJECT IDENTIFIER ::= { id-x509-ce 24 }
id-x509-ce-certificateIssuer   OBJECT IDENTIFIER ::= { id-x509-ce 29 }
id-x509-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-x509-ce 54 }

DistributionPointReasonFlags ::= BIT STRING {
	unused                  (0),
	keyCompromise           (1),
	cACompromise            (2),
	affiliationChanged      (3),
	superseded              (4),
	cessationOfOperation    (5),
	certificateHold         (6),
	privilegeWithdrawn      (7),
	aACompromise            (8)
}

DistributionPointName ::= CHOICE {
	fullName                [0]     IMPLICIT -- GeneralNames --  SEQUENCE SIZE (1..MAX) OF GeneralName,
	nameRelativeToCRLIssuer [1]     RelativeDistinguishedName
}

DistributionPoint ::= SEQUENCE {
	distributionPoint       [0]     IMPLICIT heim_any -- DistributionPointName -- OPTIONAL,
	reasons                 [1]     IMPLICIT heim_any -- DistributionPointReasonFlags -- OPTIONAL,
	cRLIssuer               [2]     IMPLICIT heim_any -- GeneralNames -- OPTIONAL
}

CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint


-- rfc3279

DSASigValue  ::=  SEQUENCE {
	r	INTEGER,
	s	INTEGER
}

DSAPublicKey ::= INTEGER

DSAParams  ::=  SEQUENCE {
	p	INTEGER,
	q	INTEGER,
	g	INTEGER
}

-- draft-ietf-pkix-ecc-subpubkeyinfo-11

ECPoint ::= OCTET STRING

ECParameters ::= CHOICE {
	namedCurve         OBJECT IDENTIFIER
	-- implicitCurve   NULL
	-- specifiedCurve  SpecifiedECDomain
}

ECDSA-Sig-Value ::= SEQUENCE {
     r  INTEGER,
     s  INTEGER
}

-- really pkcs1

RSAPublicKey ::= SEQUENCE {
	modulus INTEGER, -- n
	publicExponent INTEGER -- e
}

RSAPrivateKey ::= SEQUENCE {
	version INTEGER (0..4294967295),
	modulus INTEGER, -- n
	publicExponent INTEGER, -- e
	privateExponent INTEGER, -- d
	prime1 INTEGER, -- p
	prime2 INTEGER, -- q
	exponent1 INTEGER, -- d mod (p-1)
	exponent2 INTEGER, -- d mod (q-1)
	coefficient INTEGER -- (inverse of q) mod p
}

DigestInfo ::= SEQUENCE {
	digestAlgorithm AlgorithmIdentifier,
	digest OCTET STRING
}

-- some ms ext

-- szOID_ENROLL_CERTTYPE_EXTENSION "1.3.6.1.4.1.311.20.2" is Encoded as a

-- UNICODESTRING (0x1E tag)

-- szOID_CERTIFICATE_TEMPLATE "1.3.6.1.4.1.311.21.7" is Encoded as:

-- TemplateVersion ::= INTEGER (0..4294967295)

-- CertificateTemplate ::= SEQUENCE {
--	templateID OBJECT IDENTIFIER,
--	templateMajorVersion TemplateVersion,
--	templateMinorVersion TemplateVersion OPTIONAL
-- }


--
-- CRL
--

TBSCRLCertList ::=  SEQUENCE  {
	version			Version OPTIONAL, -- if present, MUST be v2
	signature		AlgorithmIdentifier,
	issuer			Name,
	thisUpdate		Time,
	nextUpdate		Time OPTIONAL,
	revokedCertificates     SEQUENCE OF SEQUENCE  {
		userCertificate         CertificateSerialNumber,
		revocationDate          Time,
		crlEntryExtensions      Extensions OPTIONAL
						-- if present, MUST be v2
	} OPTIONAL,
	crlExtensions		[0] EXPLICIT Extensions OPTIONAL
						-- if present, MUST be v2
}


CRLCertificateList ::=  SEQUENCE  {
	tbsCertList          TBSCRLCertList,
	signatureAlgorithm   AlgorithmIdentifier,
	signatureValue       BIT STRING
}

id-x509-ce-cRLNumber OBJECT IDENTIFIER ::= { id-x509-ce 20 }
id-x509-ce-freshestCRL OBJECT IDENTIFIER ::=  { id-x509-ce 46 }
id-x509-ce-cRLReason OBJECT IDENTIFIER ::= { id-x509-ce 21 }

CRLReason ::= ENUMERATED {
	unspecified             (0),
	keyCompromise           (1),
	cACompromise            (2),
	affiliationChanged      (3),
	superseded              (4),
	cessationOfOperation    (5),
	certificateHold         (6),
	removeFromCRL           (8),
	privilegeWithdrawn      (9),
	aACompromise           (10)
}

PKIXXmppAddr ::= UTF8String

id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
            dod(6) internet(1) security(5) mechanisms(5) pkix(7) }

id-pkix-on OBJECT IDENTIFIER ::= { id-pkix 8 }
id-pkix-on-xmppAddr OBJECT IDENTIFIER ::= { id-pkix-on 5 }
id-pkix-on-dnsSRV OBJECT IDENTIFIER ::= { id-pkix-on 7 }

id-pkix-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
id-pkix-kp-serverAuth OBJECT IDENTIFIER ::= { id-pkix-kp 1 }
id-pkix-kp-clientAuth OBJECT IDENTIFIER ::= { id-pkix-kp 2 }
id-pkix-kp-emailProtection OBJECT IDENTIFIER ::= { id-pkix-kp 4 }
id-pkix-kp-timeStamping OBJECT IDENTIFIER ::= { id-pkix-kp 8 }
id-pkix-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-pkix-kp 9 }

id-pkix-pe OBJECT IDENTIFIER ::= { id-pkix 1 }

id-pkix-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pkix-pe 1 }

AccessDescription  ::=  SEQUENCE {
	accessMethod          OBJECT IDENTIFIER,
	accessLocation        GeneralName
}

AuthorityInfoAccessSyntax ::= SEQUENCE SIZE (1..MAX) OF AccessDescription

-- RFC 3820 Proxy Certificate Profile

id-pkix-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pkix-pe 14 }

id-pkix-ppl  OBJECT IDENTIFIER ::= { id-pkix 21 }

id-pkix-ppl-anyLanguage     OBJECT IDENTIFIER ::= { id-pkix-ppl 0 }
id-pkix-ppl-inheritAll      OBJECT IDENTIFIER ::= { id-pkix-ppl 1 }
id-pkix-ppl-independent     OBJECT IDENTIFIER ::= { id-pkix-ppl 2 }

ProxyPolicy ::= SEQUENCE {
	policyLanguage		OBJECT IDENTIFIER,
	policy			OCTET STRING OPTIONAL
}

ProxyCertInfo ::= SEQUENCE {
	pCPathLenConstraint	INTEGER (0..4294967295) OPTIONAL, -- really MAX
	proxyPolicy		ProxyPolicy
}

--- U.S. Federal PKI Common Policy Framework
-- Card Authentication key
id-uspkicommon-card-id OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 6 }
id-uspkicommon-piv-interim OBJECT IDENTIFIER ::= { 2 16 840 1 101 3 6 9 1 }

--- Netscape extentions

id-netscape OBJECT IDENTIFIER ::=
    { joint-iso-itu-t(2) country(16) us(840) organization(1) netscape(113730) }
id-netscape-cert-comment OBJECT IDENTIFIER ::= { id-netscape 1 13 }

--- MS extentions

id-ms-cert-enroll-domaincontroller OBJECT IDENTIFIER ::=
    { 1 3 6 1 4 1 311 20 2 }

id-ms-client-authentication OBJECT IDENTIFIER ::=
 { 1 3 6 1 5 5 7 3 2 }

-- DER:1e:20:00:44:00:6f:00:6d:00:61:00:69:00:6e:00:43:00:6f:00:6e:00:74:00:72:00:6f:00:6c:00:6c:00:65:00:72

END