-- %CopyrightBegin%
--
-- SPDX-License-Identifier: BSD-3-Clause
--
-- Copyright (c) 2024 IETF Trust and the persons identified as the document authors.  All rights reserved.
-- Copyright Ericsson AB 2025. All Rights Reserved.
--
-- Redistribution and use in source and binary forms, with or without
-- modification, are permitted provided that the following conditions are met:
--
-- 1. Redistributions of source code must retain the above copyright notice,
--    this list of conditions and the following disclaimer.
--
-- 2. Redistributions in binary form must reproduce the above copyright notice,
--    this list of conditions and the following disclaimer in the documentation
--    and/or other materials provided with the distribution.
--
-- 3. Neither the name of the copyright holder nor the names of its contributors
--    may be used to endorse or promote products derived from this software
--    without specific prior written permission.
--
-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS”
-- AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-- ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-- LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-- CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-- POSSIBILITY OF SUCH DAMAGE.
--
-- %CopyrightEnd%

OCSP-2024-08
     { iso(1) identified-organization(3) dod(6) internet(1)
       security(5) mechanisms(5) pkix(7) id-mod(0)
       id-mod-ocsp-2024-08(112) }

DEFINITIONS EXPLICIT TAGS ::=
BEGIN

IMPORTS
    Extensions{}, EXTENSION
    FROM PKIX-CommonTypes-2009 -- From [RFC5912]
    { iso(1) identified-organization(3) dod(6)
      internet(1) security(5) mechanisms(5) pkix(7)
      id-mod(0) id-mod-pkixCommon-02(57) }

    AlgorithmIdentifier{}, DIGEST-ALGORITHM,
    SIGNATURE-ALGORITHM, PUBLIC-KEY
    FROM AlgorithmInformation-2009 -- From [RFC5912]
    { iso(1) identified-organization(3) dod(6)
      internet(1) security(5) mechanisms(5) pkix(7)
      id-mod(0) id-mod-algorithmInformation-02(58) }

    AuthorityInfoAccessSyntax, GeneralName,
    CrlEntryExtensions, CRLReason
    FROM PKIX1Implicit-2009 -- From [RFC5912]
    { iso(1) identified-organization(3) dod(6)
      internet(1) security(5) mechanisms(5) pkix(7)
      id-mod(0) id-mod-pkix1-implicit-02(59) }

    Name, Certificate, CertificateSerialNumber,
    id-kp, id-ad-ocsp
    FROM PKIX1Explicit-2009 -- From [RFC5912]
    { iso(1) identified-organization(3) dod(6)
      internet(1) security(5) mechanisms(5) pkix(7)
      id-mod(0) id-mod-pkix1-explicit-02(51) }

    sa-dsaWithSHA1, sa-rsaWithMD2,
    sa-rsaWithMD5, sa-rsaWithSHA1
    FROM PKIXAlgs-2009 -- From [RFC5912]
    { iso(1) identified-organization(3) dod(6)
    internet(1) security(5) mechanisms(5) pkix(7)
    id-mod(0) id-mod-pkix1-algorithms2008-02(56) } ;

OCSPRequest ::= SEQUENCE {
   tbsRequest             TBSRequest,
   optionalSignature  [0] EXPLICIT Signature OPTIONAL }

TBSRequest ::= SEQUENCE {
   version            [0] EXPLICIT Version DEFAULT v1,
   requestorName      [1] EXPLICIT GeneralName OPTIONAL,
   requestList             SEQUENCE OF Request,
   requestExtensions  [2] EXPLICIT Extensions
                          {{ re-ocsp-nonce | re-ocsp-response |
                          re-ocsp-preferred-signature-algorithms,
                          ... }} OPTIONAL }

Signature ::= SEQUENCE {
   signatureAlgorithm   AlgorithmIdentifier
                            { SIGNATURE-ALGORITHM, {...}},
   signature            BIT STRING,
   certs            [0] EXPLICIT SEQUENCE OF
                        Certificate OPTIONAL }

Version ::= INTEGER  {  v1(0) }

Nonce ::= OCTET STRING (SIZE(1..128))

Request ::= SEQUENCE {
   reqCert                      CertID,
   singleRequestExtensions  [0] EXPLICIT Extensions
                                {{ re-ocsp-service-locator,
                                ... }} OPTIONAL }

CertID ::= SEQUENCE {
   hashAlgorithm   AlgorithmIdentifier
                       { DIGEST-ALGORITHM, {...}},
   issuerNameHash  OCTET STRING, -- Hash of issuer's DN
   issuerKeyHash   OCTET STRING, -- Hash of issuer's public key
   serialNumber    CertificateSerialNumber }

OCSPResponse ::= SEQUENCE {
  responseStatus       OCSPResponseStatus,
  responseBytes    [0] EXPLICIT ResponseBytes OPTIONAL }

OCSPResponseStatus ::= ENUMERATED {
   successful        (0), -- Response has valid confirmations
   malformedRequest  (1), -- Illegal confirmation request
   internalError     (2), -- Internal error in issuer
   tryLater          (3), -- Try again later
                          -- (4) is not used
   sigRequired       (5), -- Must sign the request
   unauthorized      (6)  -- Request unauthorized
}

RESPONSE ::= TYPE-IDENTIFIER

ResponseSet RESPONSE ::= { basicResponse, ... }

ResponseBytes ::= SEQUENCE {
   responseType  RESPONSE.&id ({ResponseSet}),
   response      OCTET STRING (CONTAINING RESPONSE.
                     &Type({ResponseSet}{@responseType}))}

basicResponse RESPONSE ::=
   { BasicOCSPResponse IDENTIFIED BY id-pkix-ocsp-basic }

BasicOCSPResponse ::= SEQUENCE {
  tbsResponseData      ResponseData,
  signatureAlgorithm   AlgorithmIdentifier
                           { SIGNATURE-ALGORITHM,
                               { sa-dsaWithSHA1 |
                                 sa-rsaWithSHA1 |
                                 sa-rsaWithMD5  |
                                 sa-rsaWithMD2,
                                 ... }},
  signature            BIT STRING,
  certs            [0] EXPLICIT SEQUENCE OF
                       Certificate OPTIONAL }

ResponseData ::= SEQUENCE {
  version             [0] EXPLICIT Version DEFAULT v1,
  responderID             ResponderID,
  producedAt              GeneralizedTime,
  responses               SEQUENCE OF SingleResponse,
  responseExtensions  [1] EXPLICIT Extensions
                              {{ re-ocsp-nonce |
                                 re-ocsp-extended-revoke,
                                 ... }} OPTIONAL }

ResponderID ::= CHOICE {
  byName   [1] Name,
  byKey    [2] KeyHash }

KeyHash ::= OCTET STRING
            -- SHA-1 hash of responder's public key
            -- (excluding the tag and length and number
            -- of unused bits)

SingleResponse ::= SEQUENCE {
  certID                CertID,
  certStatus            CertStatus,
  thisUpdate            GeneralizedTime,
  nextUpdate        [0] EXPLICIT GeneralizedTime OPTIONAL,
  singleExtensions  [1] EXPLICIT Extensions
                        {{ re-ocsp-crl |
                           re-ocsp-archive-cutoff |
                           CrlEntryExtensions,
                           ... }} OPTIONAL }

CertStatus ::= CHOICE {
   good     [0] IMPLICIT NULL,
   revoked  [1] IMPLICIT RevokedInfo,
   unknown  [2] IMPLICIT UnknownInfo }

RevokedInfo ::= SEQUENCE {
   revocationTime        GeneralizedTime,
   revocationReason  [0] EXPLICIT CRLReason OPTIONAL }

UnknownInfo ::= NULL

ArchiveCutoff ::= GeneralizedTime

AcceptableResponses ::= SEQUENCE OF RESPONSE.&id({ResponseSet})

ServiceLocator ::= SEQUENCE {
   issuer    Name,
   locator   AuthorityInfoAccessSyntax }

CrlID ::= SEQUENCE {
   crlUrl   [0] EXPLICIT IA5String OPTIONAL,
   crlNum   [1] EXPLICIT INTEGER OPTIONAL,
   crlTime  [2] EXPLICIT GeneralizedTime OPTIONAL }

PreferredSignatureAlgorithms ::= SEQUENCE OF
                                 PreferredSignatureAlgorithm

PreferredSignatureAlgorithm ::= SEQUENCE {
   sigIdentifier  AlgorithmIdentifier
                      { SIGNATURE-ALGORITHM, {...} },
   certIdentifier AlgorithmIdentifier {PUBLIC-KEY, {...}}
                      OPTIONAL }


-- Certificate Extensions

ext-ocsp-nocheck EXTENSION ::= {
    SYNTAX NULL IDENTIFIED BY id-pkix-ocsp-nocheck }


-- Request Extensions

re-ocsp-nonce EXTENSION ::= {
    SYNTAX Nonce IDENTIFIED BY id-pkix-ocsp-nonce }

re-ocsp-response EXTENSION ::= {
    SYNTAX AcceptableResponses IDENTIFIED BY
    id-pkix-ocsp-response }

re-ocsp-service-locator EXTENSION ::= {
    SYNTAX ServiceLocator IDENTIFIED BY
    id-pkix-ocsp-service-locator }

re-ocsp-preferred-signature-algorithms EXTENSION ::= {
    SYNTAX PreferredSignatureAlgorithms IDENTIFIED BY
    id-pkix-ocsp-pref-sig-algs  }


-- Response Extensions

re-ocsp-crl EXTENSION ::= {
    SYNTAX CrlID IDENTIFIED BY id-pkix-ocsp-crl }

re-ocsp-archive-cutoff EXTENSION ::= {
    SYNTAX ArchiveCutoff IDENTIFIED BY
    id-pkix-ocsp-archive-cutoff }

re-ocsp-extended-revoke EXTENSION ::= {
    SYNTAX NULL IDENTIFIED BY id-pkix-ocsp-extended-revoke }


-- Object Identifiers

id-kp-OCSPSigning            OBJECT IDENTIFIER ::= { id-kp 9 }
id-pkix-ocsp                 OBJECT IDENTIFIER ::= id-ad-ocsp
id-pkix-ocsp-basic           OBJECT IDENTIFIER ::= { id-pkix-ocsp 1 }
id-pkix-ocsp-nonce           OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 }
id-pkix-ocsp-crl             OBJECT IDENTIFIER ::= { id-pkix-ocsp 3 }
id-pkix-ocsp-response        OBJECT IDENTIFIER ::= { id-pkix-ocsp 4 }
id-pkix-ocsp-nocheck         OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 }
id-pkix-ocsp-archive-cutoff  OBJECT IDENTIFIER ::= { id-pkix-ocsp 6 }
id-pkix-ocsp-service-locator OBJECT IDENTIFIER ::= { id-pkix-ocsp 7 }
id-pkix-ocsp-pref-sig-algs   OBJECT IDENTIFIER ::= { id-pkix-ocsp 8 }
id-pkix-ocsp-extended-revoke OBJECT IDENTIFIER ::= { id-pkix-ocsp 9 }

END
