-- %CopyrightBegin%
--
-- SPDX-License-Identifier: BSD-3-Clause
--
-- Copyright (c) 2010 IETF Trust and the persons identified as the document authors.  All rights reserved.
-- Copyright Ericsson AB 2025. All Rights Reserved.
--
-- Redistribution and use in source and binary forms, with or without
-- modification, are permitted provided that the following conditions are met:
--
-- 1. Redistributions of source code must retain the above copyright notice,
--    this list of conditions and the following disclaimer.
--
-- 2. Redistributions in binary form must reproduce the above copyright notice,
--    this list of conditions and the following disclaimer in the documentation
--    and/or other materials provided with the distribution.
--
-- 3. Neither the name of the copyright holder nor the names of its contributors
--    may be used to endorse or promote products derived from this software
--    without specific prior written permission.
--
-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS”
-- AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-- ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-- LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-- CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-- POSSIBILITY OF SUCH DAMAGE.
--
-- %CopyrightEnd%

SLH-DSA-Module-2024
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
       id-smime(16) id-mod(0) id-mod-slh-dsa-2024(81) }

   DEFINITIONS IMPLICIT TAGS ::= BEGIN

   EXPORTS ALL;

   IMPORTS
     PUBLIC-KEY, SIGNATURE-ALGORITHM, SMIME-CAPS
       FROM AlgorithmInformation-2009  -- in [RFC5911]
       { iso(1) identified-organization(3) dod(6) internet(1)
         security(5) mechanisms(5) pkix(7) id-mod(0)
         id-mod-algorithmInformation-02(58) } ;

   --
   -- Object Identifiers
   --

   nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
     country(16) us(840) organization(1) gov(101) csor(3) 4 }

   sigAlgs OBJECT IDENTIFIER ::= { nistAlgorithms 3 }

   id-slh-dsa-sha2-128s OBJECT IDENTIFIER ::= { sigAlgs 20 }

   id-slh-dsa-sha2-128f OBJECT IDENTIFIER ::= { sigAlgs 21 }

   id-slh-dsa-sha2-192s OBJECT IDENTIFIER ::= { sigAlgs 22 }

   id-slh-dsa-sha2-192f OBJECT IDENTIFIER ::= { sigAlgs 23 }

   id-slh-dsa-sha2-256s OBJECT IDENTIFIER ::= { sigAlgs 24 }

   id-slh-dsa-sha2-256f OBJECT IDENTIFIER ::= { sigAlgs 25 }

   id-slh-dsa-shake-128s OBJECT IDENTIFIER ::= { sigAlgs 26 }

   id-slh-dsa-shake-128f OBJECT IDENTIFIER ::= { sigAlgs 27 }

   id-slh-dsa-shake-192s OBJECT IDENTIFIER ::= { sigAlgs 28 }

   id-slh-dsa-shake-192f OBJECT IDENTIFIER ::= { sigAlgs 29 }

   id-slh-dsa-shake-256s OBJECT IDENTIFIER ::= { sigAlgs 30 }

   id-slh-dsa-shake-256f OBJECT IDENTIFIER ::= { sigAlgs 31 }

   --
   -- Signature Algorithm, Public Key, and Private Key
   --

   sa-slh-dsa-sha2-128s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-128s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-128s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-128s } }

   sa-slh-dsa-sha2-128f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-128f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-128f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-128f } }

   sa-slh-dsa-sha2-192s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-192s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-192s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-192s } }

   sa-slh-dsa-sha2-192f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-192f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-192f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-192f } }

   sa-slh-dsa-sha2-256s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-256s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-256s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-256s } }

   sa-slh-dsa-sha2-256f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-sha2-256f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-sha2-256f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-sha2-256f } }

   sa-slh-dsa-shake-128s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-128s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-128s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-128s } }

   sa-slh-dsa-shake-128f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-128f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-128f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-128f } }

   sa-slh-dsa-shake-192s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-192s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-192s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-192s } }

   sa-slh-dsa-shake-192f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-192f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-192f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-192f } }

   sa-slh-dsa-shake-256s SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-256s
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-256s }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-256s } }

   sa-slh-dsa-shake-256f SIGNATURE-ALGORITHM ::= {
       IDENTIFIER id-slh-dsa-shake-256f
       PARAMS ARE absent
       PUBLIC-KEYS { pk-slh-dsa-shake-256f }
       SMIME-CAPS { IDENTIFIED BY id-slh-dsa-shake-256f } }

   pk-slh-dsa-sha2-128s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-128s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-sha2-128f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-128f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-sha2-192s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-192s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-sha2-192f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-192f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-sha2-256s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-256s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-sha2-256f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-sha2-256f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-128s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-128s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-128f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-128f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-192s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-192s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-192f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-192f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-256s PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-256s
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   pk-slh-dsa-shake-256f PUBLIC-KEY ::= {
       IDENTIFIER id-slh-dsa-shake-256f
       -- KEY no ASN.1 wrapping --
       CERT-KEY-USAGE
         { digitalSignature, nonRepudiation, keyCertSign, cRLSign }
       -- PRIVATE-KEY no ASN.1 wrapping -- }

   SLH-DSA-PublicKey ::= OCTET STRING (SIZE (32 | 48 | 64))

   SLH-DSA-PrivateKey ::= OCTET STRING (SIZE (64 | 96 | 128))

   --
   -- Expand the signature algorithm set used by CMS [RFC5911]
   --

   SignatureAlgorithmSet SIGNATURE-ALGORITHM ::=
       { sa-slh-dsa-sha2-128s |
         sa-slh-dsa-sha2-128f |
         sa-slh-dsa-sha2-192s |
         sa-slh-dsa-sha2-192f |
         sa-slh-dsa-sha2-256s |
         sa-slh-dsa-sha2-256f |
         sa-slh-dsa-shake-128s |
         sa-slh-dsa-shake-128f |
         sa-slh-dsa-shake-192s |
         sa-slh-dsa-shake-192f |
         sa-slh-dsa-shake-256s |
         sa-slh-dsa-shake-256f,
         ... }

   --
   -- Expand the S/MIME capabilities set used by CMS [RFC5911]
   --

   SMimeCaps SMIME-CAPS ::=
       { sa-slh-dsa-sha2-128s.&smimeCaps |
         sa-slh-dsa-sha2-128f.&smimeCaps |
         sa-slh-dsa-sha2-192s.&smimeCaps |
         sa-slh-dsa-sha2-192f.&smimeCaps |
         sa-slh-dsa-sha2-256s.&smimeCaps |
         sa-slh-dsa-sha2-256f.&smimeCaps |
         sa-slh-dsa-shake-128s.&smimeCaps |
         sa-slh-dsa-shake-128f.&smimeCaps |
         sa-slh-dsa-shake-192s.&smimeCaps |
         sa-slh-dsa-shake-192f.&smimeCaps |
         sa-slh-dsa-shake-256s.&smimeCaps |
         sa-slh-dsa-shake-256f.&smimeCaps,
         ... }

END