#
# X.509 v3 by ITU-T Recommendation (11/93) & PKCS7 & PKCS10
#

X509: module {

	PATH: con "/dis/lib/crypt/x509.dis";

	init: fn(): string;

	## x509 (id_at) and x509 extention v3 (id_ce) Object Identifiers

	objIdTab			: array of ASN1->Oid;

	id_at,
	id_at_commonName,
	id_at_countryName,
	id_at_localityName,
	id_at_stateOrProvinceName,
	id_at_organizationName,
	id_at_organizationalUnitName,
	id_at_userPassword,
	id_at_userCertificate,
	id_at_cAcertificate,
	id_at_authorityRevocationList,
	id_at_certificateRevocationList,
	id_at_crossCertificatePair,
	id_at_supportedAlgorithms,
	id_at_deltaRevocationList,
	id_ce,
	id_ce_subjectDirectoryAttributes,
	id_ce_subjectKeyIdentifier,
	id_ce_keyUsage,
	id_ce_privateKeyUsage,
	id_ce_subjectAltName,
	id_ce_issuerAltName,
	id_ce_basicConstraints,
	id_ce_cRLNumber,
	id_ce_reasonCode,
	id_ce_instructionCode,
	id_ce_invalidityDate,
	id_ce_deltaCRLIndicator,
	id_ce_issuingDistributionPoint,
	id_ce_certificateIssuer,
	id_ce_nameConstraints,
	id_ce_cRLDistributionPoint,
	id_ce_certificatePolicies,
	id_ce_policyMapping,
	id_ce_authorityKeyIdentifier,
	id_ce_policyConstraints,
	id_mr,
	id_mr_certificateExactMatch,
 	id_mr_certificateMatch,
 	id_mr_certificatePairExactMatch,
 	id_mr_certificatePairMatch,
 	id_mr_certificateListExactMatch,
 	id_mr_certificateListMatch,
 	id_mr_algorithmidentifierMatch	: con iota;

	## Signed (as Public Key, CRL, Attribute Certificates and CertificationRequest)

	Signed: adt {
		tobe_signed		: array of byte;
  		alg			: ref AlgIdentifier;
  		signature		: array of byte; # BIT STRING, DER encoding
		
		decode: fn(a: array of byte): (string, ref Signed);
		encode: fn(s: self ref Signed): (string, array of byte);
		sign: fn(s: self ref Signed, sk: ref PrivateKey, hash: int): (string, array of byte);
		verify: fn(s: self ref Signed, pk: ref PublicKey, hash: int): int;
		tostring: fn(s: self ref Signed): string;
	};

	## Certificate Path

	verify_certchain: fn(cs: list of array of byte): (int, string);
	verify_certpath: fn(cp: list of (ref Signed, ref Certificate)): (int, string);

	## TBS (Public Key) Certificate

	Certificate: adt {
  		version			: int; # v1(0; default) or v2(1) or v3(2)
  		serial_number		: ref Keyring->IPint;
  		sig			: ref AlgIdentifier;
  		issuer			: ref Name;
  		validity		: ref Validity;
  		subject			: ref Name;
  		subject_pkinfo		: ref SubjectPKInfo;
					# OPTIONAL for v2 and v3; must be in order
  		issuer_uid		: array of byte; # v2
  		subject_uid		: array of byte; # v2 or v3
  		exts			: list of ref Extension; # v3

		decode: fn(a: array of byte): (string, ref Certificate);
		encode: fn(c: self ref Certificate): (string, array of byte);
		tostring: fn(c: self ref Certificate): string;
		is_expired: fn(c: self ref Certificate, date: int): int;
	};

	AlgIdentifier: adt {
		oid			: ref ASN1->Oid;
		parameter		: array of byte;

		tostring: fn(a: self ref AlgIdentifier): string;
	};

	Name: adt {
		rd_names		: list of ref RDName;

		equal: fn(a: self ref Name, b: ref Name): int;
		tostring: fn(n: self ref Name): string;
	};

	RDName: adt {
		avas			: list of ref AVA;

		equal: fn(a: self ref RDName, b: ref RDName): int;
		tostring: fn(r: self ref RDName): string;
	};

	AVA: adt {
		oid			: ref ASN1->Oid;
		value			: string;
		
		equal: fn(a: self ref AVA, b: ref AVA): int;
		tostring: fn(a: self ref AVA): string;
	};

	Validity: adt {
  		not_before		: int;
  		not_after		: int;

		tostring: fn(v: self ref Validity, format: string): string;
	};

	SubjectPKInfo: adt {
  		alg_id			: ref AlgIdentifier;
  		subject_pk		: array of byte; # BIT STRING

		getPublicKey: fn(c: self ref SubjectPKInfo): (string, int, ref PublicKey);
		tostring: fn(c: self ref SubjectPKInfo): string;
	};

	Extension: adt{
  		oid			: ref ASN1->Oid;
  		critical		: int; # default false 
  		value			: array of byte;

		tostring: fn(e: self ref Extension): string;
	};

	PublicKey: adt {
		pick {
		RSA =>
			pk		: ref PKCS->RSAKey;
		DSS =>
			pk		: ref PKCS->DSSPublicKey;
		DH =>
			pk		: ref PKCS->DHPublicKey;
		}
	};

	PrivateKey: adt {
		pick {
		RSA =>
			sk		: ref PKCS->RSAKey;
		DSS =>
			sk		: ref PKCS->DSSPrivateKey;
		DH =>
			sk		: ref PKCS->DHPrivateKey;
		}
	};

	## Certificate Revocation List

	CRL: adt {
		version			: int; # OPTIONAL; v2
		sig			: ref AlgIdentifier;
		issuer			: ref Name; 
		this_update		: int;
		next_update		: int; # OPTIONAL
		revoked_certs		: list of ref RevokedCert; # OPTIONAL
		exts			: list of ref Extension; # OPTIONAL

		decode: fn(a: array of byte): (string, ref CRL);
		encode: fn(c: self ref CRL): (string, array of byte);
		tostring: fn(c: self ref CRL): string;
		is_revoked: fn(c: self ref CRL, sn: ref Keyring->IPint): int;
	};

	RevokedCert: adt {
		user_cert		: ref Keyring->IPint; # serial_number
		revoc_date		: int; # OPTIONAL
		exts			: list of ref Extension; # OPTIONAL; CRL entry extensions

		tostring: fn(rc: self ref RevokedCert): string;	
	};

	## Certificate Extensions

	# get critical extensions	
	cr_exts: fn(es: list of ref Extension): list of ref Extension;

	# get non-critical extensions
	noncr_exts: fn(es: list of ref Extension): list of ref Extension;

	# decode a list of extensions
	parse_exts: fn(es: list of ref Extension): (string, list of ref ExtClass);

	# extension classes
	ExtClass: adt {
		pick {
		AuthorityKeyIdentifier =>
			id		: array of byte; # OCTET STRING
			issuer		: ref GeneralName;
			serial_number	: ref Keyring->IPint;
		SubjectKeyIdentifier =>
			id		: array of byte; # OCTET STRING
		BasicConstraints =>	
			depth		: int; # certificate path constraints
		KeyUsage =>
			usage		: int;
		PrivateKeyUsage =>
			period		: ref Validity;
		PolicyMapping =>	# (issuer, subject) domain policy pairs
			pairs		: list of (ref ASN1->Oid, ref ASN1->Oid);
		CertificatePolicies =>
			policies	: list of ref PolicyInfo;
		IssuerAltName =>
			alias		: list of ref GeneralName;
		SubjectAltName =>
			alias		: list of ref GeneralName;
		NameConstraints =>
			permitted	: list of ref GSubtree;
			excluded	: list of ref GSubtree;
		PolicyConstraints =>
			require		: int;
			inhibit		: int;
		CRLNumber =>
			curr		: int;
		ReasonCode =>
			code		: int;
		InstructionCode =>
			oid		: ref ASN1->Oid; # hold instruction code field
		InvalidityDate =>
			date		: int;
		CRLDistributionPoint =>
			ps		: list of ref DistrPoint;
		IssuingDistributionPoint =>
			name		: ref DistrPointName;
			only_usercerts	: int; # DEFAULT FALSE
			only_cacerts	: int; # DEFAULT FALSE
			only_reasons	: int;
			indirect_crl	: int; # DEFAULT FALSE	 	 
		CertificateIssuer =>
			names		: list of ref GeneralName;
		DeltaCRLIndicator =>
			number		: ref Keyring->IPint;
		SubjectDirectoryAttributes =>
			attrs		: list of ref Attribute;
		UnknownType =>
			ext		: ref Extension;
		}

		decode: fn(ext: ref Extension): (string, ref ExtClass);
		encode: fn(et: self ref ExtClass, critical: int): ref Extension;
		tostring: fn(et: self ref ExtClass): string;
	};

	# key usage
	KeyUsage_DigitalSignature, KeyUsage_NonRepudiation, KeyUsage_KeyEncipherment,
	KeyUsage_DataEncipherment, KeyUsage_KeyAgreement, KeyUsage_KeyCertSign, 
	KeyUsage_CRLSign, KeyUsage_EncipherOnly, KeyUsage_DecipherOnly : con iota << 1;

	# CRL reason
	Reason_Unspecified, Reason_KeyCompromise, Reason_CACompromise, 
	Reason_AffiliationChanged, Reason_Superseded, Reason_CessationOfOperation, 
	Reason_CertificateHold, Reason_RemoveFromCRL : con iota << 1;

	# General Name
	GeneralName: adt {
		pick {
		otherName or 		# [0]
		rfc822Name or 		# [1]
		dNSName or 		# [2]
		x400Address or 		# [3]
		uniformResourceIdentifier => # [6]
			str		: string;
		iPAddress =>		# [7]
			ip		: array of byte;
		registeredID =>		# [8]
			oid		: ref ASN1->Oid;
		ediPartyName =>		# [5]
			nameAssigner	: ref Name; # [0]
			partyName	: ref Name; # [1]
		directoryName =>	# [4]
			dir		: ref Name;
		}

		tostring: fn(g: self ref GeneralName): string;
	};

	# security policies
	PolicyInfo: adt {
		oid			: ref ASN1->Oid;
		qualifiers		: list of ref PolicyQualifier;

		tostring: fn(pi: self ref PolicyInfo): string;
	};

	PolicyQualifier: adt {
		oid			: ref ASN1->Oid;
		value			: array of byte; # OCTET STRING; OPTIONAL

		tostring: fn(pq: self ref PolicyQualifier): string;
	};

	GSubtree: adt {
		base			: ref GeneralName;
		min			: int;
		max			: int;
	
		tostring: fn(gs: self ref GSubtree): string;
	};
	
	# crl distribution point
	# with known reason code
	# Unused [0], KeyCompromise [1], CACompromise [2], AffilationChanged [3],
	# Superseded [4], CessationOfOperation [5], CertificateHold [6] 
	DistrPoint: adt{
		name			: ref DistrPointName;
 		reasons			: int;
		issuer			: list of ref GeneralName;

		tostring: fn(dp: self ref DistrPoint): string;
	};
	
	DistrPointName: adt {
		full_name		: list of ref GeneralName;
		rdname			: list of ref RDName;
	};

	Attribute: adt {
		id			: ASN1->Oid;
		value			: array of byte;
	};
};

#X509Attribute: module {
#
#	## Attribute Certificate
#
#	AttrCert: adt {
#		version			: int; # default v1
#		base_certid		: ref IssuerSerial; # [0]
#		subject_name		: list of ref GeneralName; # [1]
#		issuer			: list of ref GeneralName;
#		serial_number		: ref IPint;
#		validity		: ref Validity;
#		attrs			: list of ref Attribute;
#		issuer_uid		: array of byte; # OPTIONAL
#		exts			: list of ref Extension; # OPTIONAL			
#	};
#
#	IssuerSerial: adt {
#		issuer			: list of ref GeneralName;
#		serial			: ref IPint;
#		issuer_uid		: array of byte; # OPTIONAL
#	};
#};