pyasn1-alt-modules 0.4.4__tar.gz → 0.4.5__tar.gz

{pyasn1-alt-modules-0.4.4 → pyasn1_alt_modules-0.4.5}/CHANGES.txt

@@ -1,3 +1,17 @@
+Revision 0.4.5, released 02-09-2024
+-----------------------------------
+- Require pyasn1 0.5.0 to force people to the maintained version
+- Dropped support for EOL Python 2.7, 3.6, and 3.7
+- Added RFC9598 for Internationalized Email Addresses in X.509 Certificates
+- Added RFC9582 for RPKI Route Origin Authorizations (ROAs)
+- Added RFC9579 for Use of PBMAC1 in the PKCS #12 Syntax
+- Improve RFC9480 by updating the algorithm identifier map and fix typo
+- Improve RFC8708 by addressing errata eid7963, which only changes a comment
+- Added RFC9608 for the noRevAvail Certificate Extension
+- Improve RFC6401 by addressing errata eid3943, eid5931, and eid6571
+- Added RFC9629 for CMS KEMRecipientInfo
+- Added RFC9654 for Online Certificate Status Protocol (OCSP) Nonce Extension
+
 Revision 0.4.4, released 03-22-2024
 -----------------------------------
 - Added support for Python 3.12, and dropped support for Python 3.5.

{pyasn1-alt-modules-0.4.4/pyasn1_alt_modules.egg-info → pyasn1_alt_modules-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pyasn1-alt-modules
-Version: 0.4.4
+Version: 0.4.5
 Summary: A alternate collection of ASN.1-based protocols modules.
 Home-page: https://github.com/russhousley/pyasn1-alt-modules
 Author: Russ Housley
@@ -18,22 +18,17 @@ Classifier: Intended Audience :: Telecommunications Industry
 Classifier: License :: OSI Approved :: BSD License
 Classifier: Natural Language :: English
 Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 2
-Classifier: Programming Language :: Python :: 2.7
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
-Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Communications
-Classifier: Topic :: System :: Monitoring
-Classifier: Topic :: System :: Networking :: Monitoring
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*
+Requires-Python: >=3.8
 Description-Content-Type: text/plain
 License-File: LICENSE.txt
+Requires-Dist: pyasn1>=0.5.0
 
 A collection of ASN.1 modules expressed in form of pyasn1 classes. Includes protocols PDUs definition (SNMP, LDAP, OCSP, and so on) as well as various data structures (X.509, PKCS, and so on).

{pyasn1-alt-modules-0.4.4 → pyasn1_alt_modules-0.4.5}/pyasn1_alt_modules/__init__.py

@@ -1,2 +1,2 @@
 # http://www.python.org/dev/peps/pep-0396/
-__version__ = '0.4.4'
+__version__ = '0.4.5'

{pyasn1-alt-modules-0.4.4 → pyasn1_alt_modules-0.4.5}/pyasn1_alt_modules/rfc6402.py

@@ -6,6 +6,7 @@
 # Modified by Russ Housley to add a maps for CMC Control Attributes
 #   and CMC Content Types for use with opentypes.
 # Modified by Russ Housley to include the opentypemap manager.
+# Modified by Russ Housley for errata 3943, 5931, and 6571.
 #
 # Copyright (c) 2005-2020, Ilya Etingof <etingof@gmail.com>
 # Copyright (c) 2021-2024, Vigil Security, LLC
@@ -15,6 +16,9 @@
 #
 # ASN.1 source from:
 # https://www.rfc-editor.org/rfc/rfc6402.txt
+# https://www.rfc-editor.org/errata/eid3943
+# https://www.rfc-editor.org/errata/eid5931
+# https://www.rfc-editor.org/errata/eid6571
 #
 from pyasn1.type import char
 from pyasn1.type import constraint
@@ -57,9 +61,11 @@ class ChangeSubjectName(univ.Sequence):
     pass
 
 
+# https://www.rfc-editor.org/errata/eid3943
 ChangeSubjectName.componentType = namedtype.NamedTypes(
     namedtype.OptionalNamedType('subject', rfc5280.Name()),
-    namedtype.OptionalNamedType('subjectAlt', rfc5280.GeneralNames())
+    namedtype.OptionalNamedType('subjectAlt', rfc5280.GeneralNames().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
 )
 
 
@@ -159,7 +165,8 @@ CMCStatusInfoV2.componentType = namedtype.NamedTypes(
                     componentType=namedtype.NamedTypes(
                         namedtype.NamedType('failInfoOID', univ.ObjectIdentifier()),
                         namedtype.NamedType('failInfoValue', AttributeValue()))
-                    )
+                    ).subtype(implicitTag=tag.Tag(
+                        tag.tagClassContext, tag.tagFormatConstructed, 1))
                 )
             )
         )
@@ -501,7 +508,8 @@ class ExtensionReq(univ.SequenceOf):
 ExtensionReq.componentType = rfc5280.Extension()
 ExtensionReq.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
 
-id_kp_cmcArchive = _buildOid(rfc5280.id_kp, 28)
+# https://www.rfc-editor.org/errata/eid5931
+id_kp_cmcArchive = _buildOid(rfc5280.id_kp, 29)
 
 id_cmc_publishCert = _buildOid(id_cmc, 30)
 

{pyasn1-alt-modules-0.4.4 → pyasn1_alt_modules-0.4.5}/pyasn1_alt_modules/rfc8708.py

@@ -9,6 +9,7 @@
 #
 # ASN.1 source from:
 # https://www.rfc-editor.org/rfc/rfc8708.txt
+# https://www.rfc-editor.org/errata/eid7963
 
 
 from pyasn1.type import univ
@@ -38,5 +39,5 @@ class HSS_LMS_HashSig_PublicKey(univ.OctetString):
 
 pk_HSS_LMS_HashSig = rfc5280.SubjectPublicKeyInfo()
 pk_HSS_LMS_HashSig['algorithm'] = sa_HSS_LMS_HashSig
-# pk_HSS_LMS_HashSig['subjectPublicKey'] CONTAINS a
-#     DER-encoded HSS_LMS_HashSig_PublicKey
+# pk_HSS_LMS_HashSig['subjectPublicKey'] CONTAINS the
+#     HSS/LMS public key without any ASN.1 encoding

{pyasn1-alt-modules-0.4.4 → pyasn1_alt_modules-0.4.5}/pyasn1_alt_modules/rfc9480.py

@@ -3,8 +3,10 @@
 #
 # Created by Russ Housley with minor assistance from asn1ate v.0.6.0.
 # Modified by Russ Housley to make InfoTypeAndValue['infoType'] optional.
+# Modified by Russ Housley to update the algorithmIdentifierMap.
+# Modified bt Russ Housley to correct typo in SignKeyPairTypesValue.
 #
-# Copyright (c) 2021, Vigil Security, LLC
+# Copyright (c) 2021-2024, Vigil Security, LLC
 # License: http://vigilsec.com/pyasn1_alt_modules_license.txt
 #
 # Updates to the Certificate Management Protocol (CMP)
@@ -30,6 +32,8 @@ from pyasn1_alt_modules import rfc5652
 from pyasn1_alt_modules import rfc6402
 from pyasn1_alt_modules import opentypemap
 
+algorithmIdentifierMap = opentypemap.get('algorithmIdentifierMap')
+
 cmpInfoTypeAndValueMap = opentypemap.get('cmpInfoTypeAndValueMap')
 
 cmsAttributesMap = opentypemap.get('cmsAttributesMap')
@@ -537,7 +541,7 @@ class CAProtEncCertValue(CMPCertificate):
 
 id_it_signKeyPairTypes = id_it + (2,)
 
-class SignKeyPairTypesValueclass(univ.SequenceOf):
+class SignKeyPairTypesValue(univ.SequenceOf):
     componentType = AlgorithmIdentifier()
 
 
@@ -675,7 +679,7 @@ class CRLsValue(univ.SequenceOf):
 
 _cmpInfoTypeAndValueMapUpdate = {
     id_it_caProtEncCert: CAProtEncCertValue(),
-    id_it_signKeyPairTypes: SignKeyPairTypesValueclass(),
+    id_it_signKeyPairTypes: SignKeyPairTypesValue(),
     id_it_encKeyPairTypes: EncKeyPairTypesValue(),
     id_it_preferredSymmAlg: PreferredSymmAlgValue(),
     id_it_caKeyUpdateInfo: CAKeyUpdateInfoValue(),
@@ -711,6 +715,16 @@ _cmsAttributesMapUpdate = {
 cmsAttributesMap.update(_cmsAttributesMapUpdate)
 
 
+# Update the Algorithm Identifier map
+
+_algorithmIdentifierMapUpdate = {
+    id_PasswordBasedMac: PBMParameter(),
+    id_DHBasedMac: DHBMParameter(),
+}
+
+algorithmIdentifierMap.update(_algorithmIdentifierMapUpdate)
+
+
 # Since pyasn1 does not naturally handle recursive definitions, this hack:
 #
 NestedMessageContent._componentType = PKIMessages()

pyasn1_alt_modules-0.4.5/pyasn1_alt_modules/rfc9579.py

@@ -0,0 +1,89 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley.
+#
+# Copyright (c) 2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Use of PBMAC1 in the PKCS #12 Syntax
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc9579.txt
+#
+
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import rfc8018
+
+
+# Import from RFC 5280
+
+AlgorithmIdentifier = rfc5280.AlgorithmIdentifier
+
+
+# Import from RFC 8018
+
+rsadsi = rfc8018.rsadsi
+
+pkcs = rfc8018.pkcs
+
+pkcs_5 = rfc8018.pkcs_5
+
+id_hmacWithSHA1 = rfc8018.id_hmacWithSHA1
+
+id_hmacWithSHA224 = rfc8018.id_hmacWithSHA224
+
+id_hmacWithSHA256 = rfc8018.id_hmacWithSHA256
+
+id_hmacWithSHA384 = rfc8018.id_hmacWithSHA384
+
+id_hmacWithSHA512 = rfc8018.id_hmacWithSHA512
+
+id_hmacWithSHA512_224 = rfc8018.id_hmacWithSHA512_224
+
+id_hmacWithSHA512_256 = rfc8018.id_hmacWithSHA512_256
+
+id_PBMAC1 = rfc8018.id_PBMAC1
+
+PBMAC1_params = rfc8018.PBMAC1_params
+
+id_PBKDF2 = rfc8018.id_PBKDF2
+
+PBKDF2_params = rfc8018.PBKDF2_params
+
+
+# HMAC algorithm identifiers
+
+algid_hmacWithSHA1 = AlgorithmIdentifier()
+algid_hmacWithSHA1['algorithm'] = id_hmacWithSHA1
+algid_hmacWithSHA1['parameters'] = univ.Null("")
+
+algid_hmacWithSHA224 = AlgorithmIdentifier()
+algid_hmacWithSHA224['algorithm'] = id_hmacWithSHA224
+algid_hmacWithSHA224['parameters'] = univ.Null("")
+
+algid_hmacWithSHA256 = AlgorithmIdentifier()
+algid_hmacWithSHA256['algorithm'] = id_hmacWithSHA256
+algid_hmacWithSHA256['parameters'] = univ.Null("")
+
+algid_hmacWithSHA384 = AlgorithmIdentifier()
+algid_hmacWithSHA384['algorithm'] = id_hmacWithSHA384
+algid_hmacWithSHA384['parameters'] = univ.Null("")
+
+algid_hmacWithSHA512 = AlgorithmIdentifier()
+algid_hmacWithSHA512['algorithm'] = id_hmacWithSHA512
+algid_hmacWithSHA512['parameters'] = univ.Null("")
+
+algid_hmacWithSHA512_224 = AlgorithmIdentifier()
+algid_hmacWithSHA512_224['algorithm'] = id_hmacWithSHA512_224
+algid_hmacWithSHA512_224['parameters'] = univ.Null("")
+
+algid_hmacWithSHA512_256 = AlgorithmIdentifier()
+algid_hmacWithSHA512_256['algorithm'] = id_hmacWithSHA512_256
+algid_hmacWithSHA512_256['parameters'] = univ.Null("")
+
+
+# No need to Update the Algorithm Identifier map or the S/MIME Capabilities map;
+# these updates were handled by importing RFC 8018.

pyasn1_alt_modules-0.4.5/pyasn1_alt_modules/rfc9582.py

@@ -0,0 +1,107 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with assistance from asn1ate v.0.6.0.
+#
+# Copyright (c) 2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# RPKI Route Origin Authorizations (ROAs)
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc9582.txt
+#
+
+from pyasn1.type import constraint
+from pyasn1.type import namedtype
+from pyasn1.type import tag
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5652
+from pyasn1_alt_modules import opentypemap
+
+cmsContentTypesMap = opentypemap.get('cmsContentTypesMap')
+
+MAX = float('inf')
+
+
+id_ct_routeOriginAuthz = univ.ObjectIdentifier('1.2.840.113549.1.9.16.1.24')
+
+afi_IPv4 = univ.OctetString(hexValue='0001').subtype(
+               subtypeSpec=constraint.ValueSizeConstraint(2, 2))
+
+afi_IPv6 = univ.OctetString(hexValue='0002').subtype(
+               subtypeSpec=constraint.ValueSizeConstraint(2, 2))
+
+ub_IPv4 = univ.Integer(32)
+
+ub_IPv6 = univ.Integer(128)
+
+
+class ASID(univ.Integer):
+    subtypeSpec = constraint.ValueRangeConstraint(0, 4294967295)
+
+
+class ROAIPAddress(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('address', univ.BitString()),
+        # For IPv4, the maximum size of the BitString is ub_IPv4 bits
+        # For IPv6, the maximum size of the BitString is ub_IPv6 bits
+        namedtype.OptionalNamedType('maxLength', univ.Integer())
+        # For IPv4, the maximum value of the Integer is ub_IPv4
+        # For IPv6, the maximum value of the Integer is ub_IPv6
+    )
+
+
+class ROAAddresses(univ.SequenceOf):
+    componentType = ROAIPAddress()
+    subtypeSpec = constraint.ValueSizeConstraint(1, MAX)
+
+
+ROAIPAddressIPv4 = ROAIPAddress
+
+ROAIPAddressIPv6 = ROAIPAddress
+
+ROAAddressesIPv4 = ROAAddresses
+
+ROAAddressesIPv6 = ROAAddresses
+
+
+class ROAIPAddressFamily(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('addressFamily',
+            univ.OctetString().subtype(
+                subtypeSpec=constraint.ValueSizeConstraint(2, 2))),
+        namedtype.NamedType('addresses', ROAAddresses())
+    )
+
+
+class RouteOriginAttestation(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.DefaultedNamedType('version',
+            univ.Integer().subtype(explicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0)).subtype(value=0)),
+        namedtype.NamedType('asID', ASID()),
+        namedtype.NamedType('ipAddrBlocks',
+            univ.SequenceOf(componentType=ROAIPAddressFamily()).subtype(
+                subtypeSpec=constraint.ValueSizeConstraint(1, 2)))
+    )
+
+
+addressFamilyIPv4 = ROAIPAddressFamily()
+addressFamilyIPv4['addressFamily'] = afi_IPv4
+addressFamilyIPv4['addresses'] = ROAAddressesIPv4()
+
+
+addressFamilyIPv6 = ROAIPAddressFamily()
+addressFamilyIPv6['addressFamily'] = afi_IPv6
+addressFamilyIPv6['addresses'] = ROAAddressesIPv6()
+
+
+# Update the CMS Content Types Map
+
+_cmsContentTypesMapUpdate = {
+    id_ct_routeOriginAuthz: RouteOriginAttestation(),
+}
+
+cmsContentTypesMap.update(_cmsContentTypesMapUpdate)

pyasn1_alt_modules-0.4.5/pyasn1_alt_modules/rfc9598.py

@@ -0,0 +1,52 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley.
+#
+# Copyright (c) 2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Internationalized Email Addresses in X.509 Certificates
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc9598.txt
+#
+
+from pyasn1.type import char
+from pyasn1.type import constraint
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import opentypemap
+
+otherNamesMap = opentypemap.get('otherNamesMap')
+
+MAX = float('inf')
+
+
+# SmtpUTF8Mailbox contains Mailbox as specified in Section 3.3 of RFC 6531.
+# RFC 9598 requires that the domain name be represented as A-labels.
+
+id_pkix = rfc5280.id_pkix
+
+id_on = id_pkix + (8, )
+
+id_on_SmtpUTF8Mailbox = id_on + (9, )
+
+
+class SmtpUTF8Mailbox(char.UTF8String):
+    subtypeSpec = constraint.ValueSizeConstraint(1, MAX)
+
+
+on_SmtpUTF8Mailbox = rfc5280.AnotherName()
+on_SmtpUTF8Mailbox['type-id'] = id_on_SmtpUTF8Mailbox
+on_SmtpUTF8Mailbox['value'] = SmtpUTF8Mailbox()
+
+
+# Update the Other Names Map
+
+_otherNamesMapUpdate = {
+    id_on_SmtpUTF8Mailbox: SmtpUTF8Mailbox(),
+}
+
+otherNamesMap.update(_otherNamesMapUpdate)

pyasn1_alt_modules-0.4.5/pyasn1_alt_modules/rfc9608.py

@@ -0,0 +1,35 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley.
+#
+# Copyright (c) 2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# The noRevAvail Certificate Extension
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc9608.txt
+#
+
+from pyasn1.type import univ
+from pyasn1_alt_modules import opentypemap
+
+
+certificateExtensionsMap = opentypemap.get('certificateExtensionsMap')
+
+
+# Object Identifiers
+
+id_ce = univ.ObjectIdentifier((2, 5, 29, ))
+
+id_ce_noRevAvail = id_ce + (56, )
+
+
+# Update the Certificate Extensions Map
+
+_certificateExtensionsMapUpdate = {
+    id_ce_noRevAvail: univ.Null(),
+}
+
+certificateExtensionsMap.update(_certificateExtensionsMapUpdate)

pyasn1_alt_modules-0.4.5/pyasn1_alt_modules/rfc9629.py

@@ -0,0 +1,100 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with some help from by asn1ate v.0.6.0.
+#
+# Copyright (c) 2023-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# CMS KEMRecipientInfo
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc9629.txt
+#
+
+from pyasn1.type import constraint
+from pyasn1.type import namedtype
+from pyasn1.type import tag
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import rfc5652
+from pyasn1_alt_modules import opentypemap
+
+otherRecipientInfoMap = opentypemap.get('otherRecipientInfoMap')
+
+MAX = float('inf')
+
+
+# Imports from RFC 5280
+
+AlgorithmIdentifier = rfc5280.AlgorithmIdentifier
+
+
+# Imports from RFC 5652
+
+CMSVersion = rfc5652.CMSVersion
+
+EncryptedKey = rfc5652.EncryptedKey
+
+KeyDerivationAlgorithmIdentifier = rfc5652.KeyDerivationAlgorithmIdentifier
+
+KeyEncryptionAlgorithmIdentifier = rfc5652.KeyEncryptionAlgorithmIdentifier
+
+RecipientIdentifier = rfc5652.RecipientIdentifier
+
+UserKeyingMaterial = rfc5652.UserKeyingMaterial
+
+
+# Object Identifiers
+
+id_ori = univ.ObjectIdentifier((1, 2, 840, 113549, 1, 9, 16, 13))
+
+id_ori_kem = id_ori + (3,)
+
+
+# KEMRecipientInfo
+
+class KEMAlgorithmIdentifier(AlgorithmIdentifier):
+    pass
+
+
+class KEMRecipientInfo(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('version', CMSVersion()),
+        namedtype.NamedType('rid', RecipientIdentifier()),
+        namedtype.NamedType('kem', KEMAlgorithmIdentifier()),
+        namedtype.NamedType('kemct', univ.OctetString()),
+        namedtype.NamedType('kdf', KeyDerivationAlgorithmIdentifier()),
+        namedtype.NamedType('kekLength',
+            univ.Integer().subtype(
+                subtypeSpec=constraint.ValueRangeConstraint(1, MAX))),
+        namedtype.OptionalNamedType('ukm',
+            UserKeyingMaterial().subtype(explicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.NamedType('wrap', KeyEncryptionAlgorithmIdentifier()),
+        namedtype.NamedType('encryptedKey', EncryptedKey())
+    )
+
+
+# CMSORIforKEMOtherInfo
+
+class CMSORIforKEMOtherInfo(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('wrap', KeyEncryptionAlgorithmIdentifier()),
+        namedtype.NamedType('kekLength',
+            univ.Integer().subtype(
+                subtypeSpec=constraint.ValueRangeConstraint(1, MAX))),
+        namedtype.OptionalNamedType('ukm',
+            UserKeyingMaterial().subtype(explicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0)))
+    )
+
+
+# Update the CMS Other Recipient Info Map
+
+_otherRecipientInfoMapUpdate = {
+    id_ori_kem: KEMRecipientInfo(),
+}
+
+otherRecipientInfoMap.update(_otherRecipientInfoMapUpdate)