pyasn1-alt-modules 0.4.5__py3-none-any.whl

pyasn1_alt_modules/rfc5755.py

@@ -0,0 +1,400 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with assistance from asn1ate v.0.6.0.
+# Modified by Russ Housley to include the opentypemap manager.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# An Internet Attribute Certificate Profile for Authorization
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5755.txt
+# https://www.rfc-editor.org/rfc/rfc5912.txt (see Section 13)
+#
+
+from pyasn1.type import char
+from pyasn1.type import constraint
+from pyasn1.type import namedtype
+from pyasn1.type import namedval
+from pyasn1.type import opentype
+from pyasn1.type import tag
+from pyasn1.type import univ
+from pyasn1.type import useful
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import rfc5652
+from pyasn1_alt_modules import opentypemap
+
+certificateAttributesMap = opentypemap.get('certificateAttributesMap')
+
+certificateExtensionsMap = opentypemap.get('certificateExtensionsMap')
+
+securityCategoryMap = opentypemap.get('securityCategoryMap')
+
+MAX = float('inf')
+
+
+# Imports from RFC 5652
+
+ContentInfo = rfc5652.ContentInfo
+
+
+# Imports from RFC 5280
+
+AlgorithmIdentifier = rfc5280.AlgorithmIdentifier
+
+Attribute = rfc5280.Attribute
+
+AuthorityInfoAccessSyntax = rfc5280.AuthorityInfoAccessSyntax
+
+AuthorityKeyIdentifier = rfc5280.AuthorityKeyIdentifier
+
+CertificateSerialNumber = rfc5280.CertificateSerialNumber
+
+CRLDistributionPoints = rfc5280.CRLDistributionPoints
+
+Extensions = rfc5280.Extensions
+
+Extension = rfc5280.Extension
+
+GeneralNames = rfc5280.GeneralNames
+
+GeneralName = rfc5280.GeneralName
+
+UniqueIdentifier = rfc5280.UniqueIdentifier
+
+
+# Object Identifier arcs
+
+id_pkix = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, ))
+
+id_pe = id_pkix + (1, )
+
+id_kp = id_pkix + (3, )
+
+id_aca = id_pkix + (10, )
+
+id_ad = id_pkix + (48, )
+
+id_at = univ.ObjectIdentifier((2, 5, 4, ))
+
+id_ce = univ.ObjectIdentifier((2, 5, 29, ))
+
+
+# Attribute Certificate
+
+class AttCertVersion(univ.Integer):
+    namedValues = namedval.NamedValues(
+        ('v2', 1)
+    )
+
+
+class IssuerSerial(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('issuer', GeneralNames()),
+        namedtype.NamedType('serial', CertificateSerialNumber()),
+        namedtype.OptionalNamedType('issuerUID', UniqueIdentifier())
+    )
+
+
+class ObjectDigestInfo(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('digestedObjectType',
+            univ.Enumerated(namedValues=namedval.NamedValues(
+                ('publicKey', 0),
+                ('publicKeyCert', 1),
+                ('otherObjectTypes', 2)))),
+        namedtype.OptionalNamedType('otherObjectTypeID',
+            univ.ObjectIdentifier()),
+        namedtype.NamedType('digestAlgorithm',
+            AlgorithmIdentifier()),
+        namedtype.NamedType('objectDigest',
+            univ.BitString())
+    )
+
+
+class Holder(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('baseCertificateID',
+            IssuerSerial().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatConstructed, 0))),
+        namedtype.OptionalNamedType('entityName',
+            GeneralNames().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1))),
+        namedtype.OptionalNamedType('objectDigestInfo',
+            ObjectDigestInfo().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatConstructed, 2)))
+)
+
+
+class V2Form(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('issuerName',
+            GeneralNames()),
+        namedtype.OptionalNamedType('baseCertificateID',
+            IssuerSerial().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatConstructed, 0))),
+        namedtype.OptionalNamedType('objectDigestInfo',
+            ObjectDigestInfo().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatConstructed, 1)))
+    )
+
+
+class AttCertIssuer(univ.Choice):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('v1Form', GeneralNames()),
+        namedtype.NamedType('v2Form', V2Form().subtype(implicitTag=tag.Tag(
+            tag.tagClassContext, tag.tagFormatConstructed, 0)))
+    )
+
+
+class AttCertValidityPeriod(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('notBeforeTime', useful.GeneralizedTime()),
+        namedtype.NamedType('notAfterTime', useful.GeneralizedTime())
+    )
+
+
+class AttributeCertificateInfo(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('version',
+            AttCertVersion()),
+        namedtype.NamedType('holder',
+            Holder()),
+        namedtype.NamedType('issuer',
+            AttCertIssuer()),
+        namedtype.NamedType('signature',
+            AlgorithmIdentifier()),
+        namedtype.NamedType('serialNumber',
+            CertificateSerialNumber()),
+        namedtype.NamedType('attrCertValidityPeriod',
+            AttCertValidityPeriod()),
+        namedtype.NamedType('attributes',
+            univ.SequenceOf(componentType=Attribute())),
+        namedtype.OptionalNamedType('issuerUniqueID',
+            UniqueIdentifier()),
+        namedtype.OptionalNamedType('extensions',
+            Extensions())
+    )
+
+
+class AttributeCertificate(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('acinfo', AttributeCertificateInfo()),
+        namedtype.NamedType('signatureAlgorithm', AlgorithmIdentifier()),
+        namedtype.NamedType('signatureValue', univ.BitString())
+    )
+
+
+# Attribute Certificate Extensions
+
+id_pe_ac_auditIdentity = id_pe + (4, )
+
+id_ce_noRevAvail = id_ce + (56, )
+
+id_ce_targetInformation = id_ce + (55, )
+
+
+class TargetCert(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('targetCertificate', IssuerSerial()),
+        namedtype.OptionalNamedType('targetName', GeneralName()),
+        namedtype.OptionalNamedType('certDigestInfo', ObjectDigestInfo())
+    )
+
+
+class Target(univ.Choice):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('targetName',
+            GeneralName().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.NamedType('targetGroup',
+            GeneralName().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1))),
+        namedtype.NamedType('targetCert',
+            TargetCert().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatConstructed, 2)))
+    )
+
+
+class Targets(univ.SequenceOf):
+    componentType = Target()
+
+
+id_pe_ac_proxying = id_pe + (10, )
+
+
+class ProxyInfo(univ.SequenceOf):
+    componentType = Targets()
+
+
+id_pe_aaControls = id_pe + (6, )
+
+
+class AttrSpec(univ.SequenceOf):
+    componentType = univ.ObjectIdentifier()
+
+
+class AAControls(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('pathLenConstraint',
+            univ.Integer().subtype(
+                subtypeSpec=constraint.ValueRangeConstraint(0, MAX))),
+        namedtype.OptionalNamedType('permittedAttrs',
+            AttrSpec().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.OptionalNamedType('excludedAttrs',
+            AttrSpec().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1))),
+        namedtype.DefaultedNamedType('permitUnSpecified',
+            univ.Boolean().subtype(value=1))
+    )
+
+
+# Attribute Certificate Attributes
+
+id_aca_authenticationInfo = id_aca + (1, )
+
+
+id_aca_accessIdentity = id_aca + (2, )
+
+
+class SvceAuthInfo(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('service', GeneralName()),
+        namedtype.NamedType('ident', GeneralName()),
+        namedtype.OptionalNamedType('authInfo', univ.OctetString())
+    )
+
+
+id_aca_chargingIdentity = id_aca + (3, )
+
+
+id_aca_group = id_aca + (4, )
+
+
+class IetfAttrSyntax(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('policyAuthority',
+            GeneralNames().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.NamedType('values', univ.SequenceOf(
+            componentType=univ.Choice(componentType=namedtype.NamedTypes(
+                namedtype.NamedType('octets', univ.OctetString()),
+                namedtype.NamedType('oid', univ.ObjectIdentifier()),
+                namedtype.NamedType('string', char.UTF8String())
+            ))
+        ))
+    )
+
+
+id_at_role = id_at + (72,)
+
+
+class RoleSyntax(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.OptionalNamedType('roleAuthority',
+            GeneralNames().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.NamedType('roleName',
+            GeneralName().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1)))
+    )
+
+
+class ClassList(univ.BitString):
+    namedValues = namedval.NamedValues(
+        ('unmarked', 0),
+        ('unclassified', 1),
+        ('restricted', 2),
+        ('confidential', 3),
+        ('secret', 4),
+        ('topSecret', 5)
+    )
+
+
+class SecurityCategory(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('type',
+            univ.ObjectIdentifier().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.NamedType('value',
+            univ.Any().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1)),
+            openType=opentype.OpenType('type', securityCategoryMap))
+    )
+
+
+id_at_clearance = univ.ObjectIdentifier((2, 5, 4, 55, ))
+
+
+class Clearance(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('policyId',
+            univ.ObjectIdentifier()),
+        namedtype.DefaultedNamedType('classList',
+            ClassList().subtype(value='unclassified')),
+        namedtype.OptionalNamedType('securityCategories',
+            univ.SetOf(componentType=SecurityCategory()))
+    )
+
+
+id_at_clearance_rfc3281 = univ.ObjectIdentifier((2, 5, 1, 5, 55, ))
+
+
+class Clearance_rfc3281(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('policyId',
+            univ.ObjectIdentifier().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 0))),
+        namedtype.DefaultedNamedType('classList',
+            ClassList().subtype(implicitTag=tag.Tag(
+                tag.tagClassContext, tag.tagFormatSimple, 1)).subtype(
+                    value='unclassified')),
+        namedtype.OptionalNamedType('securityCategories',
+            univ.SetOf(componentType=SecurityCategory()).subtype(
+                implicitTag=tag.Tag(
+                    tag.tagClassContext, tag.tagFormatSimple, 2)))
+    )
+
+
+id_aca_encAttrs = id_aca + (6, )
+
+
+class ACClearAttrs(univ.Sequence):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('acIssuer', GeneralName()),
+        namedtype.NamedType('acSerial', univ.Integer()),
+        namedtype.NamedType('attrs', univ.SequenceOf(componentType=Attribute()))
+    )
+
+
+# Update the Certificate Extensions Map
+
+_certificateExtensionsMapUpdate = {
+    id_pe_ac_auditIdentity: univ.OctetString(),
+    id_ce_noRevAvail: univ.Null(),
+    id_ce_targetInformation: Targets(),
+    id_pe_ac_proxying: ProxyInfo(),
+    id_pe_aaControls: AAControls(),
+}
+
+certificateExtensionsMap.update(_certificateExtensionsMapUpdate)
+
+
+# Update the Certificate Attributes Map
+
+_certificateAttributesMapUpdate = {
+    id_aca_authenticationInfo: SvceAuthInfo(),
+    id_aca_accessIdentity: SvceAuthInfo(),
+    id_aca_chargingIdentity: IetfAttrSyntax(),
+    id_aca_group: IetfAttrSyntax(),
+    id_at_role: RoleSyntax(),
+    id_at_clearance: Clearance(),
+    id_at_clearance_rfc3281: Clearance_rfc3281(),
+    id_aca_encAttrs: ContentInfo(),
+}
+
+certificateAttributesMap.update(_certificateAttributesMapUpdate)

pyasn1_alt_modules/rfc5913.py

@@ -0,0 +1,46 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with assistance from asn1ate v.0.6.0.
+# Modified by Russ Housley to include the opentypemap manager.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Authority Clearance Constraints Certificate Extension
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5913.txt
+# https://www.rfc-editor.org/errata/eid5890
+#
+
+from pyasn1.type import constraint
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5755
+from pyasn1_alt_modules import opentypemap
+
+certificateExtensionsMap = opentypemap.get('certificateExtensionsMap')
+
+MAX = float('inf')
+
+
+# Authority Clearance Constraints Certificate Extension
+
+id_pe_clearanceConstraints = univ.ObjectIdentifier('1.3.6.1.5.5.7.1.21')
+
+id_pe_authorityClearanceConstraints = id_pe_clearanceConstraints
+
+
+class AuthorityClearanceConstraints(univ.SequenceOf):
+    componentType = rfc5755.Clearance()
+    subtypeSpec=constraint.ValueSizeConstraint(1, MAX)
+
+
+# Update the Certificate Extensions Map
+
+_certificateExtensionsMapUpdate = {
+    id_pe_clearanceConstraints: AuthorityClearanceConstraints(),
+}
+
+certificateExtensionsMap.update(_certificateExtensionsMapUpdate)

pyasn1_alt_modules/rfc5914.py

@@ -0,0 +1,119 @@
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with assistance from asn1ate v.0.6.0.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Trust Anchor Format
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5914.txt
+
+from pyasn1.type import char
+from pyasn1.type import constraint
+from pyasn1.type import namedtype
+from pyasn1.type import namedval
+from pyasn1.type import tag
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+
+
+MAX = float('inf')
+
+Certificate = rfc5280.Certificate
+
+Name = rfc5280.Name
+
+Extensions = rfc5280.Extensions
+
+SubjectPublicKeyInfo = rfc5280.SubjectPublicKeyInfo
+
+TBSCertificate = rfc5280.TBSCertificate
+
+CertificatePolicies = rfc5280.CertificatePolicies
+
+KeyIdentifier = rfc5280.KeyIdentifier
+
+NameConstraints = rfc5280.NameConstraints
+
+
+class CertPolicyFlags(univ.BitString):
+    pass
+
+CertPolicyFlags.namedValues = namedval.NamedValues(
+    ('inhibitPolicyMapping', 0),
+    ('requireExplicitPolicy', 1),
+    ('inhibitAnyPolicy', 2)
+)
+
+
+class CertPathControls(univ.Sequence):
+    pass
+
+CertPathControls.componentType = namedtype.NamedTypes(
+    namedtype.NamedType('taName', Name()),
+    namedtype.OptionalNamedType('certificate', Certificate().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
+    namedtype.OptionalNamedType('policySet', CertificatePolicies().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
+    namedtype.OptionalNamedType('policyFlags', CertPolicyFlags().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
+    namedtype.OptionalNamedType('nameConstr', NameConstraints().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))),
+    namedtype.OptionalNamedType('pathLenConstraint', univ.Integer().subtype(
+        subtypeSpec=constraint.ValueRangeConstraint(0, MAX)).subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4)))
+)
+
+
+class TrustAnchorTitle(char.UTF8String):
+    pass
+
+TrustAnchorTitle.subtypeSpec = constraint.ValueSizeConstraint(1, 64)
+
+
+class TrustAnchorInfoVersion(univ.Integer):
+    pass
+
+TrustAnchorInfoVersion.namedValues = namedval.NamedValues(
+    ('v1', 1)
+)
+
+
+class TrustAnchorInfo(univ.Sequence):
+    pass
+
+TrustAnchorInfo.componentType = namedtype.NamedTypes(
+    namedtype.DefaultedNamedType('version', TrustAnchorInfoVersion().subtype(value='v1')),
+    namedtype.NamedType('pubKey', SubjectPublicKeyInfo()),
+    namedtype.NamedType('keyId', KeyIdentifier()),
+    namedtype.OptionalNamedType('taTitle', TrustAnchorTitle()),
+    namedtype.OptionalNamedType('certPath', CertPathControls()),
+    namedtype.OptionalNamedType('exts', Extensions().subtype(explicitTag=tag.Tag(
+        tag.tagClassContext, tag.tagFormatSimple, 1))),
+    namedtype.OptionalNamedType('taTitleLangTag', char.UTF8String().subtype(
+        implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2)))
+)
+
+
+class TrustAnchorChoice(univ.Choice):
+    pass
+
+TrustAnchorChoice.componentType = namedtype.NamedTypes(
+    namedtype.NamedType('certificate', Certificate()),
+    namedtype.NamedType('tbsCert', TBSCertificate().subtype(
+        explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
+    namedtype.NamedType('taInfo', TrustAnchorInfo().subtype(
+        explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)))
+)
+
+
+id_ct_trustAnchorList = univ.ObjectIdentifier('1.2.840.113549.1.9.16.1.34')
+
+class TrustAnchorList(univ.SequenceOf):
+    pass
+
+TrustAnchorList.componentType = TrustAnchorChoice()
+TrustAnchorList.subtypeSpec=constraint.ValueSizeConstraint(1, MAX)

pyasn1_alt_modules/rfc5915.py

@@ -0,0 +1,32 @@
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley with assistance from asn1ate v.0.6.0.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Elliptic Curve Private Key
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5915.txt
+
+from pyasn1.type import namedtype
+from pyasn1.type import namedval
+from pyasn1.type import tag
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5480
+
+
+class ECPrivateKey(univ.Sequence):
+    pass
+
+ECPrivateKey.componentType = namedtype.NamedTypes(
+    namedtype.NamedType('version', univ.Integer(
+        namedValues=namedval.NamedValues(('ecPrivkeyVer1', 1)))),
+    namedtype.NamedType('privateKey', univ.OctetString()),
+    namedtype.OptionalNamedType('parameters', rfc5480.ECParameters().subtype(
+        explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
+    namedtype.OptionalNamedType('publicKey', univ.BitString().subtype(
+        explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1)))
+)

pyasn1_alt_modules/rfc5916.py

@@ -0,0 +1,39 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley.
+# Modified by Russ Housley to include the opentypemap manager.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Device Owner Attribute
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5916.txt
+#
+
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import opentypemap
+
+certificateAttributesMap = opentypemap.get('certificateAttributesMap')
+
+
+# Device Owner Attribute
+
+id_deviceOwner = univ.ObjectIdentifier((2, 16, 840, 1, 101, 2, 1, 5, 69))
+
+at_deviceOwner = rfc5280.Attribute()
+at_deviceOwner['type'] = id_deviceOwner
+at_deviceOwner['values'][0] = univ.ObjectIdentifier()
+
+
+# Update the Certificate Attributes Map
+
+_certificateAttributesMapUpdate = {
+    id_deviceOwner: univ.ObjectIdentifier(),
+}
+
+certificateAttributesMap.update(_certificateAttributesMapUpdate)

pyasn1_alt_modules/rfc5917.py

@@ -0,0 +1,59 @@
+#
+# This file is part of pyasn1-alt-modules software.
+#
+# Created by Russ Housley.
+# Modified by Russ Housley to include the opentypemap manager.
+#
+# Copyright (c) 2019-2024, Vigil Security, LLC
+# License: http://vigilsec.com/pyasn1-alt-modules-license.txt
+#
+# Clearance Sponsor Attribute
+#
+# ASN.1 source from:
+# https://www.rfc-editor.org/rfc/rfc5917.txt
+# https://www.rfc-editor.org/errata/eid4558
+# https://www.rfc-editor.org/errata/eid5883
+#
+
+from pyasn1.type import char
+from pyasn1.type import constraint
+from pyasn1.type import namedtype
+from pyasn1.type import univ
+
+from pyasn1_alt_modules import rfc5280
+from pyasn1_alt_modules import opentypemap
+
+certificateAttributesMap = opentypemap.get('certificateAttributesMap')
+
+
+# DirectoryString is the same as RFC 5280, except for two things:
+#   1. the length is limited to 64;
+#   2. only the 'utf8String' choice remains because the ASN.1
+#      specification says: ( WITH COMPONENTS { utf8String PRESENT } )
+
+class DirectoryString(univ.Choice):
+    componentType = namedtype.NamedTypes(
+        namedtype.NamedType('utf8String', char.UTF8String().subtype(
+            subtypeSpec=constraint.ValueSizeConstraint(1, 64))),
+    )
+
+
+# Clearance Sponsor Attribute
+
+id_clearanceSponsor = univ.ObjectIdentifier((2, 16, 840, 1, 101, 2, 1, 5, 68))
+
+ub_clearance_sponsor = univ.Integer(64)
+
+
+at_clearanceSponsor = rfc5280.Attribute()
+at_clearanceSponsor['type'] = id_clearanceSponsor
+at_clearanceSponsor['values'][0] = DirectoryString()
+
+
+# Update the Certificate Attributes Map
+
+_certificateAttributesMapUpdate = {
+    id_clearanceSponsor: DirectoryString(),
+}
+
+certificateAttributesMap.update(_certificateAttributesMapUpdate)