1 // Copyright 2015 The Chromium Authors 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef BSSL_PKI_EXTENDED_KEY_USAGE_H_ 16 #define BSSL_PKI_EXTENDED_KEY_USAGE_H_ 17 18 #include <vector> 19 20 #include <openssl/base.h> 21 22 #include "input.h" 23 24 BSSL_NAMESPACE_BEGIN 25 26 // The arc for the anyExtendedKeyUsage OID is found under the id-ce arc, 27 // defined in section 4.2.1 of RFC 5280: 28 // id-ce OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 29 } 29 // 30 // From RFC 5280 section 4.2.1.12: 31 // id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 } 32 // anyExtendedKeyUsage OBJECT IDENTIFIER ::= { id-ce-extKeyUsage 0 } 33 // In dotted notation: 2.5.29.37.0 34 inline constexpr uint8_t kAnyEKU[] = {0x55, 0x1d, 0x25, 0x00}; 35 36 // All other key usage purposes defined in RFC 5280 are found in the id-kp 37 // arc, defined in section 4.2.1.12 as: 38 // id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } 39 // 40 // With id-pkix defined in RFC 5280 section 4.2.2 as: 41 // id-pkix OBJECT IDENTIFIER ::= 42 // { iso(1) identified-organization(3) dod(6) internet(1) 43 // security(5) mechanisms(5) pkix(7) } 44 // 45 // From RFC 5280 section 4.2.1.12: 46 // id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 } 47 // In dotted notation: 1.3.6.1.5.5.7.3.1 48 inline constexpr uint8_t kServerAuth[] = {0x2b, 0x06, 0x01, 0x05, 49 0x05, 0x07, 0x03, 0x01}; 50 51 // From RFC 5280 section 4.2.1.12: 52 // id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 } 53 // In dotted notation: 1.3.6.1.5.5.7.3.2 54 inline constexpr uint8_t kClientAuth[] = {0x2b, 0x06, 0x01, 0x05, 55 0x05, 0x07, 0x03, 0x02}; 56 57 // From RFC 5280 section 4.2.1.12: 58 // id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 } 59 // In dotted notation: 1.3.6.1.5.5.7.3.3 60 inline constexpr uint8_t kCodeSigning[] = {0x2b, 0x06, 0x01, 0x05, 61 0x05, 0x07, 0x03, 0x03}; 62 63 // From RFC 5280 section 4.2.1.12: 64 // id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 } 65 // In dotted notation: 1.3.6.1.5.5.7.3.4 66 inline constexpr uint8_t kEmailProtection[] = {0x2b, 0x06, 0x01, 0x05, 67 0x05, 0x07, 0x03, 0x04}; 68 69 // From RFC 5280 section 4.2.1.12: 70 // id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 } 71 // In dotted notation: 1.3.6.1.5.5.7.3.8 72 inline constexpr uint8_t kTimeStamping[] = {0x2b, 0x06, 0x01, 0x05, 73 0x05, 0x07, 0x03, 0x08}; 74 75 // From RFC 5280 section 4.2.1.12: 76 // id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 } 77 // In dotted notation: 1.3.6.1.5.5.7.3.9 78 inline constexpr uint8_t kOCSPSigning[] = {0x2b, 0x06, 0x01, 0x05, 79 0x05, 0x07, 0x03, 0x09}; 80 81 // From RFC 9336 section 3.1: 82 // id-kp-documentSigning OBJECT IDENTIFIER ::= { id-kp 36 } 83 // In dotted notation: 1.3.6.1.5.5.7.3.36 84 inline constexpr uint8_t kDocumentSigning[] = {0x2b, 0x06, 0x01, 0x05, 85 0x05, 0x07, 0x03, 0x24}; 86 87 // From GSMA RCC.16 v1.0 End-to-End Encryption Specification. 88 // id-gsmaRCSE2EE OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) 89 // international-organizations(23) gsma(146) rcs(2) rcsE2EE (1)} 90 // (Note this spec incorrectly says id-appleDraftRCSE2EE in place of 91 // id-gmsaRCSE2EE in several places) 92 // 93 // From GSMA RCC.16 v1.0 End-to-End Encryption Specification section A.2.8.8, 94 // and A.3.8.7. 95 // id-kp-rcsMlsClient OBJECT IDENTIFIER ::= { id-gmsaRCS2EE 3 } 96 // In dotted notation: 2.23.146.2.1.3 97 inline constexpr uint8_t kRcsMlsClient[] = {0x67, 0x81, 0x12, 0x02, 0x01, 0x03}; 98 99 // Parses |extension_value|, which contains the extnValue field of an X.509v3 100 // Extended Key Usage extension, and populates |eku_oids| with the list of 101 // DER-encoded OID values (that is, without tag and length). Returns false if 102 // |extension_value| is improperly encoded. 103 // 104 // Note: The returned OIDs are only as valid as long as the data pointed to by 105 // |extension_value| is valid. 106 OPENSSL_EXPORT bool ParseEKUExtension(der::Input extension_value, 107 std::vector<der::Input> *eku_oids); 108 109 BSSL_NAMESPACE_END 110 111 #endif // BSSL_PKI_EXTENDED_KEY_USAGE_H_ 112