revocation.proto 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960
  1. // Copyright (c) 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. //
  5. // Data structures related to Cast device certificate revocation infrastructure.
  6. // This proto must be kept in sync with google3.
  7. syntax = "proto2";
  8. package cast_certificate;
  9. option optimize_for = LITE_RUNTIME;
  10. message CrlBundle {
  11. // List of supported versions of the same revocation list.
  12. repeated Crl crls = 1;
  13. }
  14. message Crl {
  15. // Octet string of serialized TbsCrl protobuf.
  16. optional bytes tbs_crl = 1;
  17. // Binary ASN.1 DER encoding of the signer's certificate.
  18. optional bytes signer_cert = 2;
  19. // Signature calculated over the contents of the tbs_crl field. Signature
  20. // algorithm is implied by TbsCrl.version.
  21. optional bytes signature = 3;
  22. }
  23. message TbsCrl {
  24. // Version 0 algorithms:
  25. // revoked_public_key_hashes: SHA-256
  26. // SerialNumberRange.issuer_public_key_hash: SHA-256
  27. // Crl.signature: RSA-PKCS1 V1.5 with SHA-256
  28. optional uint64 version = 1 [default = 0];
  29. // Inclusive validity range of the CRL in Unix time.
  30. optional uint64 not_before_seconds = 2;
  31. optional uint64 not_after_seconds = 3;
  32. // SPKI hashes of revoked credentials. Hashing algorithm is implied by
  33. // TbsCrl.version.
  34. repeated bytes revoked_public_key_hashes = 4;
  35. repeated SerialNumberRange revoked_serial_number_ranges = 5;
  36. }
  37. message SerialNumberRange {
  38. // SPKI hash of the certificate issuer. Hashing algorithm is implied by the
  39. // enclosing TbsCrl.version.
  40. optional bytes issuer_public_key_hash = 1;
  41. // Inclusive range of revoked certificate serial numbers. Only certificates
  42. // with positive serial numbers that fit within 64 bits can be revoked through
  43. // this mechanism.
  44. optional uint64 first_serial_number = 2;
  45. optional uint64 last_serial_number = 3;
  46. }