[原]PKCS#15 - Overview

发布时间：2011-12-12 18:05
分类名称：PKI

PKCS15 Objects Hierarchy

PKCS #15 Object hierarchy

Card file structure

Typical PKCS15 Card Layout

Contents of DF(PKCS15) (Example)

MF下面的EF(DIR)

如果有EF(DIR)的话，其中包含一个或者多个应用程序模板（Application templates），至少包含两项内容：

1. Application Identifier(tag '4F'H)

2. Path(tag '51'H)

DIRRecord ::= [APPLICATION 1] SEQUENCE {

aid          [APPLICATION 15] OCTET STRING,

label        [APPLICATION 16] UTF8String OPTIONAL,

path        [APPLICATION 17] OCTET STRING,

ddo         [APPLICATION 19] DDO OPTIONAL

}

为何要使用这个EF呢？

1. 卡上可能有多个DF，相当于一个索引。

2. This provides a way for issuers to use non-standard file identifiers for these files without sacrificing interoperability. It also provides card issuers with the opportunity to share TokenInfo files between PKCS #15 applications, when several PKCS #15 applications reside on one card.

下面看看DF(PKCS15)里面的内容：

EF(ODF)

它算是个总目录，指向其余的EFs（PrKDFs, PuKDFs, SKDFs, CDFs, DODFs and AODFs）。指向的这些文件又是一些目录（算是二级目录）。

Private Key Directory Files(PrKDFs)

这个目录文件可以有多个，至少得有一个（通常情况的话，也就是一个）。They contain general key attributes such as labels, intended usage, identifiers, etc. When applicable, they also contain cross-reference pointers to authentication objects used to protect access to the keys. Furthermore, they contain pointers to the keys themselves.

Public Key Directory Files(PuKDFs)

和PrKDFs类似，要说明的是，公钥和私钥需要共享同一个identifier。通过EF(ODF)这张图，可以看到PrKDFs和PuKDFs有一条虚线。还有，如果此公钥还有对应的一个证书，那么对应的证书也要共享此id。图中也有虚线。They contain general key attributes such as labels, intended usage, identifiers, etc. Furthermore, they contain pointers to the keys themselves.

Secret Key Directory Files(SKDFs)

这个目录文件可以有多个，至少得有一个（通常情况的话，也就是一个）。They contain general key attributes such as labels, intended usage, identifiers, etc. When applicable, they also contain cross-reference pointers to authentication objects used to protect access to the keys. Furthermore, they contain pointers to the keys themselves.

Certificate Directory Files (CDFs)

这个目录文件可以有多个，至少得有一个（通常情况的话，有一个或者是俩个）。原话这么说的：They contain general certificate attributes such as labels, identifiers, etc. When a certificate contains a public key whose private key also resides on the card, the certificate and the private key must share the same identifier. Furthermore, certificate directory files contain pointers to the certificates themselves.There can be any number of CDFs in a PKCS #15 DF, but it is anticipated that in the normal case there will only be one or two (one for trusted certificates and one which the cardholder may update).

Data Object Directory Files (DODFs)

这个目录文件可以有多个，至少得有一个（通常情况的话，也就是一个）。They contain general data object attributes such as identifiers of the application to which the data object belongs, whether it is a private or public object, etc. Furthermore, they contain pointers to the data objects themselves.

Authentication Object Directory Files (AODFs)

There can be any number of AODFs in a PKCS #15 DF, but it is anticipated that in most cases there will only be one or two. They contain generic authentication object attributes such as (in the case of PINs) allowed characters, PIN length, PIN padding character, etc. Furthermore, they contain pointers to the authentication objects themselves (e.g. in the case of PINs, pointers to the DF in which the PIN file resides).

EF(TokenInfo)

The mandatory TokenInfo elementary file with transparent structure shall contain generic information about the card as such and it's capabilities, as seen by the PKCS15 application. This information includes the card serial number, supported file types, algorithms implemented on the card, etc.

EF(UnusedSpace)

The optional UnusedSpace elementary file with transparent structure is used to keep track of unused space in already created elementary files. When present, it must initially contain at least one record pointing to an empty space in a file that is possible to update by the cardholder.

Other elementary files in the PKCS #15 directory

These (optional) files will contain the actual values of objects (such as private keys, public keys, secret keys, certificates and application specific data) referenced from within PrKDFs, SKDFs, PuKDFs, CDFs or DODFs.

File identifiers

The following file identifiers are defined for the PKCS15 files. Note that the RID (see ISO/IEC 7816-5) is A0 00 00 00 63.