'correspondence between TRUSTED CERTIFICATE and TrustAnchorInfo

OpenSSL supports certificates with auxiliary trust/distrust information stored with the PEM label "TRUSTED CERTIFICATE". Other projects like p11-kit seem to have at least partial compatibility with this format, I think. The auxiliary information seems to be defined by the following ASN.1 (inferred from openssl/crypto/x509/x_x509a.c):

X509Aux ::= SEQUENCE {
  trust                SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,  -- EKUs
  reject  [0] IMPLICIT SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,  -- EKUs
  alias                UTF8String OPTIONAL,
  keyid                OCTET STRING OPTIONAL,
  other   [1] IMPLICIT SEQUENCE OF AlgorithmIdentifier OPTIONAL
}

Question 1: Is there a document that defines this format and the meanings and uses of these fields?

RFC 5914 defines a type called TrustAnchorInfo, which provides a much more general mechanism for modifying or constraining the ways in which a certificate is trusted. (For example, it can impose name constraints on a certificate, which OpenSSL's aux info cannot.)

Question 2: Has someone already worked out (and documented) a partial mapping between the OpenSSL Certificate+X509Aux data and TrustedAnchorInfo? Maybe one of the PKCS11 projects? Or is there a better alternative to TrustAnchorInfo?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source