# 03. RC (Resource Certifications)

## 3.1 对象定位
RC是资源证书，包括CA和EE

## 3.2 原始载体与编码

- 载体：X.509 certificates.
- 编码：DER（遵循 RFC 5280 的 Certificate 结构与字段语义，但受 RPKI profile 限制）RFC 6487 §4

### 3.2.1 基本语法（RFC 5280 §4，RFC 6487 ）

RC是遵循RFC5280定义的X.509Certificate语法(RFC 5280 §4)，并且符合RFC 6487 §4的约束。只选取RFC 6487 §4章节列出来的字段。（Unless specifically noted as being OPTIONAL, all the fields listed
here MUST be present, and any other fields MUST NOT appear in a
conforming resource certificate.）

```
Certificate ::= SEQUENCE {
    tbsCertificate TBSCertificate,
    signatureAlgorithm AlgorithmIdentifier,
    signatureValue BIT STRING 
}

TBSCertificate ::= SEQUENCE {
    version         [0]     EXPLICIT Version MUST be v3,
    serialNumber            CertificateSerialNumber,
    signature               AlgorithmIdentifier,
    issuer                  Name,
    subject                 Name,
    validity                Validity,
    subjectPublicKeyInfo    SubjectPublicKeyInfo,
    extensions      [3]     EXPLICIT Extensions OPTIONAL
                            -- If present, version MUST be v3
 }

Version ::= INTEGER { v1(0), v2(1), v3(2) }

CertificateSerialNumber ::= INTEGER

Validity ::= SEQUENCE {
    notBefore   Time,
    notAfter    Time }
    
Time ::= CHOICE {
    utcTime     UTCTime,
    generalTime GeneralizedTime }

UniqueIdentifier ::= BIT STRING

SubjectPublicKeyInfo ::= SEQUENCE {
    algorithm           AlgorithmIdentifier,
    subjectPublicKey    BIT STRING }
 
Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension

Extension ::= SEQUENCE {
    extnID      OBJECT IDENTIFIER,
    critical    BOOLEAN DEFAULT FALSE,
    extnValue   OCTET STRING
                -- contains the DER encoding of an ASN.1 value
                -- corresponding to the extension type identified
                -- by extnID
}
```

> 其中`Name` "a valid X.501 distinguished name"(RFC 6487 §4.4)

### 3.2.2 证书扩展字段 （RFC 6487 §4.8)

RC的证书扩展字段按照RFC 6487 §4.8的规定，有以下几个扩展：

- Basic Constraints
- Subject Key Identifier
- Authority Key Identifier
- Key Usage
- Extended Key Usage(CA证书，以及验证RPKI对象的EE证书不能出现该字段。非RPKI对象的EE可以出现EKU，但必须为non-critical)
- CRL Distribution Points
- Authority Information Access
- Subject Information Access
  - SIA for CA Certificates
  - SIA for EE Certificates
- Certificate Policies
- IP Resources
- AS Resources

```
# Basic Constraints
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }

BasicConstraints ::= SEQUENCE {
 cA BOOLEAN DEFAULT FALSE }


# Subject Key Identifier
id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 }

SubjectKeyIdentifier ::= KeyIdentifier

KeyIdentifier ::= OCTET STRING


# Authority Key Identifier
id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 }

AuthorityKeyIdentifier ::= SEQUENCE {
    keyIdentifier             [0] KeyIdentifier OPTIONAL }


# Key Usage
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }

KeyUsage ::= BIT STRING {
    digitalSignature    (0),
    nonRepudiation      (1),  -- recent editions of X.509 have
                              -- renamed this bit to contentCommitment
    keyEncipherment     (2),
    dataEncipherment    (3),
    keyAgreement        (4),
    keyCertSign         (5),
    cRLSign             (6),
    encipherOnly        (7),
    decipherOnly        (8) }


# Extended Key Usage
id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }

ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId

KeyPurposeId ::= OBJECT IDENTIFIER


# CRL Distribution Points
id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= { id-ce 31 }

CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint

DistributionPoint ::= SEQUENCE {
  distributionPoint [0] DistributionPointName OPTIONAL }
  
DistributionPointName ::= CHOICE {
  fullName [0] GeneralNames }


## Authority Information Access
id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }

AuthorityInfoAccessSyntax ::=
  SEQUENCE SIZE (1..MAX) OF AccessDescription

AccessDescription ::= SEQUENCE {
  accessMethod OBJECT IDENTIFIER,
  accessLocation GeneralName }

# AccessDescription
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
# CA 证书发布位置
id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
# OCSP 服务地址
id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 }


# Subject Information Access
id-pe-subjectInfoAccess OBJECT IDENTIFIER ::= { id-pe 11 }

SubjectInfoAccessSyntax ::= SEQUENCE SIZE (1..MAX) OF AccessDescription
AccessDescription ::= SEQUENCE {
  accessMethod    OBJECT IDENTIFIER,
  accessLocation  GeneralName }

## Subject Information Access for CA (RFC 6487 §4.8.8.1)
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
id-ad-rpkiManifest OBJECT IDENTIFIER ::= { id-ad 10 }

必须存在一个accessMethod=id-ad-caRepository，accessLocation=rsyncURI。
必须存在一个accessMethod=id-ad-repiManifest, accessLocation=rsync URI，指向该CA的mft对象。

## Subject Information Access for EE (RFC 6487 §4.8.8.2)
id-ad-signedObject OBJECT IDENTIFIER ::= { id-ad 11 }

必须存在一个accessMethod=id-ad-signedObject, accessLocation=rsyncURI
不允许其他的accessMethod


# Certificate Policies
id-ce-certificatePolicies OBJECT IDENTIFIER ::= { id-ce 32 }
anyPolicy OBJECT IDENTIFIER ::= { id-ce-certificatePolicies 0 }

certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation

PolicyInformation ::= SEQUENCE {
  policyIdentifier    CertPolicyId,
  policyQualifiers    SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL }

CertPolicyId ::= OBJECT IDENTIFIER

PolicyQualifierInfo ::= SEQUENCE {
  policyQualifierId   PolicyQualifierId,
  qualifier           ANY DEFINED BY policyQualifierId }
  
-- policyQualifierIds for Internet policy qualifiers
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }

PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )

Qualifier ::= CHOICE {
  cPSuri      CPSuri,
  userNotice  UserNotice }

CPSuri ::= IA5String

UserNotice ::= SEQUENCE {
  noticeRef     NoticeReference OPTIONAL,
  explicitText  DisplayText OPTIONAL }

NoticeReference ::= SEQUENCE {
  organization    DisplayText,
  noticeNumbers   SEQUENCE OF INTEGER }

DisplayText ::= CHOICE {
  ia5String     IA5String     (SIZE (1..200)),
  visibleString VisibleString (SIZE (1..200)),
  bmpString     BMPString     (SIZE (1..200)),
  utf8String    UTF8String    (SIZE (1..200)) }
  
 
# IP Resources
id-pe-ipAddrBlocks OBJECT IDENTIFIER ::= { id-pe 7 }

IPAddrBlocks ::= SEQUENCE OF IPAddressFamily

IPAddressFamily ::= SEQUENCE { -- AFI & optional SAFI --
  addressFamily OCTET STRING (SIZE (2..3)),
  ipAddressChoice IPAddressChoice }

IPAddressChoice ::= CHOICE {
  inherit NULL, -- inherit from issuer --
  addressesOrRanges SEQUENCE OF IPAddressOrRange }

IPAddressOrRange ::= CHOICE {
  addressPrefix IPAddress,
  addressRange IPAddressRange }

IPAddressRange ::= SEQUENCE {
  min IPAddress,
  max IPAddress }

IPAddress ::= BIT STRING


# AS Resources
id-pe-autonomousSysIds OBJECT IDENTIFIER ::= { id-pe 8 }
ASIdentifiers ::= SEQUENCE {
  asnum [0] EXPLICIT ASIdentifierChoice OPTIONAL,
  rdi [1] EXPLICIT ASIdentifierChoice OPTIONAL}

ASIdentifierChoice ::= CHOICE {
  inherit NULL, -- inherit from issuer --
  asIdsOrRanges SEQUENCE OF ASIdOrRange }

ASIdOrRange ::= CHOICE {
  id ASId,
  range ASRange }

ASRange ::= SEQUENCE {
  min ASId,
  max ASId }

ASId ::= INTEGER
```

# 3.3 抽象数据结构
采用X509 Certificate + Resource + 约束校验的方式组合

| 字段       | 类型                  | 语义       | 约束/解析规则 | RFC 引用        |
|----------|---------------------|----------|---------|---------------|
| cert_der | Vec<u8>             | 证书原始数据   |         |               |
| cert     | X509Certificate     | 基础X509证书 |         | RFC 5280 §4.1 |
| resource | ResourceSet         | 资源集合     |         |               |


# 3.4 约束规则

## 3.4.1 Cert约束校验规则
RFC 6487中规定的证书的字段参见[3.2.1 ](#321-基本语法rfc-5280-4rfc-6487-)
- 

| 字段        | 语义    | 约束/解析规则                                      | RFC 引用       |
|-----------|-------|----------------------------------------------|--------------|
| version   | 证书版本  | 必须是v3(值为2）                                   | RFC6487 §4.1 |
| serial    | 证书编号  | 同一个CA签发的证书编号必须唯一                             | RFC6487 §4.2 |
| validity  | 证书有效期 | notBefore：时间不能早于证书的生成时间。若时间段大于上级证书的有效期，也是有效的 | RFC6487 §4.6 |


## 3.4.2 Cert Extentions中字段的约束校验规则
RFC 6487中规定的扩展字段参见[3.2.2 ](#322-证书扩展字段-rfc-6487-48)

| 字段                         | critical | 语义          | 约束/解析规则                                                                                                                                                                                                                                                  | RFC 引用          |
|----------------------------|----------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------|
| basicConstraints           | Y        | 证书类型        | CA证书：cA=TRUE; EE证书：cA=FALSE                                                                                                                                                                                                                              | RFC6487 §4.8.1  |
| subjectKeyIdentifier       | N        | 证书公钥        | SKI = SHA-1(DER-encoded SPKI bit string)                                                                                                                                                                                                                 | RFC6487 §4.8.2  |
| authorityKeyIdentifier     | N        | 父证书的公钥      | 字段只包含keyIdentifier，不能包含authorityCertIssuer和authorityCertSerialNumber；除了自签名CA外，其余证书必须出现。自签名CA若出现该字段，则等于SKI                                                                                                                                                | RFC6487 §4.8.3  |
| keyUsage                   | Y        | 证书公钥的用途权限   | CA证书：keyCertSign = TRUE, cRLSign = TRUE 其他都是FALSE。EE证书：digitalSignature = TRUE 其他都是FALSE                                                                                                                                                                 | RFC6487 §4.8.4  |
| extendedKeyUsage           | N        | 扩展证书公钥的用途权限 | CA证书：不能出现EKU；验证 RPKI 对象的 EE 证书：不能出现EKU；非 RPKI 对象的 EE：可以出现EKU，但必须为non-critical.                                                                                                                                                                           | RFC6487 §4.8.5  |
| cRLDistributionPoints      | N        | CRL的发布点位置   | 字段：distributionPoint，不能包含reasons、cRLIssuer。其中distributionPoint字段包含：fullName，不能包含nameRelativeToCRLIssuer。fullName的格式必须是URI。自签名证书禁止出现该字段。非自签名证书必须出现。一个CA只能有一个CRL。一个CRLDP只能包含一个distributionPoint。但一个distributionPoint字段中可以包含多于1个的URI，但必须包含rsync URI且必须是最新的。 | RFC6487 §4.8.6  |
| authorityInformationAccess | N        | 签发者的发布点位置   | 除了自签名的CA，必须出现。自签名CA，禁止出现。推荐的URI访问方式是rsync，并且rsyncURI的话，必须指定accessMethod=id-ad-caIssuers                                                                                                                                                                  | RFC6487 §4.8.7  |
| subjectInformationAccess   | N        | 发布点位置       | CA证书：必须存在。必须存在一个accessMethod=id-ad-caRepository，accessLocation=rsyncURI。必须存在一个accessMethod=id-ad-repiManifest,accessLocation=rsync URI，指向该CA的mft对象。 EE证书：必须存在。必须存在一个accessMethod=id-ad-signedObject,accessLocation=rsyncURI。不允许其他的accessMethod           | RFC6487 §4.8.8  |
| certificatePolicies        | Y        | 证书策略        | 必须存在，并且只能存在一种策略：RFC 6484 — RPKI Certificate Policy (CP)                                                                                                                                                                                                  | RFC6487 §4.8.9  |
| iPResources                | Y        | IP地址集合      | 所有的RPKI证书中必须包含IP Resources或者ASResources，或者两者都包含。                                                                                                                                                                                                         | RFC6487 §4.8.10 |
| aSResources                | Y        | ASN集合       | 所有的RPKI证书中必须包含IP Resources或者ASResources，或者两者都包含。                                                                                                                                                                                                         | RFC6487 §4.8.11 |


