Update CMP ASN.1 structures by Guiliano99 · Pull Request #100 · russhousley/pyasn1-alt-modules

Guiliano99 · 2026-01-15T18:49:04Z

Fix some Certificate Management Protocol (CMP) related structures.

Changes

I updated the ASN.1 Python modules for RFC 9480 and RFC 9810 to align with the standards.
I also updated the references to use the correct structures.
Removed duplicated structure.

Note

If you have a some time, could you please review my branch and check the file rfc9883_example_data.py?
I'm trying to understand why the signature verification is failing.

Fix name error.

- As of RFC9810 Section 5.3.19.17.

- As of RFC9810 Section 5.1.1.4.

- Now uses the EncryptedKey choice.

CBonnell · 2026-01-30T21:27:56Z

pyasn1_alt_modules/rfc9480.py

-                tag.tagFormatConstructed, 1)))
+        namedtype.NamedType(
+            "dpn",
+            rfc5280.DistributionPointName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)),


I don't think this change aligns with the ASN.1 module in the RFC. The ASN.1 module uses EXPLICIT tagging by default. CRLSource is defined as:

CRLSource ::= CHOICE { dpn [0] DistributionPointName, issuer [1] GeneralNames }

Which means each of the arms of the CHOICE are explicitly tagged.

Given this, I believe the current definition is correct.

But the older definition said EncryptedKey, inside the code.

But i will fix the tagging.

CBonnell · 2026-01-30T21:28:03Z

pyasn1_alt_modules/rfc9480.py

+            rfc5280.DistributionPointName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)),
+        ),
+        namedtype.NamedType(
+            "issuer", rfc5280.GeneralNames().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))


Likewise here.

CBonnell · 2026-01-30T21:32:13Z

pyasn1_alt_modules/rfc9810.py

-        namedtype.NamedType('issuer', EncryptedKey().subtype(
-            explicitTag=tag.Tag(tag.tagClassContext,
-                tag.tagFormatConstructed, 1)))
+        namedtype.NamedType(


The updated ASN.1 module in RFC 9810 also uses EXPLICIT tagging by default, so the comments in rfc9480.py apply here as well.

CBonnell · 2026-01-30T21:32:18Z

pyasn1_alt_modules/rfc9810.py

+            "dpn",
+            rfc5280.DistributionPointName().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0)),
+        ),
+        namedtype.NamedType(


Guiliano99 · 2026-01-31T06:06:32Z

@CBonnell thanks for your reply. The structures references are wrong. Please have a look at my comment from above.

…Names in RFC 9480 and RFC 9810.

Guiliano99 · 2026-02-06T08:16:30Z

@russhousley Hey, I have a quick question, what was the reason for closing this PR? Happy to revise or change it, if you point me to the issue.

CBonnell · 2026-02-06T15:10:54Z

pyasn1_alt_modules/rfc9480.py

        namedtype.OptionalNamedType('errorDetails', PKIFreeText())
    )

+class CertResponse(univ.Sequence):


Why was the reference to rfc4210.CertResponse removed and the same definition re-defined here?

CertResponse was not changed from RFC 4210, so it is imported from rfc4210.py. See line 217.

Because the CertifiedKeyPairstructure changed.

@Guiliano99, ah, thanks for pointing this out. I agree this re-definition is needed.

@CBonnell Should the structure also be updated inside the rfc4210.py file or is it correct to only change it in the newer RFC files?

I see. I missed the change from EncryptedKey to EncryptedValue in the CertOrEncCert structure.

CBonnell · 2026-02-06T15:15:48Z

After reviewing, I believe all proposed edits are not necessary except for the definition of CertProfileValue, as this PR correctly defines it as a SEQUENCE OF UTF8STRING.

@russhousley I think this PR should be re-opened to fix the CertProfileValue definition to align with the RFC(s). But all changes not related to CertProfileValue should be removed from this PR as they are not necessary.

russhousley · 2026-02-06T15:29:49Z

Agree, it should be corrected:

  CertProfileValue ::= SEQUENCE SIZE (1..MAX) OF UTF8String

Guiliano99 · 2026-02-06T15:32:55Z

@russhousley and @russhousley The CRLSource says EncryptedKey inside the old code. So I corrected the structure to GeneralNames.

Guiliano99 · 2026-02-06T15:34:15Z

@russhousley Should the file rfc4210 than also be updated to reference the new CertifiedKeyPair structure?

russhousley · 2026-02-06T15:37:07Z

I suggest:

class CertProfileValue(univ.SequenceOf):
    componentType = char.UTF8String()
    subtypeSpec=constraint.ValueSizeConstraint(1, MAX)

Guiliano99 · 2026-02-06T15:42:30Z

@russhousley Should I remove the comment from the class? In older modules, you also included the definition inside the docstrings, should I also not do that as well?

russhousley · 2026-02-06T15:44:34Z

The CRLSource says EncryptedKey inside the old code. So I corrected the structure to GeneralNames.

Sorry, I missed this one. It needs to be changed too.

class CRLSource(univ.Choice):
    componentType = namedtype.NamedTypes(
        namedtype.NamedType('dpn', DistributionPointName().subtype(
            explicitTag=tag.Tag(tag.tagClassContext,
                tag.tagFormatConstructed, 0))),
        namedtype.NamedType('issuer', GeneralNames().subtype(
            explicitTag=tag.Tag(tag.tagClassContext,
                tag.tagFormatConstructed, 1)))
    )

Guiliano99 · 2026-02-06T15:55:32Z

@russhousley Should the CertifiedKeyPair structure inside the rfc4210.py file also be modified or only in the new RFCs?

Guiliano99 and others added 7 commits October 28, 2025 11:20

Rename KemBMParameter to CAKeyUpdContent

a487fee

Fix name error.

Remove duplicate CAKeyUpdContent.

c938aa8

Fix CRLSource ANS.1 structure.

c263711

- As of RFC9810 Section 5.3.19.17.

Fix CertProfileValue ANS.1 structure.

0f6dbba

- As of RFC9810 Section 5.1.1.4.

Fix CertResponse to the correct ASN.1 structure.

25637b5

- Now uses the EncryptedKey choice.

Merge branch 'russhousley:master' into master

875f297

Merge branch 'russhousley:master' into master

c0865e0

CBonnell reviewed Jan 30, 2026

View reviewed changes

Guiliano99 closed this Jan 31, 2026

Guiliano99 reopened this Jan 31, 2026

Fix CRLSource explicit tagging, for DistributionPointName and General…

f6e048b

…Names in RFC 9480 and RFC 9810.

Guiliano99 requested a review from CBonnell January 31, 2026 06:42

Fix typo.

5434836

russhousley closed this Feb 4, 2026

Guiliano99 mentioned this pull request Feb 6, 2026

Remove CMP ASN.1 structures with pyasn1-alt-module siemens/cmp-test-suite#55

Open

CBonnell reviewed Feb 6, 2026

View reviewed changes

russhousley reopened this Feb 6, 2026

Guiliano99 added 3 commits February 6, 2026 16:48

Removed CRLSource rfc5280 imports for used structures.

7df041d

Removed docstring for CertProfileValue structure.

097754e

Reformat CRLSource structure definition.

75f8961

Conversation

Guiliano99 commented Jan 15, 2026

Changes

Note

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Guiliano99 Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Guiliano99 commented Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Guiliano99 commented Feb 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CBonnell commented Feb 6, 2026

Uh oh!

russhousley commented Feb 6, 2026

Uh oh!

Guiliano99 commented Feb 6, 2026

Uh oh!

Guiliano99 commented Feb 6, 2026

Uh oh!

russhousley commented Feb 6, 2026

Uh oh!

Guiliano99 commented Feb 6, 2026

Uh oh!

russhousley commented Feb 6, 2026

Uh oh!

Guiliano99 commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Guiliano99 Jan 31, 2026 •

edited

Loading

Guiliano99 commented Jan 31, 2026 •

edited

Loading