JNSA Challenge PKI 2001
|
|
|
- しょうこ ぜんじゅう
- 7 years ago
- Views:
Transcription
1 PKI PKI
2
3 PKI PKI PKI PKI PKI FORUM PKI CHALLENGE PKI [] [ II ]PKI [ III ] & PKI CESGPKI ( ) EMA CHALLENGE GPKI GPKI GPKI GPKI DOD BCA TECHNOLOGY DEMONSTRATIONPHASE EEMA PKI CHALLENGE CHALLENGE PKI S/MIME S/MIME S/MIME S/MIME PKI TLSTRANSPORT LAYER SECURITY TLS TLS TLS TLS TLS PKI IKE (INTERNET KEY EXCHANGE) IKE
4 IKE IKE PKI PKI PKI Single CA Strict Hierarchy Web Cross-Certification Bridge CA PKI PKI VS CA S/MIME IPsec Web Web CA S/MIME CA S/MIME DER DN DirectoryString serialnumber
5 basicconstraints.ca basicconstraints.pathlenconstraint keyusage {subject authority}keyidentifier critical PKI C
6 PKI PKI IPA PKI NPO JNSA PKI CA Challenge PKI 2001 Challenge PKI 2001 CA PKI PKI ITU IETF ITU X.509 IETF/PKIX RFC2459 PKI PKI X.509 RFC2459 X.509 RFC2459 PKI PKI PKI Forum PKI Forum PKI PKI X.509 RFC2459 Identrus GPKI PKI PKI PKI PKI PKI PKI
7 PKI Challenge PKI 2001 CA PKI PKI Challenge PKI 2001 (1) CA (2) PKI (3) PKI (1) (2)(3) PKI PKI PKI Challenge PKI 2001 PKI PKI CA PKI (1) PKI CA PKI PKI PKI PKI CA
8 (2) PKI PKI PKI PKI PKI PKI PKI PKI PKI PKI CA CP/CPS PKI PKI PKI PKI Forum White paper PKI Interoperability Framework EEMAEuropean Forum for Electronic Business PKI PKI Challenge 2 PKI Challenge PKI 2001 PKI PKI PKI PKI EEMA PKI PKI Challenge WP2NO13- Interoperability Test Criteria PKI Challenge 9 PKI PKI
9 PKI PKI ITU X.509 PKIX RFC2459 PKI X.509RFC2459 Challenge PKI 2001 X.509 RFC2459 CA Challenge PKI 2001 GPKI GPKI GPKI PKI
10 Challenge PKI 2001 CA CA CA CA CA PKI Forum White PaperCA-CA Interoperability CA-CA Interoperability White Paper 5 PKI PKI PKI CA PKI SSL IPsec S/MIME (1) CA 2 CA
11 (2) (3) GPKI GPKI (4) SSL / IPsec/IKE S/MIME 4 7 PKI Challenge PKI 2001 PKI 8 8 PKI 4 5 PKI 6 PKI PKI PKI JNSA 9 CA PKI 9 CA CA
12 PKI S/MIME S/MIME
13 Challenge PKI 2001 CA PKI PKI Forum PKI Challenge PKI Forum PKI Interoperability Framework Challenge PKI Interoperability Test Criteria Challenge PKI 2001 PKI Forum PKI PKI White Paper White Paper PKI Forum PKI Interoperability Framework PKI Interoperability Framework PKI PKI PKI Interoperability Framework PKI PKI Interoperability Framework
14 (1) PKI CA-CA CA-RA -CA -RA (2) PKI (3) PKI (4) (5) Challenge PKI 2001 CA CA-CA (1) (2) (3) (4) (1) -RA CA-RA 2 S/MIME PKI Challenge PKI 2001 IPsec PKI Interoperability Framework (1) (2)
15 (3) (4) (5) CA PKI Challenge PKI 2001 S/MIMEIPsecSSL Challenge PKI 2001 CA 2 PKI PKI PKI
16 PKI 2 PKI (1) PKI (2) 1 PKI PKI PKI Challenge PKI 2001 PKI Challenge PKI 2001 PKI
17 PKI Challenge EEMAEuropean Forum for Electronic BusinessEU PKI PKI Challenge PKI PKI PKI PKI Challenge 3 [] [ II ]PKI [ III ] & 3 END ENTITY A I END ENTITY B Applications COMMUNICATIONS Applications Crypto Directory & Validation Services III Crypto II PKI A PKI B RA CA RA RA CA CA RA X.509 V3 X.509 V3 X.509 V3 X.509 V3
18 S/MIME XML HTML Web VPN EDI PKI Forum Challenge PKI 2001 IPsec VPNSSLS/MIME PKI CA CA/RA CA RA END ENTITY A END ENTITY B Crypto Crypto Sub Sub CA RA Sub CA RA Smart Card II Sub Sub CA RA Sub CA RA Root CA Root CA PKI A PKI B
19 CA PKIX-CMP CRMF CA/RA CA RA CA RA RA CA RA Challenge PKI 2001 CA Challenge PKI 2001 PKI & LDAP CRLDP & deltacrl OCSP X.500 DAP Challenge PKI 2001 LDAP
20 CA PKI Challenge PKI 2001 Challenge PKI 2001 PKI CESG PKI EMA Challenge 2000 GPKI BCA Technology DemonstrationPhase 2 EEMA PKI Challenge ( EU ) PKI (1) CMPv2 (2) (3) CA-CA (4) (5) OCSP (6) CMC White Paper Challenge PKI 2001 (3) CA-CA - Communications-Electronics Security Group CESG 10 PKI PKI CLOUD COVER PKI CESG PKI PKI PKI HMG Root Authority CESG PKI PKI
21 PKI CLOUD COVER PKI eport.pdf CLOUD COVER PKI IMPLEMENTOR'S GUIDE Baltimore Technologies Root CA Compaq Entegrity Solutions Entrust Reflex Magnetics Spyrus XCert RSA Security SSE S/MIME Shym Novell Baltimore Technologies Root CA Baltimore Technologies CA 7 CA CA CA S/MIME S/MIME CESG RSA DSA SHA-1 S/MIMEv3 CLOUD COVER Challenge PKI 2001 S/MIME RSA
22 EMAElectronic Messaging Association The EMA Secure Messaging Challenge Challenge 1 (1996) - X.400 Challenge 2 (1997) - Directory Challenge 3 (1999) - PKI Bridged Certificate Authority Challenge 4 (2001) - Secure Messaging EMA PKI 2000 Challenge 3 (1999) - PKI Bridged Certificate Authority PKI Electronic Messaging Association Challenge Electronic Messaging Association Challenge FBCA PKI 5 CA EntrustCybertrust SpyrusCygnaCom 4 PKI 7 PKI S/MIME CA PKI Challenge PKI 2001 PKI EMA Challenge 2000 GPKI GPKI GPKI CP/CPS
23 GPKI GPKI 2000 GPKI CA CA PKI (1) (2) (3) PKI OCSP OCSP CRL/ARL GPKI GPKI GPKI Challenge PKI 2001 GPKI GPKI CRL/ARL
24 GPKI CRL/ARL CA 3 EE ( ) EE CA GPKI CA OCSP & 4 EE EE CA
25 DoD BCA Technology Demonstration Phase PKI PKI PKI PKI COTS ( Commercial Off-The-Shelf ) PKI PKI COTS NSA CA EE CRL/ARL EMA Challenge 2000 Web S/MIMEv3 ( Phase1 ) RSA/MD5 DSA/SHA-1 ( NSA ) CA Cygnacom(BCA)EntrustBaltimoreSETECSSpyrusMotorola EntgrityGetronicsA&N Associates BCA Technology DemonstrationPhase DoD Getronics BITSBridge Certification Authority Interoperability Test Suite BITS Web Site Web Site
26 (1) Phase II BCA Interoperability Demonstration Final Report (2) Technical Interoperability Profile (TIP) (3) BCA Demonstration Cert-CRL Profiles (4) BCA Interoperability Test Description (5) BCA Phase II Directory Profile BITS CRL/ARLPKCS#12 LDAP Phase II Bridge CA Demonstration Data BITS LDAP ldap://bcatest.atl.getronicsgov.com/ Challenge PKI 2001 Phase II Bridge CA Demonstration Phase II Bridge CA Demonstration PKI PKI Challenge PKI EEMA EEMA European Forum for Electronic Business PKI Challenge 2001 Q1 2 PKI Challenge Entrust Baltimore PKI Globalsign UK Post KPMG PKI Challenge
27 PKI Challenge PKI PKI PKI Challenge Challenge PKI B2B NEC NTT
28 3 Challenge PKI PKI 3 PKI
29 GPKI CESG PKI EEMA PKI Challenge Challenge PKI 2001 Challenge PKI 2001 PKI 9 CA PKI
30 S/MIMESSLIPsec IKE 3 PKI S/MIME MIME MIME S/MIME MIME RSA Security PKCS#7 PKCS#7 RFC2315 S/MIME 2 RFC2311 RFC2312 S/MIME 3 RFC2632 RFC2633 S/MIME S/MIME 2 S/MIME 2 S/MIME PKCS#7 PKCS#7 data signed data enveloped data signed-and-enveloped data digested data encrypted data
31 PKCS#7 S/MIME PKCS#7 content type content type MIME content type MIME signed-data content type PKCS#7 signed data 4-1 signed data signed data signed-data content type CRL PKCS#7 SignerInfo CRL 4. PKCS#7 SignedData
32 signed data Distinguished Name subjectkeyidentifier signeddata certificate S/MIME S/MIME 80 PKCS#7 MIME 80 S/MIME 4-2 S/MIME PKCS#7 enveloped data enveloped data 4-2 enveloped data
33 enveloped-data enveloped-data 1. content-encryption content-encryption 2. content-encryption content-encryption content-encryption content-encryption 3. content-encryption RecipientInfo 4. content-encryption 5. RecipientInfo envelopeddata enveloped data content-encryption content-encryption S/MIME PKCS#7 ExtendedCertificateAndCertificates CA PKCS#7 CertificateRevocationLists CRL CRL S/MIME 2 RFC2312
34 basicconstraints basicconstraints address From RFC822 DN Address subjectaltname From address keyusage S/MIME digitalsignature keyenchpherment PKCS#7 CA PKI CA PKCS#7 ExtendedCertificateAndCertificates S/MIME TLS TLS TLS TLSv1.0 Netscape SSLv3.0 TLSv1.0 SSLv3.0 TLSv1.0 RFC2246 TLS TLS TLS 2 TLS TLS TLS TLS MAC TLS TLS
35 TLS X TLS
36 TLS 4-3 ClientHello Certificate* ClientKeyExchange CertificateRequest* CertificateVerify* [ChangeCipherSpec] Finished Application Data ServerHello Certificate* ServerKeyExchange* CertificateRequest* ServerHelloDone [ChangeCipherSpec] Finished Application Data ClientHello ServerHello ServerCertificate CertificateRequest ClientCertificate Certificate Certificate CA TLS Web URI IP
37 subjectaltname dnsname ipaddress IP IP TLS KeyUsage digitalsignature KeyUsage keyencipherment Diffie-Hellman keyagreement subjectaltname dnsname ipaddress IP RFC2459 extendedkeyusage id-kp-serverauth id-kp-clientauth TLS bad_certificate unsupported_certificate certificate_revoked certificate_expired certificate_unknown unknown_ca CA access_denied TLS TLS
38 TLS Certificate CA PKI PKI CA CA IKE Security AssociationSA IKE Oakley/ISAKMP SKEME RFC2409 IKE SA Diffie-Hellman IKE SA IPsec RIPv2OSPF SA Domain of InterpretationDOI IPsec DOIRIP DOIOSPF DOI IKE SA IKE SA SA ISAKMP SA ISAKMP SA ISAKMP SA SA 4-4 IKE ISAKMP SA IKE IPsec SA
39 ISAKMP SA Main Aggressive Aggressive Main SA Main Diffie-Hellman IKE IKE ISAKMP SA 4 IP IKE 4-5 (i) (r) SA SA KEi KEr IDi i IDr r ISAKMP 4-5 SA 4-5 SA SA SA Diffie-Hellman KE i KE r ID ID
40 IP ID IKE 4-6 (i) (r) SA SA KE i IDi [] i KE r IDr [] r SA Diffie-Hellman KE DSS RSA ID IKE 4-7
41 (i) (r) SA SA KE [ 1] {IDi}PKr { i}pkr KE {IDr}PKi { r}pki i r SA Diffie-Hellman KE 4-7 {IDi}PKr ID { i}pkr 2 1 ID 2 ID 4-8
42 (i) (r) SA { i}pkr {KE}Ki {IDi}Ki [{}Ki] i SA { r}pki {KE}Kr {IDr}Kr [{}Kr] r Ki Kr ID Ki Kr SA Diffie-Hellman KE IKE 1 Diffie-Hellman KE KE IKE ISAKMP CRL ISAKMP 4-1 PKCS #7 wrapped X.509 certificate PGP Certificate DNS Signed Key X.509 Certificate - Signature X.509 Certificate - Key Exchange Kerberos Tokens Certificate Revocation List (CRL) Authority Revocation List (ARL) SPKI Certificate X.509 Certificate - Attribute
43 IKE Internet-Draft A PKIX Profile for IKE <draft-ietf-ipsec-pki-req-05.txt> Internet-Draft extendedkeyusage ikeintermediateiso.org.dod.internet.security.mechanisms.ipsec.certificate subjectaltname IP Fully Quallified Domain NameFQDN Internet-Draft IKE RFC2408 ISAKMP Internet-Draft A PKIX Profile for IKE CA Internet-Draft IKE PKI IKE ISAKMP Internet-Draft Protocol Requirements for Son-of-IKE <draft-ietf-ipsec-son-of-ike-protocol-reqts-00.txt> SKEYID IKE IPsec IPsec SA IKE
44 CA PKI PKI PKI PKI PKI PKI CA CA CA CA CA CRL RA CA CA CA CA
45 CA CA CA CA CA CA CA PKI CA CA CA CA CA CA CA CA CA X CA CA cacertificate CA CA cacertificate
46 CA CA CA CA CA CA CA CA CA CA CA CA PKI CA PKI Web Web CA CA CA CA
47 CA CA CA CA CA PKI PKI CA CA CA CA X.509 CA CA CA CA CA PKI PKI A B B C A C nameconstraints policyconstraints pathlenconstraint X.509 PKI PKI PKI CA CA PKI PKI
48 Bridge CA Bridge CA Bridge CA Bridge CA Bridge CA Bridge CA Bridge CA Bridge CA PKI Bridge CA PKI Bridge CA PKI Bridge CA Bridge CA Bridge CA Bridge CA Bridge CA CA PKI Bridge CA Bridge CA PKI PKI Bridge CA CA CA CA CA Issuer Subject CA CA
49 SSL/TLSS/MIMEIPsec CA CA CA CA CA CA CA-1 CA-2 CA CA Issuer CA Subject: CA-2 Issuer CA-2 Subject: CA CA CA2 CA CA CA X.509 CA cacertificate Web CRL X.509 CA certificaterevocationlist certificatedistributionpoints certificaterevocationlist CRL ARL ARL authorityrevocationlist Web CRL CA
50 X.509 CA Issuer cacertificate cacertificate AIA caissuers PKIX Authority Information AccessAIA caissuers URL SSL/TLS IPsec Web IPsec Certificate Payload S/MIME PKCS#7 CRL X.509 PKIX Authority Infomation AccessAIA ocsp AIA ocsp URL OCSPRFC2560Online Certificate Status Protocol OCSP certificatedistributionpointscrldp CRLDP directoryname URL CRL/ARL directoryname IP CA basicconstraints ca TRUE CRLDP authorityrevocationlist certificasterevocationlist CRLDP certificaterevocationlist CRLDP AIA
51 IP basicconstraints ca TRUE CA Issuer authorityrevocationlist certificaterevocationlist basicconstrasints ca FALSE basicconstraints Issuer certificaterevocationlist 2 CA 2 CA 2 CA CA CA CA CA CA CA CA CA CA PKI CA CA-1 CA-2
52 CA CA X Issuer Subject CA subject CA subject CA CA CA CA CA CA CA CA CA CA-1 CA-2 CA-1 Subject CA-2 Issuer CA-1 Subject CA-1 Issuer CA-2 CA-2 CA-2 CA-1 Subject ALICE Issuer CA-1 Subject BOB Issuer CA-2 CA X
53 crosscertificatepair ATTRIBUTE ::= { WITH SYNTAX CertificatePair EQUALITY MATCHING RULE certificatepairexactmatch ID id-at-crosscertificatepair } CertificatePair ::= SEQUENCE { issuedtothisca [0] Certificate OPTIONAL, issuedbythisca [1] Certificate OPTIONAL -- at least one of the pair shall be present -- } (WITH COMPONENTS {, issuedtothisca PRESENT} WITH COMPONENTS {, issuedbythisca PRESENT}) issuedtothisca forward issuedbythisca Reverse issuedtothisca subject issuedbythisca issuer issuedbythisca subject issuedtothisca issuer CA CA c=jp LDAP o=a Company o=b Company ou=a-ca cacertificate A-CA B-CA ou=b-ca cacertificate certificaterevocationlist authorityrevocationlist crosscertificatepair with B issuedtothisca B-CA issuedbythisca A-CA certificaterevocationlist authorityrevocationlist crosscertificatepair with A issuedtothisca A-CA issuedbythisca B-CA CA CA
54 A CA EE-A EE-R CA B CA EE-B C CA EE-C CA c=jp LDAP o=reference ou=reference CA cacertificate crosscertpair With A crosscertpair With B crosscertpair With C cacertificate crosscertipair With R) o=a o=b o=c ou=b-ca ou=c-ca ou=d-ca cacertificate crosscertipair WithR) cacertificate crosscertipair With R) CA CA CA CA -1 x-1 subjectkeyidentifier x authoritykeyidentifier keyidentifier
55 CA-A CA-B Subject CA-A Issuer:CA-A SubjectKeyIdentifier AAA Subject CA-B Issuer:CA-A authoritykeyidentifier AAA subjectkeyidentifier BBB Subject BOB Issuer:CA-B authoritykeyidentifier BBB subjectkeyidentifier CCC AB subjectkeyidentifier authoritykeyidentifier CA CA CA CA crosscertificatepair with B issuedtothisca B-CA issuedbythisca A-CA crosscertificatepair with A issuedtothisca A-CA issuedbythisca B-CA CA-A CA-B Subject CA-A Issuer:CA-A Subject CA-B Issuer:CA-A Subject BOB Issuer:CA-B issuedbythisca issuedtothisca AB
56 Issuer: A-CA Subject: ALICE CA A-CA Issuer: B-CA Subject: A-CA Issuer: A-CA Subject: B-CA B-CA Issuer: B-CA Subject: BOB CA ARL (B-CA) OK! CA EE CRL certificaterevocationlistcrl authorityrevocationlist ARL crldistributionpoints CRLDP CRL/ARL CRL/ARL issuingdistributionpointsidp CRL/ARL CRLDPAIA CA CRL/ARL CA CRL/ARL CRL/ARL authoritykeyidentifier authoritykeyidentifier CRL CRL IDP CRL CA CRL ARL CRL ARL IDP CRL
57 onlycontainsusercerts ARL onlycontainsauthoritycerts TRUE pathlenconstraint nameconstraints policyconstraints CA critical TRUE CA CA basicconstraints ca TRUE CA CA ARL ARL ARL CRL basicconstraints ca FALSE basicconstraints CRL CRL PKI CA CA
58 CA 10 CA CA CA CA CA CA CA CA CA CA CA CA BCA CA CA CA CA
59 CA CA CA PKI CA CA CA Root CA CA CA CA CA CA CA PKI PKI CA PKI PKI CP PKI PKI PKI PCA CA PKI Class-1 Class-2 Class-3 Class-4 PCA Principal CA CA PCA PKI CA CA CA PKI High Middle Low CA CA Mesh Red Blue Yellow Black White
60 GPKI critical TRUE CA requireexplicitpolicy CA PKI PKI CA PKI policymappings CA PKI CA PKI policymappings Any-Policy Any-Policy any-policyoid CA certificatepolicies any-policy CA CA policyconstraints CA policyconstraints requireexplicitpolicy PKI PKI policyconstraints inhibitpolicymapping PKI AB C CA A B B C A B inhibitpoicymapping=0 A C
61 Any-Policy inhibitanypolicy Any-Policy CA CA inhibitanypolicy CA CA CA CA CA CA-A BCA CA-B crosscertificatepair with A issuedtothisca CA-A crosscertificatepair with BCA issuedbythisca BCAcrossCertificatePair with BCA issuedtothisca BCA issuedtothisca BCA issuedbythisca CA-A crosscertificatepair with B issuedbythisca CA-B issuedtothisca CA-B issuedbythisca BCA CA-A issuedbythisca BCA crosscertificatepair With B issuedbythisca BCA crosscertificatepair(with A)issuedByToCA CA-A issuedbytoca CA-ABCA BCACA-B Subject CA-A Issuer:CA-A Subject BCA Issuer:CA-A Subject CA-B Issuer:BCA Subject Bob Issuer:CA-B CA CA CA PKI pathlenconstraint nameconstraints
62 policyconstraints CA critical TRUE CRL/ARL CA CA basicconstraints ca TRUE CA CA ARL ARL ARL CRL basicconstraints ca FALSE basicconstraints CRL CRL pathlenconstraintnameconstraints pathlenconstraint CA CA CA pathlenconstraint pathlenconstraint pathlenconstraint
63 CA-A BCA CA-B CA-X CA-ABCA BCACA-B EE-B Subject CA-A Issuer:CA-A Subject BCA Issuer:CA-A pathlenconstraint=1 Subject CA-B Issuer:BCA Subject BOB Issuer:CA-B CA CA-ABCA BCACA-B CA-BCA-X Subject CA-A Issuer:CA-A Subject BCA Issuer:CA-A pathlenconstraint=1 Subject CA-B Issuer:BCA Subject CA-X Issuer:CA-B EE-X Subject CAROL Issuer:CA-X nameconstraints CA CA nameconstraints permittedsubtrees permittedsubtrees Subject subjectaltname excludedsubtrees excludedsubtrees Subject subjectaltname initial-policy-set PKI Any-Policy initial-explicit-policy ON initial-explicit-policy 1 OFF policyconstraints requireexplicitpolicy initial-policy-mapping
64 ON PKI PKI Any-Policy initial-inhibit-policy ON Any-Policy CA policyqualifier CA CA PKIX-CMPRFC2510 CA CRL OldWithNew NewWithOld
65 CA CA NewWithOld OldWithNew CA OldWithNew NewWithOld CA cacertificate CRL NewWithOld CRL OldWithNew pathlenconstraintpolicyconstraints inhibitanypolicy
66 6-1 EE Issuer Issuer=Subject Issuer=Subject Issuer CA Issuer CA ( ) Subject
67 / Subject JNSA IPA JNSA CA C=JP,O=JNSA,CN=Root CA IPA CA C=JP,O=IPA,CN=Root CA 6-2 IPA JNSA JNSA IPA JNSAPKI IPAPKI JNSA JNSA Alice C=JP,O=JNSA,CN=JNSA Alice IPA IPA Bob C=JP,O=IPA,CN=IPA Bob IPA Bob 1 JNSA Alice JNSA CA 2
68 Alice Bob Issuer C=JP,O=IPA,CN=Root CA Alice Subject C=JP,O=IPA,CN=Root CA IPA IPA Bob Alice IPA Bob (6-3) IPA IPA IPA IPA IPA IPA IPA IPA Bob IPA Bob IPA JNSA Alice ( JNSA Alice JNSA JNSA JNSA JNSA JNSA JNSA JNSA Alice JNSA Alice ) IPA Subject C=JP,O=IPA,CN=Root CA JNSA IPA JNSA IPA Bob
69 Issuer C=JP,O=JNSA,CN=Root CA Alice Subject C=JP,O=JNSA,CN=Root CA JNSA JNSA JNSA IPA JNSA Alice Bob JNSA IPA Alice Bob Bob 6-4 IPA IPA IPA IPA IPA IPA IPA IPA Bob IPA Bob JNSA IPA JNSA Alice ( JNSA Alice JNSA JNSA JNSA JNSA JNSA JNSA JNSA Alice JNSA Alice ) JNSA IPA JNSA JNSA/IPA JNSA Subject C=JP,O=JNSA,CN=Root CA
70 Issuer C=JP,O=JNSA,CN=Root CA IPA JNSA IPA JNSA Issuer C=JP,O=IPA,CN=Root CA Subject C=JP,O=IPA,CN=Root CA IPA IPA JNSA JNSA/IPA 6-5 IPA IPA IPA IPA IPA IPA IPA IPA Bob IPA Bob JNSA/IPA JNSA/IPA JNSA Alice JNSA JNSA JNSA JNSA JNSA JNSA JNSA Alice JNSA Alice
71 JNSAC=JP,O=JNSA CA C=JP,O=JNSA,CN=Root CA /IPAC=JP,O=IPA CA C=JP,O=IPA,CN=Root CA C=JP,O=Bridge CA C=JP,O=Bridge, CN= Root CA 6-6 JNSAPKI PKI IPAPKI 6-7 IPA Bridge IPA Bridge IPA Bob JNSA Bridge Bridge IPA JNSA JNSA Bridge JNSA Alice Bob Alice
72 JNSA Alice JNSA Bridge Bridge IPA JNSA Bridge IPA Bridge JNSA IPA Bridge JNSA Alice IPA Bob JNSA BridgeIPA Bridge 2 JNSA Subject C=JP,O=JNSA,CN=Root CA Issuer C=JP,O=JNSA,CN=Root CA JNSA Bridge JNSA Bridge Bridge Bridge Bridge JNSA JNSA Bridge
73 IPA Bob IPA Bob Bridge Bridge IPA Bridge IPA IPA Bridge IPA Bridge Bridge Bridge Bridge IPA JNSA Alice JNSA Alice Bridge JNSA Alice JNSA Alice JNSA JNSA JNSA JNSA JNSA JNSA JNSA Bridge Bridge IPA 6-9 Bridge Bridge IPA IPA IPA IPA Bridge IPA Bridge IPA Bridge Bridge Bridge IPA
74 IPA Bob IPA Bob Bridge Bridge IPA Bridge IPA IPA Bridge IPA Bridge IPA IPA Bridge IPA JNSA Alice JNSA Alice Bridge IPABridge JNSA Alice JNSA Alice JNSA JNSA JNSA JNSA JNSA JNSA X.509v3 Critical Flag Critical Flag Critical Flag True/False 2 / CriticalFlag True / OID Critical TRUE / False /
75 Subject/Issuer Subject/Issuer DistinguishedName DistinguishedName DirectoryString DirectoryString RFC DirectoryString 1. PrintableString PrintableString 2. BMPString BMPString UTF8String UTF8String UTF8String Subject/Issuer DirectoryString 1 PrintableString 4 UTF8String PrintableString PrintableString C=JP,O=JNSA,OU=PKI,CN=JNSA Alice PrintableString Subject C=JP,O=JNSA,CN=Root CA PrintableString Issuer PrintableString / JNSA jnsa Subject C=JP,O=JNSA,OU=PKI,CN=JNSA Alice C=JP,O=jnsa,OU=Pki,CN=Jnsa Alice Issuer C=JP,O=JNSA,CN=Root CA C=JP,O=jnsa,CN=ROOT CA
76 RFC PrintableString / (c) PrintableString BMPString/UTF8String / (b) X.500 / (a) Issuer/Subject Name rollover certificate Name rollover Issuer/Subject RFC CA /PKI 5
77 Subject/Issuer Subject C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 Subject CA C=JP,O=JNSA,CN=JNSA Alice C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 CA SubjectKeyIdentifier/AuthorityKeyIdentifier SubjectKeyIdentifier KeyIdentifier KeyIdentifier 2 RFC SHA1 160bit 160bit 2. bit 0100 SHA1 160bit 60bit 64bit SubjectKeyIdentifier
78 C=JP,O=JNSA,OU=PKI,CN=JNSA Alice C=JP,O=JNSA,CN=Root CA 6-11 SubjectKeyIdentifier SubjectKeyIdentifier SubjectKeyIdentifier SubjectKeyIdentifier EE PKI SubjectKeyIdentifier KeyIdentifier AuthorityKeyIdentifier AuthorityKeyIdentifier SubejctKeyIdentifier KeyIdentifier authoritycertissuer authoritycertserialnumber
79 authoritycertissuer/authoritycertserialnumber OPTIONAL AuthorityKeyIdentifier keyidentifier 2. authoritycertissuer/authoritycertserialnumber 6-12 AuthorityKeyIdentifier C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 C=JP,O=JNSA,CN=Root CA C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 C=JP,O=JNSA,CN=JNSA Alice C=JP,O=JNSA,CN=Root CA 2000/01/ /12/31 AuthorityKeyIdentifier CA AuthorityKeyIdentifier AuthorityKeyIdentifier authoritycertissuer/authoritycertserialnumber keyidentifier KeyIdentifier ID 1 AuthorityKeyIdentifier Validity DistinguishedName
80 RFC2459 Validity 2049 UTCTime GeneralizedTime UTCTime ASCII ZYYMMDDHHMMSS UTC GeneralizedTime ASCII UTC UTCTime/GeneralizedTime UTCTime GeneralizedTime Subject/Issuer DirectoryString PrintableString/BMPString/UTF8String RFC notbefore UTCTime notafter GeneralizedTime GeneralaizeTime 30 notafter 2000 Repository Directory PAPublication Authority PA 1. CRL 2. OCSP 2 CRL CRL CRL CRL CRLDistributionPoint
81 CRLDistributionPoint GeneralNames GeneralName CRLDistributionPoint 1. Directory DN 2. URI LDAP 3. URI HTTP CRLDistributionPoint Repository CRL (2) (2) Directory CRL Directory IP Repository Directory 1. CRLDistributionPoint Directory CRL 2. X.500 CRLDistributionPoint Directory Referal/Chainig
82 3. / 4. Directory LDAP / LDAP Directory LDAP LDAP HTTP LDAP HTTP CRLDistributionPoint HTTP CRL HTTP HTTP CRL EE CRLDistributionPoint Complete CRL EE CRL CA CA CRLDistributionPoint Complete CRL CA ARL OCSP OCSP RFC2560 / OCSP 1. OCSP 2. PKIX AuthorityInfoAccessAIA OCSP / / OCSP OCSP OCSP AuthorityInfoAccess
83 OCSP CRL OCSP CRL / OCSP CRL / 6-14 A B N ACRL BCRL CCRL CRL CRL CRL OCSP OCSP OCSP OCSP PKI CRL OCSP OCSP OCSP 1. OCSP CRL 2. OCSP AuthorityInfoAccessAIA IETF PKIX OCSP
84 OCSP OCSP CRL/OCSP CRL CRL CRL 5 EE CRLDistributionPoint CRL 1. EE 2. CA 3. CRL EE EE CRL CA CRL CRL X.509 IssuingDistributionPointIDP CRL CRL ARLAutority Revocation List
85 ARL onlycontainscacerts TRUE IDP CRL ARL EE CRL onlycontainsusercerts TRUE IDP CRL EE/CA CRL Complete CRL IDP RFC Critical CRL IDP CRL IDP RFC Critical IDP IDP CRL CRL CRL PKI IDP Critical IDP CRL PKI Although CRL ( ) RFC2459
86 CRL CRL Complete CRL CRL KeyIdentifier OCSP OCSPv1 / / CRL P OCSP CRL OCSP OCSPv1 OCSP CA CA PKIX-CMPRFC2510 CA CRL
87 2001/01/ /12/ /01/ /12/31 JNSA 2010/01/ /12/31 JNSA 2010/01/ /12/31 NewWith 2005/01/ /12/31 NewWith 2005/01/ /12/31 ithnew 2001/01/ /12/31 ithnew 2001/01/ /12/31 JNSA JNSA JNSA Old JNSA Old JNSAOldW JNSAOldW PKI SSL/TLS S/MIME IPsec 6-1 Subject SubjectAltName PKI Subject CN FQDN SubjectAltName DNSName SSL/TLS SubjectAltName IPAddress Subject S/MIME SubjectAltName RFC822Name SubjectAltName RFC822Name SubjectAltName DNSName IPsec(IKE) SubjectAltName IPAddress SSL/TLS SSL/TLS CN/SubjectAltName DNSName/SubjectAltName IPAddress IP VeriSign SSL/TLS Subject CN FQDN SSL/TLS Web SubjectAltName DNSName/IPAddress FQDN IP
88 S/MIME 3 SubjectAltName RFC822Name RFC S/MIME Subject S/MIME Web SSL/TLS S/MIME SubjectAltName IPsecIKE Pre-Shared Key PKI PKI IPsecIKE PKI PKI IPsecIKE/PKI IPsec PKI IPsecIKE SSL/TLSS/MIME IPsec IPsecIKE VPN / PKI Internet-Draft A PKIX Profile for IKE PKIX draft-ietf-ipsec-pki-req-05.txt PKI PDA GPKI IETF PKIX-WG DPDDelegated Path Discovery DPV Delegated Path Veification 2 Internet-Draft
89 ID
90 PKI SSL/TLSS/MIMEIPsec S/MIME CA S/MIME IPsec Web Web CA S/MIME CA S/MIME CA CRL
91 AliceCA CA CA CA RA BobCA CA CA CA BobEE BobCA RA Carol AliceCA CA BobCA CA CA BobCA AliceCA CA CA
92 AliceCA CA CA
93 AliceCA CA CA
94 CA CA CA CA EE PKI 1. CA CA 2. CA CA authoritykeyidentifier subjectkeyidentifier keyusage subjectaltname basicconstraints CA CA CA CA CA CA CA PKCS#10 CA X.509 1) CA CA 2) CA CA 3) CA CA CA 4) CA CA CA 5) CA S/MIME S/MIME SSL
95 SSL SSL IPsec IPsec 6) CRL/ARL CA CRL 7) CRL/ARL CA CA CA S/MIME CA SSL CA S/MIME CA CRL S/MIME CA / 1) CA / S/MIME 2) 3) CA CRL 4) CA CRL 5) 6) CA CA CA ARL 7)
96 IPsec IPsecWG CA IPsecWG IPsecCA CA IPsecCA IPsec IPsec IKE 1) CA IPsecCA CA 2) IPsecCA IPsec 3) CA / IPsec IPsec 4) CA CRL 5) IPsec IPsecPC ping 6) IPsec IKE
97 Web Web SSL Web CA SSL 7-6 Web 1) CA Web 2) Web Web SSL 3) CA CRL 4) Web Web SSL
98 Web Web SSL Web CA SSL 1) CA / Web 2) Web Web SSL 3) CA CA CA ARL 4) Web Web SSL
99 CA CA 1. CA 2. PKI CA CA authoritykeyidentifier subjectkeyidentifier critical keyusage certificatepolicies subjectaltname basicconstraints CA critical issuingdistributionpoint CA CA 2 CA 1) CA CA 2) CA CA 3) CA CA 4) CA 5) CA CA 6) CA
100 7) CA S/MIME S/MIME 8) CRL/ARL CA CA S/MIME CA CRL CA ARL 9) CRL/ARL CA CA CA CA S/MIME CA CRL CA ARL S/MIME CA CA 1) CA / S/MIME 2) 3) CA CRL 4) / 5) / 6) CA CA ARL
101 7) 8)
102 GPKI 1. GPKI CA CA 2. GPKI GPKI non-critical authoritykeyidentifier subjectkeyidentifier critical keyusage certificatepolicies policymappings subjectaltname basicconstraints CA critical issuingdistributionpoint CA CA CA GPKI 1) CA CA CA 2) CA CA 3) CA CA 4) CA CA 5) CA
103 6) CA CA 7) CA CA 8) CA 9) CA CA S/MIME S/MIME 10) CRL/ARL CA CA CRL CA ARL 11) CRL/ARL CA CA CA CA S/MIME CA CRL CA ARL 12) CRL/ARL CA CA CA CA S/MIME CA CRL CA ARL S/MIME CA CA CA
104 1) CA / S/MIME 2) 3) CA CRL 4) / 5) CA CA CA ARL 6)
105 ITU/X.509 PKIX/RFC2459 X.509 DER 6.1 Digital signatures ( ) In the case where a signature is appended to a data type, the following ASN.1 may be used to define the data type resulting from applying a signature to the given data type. SIGNED { ToBeSigned } ::= SEQUENCE { tobesigned ToBeSigned, COMPONENTS OF SIGNATURE { ToBeSigned }} In order to enable the validation of SIGNED and SIGNATURE types in a distributed environment, a distinguished encoding is required. A distinguished encoding of a SIGNED or SIGNATURE data value shall be obtained by applying the Basic Encoding Rules defined in ITU-T Rec. X.690 (1997) ISO/IEC 8825:1998, with the following restrictions: a) the definite form of length encoding shall be used, encoded in the minimum number of octets; b) for string types, the constructed form of encoding shall not be used; c) if the value of a type is its default value, it shall be absent; d) the components of a Set type shall be encoded in ascending order of their tag value; e) the components of a Set-of type shall be encoded in ascending order of their octet value; f) if the value of a Boolean type is true, the encoding shall have its contents octet set to "FF"16; g) each unused bit in the final octet of the encoding of a Bit String value, if there are any, shall be set to zero; h) the encoding of a Real type shall be such that bases 8, 10, and 16 shall not be used, and the binary scaling factor shall be zero. i) the encoding of a UTC time shall be as specified in ITU-T Rec. X.690 (1997) ISO/IEC :1998; j) the encoding of a Generalized time shall be as specified in ITU-T Rec. X.690 (1997) ISO/IEC :1998. ( ) 7 Public-keys and public-key certificates ( ) Certificate ::= SIGNED { SEQUENCE { version [0] Version DEFAULT v1, serialnumber CertificateSerialNumber,
106 v2 or v3 v2 or v3 v3 -- } } signature AlgorithmIdentifier, issuer Name, validity Validity, subject Name, subjectpublickeyinfo SubjectPublicKeyInfo, issueruniqueidentifier [1] IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall be subjectuniqueidentifier [2] IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall be extensions [3] Extensions OPTIONAL -- If present, version shall be RFC2459 X.509 DER CA BER keyusage DER a)c)g) ASN.1 bitbit STRING 0 BER DER BER keyusage bit BOOLEAN keyidentifier DN BER DNissuersubject DirectoryString X.520
107 5 Definition of selected attribute types This Directory Specification defines a number of attribute types which may be found useful across a range of applications of the Directory. Many of the attributes defined in this Specification are based on a common ASN.1 syntax: DirectoryString { INTEGER : maxsize } ::= CHOICE { teletexstring TeletexString (SIZE (1..maxSize)), printablestring PrintableString (SIZE (1..maxSize)), universalstring UniversalString (SIZE (1..maxSize)) } Some implementations of the Directory do not support the last of these choices, and will not be able to generate, match, or display attributes having such a syntax. RFC Issuer DirectoryString ::= CHOICE { teletexstring TeletexString (SIZE (1..MAX)), printablestring PrintableString (SIZE (1..MAX)), universalstring UniversalString (SIZE (1..MAX)), utf8string UTF8String (SIZE (1.. MAX)), bmpstring BMPString (SIZE (1..MAX)) } The Name describes a hierarchical name composed of attributes, such as country name, and corresponding values, such as US. The type of the component AttributeValue is determined by the AttributeType; in general it will be a DirectoryString. Name X Name The Name attribute type is the attribute supertype from which string attribute types typically used for naming may be formed. name ATTRIBUTE ::= { WITH SYNTAX DirectoryString { ub-name } EQUALITY MATCHING RULE caseignorematch SUBSTRINGS MATCHING RULE caseignoresubstringsmatch ID id-at-name } X String matching rules In the matching rules specified in through , the following spaces are regarded as not significant: leading spaces (i.e., those preceding the first printing character); trailing spaces (i.e., those following the last printing character); multiple consecutive internal spaces (these are taken as equivalent to a single space character). In the matching rules to which these apply, the strings to be matched shall be matched as if
108 the insignificant spaces were not present in either string Case Ignore Match The Case Ignore Match rule compares for equality a presented string with an attribute value of type DirectoryString, without regard to the case (upper or lower) of the strings (e.g., Dundee and DUNDEE match). caseignorematch MATCHING-RULE ::= { SYNTAX DirectoryString {ub-match} ID id-mr-caseignorematch } The rule returns TRUE if the strings are the same length and corresponding characters are identical except possibly with regard to case. Where the strings being matched are of different ASN.1 syntax, the comparison proceeds as normal so long as the corresponding characters are in both character sets. Otherwise matching fails. RFC Converting an AttributeValue from ASN.1 to a String If the AttributeValue is of a type which does not have a string representation defined for it, then it is simply encoded as an octothorpe character ('#' ASCII 35) followed by the hexadecimal representation of each of the bytes of the BER encoding of the X.500 AttributeValue. This form SHOULD be used if the AttributeType is of the dotted-decimal form. Otherwise, if the AttributeValue is of a type which has a string representation, the value is converted first to a UTF-8 string according to its syntax specification (see for example section 6 of [4]). If the UTF-8 string does not have any of the following characters which need escaping, then that string can be used as the string representation of the value. o o a space or "#" character occurring at the beginning of the string a space character occurring at the end of the string o one of the characters ",", "+", """, " ", "<", ">" or ";" Implementations MAY escape other characters. If a character to be escaped is one of the list shown above, then it is prefixed by a backslash (' ' ASCII 92). Otherwise the character to be escaped is replaced by a backslash and two hex digits, which form a single byte in the code of the character. Examples of the escaping mechanism are shown in section 5.
109 UTF8String PrintableString UTF8String subject UTF8String UTF8String <-> PrintableString UTF8String LDAPbisWG draft-ietf-ldapbis-dn-06.txt / CA subject EE issuer CA EE case-sensitive CA case-insensitive CA issuer subject subject CA DN UTF8String PrintableString subject CSR CA UTF8String PrintableString subject CA CSR CA issuer CA issuer UTF8String issuer PrintableString CA DN DN CA
110 X.501 DirectoryString 9.2 Names in General ( ) Each initial subsequence of the name of an object is also the name of an object. The sequence of objects so identified, starting with the root and ending with the object being named, is such that each is the immediate superior of that which follows it in the sequence. RFC2253 DirectoryString 2.1. Converting the RDNSequence If the RDNSequence is an empty sequence, the result is the empty or zero length string. Otherwise, the output consists of the string encodings of each RelativeDistinguishedName in the RDNSequence (according to 2.2), starting with the last element of the sequence and moving backwards toward the first. The encodings of adjoining RelativeDistinguishedNames are separated by a comma character (',' ASCII 44). SEQUENCE RFC Formal definition The name is presented/input in a little-endian order (most significant component last). When an address is written in a context where there is a need to delimit the entire address (e.g., in free text), it is recommended that the delimiters <> are used. The terminator > is a special in the notation to facilitate this delimitation. DirectoryString ASN.1 SEQUENCE CA CA PKCS#10 PKCS#10 subject SEQUENCE CA
111 DN DirectoryString issuer subject
112 X.501 RFC1779RFC2253 ou=alice, ou=challengepki2001, o=jnsa, c=jp 1 DirectoryString PKI X.500 LDAP X.509 X.500 X.500 subject DirectoryString subject PKCS#10 subject subject subject CA CA DirectoryString subject X.500 X.509 X.509 RFC2459 serialnumber INTEGER INTEGER ASN.1 X.680 ASN.1
113 integer type: A simple type with distinguished values which are the positive and negative whole numbers, including zero (as a single value). NOTE Particular encoding rules limit the range of an integer, but such limitations are chosen so as not to affect any user of ASN.1. CA 32bit serialnumber serialnumber crlscope serialnumberrange serialnumber BufferOverflow X.509 basicconstraints CA Basic constraints extension This field indicates if the subject may act as a CA, with the certified public key being used to verify certificate signatures. If so, a certification path length constraint may also be specified. () RFC2459 CA EE basicconstraints Basic Constraints The basic constraints extension identifies whether the subject of the certificate is a CA and how deep a certification path may exist through that CA. ( ) This extension MUST appear as a critical extension in all CA certificates. This extension SHOULD NOT appear in end entity certificates. ()
114 CA EE basicconstraints CA EE basicconstraints.ca=false X.509 RFC2459 CA basicconstraints CA EE CA RFC2459 EE false-positive X.509 ca TRUE 0 EE Basic constraints extension The pathlenconstraint component shall be present only if ca is set to true. It gives the maximum number of CA-certificates that may follow this certificate in a certification path. Value 0 indicates that the subject of this certificate may issue certificates only to end-entities and not to further CAs. If no pathlenconstraint field appears in any certificate of a certification path, there is no limit to the allowed length of the certification path. ( ) pathlenconstraint 0 EE MAY pathlenconstraint pathlenconstraint CA=TRUE X.509 RFC2459 CA pathlenconstraint basicconstraints pathlenconstraint pathlenconstraint
115 CA CA X.509 keyusage digitalsignature digitalsignature SSL/TLS keyusage keyencipherment Key usage extension ( ) Bits in the KeyUsage type are as follows: a) digitalsignature: for verifying digital signatures that have purposes other than those identified in b), f), or g) below; b) nonrepudiation: for verifying digital signatures used in providing a non-repudiation service which protects against the signing entity falsely denying some action (excluding certificate or CRL signing, as in f) or g) below); c) keyencipherment: for enciphering keys or other security information, e.g. for key transport; d) dataencipherment: for enciphering user data, but not keys or other security information as in c) above; e) keyagreement: for use as a public key agreement key; f) keycertsign: for verifying a CA's signature on certificates; g) crlsign: for verifying an authority's signature on CRLs. h) encipheronly: public key agreement key for use only in enciphering data when used with keyagreement bit also set (meaning with other key usage bit set is undefined); i) decipheronly: public key agreement key for use only in deciphering data when used with keyagreement bit also set (meaning with other key usage bit set is undefined); () RFC2459 critical critical-flag RFC2459 critical CA keyusage non-critical
116 critical-flag critical-flag critical CA CA CA certificatepolicies policymappings policyconstraints CA critical-flag non-critical CA CA CRL/ARL authoritykeyidentifier issuingdistributionpoint CRL/ARL CRL/ARL CA CA crlnumber AuthorityKeyIdentifier issuingdistributionpoints
117 X.509 keyidentifier a) CRL issuer issuer b) keyidentifier Authority key identifier extension ( ) The key may be identified by an explicit key identifier in the keyidentifier component, by identification of a certificate for the key (giving certificate issuer in the authoritycertissuer component and certificate serial number in the authoritycertserialnumber component), or by both explicit key identifier and identification of a certificate for the key. If both forms of identification are used then the certificate or CRL issuer shall ensure they are consistent. A key identifier shall be unique with respect to all key identifiers for the issuing authority for the certificate or CRL containing the extension. An implementation which supports this extension is not required to be able to process all name forms in the authoritycertissuer component. (See for details of the GeneralNames type.) Certification authorities shall assign certificate serial numbers such that every (issuer, certificate serial number) pair uniquely identifies a single certificate. The keyidentifier form can be used to select CA certificates during path construction. The authoritycertissuer, authorityserialnumber pair can only be used to provide preference to one certificate over others during path construction. ( ) RFC2459 Recommendations keyidentifier 160bitSHA-1 60bit SHA Subject Key Identifier ( ) For CA certificates, subject key identifiers SHOULD be derived from the public key or a method that generates unique values. Two common methods for generating key identifiers from the public key are: (1) The keyidentifier is composed of the 160-bit SHA-1 hash of the value of the BIT STRING subjectpublickey (excluding the tag, length, and number of unused bits). (2) The keyidentifier is composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-1 hash of the value of the BIT STRING subjectpublickey. ( )
118 keyidentifier RFC2459 (1) 160bit SHA-1 keyidentifier CA keyidentifier keyidentifier X.509 critical 7 Public-keys and public-key certificates ( ) Some extensions can only be marked critical. In these cases a validation engine that understands the extension, processes it and acceptance/rejection of the certificate is dependent (at least in part) on the content of the extension. A validation engine that does not understand the extension rejects the certificate. Some extensions can only be marked non-critical. In these cases a validation engine that understands the extension processes it and acceptance/rejection of the certificate is dependent (at least in part) on the content of the extension. A validation engine that does not understand the extension accepts the certificate (unless factors other than this extension cause it to be rejected). Some extensions can be marked critical or non-critical. In these cases a validation engine that understands the extension processes it and acceptance/rejection of the certificate is dependent (at least in part) on the content of the extension, regardless of the criticality flag. A validation engine that does not understand the extension accepts the certificate if the extension is marked non-critical (unless factors other than this extension cause it to be rejected) and rejects the certificate if the extension is marked critical. ( ) RFC2459
119 4.2 Standard Certificate Extensions The extensions defined for X.509 v3 certificates provide methods for associating additional attributes with users or public keys and for managing the certification hierarchy. The X.509 v3 certificate format also allows communities to define private extensions to carry information unique to those communities. Each extension in a certificate may be designated as critical or non-critical. A certificate using system MUST reject the certificate if it encounters a critical extension it does not recognize; however, a non-critical extension may be ignored if it is not recognized. The following sections present recommended extensions used within Internet certificates and standard locations for information. Communities may elect to use additional extensions; however, caution should be exercised in adopting any critical extensions in certificates which might prevent use in a general context. ( ) Conforming CAs MUST support key identifiers (see sec and ), basic constraints (see sec ), key usage (see sec ), and certificate policies (see sec ) extensions. If the CA issues certificates with an empty sequence for the subject field, the CA MUST support the subject alternative name extension (see sec ). Support for the remaining extensions is OPTIONAL. Conforming CAs may support extensions that are not identified within this specification; certificate issuers are cautioned that marking such extensions as critical may inhibit interoperability. At a minimum, applications conforming to this profile MUST recognize the extensions which must or may be critical in this specification. These extensions are: key usage (see sec ), certificate policies (see sec ), the subject alternative name (see sec ), basic constraints (see sec ), name constraints (see sec ), policy constraints (see sec ), and extended key usage (see sec ). In addition, this profile RECOMMENDS application support for the authority and subject key identifier (see sec and ) extensions. keyusage basicconstraints non-critical RFC2459 keyusage RFC2459 keyusage keyusage critical
120 RFC2459 non-critical keyusage keyusage digitalsignature SSL keyusage critical keyusage SSL critical OCSP CRL CRL/ARL X.509 CRL X CRL distribution points extension ( ) This field identifies the CRL distribution point or points to which a certificate user should refer to ascertain if the certificate has been revoked. A certificate user can obtain a CRL from an applicable distribution point or it may be able to obtain a current complete CRL from the authority directory entry. The distributionpoint component identifies the location from which the CRL can be obtained. If this component is absent, the distribution point name defaults to the CRL issuer name Issuing distribution point extension This CRL extension field identifies the CRL distribution point for this particular CRL, and indicates if the CRL is limited to revocations for end-entity certificates only, for authority certificates only, or for a limited set of reasons only. The CRL is signed by the CRL issuer's key - CRL distribution points do not have their own key pairs. However, for a CRL distributed via the Directory, the CRL is stored in the entry of the CRL distribution point, which may not be the directory entry of the CRL issuer. If this field is absent, the CRL shall contain entries for all revoked unexpired certificates issued by the CRL issuer.
121 Annex B CRL Generation and Processing Rules ( ) B.3.2 End-entity with no critical CRL DP If the certificate is an end-entity certificate and the crldistributionpoints extension is absent from the certificate or present and not flagged critical, revocation status for the reason codes of interest may be satisfied by any combination of the following CRLs: Distribution point CRLs (if present); Complete CRLs; Complete EPRLs. () B.3.4 CA with no critical CRL DP If the certificate is a CA certificate and the crldistributionpoints extension is absent from the certificate or present and not flagged critical, revocation status for the reason codes of interest may be satisfied by any combination of the following CRLs: Distribution point CRLs/CARLs (if present); Complete CRLs; Complete CARLs. If the freshest CRL extension is also present in the certificate and if flagged critical, one or more CRLs/CARLs shall also be obtained from one or more of the nominated distribution points in that extension, ensuring that freshest revocation information for all reason codes of interest is checked. a) crldistributionpoint a-1) distributionpoint.fullname directoryname IP directoryname certificaterevocationlist authorityrevocationlist a-2) distributionpoint.fullname URI URI URI HTTP LDAP b) crldistributionpoint issuer a-1) issuer certificaterevocationlist authorityrevocationlist a) b) certificaterevocationlist authorityrevocationlist ca issuingdistributionpoint
122 CRL URI CRLDP URI LDAPHTTP CRL CRLDP CRLDP CRL CRLDP CRL out-of-bounds CRL crldistributionpoints nextupdate X.509 RFC2459 B.1.2 CRL processing ( ) If a relying party is using CRLs as the mechanism to determine if a certificate is revoked, they shall be sure to use the appropriate CRL(s) for that certificate. This annex describes a procedure for obtaining and processing appropriate CRLs by walking through a number of specific steps. An implementation shall be functionally equivalent to the external behaviour resulting from this procedure. The algorithm used by a particular implementation to derive the correct output (i.e. revocation status for a certificate) from the given inputs (the certificate itself and input from local policy) is not standardized. For example, although this procedure is described as a sequence of steps to be processed in order, an implementation may use CRLs which are in its local cache rather than retrieving CRLs each time it processes a certificate, providing those CRLs are complete for the scope of the certificate and do not violate any of the parameters of the certificate or policy. ( ) 3.1 X.509 Version 3 Certificate ( )
123 A certificate has a limited valid lifetime which is indicated in its signed contents. Because a certificate's signature and timeliness can be independently checked by a certificate-using client, certificates can be distributed via untrusted communications and server systems, and can be cached in unsecured storage in certificate-using systems. ( ) crldistributionpoints issuingdistributionpoint distributionpoint CRL nextupdate CRL CRL CRL static ARL CA CA CA CA CA nextupdate ARL CA X.509 B.5.3 Validity and currency checks on the base CRL In order to verify that a base CRL is accurate and has not been modified since its issuance, all
124 of the following conditions shall be satisfied: The relying party shall be able to obtain the public key of the issuer identified in the CRL using authenticated means; and The signature on the base CRL shall be verified using this authenticated public key; and If the nextupdate field is present, the current time should be prior to the nextupdate field; and The issuer name in the CRL shall match the issuer name in the certificate that is being checked for revocation, unless the CRL is retrieved from the CRL DP in the certificate and the CRL DP extension contains the CRL issuer component. In that case, one of the names in CRL issuer component in the CRL DP extension shall match issuer name in the CRL. ( ) RFC2459 critical issuingdistributionpoint RFC2459 draft-ietf-pkix-new-part1-12.txt Issuing Distribution Point The issuing distribution point is a critical CRL extension that identifies the CRL distribution point for a particular CRL, and it indicates whether the CRL covers revocation for end entity certificates only, CA certificates only, or a limitied set of reason codes. Although the extension is critical, conforming implementations are not required to support this extension. ( ) thisupdatenextupdate issuer critical issuingdistributionpoint X.509 RFC2459
/02/ /09/ /05/ /02/ CA /11/09 OCSP SubjectAltName /12/02 SECOM Passport for Web SR
for Web SR Certificate Policy Version 2.50 2017 5 23 1.00 2008/02/25 1.10 2008/09/19 1.20 2009/05/13 5 1.30 2012/02/15 5.6 CA 1.40 2012/11/09 OCSP SubjectAltName 2.00 2013/12/02 SECOM Passport for Web
/07/ /10/12 I
Certificate Policy Version 1.10 2018 10 12 1.00 2018/07/24 1.10 2018/10/12 I 1.... 1 1.1... 1 1.2... 1 1.3 PKI... 2 1.3.1 CA... 2 1.3.2 RA... 2 1.3.3... 2 1.3.3.1... 2 1.3.3.2... 3 1.3.4... 3 1.3.5...
はじめに
19 1.1 19 1.2 21 1.3 22 1.3.1 DES 24 1.4 25 1.4.1 DH 26 1.4.2 RSA 26 1.4.3 ElGamal 27 1.4.4 DSA 27 1.5 27 1.6 28 1.6.1 SHA-1 28 1.6.2 MD5 Message Digest 5 28 1.7 29 1.7.1 MIC 29 1.7.2 HMAC 29 1.7.3 30
1. はじめに ブリッジ CA (UTF8) 証明書プロファイル 相互認証証明書 ( ブリッジ CA (UTF8) 組織 CA ) 相互認証証明書 ( ブリッジ CA (UTF8) 政府認証基盤ブリッジ CA )..
C-6-4-4 LGPKI プロファイル設計書 第 1.8 版 平成 30 年 8 月 24 日 地方公共団体情報システム機構 1. はじめに... 1 2. ブリッジ CA (UTF8)... 1 2.1. 証明書プロファイル... 1 2.1.1. 相互認証証明書 ( ブリッジ CA (UTF8) 組織 CA )... 1 2.1.2. 相互認証証明書 ( ブリッジ CA (UTF8) 政府認証基盤ブリッジ
untitled
better RFID 1 /?? PKI PKI ) (GPKI) GtoB GPKI 3300- LGPKI GtoC -> Identrus B2B GPKI Identrus PKI 2 Internet-VPN PKI? HTTPS ( ) HTTPS 3 PKI??????? PDA/ /? RFIDPKI?? 4 Challenge
untitled
2004845 PKIUTF8String Part1: UTF8String UTF8String PKI UTF8String UTF8String 2 (1) ( ) A, ü, [ ] [ ] ASCII JIS X2013 Unicode(ISO 10646) ( )( ) Unicode A U+0041 U+007F 3 (2) u ü ( )( ) ( )(
wide95.dvi
10 261 1 1.1 ( ) WWW(World Wide Web) WWW SSL(Secure Socket Layer)[66] SHTTP(Secure Hypertext Transfer Protocol)[67] 1 1.2 RSA () ( 1 ( ) S-HTTP SSL 263 264 1995 WIDE ) (CA - Certication Authority) CA
PKIの標準化動向と リソースPKI
PKI Day 2009 2009 6 24 PKI PKI JPNIC RFC5280 PKI RFC5280 PKI RPKI IP RPKI RFC5280 RFC5280 RFC3280 PKI RFC5280 RFC5280 1/4 RFC5280 X.509-based PKI X.509CRL 2008 5published RFC5280 2/4 1988 1995 1997 1999
Juniper Networks Corporate PowerPoint Template
Juniper SRX 日本語マニュアル 41. SSL Forward Proxy の CLI 設定 はじめに SRX340 における SSL Forward Proxy の CLI 設定ついて説明します 手順内容は SRX340 JUNOS 15.1X49-D140 にて確認を実施しております SSL Proxy 機能については SRX340 以上の機種にてサポートされています 2018 年 8
Microsoft Word - PCM TL-Ed.4.4(特定電気用品適合性検査申込のご案内)
(2017.04 29 36 234 9 1 1. (1) 3 (2) 9 1 2 2. (1) 9 1 1 2 1 2 (2) 1 2 ( PSE-RE-101/205/306/405 2 PSE-RE-201 PSE-RE-301 PSE-RE-401 PSE-RE-302 PSE-RE-202 PSE-RE-303 PSE-RE-402 PSE-RE-203 PSE-RE-304 PSE-RE-403
untitled
PKI UTF8String Part1: UTF8String Microsoft MS Windows Windows 2000 Windows NT Windows XP Windows Internet Explorer Outlook Outlook Express Microsoft Corporation Sun Microsystems Sun Java Solaris Java JDK
JOURNAL OF THE JAPANESE ASSOCIATION FOR PETROLEUM TECHNOLOGY VOL. 66, NO. 6 (Nov., 2001) (Received August 10, 2001; accepted November 9, 2001) Alterna
JOURNAL OF THE JAPANESE ASSOCIATION FOR PETROLEUM TECHNOLOGY VOL. 66, NO. 6 (Nov., 2001) (Received August 10, 2001; accepted November 9, 2001) Alternative approach using the Monte Carlo simulation to evaluate
( )
NAIST-IS-MT0851100 2010 2 4 ( ) CR CR CR 1980 90 CR Kerberos SSH CR CR CR CR CR CR,,, ID, NAIST-IS- MT0851100, 2010 2 4. i On the Key Management Policy of Challenge Response Authentication Schemes Toshiya
untitled
Interfaculty Initiative in Information Studies, The University of Tokyo 2 Interfaculty Initiative in Information Studies, The University of Tokyo > > 517587 82 > > > > > 3 Interfaculty Initiative in Information
Vol. 45 No Web ) 3) ),5) 1 Fig. 1 The Official Gazette. WTO A
Vol. 45 No. 8 Aug. 2004, 1999 11 (1) (2) (3) 2003 7 Digital Evidence Enhancement for the Japanese Official Gazette Data Providing Services Atsuko Umezawa,, Hiroyuki Ueno, Yukio Miyata, Yasuharu Saikawa,
第3 章 電子認証技術に関する国際動向
3 IETF PKI TAM Trust Anchor Management 3. IETF Internet Engineering Task Force PKIX WG 3.1. IETF PKIX WG 1 2006 PKI Public-Key Infrastructure IETF PKIX WG 2007 69 IETF 70 IETF WG PKIX WG 2006 3 2 3.2.
PC_14ZY6_BFT150A_US_ indd
PARTS CATALOG BFT 0A OB NO.00-ZY- US Instruction for use of parts catalogue This parts catalogue was prepared based on the latest information available as of October,. See the Service Bulletin for any
untitled
PKI 1 / SSL/TLS PKI 28 Oct 2005 PKI /JNSA PKI Day 3 PKI? 2 RFC 2459/RFC 3280/RFC 3280bis CRL(RFC 2459/RFC 3280/RFC 3280bis) OCSP(RFC 2560/Light-weight OCSP) SCVP(SCVP) CMP(RFC 2510/RFC 4210) CRMF(RFC 2511/RFC
25 II :30 16:00 (1),. Do not open this problem booklet until the start of the examination is announced. (2) 3.. Answer the following 3 proble
25 II 25 2 6 13:30 16:00 (1),. Do not open this problem boolet until the start of the examination is announced. (2) 3.. Answer the following 3 problems. Use the designated answer sheet for each problem.
1. PKI (EDB/PKI) (Single Sign On; SSO) (PKI) ( ) Private PKI, Free Software ITRC 20th Meeting (Oct. 5, 2006) T. The University of Tokush
PKI LAN EDB/PKI and Campus Wireless LAN Authentication EDB/PKI http://web.db.tokushima-u.ac.jp/edb-manual/pki.html http://ldap.db.tokushima-u.ac.jp/wireless/ @. E-mail: alex@ee.tokushima-u.ac.jp Id: itrc20th-20061005.tex,v
How to read the marks and remarks used in this parts book. Section 1 : Explanation of Code Use In MRK Column OO : Interchangeable between the new part
Reservdelskatalog MIKASA MVB-85 rullvibrator EPOX Maskin AB Postadress Besöksadress Telefon Fax e-post Hemsida Version Box 6060 Landsvägen 1 08-754 71 60 08-754 81 00 info@epox.se www.epox.se 1,0 192 06
How to read the marks and remarks used in this parts book. Section 1 : Explanation of Code Use In MRK Column OO : Interchangeable between the new part
Reservdelskatalog MIKASA MT65H vibratorstamp EPOX Maskin AB Postadress Besöksadress Telefon Fax e-post Hemsida Version Box 6060 Landsvägen 1 08-754 71 60 08-754 81 00 info@epox.se www.epox.se 1,0 192 06
3. /dev/urandom 1024 ~CA0/private/cakey.pem $ openssl genrsa -rand /dev/urandom -out \ private/cakey.pem 1024 Generating RSA private key
PKI : OpenSSL CA NISOC @ 2007/01/06 1 CA:Certificate Authority OpenSSL CA CA0 CA0 2 CA CA1 CA2 3 CA CA1 CA2 PC CA CA 2 CA CA0 1. CA ~CA0 openssl.cnf [ CA default ] dir ~CA0 [ req distinguished name ] CSR
How to read the marks and remarks used in this parts book. Section 1 : Explanation of Code Use In MRK Column OO : Interchangeable between the new part
Reservdelskatalog MIKASA MVC-50 vibratorplatta EPOX Maskin AB Postadress Besöksadress Telefon Fax e-post Hemsida Version Box 6060 Landsvägen 1 08-754 71 60 08-754 81 00 info@epox.se www.epox.se 1,0 192
0 PARTS CATALOG BFT A BFT 0A OB NO.00-ZYET- US Instruction for use of parts catalogue This parts catalogue was prepared based on the latest information available as of October, 0. See the Service Bulletin
Introduction Purpose This training course describes the configuration and session features of the High-performance Embedded Workshop (HEW), a key tool
Introduction Purpose This training course describes the configuration and session features of the High-performance Embedded Workshop (HEW), a key tool for developing software for embedded systems that
How to read the marks and remarks used in this parts book. Section 1 : Explanation of Code Use In MRK Column OO : Interchangeable between the new part
Reservdelskatalog MIKASA MCD-L14 asfalt- och betongsåg EPOX Maskin AB Postadress Besöksadress Telefon Fax e-post Hemsida Version Box 6060 Landsvägen 1 08-754 71 60 08-754 81 00 info@epox.se www.epox.se
137. Tenancy specific information (a) Amount of deposit paid. (insert amount of deposit paid; in the case of a joint tenancy it should be the total am
13Fast Fair Secure PRESCRIBED INFORMATION RELATING TO TENANCY DEPOSITS* The Letting Protection Service Northern Ireland NOTE: The landlord must supply the tenant with the Prescribed Information regarding
21 Key Exchange method for portable terminal with direct input by user
21 Key Exchange method for portable terminal with direct input by user 1110251 2011 3 17 Diffie-Hellman,..,,,,.,, 2.,.,..,,.,, Diffie-Hellman, i Abstract Key Exchange method for portable terminal with
XMLを基盤とするビジネスプロトコルの動向
XML Trends of XML-Based Business Protocols ebxml Web XML ebxml UN/CEFACT EDIFACTOASIS XML Web W3C World Wide Web Consortium Abstract XML-based technologies such as the Electronic Business XML Initiative
fx-9860G Manager PLUS_J
fx-9860g J fx-9860g Manager PLUS http://edu.casio.jp k 1 k III 2 3 1. 2. 4 3. 4. 5 1. 2. 3. 4. 5. 1. 6 7 k 8 k 9 k 10 k 11 k k k 12 k k k 1 2 3 4 5 6 1 2 3 4 5 6 13 k 1 2 3 1 2 3 1 2 3 1 2 3 14 k a j.+-(),m1
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using con
![Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using con](/thumbs/80/81469833.jpg "Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using con")
IIS で SSL(https) を設定する方法 Copyright (C) 2008 NonSoft. All Rights Reserved. IIS でセキュアサーバを構築する方法として OpenSSL を使用した方法を実際の手順に沿って記述します 1. はじめに IIS で SSL(https) を設定する方法を以下の手順で記述します (1) 必要ソフトのダウンロード / インストールする
BS・110度CSデジタルハイビジョンチューナー P-TU1000JS取扱説明書
C S0 CS Digital Hi-Vision Tuner C C C C S0-0A TQZW99 0 C C C C 4 5 6 7 8 9 C C C C C C C C C C C C C C C C C C C C C C C 0 FGIH C 0 FGIH C C C FGIH FG IH FGIH I H FGIH FGIH 0 C C # $ IH F G 0 # $ # $
ScanFront300/300P セットアップガイド
libtiff Copyright (c) 1988-1996 Sam Leffler Copyright (c) 1991-1996 Silicon Graphics, Inc. Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby
Page 1 of 6 B (The World of Mathematics) November 20, 2006 Final Exam 2006 Division: ID#: Name: 1. p, q, r (Let p, q, r are propositions. ) (10pts) (a
Page 1 of 6 B (The World of Mathematics) November 0, 006 Final Exam 006 Division: ID#: Name: 1. p, q, r (Let p, q, r are propositions. ) (a) (Decide whether the following holds by completing the truth
wide97.dvi
11 321 1 CA (Certication Authority) ( ) 1 3 CA S/MIME[104][105][106] SSL[107](Secure Sockets Layer), TLS[108](Transport Layer Security) WWW Netscape Microsoft Web SSL CA CA CA CA CA CA CA members only
電子メールのセキュリティ
S/MIME 1...1 1.1... 1 1.2... 2 1.3... 2 2...3 2.1... 3 2.2... 4 2.3... 4 3...5 3.1... 5 3.2... 6 3.3... 8 3.4... 10 4...12 4.1 PGP... 12 4.2 (CA)... 13 5 CRL...15 5.1 ( ID )... 15 5.2 CRL(Certificate Revocation
eTA案内_ 完成TZ
T T eta e A Information provided to CIC is collected under the authority of the Immigration and Refugee Protection Act (IRPA) to determine admissibility to Canada. Information provided may be shared
LC304_manual.ai
Stick Type Electronic Calculator English INDEX Stick Type Electronic Calculator Instruction manual INDEX Disposal of Old Electrical & Electronic Equipment (Applicable in the European Union
How to read the marks and remarks used in this parts book. Section 1 : Explanation of Code Use In MRK Column OO : Interchangeable between the new part
Reservdelskatalog MIKASA MVC-88 vibratorplatta EPOX Maskin AB Postadress Besöksadress Telefon Fax e-post Hemsida Version Box 6060 Landsvägen 1 08-754 71 60 08-754 81 00 info@epox.se www.epox.se 1,0 192
YMS-VPN1_User_Manual
YAMAHA VPN YMS-VPN1 2007 12 YAMAHA VPN YMS-VPN1 YMS-VPN1 RT Windows PC IPsec VPN 2000-2002 SSH Communications Security Corp 2004-2007 SafeNet Inc. 2004-2007 dit Co., Ltd. 2006-2007 YAMAHA CORPORATION MicrosoftWindows
AtCoder Regular Contest 073 Editorial Kohei Morita(yosupo) A: Shiritori if python3 a, b, c = input().split() if a[len(a)-1] == b[0] and b[len(
![AtCoder Regular Contest 073 Editorial Kohei Morita(yosupo) A: Shiritori if python3 a, b, c = input().split() if a[len(a)-1] == b[0] and b[len(](/thumbs/104/161880166.jpg "AtCoder Regular Contest 073 Editorial Kohei Morita(yosupo) A: Shiritori if python3 a, b, c = input().split() if a[len(a)-1] == b[0] and b[len(")
AtCoder Regular Contest 073 Editorial Kohei Morita(yosupo) 29 4 29 A: Shiritori if python3 a, b, c = input().split() if a[len(a)-1] == b[0] and b[len(b)-1] == c[0]: print( YES ) else: print( NO ) 1 B:
ScanFront 220/220P 取扱説明書
libtiff Copyright (c) 1988-1996 Sam Leffler Copyright (c) 1991-1996 Silicon Graphics, Inc. Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby
ScanFront 220/220P セットアップガイド
libtiff Copyright (c) 1988-1996 Sam Leffler Copyright (c) 1991-1996 Silicon Graphics, Inc. Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby
MIDI_IO.book
MIDI I/O t Copyright This guide is copyrighted 2002 by Digidesign, a division of Avid Technology, Inc. (hereafter Digidesign ), with all rights reserved. Under copyright laws, this guide may not be duplicated
SFC
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Base Header Service Path Header ~ Context Headers ~ Figure 1: Network Service Header 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
Title 社 会 化 教 育 における 公 民 的 資 質 : 法 教 育 における 憲 法 的 価 値 原 理 ( fulltext ) Author(s) 中 平, 一 義 Citation 学 校 教 育 学 研 究 論 集 (21): 113-126 Issue Date 2010-03 URL http://hdl.handle.net/2309/107543 Publisher 東 京
,, 2024 2024 Web ,, ID ID. ID. ID. ID. must ID. ID. . ... BETWEENNo., - ESPNo. Works Impact of the Recruitment System of New Graduates as Temporary Staff on Transition from College to Work Naoyuki
7,, i
23 Research of the authentication method on the two dimensional code 1145111 2012 2 13 7,, i Abstract Research of the authentication method on the two dimensional code Karita Koichiro Recently, the two
インターネット接続ガイド v110
1 2 1 2 3 3 4 5 6 4 7 8 5 1 2 3 6 4 5 6 7 7 8 8 9 9 10 11 12 10 13 14 11 1 2 12 3 4 13 5 6 7 8 14 1 2 3 4 < > 15 5 6 16 7 8 9 10 17 18 1 2 3 19 1 2 3 4 20 U.R.G., Pro Audio & Digital Musical Instrument
Microsoft Word - Win-Outlook.docx
Microsoft Office Outlook での設定方法 (IMAP および POP 編 ) How to set up with Microsoft Office Outlook (IMAP and POP) 0. 事前に https://office365.iii.kyushu-u.ac.jp/login からサインインし 以下の手順で自分の基本アドレスをメモしておいてください Sign
エレクトーンのお客様向けiPhone/iPad接続マニュアル
/ JA 1 2 3 4 USB TO DEVICE USB TO DEVICE USB TO DEVICE 5 USB TO HOST USB TO HOST USB TO HOST i-ux1 6 7 i-ux1 USB TO HOST i-mx1 OUT IN IN OUT OUT IN OUT IN i-mx1 OUT IN IN OUT OUT IN OUT IN USB TO DEVICE
17 Multiple video streams control for the synchronous delivery and playback 1085404 2006 3 10 Web IP 1 1 1 3,,, i Abstract Multiple video streams control for the synchronous delivery and playback Yoshiyuki
REDCap_EULA_FAQ
米国ヴァンダービルト大学との End User License Agreementと 大阪市立大学における REDCap 外部提供 (SaaS) 契約について 2017 年 6 月 1 日 Japan REDCap Consortium 注意事項 この資料の著作権は 大阪市立大学 REDCap グループに帰属します 私的使用を除き 本資料の全部又は一部を承諾なしに公表又は第三者に伝達する事はできません
untitled
PKI UTF8String Part4: IETF MicrosoftMSWindowsWindows 2000Windows NTWindows XPWindows Internet ExplorerOutlookOutlook Express Microsoft Corporation Sun MicrosystemsSun Java Solaris JavaJDK Sun Microsystems
医用画像システム部会 ISO委員会報告
ISO ISO ISO ISO ISO ISO Web Access to DICOM Persistent Objects Purpose and Justification ISO DICOM standard is well accepted in the medical imaging area, including radiology, cardiology, pathology, radiotherapy
Huawei G6-L22 QSG-V100R001_02
G6 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3 17 4 5 18 UI 100% 8:08 19 100% 8:08 20 100% 8:08 21 100% 8:08 22 100% 8:08 ********** 23 100% 8:08 Happy birthday! 24 S S 25 100% 8:08 26 http://consumer.huawei.com/jp/
- 1 -
- 1 - - 2 - - 3 - - 4 - - 5 - - 6 - - 7 - - 8 - - 9 - - 10 - - 11 - - 12 - - 13 - - 14 - - 15 - 1 2 1-16 - 2 3 4 5 6 7-17 - 1 2 1 2 3 4-18 - 1 2 3 4 1 2-19 - 1 2 3 1 2-20 - 3 4 5 6 7 1-21 - 1 2 3 4-22
Virtual Window System Virtual Window System Virtual Window System Virtual Window System Virtual Window System Virtual Window System Social Networking
23 An attribute expression of the virtual window system communicators 1120265 2012 3 1 Virtual Window System Virtual Window System Virtual Window System Virtual Window System Virtual Window System Virtual
Bull. of Nippon Sport Sci. Univ. 47 (1) Devising musical expression in teaching methods for elementary music An attempt at shared teaching
Bull. of Nippon Sport Sci. Univ. 47 (1) 45 70 2017 Devising musical expression in teaching methods for elementary music An attempt at shared teaching materials for singing and arrangements for piano accompaniment
alternating current component and two transient components. Both transient components are direct currents at starting of the motor and are sinusoidal
Inrush Current of Induction Motor on Applying Electric Power by Takao Itoi Abstract The transient currents flow into the windings of the induction motors when electric sources are suddenly applied to the
Cisco® ASA シリーズルーター向けDigiCert® 統合ガイド
Cisco ASA DigiCert 2013 7 8 Cisco ASA VPN DigiCert : 2013 7 8 Copyright 2018 DigiCert, Inc. All rights reserved. DigiCert DigiCert DigiCert, Inc. Symantec Norton Symantec Corporation DigiCert, Inc. DigiCert,
Tab 5, 11 Tab 4, 10, Tab 3, 9, 15Tab 2, 8, 14 Tab 1, 7, 13 2
COMPANION 20 MULTIMEDIA SPEAKER SYSTEM Owner s Guide Tab 5, 11 Tab 4, 10, Tab 3, 9, 15Tab 2, 8, 14 Tab 1, 7, 13 2 Tab1, 7, 13 Tab 2, 8, 14 Tab 3, 9, 15 Tab 4, 10, Tab 5, 11 This product conforms to all
変更履歴 版数日付内容承認者名改訂区分 1.0 平成 26 年 3 月 31 日新規作成新規 1.1 平成 27 年 11 月 30 日設定値の確定に伴う修正及び誤記 訂正 1.2 平成 27 年 12 月 25 日 2 章 署名用電子証明書の プロファイル基本領域 (Basic)
公的個人認証サービス プロファイル仕様書 1.2 版 平成 27 年 12 月 25 日 変更履歴 版数日付内容承認者名改訂区分 1.0 平成 26 年 3 月 31 日新規作成新規 1.1 平成 27 年 11 月 30 日設定値の確定に伴う修正及び誤記 訂正 1.2 平成 27 年 12 月 25 日 2 章 2.2.1. 1 署名用電子証明書の プロファイル基本領域 (Basic) 及 び 2.2.2
1 # include < stdio.h> 2 # include < string.h> 3 4 int main (){ 5 char str [222]; 6 scanf ("%s", str ); 7 int n= strlen ( str ); 8 for ( int i=n -2; i
![1 # include < stdio.h> 2 # include < string.h> 3 4 int main (){ 5 char str [222]; 6 scanf (%s, str ); 7 int n= strlen ( str ); 8 for ( int i=n -2; i](/thumbs/89/99201513.jpg "1 # include < stdio.h> 2 # include < string.h> 3 4 int main (){ 5 char str [222]; 6 scanf (%s, str ); 7 int n= strlen ( str ); 8 for ( int i=n -2; i")
ABC066 / ARC077 writer: nuip 2017 7 1 For International Readers: English editorial starts from page 8. A : ringring a + b b + c a + c a, b, c a + b + c 1 # include < stdio.h> 2 3 int main (){ 4 int a,
Technische Beschreibung P82R SMD
P26 halstrup-walcher GmbH http://www.krone.co.jp/ Stegener Straße 10 D-79199 Kirchzarten, Germany 124-0023 2-22-1 TEL:03-3695-5431 FAX:03-3695-5698 E-MAIL:sales-tokyo@krone.co.jp 530-0054 2-2-9F TEL:06-6361-4831
TH-47LFX60 / TH-47LFX6N
TH-47LFX60J TH-47LFX6NJ 1 2 3 4 - + - + DVI-D IN PC IN SERIAL IN AUDIO IN (DVI-D / PC) LAN, DIGITAL LINK AV IN AUDIO OUT 1 11 2 12 3 13 4 14 5 6 15 7 16 8 17 9 18 10 19 19 3 1 18 4 2 HDMI AV OUT
3. RIR 3.1. RIR Regional Internet Registry APNIC Asia Pacific Network Information Centre RIR RIPE NCC Réseaux IP Européens Network Coordination Centre
3 RIR RIR APNIC 1. 2. MyAPNIC RIPE NCC 1. 2. LIR Portal ARIN 3. RIR 3.1. RIR Regional Internet Registry APNIC Asia Pacific Network Information Centre RIR RIPE NCC Réseaux IP Européens Network Coordination
クイックスタートガイド [SC-03E]
![クイックスタートガイド [SC-03E]](/thumbs/96/127590290.jpg "クイックスタートガイド [SC-03E]")
a L R 2.4 FH1 / DS4 / OF4 / XX8 IEEE802.11b/g/n IEEE802.11a/n J52 W52 W53 W56 g h a i b j c k m n o p q s t u v w t d e f l g a b c d r e f g h i j k l m n o p q r s t u v w x
大学論集第42号本文.indb
42 2010 2011 3 279 295 COSO 281 COSO 1990 1 internal control 1 19962007, Internal Control Integrated Framework COSO COSO 282 42 2 2) the Committee of Sponsoring Organizations of the Treadway committee
iPhone/iPad接続マニュアル
/ JA 2 3 USB 4 USB USB i-ux1 USB i-ux1 5 6 i-mx1 THRU i-mx1 THRU 7 USB THRU 1 2 3 4 1 2 3 4 5 8 1 1 9 2 1 2 10 1 2 2 6 7 11 1 2 3 4 5 6 7 8 12 1 2 3 4 5 6 13 14 15 WPA Supplicant Copyright 2003-2009, Jouni
untitled
SUBJECT: Applied Biosystems Data Collection Software v2.0 v3.0 Windows 2000 OS : 30 45 Cancel Data Collection - Applied Biosystems Sequencing Analysis Software v5.2 - Applied Biosystems SeqScape Software
840 Geographical Review of Japan 73A-12 835-854 2000 The Mechanism of Household Reproduction in the Fishing Community on Oro Island Masakazu YAMAUCHI (Graduate Student, Tokyo University) This
TH-65LFE7J TH-50LFE7J TH-42LFE7J - + - + PC IN DVI-D IN IR IN/OUT CHARGE OUT SERIAL IN LAN AUDIO IN (DVI-D / PC) AUDIO OUT AV IN (HDMI 1 HDMI 2) 19 3 1 1 11 2 12 3 13 4 14 5 6 15 7 16 8 17 9 18 10
2
m.uehata@sii.co.jp 2 SII 1881 1892 1937 1959 3 SEIKO 1881 1955 1964 1974 1984 1992 1994 1998 1998 2002 2002 4 SII 1960 1970 1980 1990 CMOS IC LCD LCM 2000 COF 1937 VLSI FIB 5 < > SA EOA CAE < > 6 Network
CMS長期署名プロファイル（案）
1/22 RFC3126, Electronic Signature Formats for long term electronic signatures (ETSI TS 101 733 V.1.2.2(2000-12)) ETSI TS 101 733 V1.5.1(2003-12), Electronic Signature Formats draft-pinkas-smime-cades-00.txt(2005-7),
5 11 3 1....1 2. 5...4 (1)...5...6...7...17...22 (2)...70...71...72...77...82 (3)...85...86...87...92...97 (4)...101...102...103...112...117 (5)...121...122...123...125...128 1. 10 Web Web WG 5 4 5 ²
HP cafe HP of A A B of C C Map on N th Floor coupon A cafe coupon B Poster A Poster A Poster B Poster B Case 1 Show HP of each company on a user scree
LAN 1 2 3 2 LAN WiFiTag WiFiTag LAN LAN 100% WiFi Tag An Improved Determination Method with Multiple Access Points for Relative Position Estimation Using Wireless LAN Abstract: We have proposed a WiFiTag
WARNING To reduce the risk of fire or electric shock,do not expose this apparatus to rain or moisture. To avoid electrical shock, do not open the cabi
ES-600P Operating Instructions WARNING To reduce the risk of fire or electric shock,do not expose this apparatus to rain or moisture. To avoid electrical shock, do not open the cabinet. Refer servicing
A5 PDF.pwd
DV DV DV DV DV DV 67 1 2016 5 383 DV DV DV DV DV DV DV DV DV 384 67 1 2016 5 DV DV DV NPO DV NPO NPO 67 1 2016 5 385 DV DV DV 386 67 1 2016 5 DV DV DV DV DV WHO Edleson, J. L. 1999. The overlap between
DICOM Conformance Statement Carino
Carino 2016,03,17 E1J-HC0010-01 Copyright Hitachi, Ltd. 2016. All rights reserved. 1 1 1 2 3 3 AE 3 3 AE 4 4 4 4 4 4 5 5 5 5 SOP SOP 6 6 6 TCP/IP 6 API 6 6 7 SOP 7 7 7 AE 7 7 7 A 8 ( 2 ) E1J-HC0010 DICOM
1 2 3 4 5 6 7 2.4 DSOF 4 1 1 1 1 1 1 1 1 1 1 1 1 2 3 4 5 6 7 8 1 2 3 4 5 1 6 7 1 2 3 4 1 5 6 7 8 1 1 2 2 2 2 1 2 3 4 5 6 7 8 9 10 2 11 12 2 2 2 2 1 2 3 2 4 5 6 7 8 II II 2 \ \ 9
クイックスタートガイド [SC-06D]
![クイックスタートガイド [SC-06D]](/thumbs/96/127590204.jpg "クイックスタートガイド [SC-06D]")
SC-06D a g h a i b j c k m n o p q s t u v w d e f l r g a b c d e f g h i j k l m n o p q r s t u v w x x a ab c 3 1 2 b c d a b 1 2 e a ab c 3 1 2 b c d e f a b c d e f a b
R R S K K S K S K S K S K S Study of Samuhara Belief : Transformation from Protection against Injuries to Protection against Bullets WATANABE Kazuhiro Samuhara, which is a group of letters like unfamiliar
Challenge PKI 2002 IETF PKI
Challenge PKI 2002 IETF PKI 2003 64 Agenda IETF? IETF PKI JNSAIETF Copyright (c) 2003 NPO Page 2 IETF? RFC www.ietf.org 8 WG Applications, General, Internet, Operations and
untitled
Ministry of Land, Infrastructure, Transport and Tourism IATA 996 9 96 96 1180 11 11 80 80 27231 27 27231 231 H19.12.5 10 200612 20076 200710 20076 20086 11 20061192008630 12 20088 20045 13 113 20084
Introduction Purpose This course explains how to use Mapview, a utility program for the Highperformance Embedded Workshop (HEW) development environmen
Introduction Purpose This course explains how to use Mapview, a utility program for the Highperformance Embedded Workshop (HEW) development environment for microcontrollers (MCUs) from Renesas Technology
"CAS を利用した Single Sign On 環境の構築"
CAS 2 SSO Authorization 1,3, 2,3, 2, 2,3 1 2 3 Central Authentication and Authorization Service (CAS 2 ) Web Application Single Sign On Authorization CAS 2 SSO/AuthZ Jan. 30 2007, p. 1/40 Plan of Talk
4.1 % 7.5 %
2018 (412837) 4.1 % 7.5 % Abstract Recently, various methods for improving computial performance have been proposed. One of these various methods is Multi-core. Multi-core can execute processes in parallel
0 C C C C C C C
C * This device can only be used inside Japan in areas that are covered by subscription cable TV services. ecause of differences in broadcast formats and power supply voltages, it cannot be used in overseas
0 C C C C C C
C TU-HD50 TUNER TU - HD50 0 TU-HD50 C C C C S00-06C D D D 0 C C C C 4 5 6 7 8 9 C C C C C C C C C C C C C C C C C C C C C C TUNER TU - HD50 FGIH 0 C C C 0 FGIH C C C C C C FGIH FG IH FGIH I H FGIH FGIH
1 Table 1: Identification by color of voxel Voxel Mode of expression Nothing Other 1 Orange 2 Blue 3 Yellow 4 SSL Humanoid SSL-Vision 3 3 [, 21] 8 325
![1 Table 1: Identification by color of voxel Voxel Mode of expression Nothing Other 1 Orange 2 Blue 3 Yellow 4 SSL Humanoid SSL-Vision 3 3 [, 21] 8 325](/thumbs/91/105378470.jpg "1 Table 1: Identification by color of voxel Voxel Mode of expression Nothing Other 1 Orange 2 Blue 3 Yellow 4 SSL Humanoid SSL-Vision 3 3 [, 21] 8 325")
社団法人人工知能学会 Japanese Society for Artificial Intelligence 人工知能学会研究会資料 JSAI Technical Report SIG-Challenge-B3 (5/5) RoboCup SSL Humanoid A Proposal and its Application of Color Voxel Server for RoboCup SSL
Webサービス本格活用のための設計ポイント
The Web Services are a system which links up the scattered systems on the Internet, leveraging standardized technology such as SOAP, WSDL and UDDI. It is a general thought that in the future business enterprises
1 1 tf-idf tf-idf i
14 A Method of Article Retrieval Utilizing Characteristics in Newspaper Articles 1055104 2003 1 31 1 1 tf-idf tf-idf i Abstract A Method of Article Retrieval Utilizing Characteristics in Newspaper Articles
2
2 3 ( 4 1) ( 49 8) ( 49 82) ( 49 822) ( 49 823) ( 49 14) ( 49 14) ( 49 14) 49 14 ( 49 17) ( 49 202) IEEE802.11 ( 49 201) IEEE802.11 Bluetooth 5GHz ( 49 203) IEEE802.11 ( 49 204) 5GHz ( 49 21) IEEE802.11
\\afs001-0m0005\project02\A32\M
Technical Information 2004.09 2009.04 Store Request Query Request Retrieve Request DICOM Client Application Remote SCP Remote Query/Retrieve SCP Image Stored * DICOM Server Application Remote SCU Print
0 PARTS CATALOG BFT A BFT 0A OB NO.00-ZYET- EU/EX Instruction for use of parts catalogue This parts catalogue was prepared based on the latest information available as of October, 0. See the Service Bulletin
189 2015 1 80
189 2015 1 A Design and Implementation of the Digital Annotation Basis on an Image Resource for a Touch Operation TSUDA Mitsuhiro 79 189 2015 1 80 81 189 2015 1 82 83 189 2015 1 84 85 189 2015 1 86 87
FCC This product is conform to the FCC standards. FCC Rules (Federal Communications Commission) This product complies with Part15 Subpart B and C of the FCC Rules. FCC ID : MK4TR3XM-SX01 FCC NOTICE This