"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificate {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket' (1)\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tand containing certificate\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket'\r\n\t}\r\n}"
"value":"Check that signer info of the AT certificate is a digest\r\n"
"value":"Check that the subject_name variable-length vector is empty for AT certificates\r\n"
},
"_expectedResults":{
"isGenerated":false,
"key":"_expectedResults",
"origin":"d72b7a15-20e8-40a0-8885-3b2165b97457",
"origin":"475f7e09-11b4-4a2e-8ef0-afcce3c451cd",
"type":"STRING",
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tand containing certificate\r\n\t\t\t\t\tcontaining signer_info\r\n\t\t\t\t\t\tcontaining type\r\n\t\t\t\t\t\t\tindicating 'certificate_digest_with_sha256'\r\n\t\t\t\t\t\tand containing digest\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tand containing certificate\r\n\t\t\t\t\tcontaining subject_info.subject_name\r\n\t\t\t\t\t\tindicating length = 0\r\n\t}\r\n}"
"value":"Check that the subject_name variable-length vector is empty for AT certificates\r\n"
},
"_expectedResults":{
"key":"_expectedResults",
"type":"STRING",
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificates {\r\n\t\t\t\t\tcontaining subject_info.subject_name\r\n\t\t\t\t\t\tindicating length = 0\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificate {\r\n\t\t\t\t\tcontaining subject_attributes [0..N] {\r\n\t\t\t\t\t\tindicating subject_attributes[n].type\r\n\t\t\t\t\t\t\t\t\t< subject_attributes[n+1].type\r\n\t\t\t\t\t\tcontaining subject_attributes['verification_key']\r\n\t\t\t\t\t\tcontaining subject_attributes['assurance_level']\r\n\t\t\t\t\t\tcontaining subject_attributes['its_aid_ssp_list']\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}\r\n"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificate\r\n\t\t\t\t\tcontaining subject_attributes [0..N]\r\n\t\t\t\t\t\tindicating subject_attributes[n].type\r\n\t\t\t\t\t\t\t\t\t< subject_attributes[n+1].type\r\n\t\t\t\t\t\tcontaining subject_attributes['verification_key']\r\n\t\t\t\t\t\tcontaining subject_attributes['assurance_level']\r\n\t\t\t\t\t\tcontaining subject_attributes['its_aid_ssp_list']\r\n\t}\r\n}\r\n"
"value":"Check that time_start_and_end is included in the AT certificate validation restrictions;\r\nCheck that time_start_and_end is inside the AA certificate time restrictions"
"value":"Check that time_start_and_end is included in the AT certificate validation restrictions;\r\nCheck that time_start_and_end is inside the AA certificate time restrictions\r\nCheck that validity restriction of AT certificate is inside the validity restriction of its issuing certificate"
},
"_expectedResults":{
"isGenerated":false,
"key":"_expectedResults",
"origin":"601932b9-103d-436f-92ba-51fa3a849a71",
"type":"STRING",
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1]\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_authority'\r\n\t\t\t\t\tcontaining validity_restrictions['time_start_and_end']\r\n\t\t\t\t\t\tcontaining start_validity\r\n\t\t\t\t\t\t\tindicating START_AA_VALIDITY\r\n\t\t\t\t\t\tcontaining end_validity\r\n\t\t\t\t\t\t\tindicating END_AA_VALIDITY\r\n\t\t\t\tcontaining certificates[last]\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket'\r\n\t\t\t\t\tnot containing validity_restrictions['time_end']\r\n\t\t\t\t\tand not containing validity_restrictions['time_start_and_duration']\r\n\t\t\t\t\tand containing validity_restrictions['time_start_and_end']\r\n\t\t\t\t\t\tcontaining start_validity\r\n\t\t\t\t\t\t\tindicating START_AT_VALIDITY\r\n\t\t\t\t\t\t\t\t(START_AA_VALIDITY <= START_AT_VALIDITY < END_AA_VALIDITY )\r\n\t\t\t\t\t\tcontaining end_validity\r\n\t\t\t\t\t\t\tindicating END_AT_VALIDITY\r\n\t\t\t\t\t\t\t\t(START_AT_VALIDITY < END_AT_VALIDITY <= END_AA_VALIDITY)\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last]\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket'\r\n\t\t\t\t\tnot containing validity_restrictions['time_end']\r\n\t\t\t\t\tand not containing validity_restrictions['time_start_and_duration']\r\n\t\t\t\t\tand containing validity_restrictions['time_start_and_end']\r\n\t\t\t\t\t\tcontaining start_validity\r\n\t\t\t\t\t\t\tindicating AT_START_VALIDITY\r\n\t\t\t\t\t\tcontaining end_validity\r\n\t\t\t\t\t\t\tindicating AT_END_VALIDITY\r\n\t\t\t\tcontaining certificates[last-1]\r\n\t\t\t\t\tcontaining validity_restrictions['time_end']\r\n\t\t\t\t\t\tcontaining end_validity\r\n\t\t\t\t\t\t\tindicating value > AT_END_VALIDITY\r\n\t\t\t\t\tor containing validity_restrictions['time_start_and_end']\r\n\t\t\t\t\t\tcontaining start_validity\r\n\t\t\t\t\t\t\tindicating value <= AT_START_VALIDITY\r\n\t\t\t\t\t\tand containing end_validity\r\n\t\t\t\t\t\t\tindicating value > AT_END_VALIDITY\r\n\t\t\t\t\tor containing validity_restrictions['time_start_and_duration']\r\n\t\t\t\t\t\tcontaining start_validity\r\n\t\t\t\t\t\t\tindicating X_START_VALIDITY <= AT_START_VALIDITY\r\n\t\t\t\t\t\tand containing duration\r\n\t\t\t\t\t\t\tindicating value > AT_END_VALIDITY - X_START_VALIDITY\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1] {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_authority' (2)\r\n\t\t\t\t\tcontaining subject_attributes['its_aid_list']\r\n\t\t\t\t\t\tcontaining its_aid_list[0..N]\r\n\t\t\t\t\t\t\tindicating ITS_AID_LIST_AA\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t\tcontaining certificates[last] {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket' (1)\r\n\t\t\t\t\tcontaining subject_attributes['its_aid_ssp_list']\r\n\t\t\t\t\t\tcontaining its_aid_ssp_list[0..N] {\r\n\t\t\t\t\t\t\tcontaining its_aid_ssp_list[n]{\r\n\t\t\t\t\t\t\t\tcontaining its_aid\r\n\t\t\t\t\t\t\t\t\tindicating unique value containing in the ITS_AID_LIST_AA\r\n\t\t\t\t\t\t\t\tcontaining service_specific_permissions\r\n\t\t\t\t\t\t\t\t\tindicating length <= 31 octet\r\n\t\t\t\t\t\t\t}\r\n\t\t\t\t\t\t}\r\n\t\t\t\t\t}\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}\r\n"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1]\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_authority'\r\n\t\t\t\t\tand containing subject_attributes['its_aid_list']\r\n\t\t\t\t\t\tcontaining its_aid_list[0..N]\r\n\t\t\t\t\t\t\tindicating ITS_AID_LIST_AA\r\n\t\t\t\tand containing certificates[last] {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket'\r\n\t\t\t\t\tand containing subject_attributes['its_aid_ssp_list']\r\n\t\t\t\t\t\tcontaining its_aid_ssp_list[0..N]\r\n\t\t\t\t\t\t\tcontaining its_aid_ssp_list[n]\r\n\t\t\t\t\t\t\t\tcontaining its_aid\r\n\t\t\t\t\t\t\t\t\tindicating unique value containing in the ITS_AID_LIST_AA\r\n\t\t\t\t\t\t\t\tand containing service_specific_permissions\r\n\t\t\t\t\t\t\t\t\tindicating length <= 31 octet\r\n\t}\r\n}\r\n"
"value":"Check that AT certificate is signed by AA cert"
},
"_expectedResults":{
"isGenerated":false,
"key":"_expectedResults",
"origin":"36af1ef7-6e5f-470d-9942-6c11c753d38f",
"type":"STRING",
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1] (CERT_AA) {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_authority' (2)\r\n\t\t\t\t\tand containing subject_attributes['verification key'] (KEY)\r\n\t\t\t\t}\r\n\t\t\t\tcontaining certificates[last] {\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket' (1)\r\n\t\t\t\t\t}\r\n\t\t\t\t\tand containing signer_info{\r\n\t\t\t\t\t\tcontaining type\r\n\t\t\t\t\t\t\tindicating 'certificate_digest_with_ecdsap256'\r\n\t\t\t\t\t\tcontaining digest\r\n\t\t\t\t\t\t\treferencing to CERT_AA\r\n\t\t\t\t\t}\r\n\t\t\t\t\tand containing signature\r\n\t\t\t\t\t\tverifiable using KEY\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1] (CERT_AA)\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_authority'\r\n\t\t\t\t\tand containing subject_attributes['verification key'] (KEY)\r\n\t\t\t\tcontaining certificates[last]\r\n\t\t\t\t\tcontaining subject_info.subject_type\r\n\t\t\t\t\t\tindicating 'authorization_ticket'\r\n\t\t\t\t\tand containing signer_info\r\n\t\t\t\t\t\tcontaining type\r\n\t\t\t\t\t\t\tindicating 'certificate_digest_with_ecdsap256'\r\n\t\t\t\t\t\tand containing digest\r\n\t\t\t\t\t\t\treferencing to CERT_AA\r\n\t\t\t\t\tand containing signature\r\n\t\t\t\t\t\tverifiable using KEY\r\n\t}\r\n}"
"value":"Check that the assurance level of the subordinate certificate is equal to or less than the assurance level of the issuing certificate"
},
"_expectedResults":{
"isGenerated":false,
"key":"_expectedResults",
"origin":"4744decb-d93c-4ec7-8ead-548ce850d7a8",
"type":"STRING",
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate chain in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating certificate_chain\r\n\t\t\t\tcontaining certificates[last-1] (CERT_AA) {\r\n\t\t\t\t\tcontaining subject_attributes ['assurance_level']\r\n\t\t\t\t\t\tcontaining assurance_level\r\n\t\t\t\t\t\t\tcontaining bits [5-7]\r\n\t\t\t\t\t\t\t\tindicating assurance level AL_AA\r\n\t\t\t\t}\r\n\t\t\t\tcontaining certificates[last] (CERT_AT) {\r\n\t\t\t\t\tcontaining subject_attributes ['assurance_level']\r\n\t\t\t\t\t\tcontaining assurance_level\r\n\t\t\t\t\t\t\tcontaining bits [5-7]\r\n\t\t\t\t\t\t\t\tindicating assurance level AL_AT (AL_AT <= AL_AA)\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificate {\r\n\t\t\t\t\tcontaining validity_restrictions\r\n\t\t\t\t\t\tindicating validity_restrictions[n].type < validity_restrictions[n+1].type\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}\r\n"
"value":"with {\r\n\tthe IUT being in the 'authorized' state\r\n\tthe IUT being requested to include certificate in the next CAM\r\n} ensure that {\r\n\t when {\r\n\t\tthe IUT is requested to send a CAM\r\n\t} then {\r\n\t\tthe IUT sends a SecuredMessage\r\n\t\t\tcontaining header_fields['signer_info'].signer {\r\n\t\t\t\tcontaining type\r\n\t\t\t\t\tindicating 'certificate'\r\n\t\t\t\tcontaining certificate {\r\n\t\t\t\t\tcontaining validity_restrictions\r\n\t\t\t\t\t\tindicating validity_restrictions[n].type < validity_restrictions[n+1].type\r\n\t\t\t\t\t\tand containing validity_restrictions['time_start_and_end']\r\n\t\t\t\t\t\tand not containing validity_restrictions['time_end']\r\n\t\t\t\t\t\tand not containing validity_restrictions['time_start_and_duration']\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t}\r\n}\r\n"