Composite-MLDSA-2024.asn

Composite-MLDSA-2024
  { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-composite-mldsa(TBDMOD) }


DEFINITIONS IMPLICIT TAGS ::= BEGIN

EXPORTS ALL;

IMPORTS
  PUBLIC-KEY, SIGNATURE-ALGORITHM, SMIME-CAPS, AlgorithmIdentifier{}
    FROM AlgorithmInformation-2009  -- RFC 5912 [X509ASN1]
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-algorithmInformation-02(58) }
;

--
-- Object Identifiers
--

-- Defined in ITU-T X.690
der OBJECT IDENTIFIER ::=
  {joint-iso-itu-t asn1(1) ber-derived(2) distinguished-encoding(1)}

--
-- Signature Algorithm
--

--
-- Composite Signature basic structures
--

--
-- When a CompositeMLDSAPublicKey is used with an RSA public key, the BIT STRING is generated
-- by the concatenation of a raw ML-DSA key according to {{I-D.ietf-lamps-dilithium-certificates}},
-- and an RSAPublicKey (which is a DER encoded RSAPublicKey).

-- When a CompositeMLDSAPublicKey is used with an EC public key, the BIT STRING is generated
-- by the concatenation of a raw ML-DSA key according to {{I-D.ietf-lamps-dilithium-certificates}}
-- and an ECDSAPublicKey according to [RFC5480].

-- When a CompositeMLDSAPublicKey is used with an Edwards public key, the BIT STRING is generated
-- by the concatenation of a raw ML-DSA key according to {{I-D.ietf-lamps-dilithium-certificates}}
-- and a raw Edwards public key according to [RFC8410].

CompositeMLDSAPublicKey ::= BIT STRING

--
-- When a CompositeMLDSAPrivateKey is used with an RSA public key, the OCTET STRING is generated
-- by the concatenation of an ML-DSA private key according to {{I-D.ietf-lamps-dilithium-certificates}},
-- and an RSAPrivateKey (which is a DER encoded RSAPrivateKey).

-- When a CompositeMLDSAPrivateKey is used with an EC public key, the OCTET STRING is generated
-- by the concatenation of an ML-DSA private key according to {{I-D.ietf-lamps-dilithium-certificates}},
-- and an ECDSAPrivateKey according to [RFC5915].

-- When a CompositeMLDSAPrivateKey is used with an Edwards public key, the OCTET STRING is generated
-- by the concatenation of an ML-DSA private key according to {{I-D.ietf-lamps-dilithium-certificates}},
-- and a raw Edwards private key according to [RFC8410].

CompositeMLDSAPrivateKey ::= OCTET STRING

-- Composite Signature Value is just an BIT STRING and is a concatenation of the component signature
-- algorithms.

CompositeSignatureValue ::= BIT STRING


--
-- Information Object Classes
--

pk-CompositeSignature {OBJECT IDENTIFIER:id, PublicKeyType}
    PUBLIC-KEY ::= {
      IDENTIFIER id
      KEY PublicKeyType
      PARAMS ARE absent
      CERT-KEY-USAGE { digitalSignature, nonRepudiation, keyCertSign, cRLSign}
    }

sa-CompositeSignature{OBJECT IDENTIFIER:id,
   PUBLIC-KEY:publicKeyType }
      SIGNATURE-ALGORITHM ::=  {
         IDENTIFIER id
         VALUE CompositeSignatureValue
         PARAMS ARE absent
         PUBLIC-KEYS {publicKeyType}
      }

-- PURE Version of OIDS

-- TODO: OID to be replaced by IANA
id-MLDSA44-RSA2048-PSS OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 60 }

pk-MLDSA44-RSA2048-PSS PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA44-RSA2048-PSS,
  CompositeMLDSAPublicKey}

sa-MLDSA44-RSA2048-PSS SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA44-RSA2048-PSS,
       pk-MLDSA44-RSA2048-PSS }

-- TODO: OID to be replaced by IANA
id-MLDSA44-RSA2048-PKCS15 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 61 }

pk-MLDSA44-RSA2048-PKCS15 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA44-RSA2048-PKCS15,
  CompositeMLDSAPublicKey}

sa-MLDSA44-RSA2048-PKCS15 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA44-RSA2048-PKCS15,
       pk-MLDSA44-RSA2048-PKCS15 }


-- TODO: OID to be replaced by IANA
id-MLDSA44-Ed25519 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 62 }

pk-MLDSA44-Ed25519 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA44-Ed25519,
  CompositeMLDSAPublicKey}

sa-MLDSA44-Ed25519 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA44-Ed25519,
       pk-MLDSA44-Ed25519 }


-- TODO: OID to be replaced by IANA
id-MLDSA44-ECDSA-P256 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 63 }

pk-MLDSA44-ECDSA-P256 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA44-ECDSA-P256,
  CompositeMLDSAPublicKey}

sa-MLDSA44-ECDSA-P256 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA44-ECDSA-P256,
       pk-MLDSA44-ECDSA-P256 }


-- TODO: OID to be replaced by IANA
id-MLDSA65-RSA3072-PSS OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 64 }

pk-MLDSA65-RSA3072-PSS PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-RSA3072-PSS,
  CompositeMLDSAPublicKey}

sa-MLDSA65-RSA3072-PSS SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-RSA3072-PSS,
       pk-MLDSA65-RSA3072-PSS }


-- TODO: OID to be replaced by IANA
id-MLDSA65-RSA3072-PKCS15 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 65 }

pk-MLDSA65-RSA3072-PKCS15 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-RSA3072-PKCS15,
  CompositeMLDSAPublicKey}

sa-MLDSA65-RSA3072-PKCS15 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-RSA3072-PKCS15,
       pk-MLDSA65-RSA3072-PKCS15 }

-- TODO: OID to be replaced by IANA
id-MLDSA65-RSA4096-PSS OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 66 }

pk-MLDSA65-RSA4096-PSS PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-RSA4096-PSS,
  CompositeMLDSAPublicKey}

sa-MLDSA65-RSA4096-PSS SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-RSA4096-PSS,
       pk-MLDSA65-RSA4096-PSS }


-- TODO: OID to be replaced by IANA
id-MLDSA65-RSA4096-PKCS15 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 67 }

pk-MLDSA65-RSA4096-PKCS15 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-RSA4096-PKCS15,
  CompositeMLDSAPublicKey}

sa-MLDSA65-RSA4096-PKCS15 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-RSA4096-PKCS15,
       pk-MLDSA65-RSA4096-PKCS15 }


-- TODO: OID to be replaced by IANA
id-MLDSA65-ECDSA-P256 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 68 }

pk-MLDSA65-ECDSA-P256 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-ECDSA-P256,
  CompositeMLDSAPublicKey}

sa-MLDSA65-ECDSA-P256 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-ECDSA-P256,
       pk-MLDSA65-ECDSA-P256 }


-- TODO: OID to be replaced by IANA
id-MLDSA65-ECDSA-P384 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 69 }

pk-MLDSA65-ECDSA-P384 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-ECDSA-P384,
  CompositeMLDSAPublicKey}

sa-MLDSA65-ECDSA-P384 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-ECDSA-P384,
       pk-MLDSA65-ECDSA-P384 }


-- TODO: OID to be replaced by IANA
id-MLDSA65-ECDSA-brainpoolP256r1 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 70 }

pk-MLDSA65-ECDSA-brainpoolP256r1 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-ECDSA-brainpoolP256r1,
  CompositeMLDSAPublicKey}

sa-MLDSA65-ECDSA-brainpoolP256r1 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-ECDSA-brainpoolP256r1,
       pk-MLDSA65-ECDSA-brainpoolP256r1 }


-- TODO: OID to be replaced by IANA
id-MLDSA65-Ed25519 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 71 }

pk-MLDSA65-Ed25519 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA65-Ed25519,
  CompositeMLDSAPublicKey}

sa-MLDSA65-Ed25519 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA65-Ed25519,
       pk-MLDSA65-Ed25519 }

-- TODO: OID to be replaced by IANA
id-MLDSA87-ECDSA-P384 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 72 }

pk-MLDSA87-ECDSA-P384 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA87-ECDSA-P384,
  CompositeMLDSAPublicKey}

sa-MLDSA87-ECDSA-P384 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA87-ECDSA-P384,
       pk-MLDSA87-ECDSA-P384 }


-- TODO: OID to be replaced by IANA
id-MLDSA87-ECDSA-brainpoolP384r1 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 73 }

pk-MLDSA87-ECDSA-brainpoolP384r1 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA87-ECDSA-brainpoolP384r1,
  CompositeMLDSAPublicKey}

sa-MLDSA87-ECDSA-brainpoolP384r1 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA87-ECDSA-brainpoolP384r1,
       pk-MLDSA87-ECDSA-brainpoolP384r1 }


-- TODO: OID to be replaced by IANA
id-MLDSA87-Ed448 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 74 }

pk-MLDSA87-Ed448 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA87-Ed448,
  CompositeMLDSAPublicKey}

sa-MLDSA87-Ed448 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA87-Ed448,
       pk-MLDSA87-Ed448 }

-- TODO: OID to be replaced by IANA
id-MLDSA87- OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 75 }

pk-MLDSA87-RSA4096-PSS PUBLIC-KEY ::=
  pk-CompositeSignature{ id-MLDSA87-RSA4096-PSS,
  CompositeMLDSAPublicKey}

sa-MLDSA87-RSA4096-PSS SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-MLDSA87-RSA4096-PSS,
       pk-MLDSA87-RSA4096-PSS }

-- PreHash Version of the OIDs

-- TODO: OID to be replaced by IANA
id-HashMLDSA44-RSA2048-PSS-SHA256 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 80 }

pk-HashMLDSA44-RSA2048-PSS-SHA256 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA44-RSA2048-PSS-SHA256,
  CompositeMLDSAPublicKey}

sa-HashMLDSA44-RSA2048-PSS-SHA256 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA44-RSA2048-PSS-SHA256,
       pk-HashMLDSA44-RSA2048-PSS-SHA256 }

-- TODO: OID to be replaced by IANA
id-HashMLDSA44-RSA2048-PKCS15-SHA256 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 81 }

pk-HashMLDSA44-RSA2048-PKCS15-SHA256 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA44-RSA2048-PKCS15-SHA256,
  CompositeMLDSAPublicKey}

sa-HashMLDSA44-RSA2048-PKCS15-SHA256 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA44-RSA2048-PKCS15-SHA256,
       pk-HashMLDSA44-RSA2048-PKCS15-SHA256 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA44-Ed25519-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 82 }

pk-HashMLDSA44-Ed25519-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA44-Ed25519-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA44-Ed25519-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA44-Ed25519-SHA512,
       pk-HashMLDSA44-Ed25519-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA44-ECDSA-P256-SHA256 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 83 }

pk-HashMLDSA44-ECDSA-P256-SHA256 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA44-ECDSA-P256-SHA256,
  CompositeMLDSAPublicKey}

sa-HashMLDSA44-ECDSA-P256-SHA256 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA44-ECDSA-P256-SHA256,
       pk-HashMLDSA44-ECDSA-P256-SHA256 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-RSA3072-PSS-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 84 }

pk-HashMLDSA65-RSA3072-PSS-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-RSA3072-PSS-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-RSA3072-PSS-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-RSA3072-PSS-SHA512,
       pk-HashMLDSA65-RSA3072-PSS-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-RSA3072-PKCS15-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 85 }

pk-HashMLDSA65-RSA3072-PKCS15-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-RSA3072-PKCS15-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-RSA3072-PKCS15-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-RSA3072-PKCS15-SHA512,
       pk-HashMLDSA65-RSA3072-PKCS15-SHA512 }

-- TODO: OID to be replaced by IANA
id-HashMLDSA65-RSA4096-PSS-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 86 }

pk-HashMLDSA65-RSA4096-PSS-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-RSA4096-PSS-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-RSA4096-PSS-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-RSA4096-PSS-SHA512,
       pk-HashMLDSA65-RSA4096-PSS-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-RSA4096-PKCS15-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 87 }

pk-HashMLDSA65-RSA4096-PKCS15-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-RSA4096-PKCS15-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-RSA4096-PKCS15-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-RSA4096-PKCS15-SHA512,
       pk-HashMLDSA65-RSA4096-PKCS15-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-ECDSA-P256-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 88 }

pk-HashMLDSA65-ECDSA-P256-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-ECDSA-P256-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-ECDSA-P256-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-ECDSA-P256-SHA512,
       pk-HashMLDSA65-ECDSA-P256-SHA512 }




-- TODO: OID to be replaced by IANA
id-HashMLDSA65-ECDSA-P384-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 89 }

pk-HashMLDSA65-ECDSA-P384-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-ECDSA-P384-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-ECDSA-P384-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-ECDSA-P384-SHA512,
       pk-HashMLDSA65-ECDSA-P384-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 90 }

pk-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512,
       pk-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-Ed25519-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 91 }

pk-HashMLDSA65-Ed25519-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA65-Ed25519-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA65-Ed25519-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA65-Ed25519-SHA512,
       pk-HashMLDSA65-Ed25519-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA87-ECDSA-P384-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 92 }

pk-HashMLDSA87-ECDSA-P384-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA87-ECDSA-P384-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA87-ECDSA-P384-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA87-ECDSA-P384-SHA512,
       pk-HashMLDSA87-ECDSA-P384-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 93 }

pk-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512,
       pk-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA87-Ed448-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 94 }

pk-HashMLDSA87-Ed448-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA87-Ed448-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA87-Ed448-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA87-Ed448-SHA512,
       pk-HashMLDSA87-Ed448-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA87-RSA4096-PSS-SHA512 OBJECT IDENTIFIER ::= {
   joint-iso-itu-t(2) country(16) us(840) organization(1)
   entrust(114027) algorithm(80) composite(8) signature(1) 95 }

pk-HashMLDSA87-RSA4096-PSS-SHA512 PUBLIC-KEY ::=
  pk-CompositeSignature{ id-HashMLDSA87-RSA4096-PSS-SHA512,
  CompositeMLDSAPublicKey}

sa-HashMLDSA87-RSA4096-PSS-SHA512 SIGNATURE-ALGORITHM ::=
    sa-CompositeSignature{
       id-HashMLDSA87-RSA4096-PSS-SHA512,
       pk-HashMLDSA87-RSA4096-PSS-SHA512 }
	   

SignatureAlgorithmSet SIGNATURE-ALGORITHM ::= {
  sa-MLDSA44-RSA2048-PSS |
  sa-MLDSA44-RSA2048-PKCS15 |
  sa-MLDSA44-Ed25519 |
  sa-MLDSA44-ECDSA-P256 |
  sa-MLDSA65-RSA3072-PSS |
  sa-MLDSA65-RSA3072-PKCS15 |
  sa-MLDSA65-RSA4096-PSS |
  sa-MLDSA65-RSA4096-PKCS15 |
  sa-MLDSA65-ECDSA-P256 |
  sa-MLDSA65-ECDSA-P384 |
  sa-MLDSA65-ECDSA-brainpoolP256r1 |
  sa-MLDSA65-Ed25519 |
  sa-MLDSA87-ECDSA-P384 |
  sa-MLDSA87-ECDSA-brainpoolP384r1 |
  sa-MLDSA87-Ed448 |
  sa-MLDSA87-RSA4096-PSS |  
  sa-HashMLDSA44-RSA2048-PSS-SHA256 |
  sa-HashMLDSA44-RSA2048-PKCS15-SHA256 |
  sa-HashMLDSA44-Ed25519-SHA512 |
  sa-HashMLDSA44-ECDSA-P256-SHA256 |
  sa-HashMLDSA65-RSA3072-PSS-SHA512 |
  sa-HashMLDSA65-RSA3072-PKCS15-SHA512 |
  sa-HashMLDSA65-RSA4096-PSS-SHA512 |
  sa-HashMLDSA65-RSA4096-PKCS15-SHA512 |
  sa-HashMLDSA65-ECDSA-P256-SHA512 |
  sa-HashMLDSA65-ECDSA-P384-SHA512 |
  sa-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 |
  sa-HashMLDSA65-Ed25519-SHA512 |
  sa-HashMLDSA87-ECDSA-P384-SHA512 |
  sa-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512 |
  sa-HashMLDSA87-Ed448-SHA512 |
  sa-HashMLDSA87-RSA4096-PSS-SHA512,
  ... }


--
-- Expand the S/MIME capabilities set used by CMS [RFC5911]
--

-- TODO: this doesn't compile, error:
-- "The referenced object in the 'ValueFromObject' 
-- syntax with the field '&smimeCaps' is invalid or does not exist."
-- We need help from an SMIME expert

SMimeCaps SMIME-CAPS ::= {
  sa-MLDSA44-RSA2048-PSS.&smimeCaps |
  sa-MLDSA44-RSA2048-PKCS15.&smimeCaps |
  sa-MLDSA44-Ed25519.&smimeCaps |
  sa-MLDSA44-ECDSA-P256.&smimeCaps |
  sa-MLDSA65-RSA3072-PSS.&smimeCaps |
  sa-MLDSA65-RSA3072-PKCS15.&smimeCaps |
  sa-MLDSA65-RSA4096-PSS.&smimeCaps |
  sa-MLDSA65-RSA4096-PKCS15.&smimeCaps |
  sa-MLDSA65-ECDSA-P256.&smimeCaps |
  sa-MLDSA65-ECDSA-P384.&smimeCaps |
  sa-MLDSA65-ECDSA-brainpoolP256r1.&smimeCaps |
  sa-MLDSA65-Ed25519.&smimeCaps |
  sa-MLDSA87-ECDSA-P384.&smimeCaps |
  sa-MLDSA87-ECDSA-brainpoolP384r1.&smimeCaps |
  sa-MLDSA87-Ed448.&smimeCaps |
  sa-MLDSA87-RSA4096-PSS.&smimeCaps |  
  sa-HashMLDSA44-RSA2048-PSS-SHA256.&smimeCaps |
  sa-HashMLDSA44-RSA2048-PKCS15-SHA256.&smimeCaps |
  sa-HashMLDSA44-Ed25519-SHA512.&smimeCaps |
  sa-HashMLDSA44-ECDSA-P256-SHA256.&smimeCaps |
  sa-HashMLDSA65-RSA3072-PSS-SHA512.&smimeCaps |
  sa-HashMLDSA65-RSA3072-PKCS15-SHA512.&smimeCaps |
  sa-HashMLDSA65-RSA4096-PSS-SHA512.&smimeCaps |
  sa-HashMLDSA65-RSA4096-PKCS15-SHA512.&smimeCaps |
  sa-HashMLDSA65-ECDSA-P256-SHA512.&smimeCaps |
  sa-HashMLDSA65-ECDSA-P384-SHA512.&smimeCaps |
  sa-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512.&smimeCaps |
  sa-HashMLDSA65-Ed25519-SHA512.&smimeCaps |
  sa-HashMLDSA87-ECDSA-P384-SHA512.&smimeCaps |
  sa-HashMLDSA87-ECDSA-brainpoolP384r1-SHA512.&smimeCaps |
  sa-HashMLDSA87-Ed448-SHA512.&smimeCaps |
  sa-HashMLDSA87-RSA4096-PSS-SHA512.&smimeCaps,
  ... }

END