The profile org.opcfoundation.ECC-nistP256 supports creation of a personality using gta_personality_create().
Table 1 – GTA API Creation Profile org.opcfoundation.ECC-nistP256
|
Property |
Description |
|
Security Mechanism |
Mechanism details as specified in SecurityPolicy [ECC-B] – ECC-nistP256 |
|
Fingerprinting |
Implementation dependent |
|
Attribute type |
ch.iec.30168.identifier (attribute name ch.iec.30168.identifier_value; cardinality 1) |
The identifier value that is assigned to the personality at the time of its creation (cf. IEC TS 30168 6.6.10.4.13). |
ch.iec.30168.trustlist.certificate.self.x509 (cardinality 0..1) |
X.509 end entity certificate |
org.opcfoundation.product_instance_uri (cardinality 0..1) |
ProductInstanceUri represented by the personality. This attribute shall be present for personalities which are eligible identities to be used in the OPC UA onboarding process. This attribute should occur at most once. The attribute name shall be set to “ProductInstanceUri”. |
|
Usage Info |
org.opcfoundation.ECC-nistP256 |
Table 2 – GTA API Enrollment Profile org.opcfoundation.ECC-nistP256
|
Property |
Description |
|
Profile Dependencies |
org.opcfoundation.ECC-nistP256 for creation |
|
Enrollment Attributes |
org.opcfoundation.csr.subject (optional) |
CertificateRequestInfo.subject (according to IETF RFC 2986) in ASN.1 DER coding (binary). |
org.opcfoundation.csr.subjectAltName (optional) |
CertificateRequestInfo.subjectAltName GeneralNames structure to appear as subjectAltName inside an extensionRequest (IETF RFC 2985, IETF RFC 2986). The value shall be specified as ASN.1 DER encoded GeneralNames structure according to IETF RFC 5280. |
|
Enrollment Artifact |
PKCS#10 according to RFC 2986 in ASN.1 DER coding (binary). CertificateRequestInfo.subjectPKInfo contains the information on the personality’s EC public key. CertificationRequest.signatureAlgorithm and CertificationRequest.signature are providing the proof-of-possession calculated with the personality’s EC private key. CertificateRequestInfo.subject is provided via gta_context_set_attribute(). The subject alternative name is set according to the context attribute type org.opcfoundation.csr.subjectAltName,or in case org.opcfoundation.csr.subjectAltName is not set, the value is set according to the identifier that relates to the personality (personality attribute type ch.iec.30168.identifier) if the identifier type is org.opcfoundation.application_instance_urior the function fails if none of the information described above is available. |
Table 3 – GTA API Usage Profile org.opcfoundation.ECC-nistP256
|
Property |
Description |
|
Profile Dependencies |
org.opcfoundation.ECC-nistP256 for creation and enrolment |
|
|
gta_personality_get_attribute() |
ch.iec.30168.identifier ch.iec.30168.trustlist.certificate.self.x509 org.opcfoundation.product_instance_uri |
gta_personality_add_attribute() |
ch.iec.30168.trustlist.certificate.self.x509 org.opcfoundation.product_instance_uri |
gta_personality_remove_attribute() |
ch.iec.30168.trustlist.certificate.self.x509 org.opcfoundation.product_instance_uri |
gta_authenticate_data_detached() |
Signs data and returns a signature artifact depending on the mechanism of the used personality. Mechanism details as specified in SecurityPolicy [ECC-B] – ECC-nistP256 (http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256) |
|
Usage Attributes |
n/a |
|
|
Usage Artifact |
Binary tbd. |