otp.asn1

   OTPKerberos
   DEFINITIONS IMPLICIT TAGS ::=
   BEGIN

   IMPORTS

       KerberosTime, KerberosFlags, EncryptionKey, Int32,
       EncryptedData, LastReq, KerberosString
       FROM KerberosV5Spec2 {iso(1) identified-organization(3)
                             dod(6) internet(1) security(5)
                             kerberosV5(2) modules(4) krb5spec2(2)}
                             -- as defined in RFC 4120.
       AlgorithmIdentifier
       FROM PKIX1Explicit88 { iso (1) identified-organization (3)
                              dod (6) internet (1)
                              security (5) mechanisms (5) pkix (7)
                              id-mod (0) id-pkix1-explicit (18) };
                              -- As defined in RFC 5280.

       PA-OTP-CHALLENGE ::= SEQUENCE {
         nonce            [0] OCTET STRING,
         otp-service      [1] UTF8String               OPTIONAL,
         otp-tokenInfo    [2] SEQUENCE (SIZE(1..MAX)) OF
                                                  OTP-TOKENINFO,
         salt             [3] KerberosString           OPTIONAL,
         s2kparams        [4] OCTET STRING             OPTIONAL,
         ...
       }

       OTP-TOKENINFO ::= SEQUENCE {
         flags            [0] OTPFlags,
         otp-vendor       [1] UTF8String               OPTIONAL,
         otp-challenge    [2] OCTET STRING (SIZE(1..MAX))
                                                       OPTIONAL,
         otp-length       [3] Int32                    OPTIONAL,
         otp-format       [4] OTPFormat                OPTIONAL,
         otp-tokenID      [5] OCTET STRING             OPTIONAL,
         otp-algID        [6] AnyURI                   OPTIONAL,
         supportedHashAlg [7] SEQUENCE OF AlgorithmIdentifier
                                                       OPTIONAL,
         iterationCount   [8] Int32                    OPTIONAL,
         ...
       }

       OTPFormat ::= INTEGER {
         decimal(0),
         hexadecimal(1),
         alphanumeric(2),
         binary(3),
         base64(4)
       }

       OTPFlags ::= KerberosFlags
       -- reserved(0),
       -- nextOTP(1),
       -- combine(2),
       -- collect-pin(3),
       -- do-not-collect-pin(4),
       -- must-encrypt-nonce (5),
       -- separate-pin-required (6),
       -- check-digit (7)

       PA-OTP-REQUEST ::= SEQUENCE {
         flags          [0]  OTPFlags,
         nonce          [1]  OCTET STRING                OPTIONAL,
         encData        [2]  EncryptedData,
                            -- PA-OTP-ENC-REQUEST or PA-ENC-TS-ENC
                            -- Key usage of KEY_USAGE_OTP_REQUEST
         hashAlg        [3]  AlgorithmIdentifier         OPTIONAL,
         iterationCount [4]  Int32                       OPTIONAL,
         otp-value      [5]  OCTET STRING                OPTIONAL,
         otp-pin        [6]  UTF8String                  OPTIONAL,
         otp-challenge  [7]  OCTET STRING (SIZE(1..MAX)) OPTIONAL,
         otp-time       [8]  KerberosTime                OPTIONAL,
         otp-counter    [9]  OCTET STRING                OPTIONAL,
         otp-format     [10] OTPFormat                   OPTIONAL,
         otp-tokenID    [11] OCTET STRING                OPTIONAL,
         otp-algID      [12] AnyURI                      OPTIONAL,
         otp-vendor     [13] UTF8String                  OPTIONAL,
         ...
       }

       PA-OTP-ENC-REQUEST ::= SEQUENCE {
         nonce     [0] OCTET STRING,
         ...
       }


       PA-OTP-PIN-CHANGE ::= SEQUENCE {
         flags     [0] PinFlags,
         pin       [1] UTF8String OPTIONAL,
         minLength [2] INTEGER    OPTIONAL,
         maxLength [3] INTEGER    OPTIONAL,
         last-req  [4] LastReq    OPTIONAL,
         format    [5] OTPFormat  OPTIONAL,
         ...
       }

       PinFlags ::= KerberosFlags
       -- reserved(0),
       -- systemSetPin(1),
       -- mandatory(2)

       AnyURI ::= UTF8String
          (CONSTRAINED BY {
          -- MUST be a valid URI in accordance with IETF RFC 2396
          })

   END