# Botan configuration (v1.2.7)

# This config, as shipped, matches the normal defaults, but is much easier to
# tweak than recompiling the library.

[base]
do_blinding = true
memory_chunk = 64*1024

[rng]
min_entropy = 256
safe_longterm = true
egd_path = /var/run/egd-pool:/dev/egd-pool
ms_capi_prov_type = INTEL_SEC:RSA_FULL

[x509]
x509/validity_slack = 24h
x509/v1_assume_ca = false
x509/cache_verify_results = 30m

ca/allow_ca = false
ca/basic_constraints = always
ca/default_expire = 1y
ca/rsa_hash = SHA-1

crl/unknown_critical = ignore
crl/next_update = 30d

[x509/exts]
basic_constraints = critical
subject_key_id = yes
authority_key_id = yes
subject_alternative_name = yes
issuer_alternative_name = yes
key_usage = critical
extended_key_usage = yes
crl_number = yes

[aliases]
Rijndael = AES
CAST5 = CAST-128
3-Way = ThreeWay
SHARK = SHARK-E
SEAL = SEAL-3.0-BE
SHA1 = SHA-160
SHA-1 = SHA-160

OpenPGP.Cipher.1 = IDEA
OpenPGP.Cipher.2 = TripleDES
OpenPGP.Cipher.3 = CAST-128
OpenPGP.Cipher.4 = Blowfish
OpenPGP.Cipher.5 = SAFER-SK(13)
OpenPGP.Cipher.7 = AES
OpenPGP.Cipher.8 = AES
OpenPGP.Cipher.9 = AES
OpenPGP.Cipher.10 = Twofish

OpenPGP.Digest.1 = MD5
OpenPGP.Digest.2 = SHA-1
OpenPGP.Digest.3 = RIPEMD-160
OpenPGP.Digest.5 = MD2
OpenPGP.Digest.6 = Tiger(24,3)
OpenPGP.Digest.7 = HAVAL(20,5)

TLS.Digest.0 = Parallel(MD5,SHA-1)

EME-PKCS1-v1_5 = PKCS1v15
OAEP-MGF1 = EME1
EME-OAEP = EME1
X9.31 = EMSA2
EMSA-PKCS1-v1_5 = EMSA3
PSS-MGF1 = EMSA4
EMSA-PSS = EMSA4

[oids]
ISO_MEMBER = 1.2
US_BODY = ISO_MEMBER.840
X500 = 2.5

RSA_DSI = US_BODY.113549
ANSI_X957 = US_BODY.10040
ANSI_X942 = US_BODY.10046
PKIX_USAGE = 1.3.6.1.5.5.7.3
DN_ATTR = X500.4
X509_KU = X500.29

DES/CBC = 1.3.14.3.2.7
TripleDES/CBC = RSA_DSI.3.7

PKCS    = RSA_DSI.1
PKCS1   = PKCS.1
PKCS5   = PKCS.5
PKCS7   = PKCS.7
PKCS9   = PKCS.9

RSA = PKCS1.1
RSA = X500.8.1.1
DSA = ANSI_X957.4.1
DH = ANSI_X942.2.1

DSA/EMSA1(SHA-160)/DER = ANSI_X957.4.3
DSA/EMSA1(SHA-160) = ANSI_X957.4.3
RSA/EMSA3(MD2) = PKCS1.2
RSA/EMSA3(MD5) = PKCS1.4
RSA/EMSA3(SHA-160) = PKCS1.5
RSA/EMSA3(SHA-256) = PKCS1.11
RSA/EMSA3(SHA-384) = PKCS1.12
RSA/EMSA3(SHA-512) = PKCS1.13
RSA/EMSA3(RIPEMD-160) = 1.3.36.3.3.1.2

PBE-PKCS5v15(MD2,DES/CBC) = PKCS5.1
PBE-PKCS5v15(MD2,RC2/CBC) = PKCS5.4
PBE-PKCS5v15(MD5,DES/CBC) = PKCS5.3
PBE-PKCS5v15(MD5,RC2/CBC) = PKCS5.6
PBE-PKCS5v15(SHA-160,DES/CBC) = PKCS5.10
PBE-PKCS5v15(SHA-160,RC2/CBC) = PKCS5.11
PBE-PKCS5v20 = PKCS5.13
PKCS5.PBKDF2 = PKCS5.12

PKCS7.DataContent = PKCS7.1
PKCS7.SignedData = PKCS7.2
PKCS7.EnvelopedData = PKCS7.3
PKCS7.DigestedData = PKCS7.5
PKCS7.EncryptedData = PKCS7.6

PKCS9.EmailAddress = PKCS9.1
PKCS9.UnstructuredName = PKCS9.2
PKCS9.ChallengePassword = PKCS9.7
PKCS9.ExtensionRequest = PKCS9.14

X520.CommonName = DN_ATTR.3
X520.Surname = DN_ATTR.4
X520.SerialNumber = DN_ATTR.5
X520.Country = DN_ATTR.6
X520.Locality = DN_ATTR.7
X520.State = DN_ATTR.8
X520.Organization = DN_ATTR.10
X520.OrganizationalUnit = DN_ATTR.11
X520.Title = DN_ATTR.12
X520.GivenName = DN_ATTR.42
X520.Initials = DN_ATTR.43
X520.GenerationalQualifier = DN_ATTR.44
X520.DNQualifier = DN_ATTR.46
X520.Pseudonym = DN_ATTR.65

X509v3.SubjectKeyIdentifier = X509_KU.14
X509v3.KeyUsage = X509_KU.15
X509v3.SubjectAlternativeName = X509_KU.17
X509v3.IssuerAlternativeName = X509_KU.18
X509v3.BasicConstraints = X509_KU.19
X509v3.CRLNumber = X509_KU.20
X509v3.ReasonCode = X509_KU.21
X509v3.HoldInstructionCode = X509_KU.23
X509v3.InvalidityDate = X509_KU.24
X509v3.CertificatePolicies = X509_KU.32
X509v3.AuthorityKeyIdentifier = X509_KU.35
X509v3.PolicyConstraints = X509_KU.36
X509v3.ExtendedKeyUsage = X509_KU.37

PKIX.ServerAuth = PKIX_USAGE.1
PKIX.ClientAuth = PKIX_USAGE.2
PKIX.CodeSigning = PKIX_USAGE.3
PKIX.EmailProtection = PKIX_USAGE.4
PKIX.IPsecEndSystem = PKIX_USAGE.5
PKIX.IPsecTunnel = PKIX_USAGE.6
PKIX.IPsecUser = PKIX_USAGE.7
PKIX.TimeStamping = PKIX_USAGE.8
