1PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) internet(1) 2 security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) } 3 4DEFINITIONS EXPLICIT TAGS ::= 5 6BEGIN 7 8-- EXPORTS ALL -- 9 10-- IMPORTS NONE -- 11 12-- UNIVERSAL Types defined in 1993 and 1998 ASN.1 13-- and required by this specification 14 15-- UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING 16 -- UniversalString is defined in ASN.1:1993 17 18-- BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING 19 -- BMPString is the subtype of UniversalString and models 20 -- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1 21 22--UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING 23 -- The content of this type conforms to RFC 2279. 24 25-- PKIX specific OIDs 26 27id-pkix OBJECT IDENTIFIER ::= 28 { iso(1) identified-organization(3) dod(6) internet(1) 29 security(5) mechanisms(5) pkix(7) } 30 31-- PKIX arcs 32 33id-pe OBJECT IDENTIFIER ::= { id-pkix 1 } 34 -- arc for private certificate extensions 35id-qt OBJECT IDENTIFIER ::= { id-pkix 2 } 36 -- arc for policy qualifier types 37id-kp OBJECT IDENTIFIER ::= { id-pkix 3 } 38 -- arc for extended key purpose OIDS 39id-ad OBJECT IDENTIFIER ::= { id-pkix 48 } 40 -- arc for access descriptors 41 42-- policyQualifierIds for Internet policy qualifiers 43 44id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 } 45 -- OID for CPS qualifier 46id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 } 47 -- OID for user notice qualifier 48 49-- access descriptor definitions 50 51id-ad-ocsp OBJECT IDENTIFIER ::= { id-ad 1 } 52id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 } 53id-ad-timeStamping OBJECT IDENTIFIER ::= { id-ad 3 } 54id-ad-caRepository OBJECT IDENTIFIER ::= { id-ad 5 } 55 56-- attribute data types 57 58Attribute ::= SEQUENCE { 59 type AttributeType, 60 values SET OF AttributeValue } 61 -- at least one value is required 62 63AttributeType ::= OBJECT IDENTIFIER 64 65AttributeValue ::= ANY 66 67AttributeTypeAndValue ::= SEQUENCE { 68 type AttributeType, 69 value AttributeValue } 70 71-- suggested naming attributes: Definition of the following 72-- information object set may be augmented to meet local 73-- requirements. Note that deleting members of the set may 74-- prevent interoperability with conforming implementations. 75-- presented in pairs: the AttributeType followed by the 76-- type definition for the corresponding AttributeValue 77--Arc for standard naming attributes 78id-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 } 79 80-- Naming attributes of type X520name 81 82id-at-name AttributeType ::= { id-at 41 } 83id-at-surname AttributeType ::= { id-at 4 } 84id-at-givenName AttributeType ::= { id-at 42 } 85id-at-initials AttributeType ::= { id-at 43 } 86id-at-generationQualifier AttributeType ::= { id-at 44 } 87 88X520name ::= CHOICE { 89 teletexString TeletexString (SIZE (1..ub-name)), 90 printableString PrintableString (SIZE (1..ub-name)), 91 universalString UniversalString (SIZE (1..ub-name)), 92 utf8String UTF8String (SIZE (1..ub-name)), 93 bmpString BMPString (SIZE (1..ub-name)) } 94 95-- Naming attributes of type X520CommonName 96 97id-at-commonName AttributeType ::= { id-at 3 } 98 99X520CommonName ::= CHOICE { 100 teletexString TeletexString (SIZE (1..ub-common-name)), 101 printableString PrintableString (SIZE (1..ub-common-name)), 102 universalString UniversalString (SIZE (1..ub-common-name)), 103 utf8String UTF8String (SIZE (1..ub-common-name)), 104 bmpString BMPString (SIZE (1..ub-common-name)) } 105 106-- Naming attributes of type X520LocalityName 107 108id-at-localityName AttributeType ::= { id-at 7 } 109 110X520LocalityName ::= CHOICE { 111 teletexString TeletexString (SIZE (1..ub-locality-name)), 112 printableString PrintableString (SIZE (1..ub-locality-name)), 113 universalString UniversalString (SIZE (1..ub-locality-name)), 114 utf8String UTF8String (SIZE (1..ub-locality-name)), 115 bmpString BMPString (SIZE (1..ub-locality-name)) } 116 117-- Naming attributes of type X520StateOrProvinceName 118 119id-at-stateOrProvinceName AttributeType ::= { id-at 8 } 120 121X520StateOrProvinceName ::= CHOICE { 122 teletexString TeletexString (SIZE (1..ub-state-name)), 123 printableString PrintableString (SIZE (1..ub-state-name)), 124 universalString UniversalString (SIZE (1..ub-state-name)), 125 utf8String UTF8String (SIZE (1..ub-state-name)), 126 bmpString BMPString (SIZE(1..ub-state-name)) } 127 128-- Naming attributes of type X520OrganizationName 129 130id-at-organizationName AttributeType ::= { id-at 10 } 131 132X520OrganizationName ::= CHOICE { 133 teletexString TeletexString 134 (SIZE (1..ub-organization-name)), 135 printableString PrintableString 136 (SIZE (1..ub-organization-name)), 137 universalString UniversalString 138 (SIZE (1..ub-organization-name)), 139 utf8String UTF8String 140 (SIZE (1..ub-organization-name)), 141 bmpString BMPString 142 (SIZE (1..ub-organization-name)) } 143 144-- Naming attributes of type X520OrganizationalUnitName 145 146id-at-organizationalUnitName AttributeType ::= { id-at 11 } 147 148X520OrganizationalUnitName ::= CHOICE { 149 teletexString TeletexString 150 (SIZE (1..ub-organizational-unit-name)), 151 printableString PrintableString 152 (SIZE (1..ub-organizational-unit-name)), 153 universalString UniversalString 154 (SIZE (1..ub-organizational-unit-name)), 155 utf8String UTF8String 156 (SIZE (1..ub-organizational-unit-name)), 157 bmpString BMPString 158 (SIZE (1..ub-organizational-unit-name)) } 159 160-- Naming attributes of type X520Title 161 162id-at-title AttributeType ::= { id-at 12 } 163 164X520Title ::= CHOICE { 165 teletexString TeletexString (SIZE (1..ub-title)), 166 printableString PrintableString (SIZE (1..ub-title)), 167 universalString UniversalString (SIZE (1..ub-title)), 168 utf8String UTF8String (SIZE (1..ub-title)), 169 bmpString BMPString (SIZE (1..ub-title)) } 170 171-- Naming attributes of type X520dnQualifier 172 173id-at-dnQualifier AttributeType ::= { id-at 46 } 174 175X520dnQualifier ::= PrintableString 176 177-- Naming attributes of type X520countryName (digraph from IS 3166) 178 179id-at-countryName AttributeType ::= { id-at 6 } 180 181X520countryName ::= PrintableString (SIZE (2)) 182 183-- Naming attributes of type X520SerialNumber 184 185id-at-serialNumber AttributeType ::= { id-at 5 } 186 187X520SerialNumber ::= PrintableString (SIZE (1..ub-serial-number)) 188 189-- Naming attributes of type X520Pseudonym 190 191id-at-pseudonym AttributeType ::= { id-at 65 } 192 193X520Pseudonym ::= CHOICE { 194 teletexString TeletexString (SIZE (1..ub-pseudonym)), 195 printableString PrintableString (SIZE (1..ub-pseudonym)), 196 universalString UniversalString (SIZE (1..ub-pseudonym)), 197 utf8String UTF8String (SIZE (1..ub-pseudonym)), 198 bmpString BMPString (SIZE (1..ub-pseudonym)) } 199 200-- Naming attributes of type DomainComponent (from RFC 2247) 201 202id-domainComponent AttributeType ::= 203 { 0 9 2342 19200300 100 1 25 } 204 205DomainComponent ::= IA5String 206 207-- Legacy attributes 208 209pkcs-9 OBJECT IDENTIFIER ::= 210 { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 9 } 211 212id-emailAddress AttributeType ::= { pkcs-9 1 } 213 214EmailAddress ::= IA5String (SIZE (1..ub-emailaddress-length)) 215 216-- naming data types -- 217 218Name ::= CHOICE { -- only one possibility for now -- 219 rdnSequence RDNSequence } 220 221RDNSequence ::= SEQUENCE OF RelativeDistinguishedName 222 223DistinguishedName ::= RDNSequence 224 225RelativeDistinguishedName ::= 226 SET SIZE (1 .. MAX) OF AttributeTypeAndValue 227 228-- Directory string type -- 229 230DirectoryString ::= CHOICE { 231 teletexString TeletexString (SIZE (1..MAX)), 232 printableString PrintableString (SIZE (1..MAX)), 233 universalString UniversalString (SIZE (1..MAX)), 234 utf8String UTF8String (SIZE (1..MAX)), 235 bmpString BMPString (SIZE (1..MAX)) } 236 237-- certificate and CRL specific structures begin here 238 239Certificate ::= SEQUENCE { 240 tbsCertificate TBSCertificate, 241 signatureAlgorithm AlgorithmIdentifier, 242 signature BIT STRING } 243 244TBSCertificate ::= SEQUENCE { 245 version [0] Version DEFAULT v1, 246 serialNumber CertificateSerialNumber, 247 signature AlgorithmIdentifier, 248 issuer Name, 249 validity Validity, 250 subject Name, 251 subjectPublicKeyInfo SubjectPublicKeyInfo, 252 issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, 253 -- If present, version MUST be v2 or v3 254 subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, 255 -- If present, version MUST be v2 or v3 256 extensions [3] Extensions OPTIONAL 257 -- If present, version MUST be v3 -- } 258 259Version ::= INTEGER { v1(0), v2(1), v3(2) } 260 261CertificateSerialNumber ::= INTEGER 262 263Validity ::= SEQUENCE { 264 notBefore Time, 265 notAfter Time } 266 267Time ::= CHOICE { 268 utcTime UTCTime, 269 generalTime GeneralizedTime } 270 271UniqueIdentifier ::= BIT STRING 272 273SubjectPublicKeyInfo ::= SEQUENCE { 274 algorithm AlgorithmIdentifier, 275 subjectPublicKey BIT STRING } 276 277Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension 278 279Extension ::= SEQUENCE { 280 extnID OBJECT IDENTIFIER, 281 critical BOOLEAN DEFAULT FALSE, 282 extnValue OCTET STRING } 283 284-- CRL structures 285 286CertificateList ::= SEQUENCE { 287 tbsCertList TBSCertList, 288 signatureAlgorithm AlgorithmIdentifier, 289 signature BIT STRING } 290 291TBSCertList ::= SEQUENCE { 292 version Version OPTIONAL, 293 -- if present, MUST be v2 294 signature AlgorithmIdentifier, 295 issuer Name, 296 thisUpdate Time, 297 nextUpdate Time OPTIONAL, 298 revokedCertificates SEQUENCE OF SEQUENCE { 299 userCertificate CertificateSerialNumber, 300 revocationDate Time, 301 crlEntryExtensions Extensions OPTIONAL 302 -- if present, MUST be v2 303 } OPTIONAL, 304 crlExtensions [0] Extensions OPTIONAL } 305 -- if present, MUST be v2 306 307-- Version, Time, CertificateSerialNumber, and Extensions were 308-- defined earlier for use in the certificate structure 309 310AlgorithmIdentifier ::= SEQUENCE { 311 algorithm OBJECT IDENTIFIER, 312 parameters ANY DEFINED BY algorithm OPTIONAL } 313 -- contains a value of the type 314 -- registered for use with the 315 -- algorithm object identifier value 316 317-- X.400 address syntax starts here 318 319ORAddress ::= SEQUENCE { 320 built-in-standard-attributes BuiltInStandardAttributes, 321 built-in-domain-defined-attributes 322 BuiltInDomainDefinedAttributes OPTIONAL, 323 -- see also teletex-domain-defined-attributes 324 extension-attributes ExtensionAttributes OPTIONAL } 325 326-- Built-in Standard Attributes 327 328BuiltInStandardAttributes ::= SEQUENCE { 329 country-name CountryName OPTIONAL, 330 administration-domain-name AdministrationDomainName OPTIONAL, 331 network-address [0] IMPLICIT NetworkAddress OPTIONAL, 332 -- see also extended-network-address 333 terminal-identifier [1] IMPLICIT TerminalIdentifier OPTIONAL, 334 private-domain-name [2] PrivateDomainName OPTIONAL, 335 organization-name [3] IMPLICIT OrganizationName OPTIONAL, 336 -- see also teletex-organization-name 337 numeric-user-identifier [4] IMPLICIT NumericUserIdentifier 338 OPTIONAL, 339 personal-name [5] IMPLICIT PersonalName OPTIONAL, 340 -- see also teletex-personal-name 341 organizational-unit-names [6] IMPLICIT OrganizationalUnitNames 342 OPTIONAL } 343 -- see also teletex-organizational-unit-names 344 345CountryName ::= [APPLICATION 1] CHOICE { 346 x121-dcc-code NumericString 347 (SIZE (ub-country-name-numeric-length)), 348 iso-3166-alpha2-code PrintableString 349 (SIZE (ub-country-name-alpha-length)) } 350 351AdministrationDomainName ::= [APPLICATION 2] CHOICE { 352 numeric NumericString (SIZE (0..ub-domain-name-length)), 353 printable PrintableString (SIZE (0..ub-domain-name-length)) } 354 355NetworkAddress ::= X121Address -- see also extended-network-address 356 357X121Address ::= NumericString (SIZE (1..ub-x121-address-length)) 358 359TerminalIdentifier ::= PrintableString (SIZE 360(1..ub-terminal-id-length)) 361 362PrivateDomainName ::= CHOICE { 363 numeric NumericString (SIZE (1..ub-domain-name-length)), 364 printable PrintableString (SIZE (1..ub-domain-name-length)) } 365 366OrganizationName ::= PrintableString 367 (SIZE (1..ub-organization-name-length)) 368 -- see also teletex-organization-name 369 370NumericUserIdentifier ::= NumericString 371 (SIZE (1..ub-numeric-user-id-length)) 372 373PersonalName ::= SET { 374 surname [0] IMPLICIT PrintableString 375 (SIZE (1..ub-surname-length)), 376 given-name [1] IMPLICIT PrintableString 377 (SIZE (1..ub-given-name-length)) OPTIONAL, 378 initials [2] IMPLICIT PrintableString 379 (SIZE (1..ub-initials-length)) OPTIONAL, 380 generation-qualifier [3] IMPLICIT PrintableString 381 (SIZE (1..ub-generation-qualifier-length)) 382 OPTIONAL } 383 -- see also teletex-personal-name 384 385OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units) 386 OF OrganizationalUnitName 387 -- see also teletex-organizational-unit-names 388 389OrganizationalUnitName ::= PrintableString (SIZE 390 (1..ub-organizational-unit-name-length)) 391 392-- Built-in Domain-defined Attributes 393 394BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE 395 (1..ub-domain-defined-attributes) OF 396 BuiltInDomainDefinedAttribute 397 398BuiltInDomainDefinedAttribute ::= SEQUENCE { 399 type PrintableString (SIZE 400 (1..ub-domain-defined-attribute-type-length)), 401 value PrintableString (SIZE 402 (1..ub-domain-defined-attribute-value-length)) } 403 404-- Extension Attributes 405 406ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF 407 ExtensionAttribute 408 409ExtensionAttribute ::= SEQUENCE { 410 extension-attribute-type [0] IMPLICIT INTEGER 411 (0..ub-extension-attributes), 412 extension-attribute-value [1] 413 ANY DEFINED BY extension-attribute-type } 414 415-- Extension types and attribute values 416 417common-name INTEGER ::= 1 418 419CommonName ::= PrintableString (SIZE (1..ub-common-name-length)) 420 421teletex-common-name INTEGER ::= 2 422 423TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length)) 424 425teletex-organization-name INTEGER ::= 3 426 427TeletexOrganizationName ::= 428 TeletexString (SIZE (1..ub-organization-name-length)) 429 430teletex-personal-name INTEGER ::= 4 431 432TeletexPersonalName ::= SET { 433 surname [0] IMPLICIT TeletexString 434 (SIZE (1..ub-surname-length)), 435 given-name [1] IMPLICIT TeletexString 436 (SIZE (1..ub-given-name-length)) OPTIONAL, 437 initials [2] IMPLICIT TeletexString 438 (SIZE (1..ub-initials-length)) OPTIONAL, 439 generation-qualifier [3] IMPLICIT TeletexString 440 (SIZE (1..ub-generation-qualifier-length)) 441 OPTIONAL } 442 443teletex-organizational-unit-names INTEGER ::= 5 444 445TeletexOrganizationalUnitNames ::= SEQUENCE SIZE 446 (1..ub-organizational-units) OF TeletexOrganizationalUnitName 447 448TeletexOrganizationalUnitName ::= TeletexString 449 (SIZE (1..ub-organizational-unit-name-length)) 450 451pds-name INTEGER ::= 7 452 453PDSName ::= PrintableString (SIZE (1..ub-pds-name-length)) 454 455physical-delivery-country-name INTEGER ::= 8 456 457PhysicalDeliveryCountryName ::= CHOICE { 458 x121-dcc-code NumericString (SIZE 459(ub-country-name-numeric-length)), 460 iso-3166-alpha2-code PrintableString 461 (SIZE (ub-country-name-alpha-length)) } 462 463postal-code INTEGER ::= 9 464 465PostalCode ::= CHOICE { 466 numeric-code NumericString (SIZE (1..ub-postal-code-length)), 467 printable-code PrintableString (SIZE (1..ub-postal-code-length)) } 468 469physical-delivery-office-name INTEGER ::= 10 470 471PhysicalDeliveryOfficeName ::= PDSParameter 472 473physical-delivery-office-number INTEGER ::= 11 474 475PhysicalDeliveryOfficeNumber ::= PDSParameter 476 477extension-OR-address-components INTEGER ::= 12 478 479ExtensionORAddressComponents ::= PDSParameter 480 481physical-delivery-personal-name INTEGER ::= 13 482 483PhysicalDeliveryPersonalName ::= PDSParameter 484 485physical-delivery-organization-name INTEGER ::= 14 486 487PhysicalDeliveryOrganizationName ::= PDSParameter 488 489extension-physical-delivery-address-components INTEGER ::= 15 490 491ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter 492 493unformatted-postal-address INTEGER ::= 16 494 495UnformattedPostalAddress ::= SET { 496 printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) 497 OF PrintableString (SIZE (1..ub-pds-parameter-length)) 498 OPTIONAL, 499 teletex-string TeletexString 500 (SIZE (1..ub-unformatted-address-length)) OPTIONAL } 501 502street-address INTEGER ::= 17 503 504StreetAddress ::= PDSParameter 505 506post-office-box-address INTEGER ::= 18 507 508PostOfficeBoxAddress ::= PDSParameter 509 510poste-restante-address INTEGER ::= 19 511 512PosteRestanteAddress ::= PDSParameter 513 514unique-postal-name INTEGER ::= 20 515 516UniquePostalName ::= PDSParameter 517 518local-postal-attributes INTEGER ::= 21 519 520LocalPostalAttributes ::= PDSParameter 521 522PDSParameter ::= SET { 523 printable-string PrintableString 524 (SIZE(1..ub-pds-parameter-length)) OPTIONAL, 525 teletex-string TeletexString 526 (SIZE(1..ub-pds-parameter-length)) OPTIONAL } 527 528extended-network-address INTEGER ::= 22 529 530ExtendedNetworkAddress ::= CHOICE { 531 e163-4-address SEQUENCE { 532 number [0] IMPLICIT NumericString 533 (SIZE (1..ub-e163-4-number-length)), 534 sub-address [1] IMPLICIT NumericString 535 (SIZE (1..ub-e163-4-sub-address-length)) 536 OPTIONAL }, 537 psap-address [0] IMPLICIT PresentationAddress } 538 539PresentationAddress ::= SEQUENCE { 540 pSelector [0] EXPLICIT OCTET STRING OPTIONAL, 541 sSelector [1] EXPLICIT OCTET STRING OPTIONAL, 542 tSelector [2] EXPLICIT OCTET STRING OPTIONAL, 543 nAddresses [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING } 544 545terminal-type INTEGER ::= 23 546 547TerminalType ::= INTEGER { 548 telex (3), 549 teletex (4), 550 g3-facsimile (5), 551 g4-facsimile (6), 552 ia5-terminal (7), 553 videotex (8) } (0..ub-integer-options) 554 555-- Extension Domain-defined Attributes 556 557teletex-domain-defined-attributes INTEGER ::= 6 558 559TeletexDomainDefinedAttributes ::= SEQUENCE SIZE 560 (1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute 561 562TeletexDomainDefinedAttribute ::= SEQUENCE { 563 type TeletexString 564 (SIZE (1..ub-domain-defined-attribute-type-length)), 565 value TeletexString 566 (SIZE (1..ub-domain-defined-attribute-value-length)) } 567 568-- specifications of Upper Bounds MUST be regarded as mandatory 569-- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter 570-- Upper Bounds 571 572-- Upper Bounds 573ub-name INTEGER ::= 32768 574ub-common-name INTEGER ::= 64 575ub-locality-name INTEGER ::= 128 576ub-state-name INTEGER ::= 128 577ub-organization-name INTEGER ::= 64 578ub-organizational-unit-name INTEGER ::= 64 579ub-title INTEGER ::= 64 580ub-serial-number INTEGER ::= 64 581ub-match INTEGER ::= 128 582ub-emailaddress-length INTEGER ::= 128 583ub-common-name-length INTEGER ::= 64 584ub-country-name-alpha-length INTEGER ::= 2 585ub-country-name-numeric-length INTEGER ::= 3 586ub-domain-defined-attributes INTEGER ::= 4 587ub-domain-defined-attribute-type-length INTEGER ::= 8 588ub-domain-defined-attribute-value-length INTEGER ::= 128 589ub-domain-name-length INTEGER ::= 16 590ub-extension-attributes INTEGER ::= 256 591ub-e163-4-number-length INTEGER ::= 15 592ub-e163-4-sub-address-length INTEGER ::= 40 593ub-generation-qualifier-length INTEGER ::= 3 594ub-given-name-length INTEGER ::= 16 595ub-initials-length INTEGER ::= 5 596ub-integer-options INTEGER ::= 256 597ub-numeric-user-id-length INTEGER ::= 32 598ub-organization-name-length INTEGER ::= 64 599ub-organizational-unit-name-length INTEGER ::= 32 600ub-organizational-units INTEGER ::= 4 601ub-pds-name-length INTEGER ::= 16 602ub-pds-parameter-length INTEGER ::= 30 603ub-pds-physical-address-lines INTEGER ::= 6 604ub-postal-code-length INTEGER ::= 16 605ub-pseudonym INTEGER ::= 128 606ub-surname-length INTEGER ::= 40 607ub-terminal-id-length INTEGER ::= 24 608ub-unformatted-address-length INTEGER ::= 180 609ub-x121-address-length INTEGER ::= 16 610 611-- Note - upper bounds on string types, such as TeletexString, are 612-- measured in characters. Excepting PrintableString or IA5String, a 613-- significantly greater number of octets will be required to hold 614-- such a value. As a minimum, 16 octets, or twice the specified 615-- upper bound, whichever is the larger, should be allowed for 616-- TeletexString. For UTF8String or UniversalString at least four 617-- times the upper bound should be allowed. 618 619END 620