Merge remote-tracking branch 'aosp/upstream-master' into merge-152-from-upstream

As to set a common ancestor for future merges from aosp/upstream-master
(when updating to new versions of bouncycastle).

We'll override all the changes of this commit with patch
https://android-review.googlesource.com/#/c/199872

Change-Id: I53a7f797b520a6e119878dbae53246cdcc585ddf

26 files changed, 2135 insertions, 0 deletions

diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIdentifier.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIdentifier.java
new file mode 100644
index 0000000..be52e45
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIdentifier.java
@@ -0,0 +1,14 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+
+public interface CommitmentTypeIdentifier
+{
+    public static final ASN1ObjectIdentifier proofOfOrigin = PKCSObjectIdentifiers.id_cti_ets_proofOfOrigin;
+    public static final ASN1ObjectIdentifier proofOfReceipt = PKCSObjectIdentifiers.id_cti_ets_proofOfReceipt;
+    public static final ASN1ObjectIdentifier proofOfDelivery = PKCSObjectIdentifiers.id_cti_ets_proofOfDelivery;
+    public static final ASN1ObjectIdentifier proofOfSender = PKCSObjectIdentifiers.id_cti_ets_proofOfSender;
+    public static final ASN1ObjectIdentifier proofOfApproval = PKCSObjectIdentifiers.id_cti_ets_proofOfApproval;
+    public static final ASN1ObjectIdentifier proofOfCreation = PKCSObjectIdentifiers.id_cti_ets_proofOfCreation;
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIndication.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIndication.java
new file mode 100644
index 0000000..9e2533d
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeIndication.java
@@ -0,0 +1,83 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+public class CommitmentTypeIndication
+    extends ASN1Object
+{
+    private ASN1ObjectIdentifier   commitmentTypeId;
+    private ASN1Sequence          commitmentTypeQualifier;
+    
+    private CommitmentTypeIndication(
+        ASN1Sequence seq)
+    {
+        commitmentTypeId = (ASN1ObjectIdentifier)seq.getObjectAt(0);
+
+        if (seq.size() > 1)
+        {
+            commitmentTypeQualifier = (ASN1Sequence)seq.getObjectAt(1);
+        }
+    }
+
+    public CommitmentTypeIndication(
+        ASN1ObjectIdentifier commitmentTypeId)
+    {
+        this.commitmentTypeId = commitmentTypeId;
+    }
+
+    public CommitmentTypeIndication(
+        ASN1ObjectIdentifier commitmentTypeId,
+        ASN1Sequence        commitmentTypeQualifier)
+    {
+        this.commitmentTypeId = commitmentTypeId;
+        this.commitmentTypeQualifier = commitmentTypeQualifier;
+    }
+
+    public static CommitmentTypeIndication getInstance(
+        Object obj)
+    {
+        if (obj == null || obj instanceof CommitmentTypeIndication)
+        {
+            return (CommitmentTypeIndication)obj;
+        }
+
+        return new CommitmentTypeIndication(ASN1Sequence.getInstance(obj));
+    }
+
+    public ASN1ObjectIdentifier getCommitmentTypeId()
+    {
+        return commitmentTypeId;
+    }
+    
+    public ASN1Sequence getCommitmentTypeQualifier()
+    {
+        return commitmentTypeQualifier;
+    }
+    
+    /**
+     * <pre>
+     * CommitmentTypeIndication ::= SEQUENCE {
+     *      commitmentTypeId   CommitmentTypeIdentifier,
+     *      commitmentTypeQualifier   SEQUENCE SIZE (1..MAX) OF
+     *              CommitmentTypeQualifier OPTIONAL }
+     * </pre>
+     */ 
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        
+        v.add(commitmentTypeId);
+
+        if (commitmentTypeQualifier != null)
+        {
+            v.add(commitmentTypeQualifier);
+        }
+        
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeQualifier.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeQualifier.java
new file mode 100644
index 0000000..2cbba92
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CommitmentTypeQualifier.java
@@ -0,0 +1,108 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * Commitment type qualifiers, used in the Commitment-Type-Indication attribute (RFC3126).
+ * 
+ * <pre>
+ *   CommitmentTypeQualifier ::= SEQUENCE {
+ *       commitmentTypeIdentifier  CommitmentTypeIdentifier,
+ *       qualifier          ANY DEFINED BY commitmentTypeIdentifier OPTIONAL }
+ * </pre>
+ */
+public class CommitmentTypeQualifier
+    extends ASN1Object
+{
+   private ASN1ObjectIdentifier commitmentTypeIdentifier;
+   private ASN1Encodable qualifier;
+
+   /**
+    * Creates a new <code>CommitmentTypeQualifier</code> instance.
+    *
+    * @param commitmentTypeIdentifier a <code>CommitmentTypeIdentifier</code> value
+    */
+    public CommitmentTypeQualifier(
+        ASN1ObjectIdentifier commitmentTypeIdentifier)
+    {
+        this(commitmentTypeIdentifier, null);
+    }
+    
+   /**
+    * Creates a new <code>CommitmentTypeQualifier</code> instance.
+    *
+    * @param commitmentTypeIdentifier a <code>CommitmentTypeIdentifier</code> value
+    * @param qualifier the qualifier, defined by the above field.
+    */
+    public CommitmentTypeQualifier(
+        ASN1ObjectIdentifier commitmentTypeIdentifier,
+        ASN1Encodable qualifier)
+    {
+        this.commitmentTypeIdentifier = commitmentTypeIdentifier;
+        this.qualifier = qualifier;
+    }
+
+    /**
+     * Creates a new <code>CommitmentTypeQualifier</code> instance.
+     *
+     * @param as <code>CommitmentTypeQualifier</code> structure
+     * encoded as an ASN1Sequence. 
+     */
+    private CommitmentTypeQualifier(
+        ASN1Sequence as)
+    {
+        commitmentTypeIdentifier = (ASN1ObjectIdentifier)as.getObjectAt(0);
+        
+        if (as.size() > 1)
+        {
+            qualifier = as.getObjectAt(1);
+        }
+    }
+
+    public static CommitmentTypeQualifier getInstance(Object as)
+    {
+        if (as instanceof CommitmentTypeQualifier)
+        {
+            return (CommitmentTypeQualifier)as;
+        }
+        else if (as != null)
+        {
+            return new CommitmentTypeQualifier(ASN1Sequence.getInstance(as));
+        }
+
+        return null;
+    }
+
+    public ASN1ObjectIdentifier getCommitmentTypeIdentifier()
+    {
+        return commitmentTypeIdentifier;
+    }
+    
+    public ASN1Encodable getQualifier()
+    {
+        return qualifier;
+    }
+
+   /**
+    * Returns a DER-encodable representation of this instance. 
+    *
+    * @return a <code>ASN1Primitive</code> value
+    */
+   public ASN1Primitive toASN1Primitive()
+   {
+      ASN1EncodableVector dev = new ASN1EncodableVector();
+      dev.add(commitmentTypeIdentifier);
+      if (qualifier != null)
+      {
+          dev.add(qualifier);
+      }
+
+      return new DERSequence(dev);
+   }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CompleteRevocationRefs.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CompleteRevocationRefs.java
new file mode 100644
index 0000000..4e81f29
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CompleteRevocationRefs.java
@@ -0,0 +1,65 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * CompleteRevocationRefs ::= SEQUENCE OF CrlOcspRef
+ * </pre>
+ */
+public class CompleteRevocationRefs
+    extends ASN1Object
+{
+
+    private ASN1Sequence crlOcspRefs;
+
+    public static CompleteRevocationRefs getInstance(Object obj)
+    {
+        if (obj instanceof CompleteRevocationRefs)
+        {
+            return (CompleteRevocationRefs)obj;
+        }
+        else if (obj != null)
+        {
+            return new CompleteRevocationRefs(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private CompleteRevocationRefs(ASN1Sequence seq)
+    {
+        Enumeration seqEnum = seq.getObjects();
+        while (seqEnum.hasMoreElements())
+        {
+            CrlOcspRef.getInstance(seqEnum.nextElement());
+        }
+        this.crlOcspRefs = seq;
+    }
+
+    public CompleteRevocationRefs(CrlOcspRef[] crlOcspRefs)
+    {
+        this.crlOcspRefs = new DERSequence(crlOcspRefs);
+    }
+
+    public CrlOcspRef[] getCrlOcspRefs()
+    {
+        CrlOcspRef[] result = new CrlOcspRef[this.crlOcspRefs.size()];
+        for (int idx = 0; idx < result.length; idx++)
+        {
+            result[idx] = CrlOcspRef.getInstance(this.crlOcspRefs
+                .getObjectAt(idx));
+        }
+        return result;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        return this.crlOcspRefs;
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlIdentifier.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlIdentifier.java
new file mode 100644
index 0000000..6800418
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlIdentifier.java
@@ -0,0 +1,106 @@
+package org.bouncycastle.asn1.esf;
+
+import java.math.BigInteger;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1UTCTime;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x500.X500Name;
+
+/**
+ * <pre>
+ *  CrlIdentifier ::= SEQUENCE 
+ * {
+ *   crlissuer    Name,
+ *   crlIssuedTime  UTCTime,
+ *   crlNumber    INTEGER OPTIONAL
+ * }
+ * </pre>
+ */
+public class CrlIdentifier
+    extends ASN1Object
+{
+    private X500Name crlIssuer;
+    private ASN1UTCTime crlIssuedTime;
+    private ASN1Integer crlNumber;
+
+    public static CrlIdentifier getInstance(Object obj)
+    {
+        if (obj instanceof CrlIdentifier)
+        {
+            return (CrlIdentifier)obj;
+        }
+        else if (obj != null)
+        {
+            return new CrlIdentifier(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private CrlIdentifier(ASN1Sequence seq)
+    {
+        if (seq.size() < 2 || seq.size() > 3)
+        {
+            throw new IllegalArgumentException();
+        }
+        this.crlIssuer = X500Name.getInstance(seq.getObjectAt(0));
+        this.crlIssuedTime = ASN1UTCTime.getInstance(seq.getObjectAt(1));
+        if (seq.size() > 2)
+        {
+            this.crlNumber = ASN1Integer.getInstance(seq.getObjectAt(2));
+        }
+    }
+
+    public CrlIdentifier(X500Name crlIssuer, ASN1UTCTime crlIssuedTime)
+    {
+        this(crlIssuer, crlIssuedTime, null);
+    }
+
+    public CrlIdentifier(X500Name crlIssuer, ASN1UTCTime crlIssuedTime,
+                         BigInteger crlNumber)
+    {
+        this.crlIssuer = crlIssuer;
+        this.crlIssuedTime = crlIssuedTime;
+        if (null != crlNumber)
+        {
+            this.crlNumber = new ASN1Integer(crlNumber);
+        }
+    }
+
+    public X500Name getCrlIssuer()
+    {
+        return this.crlIssuer;
+    }
+
+    public ASN1UTCTime getCrlIssuedTime()
+    {
+        return this.crlIssuedTime;
+    }
+
+    public BigInteger getCrlNumber()
+    {
+        if (null == this.crlNumber)
+        {
+            return null;
+        }
+        return this.crlNumber.getValue();
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.crlIssuer.toASN1Primitive());
+        v.add(this.crlIssuedTime);
+        if (null != this.crlNumber)
+        {
+            v.add(this.crlNumber);
+        }
+        return new DERSequence(v);
+    }
+
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlListID.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlListID.java
new file mode 100644
index 0000000..c0cb333
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlListID.java
@@ -0,0 +1,66 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * CRLListID ::= SEQUENCE {
+ *     crls SEQUENCE OF CrlValidatedID }
+ * </pre>
+ */
+public class CrlListID
+    extends ASN1Object
+{
+
+    private ASN1Sequence crls;
+
+    public static CrlListID getInstance(Object obj)
+    {
+        if (obj instanceof CrlListID)
+        {
+            return (CrlListID)obj;
+        }
+        else if (obj != null)
+        {
+            return new CrlListID(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private CrlListID(ASN1Sequence seq)
+    {
+        this.crls = (ASN1Sequence)seq.getObjectAt(0);
+        Enumeration e = this.crls.getObjects();
+        while (e.hasMoreElements())
+        {
+            CrlValidatedID.getInstance(e.nextElement());
+        }
+    }
+
+    public CrlListID(CrlValidatedID[] crls)
+    {
+        this.crls = new DERSequence(crls);
+    }
+
+    public CrlValidatedID[] getCrls()
+    {
+        CrlValidatedID[] result = new CrlValidatedID[this.crls.size()];
+        for (int idx = 0; idx < result.length; idx++)
+        {
+            result[idx] = CrlValidatedID
+                .getInstance(this.crls.getObjectAt(idx));
+        }
+        return result;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        return new DERSequence(this.crls);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlOcspRef.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlOcspRef.java
new file mode 100644
index 0000000..39539f3
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlOcspRef.java
@@ -0,0 +1,106 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERTaggedObject;
+
+/**
+ * <pre>
+ * CrlOcspRef ::= SEQUENCE {
+ *     crlids [0] CRLListID OPTIONAL,
+ *     ocspids [1] OcspListID OPTIONAL,
+ *     otherRev [2] OtherRevRefs OPTIONAL
+ * }
+ * </pre>
+ */
+public class CrlOcspRef
+    extends ASN1Object
+{
+
+    private CrlListID crlids;
+    private OcspListID ocspids;
+    private OtherRevRefs otherRev;
+
+    public static CrlOcspRef getInstance(Object obj)
+    {
+        if (obj instanceof CrlOcspRef)
+        {
+            return (CrlOcspRef)obj;
+        }
+        else if (obj != null)
+        {
+            return new CrlOcspRef(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private CrlOcspRef(ASN1Sequence seq)
+    {
+        Enumeration e = seq.getObjects();
+        while (e.hasMoreElements())
+        {
+            DERTaggedObject o = (DERTaggedObject)e.nextElement();
+            switch (o.getTagNo())
+            {
+                case 0:
+                    this.crlids = CrlListID.getInstance(o.getObject());
+                    break;
+                case 1:
+                    this.ocspids = OcspListID.getInstance(o.getObject());
+                    break;
+                case 2:
+                    this.otherRev = OtherRevRefs.getInstance(o.getObject());
+                    break;
+                default:
+                    throw new IllegalArgumentException("illegal tag");
+            }
+        }
+    }
+
+    public CrlOcspRef(CrlListID crlids, OcspListID ocspids,
+                      OtherRevRefs otherRev)
+    {
+        this.crlids = crlids;
+        this.ocspids = ocspids;
+        this.otherRev = otherRev;
+    }
+
+    public CrlListID getCrlids()
+    {
+        return this.crlids;
+    }
+
+    public OcspListID getOcspids()
+    {
+        return this.ocspids;
+    }
+
+    public OtherRevRefs getOtherRev()
+    {
+        return this.otherRev;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        if (null != this.crlids)
+        {
+            v.add(new DERTaggedObject(true, 0, this.crlids.toASN1Primitive()));
+        }
+        if (null != this.ocspids)
+        {
+            v.add(new DERTaggedObject(true, 1, this.ocspids.toASN1Primitive()));
+        }
+        if (null != this.otherRev)
+        {
+            v.add(new DERTaggedObject(true, 2, this.otherRev.toASN1Primitive()));
+        }
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlValidatedID.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlValidatedID.java
new file mode 100644
index 0000000..b378aea
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/CrlValidatedID.java
@@ -0,0 +1,82 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * CrlValidatedID ::= SEQUENCE {
+ *   crlHash OtherHash,
+ *   crlIdentifier CrlIdentifier OPTIONAL }
+ * </pre>
+ */
+public class CrlValidatedID
+    extends ASN1Object
+{
+
+    private OtherHash crlHash;
+    private CrlIdentifier crlIdentifier;
+
+    public static CrlValidatedID getInstance(Object obj)
+    {
+        if (obj instanceof CrlValidatedID)
+        {
+            return (CrlValidatedID)obj;
+        }
+        else if (obj != null)
+        {
+            return new CrlValidatedID(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private CrlValidatedID(ASN1Sequence seq)
+    {
+        if (seq.size() < 1 || seq.size() > 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.crlHash = OtherHash.getInstance(seq.getObjectAt(0));
+        if (seq.size() > 1)
+        {
+            this.crlIdentifier = CrlIdentifier.getInstance(seq.getObjectAt(1));
+        }
+    }
+
+    public CrlValidatedID(OtherHash crlHash)
+    {
+        this(crlHash, null);
+    }
+
+    public CrlValidatedID(OtherHash crlHash, CrlIdentifier crlIdentifier)
+    {
+        this.crlHash = crlHash;
+        this.crlIdentifier = crlIdentifier;
+    }
+
+    public OtherHash getCrlHash()
+    {
+        return this.crlHash;
+    }
+
+    public CrlIdentifier getCrlIdentifier()
+    {
+        return this.crlIdentifier;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.crlHash.toASN1Primitive());
+        if (null != this.crlIdentifier)
+        {
+            v.add(this.crlIdentifier.toASN1Primitive());
+        }
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/ESFAttributes.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/ESFAttributes.java
new file mode 100644
index 0000000..ebdc5ea
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/ESFAttributes.java
@@ -0,0 +1,22 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+
+public interface ESFAttributes
+{
+    public static final ASN1ObjectIdentifier  sigPolicyId = PKCSObjectIdentifiers.id_aa_ets_sigPolicyId;
+    public static final ASN1ObjectIdentifier  commitmentType = PKCSObjectIdentifiers.id_aa_ets_commitmentType;
+    public static final ASN1ObjectIdentifier  signerLocation = PKCSObjectIdentifiers.id_aa_ets_signerLocation;
+    public static final ASN1ObjectIdentifier  signerAttr = PKCSObjectIdentifiers.id_aa_ets_signerAttr;
+    public static final ASN1ObjectIdentifier  otherSigCert = PKCSObjectIdentifiers.id_aa_ets_otherSigCert;
+    public static final ASN1ObjectIdentifier  contentTimestamp = PKCSObjectIdentifiers.id_aa_ets_contentTimestamp;
+    public static final ASN1ObjectIdentifier  certificateRefs = PKCSObjectIdentifiers.id_aa_ets_certificateRefs;
+    public static final ASN1ObjectIdentifier  revocationRefs = PKCSObjectIdentifiers.id_aa_ets_revocationRefs;
+    public static final ASN1ObjectIdentifier  certValues = PKCSObjectIdentifiers.id_aa_ets_certValues;
+    public static final ASN1ObjectIdentifier  revocationValues = PKCSObjectIdentifiers.id_aa_ets_revocationValues;
+    public static final ASN1ObjectIdentifier  escTimeStamp = PKCSObjectIdentifiers.id_aa_ets_escTimeStamp;
+    public static final ASN1ObjectIdentifier  certCRLTimestamp = PKCSObjectIdentifiers.id_aa_ets_certCRLTimestamp;
+    public static final ASN1ObjectIdentifier  archiveTimestamp = PKCSObjectIdentifiers.id_aa_ets_archiveTimestamp;
+    public static final ASN1ObjectIdentifier  archiveTimestampV2 = PKCSObjectIdentifiers.id_aa.branch("48");
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspIdentifier.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspIdentifier.java
new file mode 100644
index 0000000..a3c41d4
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspIdentifier.java
@@ -0,0 +1,73 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1GeneralizedTime;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.ocsp.ResponderID;
+
+/**
+ * <pre>
+ * OcspIdentifier ::= SEQUENCE {
+ *     ocspResponderID ResponderID, -- As in OCSP response data
+ *     producedAt GeneralizedTime -- As in OCSP response data
+ * }
+ * </pre>
+ */
+public class OcspIdentifier
+    extends ASN1Object
+{
+    private ResponderID ocspResponderID;
+    private ASN1GeneralizedTime producedAt;
+
+    public static OcspIdentifier getInstance(Object obj)
+    {
+        if (obj instanceof OcspIdentifier)
+        {
+            return (OcspIdentifier)obj;
+        }
+        else if (obj != null)
+        {
+            return new OcspIdentifier(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OcspIdentifier(ASN1Sequence seq)
+    {
+        if (seq.size() != 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.ocspResponderID = ResponderID.getInstance(seq.getObjectAt(0));
+        this.producedAt = (ASN1GeneralizedTime)seq.getObjectAt(1);
+    }
+
+    public OcspIdentifier(ResponderID ocspResponderID, ASN1GeneralizedTime producedAt)
+    {
+        this.ocspResponderID = ocspResponderID;
+        this.producedAt = producedAt;
+    }
+
+    public ResponderID getOcspResponderID()
+    {
+        return this.ocspResponderID;
+    }
+
+    public ASN1GeneralizedTime getProducedAt()
+    {
+        return this.producedAt;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.ocspResponderID);
+        v.add(this.producedAt);
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspListID.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspListID.java
new file mode 100644
index 0000000..349136f
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspListID.java
@@ -0,0 +1,72 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * OcspListID ::=  SEQUENCE {
+ *    ocspResponses  SEQUENCE OF OcspResponsesID
+ * }
+ * </pre>
+ */
+public class OcspListID
+    extends ASN1Object
+{
+    private ASN1Sequence ocspResponses;
+
+    public static OcspListID getInstance(Object obj)
+    {
+        if (obj instanceof OcspListID)
+        {
+            return (OcspListID)obj;
+        }
+        else if (obj != null)
+        {
+            return new OcspListID(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OcspListID(ASN1Sequence seq)
+    {
+        if (seq.size() != 1)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.ocspResponses = (ASN1Sequence)seq.getObjectAt(0);
+        Enumeration e = this.ocspResponses.getObjects();
+        while (e.hasMoreElements())
+        {
+            OcspResponsesID.getInstance(e.nextElement());
+        }
+    }
+
+    public OcspListID(OcspResponsesID[] ocspResponses)
+    {
+        this.ocspResponses = new DERSequence(ocspResponses);
+    }
+
+    public OcspResponsesID[] getOcspResponses()
+    {
+        OcspResponsesID[] result = new OcspResponsesID[this.ocspResponses
+            .size()];
+        for (int idx = 0; idx < result.length; idx++)
+        {
+            result[idx] = OcspResponsesID.getInstance(this.ocspResponses
+                .getObjectAt(idx));
+        }
+        return result;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        return new DERSequence(this.ocspResponses);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspResponsesID.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspResponsesID.java
new file mode 100644
index 0000000..2aac80e
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OcspResponsesID.java
@@ -0,0 +1,83 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * OcspResponsesID ::= SEQUENCE {
+ *    ocspIdentifier OcspIdentifier,
+ *    ocspRepHash OtherHash OPTIONAL
+ * }
+ * </pre>
+ */
+public class OcspResponsesID
+    extends ASN1Object
+{
+
+    private OcspIdentifier ocspIdentifier;
+    private OtherHash ocspRepHash;
+
+    public static OcspResponsesID getInstance(Object obj)
+    {
+        if (obj instanceof OcspResponsesID)
+        {
+            return (OcspResponsesID)obj;
+        }
+        else if (obj != null)
+        {
+            return new OcspResponsesID(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OcspResponsesID(ASN1Sequence seq)
+    {
+        if (seq.size() < 1 || seq.size() > 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.ocspIdentifier = OcspIdentifier.getInstance(seq.getObjectAt(0));
+        if (seq.size() > 1)
+        {
+            this.ocspRepHash = OtherHash.getInstance(seq.getObjectAt(1));
+        }
+    }
+
+    public OcspResponsesID(OcspIdentifier ocspIdentifier)
+    {
+        this(ocspIdentifier, null);
+    }
+
+    public OcspResponsesID(OcspIdentifier ocspIdentifier, OtherHash ocspRepHash)
+    {
+        this.ocspIdentifier = ocspIdentifier;
+        this.ocspRepHash = ocspRepHash;
+    }
+
+    public OcspIdentifier getOcspIdentifier()
+    {
+        return this.ocspIdentifier;
+    }
+
+    public OtherHash getOcspRepHash()
+    {
+        return this.ocspRepHash;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.ocspIdentifier);
+        if (null != this.ocspRepHash)
+        {
+            v.add(this.ocspRepHash);
+        }
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHash.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHash.java
new file mode 100644
index 0000000..0ec257d
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHash.java
@@ -0,0 +1,81 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1Choice;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+
+/**
+ * <pre>
+ * OtherHash ::= CHOICE {
+ *    sha1Hash  OtherHashValue, -- This contains a SHA-1 hash
+ *   otherHash  OtherHashAlgAndValue
+ *  }
+ * </pre>
+ */
+public class OtherHash
+    extends ASN1Object
+    implements ASN1Choice
+{
+
+    private ASN1OctetString sha1Hash;
+    private OtherHashAlgAndValue otherHash;
+
+    public static OtherHash getInstance(Object obj)
+    {
+        if (obj instanceof OtherHash)
+        {
+            return (OtherHash)obj;
+        }
+        if (obj instanceof ASN1OctetString)
+        {
+            return new OtherHash((ASN1OctetString)obj);
+        }
+        return new OtherHash(OtherHashAlgAndValue.getInstance(obj));
+    }
+
+    private OtherHash(ASN1OctetString sha1Hash)
+    {
+        this.sha1Hash = sha1Hash;
+    }
+
+    public OtherHash(OtherHashAlgAndValue otherHash)
+    {
+        this.otherHash = otherHash;
+    }
+
+    public OtherHash(byte[] sha1Hash)
+    {
+        this.sha1Hash = new DEROctetString(sha1Hash);
+    }
+
+    public AlgorithmIdentifier getHashAlgorithm()
+    {
+        if (null == this.otherHash)
+        {
+            return new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1);
+        }
+        return this.otherHash.getHashAlgorithm();
+    }
+
+    public byte[] getHashValue()
+    {
+        if (null == this.otherHash)
+        {
+            return this.sha1Hash.getOctets();
+        }
+        return this.otherHash.getHashValue().getOctets();
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        if (null == this.otherHash)
+        {
+            return this.sha1Hash;
+        }
+        return this.otherHash.toASN1Primitive();
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHashAlgAndValue.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHashAlgAndValue.java
new file mode 100644
index 0000000..34229d4
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherHashAlgAndValue.java
@@ -0,0 +1,81 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+
+public class OtherHashAlgAndValue
+    extends ASN1Object
+{
+    private AlgorithmIdentifier hashAlgorithm;
+    private ASN1OctetString     hashValue;
+
+
+    public static OtherHashAlgAndValue getInstance(
+        Object obj)
+    {
+        if (obj instanceof OtherHashAlgAndValue)
+        {
+            return (OtherHashAlgAndValue) obj;
+        }
+        else if (obj != null)
+        {
+            return new OtherHashAlgAndValue(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OtherHashAlgAndValue(
+        ASN1Sequence seq)
+    {
+        if (seq.size() != 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
+        hashAlgorithm = AlgorithmIdentifier.getInstance(seq.getObjectAt(0));
+        hashValue = ASN1OctetString.getInstance(seq.getObjectAt(1));
+    }
+
+    public OtherHashAlgAndValue(
+        AlgorithmIdentifier hashAlgorithm,
+        ASN1OctetString     hashValue)
+    {
+        this.hashAlgorithm = hashAlgorithm;
+        this.hashValue = hashValue;
+    }
+
+    public AlgorithmIdentifier getHashAlgorithm()
+    {
+        return hashAlgorithm;
+    }
+
+    public ASN1OctetString getHashValue()
+    {
+        return hashValue;
+    }
+
+    /**
+     * <pre>
+     * OtherHashAlgAndValue ::= SEQUENCE {
+     *     hashAlgorithm AlgorithmIdentifier,
+     *     hashValue OtherHashValue }
+     *
+     * OtherHashValue ::= OCTET STRING
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+
+        v.add(hashAlgorithm);
+        v.add(hashValue);
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevRefs.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevRefs.java
new file mode 100644
index 0000000..ed9a9b3
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevRefs.java
@@ -0,0 +1,87 @@
+package org.bouncycastle.asn1.esf;
+
+import java.io.IOException;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Encoding;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * OtherRevRefs ::= SEQUENCE {
+ *   otherRevRefType OtherRevRefType,
+ *   otherRevRefs ANY DEFINED BY otherRevRefType
+ * }
+ *
+ * OtherRevRefType ::= OBJECT IDENTIFIER
+ * </pre>
+ */
+public class OtherRevRefs
+    extends ASN1Object
+{
+
+    private ASN1ObjectIdentifier otherRevRefType;
+    private ASN1Encodable otherRevRefs;
+
+    public static OtherRevRefs getInstance(Object obj)
+    {
+        if (obj instanceof OtherRevRefs)
+        {
+            return (OtherRevRefs)obj;
+        }
+        else if (obj != null)
+        {
+            return new OtherRevRefs(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OtherRevRefs(ASN1Sequence seq)
+    {
+        if (seq.size() != 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.otherRevRefType = new ASN1ObjectIdentifier(((ASN1ObjectIdentifier)seq.getObjectAt(0)).getId());
+        try
+        {
+            this.otherRevRefs = ASN1Primitive.fromByteArray(seq.getObjectAt(1)
+                .toASN1Primitive().getEncoded(ASN1Encoding.DER));
+        }
+        catch (IOException e)
+        {
+            throw new IllegalStateException();
+        }
+    }
+
+    public OtherRevRefs(ASN1ObjectIdentifier otherRevRefType, ASN1Encodable otherRevRefs)
+    {
+        this.otherRevRefType = otherRevRefType;
+        this.otherRevRefs = otherRevRefs;
+    }
+
+    public ASN1ObjectIdentifier getOtherRevRefType()
+    {
+        return this.otherRevRefType;
+    }
+
+    public ASN1Encodable getOtherRevRefs()
+    {
+        return this.otherRevRefs;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.otherRevRefType);
+        v.add(this.otherRevRefs);
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevVals.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevVals.java
new file mode 100644
index 0000000..7389bdf
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/OtherRevVals.java
@@ -0,0 +1,89 @@
+package org.bouncycastle.asn1.esf;
+
+import java.io.IOException;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Encoding;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+/**
+ * <pre>
+ * OtherRevVals ::= SEQUENCE {
+ *    otherRevValType OtherRevValType,
+ *    otherRevVals ANY DEFINED BY OtherRevValType
+ * }
+ *
+ * OtherRevValType ::= OBJECT IDENTIFIER
+ * </pre>
+ */
+public class OtherRevVals
+    extends ASN1Object
+{
+
+    private ASN1ObjectIdentifier otherRevValType;
+
+    private ASN1Encodable otherRevVals;
+
+    public static OtherRevVals getInstance(Object obj)
+    {
+        if (obj instanceof OtherRevVals)
+        {
+            return (OtherRevVals)obj;
+        }
+        if (obj != null)
+        {
+            return new OtherRevVals(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private OtherRevVals(ASN1Sequence seq)
+    {
+        if (seq.size() != 2)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        this.otherRevValType = (ASN1ObjectIdentifier)seq.getObjectAt(0);
+        try
+        {
+            this.otherRevVals = ASN1Primitive.fromByteArray(seq.getObjectAt(1)
+                .toASN1Primitive().getEncoded(ASN1Encoding.DER));
+        }
+        catch (IOException e)
+        {
+            throw new IllegalStateException();
+        }
+    }
+
+    public OtherRevVals(ASN1ObjectIdentifier otherRevValType,
+                        ASN1Encodable otherRevVals)
+    {
+        this.otherRevValType = otherRevValType;
+        this.otherRevVals = otherRevVals;
+    }
+
+    public ASN1ObjectIdentifier getOtherRevValType()
+    {
+        return this.otherRevValType;
+    }
+
+    public ASN1Encodable getOtherRevVals()
+    {
+        return this.otherRevVals;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        v.add(this.otherRevValType);
+        v.add(this.otherRevVals);
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/RevocationValues.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/RevocationValues.java
new file mode 100644
index 0000000..9ff4113
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/RevocationValues.java
@@ -0,0 +1,151 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERTaggedObject;
+import org.bouncycastle.asn1.ocsp.BasicOCSPResponse;
+import org.bouncycastle.asn1.x509.CertificateList;
+
+/**
+ * <pre>
+ * RevocationValues ::= SEQUENCE {
+ *    crlVals [0] SEQUENCE OF CertificateList OPTIONAL,
+ *    ocspVals [1] SEQUENCE OF BasicOCSPResponse OPTIONAL,
+ *    otherRevVals [2] OtherRevVals OPTIONAL}
+ * </pre>
+ */
+public class RevocationValues
+    extends ASN1Object
+{
+
+    private ASN1Sequence crlVals;
+    private ASN1Sequence ocspVals;
+    private OtherRevVals otherRevVals;
+
+    public static RevocationValues getInstance(Object obj)
+    {
+        if (obj instanceof RevocationValues)
+        {
+            return (RevocationValues)obj;
+        }
+        else if (obj != null)
+        {
+            return new RevocationValues(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private RevocationValues(ASN1Sequence seq)
+    {
+        if (seq.size() > 3)
+        {
+            throw new IllegalArgumentException("Bad sequence size: "
+                + seq.size());
+        }
+        Enumeration e = seq.getObjects();
+        while (e.hasMoreElements())
+        {
+            DERTaggedObject o = (DERTaggedObject)e.nextElement();
+            switch (o.getTagNo())
+            {
+                case 0:
+                    ASN1Sequence crlValsSeq = (ASN1Sequence)o.getObject();
+                    Enumeration crlValsEnum = crlValsSeq.getObjects();
+                    while (crlValsEnum.hasMoreElements())
+                    {
+                        CertificateList.getInstance(crlValsEnum.nextElement());
+                    }
+                    this.crlVals = crlValsSeq;
+                    break;
+                case 1:
+                    ASN1Sequence ocspValsSeq = (ASN1Sequence)o.getObject();
+                    Enumeration ocspValsEnum = ocspValsSeq.getObjects();
+                    while (ocspValsEnum.hasMoreElements())
+                    {
+                        BasicOCSPResponse.getInstance(ocspValsEnum.nextElement());
+                    }
+                    this.ocspVals = ocspValsSeq;
+                    break;
+                case 2:
+                    this.otherRevVals = OtherRevVals.getInstance(o.getObject());
+                    break;
+                default:
+                    throw new IllegalArgumentException("invalid tag: "
+                        + o.getTagNo());
+            }
+        }
+    }
+
+    public RevocationValues(CertificateList[] crlVals,
+                            BasicOCSPResponse[] ocspVals, OtherRevVals otherRevVals)
+    {
+        if (null != crlVals)
+        {
+            this.crlVals = new DERSequence(crlVals);
+        }
+        if (null != ocspVals)
+        {
+            this.ocspVals = new DERSequence(ocspVals);
+        }
+        this.otherRevVals = otherRevVals;
+    }
+
+    public CertificateList[] getCrlVals()
+    {
+        if (null == this.crlVals)
+        {
+            return new CertificateList[0];
+        }
+        CertificateList[] result = new CertificateList[this.crlVals.size()];
+        for (int idx = 0; idx < result.length; idx++)
+        {
+            result[idx] = CertificateList.getInstance(this.crlVals
+                .getObjectAt(idx));
+        }
+        return result;
+    }
+
+    public BasicOCSPResponse[] getOcspVals()
+    {
+        if (null == this.ocspVals)
+        {
+            return new BasicOCSPResponse[0];
+        }
+        BasicOCSPResponse[] result = new BasicOCSPResponse[this.ocspVals.size()];
+        for (int idx = 0; idx < result.length; idx++)
+        {
+            result[idx] = BasicOCSPResponse.getInstance(this.ocspVals
+                .getObjectAt(idx));
+        }
+        return result;
+    }
+
+    public OtherRevVals getOtherRevVals()
+    {
+        return this.otherRevVals;
+    }
+
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        if (null != this.crlVals)
+        {
+            v.add(new DERTaggedObject(true, 0, this.crlVals));
+        }
+        if (null != this.ocspVals)
+        {
+            v.add(new DERTaggedObject(true, 1, this.ocspVals));
+        }
+        if (null != this.otherRevVals)
+        {
+            v.add(new DERTaggedObject(true, 2, this.otherRevVals.toASN1Primitive()));
+        }
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPUserNotice.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPUserNotice.java
new file mode 100644
index 0000000..c026cde
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPUserNotice.java
@@ -0,0 +1,99 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1String;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.x509.DisplayText;
+import org.bouncycastle.asn1.x509.NoticeReference;
+
+public class SPUserNotice
+    extends ASN1Object
+{
+    private NoticeReference noticeRef;
+    private DisplayText     explicitText;
+
+    public static SPUserNotice getInstance(
+        Object obj)
+    {
+        if (obj instanceof SPUserNotice)
+        {
+            return (SPUserNotice)obj;
+        }
+        else if (obj != null)
+        {
+            return new SPUserNotice(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private SPUserNotice(
+        ASN1Sequence seq)
+    {
+        Enumeration e = seq.getObjects();
+        while (e.hasMoreElements())
+        {
+            ASN1Encodable object = (ASN1Encodable)e.nextElement();
+            if (object instanceof DisplayText || object instanceof ASN1String)
+            {
+                explicitText = DisplayText.getInstance(object);
+            }
+            else if (object instanceof NoticeReference || object instanceof ASN1Sequence)
+            {
+                noticeRef = NoticeReference.getInstance(object);
+            }
+            else
+            {
+                throw new IllegalArgumentException("Invalid element in 'SPUserNotice': " + object.getClass().getName());
+            }
+        }
+    }
+
+    public SPUserNotice(
+        NoticeReference noticeRef,
+        DisplayText     explicitText)
+    {
+        this.noticeRef = noticeRef;
+        this.explicitText = explicitText;
+    }
+
+    public NoticeReference getNoticeRef()
+    {
+        return noticeRef;
+    }
+
+    public DisplayText getExplicitText()
+    {
+        return explicitText;
+    }
+
+    /**
+     * <pre>
+     * SPUserNotice ::= SEQUENCE {
+     *     noticeRef NoticeReference OPTIONAL,
+     *     explicitText DisplayText OPTIONAL }
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector  v = new ASN1EncodableVector();
+
+        if (noticeRef != null)
+        {
+            v.add(noticeRef);
+        }
+
+        if (explicitText != null)
+        {
+            v.add(explicitText);
+        }
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPuri.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPuri.java
new file mode 100644
index 0000000..2e2483d
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SPuri.java
@@ -0,0 +1,45 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.DERIA5String;
+
+public class SPuri
+{
+    private DERIA5String uri;
+
+    public static SPuri getInstance(
+        Object obj)
+    {
+        if (obj instanceof SPuri)
+        {
+            return (SPuri) obj;
+        }
+        else if (obj instanceof DERIA5String)
+        {
+            return new SPuri(DERIA5String.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    public SPuri(
+        DERIA5String uri)
+    {
+        this.uri = uri;
+    }
+
+    public DERIA5String getUri()
+    {
+        return uri;
+    }
+
+    /**
+     * <pre>
+     * SPuri ::= IA5String
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        return uri.toASN1Primitive();
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifierInfo.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifierInfo.java
new file mode 100644
index 0000000..3ce4836
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifierInfo.java
@@ -0,0 +1,75 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+public class SigPolicyQualifierInfo
+    extends ASN1Object
+{
+    private ASN1ObjectIdentifier  sigPolicyQualifierId;
+    private ASN1Encodable         sigQualifier;
+
+    public SigPolicyQualifierInfo(
+        ASN1ObjectIdentifier   sigPolicyQualifierId,
+        ASN1Encodable          sigQualifier)
+    {
+        this.sigPolicyQualifierId = sigPolicyQualifierId;
+        this.sigQualifier = sigQualifier;
+    }
+
+    private SigPolicyQualifierInfo(
+        ASN1Sequence seq)
+    {
+        sigPolicyQualifierId = ASN1ObjectIdentifier.getInstance(seq.getObjectAt(0));
+        sigQualifier = seq.getObjectAt(1);
+    }
+
+    public static SigPolicyQualifierInfo getInstance(
+        Object obj)
+    {
+        if (obj instanceof SigPolicyQualifierInfo)
+        {
+            return (SigPolicyQualifierInfo) obj;
+        }
+        else if (obj != null)
+        {
+            return new SigPolicyQualifierInfo(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    public ASN1ObjectIdentifier getSigPolicyQualifierId()
+    {
+        return new ASN1ObjectIdentifier(sigPolicyQualifierId.getId());
+    }
+
+    public ASN1Encodable getSigQualifier()
+    {
+        return sigQualifier;
+    }
+
+    /**
+     * <pre>
+     * SigPolicyQualifierInfo ::= SEQUENCE {
+     *    sigPolicyQualifierId SigPolicyQualifierId,
+     *    sigQualifier ANY DEFINED BY sigPolicyQualifierId }
+     *
+     * SigPolicyQualifierId ::= OBJECT IDENTIFIER
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector  v = new ASN1EncodableVector();
+
+        v.add(sigPolicyQualifierId);
+        v.add(sigQualifier);
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifiers.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifiers.java
new file mode 100644
index 0000000..453c6d0
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SigPolicyQualifiers.java
@@ -0,0 +1,77 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+public class SigPolicyQualifiers
+    extends ASN1Object
+{
+    ASN1Sequence qualifiers;
+
+    public static SigPolicyQualifiers getInstance(
+        Object obj)
+    {
+        if (obj instanceof SigPolicyQualifiers)
+        {
+            return (SigPolicyQualifiers) obj;
+        }
+        else if (obj instanceof ASN1Sequence)
+        {
+            return new SigPolicyQualifiers(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private SigPolicyQualifiers(
+        ASN1Sequence seq)
+    {
+        qualifiers = seq;
+    }
+
+    public SigPolicyQualifiers(
+        SigPolicyQualifierInfo[] qualifierInfos)
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        for (int i=0; i < qualifierInfos.length; i++)
+        {
+            v.add(qualifierInfos[i]);
+        }
+        qualifiers = new DERSequence(v);
+    }
+
+    /**
+     * Return the number of qualifier info elements present.
+     *
+     * @return number of elements present.
+     */
+    public int size()
+    {
+        return qualifiers.size();
+    }
+
+    /**
+     * Return the SigPolicyQualifierInfo at index i.
+     *
+     * @param i index of the info of interest
+     * @return the info at index i.
+     */
+    public SigPolicyQualifierInfo getInfoAt(
+        int i)
+    {
+        return SigPolicyQualifierInfo.getInstance(qualifiers.getObjectAt(i));
+    }
+
+    /**
+     * <pre>
+     * SigPolicyQualifiers ::= SEQUENCE SIZE (1..MAX) OF SigPolicyQualifierInfo
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        return qualifiers;
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyId.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyId.java
new file mode 100644
index 0000000..10b88f8
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyId.java
@@ -0,0 +1,103 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+
+public class SignaturePolicyId
+    extends ASN1Object
+{
+    private ASN1ObjectIdentifier  sigPolicyId;
+    private OtherHashAlgAndValue sigPolicyHash;
+    private SigPolicyQualifiers  sigPolicyQualifiers;
+
+
+    public static SignaturePolicyId getInstance(
+        Object obj)
+    {
+        if (obj instanceof SignaturePolicyId)
+        {
+            return (SignaturePolicyId)obj;
+        }
+        else if (obj != null)
+        {
+            return new SignaturePolicyId(ASN1Sequence.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    private SignaturePolicyId(
+        ASN1Sequence seq)
+    {
+        if (seq.size() != 2 && seq.size() != 3)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
+        sigPolicyId = ASN1ObjectIdentifier.getInstance(seq.getObjectAt(0));
+        sigPolicyHash = OtherHashAlgAndValue.getInstance(seq.getObjectAt(1));
+
+        if (seq.size() == 3)
+        {
+            sigPolicyQualifiers = SigPolicyQualifiers.getInstance(seq.getObjectAt(2));
+        }
+    }
+
+    public SignaturePolicyId(
+        ASN1ObjectIdentifier   sigPolicyIdentifier,
+        OtherHashAlgAndValue  sigPolicyHash)
+    {
+        this(sigPolicyIdentifier, sigPolicyHash, null);
+    }
+
+    public SignaturePolicyId(
+        ASN1ObjectIdentifier   sigPolicyId,
+        OtherHashAlgAndValue  sigPolicyHash,
+        SigPolicyQualifiers   sigPolicyQualifiers)
+    {
+        this.sigPolicyId = sigPolicyId;
+        this.sigPolicyHash = sigPolicyHash;
+        this.sigPolicyQualifiers = sigPolicyQualifiers;
+    }
+
+    public ASN1ObjectIdentifier getSigPolicyId()
+    {
+        return new ASN1ObjectIdentifier(sigPolicyId.getId());
+    }
+
+    public OtherHashAlgAndValue getSigPolicyHash()
+    {
+        return sigPolicyHash;
+    }
+
+    public SigPolicyQualifiers getSigPolicyQualifiers()
+    {
+        return sigPolicyQualifiers;
+    }
+
+    /**
+     * <pre>
+     * SignaturePolicyId ::= SEQUENCE {
+     *     sigPolicyId SigPolicyId,
+     *     sigPolicyHash SigPolicyHash,
+     *     sigPolicyQualifiers SEQUENCE SIZE (1..MAX) OF SigPolicyQualifierInfo OPTIONAL}
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector  v = new ASN1EncodableVector();
+
+        v.add(sigPolicyId);
+        v.add(sigPolicyHash);
+        if (sigPolicyQualifiers != null)
+        {
+            v.add(sigPolicyQualifiers);
+        }
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyIdentifier.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyIdentifier.java
new file mode 100644
index 0000000..acd8ac4
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignaturePolicyIdentifier.java
@@ -0,0 +1,76 @@
+package org.bouncycastle.asn1.esf;
+
+import org.bouncycastle.asn1.ASN1Null;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.BERTags;
+import org.bouncycastle.asn1.DERNull;
+
+public class SignaturePolicyIdentifier
+    extends ASN1Object
+{
+    private SignaturePolicyId   signaturePolicyId;
+    private boolean             isSignaturePolicyImplied;
+
+    public static SignaturePolicyIdentifier getInstance(
+        Object  obj)
+    {
+        if (obj instanceof SignaturePolicyIdentifier)
+        {
+            return (SignaturePolicyIdentifier)obj;
+        }
+        else if (obj instanceof ASN1Null || hasEncodedTagValue(obj, BERTags.NULL))
+        {
+            return new SignaturePolicyIdentifier();
+        }
+        else if (obj != null)
+        {
+            return new SignaturePolicyIdentifier(SignaturePolicyId.getInstance(obj));
+        }
+
+        return null;
+    }
+
+    public SignaturePolicyIdentifier()
+    {
+        this.isSignaturePolicyImplied = true;
+    }
+
+    public SignaturePolicyIdentifier(
+        SignaturePolicyId signaturePolicyId)
+    {
+        this.signaturePolicyId = signaturePolicyId;
+        this.isSignaturePolicyImplied = false;
+    }
+
+    public SignaturePolicyId getSignaturePolicyId()
+    {
+        return signaturePolicyId;
+    }
+
+    public boolean isSignaturePolicyImplied()
+    {
+        return isSignaturePolicyImplied;
+    }
+
+    /**
+     * <pre>
+     * SignaturePolicyIdentifier ::= CHOICE{
+     *     SignaturePolicyId         SignaturePolicyId,
+     *     SignaturePolicyImplied    SignaturePolicyImplied }
+     *
+     * SignaturePolicyImplied ::= NULL
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        if (isSignaturePolicyImplied)
+        {
+            return DERNull.INSTANCE;
+        }
+        else
+        {
+            return signaturePolicyId.toASN1Primitive();
+        }
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerAttribute.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerAttribute.java
new file mode 100644
index 0000000..ecc4db3
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerAttribute.java
@@ -0,0 +1,123 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1TaggedObject;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERTaggedObject;
+import org.bouncycastle.asn1.x509.Attribute;
+import org.bouncycastle.asn1.x509.AttributeCertificate;
+
+
+public class SignerAttribute
+    extends ASN1Object
+{
+    private Object[] values;
+
+    public static SignerAttribute getInstance(
+        Object o)
+    {
+        if (o instanceof SignerAttribute)
+        {
+            return (SignerAttribute) o;
+        }
+        else if (o != null)
+        {
+            return new SignerAttribute(ASN1Sequence.getInstance(o));
+        }
+
+        return null;
+    }
+
+    private SignerAttribute(
+        ASN1Sequence seq)
+    {
+        int index = 0;
+        values = new Object[seq.size()];
+
+        for (Enumeration e = seq.getObjects(); e.hasMoreElements();)
+        {
+            ASN1TaggedObject taggedObject = ASN1TaggedObject.getInstance(e.nextElement());
+
+            if (taggedObject.getTagNo() == 0)
+            {
+                ASN1Sequence attrs = ASN1Sequence.getInstance(taggedObject, true);
+                Attribute[]  attributes = new Attribute[attrs.size()];
+
+                for (int i = 0; i != attributes.length; i++)
+                {
+                    attributes[i] = Attribute.getInstance(attrs.getObjectAt(i));
+                }
+                values[index] = attributes;
+            }
+            else if (taggedObject.getTagNo() == 1)
+            {
+                values[index] = AttributeCertificate.getInstance(ASN1Sequence.getInstance(taggedObject, true));
+            }
+            else
+            {
+                throw new IllegalArgumentException("illegal tag: " + taggedObject.getTagNo());
+            }
+            index++;
+        }
+    }
+
+    public SignerAttribute(
+        Attribute[] claimedAttributes)
+    {
+        this.values = new Object[1];
+        this.values[0] = claimedAttributes;
+    }
+
+    public SignerAttribute(
+        AttributeCertificate certifiedAttributes)
+    {
+        this.values = new Object[1];
+        this.values[0] = certifiedAttributes;
+    }
+
+    /**
+     * Return the sequence of choices - the array elements will either be of
+     * type Attribute[] or AttributeCertificate depending on what tag was used.
+     *
+     * @return array of choices.
+     */
+    public Object[] getValues()
+    {
+        return values;
+    }
+
+    /**
+     *
+     * <pre>
+     *  SignerAttribute ::= SEQUENCE OF CHOICE {
+     *      claimedAttributes   [0] ClaimedAttributes,
+     *      certifiedAttributes [1] CertifiedAttributes }
+     *
+     *  ClaimedAttributes ::= SEQUENCE OF Attribute
+     *  CertifiedAttributes ::= AttributeCertificate -- as defined in RFC 3281: see clause 4.1.
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+
+        for (int i = 0; i != values.length; i++)
+        {
+            if (values[i] instanceof Attribute[])
+            {
+                v.add(new DERTaggedObject(0, new DERSequence((Attribute[])values[i])));
+            }
+            else
+            {
+                v.add(new DERTaggedObject(1, (AttributeCertificate)values[i]));
+            }
+        }
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerLocation.java b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerLocation.java
new file mode 100644
index 0000000..fcdb320
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/SignerLocation.java
@@ -0,0 +1,162 @@
+package org.bouncycastle.asn1.esf;
+
+import java.util.Enumeration;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1Object;
+import org.bouncycastle.asn1.ASN1Primitive;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERTaggedObject;
+import org.bouncycastle.asn1.DERUTF8String;
+import org.bouncycastle.asn1.x500.DirectoryString;
+
+/**
+ * Signer-Location attribute (RFC3126).
+ * 
+ * <pre>
+ *   SignerLocation ::= SEQUENCE {
+ *       countryName        [0] DirectoryString OPTIONAL,
+ *       localityName       [1] DirectoryString OPTIONAL,
+ *       postalAddress      [2] PostalAddress OPTIONAL }
+ *
+ *   PostalAddress ::= SEQUENCE SIZE(1..6) OF DirectoryString
+ * </pre>
+ */
+public class SignerLocation
+    extends ASN1Object
+{
+    private DERUTF8String   countryName;
+    private DERUTF8String   localityName;
+    private ASN1Sequence    postalAddress;
+    
+    private SignerLocation(
+        ASN1Sequence seq)
+    {
+        Enumeration     e = seq.getObjects();
+
+        while (e.hasMoreElements())
+        {
+            DERTaggedObject o = (DERTaggedObject)e.nextElement();
+
+            switch (o.getTagNo())
+            {
+            case 0:
+                DirectoryString countryNameDirectoryString = DirectoryString.getInstance(o, true);
+                this.countryName = new DERUTF8String(countryNameDirectoryString.getString());
+                break;
+            case 1:
+                DirectoryString localityNameDirectoryString = DirectoryString.getInstance(o, true);
+                this.localityName = new DERUTF8String(localityNameDirectoryString.getString());
+                break;
+            case 2:
+                if (o.isExplicit())
+                {
+                    this.postalAddress = ASN1Sequence.getInstance(o, true);
+                }
+                else    // handle erroneous implicitly tagged sequences
+                {
+                    this.postalAddress = ASN1Sequence.getInstance(o, false);
+                }
+                if (postalAddress != null && postalAddress.size() > 6)
+                {
+                    throw new IllegalArgumentException("postal address must contain less than 6 strings");
+                }
+                break;
+            default:
+                throw new IllegalArgumentException("illegal tag");
+            }
+        }
+    }
+
+    public SignerLocation(
+        DERUTF8String   countryName,
+        DERUTF8String   localityName,
+        ASN1Sequence    postalAddress)
+    {
+        if (postalAddress != null && postalAddress.size() > 6)
+        {
+            throw new IllegalArgumentException("postal address must contain less than 6 strings");
+        }
+
+        if (countryName != null)
+        {
+            this.countryName = DERUTF8String.getInstance(countryName.toASN1Primitive());
+        }
+
+        if (localityName != null)
+        {
+            this.localityName = DERUTF8String.getInstance(localityName.toASN1Primitive());
+        }
+
+        if (postalAddress != null)
+        {
+            this.postalAddress = ASN1Sequence.getInstance(postalAddress.toASN1Primitive());
+        }
+    }
+
+    public static SignerLocation getInstance(
+        Object obj)
+    {
+        if (obj == null || obj instanceof SignerLocation)
+        {
+            return (SignerLocation)obj;
+        }
+
+        return new SignerLocation(ASN1Sequence.getInstance(obj));
+    }
+
+    public DERUTF8String getCountryName()
+    {
+        return countryName;
+    }
+
+    public DERUTF8String getLocalityName()
+    {
+        return localityName;
+    }
+
+    public ASN1Sequence getPostalAddress()
+    {
+        return postalAddress;
+    }
+
+    /**
+     * <pre>
+     *   SignerLocation ::= SEQUENCE {
+     *       countryName        [0] DirectoryString OPTIONAL,
+     *       localityName       [1] DirectoryString OPTIONAL,
+     *       postalAddress      [2] PostalAddress OPTIONAL }
+     *
+     *   PostalAddress ::= SEQUENCE SIZE(1..6) OF DirectoryString
+     *   
+     *   DirectoryString ::= CHOICE {
+     *         teletexString           TeletexString (SIZE (1..MAX)),
+     *         printableString         PrintableString (SIZE (1..MAX)),
+     *         universalString         UniversalString (SIZE (1..MAX)),
+     *         utf8String              UTF8String (SIZE (1.. MAX)),
+     *         bmpString               BMPString (SIZE (1..MAX)) }
+     * </pre>
+     */
+    public ASN1Primitive toASN1Primitive()
+    {
+        ASN1EncodableVector  v = new ASN1EncodableVector();
+
+        if (countryName != null)
+        {
+            v.add(new DERTaggedObject(true, 0, countryName));
+        }
+
+        if (localityName != null)
+        {
+            v.add(new DERTaggedObject(true, 1, localityName));
+        }
+
+        if (postalAddress != null)
+        {
+            v.add(new DERTaggedObject(true, 2, postalAddress));
+        }
+
+        return new DERSequence(v);
+    }
+}
diff --git a/bcprov/src/main/java/org/bouncycastle/asn1/esf/package.html b/bcprov/src/main/java/org/bouncycastle/asn1/esf/package.html
new file mode 100644
index 0000000..de27367
--- /dev/null
+++ b/bcprov/src/main/java/org/bouncycastle/asn1/esf/package.html
@@ -0,0 +1,6 @@
+<html>
+<body bgcolor="#ffffff">
+Support classes useful for encoding and supporting [ESF] RFC3126 
+Electronic Signature Formats for long term electronic signatures.
+</body>
+</html>