Internet Engineering Task Force (IETF) R. Housley
Request for Comments: 7299 Vigil Security
Category: Informational July 2014
ISSN: 2070-1721
Object Identifier Registry for the PKIX Working Group
Abstract
When the Public-Key Infrastructure using X.509 (PKIX) Working Group
was chartered, an object identifier arc was allocated by IANA for use
by that working group. This document describes the object
identifiers that were assigned in that arc, returns control of that
arc to IANA, and establishes IANA allocation policies for any future
assignments within that arc.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7299.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Housley Informational [Page 1]
RFC 7299 PKIX OID Registry July 2014
Table of Contents
1. Introduction ....................................................3
2. Subordinate Object Identifier Arcs ..............................3
3. IANA Considerations .............................................6
3.1. Update to "SMI Security for Mechanism Codes" Registry ......6
3.2. "SMI Security for PKIX" Registry ...........................6
3.3. "SMI Security for PKIX Module Identifier" Registry .........7
3.4. "SMI Security for PKIX Certificate Extension" Registry .....9
3.5. "SMI Security for PKIX Policy Qualifier" Registry .........10
3.6. "SMI Security for PKIX Extended Key Purpose" Registry .....10
3.7. "SMI Security for PKIX CMP Information Types" Registry ....11
3.8. "SMI Security for PKIX CRMF Registration" Registry ........12
3.9. "SMI Security for PKIX CRMF Registration Controls"
Registry ..................................................12
3.10. "SMI Security for PKIX CRMF Registration
Information" Registry ....................................12
3.11. "SMI Security for PKIX Algorithms" Registry ..............13
3.12. "SMI Security for PKIX CMC Controls" Registry ............13
3.13. "SMI Security for PKIX CMC GLA Requests and
Responses" Registry ......................................14
3.14. "SMI Security for PKIX Other Name Forms" Registry ........15
3.15. "SMI Security for PKIX Personal Data Attributes"
Registry .................................................15
3.16. "SMI Security for PKIX Attribute Certificate
Attributes" Registry .....................................16
3.17. "SMI Security for PKIX Qualified Certificate
Statements" Registry .....................................16
3.18. "SMI Security for PKIX CMC Content Types" Registry .......16
3.19. "SMI Security for PKIX OIDs Used Only for
Testing" Registry ........................................17
3.20. "SMI Security for PKIX Certificate Policies" Registry ....17
3.21. "SMI Security for PKIX CMC Error Types" Registry .........17
3.22. "SMI Security for PKIX Revocation Information
Types" Registry ..........................................18
3.23. "SMI Security for PKIX SCVP Check Types" Registry ........18
3.24. "SMI Security for PKIX SCVP Want Back Types" Registry ....19
3.25. "SMI Security for PKIX SCVP Validation Policies
and Algorithms" Registry .................................20
3.26. "SMI Security for PKIX SCVP Name Validation
Policy Errors" Registry ..................................20
3.27. "SMI Security for PKIX SCVP Basic Validation
Policy Errors" Registry ..................................21
3.28. "SMI Security for PKIX SCVP Distinguished Name
Validation Policy Errors" Registry .......................21
3.29. "SMI Security for PKIX Other Logotype
Identifiers" Registry ....................................22
Housley Informational [Page 2]
RFC 7299 PKIX OID Registry July 2014
3.30. "SMI Security for PKIX Proxy Certificate Policy
Languages" Registry ......................................22
3.31. "SMI Security for PKIX Proxy Matching Rules" Registry ....22
3.32. "SMI Security for PKIX Subject Key Identifier
Semantics" Registry ......................................23
3.33. "SMI Security for PKIX Access Descriptor" Registry .......23
3.34. "SMI Security for PKIX Online Certificate Status
Protocol (OCSP)" Registry ................................24
4. Security Considerations ........................................24
5. References .....................................................25
5.1. Normative References ......................................25
5.2. Informative References ....................................25
Acknowledgements ..................................................30
1. Introduction
When the Public-Key Infrastructure using X.509 (PKIX) Working Group
was chartered, an object identifier arc was allocated by IANA for use
by that working group. These object identifiers are primarily used
with Abstract Syntax Notation One (ASN.1) [ASN1-88] [ASN1-97]
[ASN1-08]. The ASN.1 specifications continue to evolve, but object
identifiers can be used with any and all versions of ASN.1.
The PKIX object identifier arc is:
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
This document describes the object identifiers that were assigned in
the PKIX arc, returns control of the PKIX arc to IANA, and
establishes IANA allocation policies for any future assignments
within the PKIX arc.
2. Subordinate Object Identifier Arcs
Twenty-five subordinate object identifier arcs were used, numbered
from 0 to 23 and 48. In addition, there are seven subordinate arcs.
They were assigned as follows:
-- Module identifiers
id-mod OBJECT IDENTIFIER ::= { id-pkix 0 }
-- PKIX certificate extensions
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
-- Policy qualifier types
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
Housley Informational [Page 3]
RFC 7299 PKIX OID Registry July 2014
-- Extended key purpose identifiers
id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
-- CMP information types
id-it OBJECT IDENTIFIER ::= { id-pkix 4 }
-- CRMF registration
id-pkip OBJECT IDENTIFIER ::= { id-pkix 5 }
-- CRMF registration controls
id-regCtrl OBJECT IDENTIFIER ::= { id-pkix 5 1 }
-- CRMF registration information
id-regInfo OBJECT IDENTIFIER ::= { id-pkix 5 2 }
-- Algorithms
id-alg OBJECT IDENTIFIER ::= { id-pkix 6 }
-- CMC controls
id-cmc OBJECT IDENTIFIER ::= { id-pkix 7 }
-- CMC GLA Requests and Responses
id-cmc-glaRR OBJECT IDENTIFIER ::= { id-pkix 7 99 }
-- Other name forms
id-on OBJECT IDENTIFIER ::= { id-pkix 8 }
-- Personal data attribute
id-pda OBJECT IDENTIFIER ::= { id-pkix 9 }
-- Attribute certificate attributes
id-aca OBJECT IDENTIFIER ::= { id-pkix 10 }
-- Qualified certificate statements
id-qcs OBJECT IDENTIFIER ::= { id-pkix 11 }
-- CMC content types
id-cct OBJECT IDENTIFIER ::= { id-pkix 12 }
-- OIDs for TESTING ONLY
id-TEST OBJECT IDENTIFIER ::= { id-pkix 13 }
-- Certificate policies
id-cp OBJECT IDENTIFIER ::= { id-pkix 14 }
-- CMC error types
id-cet OBJECT IDENTIFIER ::= { id-pkix 15 }
Housley Informational [Page 4]
RFC 7299 PKIX OID Registry July 2014
-- Revocation information types
id-ri OBJECT IDENTIFIER ::= { id-pkix 16 }
-- SCVP check type
id-sct OBJECT IDENTIFIER ::= { id-pkix 17 }
-- SCVP want back types
id-swb OBJECT IDENTIFIER ::= { id-pkix 18 }
-- SCVP validation policies
id-svp OBJECT IDENTIFIER ::= { id-pkix 19 }
-- SCVP name validation policy errors
id-nvae OBJECT IDENTIFIER ::= { id-pkix 19 2 }
-- SCVP basic validation policy errors
id-bvae OBJECT IDENTIFIER ::= { id-pkix 19 3 }
-- SCVP distinguished name validation policy errors
id-dnvae OBJECT IDENTIFIER ::= { id-pkix 19 4 }
-- Other logotype identifiers
id-logo OBJECT IDENTIFIER ::= { id-pkix 20 }
-- Proxy certificate policy languages
id-ppl OBJECT IDENTIFIER ::= { id-pkix 21 }
-- Matching rules
id-mr OBJECT IDENTIFIER ::= { id-pkix 22 }
-- Subject key identifier semantics
id-skis OBJECT IDENTIFIER ::= { id-pkix 23 }
-- Access descriptors
id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
-- Online Certificate Status Protocol
id-pkix-ocsp OBJECT IDENTIFIER ::= { id-pkix 48 1 }
The values assigned in each of these subordinate object identifier
arcs are discussed in the next section.
Housley Informational [Page 5]
RFC 7299 PKIX OID Registry July 2014
3. IANA Considerations
IANA has updated one registry table and created 33 additional tables.
Updates to the new tables are to be made according to the
Specification Required policy as defined in [RFC5226]. The expert is
expected to ensure that any new values are strongly related to the
work that was done by the PKIX Working Group. That is, additional
object identifiers are to be related to X.509 certificates, X.509
attribute certificates, X.509 certificate revocation lists (CRLs), or
protocols associated with them. Object identifiers for other
purposes should not be assigned in this arc.
3.1. Update to "SMI Security for Mechanism Codes" Registry
The reference for the Public Key Infrastructure using X.509 (PKIX)
entry (decimal value 7) has been updated to point to this document.
3.2. "SMI Security for PKIX" Registry
Within the SMI-numbers registry, a "PKIX (1.3.6.1.5.5.7)" table with
three columns has been added:
Decimal Description References
------- -------------------------------------- ----------
0 Module identifiers [RFC7299]
1 PKIX certificate extensions [RFC7299]
2 Policy qualifier types [RFC7299]
3 Extended key purpose identifiers [RFC7299]
4 CMP information types [RFC7299]
5 CRMF registration [RFC7299]
6 Algorithms [RFC7299]
7 CMC controls [RFC7299]
8 Other name forms [RFC7299]
9 Personal data attribute [RFC7299]
10 Attribute certificate attributes [RFC7299]
11 Qualified certificate statements [RFC7299]
12 CMC content types [RFC7299]
13 OIDs for TESTING ONLY [RFC7299]
14 Certificate policies [RFC7299]
15 CMC error types [RFC7299]
16 Revocation information types [RFC7299]
17 SCVP check type [RFC7299]
18 SCVP want back types [RFC7299]
19 SCVP validation policies [RFC7299]
20 Other logotype identifiers [RFC7299]
Housley Informational [Page 6]
RFC 7299 PKIX OID Registry July 2014
21 Proxy certificate policy languages [RFC7299]
22 Matching rules [RFC7299]
23 Subject key identifier semantics [RFC7299]
48 Access descriptors [RFC7299]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.3. "SMI Security for PKIX Module Identifier" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Module
Identifier (1.3.6.1.5.5.7.0)" table with three columns has been
added:
Decimal Description References
------- ------------------------------- ---------------------
1 id-pkix1-explicit-88 [RFC2459]
2 id-pkix1-implicit-88 [RFC2459]
3 id-pkix1-explicit-93 [RFC2459]
4 id-pkix1-implicit-93 [RFC2459]
5 id-mod-crmf [RFC2511]
6 id-mod-cmc [RFC2797]
7 id-mod-kea-profile-88 [RFC2528]
8 id-mod-kea-profile-93 [RFC2528]
9 id-mod-cmp [RFC2510]
10 id-mod-qualified-cert-88 [RFC3039]
11 id-mod-qualified-cert-93 [RFC3039]
12 id-mod-attribute-cert [RFC3281]
13 id-mod-tsp [RFC3161]
14 id-mod-ocsp [RFC3029]
15 id-mod-dvcs [RFC3029]
16 id-mod-cmp2000 [RFC4210]
17 id-mod-pkix1-algorithms [RFC3279]
18 id-mod-pkix1-explicit [RFC3280]
19 id-mod-pkix1-implicit [RFC3280]
20 id-mod-user-group Reserved and Obsolete
21 id-mod-scvp [RFC5055]
22 id-mod-logotype [RFC3709]
23 id-mod-cmc2002 [RFC5272]
24 id-mod-wlan-extns [RFC3770]
25 id-mod-proxy-cert-extns [RFC3820]
26 id-mod-ac-policies [RFC4476]
27 id-mod-warranty-extn [RFC4059]
28 id-mod-perm-id-88 [RFC4043]
29 id-mod-perm-id-93 [RFC4043]
30 id-mod-ip-addr-and-as-ident [RFC3779]
31 id-mod-qualified-cert [RFC3739]
32 id-mod-crmf2003 Reserved and Obsolete
Housley Informational [Page 7]
RFC 7299 PKIX OID Registry July 2014
33 id-mod-pkix1-rsa-pkalgs [RFC4055]
34 id-mod-cert-bundle [RFC4306]
35 id-mod-qualified-cert-97 [RFC3739]
36 id-mod-crmf2005 [RFC4210]
37 id-mod-wlan-extns2005 [RFC4334]
38 id-mod-sim2005 [RFC4683]
39 id-mod-dns-srv-name-88 [RFC4985]
40 id-mod-dns-srv-name-93 [RFC4985]
41 id-mod-cmsContentConstr-88 [RFC6010]
42 id-mod-cmsContentConstr-93 [RFC6010]
43 id-mod-pkixCommon Reserved and Obsolete
44 id-mod-pkixOtherCerts [RFC5697]
45 id-mod-pkix1-algorithms2008 [RFC5480]
46 id-mod-clearanceConstraints [RFC5913]
47 id-mod-attribute-cert-02 [RFC5912]
48 id-mod-ocsp-02 [RFC5912]
49 id-mod-v1AttrCert-02 [RFC5912]
50 id-mod-cmp2000-02 [RFC5912]
51 id-mod-pkix1-explicit-02 [RFC5912]
52 id-mod-scvp-02 [RFC5912]
53 id-mod-cmc2002-02 [RFC5912]
54 id-mod-pkix1-rsa-pkalgs-02 [RFC5912]
55 id-mod-crmf2005-02 [RFC5912]
56 id-mod-pkix1-algorithms2008-02 [RFC5912]
57 id-mod-pkixCommon-02 [RFC5912]
58 id-mod-algorithmInformation-02 [RFC5912]
59 id-mod-pkix1-implicit-02 [RFC5912]
60 id-mod-pkix1-x400address-02 [RFC5912]
61 id-mod-attribute-cert-v2 [RFC5755]
62 id-mod-sip-domain-extns2007 [RFC5924]
63 id-mod-cms-otherRIs-2009-88 [RFC5940]
64 id-mod-cms-otherRIs-2009-93 [RFC5940]
65 id-mod-ecprivatekey [RFC5915]
66 id-mod-ocsp-agility-2009-93 [RFC6277]
67 id-mod-ocsp-agility-2009-88 [RFC6277]
68 id-mod-logotype-certimage [RFC6170]
69 id-mod-pkcs10-2009 [RFC5912]
70 id-mod-dns-resource-record [Abley]
71 id-mod-send-cert-extns [RFC6494]
72 id-mod-ip-addr-and-as-ident-2 [RFC6268]
73 id-mod-wlan-extns-2 [RFC6268]
74 id-mod-hmac [RFC6268]
75 id-mod-enrollMsgSyntax-2011-88 [RFC6402] [Err3860]
76 id-mod-enrollMsgSyntax-2011-08 [RFC6402]
77 id-mod-pubKeySMIMECaps-88 [RFC6664]
78 id-mod-pubKeySMIMECaps-08 [RFC6664]
79 id-mod-dhSign-2012-88 [RFC6955]
80 id-mod-dhSign-2012-08 [RFC6955]
Housley Informational [Page 8]
RFC 7299 PKIX OID Registry July 2014
81 id-mod-ocsp-2013-88 [RFC6960]
82 id-mod-ocsp-2013-08 [RFC6960]
83 id-mod-TEST-certPolicies [RFC7229]
84 id-mod-bgpsec-eku [BGPSEC]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.4. "SMI Security for PKIX Certificate Extension" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX
Certificate Extension (1.3.6.1.5.5.7.1)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-pe-authorityInfoAccess [RFC2459]
2 id-pe-biometricInfo [RFC3039]
3 id-pe-qcStatements [RFC3039]
4 id-pe-ac-auditIdentity [RFC3281]
5 id-pe-ac-targeting Reserved and Obsolete
6 id-pe-aaControls [RFC3281]
7 id-pe-ipAddrBlocks [RFC3779]
8 id-pe-autonomousSysIds [RFC3779]
9 id-pe-sbgp-routerIdentifier Reserved and Obsolete
10 id-pe-ac-proxying [RFC3281]
11 id-pe-subjectInfoAccess [RFC3280]
12 id-pe-logotype [RFC3709]
13 id-pe-wlanSSID [RFC4334]
14 id-pe-proxyCertInfo [RFC3820]
15 id-pe-acPolicies [RFC4476]
16 id-pe-warranty [RFC4059]
17 id-pe-sim Reserved and Obsolete
18 id-pe-cmsContentConstraints [RFC6010]
19 id-pe-otherCerts [RFC5697]
20 id-pe-wrappedApexContinKey [RFC5934]
21 id-pe-clearanceConstraints [RFC5913]
22 id-pe-skiSemantics Reserved and Obsolete
23 id-pe-nsa [RFC7169]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 9]
RFC 7299 PKIX OID Registry July 2014
3.5. "SMI Security for PKIX Policy Qualifier" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Policy
Qualifier Identifiers (1.3.6.1.5.5.7.2)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-qt-cps [RFC2459]
2 id-qt-unotice [RFC2459]
3 id-qt-textNotice Reserved and Obsolete
4 id-qt-acps [RFC4476]
5 id-qt-acunotice [RFC4476]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.6. "SMI Security for PKIX Extended Key Purpose" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Extended
Key Purpose Identifiers (1.3.6.1.5.5.7.3)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-kp-serverAuth [RFC2459]
2 id-kp-clientAuth [RFC2459]
3 id-kp-codeSigning [RFC2459]
4 id-kp-emailProtection [RFC2459]
5 id-kp-ipsecEndSystem Reserved and Obsolete
6 id-kp-ipsecTunnel Reserved and Obsolete
7 id-kp-ipsecUser Reserved and Obsolete
8 id-kp-timeStamping [RFC2459]
9 id-kp-OCSPSigning [RFC2560]
10 id-kp-dvcs [RFC3029]
11 id-kp-sbgpCertAAServerAuth Reserved and Obsolete
12 id-kp-scvp-responder Reserved and Obsolete
13 id-kp-eapOverPPP [RFC4334]
14 id-kp-eapOverLAN [RFC4334]
15 id-kp-scvpServer [RFC5055]
16 id-kp-scvpClient [RFC5055]
17 id-kp-ipsecIKE [RFC4945]
18 id-kp-capwapAC [RFC5415]
19 id-kp-capwapWTP [RFC5415]
20 id-kp-sipDomain [RFC5924]
21 id-kp-secureShellClient [RFC6187]
22 id-kp-secureShellServer [RFC6187]
23 id-kp-sendRouter [RFC6494]
Housley Informational [Page 10]
RFC 7299 PKIX OID Registry July 2014
24 id-kp-sendProxiedRouter [RFC6494]
25 id-kp-sendOwner [RFC6494]
26 id-kp-sendProxiedOwner [RFC6494]
27 id-kp-cmcCA [RFC6402]
28 id-kp-cmcRA [RFC6402]
29 id-kp-cmcArchive [RFC6402]
30 id-kp-bgpsec-router [BGPSEC]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.7. "SMI Security for PKIX CMP Information Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CMP
Information Types (1.3.6.1.5.5.7.4)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-it-caProtEncCert [RFC2510]
2 id-it-signKeyPairTypes [RFC2510]
3 id-it-encKeyPairTypes [RFC2510]
4 id-it-preferredSymmAlg [RFC2510]
5 id-it-caKeyUpdateInfo [RFC2510]
6 id-it-currentCRL [RFC2510]
7 id-it-unsupportedOIDs [RFC4210]
8 id-it-subscriptionRequest Reserved and Obsolete
9 id-it-subscriptionResponse Reserved and Obsolete
10 id-it-keyPairParamReq [RFC4210]
11 id-it-keyPairParamRep [RFC4210]
12 id-it-revPassphrase [RFC4210]
13 id-it-implicitConfirm [RFC4210]
14 id-it-confirmWaitTime [RFC4210]
15 id-it-origPKIMessage [RFC4210]
16 id-it-suppLangTags [RFC4210]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 11]
RFC 7299 PKIX OID Registry July 2014
3.8. "SMI Security for PKIX CRMF Registration" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CRMF
Registration (1.3.6.1.5.5.7.5)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ----------
1 id-regCtrl [RFC2511]
2 id-regInfo [RFC2511]
3 id-regEPEPSI [RFC4683]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.9. "SMI Security for PKIX CRMF Registration Controls" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CRMF
Registration Controls (1.3.6.1.5.5.7.5.1)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-regCtrl-regToken [RFC2511]
2 id-regCtrl-authenticator [RFC2511]
3 id-regCtrl-pkiPublicationInfo [RFC2511]
4 id-regCtrl-pkiArchiveOptions [RFC2511]
5 id-regCtrl-oldCertID [RFC2511]
6 id-regCtrl-protocolEncrKey [RFC2511]
7 id-regCtrl-altCertTemplate [RFC4210]
8 id-regCtrl-wtlsTemplate Reserved and Obsolete
9 id-regCtrl-regTokenUTF8 Reserved and Obsolete
10 id-regCtrl-authenticatorUTF8 Reserved and Obsolete
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.10. "SMI Security for PKIX CRMF Registration Information" Registry
Within the SMI-numbers registry, add an "SMI Security for PKIX CRMF
Registration Information (1.3.6.1.5.5.7.5.2)" table with three
columns:
Decimal Description References
------- ------------------------------ ----------
1 id-regInfo-utf8Pairs [RFC2511]
2 id-regInfo-certReq [RFC2511]
Housley Informational [Page 12]
RFC 7299 PKIX OID Registry July 2014
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.11. "SMI Security for PKIX Algorithms" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Algorithms
(1.3.6.1.5.5.7.6)" table with three columns has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-alg-des40 Reserved and Obsolete
2 id-alg-noSignature [RFC2797]
3 id-alg-dh-sig-hmac-sha1 [RFC2875]
4 id-alg-dhPop-sha1 [RFC2875]
5 id-alg-dhPop-sha224 [RFC6955]
6 id-alg-dhPop-sha256 [RFC6955]
7 id-alg-dhPop-sha384 [RFC6955]
8 id-alg-dhPop-sha512 [RFC6955]
15 id-alg-dhPop-static-sha224-hmac-sha224 [RFC6955]
16 id-alg-dhPop-static-sha256-hmac-sha256 [RFC6955]
17 id-alg-dhPop-static-sha384-hmac-sha384 [RFC6955]
18 id-alg-dhPop-static-sha512-hmac-sha512 [RFC6955]
25 id-alg-ecdhPop-static-sha224-hmac-sha224 [RFC6955]
26 id-alg-ecdhPop-static-sha256-hmac-sha256 [RFC6955]
27 id-alg-ecdhPop-static-sha384-hmac-sha384 [RFC6955]
28 id-alg-ecdhPop-static-sha512-hmac-sha512 [RFC6955]
Note: id-alg-dhPop-sha1 is also known as id-alg-dh-pop.
Note: id-alg-dh-sig-hmac-sha1 is also known as
id-alg-dhPop-static-sha1-hmac-sha1 and
id-dhPop-static-hmac-sha1.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.12. "SMI Security for PKIX CMC Controls" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CMC
Controls (1.3.6.1.5.5.7.7)" table with three columns has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-cmc-statusInfo [RFC2797]
2 id-cmc-identification [RFC2797]
3 id-cmc-identityProof [RFC2797]
4 id-cmc-dataReturn [RFC2797]
5 id-cmc-transactionId [RFC2797]
Housley Informational [Page 13]
RFC 7299 PKIX OID Registry July 2014
6 id-cmc-senderNonce [RFC2797]
7 id-cmc-recipientNonce [RFC2797]
8 id-cmc-addExtensions [RFC2797]
9 id-cmc-encryptedPOP [RFC2797]
10 id-cmc-decryptedPOP [RFC2797]
11 id-cmc-lraPOPWitness [RFC2797]
15 id-cmc-getCert [RFC2797]
16 id-cmc-getCRL [RFC2797]
17 id-cmc-revokeRequest [RFC2797]
18 id-cmc-regInfo [RFC2797]
19 id-cmc-responseInfo [RFC2797]
21 id-cmc-queryPending [RFC2797]
22 id-cmc-popLinkRandom [RFC2797]
23 id-cmc-popLinkWitness [RFC2797]
24 id-cmc-confirmCertAcceptance [RFC2797]
25 id-cmc-statusInfoV2 [RFC5272]
26 id-cmc-trustedAnchors [RFC5272]
27 id-cmc-authData [RFC5272]
28 id-cmc-batchRequests [RFC5272]
29 id-cmc-batchResponses [RFC5272]
30 id-cmc-publishCert [RFC5272]
31 id-cmc-modCertTemplate [RFC5272]
32 id-cmc-controlProcessed [RFC5272]
33 id-cmc-popLinkWitnessV2 [RFC5272]
34 id-cmc-identityProofV2 [RFC5272]
35 id-cmc-raIdentityWitness [RFC6402]
36 id-cmc-changeSubjectName [RFC6402]
37 id-cmc-responseBody [RFC6402]
99 id-cmc-glaRR [RFC5275]
Note: id-cmc-statusInfo is also known as id-cmc-cMCStatusInfo.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.13. "SMI Security for PKIX CMC GLA Requests and Responses" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CMC GLA
Requests and Responses (1.3.6.1.5.5.7.7.99)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-cmc-gla-skdAlgRequest [RFC5275]
2 id-cmc-gla-skdAlgResponse [RFC5275]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 14]
RFC 7299 PKIX OID Registry July 2014
3.14. "SMI Security for PKIX Other Name Forms" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Other Name
Forms (1.3.6.1.5.5.7.8)" table with three columns has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-on-personalData Reserved and Obsolete
2 id-on-userGroup Reserved and Obsolete
3 id-on-permanentIdentifier [RFC4043]
4 id-on-hardwareModuleName [RFC4108]
5 id-on-xmppAddr [RFC3920]
6 id-on-SIM [RFC4683]
7 id-on-dnsSRV [RFC4985]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.15. "SMI Security for PKIX Personal Data Attributes" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Personal
Data Attributes (1.3.6.1.5.5.7.9)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ----------
1 id-pda-dateOfBirth [RFC3039]
2 id-pda-placeOfBirth [RFC3039]
3 id-pda-gender [RFC3039]
4 id-pda-countryOfCitizenship [RFC3039]
5 id-pda-countryOfResidence [RFC3039]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 15]
RFC 7299 PKIX OID Registry July 2014
3.16. "SMI Security for PKIX Attribute Certificate Attributes" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Attribute
Certificate Attributes (1.3.6.1.5.5.7.10)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-aca-authenticationInfo [RFC3281]
2 id-aca-accessIdentity [RFC3281]
3 id-aca-chargingIdentity [RFC3281]
4 id-aca-group [RFC3281]
5 id-aca-role Reserved and Obsolete
6 id-aca-encAttrs [RFC3281]
7 id-aca-wlanSSID [RFC4334]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.17. "SMI Security for PKIX Qualified Certificate Statements" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Qualified
Certificate Statements (1.3.6.1.5.5.7.11)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-qcs-pkixQCSyntax-v1 [RFC3039]
2 id-qcs-pkixQCSyntax-v2 [RFC3739]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.18. "SMI Security for PKIX CMC Content Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CMC
Content Types (1.3.6.1.5.5.7.12)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-cct-crs Reserved and Obsolete
2 id-cct-PKIData [RFC2797]
3 id-cct-PKIResponse [RFC2797]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 16]
RFC 7299 PKIX OID Registry July 2014
3.19. "SMI Security for PKIX OIDs Used Only for Testing" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX OIDs used
Only for Testing (1.3.6.1.5.5.7.13)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ----------
1 id-TEST-certPolicyOne [RFC7229]
2 id-TEST-certPolicyTwo [RFC7229]
3 id-TEST-certPolicyThree [RFC7229]
4 id-TEST-certPolicyFour [RFC7229]
5 id-TEST-certPolicyFive [RFC7229]
6 id-TEST-certPolicySix [RFC7229]
7 id-TEST-certPolicySeven [RFC7229]
8 id-TEST-certPolicyEight [RFC7229]
Note: The object identifiers in this table should not appear on the
public Internet. These object identifiers are ONLY for
TESTING.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.20. "SMI Security for PKIX Certificate Policies" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX
Certificate Policies (1.3.6.1.5.5.7.14)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-cp-sbgpCertificatePolicy Reserved and Obsolete
2 id-cp-ipAddr-asNumber [RFC6484]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.21. "SMI Security for PKIX CMC Error Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX CMC Error
Types (1.3.6.1.5.5.7.15)" table with three columns has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-cet-skdFailInfo [RFC5275]
Housley Informational [Page 17]
RFC 7299 PKIX OID Registry July 2014
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.22. "SMI Security for PKIX Revocation Information Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Revocation
Information Types (1.3.6.1.5.5.7.16)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ----------
1 id-ri-crl [RFC5940]
2 id-ri-ocsp-response [RFC5940]
3 id-ri-delta-crl [RFC5940]
4 id-ri-scvp [RFC5940]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.23. "SMI Security for PKIX SCVP Check Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP Check
Types (1.3.6.1.5.5.7.17)" table with three columns has been added:
Decimal Description References
------- ------------------------------------------------ ----------
1 id-stc-build-pkc-path [RFC5055]
2 id-stc-build-valid-pkc-path [RFC5055]
3 id-stc-build-status-checked-pkc-path [RFC5055]
4 id-stc-build-aa-path [RFC5055]
5 id-stc-build-valid-aa-path [RFC5055]
6 id-stc-build-status-checked-aa-path [RFC5055]
7 id-stc-status-check-ac-and-build-status-checked-aa-path
[RFC5055]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 18]
RFC 7299 PKIX OID Registry July 2014
3.24. "SMI Security for PKIX SCVP Want Back Types" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP Want
Back Types (1.3.6.1.5.5.7.18)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-swb-pkc-best-cert-path [RFC5055]
2 id-swb-pkc-revocation-info [RFC5055]
3 id-swb-pkc-cert-status Reserved and Obsolete
4 id-swb-pkc-public-key-info [RFC5055]
5 id-swb-aa-cert-path [RFC5055]
6 id-swb-aa-revocation-info [RFC5055]
7 id-swb-ac-revocation-info [RFC5055]
8 id-swb-ac-cert-status Reserved and Obsolete
9 id-swb-relayed-responses [RFC5055]
10 id-swb-pkc-cert [RFC5055]
11 id-swb-ac-cert [RFC5055]
12 id-swb-pkc-all-cert-paths [RFC5055]
13 id-swb-pkc-ee-revocation-info [RFC5055]
14 id-swb-pkc-CAs-revocation-info [RFC5055]
15 id-swb-partial-cert-path [RFC5276]
16 id-swb-ers-pkc-cert [RFC5276]
17 id-swb-ers-best-cert-path [RFC5276]
18 id-swb-ers-partial-cert-path [RFC5276]
19 id-swb-ers-revocation-info [RFC5276]
20 id-swb-ers-all [RFC5276]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 19]
RFC 7299 PKIX OID Registry July 2014
3.25. "SMI Security for PKIX SCVP Validation Policies and Algorithms"
Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP
Validation Policies and Algorithms (1.3.6.1.5.5.7.19)" table with
three columns has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-svp-defaultValPolicy [RFC5055]
2 id-svp-nameValAlg [RFC5055]
3 id-svp-basicValAlg [RFC5055]
4 id-svp-dnValAlg [RFC5055]
Note: id-svp-nameValAlg is also known as id-nvae.
Note: id-svp-basicValAlg is also known as id-bvae.
Note: id-svp-dnValAlg is also known as id-dnvae and id-nva-dnCompAlg.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.26. "SMI Security for PKIX SCVP Name Validation Policy Errors"
Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP Name
Validation Policy Errors (1.3.6.1.5.5.7.19.2)" table with three
columns has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-nvae-name-mismatch [RFC5055]
2 id-nvae-no-name [RFC5055]
3 id-nvae-unknown-alg [RFC5055]
4 id-nvae-bad-name [RFC5055]
5 id-nvae-bad-name-type [RFC5055]
6 id-nvae-mixed-names [RFC5055]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 20]
RFC 7299 PKIX OID Registry July 2014
3.27. "SMI Security for PKIX SCVP Basic Validation Policy Errors"
Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP Basic
Validation Policy Errors (1.3.6.1.5.5.7.19.3)" table with three
columns has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-bvae-expired [RFC5055]
2 id-bvae-not-yet-valid [RFC5055]
3 id-bvae-wrongTrustAnchor [RFC5055]
4 id-bvae-noValidCertPath [RFC5055]
5 id-bvae-revoked [RFC5055]
9 id-bvae-invalidKeyPurpose [RFC5055]
10 id-bvae-invalidKeyUsage [RFC5055]
11 id-bvae-invalidCertPolicy [RFC5055]
12 id-bvae-invalidName Reserved and Obsolete
13 id-bvae-invalidEntity Reserved and Obsolete
14 id-bvae-invalidPathDepth Reserved and Obsolete
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.28. "SMI Security for PKIX SCVP Distinguished Name Validation Policy
Errors" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX SCVP
Distinguished Name Validation Policy Errors (1.3.6.1.5.5.7.19.4)"
table with three columns has been added:
Decimal Description References
------- ------------------------------ ----------
Note: This table is currently empty.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 21]
RFC 7299 PKIX OID Registry July 2014
3.29. "SMI Security for PKIX Other Logotype Identifiers" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Other
Logotype Identifiers (1.3.6.1.5.5.7.20)" table with three columns has
been added:
Decimal Description References
------- ------------------------------ ----------
1 id-logo-loyalty [RFC3709]
2 id-logo-background [RFC3709]
3 id-logo-certImage [RFC6170]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.30. "SMI Security for PKIX Proxy Certificate Policy Languages"
Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Proxy
Certificate Policy Languages (1.3.6.1.5.5.7.21)" table with three
columns has been added:
Decimal Description References
------- ------------------------------ ----------
0 id-ppl-anyLanguage [RFC3820]
1 id-ppl-inheritAll [RFC3820]
2 id-ppl-independent [RFC3820]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.31. "SMI Security for PKIX Proxy Matching Rules" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Proxy
Matching Rules (1.3.6.1.5.5.7.22)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-mr-pkix-alphanum-ids Reserved and Obsolete
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 22]
RFC 7299 PKIX OID Registry July 2014
3.32. "SMI Security for PKIX Subject Key Identifier Semantics" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Subject
Key Identifier Semantics (1.3.6.1.5.5.7.23)" table with three columns
has been added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-skis-keyHash Reserved and Obsolete
2 id-skis-4BitKeyHash Reserved and Obsolete
3 id-skis-keyInfoHash Reserved and Obsolete
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
3.33. "SMI Security for PKIX Access Descriptor" Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Access
Descriptor (1.3.6.1.5.5.7.48)" table with three columns has been
added:
Decimal Description References
------- ------------------------------ ---------------------
1 id-ad-ocsp [RFC2459]
2 id-ad-caIssuers [RFC2459]
3 id-ad-timestamping [RFC3161]
4 id-ad-dvcs [RFC3029]
5 id-ad-caRepository [RFC3280]
6 id-ad-http-certs [RFC4387]
7 id-ad-http-crls [RFC4387]
8 id-ad-xkms Reserved and Obsolete
9 id-ad-signedObjectRepository Reserved and Obsolete
10 id-ad-rpkiManifest [RFC6487]
11 id-ad-signedObject [RFC6487]
12 id-ad-cmc [RFC6402]
Note: id-ad-ocsp is also known as id-pkix-ocsp.
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
Housley Informational [Page 23]
RFC 7299 PKIX OID Registry July 2014
3.34. "SMI Security for PKIX Online Certificate Status Protocol (OCSP)"
Registry
Within the SMI-numbers registry, an "SMI Security for PKIX Online
Certificate Status Protocol (OCSP) (1.3.6.1.5.5.7.48.1)" table with
three columns has been added:
Decimal Description References
------- ------------------------------ ----------
1 id-pkix-ocsp-basic [RFC2560]
2 id-pkix-ocsp-nonce [RFC2560]
3 id-pkix-ocsp-crl [RFC2560]
4 id-pkix-ocsp-response [RFC2560]
5 id-pkix-ocsp-nocheck [RFC2560]
6 id-pkix-ocsp-archive-cutoff [RFC2560]
7 id-pkix-ocsp-service-locator [RFC2560]
8 id-pkix-ocsp-pref-sig-algs [RFC6277]
9 id-pkix-ocsp-extended-revoke [RFC6960]
Future updates to this table are to be made according to the
Specification Required policy as defined in [RFC5226].
4. Security Considerations
This document populates an IANA registry, and it raises no new
security considerations. The protocols that specify these values
include the security considerations associated with their usage.
The id-pe-nsa certificate extension should not appear in any
certificate that is used on the public Internet.
Housley Informational [Page 24]
RFC 7299 PKIX OID Registry July 2014
5. References
5.1. Normative References
[ASN1-08] International Telecommunication Union, "Abstract Syntax
Notation One (ASN.1): Specification of basic notation",
ITU-T Recommendation X.680, November 2008.
[ASN1-88] International Telephone and Telegraph Consultative
Committee, "Specification of Abstract Syntax Notation One
(ASN.1)", CCITT Recommendation X.208, 1988.
[ASN1-97] International Telecommunication Union, "Abstract Syntax
Notation One (ASN.1): Specification of basic notation",
ITU-T Recommendation X.680, 1997.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.
5.2. Informative References
[Err3860] RFC Errata, Errata ID 3860, RFC 6402,
-- Leo's gemini proxy
-- Connecting to gemini.bortzmeyer.org:1965...
-- Connected
-- Sending request
-- Meta line: 20 text/plain
-- Response ended
-- Page fetched on Tue May 7 01:06:48 2024