ISO/IEC 9594-11:2020

Overview

ISO/IEC 9594-11:2020 (also published as ITU‑T X.510) defines protocol specifications for secure operations within the Open Systems Interconnection (OSI) Directory framework. The standard specifies a general wrapper protocol that provides authentication, integrity and optional confidentiality for other protocols - enabling security to be applied independently of the protected protocol specifications. It also provides guidance and auxiliary algorithm constructs to support cryptographic algorithm migration, including migration paths toward quantum‑safe algorithms, and supplies ASN.1 specifications to support that migration.

Key technical topics and requirements

• Wrapper protocol: A generic security layer that authenticates, protects integrity, and can encrypt protected protocol data units without embedding specific cryptographic algorithm choices into the protected protocols.
• Algorithm migration support: Guidance and auxiliary cryptographic algorithm definitions to allow smooth transition to stronger or quantum‑safe cryptography. The wrapper is designed for easy “plug‑in” of new algorithms.
• ASN.1 specifications: Data type and information object class tools to support multiple-cryptographic-algorithm specifications and migration.
• Key management and establishment: Concepts for establishing shared keys and symmetric key renewal during data transfer.
• Association and session management: Handshake, association accept/reject, error handling, sequence numbers, and abort procedures to manage secure sessions.
• Protected protocols defined: Examples of protocols designed to run under the wrapper include Authorization and Validation List (AVL) management, Certification Authority (CA) subscription for public‑key certificate status, and trust broker access.
• Error handling and diagnostics: Defined checks and diagnostic codes for secure handshake and data transfer phases.

Practical applications and who uses this standard

ISO/IEC 9594-11:2020 is intended for organizations and professionals who implement or design secure directory and PKI-related systems, including:

• PKI implementers and Certification Authorities (CAs) - for certificate subscription and status services.
• Directory service operators and vendors - to secure directory operations without embedding crypto details into application protocols.
• Security architects and network engineers - to design systems that can be migrated to quantum‑safe algorithms and maintain long‑term security.
• Standards developers - to create protected protocols that rely on the wrapper protocol for security.

Practical benefits include decoupling security from protocol logic, simplifying upgrades to stronger cryptography, and enabling interoperability across implementations while supporting future algorithm evolution.

Related standards

• Part of the ISO/IEC 9594 Directory series and aligned with ITU‑T X.510. The standard is designed so other Recommendations or International Standards can define protocols intended to be protected by the wrapper protocol. Keywords: ISO/IEC 9594-11:2020, wrapper protocol, PKI, cryptographic algorithm migration, quantum-safe, ASN.1, authentication, integrity, confidentiality.