ISO/IEC 9594-8:2020

Overview

ISO/IEC 9594-8:2020 - also published as ITU‑T X.509 (10/2019) - defines the public-key and attribute certificate frameworks used in Directory services. This international standard specifies the information objects, data types and schema components required for a public‑key infrastructure (PKI) and a privilege management infrastructure (PMI). It covers certificate formats, revocation mechanisms (CRLs and ACRLs), authorization and validation lists (AVLs), extensibility for certificate and revocation schemes, and directory schema elements (object classes, attribute types and matching rules) for storing PKI/PMI data.

Key Topics and Requirements

• Public‑key certificate framework (PKI):
  • Defines public‑key certificates, certificate revocation lists (CRLs), trust anchors, and certification path concepts.
  • Specifies certificate creation, key‑pair generation guidance, and certificate/CRL extension mechanisms.
• Attribute certificate framework (PMI):
  • Defines attribute certificates, attribute certificate revocation lists (ACRLs), delegation paths and privilege representations for access control.
• Revocation and validation:
  • Standardizes CRL/ACRL formats, delta CRLs, indirect CRLs and Authorization and Validation Lists (AVLs) to support certificate status checking.
• Directory schema and encoding:
  • Provides ASN.1‑based schema components for storing PKI/PMI data in a Directory (object classes, attribute types, matching rules).
  • Prescribes Distinguished Encoding Rules (DER) use for canonical representations.
• Extensions & extensibility:
  • Includes a set of generally useful certificate and revocation extensions and specifies mechanisms to extend formats safely.
• Security scope:
  • Specifies strong authentication frameworks based on cryptographic credentials; emphasizes that authentication and other services must be applied within a defined security policy.

Applications and Practical Uses

• Implementing and operating Certificate Authorities (CAs) and Attribute Authorities for enterprise and public PKI/PMI.
• Designing directory services that store certificates, revocation data and authorization metadata.
• Enabling secure protocols and services that rely on X.509 certificates: TLS/SSL, secure email (S/MIME), code signing, enterprise single sign‑on, device identity for IoT, smart cards and access control systems.
• Building certificate validation and revocation checking mechanisms in client and server software.
• Guiding policy authors, security architects and auditors on certificate, revocation and directory data models.

Who Should Use This Standard

• PKI/PMI implementers, CA operators and directory administrators
• Security architects, identity and access management (IAM) engineers
• Software vendors building TLS/PKI clients, OCSP/CRL processors and directory servers
• Regulators and auditors evaluating certificate management practices

Related Standards

• ITU‑T X.509 (10/2019) - source specification aligned with this edition
• Other parts of the ISO/IEC 9594 series (The Directory) for complementary Directory protocols and models

Keywords: ISO/IEC 9594-8:2020, X.509, public-key certificate, attribute certificate, PKI, PMI, CRL, ACRL, directory schema, certificate revocation, strong authentication, ASN.1, DER.