Network Working Group L. Liao Internet-Draft NIO Intended status: Standards Track 17 September 2026 Expires: 21 March 2027 Additions to C509 Structures draft-liao-cose-c509-additions-00 Abstract This document defines additions to CBOR Encoded X.509 Certificates (C509). This document defines a new C509SubjectPublicKeyInfo type, a CBOR representation of the X.509 SubjectDirectoryAttributes extension, and a mechanism that allows organizations assigned a Private Enterprise Number (PEN) to define organization-specific integer identifiers without registering each identifier in the C509 RDN attribute type, CR attribute type, extension ID, certificate policy, or extended key usage registries. This document also defines textual encoding labels for C509 objects using the textual encoding conventions specified in RFC 7468. About This Document This note is to be removed before publishing as an RFC. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-liao-cose-c509-additions/. Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (mailto:cose@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/cose/. Subscribe at https://www.ietf.org/mailman/listinfo/cose/. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Liao Expires 21 March 2027 [Page 1] Internet-Draft C509 Additions September 2026 Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 21 March 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Notational Conventions . . . . . . . . . . . . . . . . . . . 4 3. C509 Public Key . . . . . . . . . . . . . . . . . . . . . . . 4 4. Extensions . . . . . . . . . . . . . . . . . . . . . . . . . 4 4.1. Extension Subject Directory Attributes . . . . . . . . . 4 4.1.1. DateOfBirth . . . . . . . . . . . . . . . . . . . . . 5 4.1.2. PlaceOfBirth . . . . . . . . . . . . . . . . . . . . 5 4.1.3. Gender . . . . . . . . . . . . . . . . . . . . . . . 5 4.1.4. CountryOfCitizenship . . . . . . . . . . . . . . . . 6 4.1.5. CountryOfResidence . . . . . . . . . . . . . . . . . 6 5. PEN-Scoped Identifiers . . . . . . . . . . . . . . . . . . . 6 6. Textual Encoding (PEM) . . . . . . . . . . . . . . . . . . . 7 6.1. General Rules . . . . . . . . . . . . . . . . . . . . . . 7 6.2. C509 Certificate . . . . . . . . . . . . . . . . . . . . 7 6.3. COSE_C509 . . . . . . . . . . . . . . . . . . . . . . . . 8 6.4. C509 Certification Request . . . . . . . . . . . . . . . 8 6.5. C509 Public Key . . . . . . . . . . . . . . . . . . . . . 8 6.6. C509 Private Key . . . . . . . . . . . . . . . . . . . . 9 6.7. C509 PEM . . . . . . . . . . . . . . . . . . . . . . . . 9 6.8. PEM Label Summary . . . . . . . . . . . . . . . . . . . . 9 7. Security Considerations . . . . . . . . . . . . . . . . . . . 10 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 8.1. C509 Subject Directory Attributes Registry . . . . . . . 10 8.2. C509 RDN Attributes Registry . . . . . . . . . . . . . . 12 8.3. C509 CR Attributes Registry . . . . . . . . . . . . . . . 12 Liao Expires 21 March 2027 [Page 2] Internet-Draft C509 Additions September 2026 8.4. C509 Extensions Registry . . . . . . . . . . . . . . . . 12 8.5. C509 Certificate Policies Registry . . . . . . . . . . . 12 8.6. C509 Extended Key Usages Registry . . . . . . . . . . . . 12 8.7. PEM Label Registry . . . . . . . . . . . . . . . . . . . 12 8.8. CoAP Content-Formats Registry . . . . . . . . . . . . . . 13 8.9. Media Type Application Registry . . . . . . . . . . . . . 13 8.9.1. Media Type application/cose-c509-pubkey+cbor . . . . 13 9. Normative References . . . . . . . . . . . . . . . . . . . . 14 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 15 1. Introduction [I-D.ietf-cose-cbor-encoded-cert] defines C509 certificate structure, a compact CBOR encoding of X.509 certificates. C509 supports a large subset of the X.509 certificate profile defined in [RFC5280] and is designed for use in constrained environments as well as general certificate-based protocols. The base C509 specification defines the public key as fields within the certificate structure. It also defines compact integer identifiers for selected X.509 RDN attribute types, CR attribute types, extension IDs, certificate policies, and extended key usages. This document defines additions to the C509 specification in four areas. * Defines a new structure C509SubjectPublicKeyInfo which corresponds to SubjectPublicKeyInfo in X.509 Section 4.1 of [RFC5280]. This permits a C509 public key to be represented independently of a complete C509 certificate. * Defines the C509 representation of the X.509 SubjectDirectoryAttributes extension specified in Section 4.2.1.8 of [RFC5280]. * Defines PEN-scoped identifiers. An organization that has been assigned a Private Enterprise Number (PEN) can assign integer values within its own namespace. Such identifiers can be used for RDN attribute types, CR attribute types, extension IDs, certificate policies, and extended key usages without requiring each identifier to be registered in a C509 IANA registry. * Defines PEM labels for C509 objects using the textual encoding framework specified by [RFC7468]. Liao Expires 21 March 2027 [Page 3] Internet-Draft C509 Additions September 2026 This document is intended to be used together with [I-D.ietf-cose-cbor-encoded-cert]. It does not define a new certificate format; it adds types and encoding mechanisms to the C509 data model. 2. Notational Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. C509 Public Key This document defines the following reusable C509 subject public key type: C509SubjectPublicKeyInfo = [ subjectPublicKeyAlgorithm : AlgorithmIdentifier, subjectPublicKey : Defined ] Figure 1: CDDL for C509SubjectPublicKeyInfo The subjectPublicKeyAlgorithm field has the same encoding and semantics as the subjectPublicKeyAlgorithm field of TBSCertificate in [I-D.ietf-cose-cbor-encoded-cert]. The subjectPublicKey field has the same encoding and semantics as the subjectPublicKey field of TBSCertificate in [I-D.ietf-cose-cbor-encoded-cert]. In particular, algorithm-specific C509 encodings defined by [I-D.ietf-cose-cbor-encoded-cert] apply equally when the public key is represented using C509SubjectPublicKeyInfo. For example, the optimized RSA encoding and elliptic-curve public key encoding apply to C509SubjectPublicKeyInfo. 4. Extensions 4.1. Extension Subject Directory Attributes X.509 defines the SubjectDirectoryAttributes extension in Section 4.2.1.8 of [RFC5280]. This document defines a C509 representation of that extension. The extension value is represented as SubjectDirectoryAttributes: Liao Expires 21 March 2027 [Page 4] Internet-Draft C509 Additions September 2026 SubjectDirectoryAttributes = [ + SubjectDirectoryAttribute ] SubjectDirectoryAttribute = (( attributeType: int, attributeValue: Defined ) // ( attributeType: ~oid, attributeValue: bytes )) Figure 2: CDDL for SubjectDirectoryAttributes Each 'attributeType' is encoded either as a CBOR int (see Section 8.1) or as an unwrapped CBOR OID [RFC9090]. * If 'attributeType' is encoded as a CBOR int, it is followed by a CBOR item of any type other than undefined. The specific type of the item is determined by 'attributeType'. * If 'attributeType' is encoded as an unwrapped CBOR OID, it is followed by the DER-encoded 'values' (which is SET OF AttributeValue) encoded as a CBOR byte string. 4.1.1. DateOfBirth The personal data attribute 'DateOfBirth' is defined in [RFC3739] as 'GeneralizedTime'. In C509, the 'attributeValue' field has type CBOR text represented as 'YYYYMMDD', where the first 4 digits are the year, followed by 2 digits for the month and 2 digits for the day. 4.1.2. PlaceOfBirth The personal data attribute 'PlaceOfBirth' is defined in [RFC3739] as 'DirectoryString'. In C509, the 'attributeValue' field has type PlaceOfBirth. A UTF8 String is encoded as CBOR text, and a Printable String is tagged with number 121 (alternative 0, as defined in [IANA- CBOR-TAGS]). All other string types are not supported. For native certificates and certification requests, only UTF8 String is allowed. PlaceOfBirth = text / #6.121(text) 4.1.3. Gender The personal data attribute 'Gender' is defined in [RFC3739] as 'PrintableString'. In C509, the 'attributeValue' field has type CBOR text. Liao Expires 21 March 2027 [Page 5] Internet-Draft C509 Additions September 2026 4.1.4. CountryOfCitizenship The personal data attribute 'CountryOfCitizenship' is defined in [RFC3739] as 'PrintableString'. In C509, only a single CountryOfCitizenship value is supported. The 'attributeValue' field has type CBOR text. 4.1.5. CountryOfResidence The personal data attribute 'CountryOfResidence' is defined in [RFC3739] as 'PrintableString'. In C509, the 'attributeValue' field has type CBOR text. 5. PEN-Scoped Identifiers [I-D.ietf-cose-cbor-encoded-cert] defines integer identifiers for commonly used RDN attributes, CR attributes, extensions, extended key usages, and certificate policies, and this document defines the subject directory attributes. These integer identifiers provide compact encodings. An organization may also need identifiers that are meaningful only within its own ecosystem. Requiring each such identifier to be allocated from an IANA registry is unnecessary when the organization already has a globally unique namespace through a Private Enterprise Number. This document therefore reserves two intervals for PEN-scoped identifiers for the RDN attributes, CR attributes, extensions, extended key usages, certificate policies, and subject directory attributes. Both the PEN and the internal ID are represented as 'bn ... b1 b0', where bn is the most significant bit and b0 is the least significant bit. * Interval [2^31, 2^32 - 1]: For PEN in [0, 2^21 - 1], and internal ID: [0, 2^10 - 1] The integer value is constructed as follows: b'1' || 21-bit PEN || 10-bit internal ID * Interval [2^47, 2^48-1]: For all identifiers that cannot be represented in the interval [2^31, 2^32 - 1]: Liao Expires 21 March 2027 [Page 6] Internet-Draft C509 Additions September 2026 - PEN in the interval [2^21, 2^32 -1] and internal ID in [0, 2^15 - 1] - PEN in [0, 2^21 - 1] and internal ID in [2^11, 2^15 - 1] The integer value is constructed as follows: b'1' || 32-bit PEN || 15-bit internal ID 6. Textual Encoding (PEM) This section defines textual (PEM) encodings for C509 structures, following the conventions of [RFC7468]. The textual encodings use base64-encoded binary data enclosed between "-----BEGIN LABEL-----" and "-----END LABEL-----" lines and carry CBOR-encoded C509 objects rather than DER-encoded ASN.1 objects. 6.1. General Rules Each C509 PEM block MUST conform to the following rules: * The binary payload is the CBOR encoding of the structure. CBOR encoding MUST be deterministic as specified in Sections 4.2.1 and 4.2.2 of [RFC8949]. * The binary payload is base64-encoded according to Section 4 of [RFC4648] (standard Base64 with padding characters =). Parsers SHOULD ignore whitespace and other non-base64 characters as per Section 2 of [RFC7468]. * The encapsulation boundaries follow Section 2 of [RFC7468]: -----BEGIN LABEL----- (base64-encoded CBOR payload) -----END LABEL----- * No header fields (as described in Section 2 of [RFC7468]) are defined for any of the labels in this document. Implementations MUST ignore any header fields encountered. * Explanatory text before the pre-encapsulation boundary is allowed. Implementations MUST NOT require or rely on such text. 6.2. C509 Certificate PEM label: C509 CERTIFICATE Liao Expires 21 March 2027 [Page 7] Internet-Draft C509 Additions September 2026 The payload is a CBOR-encoded C509Certificate as defined in [I-D.ietf-cose-cbor-encoded-cert]. -----BEGIN C509 CERTIFICATE----- (base64-encoded CBOR C509Certificate) -----END C509 CERTIFICATE----- Figure 3: C509 Certificate PEM Encoding 6.3. COSE_C509 PEM label: COSE C509 The payload is a CBOR-encoded COSE_C509 as defined in [I-D.ietf-cose-cbor-encoded-cert]. -----BEGIN COSE C509----- (base64-encoded CBOR COSE_C509) -----END COSE C509----- Figure 4: COSE_C509 PEM Encoding 6.4. C509 Certification Request PEM label: C509 CERTIFICATE REQUEST The payload is a CBOR-encoded C509CertificationRequest as defined in [I-D.ietf-cose-cbor-encoded-cert], Section 4. -----BEGIN C509 CERTIFICATE REQUEST----- (base64-encoded CBOR C509CertificationRequest) -----END C509 CERTIFICATE REQUEST----- Figure 5: C509 Certification Request PEM Encoding 6.5. C509 Public Key PEM label: C509 PUBLIC KEY The payload is a CBOR-encoded C509SubjectPublicKeyInfo as defined in Section 3. -----BEGIN C509 PUBLIC KEY----- (base64-encoded CBOR C509SubjectPublicKeyInfo) -----END C509 PUBLIC KEY----- Figure 6: C509 Public Key PEM Encoding Liao Expires 21 March 2027 [Page 8] Internet-Draft C509 Additions September 2026 6.6. C509 Private Key PEM label: C509 PRIVATE KEY The payload is a CBOR-encoded C509PrivateKey as defined in [I-D.ietf-cose-cbor-encoded-cert]. -----BEGIN C509 PRIVATE KEY----- (base64-encoded CBOR C509PrivateKey) -----END C509 PRIVATE KEY----- Figure 7: C509 Private Key PEM Encoding 6.7. C509 PEM PEM label: C509 PEM The payload is a CBOR-encoded C509PEM as defined in [I-D.ietf-cose-cbor-encoded-cert]. -----BEGIN C509 PEM----- (base64-encoded CBOR C509PEM) -----END C509 PEM----- Figure 8: C509 PEM Encoding 6.8. PEM Label Summary The following table summarizes all PEM labels defined in this document and compares them with RFC 7468 labels for equivalent DER- encoded structures. Liao Expires 21 March 2027 [Page 9] Internet-Draft C509 Additions September 2026 +===========+========================+=================================+===========+ |PEM Label |C509 Structure |Defined in |RFC 7468 | | | | |Label | +===========+========================+=================================+===========+ |C509 |C509Certificate |[I-D.ietf-cose-cbor-encoded-cert]|CERTIFICATE| |CERTIFICATE| | | | +-----------+------------------------+---------------------------------+-----------+ |COSE C509 |COSE_C509 |[I-D.ietf-cose-cbor-encoded-cert]|N/A | +-----------+------------------------+---------------------------------+-----------+ |C509 |C509CertificationRequest|[I-D.ietf-cose-cbor-encoded-cert]|CERTIFICATE| |CERTIFICATE| | |REQUEST | |REQUEST | | | | +-----------+------------------------+---------------------------------+-----------+ |C509 PUBLIC|C509PublicKey |[[this document]] |PUBLIC KEY | |KEY | | | | +-----------+------------------------+---------------------------------+-----------+ |C509 |C509PrivateKey |[I-D.ietf-cose-cbor-encoded-cert]|PRIVATE KEY| |PRIVATE KEY| | | | +-----------+------------------------+---------------------------------+-----------+ |C509 PEM |C509PEM |[I-D.ietf-cose-cbor-encoded-cert]|N/A | +-----------+------------------------+---------------------------------+-----------+ Table 1: PEM Labels Defined in This Document 7. Security Considerations TODO 8. IANA Considerations 8.1. C509 Subject Directory Attributes Registry IANA has created a new registry titled "C509 Subject Directory Attributes" under the registry group "CBOR Encoded X.509 (C509)". The registry fields are Value, Name, Identifiers, OID, DER, Comments, attributeValue, and Reference, where Value is an integer in the interval [-2^63, 2^63 - 1], and the other columns are text strings. Name and Identifiers are informal descriptions. The fields Name, OID, and DER are mandatory. For Subject Directory Attributes specified only for CBOR encoded certificates where no OID is defined, the OID and DER fields are marked "N/A". If an OID is present, it is given in dotted decimal representation, and the DER column contains the hex string of the DER-encoded OID [X.690]. If the attribute is not expected to be understood from the other information (for example, the OID), then the Comments field must contain a reference to where the Subject Directory Attribute is described. Liao Expires 21 March 2027 [Page 10] Internet-Draft C509 Additions September 2026 Values in the interval [32768, 65535] are reserved for Private Use, values in the intervals [2^31, 2^32 - 1] and [2^47, 2^48-1] are reserved for PEN identifiers as in Section 5, values in the intervals [65536, 2^31 -1], [2^32, 2^47 -1], and [2^48, 2^63 - 1] are reserved for Future Use. For values in the interval [-24, 23] the registration procedure is "IETF Review with Expert Review", and for all other values the registration procedure is "Expert Review". The initial contents of the registry are: +-------+-----------------------------------------------------------+ | Value | Subject Directory Attribute | +=======+===========================================================+ | 1 | Name: DateOfBirth | | | Identifiers: id-pda-dateOfBirth | | | OID: 1.2.840.113549.1.9.14 | | | DER: 06 08 2B 06 01 05 05 07 09 01 | | | Comments: RFC 3739 | | | attributeValue: text | +-------+-----------------------------------------------------------+ | 2 | Name: PlaceOfBirth | | | Identifiers: id-pda-placeOfBirth | | | DER: 06 08 2B 06 01 05 05 07 09 02 | | | Comments: RFC 3739 | | | attributeValue: PlaceOfBirth | +-------+-----------------------------------------------------------+ | 3 | Name: Gender | | | Identifiers: id-pda-gender | | | DER: 06 08 2B 06 01 05 05 07 09 03 | | | Comments: RFC 3739 | | | attributeValue: text | +-------+-----------------------------------------------------------+ | 4 | Name: CountryOfCitizenship | | | Identifiers: id-pda-countryOfCitizenship | | | DER: 06 08 2B 06 01 05 05 07 09 04 | | | Comments: RFC 3739 | | | attributeValue: text | +-------+-----------------------------------------------------------+ | 5 | Name: CountryOfResidence | | | Identifiers: id-pda-countryOfResidence | | | DER: 06 08 2B 06 01 05 05 07 09 05 | | | Comments: RFC 3739 | | | attributeValue: text | +-------+-----------------------------------------------------------+ Figure 9: C509 Subject Directory Attributes Liao Expires 21 March 2027 [Page 11] Internet-Draft C509 Additions September 2026 8.2. C509 RDN Attributes Registry This document updates the following ranges in the "C509 RDN Attributes" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in Section 5. 8.3. C509 CR Attributes Registry This document updates the following ranges in the "C509 CR Attributes" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in Section 5. 8.4. C509 Extensions Registry This document updates the following ranges in the "C509 Extensions" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in Section 5. 8.5. C509 Certificate Policies Registry This document updates the following ranges in the "C509 Certificate Policies" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in Section 5. 8.6. C509 Extended Key Usages Registry This document updates the following ranges in the "C509 Extended Key Usages" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in Section 5. 8.7. PEM Label Registry IANA is requested to register the following entries in the "Textual Encoding Label" registry under the registry group "PKIX Parameters" [RFC7468]: Liao Expires 21 March 2027 [Page 12] Internet-Draft C509 Additions September 2026 +==========================+===============+ | Label | Reference | +==========================+===============+ | C509 CERTIFICATE | This document | +--------------------------+---------------+ | COSE C509 | This document | +--------------------------+---------------+ | C509 CERTIFICATE REQUEST | This document | +--------------------------+---------------+ | C509 PUBLIC KEY | This document | +--------------------------+---------------+ | C509 PRIVATE KEY | This document | +--------------------------+---------------+ | C509 PEM | This document | +--------------------------+---------------+ Table 2: PEM Label Registrations 8.8. CoAP Content-Formats Registry IANA is requested to add an entry for application/cose- c509-pubkey+cbor to the "CoAP Content-Formats" registry in the registry group "Constrained RESTful Environments (CoRE) Parameters". +---------------------------+---------+-----------+-------+------------+ | Content | Content | Media | ID | Reference | | Format | Coding | Type | | | +===========================+=========+===========+=======+============+ | application/ | - | [[link | TBD1 | [[this | | cose-c509-pubkey+cbor | | to TODO]] | | document]] | +---------------------------+---------+-----------+-------+------------+ Figure 10: CoAP Content-Format IDs 8.9. Media Type Application Registry IANA is requested to assign the following entries into the "application" registry in the registry group "Media Types" with this document as reference. 8.9.1. Media Type application/cose-c509-pubkey+cbor When the 'application/cose-c509-pubkey+cbor' media type is used, the data is a C509SubjectPublicKeyInfo structure. Type name: application Subtype name: cose-c509-pubkey+cbor Liao Expires 21 March 2027 [Page 13] Internet-Draft C509 Additions September 2026 Required parameters: N/A Optional parameters: N/A Encoding considerations: binary Security considerations: See the Security Considerations section of [[this document]]. Interoperability considerations: N/A Published specification: [[this document]] Applications that use this media type: Applications that employ COSE and use C509 as a certificate type. Fragment identifier considerations: N/A Additional information: * Deprecated alias names for this type: N/A * Magic number(s): TBD2 * File extension(s): .c509 * Macintosh file type code(s): N/A Person & email address to contact for further information: iesg@ietf.org Intended usage: COMMON Restrictions on usage: N/A Author: COSE WG Change controller: IETF 9. Normative References [I-D.ietf-cose-cbor-encoded-cert] Mattsson, J. P., Selander, G., Raza, S., Höglund, J., Furuhed, M., and L. Liao, "CBOR Encoded X.509 Certificates (C509 Certificates)", Work in Progress, Internet-Draft, draft-ietf-cose-cbor-encoded-cert-20, 30 June 2026, . Liao Expires 21 March 2027 [Page 14] Internet-Draft C509 Additions September 2026 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC3739] Santesson, S., Nystrom, M., and T. Polk, "Internet X.509 Public Key Infrastructure: Qualified Certificates Profile", RFC 3739, DOI 10.17487/RFC3739, March 2004, . [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006, . [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, . [RFC7468] Josefsson, S. and S. Leonard, "Textual Encodings of PKIX, PKCS, and CMS Structures", RFC 7468, DOI 10.17487/RFC7468, April 2015, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8949] Bormann, C. and P. Hoffman, "Concise Binary Object Representation (CBOR)", STD 94, RFC 8949, DOI 10.17487/RFC8949, December 2020, . [RFC9090] Bormann, C., "Concise Binary Object Representation (CBOR) Tags for Object Identifiers", RFC 9090, DOI 10.17487/RFC9090, July 2021, . [X.690] "ASN.1 encoding rules. Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", n.d., . Author's Address Lijun Liao NIO Email: lijun.liao@nio.io Liao Expires 21 March 2027 [Page 15]