<?xml version='1.0' encoding='utf-8'?>
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" version="3" ipr="trust200902" docName="draft-ietf-lamps-pkcs8-prikeyinfo-contenttypes-04" number="9939" updates="" obsoletes="" xml:lang="en" category="std" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" prepTime="2026-02-28T21:08:27" indexInclude="true" scripts="Common,Latin" tocDepth="3">
  <link href="https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs8-prikeyinfo-contenttypes-04" rel="prev"/>
  <link href="https://dx.doi.org/10.17487/rfc9939" rel="alternate"/>
  <link href="urn:issn:2070-1721" rel="alternate"/>
  <front>
    <title abbrev="PKCS #8: PrivateKeyInfo Content Types">PKCS #8: Private-Key Information Content Types</title>
    <seriesInfo name="RFC" value="9939" stream="IETF"/>
    <author initials="J." surname="Mandel" fullname="Joe Mandel">
      <organization abbrev="AKAYLA" showOnFrontPage="true">AKAYLA, Inc.</organization>
      <address>
        <email>joe@akayla.com</email>
      </address>
    </author>
    <author initials="R." surname="Housley" fullname="Russ Housley">
      <organization abbrev="Vigil Security" showOnFrontPage="true">Vigil Security, LLC</organization>
      <address>
        <email>housley@vigilsec.com</email>
      </address>
    </author>
    <author initials="S." surname="Turner" fullname="Sean Turner">
      <organization abbrev="sn3rd" showOnFrontPage="true">sn3rd</organization>
      <address>
        <email>sean@sn3rd.com</email>
      </address>
    </author>
    <date month="02" year="2026"/>
    <area>SEC</area>
    <workgroup>lamps</workgroup>
    <keyword>CMS</keyword>
    <abstract pn="section-abstract">
      <t indent="0" pn="section-abstract-1">This document defines PKCS #8 content types for use with
PrivateKeyInfo and EncryptedPrivateKeyInfo as specified in
RFC 5958.</t>
    </abstract>
    <boilerplate>
      <section anchor="status-of-memo" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.1">
        <name slugifiedName="name-status-of-this-memo">Status of This Memo</name>
        <t indent="0" pn="section-boilerplate.1-1">
            This is an Internet Standards Track document.
        </t>
        <t indent="0" pn="section-boilerplate.1-2">
            This document is a product of the Internet Engineering Task Force
            (IETF).  It represents the consensus of the IETF community.  It has
            received public review and has been approved for publication by
            the Internet Engineering Steering Group (IESG).  Further
            information on Internet Standards is available in Section 2 of 
            RFC 7841.
        </t>
        <t indent="0" pn="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <eref target="https://www.rfc-editor.org/info/rfc9939" brackets="none"/>.
        </t>
      </section>
      <section anchor="copyright" numbered="false" removeInRFC="false" toc="exclude" pn="section-boilerplate.2">
        <name slugifiedName="name-copyright-notice">Copyright Notice</name>
        <t indent="0" pn="section-boilerplate.2-1">
            Copyright (c) 2026 IETF Trust and the persons identified as the
            document authors. All rights reserved.
        </t>
        <t indent="0" pn="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<eref target="https://trustee.ietf.org/license-info" brackets="none"/>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document. Code Components extracted from this
            document must include Revised BSD License text as described in
            Section 4.e of the Trust Legal Provisions and are provided without
            warranty as described in the Revised BSD License.
        </t>
      </section>
    </boilerplate>
    <toc>
      <section anchor="toc" numbered="false" removeInRFC="false" toc="exclude" pn="section-toc.1">
        <name slugifiedName="name-table-of-contents">Table of Contents</name>
        <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1">
          <li pn="section-toc.1-1.1">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.1.1"><xref derivedContent="1" format="counter" sectionFormat="of" target="section-1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-introduction">Introduction</xref></t>
          </li>
          <li pn="section-toc.1-1.2">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.2.1"><xref derivedContent="2" format="counter" sectionFormat="of" target="section-2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-private-key-information-con">Private-Key Information Content Types</xref></t>
          </li>
          <li pn="section-toc.1-1.3">
            <t indent="0" keepWithNext="true" pn="section-toc.1-1.3.1"><xref derivedContent="3" format="counter" sectionFormat="of" target="section-3"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-asn1-module">ASN.1 Module</xref></t>
          </li>
          <li pn="section-toc.1-1.4">
            <t indent="0" pn="section-toc.1-1.4.1"><xref derivedContent="4" format="counter" sectionFormat="of" target="section-4"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-security-considerations">Security Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.5">
            <t indent="0" pn="section-toc.1-1.5.1"><xref derivedContent="5" format="counter" sectionFormat="of" target="section-5"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-iana-considerations">IANA Considerations</xref></t>
          </li>
          <li pn="section-toc.1-1.6">
            <t indent="0" pn="section-toc.1-1.6.1"><xref derivedContent="6" format="counter" sectionFormat="of" target="section-6"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-references">References</xref></t>
            <ul bare="true" empty="true" indent="2" spacing="compact" pn="section-toc.1-1.6.2">
              <li pn="section-toc.1-1.6.2.1">
                <t indent="0" pn="section-toc.1-1.6.2.1.1"><xref derivedContent="6.1" format="counter" sectionFormat="of" target="section-6.1"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-normative-references">Normative References</xref></t>
              </li>
              <li pn="section-toc.1-1.6.2.2">
                <t indent="0" pn="section-toc.1-1.6.2.2.1"><xref derivedContent="6.2" format="counter" sectionFormat="of" target="section-6.2"/>.  <xref derivedContent="" format="title" sectionFormat="of" target="name-informative-references">Informative References</xref></t>
              </li>
            </ul>
          </li>
          <li pn="section-toc.1-1.7">
            <t indent="0" pn="section-toc.1-1.7.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.a"/><xref derivedContent="" format="title" sectionFormat="of" target="name-acknowledgments">Acknowledgments</xref></t>
          </li>
          <li pn="section-toc.1-1.8">
            <t indent="0" pn="section-toc.1-1.8.1"><xref derivedContent="" format="none" sectionFormat="of" target="section-appendix.b"/><xref derivedContent="" format="title" sectionFormat="of" target="name-authors-addresses">Authors' Addresses</xref></t>
          </li>
        </ul>
      </section>
    </toc>
  </front>
  <middle>
    <section anchor="intro" numbered="true" removeInRFC="false" toc="include" pn="section-1">
      <name slugifiedName="name-introduction">Introduction</name>
      <t indent="0" pn="section-1-1">The syntax for private-key information was originally described in <xref target="RFC5208" format="default" sectionFormat="of" derivedContent="RFC5208"/>, and
the syntax was later revised by <xref target="RFC5958" format="default" sectionFormat="of" derivedContent="RFC5958"/> to include the AsymmetricKeyPackage
content type that supports multiple PrivateKeyInfos. This document defines PKCS #8 content types for
use with one PrivateKeyInfo and one EncryptedPrivateKeyInfo. These content type assignments are
needed for the PrivateKeyInfo and EncryptedPrivateKeyInfo to be carried in the
Cryptographic Message Syntax (CMS) <xref target="RFC5652" format="default" sectionFormat="of" derivedContent="RFC5652"/>.</t>
      <t indent="0" pn="section-1-2">Note: A very long time ago, media types for PrivateKeyInfo and EncryptedPrivateKeyInfo were assigned
as "application/pkcs8" and "application/pkcs8-encrypted", respectively.</t>
    </section>
    <section anchor="ContentTypes" numbered="true" removeInRFC="false" toc="include" pn="section-2">
      <name slugifiedName="name-private-key-information-con">Private-Key Information Content Types</name>
      <t indent="0" pn="section-2-1">This section defines a content type for private-key information and
encrypted private-key information.</t>
      <t indent="0" pn="section-2-2">The PrivateKeyInfo content type is identified by the following object identifier:</t>
      <sourcecode type="asn.1" markers="false" pn="section-2-3">
id-ct-privateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 52 }</sourcecode>
      <t indent="0" pn="section-2-4">The EncryptedPrivateKeyInfo content type is identified by the following object identifier:</t>
      <sourcecode type="asn.1" markers="false" pn="section-2-5">
id-ct-encrPrivateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 53 }</sourcecode>
    </section>
    <section anchor="asn1-mod" numbered="true" removeInRFC="false" toc="include" pn="section-3">
      <name slugifiedName="name-asn1-module">ASN.1 Module</name>
      <t indent="0" pn="section-3-1">The ASN.1 module <xref target="X680" format="default" sectionFormat="of" derivedContent="X680"/> <xref target="X690" format="default" sectionFormat="of" derivedContent="X690"/> in this section builds upon the modules in <xref target="RFC5911" format="default" sectionFormat="of" derivedContent="RFC5911"/>.</t>
      <sourcecode type="asn.1" markers="true" pn="section-3-2">
PrivateKeyInfoContentTypes
 { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
   pkcs-9(9) smime(16) modules(0) id-mod-pkcs8ContentType(85) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- EXPORTS ALL

IMPORTS

CONTENT-TYPE
 FROM CryptographicMessageSyntax-2009 -- in [RFC5911]
   { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
     pkcs-9(9) smime(16) modules(0) id-mod-cms-2004-02(41) }

PrivateKeyInfo, EncryptedPrivateKeyInfo
 FROM AsymmetricKeyPackageModuleV1 -- in [RFC5958]
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
      pkcs-9(9) smime(16) modules(0)
      id-mod-asymmetricKeyPkgV1(50) }  ;


PrivateKeyInfoContentTypes CONTENT-TYPE ::= {
 ct-privateKeyInfo | ct-encrPrivateKeyInfo,
 ... -- Expect additional content types --  }

ct-privateKeyInfo CONTENT-TYPE ::= { PrivateKeyInfo
 IDENTIFIED BY id-ct-privateKeyInfo }

id-ct-privateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 52 }

ct-encrPrivateKeyInfo CONTENT-TYPE ::= { EncryptedPrivateKeyInfo
 IDENTIFIED BY id-ct-encrPrivateKeyInfo }

id-ct-encrPrivateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 53 }

END</sourcecode>
    </section>
    <section anchor="security-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-4">
      <name slugifiedName="name-security-considerations">Security Considerations</name>
      <t indent="0" pn="section-4-1">The security considerations in <xref target="RFC5958" format="default" sectionFormat="of" derivedContent="RFC5958"/> apply here.</t>
    </section>
    <section anchor="iana-considerations" numbered="true" removeInRFC="false" toc="include" pn="section-5">
      <name slugifiedName="name-iana-considerations">IANA Considerations</name>
      <t indent="0" pn="section-5-1">For each of the private-key information content types defined in <xref target="ContentTypes" format="default" sectionFormat="of" derivedContent="Section 2"/>,
IANA has assigned an Object Identifier (OID). The
OIDs for the content types have been allocated in the "SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)" registry <xref target="IANA-CMS-CTS" format="default" sectionFormat="of" derivedContent="IANA-CMS-CTS"/> as follows:
      </t>
      <table align="center" pn="table-1">
        <thead>
          <tr>
            <th align="left" colspan="1" rowspan="1">Decimal</th>
            <th align="left" colspan="1" rowspan="1">Description</th>
            <th align="left" colspan="1" rowspan="1">Reference</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td align="left" colspan="1" rowspan="1">52</td>
            <td align="left" colspan="1" rowspan="1">id-ct-privateKeyInfo</td>
            <td align="left" colspan="1" rowspan="1">RFC 9939</td>
          </tr>
          <tr>
            <td align="left" colspan="1" rowspan="1">53</td>
            <td align="left" colspan="1" rowspan="1">id-ct-encrPrivateKeyInfo</td>
            <td align="left" colspan="1" rowspan="1">RFC 9939</td>
          </tr>
        </tbody>
      </table>
      <t indent="0" pn="section-5-3">For the ASN.1 module in <xref target="asn1-mod" format="default" sectionFormat="of" derivedContent="Section 3"/>, IANA has assigned an OID for the module identifier. The OID for the module
has been allocated in the "SMI Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)"
registry  <xref target="IANA-SMIME-MODS" format="default" sectionFormat="of" derivedContent="IANA-SMIME-MODS"/> as follows:</t>
      <table align="center" pn="table-2">
        <thead>
          <tr>
            <th align="left" colspan="1" rowspan="1">Decimal</th>
            <th align="left" colspan="1" rowspan="1">Description</th>
            <th align="left" colspan="1" rowspan="1">Reference</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td align="left" colspan="1" rowspan="1">85</td>
            <td align="left" colspan="1" rowspan="1">id-mod-pkcs8ContentType</td>
            <td align="left" colspan="1" rowspan="1">RFC 9939</td>
          </tr>
        </tbody>
      </table>
      <t indent="0" pn="section-5-5">IANA has updated the application/cms registration entry in the "Media Types" registry by adding RFC 9939 to the "Interoperability considerations" section and to the list of RFCs where Inner Content Types (ICTs) are defined (see the "Optional parameters" section) and by adding the following values to the list of ICTs:</t>
      <ul spacing="compact" bare="false" empty="false" indent="3" pn="section-5-6">
        <li pn="section-5-6.1">
          <t indent="0" pn="section-5-6.1.1">privateKeyInfo</t>
        </li>
        <li pn="section-5-6.2">
          <t indent="0" pn="section-5-6.2.1">encrPrivateKeyInfo</t>
        </li>
      </ul>
      <t indent="0" pn="section-5-7">IANA has also updated the "Security considerations" section in the application/cms entry as follows:</t>
      <table align="center" pn="table-3">
        <thead>
          <tr>
            <th align="left" colspan="1" rowspan="1">RFC</th>
            <th align="left" colspan="1" rowspan="1">CMS Protecting Content Type and Algorithms</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td align="left" colspan="1" rowspan="1">RFC 9939</td>
            <td align="left" colspan="1" rowspan="1">privateKeyInfo and encrPrivateKeyInfo</td>
          </tr>
        </tbody>
      </table>
    </section>
  </middle>
  <back>
    <references anchor="sec-combined-references" pn="section-6">
      <name slugifiedName="name-references">References</name>
      <references anchor="sec-normative-references" pn="section-6.1">
        <name slugifiedName="name-normative-references">Normative References</name>
        <reference anchor="RFC5652" target="https://www.rfc-editor.org/info/rfc5652" quoteTitle="true" derivedAnchor="RFC5652">
          <front>
            <title>Cryptographic Message Syntax (CMS)</title>
            <author fullname="R. Housley" initials="R." surname="Housley"/>
            <date month="September" year="2009"/>
            <abstract>
              <t indent="0">This document describes the Cryptographic Message Syntax (CMS). This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="70"/>
          <seriesInfo name="RFC" value="5652"/>
          <seriesInfo name="DOI" value="10.17487/RFC5652"/>
        </reference>
        <reference anchor="RFC5911" target="https://www.rfc-editor.org/info/rfc5911" quoteTitle="true" derivedAnchor="RFC5911">
          <front>
            <title>New ASN.1 Modules for Cryptographic Message Syntax (CMS) and S/MIME</title>
            <author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
            <author fullname="J. Schaad" initials="J." surname="Schaad"/>
            <date month="June" year="2010"/>
            <abstract>
              <t indent="0">The Cryptographic Message Syntax (CMS) format, and many associated formats, are expressed using ASN.1. The current ASN.1 modules conform to the 1988 version of ASN.1. This document updates those ASN.1 modules to conform to the 2002 version of ASN.1. There are no bits-on-the-wire changes to any of the formats; this is simply a change to the syntax. This document is not an Internet Standards Track specification; it is published for informational purposes.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5911"/>
          <seriesInfo name="DOI" value="10.17487/RFC5911"/>
        </reference>
        <reference anchor="RFC5958" target="https://www.rfc-editor.org/info/rfc5958" quoteTitle="true" derivedAnchor="RFC5958">
          <front>
            <title>Asymmetric Key Packages</title>
            <author fullname="S. Turner" initials="S." surname="Turner"/>
            <date month="August" year="2010"/>
            <abstract>
              <t indent="0">This document defines the syntax for private-key information and a content type for it. Private-key information includes a private key for a specified public-key algorithm and a set of attributes. The Cryptographic Message Syntax (CMS), as defined in RFC 5652, can be used to digitally sign, digest, authenticate, or encrypt the asymmetric key format content type. This document obsoletes RFC 5208. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5958"/>
          <seriesInfo name="DOI" value="10.17487/RFC5958"/>
        </reference>
        <reference anchor="X680" target="https://www.itu.int/rec/T-REC-X.680" quoteTitle="true" derivedAnchor="X680">
          <front>
            <title>Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation</title>
            <author>
              <organization showOnFrontPage="true">ITU-T</organization>
            </author>
            <date year="2021" month="February"/>
          </front>
          <seriesInfo name="ITU-T Recommendation" value="X.680"/>
          <seriesInfo name="ISO/IEC" value="8824-1:2021"/>
        </reference>
        <reference anchor="X690" target="https://www.itu.int/rec/T-REC-X.690" quoteTitle="true" derivedAnchor="X690">
          <front>
            <title>Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)</title>
            <author>
              <organization showOnFrontPage="true">ITU-T</organization>
            </author>
            <date year="2021" month="February"/>
          </front>
          <seriesInfo name="ITU-T Recommendation" value="X.690"/>
          <seriesInfo name="ISO/IEC" value="8825-1:2021"/>
        </reference>
      </references>
      <references anchor="sec-informative-references" pn="section-6.2">
        <name slugifiedName="name-informative-references">Informative References</name>
        <reference anchor="IANA-CMS-CTS" target="https://www.iana.org/assignments/smi-numbers" quoteTitle="true" derivedAnchor="IANA-CMS-CTS">
          <front>
            <title>SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="IANA-SMIME-MODS" target="https://www.iana.org/assignments/smi-numbers" quoteTitle="true" derivedAnchor="IANA-SMIME-MODS">
          <front>
            <title>SMI Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)</title>
            <author>
              <organization showOnFrontPage="true">IANA</organization>
            </author>
          </front>
        </reference>
        <reference anchor="RFC5208" target="https://www.rfc-editor.org/info/rfc5208" quoteTitle="true" derivedAnchor="RFC5208">
          <front>
            <title>Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification Version 1.2</title>
            <author fullname="B. Kaliski" initials="B." surname="Kaliski"/>
            <date month="May" year="2008"/>
            <abstract>
              <t indent="0">This document represents a republication of PKCS #8 v1.2 from RSA Laboratories' Public Key Cryptography Standard (PKCS) series. Change control is transferred to the IETF. The body of this document, except for the security considerations section, is taken directly from the PKCS #8 v1.2 specification.</t>
              <t indent="0">This document describes a syntax for private-key information. This memo provides information for the Internet community.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5208"/>
          <seriesInfo name="DOI" value="10.17487/RFC5208"/>
        </reference>
      </references>
    </references>
    <section numbered="false" anchor="acknowledgments" removeInRFC="false" toc="include" pn="section-appendix.a">
      <name slugifiedName="name-acknowledgments">Acknowledgments</name>
      <t indent="0" pn="section-appendix.a-1">Thanks to <contact fullname="John Gray"/>, <contact fullname="Deb       Cooley"/>, <contact fullname="Mohamed Boucadair"/>, <contact fullname="Orie Steele"/>, and <contact fullname="Éric Vyncke"/> for
      reviewing the document and providing comments.</t>
    </section>
    <section anchor="authors-addresses" numbered="false" removeInRFC="false" toc="include" pn="section-appendix.b">
      <name slugifiedName="name-authors-addresses">Authors' Addresses</name>
      <author initials="J." surname="Mandel" fullname="Joe Mandel">
        <organization abbrev="AKAYLA" showOnFrontPage="true">AKAYLA, Inc.</organization>
        <address>
          <email>joe@akayla.com</email>
        </address>
      </author>
      <author initials="R." surname="Housley" fullname="Russ Housley">
        <organization abbrev="Vigil Security" showOnFrontPage="true">Vigil Security, LLC</organization>
        <address>
          <email>housley@vigilsec.com</email>
        </address>
      </author>
      <author initials="S." surname="Turner" fullname="Sean Turner">
        <organization abbrev="sn3rd" showOnFrontPage="true">sn3rd</organization>
        <address>
          <email>sean@sn3rd.com</email>
        </address>
      </author>
    </section>
  </back>
</rfc>
