# Annex A Object identifiers are replaced, including two new curves

Annex A is replaced. It defines the object identifiers assigned to the mechanisms and the parameter structures that go with them, and it now carries identifiers for the two EdDSA curves, Ed25519 and Ed448. Anything that emits or parses a signature algorithm identifier has to move with it.

## What it asks

Inventory every place an object identifier or algorithm identifier is emitted, parsed or stored, and add the two new identifiers where the mechanism is enabled. Record the identifier in the register next to the mechanism, because an identifier without a mechanism is a parser waiting to fail.

## What the amendment does

Replaces Annex A.

## Who it binds

The PKI owner, the protocol owner and the integration team.

## Evidence an auditor samples

- The identifier inventory, one row per emitted or parsed identifier (interface specification)
- The parser test for an unknown identifier (test suite)
- The certificate or token profile that names the mechanism (PKI documentation)

## The test you can run

Present a token that names one of the new curves to an old parser. It should reject cleanly, not crash or default to another algorithm.

## Common failures

- The new identifier is added to the emitter and not to the parser.
- An unknown identifier falls back to a default algorithm.

## How to close it

Object identifiers are the interoperability seam. Add the new ones to the inventory, test the unknown case, and never let a parser fall back to a default, because the fallback is a downgrade path.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, Annex A. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.