Home / The record / Annexes changed

Annex A is replaced. It defines the object identifiers assigned to the mechanisms and the parameter structures that go with them, and it now carries identifiers for the two EdDSA curves, Ed25519 and Ed448. Anything that emits or parses a signature algorithm identifier has to move with it.

What it asks

Inventory every place an object identifier or algorithm identifier is emitted, parsed or stored, and add the two new identifiers where the mechanism is enabled. Record the identifier in the register next to the mechanism, because an identifier without a mechanism is a parser waiting to fail.

What the amendment does

Replaces Annex A. So the 2018 wording is superseded for this clause.

Who it binds

The PKI owner, the protocol owner and the integration team.

Evidence an auditor samples

• The identifier inventory, one row per emitted or parsed identifier (interface specification)
• The parser test for an unknown identifier (test suite)
• The certificate or token profile that names the mechanism (PKI documentation)

The test you can run

Present a token that names one of the new curves to an old parser. It should reject cleanly, not crash or default to another algorithm.

Common failures

• The new identifier is added to the emitter and not to the parser.
• An unknown identifier falls back to a default algorithm.

How to close it

Object identifiers are the interoperability seam. Add the new ones to the inventory, test the unknown case, and never let a parser fall back to a default, because the fallback is a downgrade path. The artefact that opens the work is the identifier inventory, one row per emitted or parsed identifier; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The annex exists in the base standard and the amendment replaces it. A copy of the base annex is not the current annex, so the citation must name the amendment as well as the edition.