Cryptographic names often identify an issuing organization and a document series. A protocol must name the exact version, algorithm identifiers, parameters, and encoding rules it implements; a broad label such as “PKCS” or “X.509” is insufficient.
ITU-T X-Series and X.509 #
The ITU Telecommunication Standardization Sector (ITU-T) publishes Recommendations in lettered series. The X-series covers data networks, open systems communications, and security. ITU-T X.509 defines a public-key certificate framework and an ASN.1 certificate structure. The IETF profiles X.509 certificates for Internet use in RFC 5280.
X.509 does not itself define TLS hostname verification, HTTP use, or a particular certificate authority policy. Protocol specifications and relying party software apply those semantics.
PKCS Documents #
Public-Key Cryptography Standards originated at RSA Laboratories and cover distinct formats and algorithms:
- PKCS #1 defines RSA primitives and encodings.
- PKCS #3 describes Diffie–Hellman key agreement.
- PKCS #5 defines password-based cryptography, including PBKDF2.
- PKCS #7 evolved into Cryptographic Message Syntax (CMS).
- PKCS #8 defines private-key information syntax.
- PKCS #10 defines certification requests.
- PKCS #12 packages private keys and certificates.
Some PKCS documents are historical while IETF RFCs or other standards bodies maintain current specifications. For example, CMS is RFC 5652 and PKCS #1 v2.2 is RFC 8017.
ASN.1, DER, and PEM #
ASN.1 defines abstract data types; it does not select a byte encoding. Basic Encoding Rules (BER) permit multiple encodings for values. Distinguished Encoding Rules (DER) select one canonical BER encoding, which is required where a signature must cover exactly one byte sequence.
PEM is an ASCII armor convention: base64-encoded DER bytes surrounded by
labels such as -----BEGIN CERTIFICATE-----. PEM is an encoding container, not
a certificate type. A file can contain one or more PEM blocks, and the label
determines the encoded object’s expected type.
Comments
Read or comment on GitHub (sign-in required to comment)