IEC > Webstore > Search > Register > Check out > Payment > Order confirmation

Publication detail

Reference P-ISO/IEC 9594-8 ed6.0 withdrawn corrigendum
> preview
Title Information technology -- Open Systems Interconnection -- The Directory: Public-key and attribute certificate frameworks
Publication date 2008-12-15
Format, price
(Swiss francs)
and language
198.- 173 pages
198.- 1540 Kb
Abstract ISO/IEC 9594-8:2008 addresses some of the security requirements in the areas of authentication and other security services through the provision of a set of frameworks upon which full services can be based.

Specifically, it defines frameworks for:

  • Public-key certificates;

  • Attribute certificates;

  • Authentication services.

The public-key certificate framework defined in ISO/IEC 9594-8:2008 includes definition of the information objects for Public Key Infrastructure (PKI), including public-key certificates, and Certificate Revocation List (CRL). The attribute certificate framework includes definition of the information objects for Privilege Management Infrastructure (PMI), including attribute certificates, and Attribute Certificate Revocation List (ACRL). ISO/IEC 9594-8:2008 also provides the framework for issuing, managing, using and revoking certificates. An extensibility mechanism is included in the defined formats for both certificate types and for all revocation list schemes. ISO/IEC 9594-8:2008 also includes a set of standard extensions for each, which is expected to be generally useful across a number of applications of PKI and PMI. The schema components (including object classes, attribute types and matching rules) for storing PKI and PMI objects in the Directory are included in ISO/IEC 9594-8:2008. Other elements of PKI and PMI, beyond these frameworks, such as key and certificate management protocols, operational protocols, additional certificate and CRL extensions, are expected to be defined by other standards bodies (e.g. ISO/TC 68 and IETF).

The authentication scheme defined in ISO/IEC 9594-8:2008 is generic and can be applied to a variety of applications and environments.

The Directory makes use of public-key certificates and attribute certificates, and the framework for the Directory's use of these facilities is also defined in ISO/IEC 9594-8:2008. Public-key technology, including certificates, is used by the Directory to enable strong authentication, signed and/or encrypted operations, and for storage of signed and/or encrypted data in the Directory. Attribute certificates can be used by the Directory to enable rule-based access control. Although the framework for these is provided in this Specification, the full definition of the Directory's use of these frameworks, and the associated services provided by the Directory and its components, is supplied in the complete set of Directory Specifications.

ISO/IEC 9594-8:2008, in the Authentication services framework, also:

  • specifies the form of authentication information held by the Directory;

  • describes how authentication information may be obtained from the Directory;

  • states the assumptions made about how authentication information is formed and placed in the Directory;

  • defines three ways in which applications may use this authentication information to perform authentication and describes how other security services may be supported by authentication.

ISO/IEC 9594-8:2008 describes two levels of authentication: simple authentication, using a password as a verification of claimed identity; and strong authentication, involving credentials formed using cryptographic techniques. While simple authentication offers some limited protection against unauthorized access, only strong authentication should be used as the basis for providing secure services. It is not intended to establish this as a general framework for authentication, but it can be of general use for applications that consider these techniques adequate.

Authentication (and other security services) can only be provided within the context of a defined security policy. It is a matter for users of an application to define their own security policy, which may be constrained by the services provided by a standard.

It is a matter for standards-defining applications that use the authentication framework to specify the protocol exchanges which need to be performed in order to achieve authentication based upon the authentication information obtained from the Directory. The protocol used by applications to obtain credentials from the Directory is the Directory Access Protocol (DAP) specified in ISO/IEC 9594-5.
Technical Committee JTC 1/SC 6 - Telecommunications and information exchange between systems  RSS
ICS Codes
35.100.70 Application layer
Replaced by


>> Advanced search

Quick access by ref. number


Your basket is empty
Your country is :
Your TVA is : You must login...


Accepted credit cards:
Prices in CHF (Swiss francs)
Request a pro forma to pay by bank transfer or cheque
Learn how to share your publications with your colleagues, using networking options
Prices in CHF (Swiss francs)
We accept the following credit cards:
To pay by bank transfer: request a pro forma
If you purchase regularly through the IEC Webstore you can open a corporate account

Just Published

>> Published in the last 30 days


  1. IEC 60601-1-2 Ed. 4.0
  2. IEC 62366-1 Ed. 1.0
  3. IEC 61000-4-5 Ed. 3.0
  4. IEC 60529 Ed. 2.2
  5. IEC 60601-1-11 Ed. 2.0
  6. IEC 61010-1 Ed. 3.0
  7. IEC 61000-4-4 Ed. 3.0
  8. IEC 60079-0 Ed. 6.0
  9. IEC 61000-4-2 Ed. 2.0
  10. IEC 61000-4-6 Ed. 4.0