RFC 9939

PKCS #8: Private-Key Information Content Types

📅 published February 2026, from ietf

RFC 9939 📜✨ PKCS #8: Private-Key Information Content Types

okay bestie, let's talk about RFC 9939 💖 It's a Standards Track document from February 2026, so it's an official Internet standard, not just a suggestion 💅. It's written by J. Mandel (AKAYLA), R. Housley (Vigil Security), and S. Turner (sn3rd). The ISSN is 2070-1721. It doesn't list anything it obsoletes or updates, so it's a clean slate 🧚

Abstract

okay so the abstract is short and sweet 🍓 This document defines PKCS #8 content types for use with PrivateKeyInfo and EncryptedPrivateKeyInfo, as specified in RFC 5958. That's the whole pitch ✨

Status of This Memo 🗂️

this one's an Internet Standards Track document 💜 It's a product of the IETF, it represents what the IETF community agreed on, it got public review, and the IESG approved it for publication. If you want more info on Internet Standards, check Section 2 of RFC 7841. For the current status, errata, and where to send feedback, go to https://www.rfc-editor.org/info/rfc9939 🦋

Copyright Notice 🌈

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the publication date. please read them carefully, because they explain your rights and restrictions for this document 🙈 Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come with no warranty, as the Revised BSD License describes 🫶

1.  Introduction
2.  Private-Key Information Content Types
3.  ASN.1 Module
4.  Security Considerations
5.  IANA Considerations
6.  References
  6.1.  Normative References
  6.2.  Informative References
Acknowledgments
Authors' Addresses

1. Introduction ✨

okay so the original private-key syntax came from [RFC5208] 🎀 Then [RFC5958] revised it and added the AsymmetricKeyPackage content type, which can hold multiple PrivateKeyInfos. This document is more focused: it defines PKCS #8 content types for one PrivateKeyInfo and one EncryptedPrivateKeyInfo 💖 These content type assignments are needed so those two can be carried in the Cryptographic Message Syntax (CMS) [RFC5652] 🔥

Note: A very long time ago, media types for PrivateKeyInfo and EncryptedPrivateKeyInfo were assigned as "application/pkcs8" and "application/pkcs8-encrypted", respectively. 🧚

2. Private-Key Information Content Types 🔐

this section defines one content type for private-key information and one for encrypted private-key information 💜

the PrivateKeyInfo content type is identified by this object identifier:

id-ct-privateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 52 }

and the EncryptedPrivateKeyInfo content type is identified by this one 🦋

id-ct-encrPrivateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 53 }

3. ASN.1 Module 🧩

the ASN.1 module [X680] [X690] in this section is built on top of the modules in [RFC5911] 💅 Here's the full thing, verbatim:

<CODE BEGINS>
PrivateKeyInfoContentTypes
 { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
   pkcs-9(9) smime(16) modules(0) id-mod-pkcs8ContentType(85) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- EXPORTS ALL

IMPORTS

CONTENT-TYPE
 FROM CryptographicMessageSyntax-2009 -- in [RFC5911]
   { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
     pkcs-9(9) smime(16) modules(0) id-mod-cms-2004-02(41) }

PrivateKeyInfo, EncryptedPrivateKeyInfo
 FROM AsymmetricKeyPackageModuleV1 -- in [RFC5958]
    { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
      pkcs-9(9) smime(16) modules(0)
      id-mod-asymmetricKeyPkgV1(50) }  ;


PrivateKeyInfoContentTypes CONTENT-TYPE ::= {
 ct-privateKeyInfo | ct-encrPrivateKeyInfo,
 ... -- Expect additional content types --  }

ct-privateKeyInfo CONTENT-TYPE ::= { PrivateKeyInfo
 IDENTIFIED BY id-ct-privateKeyInfo }

id-ct-privateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 52 }

ct-encrPrivateKeyInfo CONTENT-TYPE ::= { EncryptedPrivateKeyInfo
 IDENTIFIED BY id-ct-encrPrivateKeyInfo }

id-ct-encrPrivateKeyInfo OBJECT IDENTIFIER ::= { iso(1)
 member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
 smime(16) ct(1) 53 }

END
<CODE ENDS>

4. Security Considerations 🔒😭

okay this section is short but it's a big deal 💀 The security considerations in [RFC5958] apply here. So go read that one too, bestie. No skipping 🙈

5. IANA Considerations 🌸

for each private-key information content type defined in Section 2, IANA has assigned an Object Identifier (OID) 🎀 The OIDs were allocated in the "SMI Security for S/MIME CMS Content Type (1.2.840.113549.1.9.16.1)" registry [IANA-CMS-CTS], like this:

         +=========+==========================+===========+
         | Decimal | Description              | Reference |
         +=========+==========================+===========+
         | 52      | id-ct-privateKeyInfo     | RFC 9939  |
         +---------+--------------------------+-----------+
         | 53      | id-ct-encrPrivateKeyInfo | RFC 9939  |
         +---------+--------------------------+-----------+

                              Table 1

for the ASN.1 module in Section 3, IANA has assigned an OID for the module identifier 🧚 That OID was allocated in the "SMI Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)" registry [IANA-SMIME-MODS], like so:

          +=========+=========================+===========+
          | Decimal | Description             | Reference |
          +=========+=========================+===========+
          | 85      | id-mod-pkcs8ContentType | RFC 9939  |
          +---------+-------------------------+-----------+

                               Table 2

IANA also updated the application/cms registration entry in the "Media Types" registry 💜 RFC 9939 got added to the "Interoperability considerations" section, and to the list of RFCs where Inner Content Types (ICTs) are defined (see the "Optional parameters" section). Two new values went onto the list of ICTs:

privateKeyInfo
encrPrivateKeyInfo

IANA also updated the "Security considerations" section in the application/cms entry, like this:

      +==========+============================================+
      | RFC      | CMS Protecting Content Type and Algorithms |
      +==========+============================================+
      | RFC 9939 | privateKeyInfo and encrPrivateKeyInfo      |
      +----------+--------------------------------------------+

                               Table 3

6. References 📚

6.1. Normative References

[RFC5652]  Housley, R., "Cryptographic Message Syntax (CMS)", STD 70,
           RFC 5652, DOI 10.17487/RFC5652, September 2009,
           <https://www.rfc-editor.org/info/rfc5652>.

[RFC5911]  Hoffman, P. and J. Schaad, "New ASN.1 Modules for
           Cryptographic Message Syntax (CMS) and S/MIME", RFC 5911,
           DOI 10.17487/RFC5911, June 2010,
           <https://www.rfc-editor.org/info/rfc5911>.

[RFC5958]  Turner, S., "Asymmetric Key Packages", RFC 5958,
           DOI 10.17487/RFC5958, August 2010,
           <https://www.rfc-editor.org/info/rfc5958>.

[X680]     ITU-T, "Information technology - Abstract Syntax Notation
           One (ASN.1): Specification of basic notation", ITU-T
           Recommendation X.680, ISO/IEC 8824-1:2021, February 2021,
           <https://www.itu.int/rec/T-REC-X.680>.

[X690]     ITU-T, "Information technology - ASN.1 encoding rules:
           Specification of Basic Encoding Rules (BER), Canonical
           Encoding Rules (CER) and Distinguished Encoding Rules
           (DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1:2021,
           February 2021, <https://www.itu.int/rec/T-REC-X.690>.

6.2. Informative References

[IANA-CMS-CTS]
           IANA, "SMI Security for S/MIME CMS Content Type
           (1.2.840.113549.1.9.16.1)",
           <https://www.iana.org/assignments/smi-numbers>.

[IANA-SMIME-MODS]
           IANA, "SMI Security for S/MIME Module Identifier
           (1.2.840.113549.1.9.16.0)",
           <https://www.iana.org/assignments/smi-numbers>.

[RFC5208]  Kaliski, B., "Public-Key Cryptography Standards (PKCS) #8:
           Private-Key Information Syntax Specification Version 1.2",
           RFC 5208, DOI 10.17487/RFC5208, May 2008,
           <https://www.rfc-editor.org/info/rfc5208>.

Acknowledgments 🫶

thanks to John Gray, Deb Cooley, Mohamed Boucadair, Orie Steele, and Éric Vyncke for reviewing the document and leaving comments 💖

Authors' Addresses 💌

Joe Mandel
AKAYLA, Inc.
Email: joe@akayla.com


Russ Housley
Vigil Security, LLC
Email: housley@vigilsec.com


Sean Turner
sn3rd
Email: sean@sn3rd.com

that's the whole RFC, bestie 🎀 it's basically "here's how to label private keys in CMS, and here are the IDs to prove it" 👑

📦 where this page comes from

ietf: rfc9939 2026-02
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms