ISO/IEC 9594-6:2020/Amd 1:2025

International
Standard
ISO/IEC 9594-6
Ninth edition
Information technology — Open
2020-11
systems interconnection —
AMENDMENT 1
Part 6:
2025-05
The Directory: Selected
attribute types
AMENDMENT 1
Reference number
ISO/IEC 9594-6:2020/Amd. 1:2025(en) © ISO/IEC 2025

ISO/IEC 9594-6:2020/Amd. 1:2025(en)
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of document should be noted.
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had
not received notice of (a) patent(s) which may be required to implement this document. However,
implementers are cautioned that this may not represent the latest information, which may be obtained
from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall
not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT)
see www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by ITU-T as ITU-T X.520 (2019) Amd. 1 (10/2024) and drafted in
accordance with its editorial rules, in collaboration with Joint Technical Committee ISO/IEC JTC 1,
Information technology, Subcommittee SC 6, Telecommunications and information exchange
between systems.
A list of all parts in the ISO/IEC 9594 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards body.
A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
INTERNATIONAL STANDARD ISO/IEC 9594-6
RECOMMENDATION ITU-T X.520
Information technology – Open Systems Interconnection – The Directory:
Selected attribute types
Amendment 1
Summary
Amendment 1 to Recommendation ITU-T X.520 (2019) | International Standard ISO/IEC 9594-6:2020, introduces text
updates to facilitate separation between cybersecurity ASN.1 modules and directory ASN.1 modules.
History
Edition Recommendation Approval Study Group Unique ID
1.0 ITU-T X.520 1988-11-25 11.1002/1000/3010
2.0 ITU-T X.520 1993-11-16 7 11.1002/1000/3011
3.0 ITU-T X.520 1997-08-09 7 11.1002/1000/4127
3.1   ITU-T X.520 (1997) Technical Cor. 1 2000-03-31 7 11.1002/1000/5042
3.2   ITU-T X.520 (1997) Amd. 1 2000-03-31 7 11.1002/1000/5041
3.3   ITU-T X.520 (1997) Technical Cor. 2 2001-02-02 7 11.1002/1000/5322
3.4   ITU-T X.520 (1997) Technical Cor. 3 2002-04-13 17 11.1002/1000/6027
4.0 ITU-T X.520 2001-02-02 7 11.1002/1000/5324
4.1   ITU-T X.520 (2001) Technical Cor. 1 2002-04-13 17 11.1002/1000/6028
4.2   ITU-T X.520 (2001) Technical Cor. 2 2005-11-29 17 11.1002/1000/8636
4.3   ITU-T X.520 (2001) Cor. 3 2008-05-29 17 11.1002/1000/9439
5.0 ITU-T X.520 2005-08-29 17 11.1002/1000/8508
5.1   ITU-T X.520 (2005) Cor. 1 2008-05-29 17 11.1002/1000/9440
5.2   ITU-T X.520 (2005) Cor. 2 2008-11-13 17 11.1002/1000/9628
5.3   ITU-T X.520 (2005) Cor. 3 2011-02-13 17 11.1002/1000/11050
5.4   ITU-T X.520 (2005) Cor. 4 2012-04-13 17 11.1002/1000/11590
6.0 ITU-T X.520 2008-11-13 17 11.1002/1000/9598
6.1   ITU-T X.520 (2008) Cor. 1 2011-02-13 17 11.1002/1000/11051
6.2   ITU-T X.520 (2008) Cor. 2 2012-04-13 17 11.1002/1000/11591
6.3   ITU-T X.520 (2008) Cor. 3 2012-10-14 17 11.1002/1000/11742
7.0 ITU-T X.520 2012-10-14 17 11.1002/1000/11743
7.1   ITU-T X.520 (2012) Cor. 1 2014-11-13 17 11.1002/1000/12350
8.0 ITU-T X.520 2016-10-14 17 11.1002/1000/13036
9.0 ITU-T X.520 2019-10-14 17 11.1002/1000/14037
9.1   ITU-T X.520 (2019) Amd. 1 2024-10-29 17 11.1002/1000/16176
To access the Recommendation, type the URL https://handle.itu.int/ in the address field of your web
browser, followed by the Recommendation's unique ID.
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC 9594-6:2020/Amd. 1:2025(en)

FOREWORD
The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of
telecommunications, and information and communication technologies (ICTs). The ITU Telecommunication
Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical,
operating and tariff questions and issuing Recommendations on them with a view to standardizing
telecommunications on a worldwide basis.
The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes
the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics.
The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1.
In some areas of information technology which fall within ITU-T's purview, the necessary standards are
prepared on a collaborative basis with ISO and IEC.

NOTE
In this Recommendation, the expression "Administration" is used for conciseness to indicate both a
telecommunication administration and a recognized operating agency.
Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain
mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the
Recommendation is achieved when all of these mandatory provisions are met. The words "shall" or some other
obligatory language such as "must" and the negative equivalents are used to express requirements. The use of
such words does not suggest that compliance with the Recommendation is required of any party.

INTELLECTUAL PROPERTY RIGHTS
ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve
the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or
applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of
the Recommendation development process.
As of the date of approval of this Recommendation, ITU had not received notice of intellectual property,
protected by patents/software copyrights, which may be required to implement this Recommendation.
However, implementers are cautioned that this may not represent the latest information and are therefore
strongly urged to consult the appropriate ITU-T databases available via the ITU-T website at
https://www.itu.int/ITU-T/ipr/.

 ITU 2025
All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior
written permission of ITU.
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
v
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
CONTENTS
Page
1) Clause 2.2 . 1
2) Clause 4 . 1
3) Clause 5 . 1
4) Clause 6 and its subclauses . 1
5) Clause 8 and its subclauses . 2
6) Clause 9 and its subclauses . 2
7) Clause 10 and its subclauses . 3
8) Annex A . 3

Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
vi
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
INTERNATIONAL STANDARD
ITU-T RECOMMENDATION
Information technology – Open Systems Interconnection –
The Directory: Selected attribute types

Amendment 1
1) Clause 2.2
Add a new normative reference to clause 2.2:
– IETF RFC 4524 (2006), COSINE LDAP/X.500 Schema.
2) Clause 4
Add a new abbreviation in clause 4
DNS Domain Name System
3) Clause 5
Add the following paragraph to end of clause 5:
Some ASN.1 symbols have been moved from the SelectedAttributeTypes module (Annex A) to the
UsefulDefinitions module (Annex A of Rec. ITU-T X.501 | ISO/IEC 9594-2). However, in the main body of text
the locations of the specifications for these ASN.1 symbols are not changed as they still can be considered part of selected
attribute types as they are present in the SelectAttributeTypes module by being imported from the
UsefulDefinitions module.
4) Clause 6 and its subclauses
In clause 6 add after the ASN.1 specification for UnboundedDirectoryString:
NOTE 1 – After the ninth edition of this Directory Specification, the definition of this data type was placed in the
UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the SelectedAttributeTypes
module.
In clause 6 update NOTE numbering as required.
In clause 6.2.1, add after the ASN.1 specification for name:
NOTE – After the ninth edition of this Directory Specification, the definitions of the name attribute type and the id-at-name
object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the
SelectedAttributeTypes module.
In clause 6.2.2, add after the ASN.1 specification for commonName:
NOTE – After the ninth edition of this Directory Specification, the definitions of the commonName attribute type and the id-
at-commonName object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2
rather than in the SelectedAttributeTypes module.
In clause 6.2.15, add after the ASN.1 specification for dnsName:
NOTE 1 – After the ninth edition of this Directory Specification, the definitions of the dnsName attribute type and the id-at-
dnsName object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than
in the SelectedAttributeTypes module.
In clause 6.2.15, update NOTE numbering as required.
In clause 6.2.18, add after the ASN.1 specification for objectIdentifier:
NOTE – After the ninth edition of this Directory Specification, the definitions of the objectIdentifier attribute type and the
id-at-objectIdentifier object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 |
ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 6.9.1, add after the ASN.1 specification for PresentationAddress:
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
NOTE – After the ninth edition of this Directory Specification, the definition of this data type was placed in the
UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the SelectedAttributeTypes
module.
5) Clause 8 and its subclauses
In clause 8.1.1, add after the ASN.1 specification for caseIgnoreMatch:
NOTE – After the ninth edition of this Directory Specification, the definitions of the caseIgnoreMatch matching rule and the
id-mr-caseIgnoreMatch object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 |
ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 8.1.3, add after the ASN.1 specification for caseIgnoreSubstringMatch:
NOTE 1 – After the ninth edition of this Directory Specification, the definitions of the caseIgnoreSubstringsMatch
matching rule and the id-mr-caseIgnoreSubstringsMatch object identifier were placed in the UsefulDefinitions
module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 8.1.3, add after the ASN.1 specification for SubstringAssertion:
NOTE 2 – After the ninth edition of this Directory Specification, the definition of the SubstringAssertion data type was
placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the
SelectedAttributeTypes module.
In clause 8.1.3, renumber other NOTEs as required.
In clause 8.1.3, delete the second appearance of caseIgnoreSubstringsMatch matching rule.
In clause 8.2.2, add after the ASN.1 specification for integerMatch:
NOTE – After the ninth edition of this Directory Specification, the definitions of the integerMatch matching rule and the id-
mr-integerMatch object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-
2 rather than in the SelectedAttributeTypes module.
In clause 8.2.5, add after the ASN.1 specification for octetStringMatch:
NOTE – After the ninth edition of this Directory Specification, the definitions of the octetStringMatch matching rule and
the id-mr-octetStringMatch object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 |
ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 8.9.2, add after the ASN.1 specification for dnsNameMatch:
NOTE – After the ninth edition of this Directory Specification, the definitions of the dnsNameMatch matching rule and the id-
mr-dnsNameMatch object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-
2 rather than in the SelectedAttributeTypes module.
6) Clause 9 and its subclauses
In clause 9.1.6, add after the ASN.1 specification for dnsString:
NOTE – After the ninth edition of this Directory Specification, the definitions of the dnsString syntax name and the id-asx-
dnsString object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather
than in the SelectedAttributeTypes module.
In clause 9.2.8, add after the ASN.1 specification for directoryString:
NOTE – After the ninth edition of this Directory Specification, the definitions of the directoryString syntax name and the
id-lsx-directoryString object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 |
ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 9.2.17, add after the ASN.1 specification for integer:
NOTE – After the ninth edition of this Directory Specification, the definitions of the integer syntax name and the id-lsx-
integer object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than
in the SelectedAttributeTypes module.
In clause 9.2.25, add after the ASN.1 specification for oid:
NOTE – After the ninth edition of this Directory Specification, the definitions of the oid syntax name and the id-lsx-oid
object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-2 rather than in the
SelectedAttributeTypes module.
In clause 9.2.27, add after the ASN.1 specification for octetString:
NOTE – After the ninth edition of this Directory Specification, the definitions of the octetString syntax name and the id-
lsx-octetString object identifier were placed in the UsefulDefinitions module in Rec. ITU-T X.501 | ISO/IEC 9594-
2 rather than in the SelectedAttributeTypes module.
In clause 9.2.36, add after the ASN.1 specification for substringAssertion:
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
NOTE – After the ninth edition of this Directory Specification, the definitions of the substringAssertion syntax name and
the id-lsx-substringAssertion object identifier were placed in the UsefulDefinitions module in Rec. ITU-T
X.501 | ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
7) Clause 10 and its subclauses
In clause 10.2 add after the ASN.1 specification for temporalContext:
NOTE 1 – After the ninth edition of this Directory Specification, the definition of TimeSpecification, Period, XDayOf,
NamedDay, DayTimeBand, DayTime, and TimeZone data types were placed in the UsefulDefinitions module in Rec.
ITU-T X.501 | ISO/IEC 9594-2 rather than in the SelectedAttributeTypes module.
In clause 10.2, renumber other NOTEs as required.
8) Annex A
Replace Annex A with:
Annex A
Selected attribute types in ASN.1
(This annex forms an integral part of this Recommendation | International Standard.)
This annex includes ASN.1 type and value definitions contained in this Directory Specification in the form of the ASN.1
module SelectedAttributeTypes. Attribute type and matching rule definitions specific for password policy are
included in Annex B.
SelectedAttributeTypes
{joint-iso-itu-t ds(5) module(1) selectedAttributeTypes(5) 10}
DEFINITIONS ::=
BEGIN
-- EXPORTS All
/*
The types and values defined in this module are exported for use in the other
ASN.1
modules contained within the Directory Specifications, and for the use of other
applications which will use them to access Directory services. Other applications
may use them for their own purposes, but this will not constrain extensions and
modifications needed to maintain or improve the Directory service.
*/
IMPORTS
-- from Rec. ITU-T X.501 | ISO/IEC 9594-2

id-at, id-avc, id, id-asx, id-cat, id-coat, id-lmr, id-lsx, id-mr, id-not, id-
pr,
/* The following imports were previously ASN.1 symbols that have been moved out
to the
UsefulDefinitions module to be made available the cybersecurity modules. They
therefore need to be imported from that module to made available not only for
this
module, but also to other modules that might import from this module */

caseIgnoreMatch, caseIgnoreSubstringsMatch, commonName, DayTime, DayTimeBand,
directoryString, dnsName, dnsNameMatch, dnsString, id-asx-dnsString, id-at-
commonName,
id-at-dnsName, id-at-name, id-at-objectIdentifier, id-lsx-directoryString,
id-lsx-integer, id-lsx-octetString, id-lsx-oid, id-lsx-substringAssertion,
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
id-mr-caseIgnoreMatch, id-mr-caseIgnoreSubstringsMatch, id-mr-dnsNameMatch,
id-mr-octetStringMatch, integer, integerMatch, name, NamedDay,
objectIdentifier,
octetString, octetStringMatch, oid, Period, PresentationAddress,
SubstringAssertion,
substringAssertion, TimeSpecification, TimeZone, UnboundedDirectoryString,
XDayOf,
/* The following imports were previously imported from InformatioFrawork, but
these
ASN.1 symbols have been moved to the UsefulDefinitions module */

Attribute{}, ATTRIBUTE, AttributeType,CONTEXT, DistinguishedName, MATCHING-RULE,
OBJECT-CLASS, objectIdentifierMatch, SupportedAttributes, SYNTAX-NAME
FROM UsefulDefinitions
{joint-iso-itu-t ds(5) module(1) usefulDefinitions(0) 10} WITH SUCCESSORS

AttributeValueAssertion, ContextAssertion, distinguishedNameMatch,
MAPPING-BASED-MATCHING{}, SubtreeSpecification
FROM InformationFramework
{joint-iso-itu-t ds(5) module(1) informationFramework(1) 10} WITH
SUCCESSORS
AttributeCombination, ContextCombination, MRMapping
FROM ServiceAdministration
{joint-iso-itu-t ds(5) module(1) serviceAdministration(33) 10} WITH
SUCCESSORS
AttributeTypeDescription, DITContentRuleDescription,
DITStructureRuleDescription,
MatchingRuleDescription, MatchingRuleUseDescription, NameFormDescription,
ObjectClassDescription
FROM SchemaAdministration
{joint-iso-itu-t ds(5) module(1) schemaAdministration(23) 10} WITH
SUCCESSORS
-- from Rec. ITU-T X.509 | ISO/IEC 9594-8

AlgorithmIdentifier{}, Certificate, CertificateList, CertificatePair,
SupportedAlgorithm, SupportedAlgorithms
FROM AuthenticationFramework
{joint-iso-itu-t ds(5) module(1) authenticationFramework(7) 10} WITH
SUCCESSORS
G3FacsimileNonBasicParameters
FROM PkiPmiExternalDataTypes
{joint-iso-itu-t ds(5) module(1) pkiPmiExternalDataTypes(40) 10} WITH
SUCCESSORS
-- from Rec. ITU-T X.511 | ISO/IEC 9594-3

FilterItem, HierarchySelections, SearchControlOptions, ServiceControlOptions
FROM DirectoryAbstractService
{joint-iso-itu-t ds(5) module(1) directoryAbstractService(2) 10} WITH
SUCCESSORS
-- from Rec. ITU-T X.520 | ISO/IEC 9594-6

PwdAlphabet, PwdVocabulary, UserPwd
FROM PasswordPolicy
{joint-iso-itu-t ds(5) module(1) passwordPolicy(39) 10} WITH SUCCESSORS ;

Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
/*from IETF RFC 3727
The following import is provided for information only (see clause 7.2.16), it is
not
referenced by any ASN.1 construct within these Directory Specifications. Note that
the ASN.1 module in RFC 3727 imports from the InformationFramework module of
edition
4 of Rec. ITU-T X.501 | ISO/IEC 9594-2. A specification importing from both these
Directory Specifications and from RFC 3727 should take corrective actions, e.g.,
by making a copy of the ASN.1 module of RFC 3727 and then update the IMPORT
statement.
allComponentsMatch, componentFilterMatch, directoryComponentsMatch,
presentMatch, rdnMatch
FROM ComponentMatching {iso(1) 2 36 79672281 xed(3) module (0) component-
matching(4)} */
-- Directory string type
/* This type has been moved to the UsefulDefinitions module
UnboundedDirectoryString ::= CHOICE {
teletexString  TeletexString(SIZE (1.MAX)),
printableString PrintableString(SIZE (1.MAX)),
bmpString    BMPString(SIZE (1.MAX)),
universalString UniversalString(SIZE (1.MAX)),
uTF8String    UTF8String(SIZE (1.MAX)) }
*/
DirectoryString{INTEGER:maxSize} ::= CHOICE {
teletexString  TeletexString(SIZE (1.maxSize,.)),
printableString PrintableString(SIZE (1.maxSize,.)),
bmpString    BMPString(SIZE (1.maxSize,.)),
universalString UniversalString(SIZE (1.maxSize,.)),
uTF8String    UTF8String(SIZE (1.maxSize,.)) }

-- Attribute types
knowledgeInformation ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
OBSOLETE         TRUE
ID            id-at-knowledgeInformation }

/* These information objects have been moved to UsefulDefinitions module

name ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"name"}
ID            id-at-name }

commonName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"cn", "commonName"}
ID            id-at-commonName }
*/
surname ATTRIBUTE ::= {
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"sn"}
ID            id-at-surname }

givenName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"givenName"}
ID            id-at-givenName }

initials ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"initials"}
ID            id-at-initials }

generationQualifier ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"generationQualifier"}
ID            id-at-generationQualifier }

uniqueIdentifier ATTRIBUTE ::= {
WITH SYNTAX       UniqueIdentifier
EQUALITY MATCHING RULE  bitStringMatch
LDAP-SYNTAX       bitString.&id
LDAP-NAME        {"x500UniqueIdentifier"}
ID            id-at-uniqueIdentifier }

UniqueIdentifier ::= BIT STRING

dnQualifier ATTRIBUTE ::= {
WITH SYNTAX       PrintableString
EQUALITY MATCHING RULE  caseIgnoreMatch
ORDERING MATCHING RULE  caseIgnoreOrderingMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       printableString.&id
LDAP-NAME        {"dnQualifier"}
ID            id-at-dnQualifier }

serialNumber ATTRIBUTE ::= {
WITH SYNTAX       PrintableString(SIZE (1.MAX))
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       printableString.&id
LDAP-NAME        {"serialNumber"}
ID            id-at-serialNumber }

pseudonym ATTRIBUTE ::= {
SUBTYPE OF       name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"Pseudonym"}
ID           id-at-pseudonym }

uUIDPair ATTRIBUTE ::= {
WITH SYNTAX       UUIDPair
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
EQUALITY MATCHING RULE uUIDPairMatch
LDAP-SYNTAX       uUIDPAIR.&id
LDAP-NAME        {"uUIDPair"}
ID           id-at-uuidpair }

UUIDPair ::= SEQUENCE {
issuerUUID  UUID,
subjectUUID UUID,
... }
UUID ::= OCTET STRING(SIZE (16)) -- UUID format only

uri ATTRIBUTE ::= {
WITH SYNTAX       URI
EQUALITY MATCHING RULE  uriMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"uri"}
ID            id-at-uri }

URI ::= UTF8String
urn ATTRIBUTE ::= {
SUBTYPE OF        uri
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"urn"}
ID            id-at-urn }

url ATTRIBUTE ::= {
SUBTYPE OF        uri
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"url"}
ID            id-at-url }

/* This information object has been moved to UsefulDefinitions module

dnsName ATTRIBUTE ::= {
WITH SYNTAX       DomainName
EQUALITY MATCHING RULE dnsNameMatch
LDAP-SYNTAX       dnsString.&id
LDAP-NAME        {"DNS name"}
ID           id-at-dnsName }

DomainName ::= UTF8String (CONSTRAINED BY { -- Conforms to the format of a domain
name. -- })
*/
intEmail ATTRIBUTE ::= {
WITH SYNTAX       IntEmail
EQUALITY MATCHING RULE intEmailMatch
SINGLE VALUE      TRUE
LDAP-SYNTAX       intEmailString.&id
LDAP-NAME        {"Internationalized Email"}
ID           id-at-intEmail }

IntEmail ::= UTF8String (CONSTRAINED BY { -- Conforms to the format of an
(internationalized) email address. -- })

jid ATTRIBUTE ::= {
WITH SYNTAX       Jid
EQUALITY MATCHING RULE jidMatch
SINGLE VALUE      TRUE
LDAP-SYNTAX       jidString.&id
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
LDAP-NAME        {"Jabber identifier"}
ID           id-at-jid }

Jid ::= UTF8String (CONSTRAINED BY { /* Conforms to the format of a jabber
identifier. */ })
/*
objectIdentifier ATTRIBUTE ::= {
WITH SYNTAX       OBJECT IDENTIFIER
EQUALITY MATCHING RULE objectIdentifierMatch
SINGLE VALUE      TRUE
LDAP-SYNTAX       oid.&id
LDAP-NAME        {"Object Identifier"}
ID           id-at-objectIdentifier }
*/
countryName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       CountryName
SINGLE VALUE       TRUE
LDAP-SYNTAX       countryString.&id
LDAP-NAME        {"c"}
ID            id-at-countryName }

CountryName ::= PrintableString(SIZE (2)) (CONSTRAINED BY { -- ISO 3166 alpha-2
codes only -- })
countryCode3c ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       CountryCode3c
SINGLE VALUE       TRUE
LDAP-SYNTAX       countryString3c.&id
LDAP-NAME        {"c3"}
ID            id-at-countryCode3c }

CountryCode3c ::= PrintableString(SIZE (3)) (CONSTRAINED BY { -- ISO 3166 alpha-
3 codes only -- })
countryCode3n ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       CountryCode3n
SINGLE VALUE       TRUE
LDAP-SYNTAX       countryString3n.&id
LDAP-NAME        {"n3"}
ID            id-at-countryCode3n }

CountryCode3n ::= NumericString(SIZE (3)) (CONSTRAINED BY { -- ISO 3166 numeric-
3 codes only -- })
localityName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"l"}
ID            id-at-localityName }

collectiveLocalityName ATTRIBUTE ::= {
SUBTYPE OF       localityName
COLLECTIVE       TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-l"}
ID           id-at-collectiveLocalityName }
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)

stateOrProvinceName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"st"}
ID            id-at-stateOrProvinceName }

collectiveStateOrProvinceName ATTRIBUTE ::= {
SUBTYPE OF        stateOrProvinceName
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-st"}
ID            id-at-collectiveStateOrProvinceName }

streetAddress ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"street"}
ID            id-at-streetAddress }

collectiveStreetAddress ATTRIBUTE ::= {
SUBTYPE OF        streetAddress
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-street"}
ID            id-at-collectiveStreetAddress }

houseIdentifier ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"houseIdentifier"}
ID            id-at-houseIdentifier }

utmCoordinates ATTRIBUTE ::= {
WITH SYNTAX       UtmCoordinates
SINGLE VALUE       TRUE
LDAP-SYNTAX       utmCoords.&id
LDAP-NAME        {"utmCoordinates"}
ID            id-at-utmCoordinates }

UtmCoordinates ::= SEQUENCE {
zone   PrintableString,
easting  NumericString,
northing NumericString }
organizationName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"o"}
ID            id-at-organizationName }

collectiveOrganizationName ATTRIBUTE ::= {
SUBTYPE OF        organizationName
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-o"}
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
ID            id-at-collectiveOrganizationName }

organizationalUnitName ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"ou"}
ID            id-at-organizationalUnitName }

collectiveOrganizationalUnitName ATTRIBUTE ::= {
SUBTYPE OF        organizationalUnitName
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-ou"}
ID            id-at-collectiveOrganizationalUnitName }

title ATTRIBUTE ::= {
SUBTYPE OF        name
WITH SYNTAX       UnboundedDirectoryString
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"title"}
ID            id-at-title }

organizationIdentifier ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
SINGLE VALUE       TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"organizationIdentifier"}
ID            id-at-organizationIdentifier }

description ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"description"}
ID            id-at-description }

searchGuide ATTRIBUTE ::= {
WITH SYNTAX       Guide
LDAP-SYNTAX       guide.&id
LDAP-NAME        {"searchGuide"}
ID            id-at-searchGuide }

Guide ::= SET {
objectClass [0] OBJECT-CLASS.&id OPTIONAL,
criteria   [1] Criteria,
... }
Criteria ::= CHOICE {
type [0] CriteriaItem,
and  [1] SET OF Criteria,
or  [2] SET OF Criteria,
not  [3] Criteria,
... }
CriteriaItem ::= CHOICE {
equality     [0] AttributeType,
substrings    [1] AttributeType,
greaterOrEqual  [2] AttributeType,
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
lessOrEqual    [3] AttributeType,
approximateMatch [4] AttributeType,
... }
enhancedSearchGuide ATTRIBUTE ::= {
WITH SYNTAX       EnhancedGuide
LDAP-SYNTAX       enhancedGuide.&id
LDAP-NAME        {"enhancedSearchGuide"}
ID            id-at-enhancedSearchGuide }

EnhancedGuide ::= SEQUENCE {
objectClass [0] OBJECT-CLASS.&id,
criteria   [1] Criteria,
subset    [2] INTEGER {
baseObject  (0),
oneLevel   (1),
wholeSubtree (2)} DEFAULT oneLevel,
... }
businessCategory ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"businessCategory"}
ID            id-at-businessCategory }

postalAddress ATTRIBUTE ::= {
WITH SYNTAX       PostalAddress
EQUALITY MATCHING RULE  caseIgnoreListMatch
SUBSTRINGS MATCHING RULE caseIgnoreListSubstringsMatch
LDAP-SYNTAX       postalAddr.&id
LDAP-NAME        {"postalAddress"}
ID            id-at-postalAddress }

PostalAddress ::= SEQUENCE SIZE (1.MAX) OF UnboundedDirectoryString

collectivePostalAddress ATTRIBUTE ::= {
SUBTYPE OF        postalAddress
COLLECTIVE        TRUE
LDAP-SYNTAX       postalAddr.&id
LDAP-NAME        {"c-PostalAddress"}
ID            id-at-collectivePostalAddress }

postalCode ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"postalCode"}
ID            id-at-postalCode }

collectivePostalCode ATTRIBUTE ::= {
SUBTYPE OF        postalCode
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-PostalCode"}
ID            id-at-collectivePostalCode }

postOfficeBox ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"postOfficeBox"}
ID            id-at-postOfficeBox }

collectivePostOfficeBox ATTRIBUTE ::= {
SUBTYPE OF        postOfficeBox
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-PostOfficeBox"}
ID            id-at-collectivePostOfficeBox }

physicalDeliveryOfficeName ATTRIBUTE ::= {
WITH SYNTAX       UnboundedDirectoryString
EQUALITY MATCHING RULE  caseIgnoreMatch
SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"physicalDeliveryOfficeName"}
ID            id-at-physicalDeliveryOfficeName }

collectivePhysicalDeliveryOfficeName ATTRIBUTE ::= {
SUBTYPE OF        physicalDeliveryOfficeName
COLLECTIVE        TRUE
LDAP-SYNTAX       directoryString.&id
LDAP-NAME        {"c-PhysicalDeliveryOfficeName"}
ID            id-at-collectivePhysicalDeliveryOfficeName }

telephoneNumber ATTRIBUTE ::= {
WITH SYNTAX       TelephoneNumber
EQUALITY MATCHING RULE  telephoneNumberMatch
SUBSTRINGS MATCHING RULE telephoneNumberSubstringsMatch
LDAP-SYNTAX       printableString.&id
LDAP-NAME        {"telephoneNumber"}
ID            id-at-telephoneNumber }

TelephoneNumber ::= PrintableString(SIZE (1.ub-telephone-number))
-- String complying with Rec. ITU-T E.123 only

ub-telephone-number INTEGER ::= 32

collectiveTelephoneNumber ATTRIBUTE ::= {
SUBTYPE OF        telephoneNumber
COLLECTIVE        TRUE
LDAP-SYNTAX       printableString.&id
LDAP-NAME        {"c-TelephoneNumber"}
ID            id-at-collectiveTelephoneNumber }

telexNumber ATTRIBUTE ::= {
WITH SYNTAX       TelexNumber
LDAP-SYNTAX       telexNr.&id
LDAP-NAME        {"telexNumber"}
ID            id-at-telexNumber }

TelexNumber ::= SEQUENCE {
telexNumber PrintableString(SIZE (1.ub-telex-number)),
countryCode PrintableString(SIZE (1.ub-country-code)),
answerback  PrintableString(SIZE (1.ub-answerback)),
... }
ub-telex-number INTEGER ::= 14
ub-country-code INTEGER ::= 4
ub-answerback  INTEGER ::= 8
Rec. ITU-T X.520 (2019) Amd. 1 (10/2024)
© ISO/IEC 2025 – All rights reserved
ISO/IEC 9594-6:2020/Amd. 1:2025(en)

collectiveTelexNumber ATTRIBUTE ::= {
SUBTYPE OF        telexNumber
COLLECTIVE        TRUE
LDAP-SYNTAX       telexNr.&id
LDAP-NAME        {"c-TelexNumber"}
ID            id-at-collectiveTelexNumber }

facsimileTelephoneNumber ATTRIBUTE ::= {
WITH SYNTAX       FacsimileTelephoneNumber
EQUALITY MATCHING RULE  facsimileNumberMatch
SUBSTRINGS MATCHING RULE facsimileNumberSubstringsMatch
LDAP-SYNTAX       facsimileTelephoneNr.&id
LDAP-NAME        {"facsimileTelephoneNumber"}
ID            id-at-facsimileTelephoneNumber }

FacsimileTelephoneNumber ::= SEQUENCE {
telephoneNumber TelephoneNumber,
parameters    G3FacsimileNonBasicParameters OPTIONAL,
... }
collectiveFacsimileTelephoneNumber ATTRIBUTE ::= {
SUBTYPE OF        facsimileTelephoneNumber
COLLECTIVE        TRUE
LDAP-SYNTAX       facsimileTelephoneNr.&id
LDAP-NAME        {"c-FacsimileTelephoneNumber"}
ID            id-at-collectiveFacsimileTelephoneNumber }

x121Address ATTRIBUTE ::= {
WITH SYNTAX       X121Address
EQUALITY MATCHING RULE  numericStringMatch
SUBSTRINGS MATCHING RULE numericStringSubstringsMatch
LDAP-SYNTAX       numericString.&id
LDAP-NAME        {"x121Address"}
ID            id-at-x121Address }

X121Address ::= NumericString(SIZE (1.ub-x121-address))
-- String as defined by Rec. ITU-T X.121

ub-x121-address INTEGER ::= 15

internationalISDNNumber ATTRIBUTE ::= {
WITH SYNTAX       InternationalISDNNumber
EQUALITY MATCHING RULE  numericStringMatch
SUBSTRINGS MATCHING RULE numericStringSubstringsMatch
LDAP-SYNTAX       numericString.&id
LDAP-NAME        {"internationalISDNNumber"}
ID            id-at-internationalISDNNumber }

InternationalISDNNumber ::=
NumericString(SIZE (1.ub-international-isdn-number))
-- String complying with Rec. ITU-T E.164 only

ub-international-isdn-number
...