In ASN.1 you'll have definitions like this:

id-ad-ocsp         OBJECT IDENTIFIER ::= { id-ad 1 }

X.680 (page 22) says the following:

Each production consists of the following parts, on one or several lines, in order:

a) a name for the new permitted sequence of lexical items;

b) the characters


c) one or more alternative sequences of lexical items, as defined in 5.3, separated by the character


So the id-ad-ocsp bit is a name. But what are the valid characters in a name?

  • 1
    See section 12.3 (and section 12 in general) of that X.680 document
    – Ben Voigt
    Jan 15 at 22:05

2 Answers 2


The rules are found in clause 12, and are

  • An arbitrary number (one or more) of letters, digits, and hyphens
  • The initial character shall be a letter.
  • A hyphen shall not be the last character.
  • A hyphen shall not be immediately followed by another hyphen.

Whether the initial character (always a letter) is uppercase or lowercase reflects whether the lexical item is a type reference, module reference, value reference, or identifier.


The short answer is: Integers

From section 3.8.54 of the document you referenced:

3.8.54 Object identifier type: A simple type whose values are a sequence of primary integer values that identify a series of arcs leading from the root to a node of the International Object Identifier tree, as specified by the Rec. ITU-T X.660 | ISO/IEC 9834 series.

The longer answer is:
Like any standard document, you're not getting away with reading just one. The short answer referenced X.660. The X.660 details the use of integers but also throws in using Unicode for internationalization purposes. The Let's Encrypt document linked below is a much easier first read.

Object identifiers are globally unique, hierarchical identifiers made of a sequence of integers. They can refer to any kind of “thing,” but are commonly used to identify standards, algorithms, certificate extensions, organizations, or policy documents. For example, 1.2.840.113549 identifies RSA Security LLC. RSA can then assign OIDs starting with that prefix, like 1.2.840.113549.1.1.11, which identifies sha256WithRSAEncryption, as defined in RFC 8017.

The set of child OIDs that can exist under a given prefix is called an “OID arc.” Since the representation of shorter OIDs is smaller, OID assignments under shorter arcs are considered more valuable, particularly for formats where that OID will have to be sent a lot. The OID arc 2.5 is assigned to “Directory Services,” the series of specifications that includes X.509, which HTTPS certificates are based on. A lot of fields in certificates begin with that conveniently short arc. For instance, means “countryName,” while means “organizationName.” Since most certificates have to encode each of those OIDs at least once, it’s handy that they are short.

That document also details Object Identifier encoding as:

OIDs are conceptually a series of integers. They are always at least two components long. The first component is always 0, 1, or 2. When the first component is 0 or 1, the second component is always less than 40. Because of this, the first two components are unambiguously represented as 40X+Y, where X is the first component and Y is the second.
So, for instance, to encode 2.999.3, you would combine the first two components into 1079 decimal (40
2 + 999), which would give you “1079.3”.

The X.660 document has the catchy title:
Information technology - Procedures for the operation of object identifier registration authorities: General procedures and top arcs of the international object identifier tree.

It's the standard and reads like a standard. Section 7 speaks to the International OID tree.

Let's Encrypt - A Warm Welcome to ASN1 and DER

  • 1
    That's a lot of factual information about OIDs, but the question wasn't about OIDs.
    – Ben Voigt
    Jan 15 at 22:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .