KeyPurposeId (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.asn1.x509

## Class KeyPurposeId

- java.lang.Object
- - org.bouncycastle.asn1.ASN1Object
  - - org.bouncycastle.asn1.x509.KeyPurposeId

- All Implemented Interfaces:
    ASN1Encodable, Encodable

      public class KeyPurposeId
      extends ASN1Object

  The KeyPurposeId object.

           KeyPurposeId ::= OBJECT IDENTIFIER

           id-kp ::= OBJECT IDENTIFIER { iso(1) identified-organization(3)
                dod(6) internet(1) security(5) mechanisms(5) pkix(7) 3}

  To create a new KeyPurposeId where none of the below suit, use

           ASN1ObjectIdentifier newKeyPurposeIdOID = new ASN1ObjectIdentifier("1.3.6.1...");

           KeyPurposeId newKeyPurposeId = KeyPurposeId.getInstance(newKeyPurposeIdOID);

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static KeyPurposeId` | `anyExtendedKeyUsage` { 2 5 29 37 0 }
    `static KeyPurposeId` | `id_kp_capwapAC` { id-kp 18 }
    `static KeyPurposeId` | `id_kp_capwapWTP` { id-kp 19 }
    `static KeyPurposeId` | `id_kp_clientAuth` { id-kp 2 }
    `static KeyPurposeId` | `id_kp_cmcCA` id-kp-cmcCA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 27 }
    `static KeyPurposeId` | `id_kp_cmcRA` id-kp-cmcRA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 28 }
    `static KeyPurposeId` | `id_kp_cmKGA` id-kp-cmKGA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 32 }
    `static KeyPurposeId` | `id_kp_codeSigning` { id-kp 3 }
    `static KeyPurposeId` | `id_kp_configSigning` RFC 9809 sec. 3 - signing general-purpose configuration files.
    `static KeyPurposeId` | `id_kp_documentSigning` RFC 9336 sec. 3.1 - signing documents (e.g.
    `static KeyPurposeId` | `id_kp_dvcs` { id-kp 10 }
    `static KeyPurposeId` | `id_kp_eapOverLAN` { id-kp 14 }
    `static KeyPurposeId` | `id_kp_eapOverPPP` { id-kp 13 }
    `static KeyPurposeId` | `id_kp_emailProtection` { id-kp 4 }
    `static KeyPurposeId` | `id_kp_imUri` RFC 9734 sec. 3 - proving the identity of an Instant Messaging (IM) client, whose IM URI (RFC 3860) or XMPP URI (RFC 6121) appears in the subjectAltName.
    `static KeyPurposeId` | `id_kp_ipsecEndSystem` Usage deprecated by RFC4945 - was { id-kp 5 }
    `static KeyPurposeId` | `id_kp_ipsecIKE` { id-kp 17 }
    `static KeyPurposeId` | `id_kp_ipsecTunnel` Usage deprecated by RFC4945 - was { id-kp 6 }
    `static KeyPurposeId` | `id_kp_ipsecUser` Usage deprecated by RFC4945 - was { idkp 7 }
    `static KeyPurposeId` | `id_kp_macAddress`
    `static KeyPurposeId` | `id_kp_msSGC` Microsoft Server Gated Crypto (msSGC) see https://www.alvestrand.no/objectid/1.3.6.1.4.1.311.10.3.3.html
    `static KeyPurposeId` | `id_kp_nsSGC` Netscape Server Gated Crypto (nsSGC) see https://www.alvestrand.no/objectid/2.16.840.1.113730.4.1.html
    `static KeyPurposeId` | `id_kp_OCSPSigning` { id-kp 9 }
    `static KeyPurposeId` | `id_kp_safetyCommunication` RFC 9809 sec. 3 - authenticating communication peers for safety-critical communication.
    `static KeyPurposeId` | `id_kp_sbgpCertAAServerAuth` { id-kp 11 }
    `static KeyPurposeId` | `id_kp_scvp_responder` { id-kp 12 }
    `static KeyPurposeId` | `id_kp_scvpClient` { id-kp 16 }
    `static KeyPurposeId` | `id_kp_scvpServer` { id-kp 15 }
    `static KeyPurposeId` | `id_kp_serverAuth` { id-kp 1 }
    `static KeyPurposeId` | `id_kp_smartcardlogon` { 1 3 6 1 4 1 311 20 2 2 }
    `static KeyPurposeId` | `id_kp_timeStamping` { id-kp 8 }
    `static KeyPurposeId` | `id_kp_trustAnchorConfigSigning` RFC 9809 sec. 3 - signing trust anchor configuration files.
    `static KeyPurposeId` | `id_kp_updatePackageSigning` RFC 9809 sec. 3 - signing software or firmware update packages.

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `java.lang.String` | `getId()`
    `static KeyPurposeId` | `getInstance(java.lang.Object o)`
    `ASN1Primitive` | `toASN1Primitive()` Method providing a primitive representation of this object suitable for encoding.
    `ASN1ObjectIdentifier` | `toOID()`
    `java.lang.String` | `toString()`

    - ### Methods inherited from class org.bouncycastle.asn1.ASN1Object

      `encodeTo, encodeTo, equals, getEncoded, getEncoded, hasEncodedTagValue, hashCode`

    - ### Methods inherited from class java.lang.Object

      `clone, finalize, getClass, notify, notifyAll, wait, wait, wait`

- - ### Field Detail

    - #### anyExtendedKeyUsage

          public static final KeyPurposeId anyExtendedKeyUsage

      { 2 5 29 37 0 }

    - #### id_kp_serverAuth

          public static final KeyPurposeId id_kp_serverAuth

      { id-kp 1 }

    - #### id_kp_clientAuth

          public static final KeyPurposeId id_kp_clientAuth

      { id-kp 2 }

    - #### id_kp_codeSigning

          public static final KeyPurposeId id_kp_codeSigning

      { id-kp 3 }

    - #### id_kp_emailProtection

          public static final KeyPurposeId id_kp_emailProtection

      { id-kp 4 }

    - #### id_kp_ipsecEndSystem

          public static final KeyPurposeId id_kp_ipsecEndSystem

      Usage deprecated by RFC4945 - was { id-kp 5 }

    - #### id_kp_ipsecTunnel

          public static final KeyPurposeId id_kp_ipsecTunnel

      Usage deprecated by RFC4945 - was { id-kp 6 }

    - #### id_kp_ipsecUser

          public static final KeyPurposeId id_kp_ipsecUser

      Usage deprecated by RFC4945 - was { idkp 7 }

    - #### id_kp_timeStamping

          public static final KeyPurposeId id_kp_timeStamping

      { id-kp 8 }

    - #### id_kp_OCSPSigning

          public static final KeyPurposeId id_kp_OCSPSigning

      { id-kp 9 }

    - #### id_kp_dvcs

          public static final KeyPurposeId id_kp_dvcs

      { id-kp 10 }

    - #### id_kp_sbgpCertAAServerAuth

          public static final KeyPurposeId id_kp_sbgpCertAAServerAuth

      { id-kp 11 }

    - #### id_kp_scvp_responder

          public static final KeyPurposeId id_kp_scvp_responder

      { id-kp 12 }

    - #### id_kp_eapOverPPP

          public static final KeyPurposeId id_kp_eapOverPPP

      { id-kp 13 }

    - #### id_kp_eapOverLAN

          public static final KeyPurposeId id_kp_eapOverLAN

      { id-kp 14 }

    - #### id_kp_scvpServer

          public static final KeyPurposeId id_kp_scvpServer

      { id-kp 15 }

    - #### id_kp_scvpClient

          public static final KeyPurposeId id_kp_scvpClient

      { id-kp 16 }

    - #### id_kp_ipsecIKE

          public static final KeyPurposeId id_kp_ipsecIKE

      { id-kp 17 }

    - #### id_kp_capwapAC

          public static final KeyPurposeId id_kp_capwapAC

      { id-kp 18 }

    - #### id_kp_capwapWTP

          public static final KeyPurposeId id_kp_capwapWTP

      { id-kp 19 }

    - #### id_kp_cmcCA

          public static final KeyPurposeId id_kp_cmcCA

      id-kp-cmcCA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 27 }

    - #### id_kp_cmcRA

          public static final KeyPurposeId id_kp_cmcRA

      id-kp-cmcRA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 28 }

    - #### id_kp_cmKGA

          public static final KeyPurposeId id_kp_cmKGA

      id-kp-cmKGA OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 32 }

    - #### id_kp_documentSigning

          public static final KeyPurposeId id_kp_documentSigning

      RFC 9336 sec. 3.1 - signing documents (e.g. PDF, XML, JSON) for human consumption.

      id-kp-documentSigning OBJECT IDENTIFIER ::= { id-kp 36 }

    - #### id_kp_imUri

          public static final KeyPurposeId id_kp_imUri

      RFC 9734 sec. 3 - proving the identity of an Instant Messaging (IM) client, whose IM URI (RFC 3860) or XMPP URI (RFC 6121) appears in the subjectAltName.

      id-kp-imUri OBJECT IDENTIFIER ::= { id-kp 40 }

    - #### id_kp_configSigning

          public static final KeyPurposeId id_kp_configSigning

      RFC 9809 sec. 3 - signing general-purpose configuration files.

      id-kp-configSigning OBJECT IDENTIFIER ::= { id-kp 41 }

    - #### id_kp_trustAnchorConfigSigning

          public static final KeyPurposeId id_kp_trustAnchorConfigSigning

      RFC 9809 sec. 3 - signing trust anchor configuration files.

      id-kp-trustAnchorConfigSigning OBJECT IDENTIFIER ::= { id-kp 42 }

    - #### id_kp_updatePackageSigning

          public static final KeyPurposeId id_kp_updatePackageSigning

      RFC 9809 sec. 3 - signing software or firmware update packages.

      id-kp-updatePackageSigning OBJECT IDENTIFIER ::= { id-kp 43 }

    - #### id_kp_safetyCommunication

          public static final KeyPurposeId id_kp_safetyCommunication

      RFC 9809 sec. 3 - authenticating communication peers for safety-critical communication.

      id-kp-safetyCommunication OBJECT IDENTIFIER ::= { id-kp 44 }

    - #### id_kp_smartcardlogon

          public static final KeyPurposeId id_kp_smartcardlogon

      { 1 3 6 1 4 1 311 20 2 2 }

    - #### id_kp_macAddress

          public static final KeyPurposeId id_kp_macAddress

    - #### id_kp_msSGC

          public static final KeyPurposeId id_kp_msSGC

      Microsoft Server Gated Crypto (msSGC) see https://www.alvestrand.no/objectid/1.3.6.1.4.1.311.10.3.3.html

    - #### id_kp_nsSGC

          public static final KeyPurposeId id_kp_nsSGC

      Netscape Server Gated Crypto (nsSGC) see https://www.alvestrand.no/objectid/2.16.840.1.113730.4.1.html

  - ### Method Detail

    - #### getInstance

          public static KeyPurposeId getInstance(java.lang.Object o)

    - #### toOID

          public ASN1ObjectIdentifier toOID()

    - #### toASN1Primitive

          public ASN1Primitive toASN1Primitive()

      Description copied from class: `ASN1Object`
      Method providing a primitive representation of this object suitable for encoding.
      Specified by:
        `toASN1Primitive` in interface `ASN1Encodable`
      Specified by:
        `toASN1Primitive` in class `ASN1Object`
      Returns:
        a primitive representation of this object.

    - #### getId

          public java.lang.String getId()

    - #### toString

          public java.lang.String toString()

      Overrides:
        `toString` in class `java.lang.Object`