Update Normative References

[SteveLLamb]

Reference to 430-2

[msheby]

also:

---

FIPS 180-2 withdrawn and replaced by FIPS 180-4
FIPS 198 withdrawn and replaced by FIPS 198-1
RFC 3447 obsoleted by RFC 8017
RFC 2253 obsoleted by RFC 4514
RFC 4051 obsoleted by RFC 6931

[msheby]

Bibliography:
RFC 1521 obsoleted by RFC 2045.
ST 430-1 has been updated and needs an update. Also: circular dependency.
KMG draft replaced by SP 800-57.
RFC 3280 obsoleted by RFC 5280.
RFC 4055 updated by RFC 5756.
RFC 2246 obsoleted by RFC 8446.
X.509 08/97 superseded by X.509 10/19.
XKMS draft replaced by XKMS 2.0 https://www.w3.org/TR/xkms2/.
ISO 3166:1993 withdrawn -- is this a typo for RFC 3066?

[msheby]

Normative References (Section 3) — Superseded Documents and Orphaned Citation

Nine of the twelve normative references cite documents that have since been superseded:

[FIPS-180-2] FIPS 180-2 (2002) superseded by FIPS 180-4 (2012)
[FIPS-198] FIPS 198 (2002) superseded by FIPS 198-1 (2008)
[PKCS1] RFC 3447 / PKCS#1 v2.1 (2003) superseded by RFC 8017 / PKCS#1 v2.2 (2016)
[RFC2253] RFC 2253 (1997) superseded by RFC 4514 (2006)
[RFC4051] RFC 4051 (2005) superseded by RFC 6931 (2013)
[UUID] RFC 4122 (2005) superseded by RFC 9562 (2024)
[XML] XML Schema Part 1: Structures First Edition (2001) superseded by Second Edition (2004)
[XML-Encrypt] XML Encryption Syntax and Processing (2002) superseded by XML Encryption 1.1 (2013)
[XML-Sign] XML-Signature Syntax and Processing (2002) superseded by XML Signature 1.1 (2013)

Not superseded:
[FIPS-197] AES spec republished in 2023 with identical content; 2001 version remains valid.
[Time] RFC 3339 (2002) not formally obsoleted; still current.
[D-Cinema Digital Certificate] SMPTE 430-2 — refer to latest published version.

Additionally, [UUID] is never cited with bracket notation in the normative body text. Section 6.1 (MessageId) requires the urn:uuid format but omits the [UUID] inline citation. Since the format requirement is normative, the reference should remain in Section 3 and the inline citation [UUID] should be added to Section 6.1.

Conformance Impact

These are editorial corrections — the reference entries are updated to point to the current
authoritative document for each specification. No substantive requirement of ST 430-3 changes
as a result. Earlier implementations remain conformant because:

[FIPS-180-2→180-4] SHA-256 definition is identical; FIPS 180-4 adds SHA-512/224 and
SHA-512/256 only (additive).
[FIPS-198→198-1] Administrative redesignation; HMAC construction is unchanged.
[PKCS1: RFC 3447→8017] RSA-OAEP-MGF1P is identical in both versions. RFC 8017 deprecates
RSAES-PKCS1-v1_5, which ST 430-3 already forbids.
[RFC2253→4514] DN string encoding for IssuerName is backward compatible; RFC 4514
adds no new mandatory requirements for the fields ST 430-3 uses.
[RFC4051→6931] All algorithm URIs used by ST 430-3 (rsa-oaep-mgf1p, rsa-sha256,
sha256, aes128-cbc) are present and unchanged in RFC 6931.
[UUID: RFC 4122→9562] RFC 9562 §6.10 explicitly states "this document makes no changes to
existing UUID versions." The urn:uuid: URN format is identical.
[XML Schema 1st→2nd] W3C designated the Second Edition a bug-fix release; it is fully
backward compatible.
[XML-Encrypt 1.0→1.1] AES-128-CBC is unchanged. XML Encryption 1.1 adds a mandatory
padding-oracle mitigation for decoders; this is a new decoder
obligation but does not invalidate message format produced under 1.0.
[XML-Sign 1.0→1.1] The required algorithms (C14N with comments, RSA-SHA256, SHA-256
digest) are identical in both versions. Version 1.1 adds ECDSA and
new transform types only.