YANG SID ranges for PEN: YANG-CBOR: Allocating SID Ranges for Private Enterprise Number (PEN) Holders
Allocating globally unique identifiers to enterprise organizations through existing PEN assignments.
Bormann, C., "YANG-CBOR: Allocating SID Ranges for Private Enterprise Number (PEN) Holders", RFC 9997, DOI 10.17487/RFC9997, July 2026, <https://www.rfc-editor.org/info/rfc9997>.
@misc{rfc9997,
series = {Request for Comments},
number = 9997,
howpublished = {RFC 9997},
publisher = {RFC Editor},
doi = {10.17487/RFC9997},
url = {https://www.rfc-editor.org/info/rfc9997},
author = {C. Bormann},
title = {{YANG-CBOR: Allocating SID Ranges for Private Enterprise Number (PEN) Holders}},
pagetotal = 6,
year = 2026,
month = jul,
} RFC text
Contents
Internet Engineering Task Force (IETF) C. Bormann
Request for Comments: 9997 Universität Bremen TZI
Category: Standards Track July 2026
ISSN: 2070-1721
YANG-CBOR: Allocating SID Ranges for Private Enterprise Number (PEN)
Holders
Abstract
YANG-CBOR (RFC 9254, "Encoding of Data Modeled with YANG in the
Concise Binary Object Representation (CBOR)") defines YANG Schema
Item iDentifiers (YANG SIDs), globally unique 63-bit unsigned
integers used to identify YANG items. RFC 9595 ("YANG Schema Item
iDentifier (YANG SID)") defines ways to allocate these SIDs using
IANA registries.
The present specification employs these SID allocation mechanisms to
allocate ranges of 100 000 SIDs (representation size 64 bits) to each
holder of an IANA Private Enterprise Number (PEN) of a value below
1 000 000. Holders of PENs of values smaller than 100 000 are also
allocated ranges of 10 000 SIDs (representation size 32 bits).
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9997.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Revised BSD License text as described in Section 4.e of the
Trust Legal Provisions and are provided without warranty as described
in the Revised BSD License.
Table of Contents
1. Introduction
2. Example: SID Range Allocation for Holder of PEN 32473
3. Discussion
4. IANA Considerations
5. Security Considerations
6. References
6.1. Normative References
6.2. Informative References
Acknowledgments
Author's Address
1. Introduction
YANG-CBOR [RFC9254] defines YANG Schema Item iDentifiers (YANG SID),
globally unique 63-bit unsigned integers used to identify YANG items.
[RFC9595] defines ways to allocate these SIDs using IANA registries.
The present specification employs these SID allocation mechanisms to
allocate ranges of 100 000 SIDs (representation size 64 bits) to each
holder of an IANA Private Enterprise Number (PEN) of a value below
1 000 000. Holders of PENs of values smaller than 100 000 are also
allocated ranges of 10 000 SIDs (representation size 32 bits).
IANA has allocated a mega-range with 100 billion SIDs (representation
size 64 bits) for the SID numbers 300 000 000 000 to 399 999 999 999.
IANA has also allocated a mega-range with 1 billion SIDs
(representation size 32 bits) for the SID numbers 3 000 000 000 to
3 999 999 999.
PENs are registered in [IANA.enterprise-numbers] using a low-
threshold, low-overhead registration process. At the time of writing
(~38 years after registry creation), around 66 000 PENs are
registered. In this document, the registrant for a PEN is referred
to as the "PEN holder".
This specification makes the following SID ranges available to
certain (current or future) PEN holders for allocation in a scheme
defined by the holder:
* The holder of a PEN ppp ppp (< 1 000 000) can use the SID numbers
3pp ppp p00 000 to 3pp ppp p99 999.
* The holder of a PEN pp ppp (< 100 000) can also use the smaller
SID numbers 3 ppp pp0 000 to 3 ppp pp9 999.
2. Example: SID Range Allocation for Holder of PEN 32473
[RFC5612] allocated Enterprise Number 32473 "for use in examples in
RFCs, books, documentation, and the like".
If this Enterprise Number had an actual PEN holder, the present
specification would confer control over the following SID ranges to
the holder:
* 3*03 247 3*00 000 up to 3*03 247 3*99 999, and
* 3 *324 73*0 000 up to 3 *324 73*9 999.
(The plaintext form of this document shows "*" characters around the
digits conveying the PEN, which are shown in *boldface* in the other
renditions.)
As Enterprise Number 32473 is intended to be used in documentation,
the SIDs in the two SID ranges are consequently also available for
use in documentation.
3. Discussion
This document assigns two mega-ranges as an extremely-low-threshold
(zero-interaction) way for a PEN holder to obtain a number space for
the YANG SIDs used in their YANG modules. If a PEN is not already
available to the entity needing such a number space, it can be
obtained through a very low-threshold process. However, use of
values in these mega-ranges is not always the recommended approach
for a module author:
* In the larger of the two spaces, each SID number needs a
representation size of 64 bits ("64-bit SIDs"). (This larger
representation size of the absolute value of the SID is of
comparatively little consequence due to the delta-encoding used
for SIDs in YANG-CBOR.)
* For the holders of PENs with values less than 100 000 in the
"Private Enterprise Numbers (PENs)" registry, there is another
smaller space of SID numbers that need a representation size of 32
bits ("32-bit SIDs"). By or around 2040, the PENs with a value
less than 100 000 are likely to be exhausted; the expectation is
that there will be enough opportunities by that time to request
SID ranges within mega-ranges already allocated by other
registrants that this mechanism is less needed.
* This document does not define infrastructure to discover the YANG
module behind a SID in one of its ranges. Of course, each PEN
holder can provide such infrastructure, but even then the problem
of how to find that infrastructure for a SID remains. (Search
engines may mitigate this somewhat.) On the other hand, in some
cases this relative obscurity may be exactly what a PEN holder
wants to achieve by using this mechanism.
If obscurity is not the intention, one or both of the following
approaches are encouraged:
- The PEN holder can provide a public repository where their YANG
models can be found alongside the applicable SID files. Such a
repository may be easy to set up using a popular git forge such
as, at the time of writing, GitHub.
- Implementations that employ PEN-based SIDs can facilitate
information discovery by providing a form of a YANG library
[RFC8525], possibly a constrained version [core-yang-library].
Relying on the PEN registry might theoretically trigger a land grab
of PEN assignments by prospective writers of YANG modules. However,
PENs have been around for decades (see Section 3.1.4 of [RFC1065],
which continues to be in force with no technical changes as
Section 3.1.4 of RFC 1155 [STD16]), and such a land grab has not
occurred for the other allocations implicitly provided by obtaining a
PEN.
4. IANA Considerations
As summarized in Table 1, this document allocates the following two
mega-ranges (Section 6.3 of [RFC9595]) in the "YANG-SID Mega-Ranges"
registry within the "YANG SIDs" registry group [IANA.yang-sid]:
* 1 billion SIDs ranging from 3 000 000 000 up to 3 999 999 999
(32-bit representation size)
* 100 billion SIDs ranging from 300 000 000 000 up to
399 999 999 999 (64-bit representation size)
+=========+=========+============+======+=========================+
| Entry | Size | Allocation | Org | URL |
| Point | | | Name | |
+=========+=========+============+======+=========================+
| 3 000 | 1 000 | Private | IANA | https://rfc- |
| 000 000 | 000 000 | | | editor.org/info/rfc9997 |
+---------+---------+------------+------+-------------------------+
| 300 000 | 100 000 | Private | IANA | https://rfc- |
| 000 000 | 000 000 | | | editor.org/info/rfc9997 |
+---------+---------+------------+------+-------------------------+
Table 1: YANG-SID Mega-Range Allocations for Use by PEN Holders
IANA has marked the following ranges as Reserved for Documentation:
* 303 247 300 000 up to 303 247 399 999
* 3 324 730 000 up to 3 324 739 999
An additional contact for the allocation is: IETF CORE Working Group
(core@ietf.org) or IETF Applications and Real-Time Area
(art@ietf.org).
The allocation policy inside the mega-range is "Private" (see
Section 6.3.2 of [RFC9595]). The URL is that of the present
specification.
The management of each SID block of 100 000 SIDs, ranging from
3pp ppp p00 000 to 3pp ppp p99 999, is delegated to the PEN holder
for PEN ppp ppp (i.e., the PEN holder for ppp ppp controls SID
3pp ppp p00 000 to 3pp ppp p99 999).
Similarly, the management of each SID block of 10 000 SIDs, ranging
from 3 ppp pp0 000 to 3 ppp pp9 999, is delegated to the PEN holder
for PEN pp ppp (i.e., the PEN holder for pp ppp controls SID
3 ppp pp0 000 to 3 ppp pp9 999).
Section 6.3.2 of [RFC9595] requires an organization that requests an
entry in the "YANG-SID Mega-Ranges" registry to ensure the technical
capacity to manage the SID ranges within those mega-ranges for a
period of at least 10 years (Private ranges). The individual SID
ranges within the mega-ranges allocated in this document are assigned
through the registration of PEN numbers. The technical capacity to
ensure the sustained operation of the PEN number registry is derived
from the demonstrated capacity of IANA to maintain this registry as
well as the importance of a functioning PEN number registry in other
contexts.
5. Security Considerations
The Security Considerations of Section 5 of [RFC9595] and Section 8
of [RFC9254] apply. In particular, the fact that a certain Private
Enterprise Number appears in a SID is not an indicator of provenance,
i.e., it does not guarantee that the SID or underlying YANG model
actually originates from the holder of that PEN. The requirement to
ascertain the authoritative source of this information, as discussed
in the above security considerations, remains.
6. References
6.1. Normative References
[IANA.enterprise-numbers]
IANA, "Private Enterprise Numbers (PENs)",
<https://www.iana.org/assignments/enterprise-numbers>.
[IANA.yang-sid]
IANA, "YANG SIDs",
<https://www.iana.org/assignments/yang-sid>.
[RFC9254] Veillette, M., Ed., Petrov, I., Ed., Pelov, A., Bormann,
C., and M. Richardson, "Encoding of Data Modeled with YANG
in the Concise Binary Object Representation (CBOR)",
RFC 9254, DOI 10.17487/RFC9254, July 2022,
<https://www.rfc-editor.org/info/rfc9254>.
[RFC9595] Veillette, M., Ed., Pelov, A., Ed., Petrov, I., Ed.,
Bormann, C., and M. Richardson, "YANG Schema Item
iDentifier (YANG SID)", RFC 9595, DOI 10.17487/RFC9595,
July 2024, <https://www.rfc-editor.org/info/rfc9595>.
6.2. Informative References
[core-yang-library]
Veillette, M. and I. Petrov, "Constrained YANG Module
Library", Work in Progress, Internet-Draft, draft-ietf-
core-yang-library-03, 11 January 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-core-
yang-library-03>.
[RFC1065] McCloghrie, K. and M. Rose, "Structure and identification
of management information for TCP/IP-based internets",
RFC 1065, DOI 10.17487/RFC1065, August 1988,
<https://www.rfc-editor.org/info/rfc1065>.
[RFC5612] Eronen, P. and D. Harrington, "Enterprise Number for
Documentation Use", RFC 5612, DOI 10.17487/RFC5612, August
2009, <https://www.rfc-editor.org/info/rfc5612>.
[RFC8525] Bierman, A., Bjorklund, M., Schoenwaelder, J., Watsen, K.,
and R. Wilton, "YANG Library", RFC 8525,
DOI 10.17487/RFC8525, March 2019,
<https://www.rfc-editor.org/info/rfc8525>.
[STD16] Internet Standard 16,
<https://www.rfc-editor.org/info/std16>.
At the time of writing, this STD comprises the following:
Rose, M. and K. McCloghrie, "Structure and identification
of management information for TCP/IP-based internets",
STD 16, RFC 1155, DOI 10.17487/RFC1155, May 1990,
<https://www.rfc-editor.org/info/rfc1155>.
Rose, M. and K. McCloghrie, "Concise MIB definitions",
STD 16, RFC 1212, DOI 10.17487/RFC1212, March 1991,
<https://www.rfc-editor.org/info/rfc1212>.
Acknowledgments
This document was inspired by the discussion of the authors of
[RFC9254] and [RFC9595] on how to handle Rob Wilton's feedback.
Author's Address
Carsten Bormann
Universität Bremen TZI
Postfach 330440
D-28359 Bremen
Germany
Phone: +49-421-218-63921
Email: cabo@tzi.org
AI ELI5
On this page
§1Introduction
YANG Schema Item Identifiers (YANG SIDs) are globally unique 63-bit numbers that identify items within YANG data models. RFC 9254 defines how to encode YANG data using CBOR (Concise Binary Object Representation) with SIDs, making the encoding much more compact than XML or JSON. RFC 9595 defines how to allocate SIDs using IANA registries.
This specification connects SID allocation to the existing Private Enterprise Number (PEN) registry, which has been maintained by IANA for decades. PENs are assigned to organizations that need a private namespace for their own specifications, much like organization identifiers in other systems.
The scheme allocates SID ranges to PEN holders: each organization holding a PEN below 1,000,000 gets exclusive use of 100,000 consecutive SIDs, with a representation size of 64 bits. Organizations holding a PEN below 100,000 also get a smaller range of 10,000 SIDs with a 32-bit representation size, which is more efficient for encoded data.
YANG uses short numbers to name different parts of data models. Instead of creating a whole new system to give out these numbers, the plan reuses the existing company ID system (PENs) so each company automatically gets its own block of numbers to use.
§2Key Concepts
The specification uses two mega-ranges allocated by IANA:
- 32-bit SID range: 3,000,000,000 to 3,999,999,999 (1 billion SIDs). These SIDs require only 32 bits to represent in CBOR, making them highly compact. Allocated to PEN holders with PEN values below 100,000.
- 64-bit SID range: 300,000,000,000 to 399,999,999,999 (100 billion SIDs). These require 64 bits to represent. Allocated to any PEN holder with a PEN value below 1,000,000.
Within each mega-range, SIDs are allocated using a formula based on the PEN value. For a PEN holder with PEN value ppp ppp (less than 1,000,000), the 64-bit allocation gives them SID numbers 3pp ppp p00 000 through 3pp ppp p99 999 (100,000 consecutive numbers). For PENs less than 100,000, the 32-bit allocation additionally grants 3 ppp pp0 000 through 3 ppp pp9 999 (10,000 numbers).
Organizations get two pools of ID numbers: a large pool (using 64 bits) and a smaller, more efficient pool (32 bits) if they have an older company number.
§3Allocation Example
RFC 5612 reserved PEN 32473 for use in examples and documentation. Under this specification, a holder of PEN 32473 would be allocated two ranges:
- The 64-bit range from SID 303,247,300,000 to 303,247,399,999 (100,000 consecutive SIDs)
- The 32-bit range from SID 3,324,730,000 to 3,324,739,999 (10,000 consecutive SIDs)
Since PEN 32473 is designated for documentation and examples, these SID ranges are also marked by IANA as available for use in documentation and examples.
A company with a low ID number gets to use special ranges of numbers in both the large and compact ID systems.
§4Design Rationale
This allocation scheme offers benefits and tradeoffs:
- Low-friction assignment: PEN holders automatically receive their SID ranges with zero additional overhead. The PEN registry uses a low-threshold process requiring minimal paperwork.
- Representation size tradeoffs: The 64-bit SID range is large enough for most use cases, but the encoded representation takes 8 bytes. The smaller 32-bit range (for PENs under 100,000) encodes in 4 bytes, reducing CBOR message size. This benefits constrained devices but is expected to be exhausted around 2040 as new PENs are allocated.
- Discovery challenges: A PEN appearing in a SID does not guarantee the SID originates from that PEN holder—it is merely a namespace convention. PEN holders should provide their own public repository or YANG library to help others discover their models.
- No land grab expected: Although the PEN registry has existed for decades with no surge in speculative registrations, the specification acknowledges that assigning number spaces might theoretically encourage requests. However, historical evidence suggests this is not a practical concern.
This approach is simple and automatic, but the company still needs to publish a list of what each number means, or users won't find the definitions.
§5IANA Allocations and Management
IANA allocates two mega-ranges in the YANG-SID Mega-Ranges registry and applies specific management policies:
- The 1-billion-SID range (32-bit) starting at 3,000,000,000
- The 100-billion-SID range (64-bit) starting at 300,000,000,000
Within each mega-range, each PEN holder's individual SID block is delegated to the PEN holder themselves under a "Private" allocation policy. This means the PEN holder controls how SIDs within their block are assigned to their own YANG modules or sub-organizations. Management authority is derived from IANA's demonstrated capacity to maintain the PEN registry for several decades, ensuring sustained technical support for at least 10 years (the required duration for IANA mega-range operators).
IANA also marks two example ranges (based on PEN 32473) as Reserved for Documentation, making them available for use in RFCs, examples, and documentation as stated in RFC 5612.
IANA set up the system and made sure each company could manage its own block, relying on IANA's long track record of maintaining the company ID system.
§6Security Considerations
The security considerations of RFC 9595 and RFC 9254 apply to this allocation mechanism. The key concern is that appearing in a SID does not prove provenance: a PEN value embedded in a SID does not guarantee that the YANG module actually comes from the PEN holder. Potential attackers could use SIDs in the allocated ranges without authorization.
To mitigate this risk, PEN holders are encouraged to provide publicly discoverable information about their YANG modules, either through a public repository (such as GitHub) or by publishing a YANG library (as defined in RFC 8525, or a constrained version in a separate specification). Implementers that use PEN-based SIDs should also provide YANG library information to help consumers verify that they are using authentic modules.
Just because a number belongs to a company doesn't mean something is really from that company. Companies should publish a list of what they actually made so people can check.