Background

The IEEE 1609.2.1 SCMS

Autonomous and connected vehicles depend on secure and reliable V2X (V2V/V2I) communication to enable cooperative awareness, coordinated maneuvers, traffic optimization, and improved road safety. In this context, security and privacy are foundational.

The IEEE 1609.2.1 (2022) standard defines the Security Credential Management System (SCMS) for V2X: a Public-Key Infrastructure (PKI) responsible for issuing and managing digital certificates for V2X end entities (e.g., OBUs and RSUs). These certificates encode application permissions and used to sign message exchanged between end-entities.

Despite its importance, implementing a correct SCMS presents multi-dimensional challenges. It requires secure coordination across distributed components with distinct trust models, must handle high volumes of cryptographic operations under strict latency and privacy constraints, needs to address critical systems concerns like parallelism and fault tolerance, and has historically suffered from limited accessibility due to proprietary implementations that hinder both research experimentation and industry prototyping.

OpenSCMS

OpenSCMS addresses this gap with an open-source implementation of the core workflows of an IEEE 1609.2.1-compliant SCMS. It focuses on a "minimum complete" set of building blocks that enables real-world use while keeping the architecture clear and extensible.

>OpenSCMS robustly implements the main workflows:

• Enrollment Certificate Provisioning End entities obtain enrollment (or successor Enrollment) certificates from an Enrollment Certificate Authority (ECA) to establish trust for secure SCMS communication;
• Authorization Certificate Provisioning: Enrolled entities request certificates for V2X applications through the Registration Authority (RA), fulfilled through coordinated interaction with the Authorization Certificate Authority (ACA) and Linkage Authorities to ensure no single party can associate certificates with specific devices.

OpenSCMS prioritizes component isolation and independent scalability. It leverages a message-driven architecture where certificate requests are optimized through message queues, effectively decoupling service interactions from core processing. The backend is primarily written in Rust, ensuring memory safety, robust concurrency, and high performance.

The Rust components interface with a low-level C libraries to deliver high-performance cryptographic operations with minimal overhead. The oscms-codecs-bridge, implements the critical cryptographic and protocol logic, including IEEE 1609.2.1 SPDU/ASN.1 encoding/decoding, signature verification, encryption/decryption operations, request/response handling, and the IEEE 1609.2.1 certificates issuance.

Most notably, the oscms-codecs-bridge library is codec-agnostic: it abstracts the ASN.1 toolchain behind a clean API, reducing dependency on proprietary tooling and improving auditability and portability. The API and codecs abstraction provided can also be used independently of the Rust backend.

By providing an open, extensible, and tested SCMS platform, OpenSCMS supports faster industrial prototyping and enables academic experimentation , while also serving as a practical reference backend for V2X client testing.