]> mesur.io

mprorock@mesur.io

Transmute

orie@transmute.industries

Google

rafaelmisoczki@google.com

IBM

osb@zurich.ibm.com

NXP

christine.cloostermans@nxp.com

Security CBOR Object Signing and Encryption JOSE COSE PQC DILITHIUM ML-DSA This document describes JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for Module-Lattice-Based Digital Signature Standard (ML-DSA), which was derived from Dilithium, a Post-Quantum Cryptography (PQC) based digital signature scheme. This document does not define any new cryptography, only seralizations of existing cryptographic systems described in . Note to RFC Editor: This document should not proceed to AUTH48 until NIST completes paramater tuning and selection as a part of the PQC standardization process. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction This document describes how to use ML-DSA keys and signatures as described in with JOSE and COSE. To reduce implementation burden, the key type and thumbprint computations for ML-DSA are generic, and suitable for use with other algorithms such as SLH-DSA as described in .

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

ML-DSA Algorithms The ML-DSA Signature Scheme is paramaterized to support different security levels. This document requests the registration of the following algorithms in : JOSE algorithms for ML-DSA

Name	alg	Description
ML-DSA-44	ML-DSA-44	JSON Web Signature Algorithm for ML-DSA-44
ML-DSA-65	ML-DSA-65	JSON Web Signature Algorithm for ML-DSA-65
ML-DSA-87	ML-DSA-87	JSON Web Signature Algorithm for ML-DSA-87

This document requests the registration of the following algorithms in : COSE algorithms for ML-DSA

Name	alg	Description
ML-DSA-44	TBD (requested assignment -48)	CBOR Object Signing Algorithm for ML-DSA-44
ML-DSA-65	TBD (requested assignment -49)	CBOR Object Signing Algorithm for ML-DSA-65
ML-DSA-87	TBD (requested assignment -50)	CBOR Object Signing Algorithm for ML-DSA-87

Algorithm Key Pair Type The Algorithm Key Pair (AKP) Type is used to express Public and Private Keys for use with Algorithms. When this key type is used the "alg" JSON Web Key Parameter or COSE Key Common Parameter is REQUIRED. This document requests the registration of the following key types in : Algorithm Key Pair Type for JOSE

Name	kty	Description
Algorithm Key Pair	AKP	JSON Web Key Type for the Algorithm Key Pair.

The all zeros ML-DSA-44 JSON Web Key

This document requests the registration of the following algorithms in : Algorithm Key Pair Type for COSE

Name	kty	Description
AKP	TBD (requested assignment 7)	COSE Key Type for the Algorithm Key Pair.

The all zeros ML-DSA-44 COSE Key

ML-DSA Private Keys Note that FIPS 204 defines 2 expressions for private keys, a seed, and a private key that is expanded from the seed. For the algorithms defined in this document, the private key is always the seed, and never the expanded expression. The AKP Key Type MAY be used with algorithms not defined in this specification, and those algorithms MAY encode their private keys differently.

AKP Thumbprints When computing the COSE Key Thumbprint as described in , the required parameters for algorithm key pairs are:

• "kty" (label: 1, data type: int, value: 7)
• "alg" (label: 3, data type: int, value: int)
• "pub" (label: -1, value: bstr)

The COSE Key Thumbprint is produced according to the process described in . When computing the JWK Thumbprint as described in , the required parameters for algorithm key pairs are:

• "kty"
• "alg"
• "pub"

Their lexicographic order, per , is:

• "alg"
• "kty"
• "pub"

The JWK Key Thumbprint is produced according to the process described in . See the kid values in the JSON Web Key and COSE Key examples in the appendix for examples of AKP thumbprints.

Security Considerations The security considerations of , and applies to this specification as well. A detailed security analysis of ML-DSA is beyond the scope of this specification, see for additional details.

IANA Considerations

Additions to Existing Registries

New COSE Algorithms IANA is requested to add the following entries to the COSE Algorithms Registry. The following completed registration templates are provided as described in RFC9053 and RFC9054.

ML-DSA-44

• Name: ML-DSA-44
• Value: TBD (requested assignment -48)
• Description: CBOR Object Signing Algorithm for ML-DSA-44
• Capabilities: [kty]
• Reference: RFC XXXX
• Recommended: Yes

ML-DSA-65

• Name: ML-DSA-65
• Value: TBD (requested assignment -49)
• Description: CBOR Object Signing Algorithm for ML-DSA-65
• Capabilities: [kty]
• Reference: RFC XXXX
• Recommended: Yes

ML-DSA-87

• Name: ML-DSA-87
• Value: TBD (requested assignment -50)
• Description: CBOR Object Signing Algorithm for ML-DSA-87
• Capabilities: [kty]
• Reference: RFC XXXX
• Recommended: Yes

New COSE Key Types IANA is requested to add the following entries to the COSE Key Types Registry. The following completed registration templates are provided as described in RFC9053.

AKP

• Name: AKP
• Value: TBD (requested assignment 7)
• Description: COSE Key Type for Algorithm Key Pairs
• Capabilities: [kty(7)]
• Reference: RFC XXXX

New COSE Key Type Parameters IANA is requested to add the following entries to the COSE Key Type Parameters. The following completed registration templates are provided as described in RFC9053.

ML-DSA Public Key

• Key Type: TBD (requested assignment 7)
• Name: public_key
• Label: -1
• CBOR Type: bstr
• Description: Public key
• Reference: RFC XXXX

ML-DSA Private Key

• Key Type: TBD (requested assignment 7)
• Name: private_key
• Label: -2
• CBOR Type: bstr
• Description: Private key or seed used to derive a private key.
• Reference: RFC XXXX

New JOSE Algorithms IANA is requested to add the following entries to the JSON Web Signature and Encryption Algorithms Registry. The following completed registration templates are provided as described in RFC7518.

ML-DSA-44

• Algorithm Name: ML-DSA-44
• Algorithm Description: ML-DSA-44 as described in FIPS 204.
• Algorithm Usage Location(s): alg
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Value registry: Algorithms
• Specification Document(s): RFC XXXX
• Algorithm Analysis Documents(s):

ML-DSA-65

• Algorithm Name: ML-DSA-65
• Algorithm Description: ML-DSA-65 as described in FIPS 204.
• Algorithm Usage Location(s): alg
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Value registry: Algorithms
• Specification Document(s): RFC XXXX
• Algorithm Analysis Documents(s):

ML-DSA-87

• Algorithm Name: ML-DSA-87
• Algorithm Description: ML-DSA-87 as described in FIPS 204.
• Algorithm Usage Location(s): alg
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Value registry: Algorithms
• Specification Document(s): RFC XXXX
• Algorithm Analysis Documents(s):

New JOSE Key Types IANA is requested to add the following entries to the JSON Web Key Types Registry. The following completed registration templates are provided as described in RFC7518 RFC7638.

AKP

• "kty" Parameter Value: AKP
• Key Type Description: Algorithm Key Pair
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Specification Document(s): RFC XXXX

New JSON Web Key Parameters IANA is requested to add the following entries to the JSON Web Key Parameters Registry. The following completed registration templates are provided as described in RFC7517, and RFC7638.

AKP Public Key

• Parameter Name: pub
• Parameter Description: Public key
• Used with "kty" Value(s): AKP
• Parameter Information Class: Public
• Change Controller: IETF
• Specification Document(s): RFC XXXX

AKP Private Key

• Parameter Name: priv
• Parameter Description: Private key or seed used to derive a private key.
• Used with "kty" Value(s): AKP
• Parameter Information Class: Private
• Change Controller: IETF
• Specification Document(s): RFC XXXX

References Normative References IANA IANA JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and an IANA registry defined by that specification. Related encryption capabilities are described in the separate JSON Web Encryption (JWE) specification. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. This specification also defines a JWK Set JSON data structure that represents a set of JWKs. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and IANA registries established by that specification. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol (RFC 9052). This document, along with RFC 9052, obsoletes RFC 8152. This specification defines a method for computing a hash value over a JSON Web Key (JWK). It defines which fields in a JWK are used in the hash computation, the method of creating a canonical form for those fields, and how to convert the resulting Unicode string into a byte sequence to be hashed. The resulting hash value can be used for identifying or selecting the key represented by the JWK that is the subject of the thumbprint. mesur.io Transmute Google IBM NXP This document describes JOSE and COSE serializations for SLH-DSA, which was derived from SPHINCS+, a Post-Quantum Cryptography (PQC) based digital signature scheme. This document does not define any new cryptography, only seralizations of existing cryptographic systems described in [FIPS-205]. Note to RFC Editor: This document should not proceed to AUTH48 until NIST completes paramater tuning and selection as a part of the PQC (https://csrc.nist.gov/projects/post-quantum-cryptography) standardization process. SECOM CO., LTD. University of Applied Sciences Bonn-Rhein-Sieg Transmute This specification defines a method for computing a hash value over a CBOR Object Signing and Encryption (COSE) Key. It specifies which fields within the COSE Key structure are included in the cryptographic hash computation, the process for creating a canonical representation of these fields, and how to hash the resulting byte sequence. The resulting hash value, referred to as a "thumbprint," can be used to identify or select the corresponding key. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Informative References n.d. n.d.

Examples

JOSE

ML_DSA_44

ML_DSA_65

ML_DSA_87

COSE

ML_DSA_44

ML_DSA_65

ML_DSA_87

Acknowledgments We would like to thank Simo Sorce, Ilari Liusvaara, Neil Madden, Anders Rundgren, David Waite, and Russ Housley for their review feedback.