Tsinghua University

Beijing 100084 China dangfan@tsinghua.edu.cn

Security WebAuthn Working Group Cryptography Digital Signature Internet-Draft This specification defines algorithm encodings and representations enabling the ISO/IEC 14888-3:2018 elliptic curve "SM2" to be used for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) messages.

This specification defines algorithm encodings and representations enabling the ISO/IEC 14888-3:2018 elliptic curve "SM2" to be used for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) messages. The elliptic curve and associated algorithm are registered in appropriate IANA JOSE and COSE registries.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The ISO/IEC 14888-3:2018 elliptic curve "SM2" is represented in a JSON Web Key (JWK) using these values: kty: EC crv: SM2 plus x and y values to represent the curve point for the key. Other optional values such as alg MAY also be present. It is represented in a COSE_Key using these values: kty (1): EC2 (2) crv (-1): SM2 (TBD - requested assignment 9) plus x (-2) and y (-3) values to represent the curve point for the key. Other optional values such as alg (3) MAY also be present.

The ECDSA signature algorithm is defined in . Implementations need to check that the key type is EC for JOSE or EC2 (2) for COSE when creating or verifying a signature. The ECDSA algorithm specified in this document is: JOSE Alg Name COSE Alg Value Description SM2 TBD (requested assignment -48) ECDSA w/ SM2 Curve

This section registers the following value in the IANA "JSON Web Key Elliptic Curve" registry . Curve Name: curveSM2 Curve Description: SM2 Curve JOSE Implementation Requirements: Optional Change Controller: IESG Specification Document(s): of [[ this specification ]]

This section registers the following value in the IANA "JSON Web Signature and Encryption Algorithms" registry . Algorithm Name: SM2 Algorithm Description: ECDSA w/ SM2 Curve Algorithm Usage Locations: alg JOSE Implementation Requirements: Optional Change Controller: IESG Reference: of [[ this specification ]] Algorithm Analysis Document(s):

This section registers the following value in the IANA "COSE Elliptic Curves" registry . Name: curveSM2 Value: TBD (requested assignment 9) Key Type: EC2 Description: SM2 Curve Change Controller: IESG Reference: of [[ this specification ]] Recommended: Yes

This section registers the following value in the IANA "COSE Algorithms" registry . Name: SM2 Value: TBD (requested assignment -48) Description: ECDSA w/ SM2 Curve Reference: of this document Recommended: Yes

The procedures and security considerations described in the specifications apply to implementations of this specification.

International Organization for Standardization IANA IANA IANA IANA

[[ to be removed by the RFC Editor before publication as an RFC ]] -00 Initial version.