FN-DSA for JOSE and COSE

]> FN-DSA for JOSE and COSE mesur.io

mprorock@mesur.io

Tradeverifyd

orie@or13.io

University of Applied Sciences Bonn-Rhein-Sieg

Germany hannes.tschofenig@gmx.net

Security CBOR Object Signing and Encryption JOSE COSE PQC FN-DSA This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in US NIST FIPS 206 (expected to be published in late 2026 early 2027). About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in US NIST FIPS 206 (expected to be published in late 2026 early 2027). See Section 11.3 of for a comparison of FN-DSA with ML-DSA and SLH-DSA .

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The FN-DSA Algorithm Family The FN-DSA Signature Scheme is parameterized to support different security levels. This document introduces the registration of the following algorithms in : JOSE Algorithms for FN-DSA

Name	alg	Description
FALCON512	FALCON512	Falcon with parameter set 512
FALCON1024	FALCON1024	Falcon with parameter set 1024

This document introduces the registration of the following algorithms in : COSE Algorithms for FN-DSA

Name	alg	Description
FALCON512	TBD1 (-54)	CBOR Object Signing Algorithm for FALCON512
FALCON1024	TBD2 (-55)	CBOR Object Signing Algorithm for FALCON1024

FN-DSA Keys The FN-DSA Algorithm Family uses the Algorithm Key Pair (AKP) key type, as defined in . The specific algorithms for FN-DSA, such as FALCON512 and FALCON1024, are defined in this document and are used in the alg value of an AKP key representation to specify the corresponding algorithm. Thumbprints for FN-DSA keys are computed according to the process described in .

Security Considerations The security considerations of , and apply to this specification as well. A detailed security analysis of FN-DSA is beyond the scope of this specification; see for additional details.

Validating Public Keys TODO

Side-Channel Attacks TODO

Randomness TODO

IANA Considerations

New COSE Algorithms IANA is requested to add the following entries to the COSE Algorithms Registry. The following completed registration templates are provided as described in and .

FALCON512

Name: FALCON512
Value: TBD1 (requested assignment -54)
Description: CBOR Object Signing Algorithm for FALCON512
Capabilities: [kty]
Change Controller: IETF
Reference: RFC XXXX
Recommended: Yes

FALCON1024

Name: FALCON1024
Value: TBD2 (requested assignment -55)
Description: CBOR Object Signing Algorithm for FALCON1024
Capabilities: [kty]
Change Controller: IETF
Reference: RFC XXXX
Recommended: Yes

New JOSE Algorithms IANA is requested to add the following entries to the JSON Web Signature and Encryption Algorithms Registry. The following completed registration templates are provided as described in .

FALCON512

Algorithm Name: FALCON512
Algorithm Description: FALCON512 as described in US NIST FIPS 206.
Algorithm Usage Location(s): alg
JOSE Implementation Requirements: Optional
Change Controller: IETF
Specification Document(s): RFC XXXX
Algorithm Analysis Documents(s):

FALCON1024

Algorithm Name: FALCON1024
Algorithm Description: FALCON1024 as described in US NIST FIPS 206.
Algorithm Usage Location(s): alg
JOSE Implementation Requirements: Optional
Change Controller: IETF
Specification Document(s): RFC XXXX
Algorithm Analysis Documents(s):

References Normative References JSON Web Signature (JWS) JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and an IANA registry defined by that specification. Related encryption capabilities are described in the separate JSON Web Encryption (JWE) specification. JSON Web Key (JWK) A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. This specification also defines a JWK Set JSON data structure that represents a set of JWKs. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and IANA registries established by that specification. CBOR Object Signing and Encryption (COSE): Initial Algorithms Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol (RFC 9052). This document, along with RFC 9052, obsoletes RFC 8152. CBOR Object Signing and Encryption (COSE): Hash Algorithms The CBOR Object Signing and Encryption (COSE) syntax (see RFC 9052) does not define any direct methods for using hash algorithms. There are, however, circumstances where hash algorithms are used, such as indirect signatures, where the hash of one or more contents are signed, and identification of an X.509 certificate or other object by the use of a fingerprint. This document defines hash algorithms that are identified by COSE algorithm identifiers. JSON Web Algorithms (JWA) This specification registers cryptographic algorithms and identifiers to be used with the JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Key (JWK) specifications. It defines several IANA registries for these identifiers. ML-DSA for JOSE and COSE Tradeverifyd Tradeverifyd This document describes JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for Module- Lattice-Based Digital Signature Standard (ML-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in FIPS 204. Fast Fourier Transform over NTRU-Lattice-Based Digital Signature Algorithm n.d. Key words for use in RFCs to Indicate Requirement Levels In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Informative References JSON Object Signing and Encryption (JOSE) IANA CBOR Object Signing and Encryption (COSE) IANA Post-Quantum Cryptography for Engineers Nokia Nokia Nokia DigiCert Entrust Limited The advent of a cryptographically relevant quantum computer (CRQC) would render state-of-the-art, traditional public key algorithms deployed today obsolete, as the mathematical assumptions underpinning their security would no longer hold. To address this, protocols and infrastructure must transition to post-quantum algorithms, which are designed to resist both traditional and quantum attacks. This document explains why engineers need to be aware of and understand post-quantum cryptography (PQC), detailing the impact of CRQCs on existing systems and the challenges involved in transitioning to post-quantum algorithms. Unlike previous cryptographic updates, this shift may require significant protocol redesign due to the unique properties of post-quantum algorithms. Module-Lattice-Based Digital Signature Standard n.d. Stateless Hash-Based Digital Signature Standard n.d.

Examples

JOSE

Key Pair

Example FALCON512 Private JSON Web Key

Example FALCON512 Public JSON Web Key

JSON Web Signature

Example FALCON512 Decoded Protected Header for a JSON Web Signature

COSE

Key Pair

Example FALCON512 Private COSE Key

Example FALCON512 Public COSE Key

COSE Sign1

Example FALCON512 COSE Sign1 >, / unprotected / {}, / payload / h'66616b65', / signature / h'53e855e8...0f263549' ]) ]]>

Document History -02

Converted to markdown
Applied feedback from IESG Evaluation on ML-DSA
Revised references
Revised abstract

-01

Added Acknowledgements
Added Document History
Updated test vectors

Acknowledgments We would like to especially thank David Balenson for careful review of approaches taken in this document. We would also like to thank Michael B. Jones for guidance in authoring.

Contributors Google

rafaelmisoczki@google.com

IBM

osb@zurich.ibm.com

NXP

christine.cloostermans@nxp.com