]> mesur.io

mprorock@mesur.io

Tradeverifyd

orie@or13.io

University of Applied Sciences Bonn-Rhein-Sieg

Germany hannes.tschofenig@gmx.net

Security CBOR Object Signing and Encryption JOSE COSE PQC FN-DSA This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in US NIST FIPS 206 (expected to be published in late 2026 early 2027). It does not define new cryptographic primitives; rather, it specifies how existing FN-DSA mechanisms are serialized for use in JOSE and COSE. This document registers signature algorithms for JOSE and COSE, specifically FN-DSA-512 and FN-DSA-1024. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for FFT (fast-Fourier transform) over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in US NIST FIPS 206 (expected to be published in late 2026 early 2027). FN-DSA (formerly known as Falcon) is a lattice-based digital signature scheme based on the GPV hash-and-sign framework , instantiated over NTRU lattices with fast Fourier sampling techniques . The core hard problem underlying FN-DSA is the SIS (Short Integer Solution) problem over NTRU lattices. FN-DSA (formerly known as Falcon) is a digital signature algorithm based on lattice mathematics. It follows the hash-and-sign design introduced by Gentry, Peikert, and Vaikuntanathan . FN-DSA operates on NTRU lattices and uses fast Fourier techniques to make signature generation compact and efficient. The security of the scheme relies on the hardness of solving certain lattice problems, in particular the Short Integer Solution (SIS) problem. FN-DSA offers:

• Post-quantum security under the assumption that NTRU-SIS remains hard.
• Compactness in key and signature size.
• Efficient operations (roughly O(n log n)).
• A requirement for careful implementation to avoid side-channel leakage (notably Gaussian sampling must be constant-time where applicable).

The sizes of public key, private key, and signature for the parameter sets are the same as in the original Falcon specification:

Parameter Set	Signature size (bytes)	Public Key size (bytes)	Private Key size (bytes)
FN-DSA-512	666	897	1281
FN-DSA-1024	1280	1793	2305

For a detailed comparison of FN-DSA with ML-DSA and SLH-DSA see . This document defines how FN-DSA is used with JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) .

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The FN-DSA Algorithm Family The FN-DSA Signature Scheme is parameterized to support different security levels. This document introduces the registration of the following algorithms in : JOSE Algorithms for FN-DSA

Name	alg	Description
FN-DSA-512	FN-DSA-512	FN-DSA with parameter set 512
FN-DSA-1024	FN-DSA-1024	FN-DSA with parameter set 1024

This document introduces the registration of the following algorithms in : COSE Algorithms for FN-DSA

Name	alg	Description
FN-DSA-512	TBD1 (-54)	CBOR Object Signing Algorithm for FALCON512
FN-DSA-1024	TBD2 (-55)	CBOR Object Signing Algorithm for FALCON1024

FN-DSA Keys The FN-DSA Algorithm Family uses the Algorithm Key Pair (AKP) key type, as defined in . The specific algorithms for FN-DSA, such as FALCON512 and FALCON1024, are defined in this document and are used in the alg value of an AKP key representation to specify the corresponding algorithm. Thumbprints for FN-DSA keys are computed according to the process described in .

Security Considerations The security considerations of , and apply to this specification as well. A detailed security analysis of FN-DSA is beyond the scope of this specification; see for additional details. All the usual caveats for PQC and side-channel resistance apply.

• Implementations MUST ensure that alg matches the intended algorithm variant.
• Private implementations of sampling (Gaussian, etc.) must be constant-time to prevent leakage.
• Public keys SHOULD be validated before use (e.g., against encoding constraints).
• Nonces, random values, blinding factors (if used) MUST originate from a secure source of randomness.

Validating Public Keys TODO

Side-Channel Attacks Implementers should follow best practices to mitigate timing, cache, and power side channels, such as:

• Using constant-time arithmetic
• Maintaining uniform memory access patterns
• Avoiding data-dependent branching or memory indexing

Randomness Considerations All required randomness (e.g. for signature generation) MUST be derived from a cryptographically secure, high-entropy source.

IANA Considerations

New COSE Algorithms IANA is requested to add the following entries to the COSE Algorithms Registry. The following completed registration templates are provided as described in and .

FN-DSA-512

• Name: FN-DSA-512
• Value: TBD1 (requested assignment -54)
• Description: CBOR Object Signing Algorithm for FALCON512
• Capabilities: [kty]
• Change Controller: IETF
• Reference: RFC XXXX
• Recommended: Yes

FN-DSA-1024

• Name: FN-DSA-1024
• Value: TBD2 (requested assignment -55)
• Description: CBOR Object Signing Algorithm for FALCON1024
• Capabilities: [kty]
• Change Controller: IETF
• Reference: RFC XXXX
• Recommended: Yes

New JOSE Algorithms IANA is requested to add the following entries to the JSON Web Signature and Encryption Algorithms Registry. The following completed registration templates are provided as described in .

FN-DSA-512

• Algorithm Name: FN-DSA-512
• Algorithm Description: FN-DSA-512 as described in US NIST FIPS 206.
• Algorithm Usage Location(s): alg
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Specification Document(s): RFC XXXX
• Algorithm Analysis Documents(s):

FN-DSA-1024

• Algorithm Name: FN-DSA-1024
• Algorithm Description: FN-DSA-1024 as described in US NIST FIPS 206.
• Algorithm Usage Location(s): alg
• JOSE Implementation Requirements: Optional
• Change Controller: IETF
• Specification Document(s): RFC XXXX
• Algorithm Analysis Documents(s):

References Normative References JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and an IANA registry defined by that specification. Related encryption capabilities are described in the separate JSON Web Encryption (JWE) specification. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. This specification also defines a JWK Set JSON data structure that represents a set of JWKs. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and IANA registries established by that specification. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. This document, along with RFC 9053, obsoletes RFC 8152. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol (RFC 9052). This document, along with RFC 9052, obsoletes RFC 8152. The CBOR Object Signing and Encryption (COSE) syntax (see RFC 9052) does not define any direct methods for using hash algorithms. There are, however, circumstances where hash algorithms are used, such as indirect signatures, where the hash of one or more contents are signed, and identification of an X.509 certificate or other object by the use of a fingerprint. This document defines hash algorithms that are identified by COSE algorithm identifiers. This specification registers cryptographic algorithms and identifiers to be used with the JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Key (JWK) specifications. It defines several IANA registries for these identifiers. Tradeverifyd Tradeverifyd This document describes JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for Module- Lattice-Based Digital Signature Standard (ML-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in FIPS 204. n.d. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Informative References IANA IANA Nokia Nokia Nokia DigiCert Entrust Limited The advent of a cryptographically relevant quantum computer (CRQC) would render state-of-the-art, traditional public key algorithms deployed today obsolete, as the mathematical assumptions underpinning their security would no longer hold. To address this, protocols and infrastructure must transition to post-quantum algorithms, which are designed to resist both traditional and quantum attacks. This document explains why engineers need to be aware of and understand post-quantum cryptography (PQC), detailing the impact of CRQCs on existing systems and the challenges involved in transitioning to post-quantum algorithms. Unlike previous cryptographic updates, this shift may require significant protocol redesign due to the unique properties of post-quantum algorithms. n.d. n.d.

Examples

JOSE

Key Pair

Example FN-DSA-512 Private JSON Web Key

Example FN-DSA-512 Public JSON Web Key

JSON Web Signature

Example FN-DSA-512 Decoded Protected Header for a JSON Web Signature

COSE

Key Pair

Example FN-DSA-512 Private COSE Key

Example FN-DSA-512 Public COSE Key

COSE Sign1

Example FN-DSA-512 COSE Sign1 >, / unprotected / {}, / payload / h'66616b65', / signature / h'53e855e8...0f263549' ]) ]]>

Document History -02

• Converted to markdown
• Applied feedback from IESG Evaluation on ML-DSA
• Revised references
• Revised abstract

-01

• Added Acknowledgements
• Added Document History
• Updated test vectors

Acknowledgments We would like to especially thank David Balenson for careful review of approaches taken in this document. We would also like to thank Michael B. Jones for guidance in authoring.

Contributors Google

rafaelmisoczki@google.com

IBM

osb@zurich.ibm.com

NXP

christine.cloostermans@nxp.com