]> Yubico

Gävlegatan 22 Stockholm SE emil@emlun.se

Self-Issued Consulting

United States michael_b_jones@hotmail.com https://self-issued.info/

Security COSE COSE Signing Algorithms Split algorithms Split signing This specification defines COSE algorithm identifiers used when one signing operation is split between two cooperating parties. When performing split signing, the first party typically hashes the data to be signed and the second party signs the hashed data computed by the first party. This can be useful when communication with the party holding the signing private key occurs over a limited-bandwidth channel, such as NFC or Bluetooth Low Energy (BLE), in which it is infeasible to send the complete set of data to be signed. The resulting signatures are identical in structure to those computed by a single party, and can be verified using the same verification algorithm without additional steps to preprocess the signed data. About This Document Status information for this document may be found at . Discussion of this document takes place on the COSE Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction CBOR Object Signing and Encryption (COSE) algorithm identifiers are used to specify the cryptographic operations used to create cryptographic data structures, but do not record internal details of how the cryptography was performed, since those details are typically irrelevant for the recipient. The algorithm identifiers defined by this specification facilitate splitting a signing operation between two cooperating parties, by specifying the division of responsibilities between the two parties. The resulting signature can be verified by the same verification algorithm as if it had been created by a single party, so this division of responsibilities is an implementation detail of the signer. Verifiers therefore do not use these split algorithm identifiers, and instead use the corresponding non-split algorithm identifier which identifies the same verification algorithm as the split algorithm identifier would. A primary use case for this is splitting a signature operation between a software application and a discrete hardware security module (HSM) holding the private key. In particular, since the data link between them may have limited bandwidth, it may not be practical to send the entire original message to the HSM. Instead, since most signature algorithms begin with digesting the message into a fixed-length intermediate input, this initial digest can be computed by the software application while the HSM computes the rest of the signature algorithm on the digest. Since different signature algorithms digest the message in different ways and at different stages of the algorithm, there is no one generally-applicable way to define such a division point for every possible signature algorithm. Therefore, this specification defines algorithm identifiers encoding, for a specific set of signature algorithms, which steps of the signature algorithm are performed by the digester (e.g., software application) and which are performed by the signer (e.g., HSM). In general, the signer holds exclusive control of the signing private key. Note that these algorithm identifiers do not define new "pre-hashed" variants of the base signature algorithm, nor an intermediate "hash envelope" data structure, such as that defined in . Rather, these identifiers correspond to existing signature algorithms that would typically be executed by a single party, but split into two stages. The resulting signatures are identical to those computed by a single party, and can be verified using the same verification algorithms without additional special steps to process the signed data. However some signature algorithms, such as PureEdDSA , cannot be split in this way and therefore cannot be assigned split signing algorithm identifiers. However, if such a signature algorithm defines a "pre-hashed" variant, such as Ed25519ph , that "pre-hashed" algorithm can also be assigned a split signing algorithm identifier, enabling the hashing step to be performed by the digester and the signing step to be executed by the signer.

Requirements Notation and Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 RFC2119 when, and only when, they appear in all capitals, as shown here.

Split Signing Algorithms This section defines divisions of signing algorithm steps between a digester and a signer in a split signing protocol, and assigns algorithm identifiers to these algorithm divisions. The digester performs the first part of the split algorithm and does not have access to the signing private key, while the signer performs the second part of the split algorithm and has access to the signing private key. For signing algorithms that format the message to insert domain separation tags, as described in , this message formatting is also performed by the signer. The algorithm identifiers defined in this specification MAY appear in COSE structures used internally between the digester and the signer in a split signing protocol, but SHOULD NOT appear in COSE structures consumed by signature verifiers. COSE structures consumed by signature verifiers SHOULD instead use the corresponding conventional algorithm identifiers for the verification algorithm. These are listed in the "Verification algorithm" column in the tables defining split signing algorithm identifiers.

ECDSA ECDSA split signing uses the following division between the digester and the signer of the steps of the ECDSA signature generation algorithm :

• The signing procedure is defined in Section 6.4.1 of .
• The digester performs Step 1 of the signing procedure - hashing the message, producing the value H.
• The message input to the signer is the value H defined in the signing procedure.
• The signer resumes the signing procedure from Step 2.

The following algorithm identifiers are defined:

Name	COSE Value	Verification algorithm	Description
ESP256-split	TBD	ESP256	ESP256 split signing as defined here
ESP384-split	TBD	ESP384	ESP384 split signing as defined here
ESP512-split	TBD	ESP512	ESP512 split signing as defined here

Note: This is distinct from the similarly named Split-ECDSA (SECDSA) , although SECDSA can be implemented using this split procedure as a component.

HashEdDSA Split HashEdDSA uses the following division between the digester and the signer of the steps of the HashEdDSA signing algorithm :

• HashEdDSA is a combination of the EdDSA signing procedure and the PureEdDSA signing procedure. The EdDSA signing procedure is defined in the first paragraph of . The PureEdDSA signing procedure is defined in the second paragraph of .
• The digester computes the value PH(M) defined in the EdDSA signing procedure.
• The message input to the signer is the value PH(M) defined in the EdDSA signing procedure. This value is represented as M in the PureEdDSA signing procedure.
• The signer executes the PureEdDSA signing procedure, where the value denoted M in the PureEdDSA signing procedure takes the value denoted PH(M) in the EdDSA signing procedure.

PureEdDSA cannot be divided in this way since such a division would require that the digester has access to the private key. The following algorithm identifiers are defined:

Name	COSE Value	Verification algorithm	Description
Ed25519ph-split	TBD	Ed25519ph	Ed25519ph split signing as defined here (NOTE: Ed25519ph not yet registered)
Ed448ph-split	TBD	Ed448ph	Ed448ph split signing as defined here (NOTE: Ed448ph not yet registered)

COSE Signing Arguments While many signature algorithms take the private key and data to be signed as the only two parameters, some signature algorithms have additional parameters that must also be set. For example, to sign using a key derived by ARKG , two additional arguments kh and info are needed in ARKG-Derive-Private-Key to derive the signing private key. While such additional arguments are simple to provide to the API of the signing procedure in a single-party context, in a split signing context these additional arguments also need to be conveyed from the digester to the signer. For this purpose, we define a new COSE structure COSE_Sign_Args for "COSE signing arguments". This enables defining a unified, algorithm-agnostic protocol between the digester and the signer, rather than requiring a distinct protocol for each signature algorithm for the sake of conveying algorithm-specific parameters. COSE_Sign_Args is built on a CBOR map. The set of common parameters that can appear in a COSE_Sign_Args can be found in the IANA "COSE Signing Arguments Common Parameters" registry (TODO). Additional parameters defined for specific signing algorithms can be found in the IANA "COSE Signing Arguments Algorithm Parameters" registry (TODO). The CDDL grammar describing COSE_Sign_Args, using the CDDL fragment defined in , is: tstr / int, ; alg * label => values, } ]]>

COSE Signing Arguments Common Parameters This document defines a set of common parameters for a COSE Signing Arguments object. provides a summary of the parameters defined in this section. Common parameters of the COSE_Sign_Args structure.

Name	Label	CBOR Type	Value Registry	Description
alg	3	tstr / int	COSE Algorithms	Signing algorithm to use

• alg: This parameter identifies the signing algorithm the additional arguments apply to. The signer MUST verify that this algorithm matches any key usage restrictions set on the key to be used. If the algorithms do not match, then the signature operation MUST be aborted with an error.

Definitions of COSE algorithms MAY define additional algorithm-specific parameters for COSE_Sign_Args. The following CDDL example conveys additional arguments for signing data using the ESP256-split algorithm (see ) and a key derived using ARKG-P256 :

IANA Considerations

COSE Algorithms Registrations This section registers the following values in the IANA "COSE Algorithms" registry :

• Name: ESP256-split
  • Value: TBD (Requested Assignment -300)
  • Description: ESP256 split signing
  • Capabilities: [kty]
  • Change Controller: IETF
  • Reference: of this specification
  • Recommended: Yes
• Name: ESP384-split
  • Value: TBD (Requested Assignment -301)
  • Description: ESP384 split signing
  • Capabilities: [kty]
  • Change Controller: IETF
  • Reference: of this specification
  • Recommended: Yes
• Name: ESP512-split
  • Value: TBD (Requested Assignment -302)
  • Description: ESP512 split signing
  • Capabilities: [kty]
  • Change Controller: IETF
  • Reference: of this specification
  • Recommended: Yes
• Name: Ed25519ph-split
  • Value: TBD (Requested Assignment -303)
  • Description: Ed25519ph split signing
  • Capabilities: [kty]
  • Change Controller: IETF
  • Reference: of this specification
  • Recommended: Yes
• Name: Ed448ph-split
  • Value: TBD (Requested Assignment -304)
  • Description: Ed448ph split signing
  • Capabilities: [kty]
  • Change Controller: IETF
  • Reference: of this specification
  • Recommended: Yes

COSE Signing Arguments Common Parameters Registry TODO

COSE Signing Arguments Algorithm Parameters Registry TODO

References Normative References Yubico Yubico Asynchronous Remote Key Generation (ARKG) is an abstract algorithm that enables delegation of asymmetric public key generation without giving access to the corresponding private keys. This capability enables a variety of applications: a user agent can generate pseudonymous public keys to prevent tracking; a message sender can generate ephemeral recipient public keys to enhance forward secrecy; two paired authentication devices can each have their own private keys while each can register public keys on behalf of the other. This document provides three main contributions: a specification of the generic ARKG algorithm using abstract primitives; a set of formulae for instantiating the abstract primitives using concrete primitives; and an initial set of fully specified concrete ARKG instances. We expect that additional instances will be defined in the future. Self-Issued Consulting Transmute This specification refers to cryptographic algorithm identifiers that fully specify the cryptographic operations to be performed, including any curve, key derivation function (KDF), and hash functions, as being "fully specified". It refers to cryptographic algorithm identifiers that require additional information beyond the algorithm identifier to determine the cryptographic operations to be performed as being "polymorphic". This specification creates fully-specified algorithm identifiers for registered JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) polymorphic algorithm identifiers, enabling applications to use only fully-specified algorithm identifiers. It deprecates those polymorphic algorithm identifiers. This specification updates RFC 7518, RFC 8037, and RFC 9053. It deprecates polymorphic algorithms defined by RFC 8037 and RFC 9053 and provides fully-specified replacements for them. It adds to the instructions to designated experts in RFC 7518 and RFC 9053. IANA n.d. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document describes elliptic curve signature scheme Edwards-curve Digital Signature Algorithm (EdDSA). The algorithm is instantiated with recommended parameters for the edwards25519 and edwards448 curves. An example implementation and test vectors are provided. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document proposes a notational convention to express Concise Binary Object Representation (CBOR) data structures (RFC 7049). Its main goal is to provide an easy and unambiguous way to express structures for protocol messages and data formats that use CBOR or JSON. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. This document, along with RFC 9053, obsoletes RFC 8152. Certicom Research Informative References National Institute of Standards and Technology National Institute of Standards and Technology Transmute DataTrails Fraunhofer SIT This document defines new COSE header parameters for signaling a payload as an output of a hash function. This mechanism enables faster validation as access to the original payload is not required for signature validation. Additionally, hints of the detached payload's content format and availability are defined providing references to optional discovery mechanisms that can help to find original payload content. This document specifies a number of algorithms for encoding or hashing an arbitrary string to a point on an elliptic curve. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Document History -02

• Renamed document from "COSE Algorithms for Two-Party Signing" to "Split signing algorithms for COSE" and updated introduction and terminology accordingly.
• Dropped definitions for HashML-DSA, as split variants of ML-DSA are being actively discussed in other IETF groups.
• Changed "Base algorithm" heading in definition tables to "Verification algorithm".
• Remodeled COSE_Key_Ref as COSE_Sign_Args.
  • Dropped definitions of reference types for COSE Key Types registry.

-01

• Added IANA registration requests for algorithms defined.
• Updated references and other editorial tweaks.

-00

• Initial individual draft