IETF logoThe JOSE and COSE HPKE specs, “Use of Hybrid Public Key Encryption (HPKE) with JSON Web Encryption (JWE)” and “Use of Hybrid Public-Key Encryption (HPKE) with CBOR Object Signing and Encryption (COSE)” are continuing to progress towards completion.

The JOSE HPKE spec successfully completed its second working group last call (WGLC) in February 2026, received its shepherd review in March 2026, received a review from Area Director Deb Cooley in May 2026, successfully completed IETF last call in May 2026, completed IANA designated expert review in May 2026, was reviewed by the IESG in June 2026, and was approved on an IESG telechat in July 2026. This week, based on IETF last call feedback and with the support of Area Director Deb Cooley, the two key encryption algorithms using ChaCha20/Poly1305 were removed. The rationale for why these algorithms didn’t make sense in JOSE was that JOSE doesn’t have a ChaCha20/Poly1305 content encryption algorithm registered; so the Key Encryption algorithms removed would have encrypted the key with ChaCha20/Poly1305 but content would have had to be encrypted with AES. Assuming this new WGLC succeeds, the spec should progress to the RFC Editor shortly.

The COSE HPKE spec also successfully completed its second working group last call (WGLC) in February 2026, received its shepherd review in April 2026, and received a review by Area Director Chris Inacio in June 2026 which was addressed in July 2026. I believe the next step for this specification is IETF last call.

I’ll note that both specifications have a normative dependency on “Hybrid Public Key Encryption”, which will replace the original Hybrid Public Key Encryption specification RFC 9180 when it becomes an RFC. This creates the risk that this specification will progress more slowly than the JOSE and COSE HPKE specifications, which would block their progress at the RFC Editor until it catches up. Worst comes to worst, both the JOSE and COSE HPKE specifications could be updated to depend upon RFC 9180 instead if its replacement progresses too slowly.

I expect more progress on these specifications at IETF 126 in Vienna just over a week from now!