{"id":2762,"date":"2025-10-30T15:00:39","date_gmt":"2025-10-30T22:00:39","guid":{"rendered":"https:\/\/self-issued.info\/?p=2762"},"modified":"2025-10-30T15:00:39","modified_gmt":"2025-10-30T22:00:39","slug":"fully-specified-algorithms-for-jose-and-cose-is-now-rfc-9864","status":"publish","type":"post","link":"https:\/\/self-issued.info\/?p=2762","title":{"rendered":"Fully-Specified Algorithms for JOSE and COSE is now RFC 9864"},"content":{"rendered":"<p><span class=\"plain\"><img decoding=\"async\" align=\"right\" src=\"https:\/\/self-issued.info\/images\/ietf-logo.png\" alt=\"IETF logo\" \/>The &#8220;Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)&#8221; specification has been published as <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc9864.html\">RFC 9864<\/a>!  I believe that this is the first RFC I&#8217;ve worked on that started its journey as <a href=\"https:\/\/datatracker.ietf.org\/meeting\/117\/materials\/slides-117-jose-fully-specified-algorithms-for-jose-and-cose-00\">a presentation of an idea to the working group<\/a> without an accompanying draft.  The idea was well received by the <a href=\"https:\/\/datatracker.ietf.org\/wg\/jose\/about\/\">JOSE Working Group<\/a> at <a href=\"https:\/\/datatracker.ietf.org\/meeting\/117\/proceedings\/\">IETF 117<\/a> in July 2023 and so <a href=\"https:\/\/www.linkedin.com\/in\/or13b\/\">Orie Steele<\/a> and I took the next step of writing a draft.  The work was done in close coordination with the <a href=\"https:\/\/datatracker.ietf.org\/wg\/cose\/about\/\">COSE Working Group<\/a>.<\/p>\n<p>The abstract from the RFC describes its contributions as follows:<\/p>\n<blockquote><p>\nThis specification refers to cryptographic algorithm identifiers that fully specify the cryptographic operations to be performed, including any curve, key derivation function (KDF), and hash functions, as being &#8220;fully specified&#8221;. It refers to cryptographic algorithm identifiers that require additional information beyond the algorithm identifier to determine the cryptographic operations to be performed as being &#8220;polymorphic&#8221;. This specification creates fully-specified algorithm identifiers for registered JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) polymorphic algorithm identifiers, enabling applications to use only fully-specified algorithm identifiers. It deprecates those polymorphic algorithm identifiers.<\/p>\n<p>This specification updates RFCs 7518, 8037, and 9053. It deprecates polymorphic algorithms defined by RFCs 8037 and 9053 and provides fully-specified replacements for them. It adds to the instructions to designated experts in RFCs 7518 and 9053.\n<\/p><\/blockquote>\n<p>This is one that the world has been wanting and waiting for!  There are already normative references to it both from IETF specs and also W3C, FIDO Alliance, and OpenID Foundation specifications.<\/p>\n<p>I&#8217;m particularly proud of this one because it not only fixes the real and present problem of polymorphic algorithm identifiers that has plagued implementations and systems; it also ensures that the problem cannot recur, by mandating that only fully-specified algorithm identifiers can henceforth be registered.  In my view, this one makes the world better.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The &#8220;Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)&#8221; specification has been published as RFC 9864! I believe that this is the first RFC I&#8217;ve worked on that started its journey as a presentation of an idea to the working group without an accompanying draft. The idea [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29,28,32,27,25],"tags":[],"class_list":["post-2762","post","type-post","status-publish","format-standard","hentry","category-cbor","category-cryptography","category-ietf","category-json","category-specifications"],"_links":{"self":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2762"}],"version-history":[{"count":2,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2762\/revisions"}],"predecessor-version":[{"id":2764,"href":"https:\/\/self-issued.info\/index.php?rest_route=\/wp\/v2\/posts\/2762\/revisions\/2764"}],"wp:attachment":[{"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/self-issued.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}