Skip to content

Commit a649e0b

Browse files
panvapanva
authored
Add IANA considerations and define SLH-DSA JWK usage (#30)
1 parent 31234cc commit a649e0b

File tree

1 file changed

+200
-21
lines changed

1 file changed

+200
-21
lines changed

‎index.html‎

Lines changed: 200 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -83,17 +83,11 @@
8383
"publisher": "IETF",
8484
"date": "May 2025"
8585
},
86-
"draft-ietf-cose-dilithium-07": {
86+
"draft-ietf-cose-dilithium-08": {
8787
"title": "ML-DSA for JOSE and COSE",
88-
"href": "https://www.ietf.org/archive/id/draft-ietf-cose-dilithium-07.html",
88+
"href": "https://www.ietf.org/archive/id/draft-ietf-cose-dilithium-08.html",
8989
"publisher": "IETF",
90-
"date": "June 2025"
91-
},
92-
"draft-ietf-cose-sphincs-plus-05": {
93-
"title": "SLH-DSA for JOSE and COSE",
94-
"href": "https://www.ietf.org/archive/id/draft-ietf-cose-sphincs-plus-05.html",
95-
"publisher": "IETF",
96-
"date": "October 2024"
90+
"date": "July 2025"
9791
},
9892
"CSOR": {
9993
"title": "Computer Security Objects Register",
@@ -1211,14 +1205,14 @@ <h2>Encapsulation dictionaries</h2>
12111205
<h2>Partial JsonWebKey dictionary</h2>
12121206
<pre class=idl>
12131207
partial dictionary JsonWebKey {
1214-
// The following fields are defined in draft-ietf-cose-dilithium-07
1208+
// The following fields are defined in draft-ietf-cose-dilithium-08
12151209
DOMString pub;
12161210
DOMString priv;
12171211
};
12181212
</pre>
12191213
<p>
12201214
This extension of the {{JsonWebKey}} dictionary defined in [[webcrypto]]
1221-
provides a way to represent keys with the "AKP" key type defined in [[draft-ietf-cose-dilithium-07]].
1215+
provides a way to represent keys with the "AKP" key type defined in [[draft-ietf-cose-dilithium-08]].
12221216
</p>
12231217
</section>
12241218

@@ -3576,6 +3570,15 @@ <h4>Registration</h4>
35763570
</tbody>
35773571
</table>
35783572
</section>
3573+
<section id="slh-dsa-jwk">
3574+
<h4>JSON Web Key Representation</h4>
3575+
<p>
3576+
SLH-DSA keys use the "AKP" (Algorithm Key Pair) key type defined in [[draft-ietf-cose-dilithium-08]]
3577+
for JWK representation. The "alg" (algorithm) parameter identifies the specific SLH-DSA parameter set.
3578+
The public key is carried in the "pub" parameter. If a private key is included, it is represented
3579+
using the "priv" parameter. When expressed in JWK, all key parameters are base64url encoded.
3580+
</p>
3581+
</section>
35793582

35803583
<section id="slh-dsa-operations">
35813584
<h4>Operations</h4>
@@ -4225,10 +4228,6 @@ <h5>Import Key</h5>
42254228
<dd>
42264229
<ol>
42274230
<li>
4228-
<p class="issue">
4229-
The JWK format for SLH-DSA is not standardized yet and thus subject to change.
4230-
TODO: register "alg" values for SLH-DSA with IANA in the JSON Web Signature and Encryption Algorithms registry.
4231-
</p>
42324231
<dl class="switch">
42334232
<dt>If |keyData| is a {{JsonWebKey}} dictionary:</dt>
42344233
<dd><p>Let |jwk| equal |keyData|.</p></dd>
@@ -4711,10 +4710,6 @@ <h5>Export Key</h5>
47114710
<dd>
47124711
<ol>
47134712
<li>
4714-
<p class="issue">
4715-
The JWK format for SLH-DSA is not standardized yet and thus subject to change.
4716-
TODO: register "alg" values for SLH-DSA with IANA in the JSON Web Signature and Encryption Algorithms registry.
4717-
</p>
47184713
<p>
47194714
Let |jwk| be a new {{JsonWebKey}}
47204715
dictionary.
@@ -7016,6 +7011,192 @@ <h5>Get key length</h5>
70167011
</section>
70177012
</section>
70187013

7014+
<section id="iana-section">
7015+
<h2>IANA Considerations</h2>
7016+
<section id="iana-section-jws-jwa">
7017+
<h3>JSON Web Signature and Encryption Algorithms Registration</h3>
7018+
<p>
7019+
This section registers the following algorithm identifiers in the IANA JSON Web
7020+
Signature and Encryption Algorithms Registry for use with JSON Web Key.
7021+
</p>
7022+
<ul>
7023+
<li>Algorithm Name: "A128OCB"</li>
7024+
<li>Algorithm Description: AES OCB using 128 bit key</li>
7025+
<li>Algorithm Usage Location(s): "JWK"</li>
7026+
<li>JOSE Implementation Requirements: Optional</li>
7027+
<li>Change Controller: W3C Web Application Security Working Group</li>
7028+
<li>Specification Document(s): [[ This Document ]]</li>
7029+
</ul>
7030+
<ul>
7031+
<li>Algorithm Name: "A192OCB"</li>
7032+
<li>Algorithm Description: AES OCB using 192 bit key</li>
7033+
<li>Algorithm Usage Location(s): "JWK"</li>
7034+
<li>JOSE Implementation Requirements: Optional</li>
7035+
<li>Change Controller: W3C Web Application Security Working Group</li>
7036+
<li>Specification Document(s): [[ This Document ]]</li>
7037+
</ul>
7038+
<ul>
7039+
<li>Algorithm Name: "A256OCB"</li>
7040+
<li>Algorithm Description: AES OCB using 256 bit key</li>
7041+
<li>Algorithm Usage Location(s): "JWK"</li>
7042+
<li>JOSE Implementation Requirements: Optional</li>
7043+
<li>Change Controller: W3C Web Application Security Working Group</li>
7044+
<li>Specification Document(s): [[ This Document ]]</li>
7045+
</ul>
7046+
<ul>
7047+
<li>Algorithm Name: "C20P"</li>
7048+
<li>Algorithm Description: ChaCha20-Poly1305</li>
7049+
<li>Algorithm Usage Location(s): "JWK"</li>
7050+
<li>JOSE Implementation Requirements: Optional</li>
7051+
<li>Change Controller: W3C Web Application Security Working Group</li>
7052+
<li>Specification Document(s): [[ This Document ]]</li>
7053+
</ul>
7054+
<ul>
7055+
<li>Algorithm Name: "K128"</li>
7056+
<li>Algorithm Description: KMAC using the KMAC128</li>
7057+
<li>Algorithm Usage Location(s): "JWK"</li>
7058+
<li>JOSE Implementation Requirements: Optional</li>
7059+
<li>Change Controller: W3C Web Application Security Working Group</li>
7060+
<li>Specification Document(s): [[ This Document ]]</li>
7061+
</ul>
7062+
<ul>
7063+
<li>Algorithm Name: "K256"</li>
7064+
<li>Algorithm Description: KMAC using the KMAC256</li>
7065+
<li>Algorithm Usage Location(s): "JWK"</li>
7066+
<li>JOSE Implementation Requirements: Optional</li>
7067+
<li>Change Controller: W3C Web Application Security Working Group</li>
7068+
<li>Specification Document(s): [[ This Document ]]</li>
7069+
</ul>
7070+
<ul>
7071+
<li>Algorithm Name: "SLH-DSA-SHA2-128s"</li>
7072+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-128s parameter set</li>
7073+
<li>Algorithm Usage Location(s): "JWK"</li>
7074+
<li>JOSE Implementation Requirements: Optional</li>
7075+
<li>Change Controller: W3C Web Application Security Working Group</li>
7076+
<li>Specification Document(s): [[ This Document ]]</li>
7077+
</ul>
7078+
<ul>
7079+
<li>Algorithm Name: "SLH-DSA-SHA2-128f"</li>
7080+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-128f parameter set</li>
7081+
<li>Algorithm Usage Location(s): "JWK"</li>
7082+
<li>JOSE Implementation Requirements: Optional</li>
7083+
<li>Change Controller: W3C Web Application Security Working Group</li>
7084+
<li>Specification Document(s): [[ This Document ]]</li>
7085+
</ul>
7086+
<ul>
7087+
<li>Algorithm Name: "SLH-DSA-SHA2-192s"</li>
7088+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-192s parameter set</li>
7089+
<li>Algorithm Usage Location(s): "JWK"</li>
7090+
<li>JOSE Implementation Requirements: Optional</li>
7091+
<li>Change Controller: W3C Web Application Security Working Group</li>
7092+
<li>Specification Document(s): [[ This Document ]]</li>
7093+
</ul>
7094+
<ul>
7095+
<li>Algorithm Name: "SLH-DSA-SHA2-192f"</li>
7096+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-192f parameter set</li>
7097+
<li>Algorithm Usage Location(s): "JWK"</li>
7098+
<li>JOSE Implementation Requirements: Optional</li>
7099+
<li>Change Controller: W3C Web Application Security Working Group</li>
7100+
<li>Specification Document(s): [[ This Document ]]</li>
7101+
</ul>
7102+
<ul>
7103+
<li>Algorithm Name: "SLH-DSA-SHA2-256s"</li>
7104+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-256s parameter set</li>
7105+
<li>Algorithm Usage Location(s): "JWK"</li>
7106+
<li>JOSE Implementation Requirements: Optional</li>
7107+
<li>Change Controller: W3C Web Application Security Working Group</li>
7108+
<li>Specification Document(s): [[ This Document ]]</li>
7109+
</ul>
7110+
<ul>
7111+
<li>Algorithm Name: "SLH-DSA-SHA2-256f"</li>
7112+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHA2-256f parameter set</li>
7113+
<li>Algorithm Usage Location(s): "JWK"</li>
7114+
<li>JOSE Implementation Requirements: Optional</li>
7115+
<li>Change Controller: W3C Web Application Security Working Group</li>
7116+
<li>Specification Document(s): [[ This Document ]]</li>
7117+
</ul>
7118+
<ul>
7119+
<li>Algorithm Name: "SLH-DSA-SHAKE-128s"</li>
7120+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-128s parameter set</li>
7121+
<li>Algorithm Usage Location(s): "JWK"</li>
7122+
<li>JOSE Implementation Requirements: Optional</li>
7123+
<li>Change Controller: W3C Web Application Security Working Group</li>
7124+
<li>Specification Document(s): [[ This Document ]]</li>
7125+
</ul>
7126+
<ul>
7127+
<li>Algorithm Name: "SLH-DSA-SHAKE-128f"</li>
7128+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-128f parameter set</li>
7129+
<li>Algorithm Usage Location(s): "JWK"</li>
7130+
<li>JOSE Implementation Requirements: Optional</li>
7131+
<li>Change Controller: W3C Web Application Security Working Group</li>
7132+
<li>Specification Document(s): [[ This Document ]]</li>
7133+
</ul>
7134+
<ul>
7135+
<li>Algorithm Name: "SLH-DSA-SHAKE-192s"</li>
7136+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-192s parameter set</li>
7137+
<li>Algorithm Usage Location(s): "JWK"</li>
7138+
<li>JOSE Implementation Requirements: Optional</li>
7139+
<li>Change Controller: W3C Web Application Security Working Group</li>
7140+
<li>Specification Document(s): [[ This Document ]]</li>
7141+
</ul>
7142+
<ul>
7143+
<li>Algorithm Name: "SLH-DSA-SHAKE-192f"</li>
7144+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-192f parameter set</li>
7145+
<li>Algorithm Usage Location(s): "JWK"</li>
7146+
<li>JOSE Implementation Requirements: Optional</li>
7147+
<li>Change Controller: W3C Web Application Security Working Group</li>
7148+
<li>Specification Document(s): [[ This Document ]]</li>
7149+
</ul>
7150+
<ul>
7151+
<li>Algorithm Name: "SLH-DSA-SHAKE-256s"</li>
7152+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-256s parameter set</li>
7153+
<li>Algorithm Usage Location(s): "JWK"</li>
7154+
<li>JOSE Implementation Requirements: Optional</li>
7155+
<li>Change Controller: W3C Web Application Security Working Group</li>
7156+
<li>Specification Document(s): [[ This Document ]]</li>
7157+
</ul>
7158+
<ul>
7159+
<li>Algorithm Name: "SLH-DSA-SHAKE-256f"</li>
7160+
<li>Algorithm Description: SLH-DSA using the SLH-DSA-SHAKE-256f parameter set</li>
7161+
<li>Algorithm Usage Location(s): "JWK"</li>
7162+
<li>JOSE Implementation Requirements: Optional</li>
7163+
<li>Change Controller: W3C Web Application Security Working Group</li>
7164+
<li>Specification Document(s): [[ This Document ]]</li>
7165+
</ul>
7166+
</section>
7167+
<section id="iana-section-key-operations">
7168+
<h3>JSON Web Key Operations</h3>
7169+
<p>
7170+
This section registers the following key operations in the IANA JSON Web Key
7171+
Operations Registry for use with JSON Web Key.
7172+
</p>
7173+
<ul>
7174+
<li>Key Operation Value: "encapsulateKey"</li>
7175+
<li>Key Operation Description: Encapsulate key</li>
7176+
<li>Change Controller: W3C Web Application Security Working Group</li>
7177+
<li>Specification Document(s): [[ This Document ]]</li>
7178+
</ul>
7179+
<ul>
7180+
<li>Key Operation Value: "encapsulateBits"</li>
7181+
<li>Key Operation Description: Encapsulate bits not to be used as a key</li>
7182+
<li>Change Controller: W3C Web Application Security Working Group</li>
7183+
<li>Specification Document(s): [[ This Document ]]</li>
7184+
</ul>
7185+
<ul>
7186+
<li>Key Operation Value: "decapsulateKey"</li>
7187+
<li>Key Operation Description: Eecapsulate key</li>
7188+
<li>Change Controller: W3C Web Application Security Working Group</li>
7189+
<li>Specification Document(s): [[ This Document ]]</li>
7190+
</ul>
7191+
<ul>
7192+
<li>Key Operation Value: "decapsulateBits"</li>
7193+
<li>Key Operation Description: Encapsulate bits not to be used as a key</li>
7194+
<li>Change Controller: W3C Web Application Security Working Group</li>
7195+
<li>Specification Document(s): [[ This Document ]]</li>
7196+
</ul>
7197+
</section>
7198+
</section>
7199+
70197200
<section>
70207201
<h2>Usage Example</h2>
70217202
<p>
@@ -7184,8 +7365,6 @@ <h3>Algorithm mappings</h3>
71847365
</tr>
71857366
</tbody>
71867367
</table>
7187-
<div class="todo">TODO: register A128OCB, A192OCB, A256OCB, C20P, K128 and K256(?) with IANA in the JSON Web Signature and Encryption Algorithms registry.</div>
7188-
<div class="todo">TODO: register encapsulateKey, encapsulateBits, decapsulateKey and decapsulateBits with IANA in the JSON Web Key Operations registry.</div>
71897368
</section>
71907369

71917370
<section id="pkcs8-mapping" class="appendix informative">

0 commit comments

Comments
 (0)