Re: [COSE] JOSE & COSE: Registered Curves & Hybrids

[Ilari Liusvaara <[e-mail]>]

On Thu, Mar 28, 2024 at 09:11:52AM -0700, Orie Steele wrote:
> See:
> 
> https://mailarchive.ietf.org/arch/msg/tls/QU1kpJdGNPsIFbjTG2KlDLMdcPk/
> 
> We've got similar issues in JOSE and COSE registries.
> 
> I wonder if we ought to consider similar changes to:
> 
> https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
> https://www.iana.org/assignments/cose/cose.xhtml#elliptic-curves
> 
> This issue has come up already in several discussions regarding ML-DSA,
> SLH-DSA, FN-DSA, ML-KEM and hybrids.

As far as I remember, this issue does not come up with how *-DSA is
currently defined, but prehash could change things (unless we just
decide that prehash variants are not supported, like with Ed25519/
Ed448).

It does come up with ML-KEM and anything hybridizing it, since KEMs
are always multi-algorithm. Even just DKA vs KAwKW always gives at least
two algorithms.


> Because JOSE and COSE tend to separate algorithms from keys, we've not seen
> the equivalent of curves created for lattices or hashes or hybrids.

As I see it, the issue is that OKP can throw who knows what into
"elliptic curve" space. EC/EC2 is nicely behaved, those are always
elliptic curves.

Then I note that COSE 1/-1 is described as "EC identifier -- Taken from
the 'COSE Elliptic Curves' registry", which is less than great.

Radical way would be to split the registries (and move the CFRG stuff
to the new registry).


> I personally think this is a good thing, since fully specified algorithms
> attached to a key representation is better than looking at kty -> crv ->
> P-256 and then just trying ES256 or ECDH-ES+A128KW.

I don't see what this has to do with fully-specified algorithms.
Especially for things like P-256, that truly are elliptic curves.

 
> If we don't plan to create new registries for PQC related things, should we
> say anything about future expectations on this?
>
> Or just let curves be the last such registry and rely on tribal knowledge?

I don't see any need to create any new registry for PQC stuff. There
is no PQC stuff yet, but there would be 4 entries for the new registry.

And as far as I see, the track record with tribal knowledge (e.g., about
actual meaning of "crv" in OKP[1] or "kty"[2]) is not exactly great.


[1] "Read the correct mailing list thread and you'll get it right."
[2] Listen the correct comment in session video recording and you'll
    get it right.




-Ilari