WG Action: Rechartered CBOR Object Signing and Encryption (cose)

The CBOR Object Signing and Encryption (cose) WG in the Security Area of the
IETF has been rechartered. For additional information, please contact the
Area Directors or the WG Chairs.

CBOR Object Signing and Encryption (cose)
-----------------------------------------------------------------------
Current status: Active WG

Chairs:
  Ivaylo Petrov <ivaylopetrov@google.com>
  Michael Jones <michael_b_jones@hotmail.com>

Assigned Area Director:
  Paul Wouters <paul.wouters@aiven.io>

Security Area Directors:
  Paul Wouters <paul.wouters@aiven.io>
  Deb Cooley <debcooley1@gmail.com>

Mailing list:
  Address: cose@ietf.org
  To subscribe: https://www.ietf.org/mailman/listinfo/cose
  Archive: https://mailarchive.ietf.org/arch/browse/cose/

Group page: https://datatracker.ietf.org/group/cose/

Charter: https://datatracker.ietf.org/doc/charter-ietf-cose/

CBOR Object Signing and Encryption (COSE, RFC 9052) describes how to
create and process signatures, message authentication codes, and
encryption using Concise Binary Object Representation (CBOR, RFC 8949)
for serialization. COSE additionally describes a representation for
cryptographic keys.

The COSE working group handles four types of (intended status Standard Track)
documents:

1.  Documents that describe the use of cryptographic algorithms in COSE.
2.  Documents that describe additional attributes for COSE.
3.  Documents that define header parameters to be used in COSE objects.
4.  Documents that define COSE key representations.

The WG will evaluate, and potentially adopt, documents dealing with algorithms
that would fit the criteria of being IETF consensus algorithms.

Key management and binding of keys to identities are out of scope for
the working group. The COSE WG will not innovate in terms of
cryptography. The specification of algorithms in COSE is limited to
those in RFCs, active IRTF CFRG or IETF WG documents, or algorithms which
have been positively reviewed by the IRTF CFRG.

The COSE WG will also work on a CBOR encoding of the certificate profile
defined in RFC 5280. It is expected that the encoding works with RFC 7925.
The main objective is to define a method of encoding current X.509
certificates that meet a specific profile into a smaller format. This
encoding shall be invertible, so they can be expanded and normal X.509
certificate processing can be used. This work is currently happening in
draft-ietf-cose-cbor-encoded-cert.

Milestones:

  Jun 2025 - COSE header parameters for RFC 3161-based timestamping into COSE
  objects to IESG

  Jun 2025 - COSE header parameters for incorporating “COSE Receipts” into
  COSE objects to IESG

  Jul 2025 - COSE header parameters for COSE objects that carry a payload
  that is an output of a hash function on an original payload to IESG

  Nov 2025 - A CBOR encoding of the certificate profile to the IESG

  Jan 2026 - One or more documents describing the proper use of algorithms.