[jose] Re: Algorithm identifiers for ML-KEM and ML-DSA

[Orie Steele <[e-mail]>]

I am cross posting to COSE WG list since we are defining ML-DSA / SLH-DSA
keys for both JOSE and COSE in the drafts.

On Thu, Aug 22, 2024 at 3:47 PM Ilari Liusvaara <[e-mail]>
wrote:

<snip>

> I think you are arguing that "kty" : "ML-DSA" should be "kty: "PQK", so
> > that both ML-DSA and SLH-DSA can use the same kty, just with different
> > algorithms.
>
> No, I am arguing that all keys that are:
>
> - Subtyped using "alg"
> - Public key is byte string.
> - Private key is byte string.
>

So instead of:

{
  "kty": "ML-DSA",
  "alg": "ML-DSA-44",
  "pub": "V53SIdVF...uvw2nuCQ",
  "priv": "V53SIdVF...cDKLbsBY"
}

This?

{
  "kty": "AKP",
  "alg": "ML-DSA-44",
  "pub": "V53SIdVF...uvw2nuCQ",
  "priv": "V53SIdVF...cDKLbsBY"
}

Where "alg" is mandatory when kty = AKP?

Should have the same kty regardless of if those are pre-quantum or
> post-quantum, what cryptographic algorithm is used, etc...
>
> This corresponds to the first part in "ways to subtype" above.
>
> Earlier I proposed name "AKP" (Algorithm Key Pair) for such key type.
>
>
> And really the only thing in JOSE such keys are suitable for is non-
> prehashed signatures.
>
>
I'd be fine with this.

@Mike Prorock <[e-mail]> Would this work for you? Any objections
from JOSE / COSE list readers?

 <snip>


> -Ilari
>
> _______________________________________________
> jose mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>


-- 


ORIE STEELE
Chief Technology Officer
www.transmute.industries

<https://transmute.industries>