[jose] draft-ietf-jose-pq-composite-sigs examples issue

[Filip Skokan <[e-mail]>]

Hello,

I believe the draft has an inconsistency in the JOSE signing input for the
composite components.

The algorithm builds the representative as:

  M' = Prefix || Label || 0x00 || PH(M)

but then says that for JOSE, M' is base64url-encoded before signing.
However, the Appendix A JOSE examples appear to sign the raw octets above,
not a base64url-encoded representation of them.

For example, Figure 1’s `raw_to_be_signed` starts with the hex encoding of:

  CompositeAlgorithmSignatures2025COMPSIG-MLDSA44-ECDSA-P256-SHA256

followed by `00` and the prehash. If the JOSE `Encode(M')` step were
applied as base64url, the signed bytes would instead begin with ASCII
base64url text such as `Q29tcG...`.

In an implementation, the Appendix A JWS signatures verify when
signing/verifying the raw `Prefix || Label || 0x00 || PH(M)` bytes, and do
not match if `M'` is base64url-encoded first.

Could you clarify which behavior is intended? If the Appendix A vectors are
intended to be normative examples, I think the JOSE-specific base64url
encoding step should be removed or reworded to say that the raw
representative octets are signed. If the base64url encoding step is
intended, then the Appendix A JOSE vectors need to be regenerated.

S pozdravem,
*Filip Skokan*


On Mon, 6 Jul 2026 at 23:17, <[e-mail]> wrote:

> Internet-Draft draft-ietf-jose-pq-composite-sigs-02.txt is now available.
> It
> is a work item of the Javascript Object Signing and Encryption (JOSE) WG of
> the IETF.
>
>    Title:   PQ/T Hybrid Composite Signatures for JOSE and COSE
>    Authors: Lucas Prabel
>             Sun Shuzhou
>             John Gray
>             Tirumaleswar Reddy
>    Name:    draft-ietf-jose-pq-composite-sigs-02.txt
>    Pages:   29
>    Dates:   2026-07-06
>
> Abstract:
>
>    This document describes JSON Object Signing and Encryption (JOSE) and
>    CBOR Object Signing and Encryption (COSE) serializations for PQ/T
>    hybrid composite signatures.  The composite algorithms described
>    combine ML-DSA as the post-quantum component and either ECDSA or
>    EdDSA as the traditional component.
>
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-jose-pq-composite-sigs/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-jose-pq-composite-sigs-02.html
>
> A diff from the previous version is available at:
>
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-jose-pq-composite-sigs-02
>
> Internet-Drafts are also available by rsync at:
> rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> jose mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>