[jose] PQ & PQ/T HPKE JWE path forward, draft-skokan-jose-hpke-pq-pqt-04 published; request for WG adoption call

[Filip Skokan <[e-mail]>]

Dear JOSE WG Chairs, Deb, and all,

Following the discussion at IETF 125 and the feedback on the list, the
authors of the two individual drafts covering PQ and PQ/T HPKE algorithms
for JOSE and COSE met last week to align on a path forward.

*Alignment outcome*

   - *draft-skokan-jose-hpke-pq-pqt* will continue as a *JOSE-only* document.
   Hannes and Tiru have joined myself and Brian as co-authors.
   - *draft-reddy-cose-jose-pqc-hybrid-hpke* (or its renamed version, Tiru
   is working on figuring that out) will continue as a *COSE-only* document;
   the JOSE portions are being removed; I'm joining as co-author.

This split directly addresses the concerns raised at IETF 125 about tightly
coupling JOSE and COSE work in a single document, in particular the
differing use cases between the two. The goal is to do JOSE things in JOSE
and COSE things in COSE, while keeping the two drafts aligned where it
makes sense (e.g. algorithm identifier numbering, see below).

*-04 published*

A new revision, *draft-skokan-jose-hpke-pq-pqt-04*, has been published:
https://datatracker.ietf.org/doc/draft-skokan-jose-hpke-pq-pqt/ (see diff
<https://author-tools.ietf.org/iddiff?url1=draft-skokan-jose-hpke-pq-pqt-03&url2=draft-skokan-jose-hpke-pq-pqt-04&difftype=--hwdiff>
)

It incorporates both the alignment reached among the (now four) authors and
feedback from the WG session and the list:

   - *Algorithm identifier alignment with COSE* - algorithms were
   renumbered with intentional gaps so the JOSE identifiers track the
   corresponding COSE registrations; an explanatory note was added to the IANA
   Considerations.
   - *Ciphersuite count reduced* - ChaCha20Poly1305 ciphersuites were
   removed, and rationale was added for selecting AES-256-GCM as the sole AEAD
   and SHAKE256 as the sole KDF.
   - *Security Considerations expanded* - added a Security Strength
   subsection, HNDL ("harvest now, decrypt later") and multi-recipient
   guidance, and rationale for registering both PQ/T hybrid and pure PQ
   ciphersuites alongside the previously added ML-KEM-512 omission rationale.
   - *Terminology aligned with RFC 9794* - the Conventions and Definitions
   section now uses RFC 9794 PQ/T terminology; informative references to RFC
   9794, I-D.ietf-pquip-pqc-engineers, and CNSA 2.0 were added.
   - *JSON Web Key Representation section refactored* for clarity.

*Scope recap*

This draft registers PQ and PQ/T hybrid algorithm identifiers for JWE built
on the HPKE framework defined in draft-ietf-jose-hpke-encrypt, reusing the
HPKE mode machinery with PQ and PQ/T KEMs (from draft-ietf-hpke-pq). It is
intentionally narrow - HPKE-based registrations for JOSE only. The
corresponding COSE registrations will continue in
draft-reddy-cose-jose-pqc-hybrid-hpke (or its renamed version).

*Asks*

   - *Chairs:* with the JOSE/COSE split resolved, four aligned authors, and
   the IETF 125 feedback addressed in -04, we'd like to request a *call for
   working group adoption*.
   - *WG participants*: please review -04 and share feedback on the list,
   we're looking forward to your feedback to incorporate into a WG draft.

Best,
*Filip* (also on behalf of the rest of the authors: Brian, Tiru, and Hannes)


On Wed, 22 Apr 2026 at 12:04, <[e-mail]> wrote:

> A new version of Internet-Draft draft-skokan-jose-hpke-pq-pqt-04.txt has
> been
> successfully submitted by Filip Skokan and posted to the
> IETF repository.
>
> Name:     draft-skokan-jose-hpke-pq-pqt
> Revision: 04
> Title:    JOSE HPKE PQ & PQ/T Algorithm Registrations
> Date:     2026-04-22
> Group:    Individual Submission
> Pages:    20
> URL:
> https://www.ietf.org/archive/id/draft-skokan-jose-hpke-pq-pqt-04.txt
> Status:   https://datatracker.ietf.org/doc/draft-skokan-jose-hpke-pq-pqt/
> HTML:
> https://www.ietf.org/archive/id/draft-skokan-jose-hpke-pq-pqt-04.html
> HTMLized:
> https://datatracker.ietf.org/doc/html/draft-skokan-jose-hpke-pq-pqt
> Diff:
> https://author-tools.ietf.org/iddiff?url1=draft-skokan-jose-hpke-pq-pqt-03&url2=draft-skokan-jose-hpke-pq-pqt-04&difftype=--hwdiff
>
> Abstract:
>
>    This document registers Post-Quantum (PQ) and Post-Quantum/
>    Traditional (PQ/T) hybrid algorithm identifiers for use with JSON
>    Object Signing and Encryption (JOSE), building on the Hybrid Public
>    Key Encryption (HPKE) framework.
>
>
>
> The IETF Secretariat
>
>
>