Subject: [COSE] FW: COSE and JOSE Registrations for Web Authentication (WebAuthn) Algorithms is now RFC 8812

From: Mike Jones <[email-masked]>
Date: Fri, 14 Aug 2020 23:58:50 +0000

Thanks again to the working group for supporting this work!

                                                       -- Mike

From: Mike Jones
Sent: Friday, August 14, 2020 4:58 PM
To: [email-masked]
Subject: COSE and JOSE Registrations for Web Authentication (WebAuthn) Algorithms is now RFC 8812

The W3C Web Authentication (WebAuthn) working group<https://www.w3.org/Webauthn/> and the IETF COSE working group<https://datatracker.ietf.org/wg/cose/about/> created "CBOR Object Signing and Encryption (COSE) and JSON Object Signing and Encryption (JOSE) Registrations for Web Authentication (WebAuthn) Algorithms" to make some algorithms and elliptic curves used by WebAuthn and FIDO2 officially part of COSE and JOSE.  The RSA algorithms are used by TPMs.  The "secp256k1" curve registered (a.k.a., the Bitcoin curve) is also used in some decentralized identity applications.  The completed specification has now been published as RFC 8812<https://www.rfc-editor.org/rfc/rfc8812>.

As described when the registrations recently occurred<https://self-issued.info/?p=2106>, the algorithms registered are:

  *   RS256 - RSASSA-PKCS1-v1_5 using SHA-256 - new for COSE

*       RS384 - RSASSA-PKCS1-v1_5 using SHA-384 - new for COSE

*       RS512 - RSASSA-PKCS1-v1_5 using SHA-512 - new for COSE

*       RS1 - RSASSA-PKCS1-v1_5 using SHA-1 - new for COSE

*       ES256K - ECDSA using secp256k1 curve and SHA-256 - new for COSE and JOSE

The elliptic curves registered are:

*       secp256k1 - SECG secp256k1 curve - new for COSE and JOSE

See them in the IANA COSE Registry<https://www.iana.org/assignments/cose/cose.xhtml> and the IANA JOSE Registry<https://www.iana.org/assignments/jose/jose.xhtml>.

                                                       -- Mike

P.S.  This notice was also published as https://self-issued.info/?p=2119 and as @selfissued<https://twitter.com/selfissued/>.