Network Working Group L. Liao Internet-Draft NIO Inc. Intended status: Standards Track 1 November 2026 Expires: 5 May 2027 Post-Quantum Algorithms for C509 Certificates draft-liao-cose-c509-pq-algorithms-00 Abstract This document registers post-quantum algorithms in the IANA registries defined by [I-D.ietf-cose-cbor-encoded-cert]. It extends the C509 certificate specification with post-quantum cryptography (PQC) signature and key encapsulation algorithms: ML-DSA, FN-DSA, ML- KEM, and the stateful hash-based signature algorithms HSS/LMS, XMSS, and XMSS^MT, as well as with composite ML-DSA and ML-KEM algorithms, which combine a PQC algorithm with a traditional algorithm. About This Document This note is to be removed before publishing as an RFC. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-liao-cose-c509-pq-algorithms/. Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (mailto:cose@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/cose/. Subscribe at https://www.ietf.org/mailman/listinfo/cose/. Source for this draft and an issue tracker can be found at https://github.com/cose-wg/xxx. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." Liao Expires 5 May 2027 [Page 1] Internet-Draft C509 PQ Algorithms November 2026 This Internet-Draft will expire on 5 May 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3 3. Additional Signature Algorithms . . . . . . . . . . . . . . . 3 3.1. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) . . . . . . . . . . . . . . . . . . . . . . . 4 3.2. FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm) . . . . . . . . . . . . . . . . . . . . . . . 5 3.3. Stateful Hash-Based Signature Algorithms (HSS/LMS, XMSS, XMSS^MT) . . . . . . . . . . . . . . . . . . . . . . . . 6 3.4. Composite ML-DSA Signature Algorithms . . . . . . . . . . 7 4. Additional Public Key Algorithms . . . . . . . . . . . . . . 10 4.1. ML-DSA Public Keys . . . . . . . . . . . . . . . . . . . 11 4.2. FN-DSA Public Keys . . . . . . . . . . . . . . . . . . . 11 4.3. ML-KEM Public Keys (Key Encapsulation Mechanism) . . . . 12 4.4. Stateful Hash-Based Public Keys . . . . . . . . . . . . . 13 4.5. Composite ML-DSA Public Keys . . . . . . . . . . . . . . 14 4.6. Composite ML-KEM Public Keys . . . . . . . . . . . . . . 18 5. Use in Other C509 Structures . . . . . . . . . . . . . . . . 20 5.1. Private Keys . . . . . . . . . . . . . . . . . . . . . . 20 5.2. Certification Requests . . . . . . . . . . . . . . . . . 21 6. Security Considerations . . . . . . . . . . . . . . . . . . . 21 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 7.1. C509 Signature Algorithms Registry . . . . . . . . . . . 22 7.2. C509 Public Key Algorithms Registry . . . . . . . . . . . 22 7.3. Suggested Values . . . . . . . . . . . . . . . . . . . . 22 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 23 8.1. Normative References . . . . . . . . . . . . . . . . . . 23 8.2. Informative References . . . . . . . . . . . . . . . . . 25 Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 26 Change Log . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Liao Expires 5 May 2027 [Page 2] Internet-Draft C509 PQ Algorithms November 2026 Changes from draft-liao-cose-c509-algorithms-00 . . . . . . . . 26 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 27 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 27 1. Introduction [I-D.ietf-cose-cbor-encoded-cert] defines C509, a compact CBOR encoding of X.509 certificates and certification requests, and establishes a set of IANA registries, including the "C509 Signature Algorithms" and "C509 Public Key Algorithms" registries. That specification populates these registries with commonly used values and anticipates that new algorithms, including post-quantum algorithms, are registered as they are specified. This document adds entries to the C509 Signature Algorithms and C509 Public Key Algorithms registries for PQC signature and key encapsulation algorithms: ML-DSA, FN-DSA, ML-KEM, and the stateful hash-based signature algorithms HSS/LMS, XMSS, and XMSS^MT. It also adds entries for the composite ML-DSA and ML-KEM algorithms, which combine a PQC algorithm with a traditional algorithm into a single post-quantum/traditional (PQ/T) hybrid algorithm. All new values are registered in the "CBOR Encoded X.509 (C509)" registry group, following the registration procedures defined in [I-D.ietf-cose-cbor-encoded-cert]. 2. Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. This document uses the terminology and registry structure defined in [I-D.ietf-cose-cbor-encoded-cert]. The CBOR terminology of [RFC8949] applies. 3. Additional Signature Algorithms This section defines additional entries for the C509 Signature Algorithms registry established in [I-D.ietf-cose-cbor-encoded-cert]. Liao Expires 5 May 2027 [Page 3] Internet-Draft C509 PQ Algorithms November 2026 3.1. ML-DSA (Module-Lattice-Based Digital Signature Algorithm) ML-DSA is a lattice-based digital signature algorithm standardized by NIST as [FIPS204] and specified for use in X.509 PKI by [RFC9881]. In C509, the signature value (issuerSignatureValue in a C509 certificate, subjectSignatureValue in a C509 certification request) is a byte string containing the raw ML-DSA signature. For natively signed C509 certificates and certification requests, the ML-DSA signature is computed over the CBOR-encoded TBSCertificate or TBSCertificationRequest, respectively, with the context string (ctx) set to the empty string, as specified in [RFC9881] for the DER- encoded structures. +-------+-----------------------------------------------------------+ | Value | Signature Algorithm | +=======+===========================================================+ | TBD1 | Name: ML-DSA-44 | | (17) | Identifiers: id-ml-dsa-44 | | | OID: 2.16.840.1.101.3.4.3.17 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 11 | | | Comments: FIPS 204; RFC 9881; | | | signature: bytes of size 2420 | +-------+-----------------------------------------------------------+ | TBD2 | Name: ML-DSA-65 | | (18) | Identifiers: id-ml-dsa-65 | | | OID: 2.16.840.1.101.3.4.3.18 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 12 | | | Comments: FIPS 204; RFC 9881; | | | signature: bytes of size 3309 | +-------+-----------------------------------------------------------+ | TBD3 | Name: ML-DSA-87 | | (19) | Identifiers: id-ml-dsa-87 | | | OID: 2.16.840.1.101.3.4.3.19 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 13 | | | Comments: FIPS 204; RFC 9881; | | | signature: bytes of size 4627 | +-------+-----------------------------------------------------------+ Liao Expires 5 May 2027 [Page 4] Internet-Draft C509 PQ Algorithms November 2026 3.2. FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm) FN-DSA is a lattice-based digital signature algorithm based on Falcon, standardized by NIST as [FIPS206] and specified for use in X.509 PKI by [I-D.ietf-lamps-fn-dsa-certificates]. In C509, the signature value (issuerSignatureValue in a C509 certificate, subjectSignatureValue in a C509 certification request) is a byte string containing the raw FN-DSA signature. For natively signed C509 certificates and certification requests, the FN-DSA signature is computed over the CBOR-encoded TBSCertificate or TBSCertificationRequest, respectively, with the context string (ctx) set to the empty string, as specified in [I-D.ietf-lamps-fn-dsa-certificates] for the DER-encoded structures. The OIDs id-fn-dsa-512 and id-fn-dsa-1024 have not yet been assigned by NIST. The final arc of each OID and the last byte of each DER encoding below are therefore given as TBD. Likewise, the signature sizes are given as TBD until [FIPS206] is finalized. +-------+-----------------------------------------------------------+ | Value | Signature Algorithm | +=======+===========================================================+ | TBD4 | Name: FN-DSA-512 | | (20) | Identifiers: id-fn-dsa-512 | | | OID: 2.16.840.1.101.3.4.3.TBD | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 TBD | | | Comments: FIPS 206; draft-ietf-lamps-fn-dsa- | | | certificates; | | | signature: bytes of size TBD | +-------+-----------------------------------------------------------+ | TBD5 | Name: FN-DSA-1024 | | (21) | Identifiers: id-fn-dsa-1024 | | | OID: 2.16.840.1.101.3.4.3.TBD | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 TBD | | | Comments: FIPS 206; draft-ietf-lamps-fn-dsa- | | | certificates; | | | signature: bytes of size TBD | +-------+-----------------------------------------------------------+ Liao Expires 5 May 2027 [Page 5] Internet-Draft C509 PQ Algorithms November 2026 3.3. Stateful Hash-Based Signature Algorithms (HSS/LMS, XMSS, XMSS^MT) The Hierarchical Signature System (HSS) built on the Leighton-Micali Signature (LMS) scheme is defined in [RFC8554]; its use in X.509 PKI is specified in [RFC9708] and [RFC9802]. The eXtended Merkle Signature Scheme (XMSS) and its multi-tree variant (XMSS^MT) are defined in [RFC8391]; their use in X.509 PKI is specified in [RFC9802]. For all three schemes, the C509 signature value is a byte string containing the raw signature. All three are stateful signature schemes. Their signature sizes depend on the chosen parameter set, while their public key sizes depend only on the hash output length; see Section 4.4. +-------+-----------------------------------------------------------+ | Value | Signature Algorithm | +=======+===========================================================+ | TBD6 | Name: HSS/LMS Hash-based Signature | | (32) | Identifiers: id-alg-hss-lms-hashsig, | | | id-alg-mts-hashsig | | | OID: 1.2.840.113549.1.9.16.3.17 | | | Parameters: Absent | | | DER: 30 0D 06 0B 2A 86 48 86 F7 0D 01 09 10 03 11 | | | Comments: RFC 8554; RFC 9708; RFC 9802; | | | signature: bytes of variable size | +-------+-----------------------------------------------------------+ | TBD7 | Name: XMSS Hash-based Signature | | (34) | Identifiers: id-alg-xmss-hashsig | | | OID: 1.3.6.1.5.5.7.6.34 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 22 | | | Comments: RFC 8391; RFC 9802; | | | signature: bytes of variable size | +-------+-----------------------------------------------------------+ | TBD8 | Name: XMSS^MT Hash-based Signature | | (35) | Identifiers: id-alg-xmssmt-hashsig | | | OID: 1.3.6.1.5.5.7.6.35 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 23 | | | Comments: RFC 8391; RFC 9802; | | | signature: bytes of variable size | +-------+-----------------------------------------------------------+ Liao Expires 5 May 2027 [Page 6] Internet-Draft C509 PQ Algorithms November 2026 3.4. Composite ML-DSA Signature Algorithms Composite ML-DSA combines an ML-DSA component with a traditional signature algorithm (RSA, ECDSA, Ed25519, or Ed448) into a single signature algorithm for use in X.509 PKI. These algorithms are defined in [I-D.ietf-lamps-pq-composite-sigs], which assigns their OIDs under the PKIX algorithms arc (1.3.6.1.5.5.7.6). In C509, the signature value is a byte string containing the composite signature value as serialized by SerializeSignatureValue in [I-D.ietf-lamps-pq-composite-sigs], i.e., the ML-DSA signature followed by the traditional signature, exactly as in X.509. The traditional component is not re-encoded. In particular, ECDSA signatures remain DER-encoded Ecdsa-Sig-Value structures, so the size of composite signatures with an ECDSA component varies slightly. This is the same encoding as used for composite ML-DSA signatures in JOSE and COSE [I-D.ietf-jose-pq-composite-sigs], so composite signature values need no conversion between X.509, C509, and COSE. For natively signed C509 certificates and certification requests, the composite signature is computed with the Composite-ML-DSA.Sign function of [I-D.ietf-lamps-pq-composite-sigs], with the message M set to the CBOR-encoded TBSCertificate or TBSCertificationRequest, respectively, and the application context string (ctx) set to the empty string. +-------+-----------------------------------------------------------+ | Value | Signature Algorithm | +=======+===========================================================+ | TBD9 | Name: sa-MLDSA44-RSA2048-PSS-SHA256 | | (293) | Identifiers: id-MLDSA44-RSA2048-PSS-SHA256 | | | OID: 1.3.6.1.5.5.7.6.37 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 25 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 2676 | +-------+-----------------------------------------------------------+ | TBD10 | Name: sa-MLDSA44-RSA2048-PKCS15-SHA256 | | (294) | Identifiers: id-MLDSA44-RSA2048-PKCS15-SHA256 | | | OID: 1.3.6.1.5.5.7.6.38 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 26 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 2676 | +-------+-----------------------------------------------------------+ | TBD11 | Name: sa-MLDSA44-Ed25519-SHA512 | | (295) | Identifiers: id-MLDSA44-Ed25519-SHA512 | | | OID: 1.3.6.1.5.5.7.6.39 | Liao Expires 5 May 2027 [Page 7] Internet-Draft C509 PQ Algorithms November 2026 | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 27 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 2484 | +-------+-----------------------------------------------------------+ | TBD12 | Name: sa-MLDSA44-ECDSA-P256-SHA256 | | (296) | Identifiers: id-MLDSA44-ECDSA-P256-SHA256 | | | OID: 1.3.6.1.5.5.7.6.40 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 28 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 2492 | +-------+-----------------------------------------------------------+ | TBD13 | Name: sa-MLDSA65-RSA3072-PSS-SHA512 | | (297) | Identifiers: id-MLDSA65-RSA3072-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.41 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 29 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 3693 | +-------+-----------------------------------------------------------+ | TBD14 | Name: sa-MLDSA65-RSA3072-PKCS15-SHA512 | | (298) | Identifiers: id-MLDSA65-RSA3072-PKCS15-SHA512 | | | OID: 1.3.6.1.5.5.7.6.42 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2A | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 3693 | +-------+-----------------------------------------------------------+ | TBD15 | Name: sa-MLDSA65-RSA4096-PSS-SHA512 | | (299) | Identifiers: id-MLDSA65-RSA4096-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.43 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2B | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 3821 | +-------+-----------------------------------------------------------+ | TBD16 | Name: sa-MLDSA65-RSA4096-PKCS15-SHA512 | | (300) | Identifiers: id-MLDSA65-RSA4096-PKCS15-SHA512 | | | OID: 1.3.6.1.5.5.7.6.44 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2C | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 3821 | +-------+-----------------------------------------------------------+ | TBD17 | Name: sa-MLDSA65-ECDSA-P256-SHA512 | | (301) | Identifiers: id-MLDSA65-ECDSA-P256-SHA512 | | | OID: 1.3.6.1.5.5.7.6.45 | Liao Expires 5 May 2027 [Page 8] Internet-Draft C509 PQ Algorithms November 2026 | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2D | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 3381 | +-------+-----------------------------------------------------------+ | TBD18 | Name: sa-MLDSA65-ECDSA-P384-SHA512 | | (302) | Identifiers: id-MLDSA65-ECDSA-P384-SHA512 | | | OID: 1.3.6.1.5.5.7.6.46 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2E | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 3413 | +-------+-----------------------------------------------------------+ | TBD19 | Name: sa-MLDSA65-ECDSA-brainpoolP256r1-SHA512 | | (303) | Identifiers: id-MLDSA65-ECDSA-brainpoolP256r1-SHA512 | | | OID: 1.3.6.1.5.5.7.6.47 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2F | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 3381 | +-------+-----------------------------------------------------------+ | TBD20 | Name: sa-MLDSA65-Ed25519-SHA512 | | (304) | Identifiers: id-MLDSA65-Ed25519-SHA512 | | | OID: 1.3.6.1.5.5.7.6.48 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 30 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 3373 | +-------+-----------------------------------------------------------+ | TBD21 | Name: sa-MLDSA87-ECDSA-P384-SHA512 | | (305) | Identifiers: id-MLDSA87-ECDSA-P384-SHA512 | | | OID: 1.3.6.1.5.5.7.6.49 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 31 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 4731 | +-------+-----------------------------------------------------------+ | TBD22 | Name: sa-MLDSA87-ECDSA-brainpoolP384r1-SHA512 | | (306) | Identifiers: id-MLDSA87-ECDSA-brainpoolP384r1-SHA512 | | | OID: 1.3.6.1.5.5.7.6.50 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 32 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 4731 | +-------+-----------------------------------------------------------+ | TBD23 | Name: sa-MLDSA87-Ed448-SHAKE256 | | (307) | Identifiers: id-MLDSA87-Ed448-SHAKE256 | | | OID: 1.3.6.1.5.5.7.6.51 | Liao Expires 5 May 2027 [Page 9] Internet-Draft C509 PQ Algorithms November 2026 | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 33 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 4741 | +-------+-----------------------------------------------------------+ | TBD24 | Name: sa-MLDSA87-RSA3072-PSS-SHA512 | | (308) | Identifiers: id-MLDSA87-RSA3072-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.52 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 34 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 5011 | +-------+-----------------------------------------------------------+ | TBD25 | Name: sa-MLDSA87-RSA4096-PSS-SHA512 | | (309) | Identifiers: id-MLDSA87-RSA4096-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.53 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 35 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size 5139 | +-------+-----------------------------------------------------------+ | TBD26 | Name: sa-MLDSA87-ECDSA-P521-SHA512 | | (310) | Identifiers: id-MLDSA87-ECDSA-P521-SHA512 | | | OID: 1.3.6.1.5.5.7.6.54 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 36 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | signature: bytes of size at most 4766 | +-------+-----------------------------------------------------------+ 4. Additional Public Key Algorithms This section defines additional entries for the C509 Public Key Algorithms registry established in [I-D.ietf-cose-cbor-encoded-cert]. As required by Section 8.15 of [I-D.ietf-cose-cbor-encoded-cert], a public key algorithm that can only be used with one signature algorithm and that has the same OID as that signature algorithm is assigned the same integer value in both registries. This applies to the ML-DSA, FN-DSA, HSS/LMS, XMSS, XMSS^MT, and composite ML-DSA entries below. The ML-KEM and composite ML-KEM entries have no counterpart in the C509 Signature Algorithms registry. Liao Expires 5 May 2027 [Page 10] Internet-Draft C509 PQ Algorithms November 2026 4.1. ML-DSA Public Keys ML-DSA public keys in X.509 certificates are encoded as specified in [RFC9881]. In C509, the subjectPublicKey field is a byte string containing the raw ML-DSA public key. The values TBD1, TBD2, and TBD3 are the same as in the C509 Signature Algorithms registry. +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD1 | Name: ML-DSA-44 | | (17) | Identifiers: id-ml-dsa-44 | | | OID: 2.16.840.1.101.3.4.3.17 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 11 | | | Comments: FIPS 204; RFC 9881; | | | subjectPublicKey: bytes of size 1312 | +-------+-----------------------------------------------------------+ | TBD2 | Name: ML-DSA-65 | | (18) | Identifiers: id-ml-dsa-65 | | | OID: 2.16.840.1.101.3.4.3.18 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 12 | | | Comments: FIPS 204; RFC 9881; | | | subjectPublicKey: bytes of size 1952 | +-------+-----------------------------------------------------------+ | TBD3 | Name: ML-DSA-87 | | (19) | Identifiers: id-ml-dsa-87 | | | OID: 2.16.840.1.101.3.4.3.19 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 13 | | | Comments: FIPS 204; RFC 9881; | | | subjectPublicKey: bytes of size 2592 | +-------+-----------------------------------------------------------+ 4.2. FN-DSA Public Keys FN-DSA public keys in X.509 certificates are encoded as specified in [I-D.ietf-lamps-fn-dsa-certificates]. In C509, the subjectPublicKey field is a byte string containing the raw FN-DSA public key. The public key sizes are given as TBD until [FIPS206] is finalized. The values TBD4 and TBD5 are the same as in the C509 Signature Algorithms registry. Liao Expires 5 May 2027 [Page 11] Internet-Draft C509 PQ Algorithms November 2026 +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD4 | Name: FN-DSA-512 | | (20) | Identifiers: id-fn-dsa-512 | | | OID: 2.16.840.1.101.3.4.3.TBD | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 TBD | | | Comments: FIPS 206; draft-ietf-lamps-fn-dsa- | | | certificates; | | | subjectPublicKey: bytes of size TBD | +-------+-----------------------------------------------------------+ | TBD5 | Name: FN-DSA-1024 | | (21) | Identifiers: id-fn-dsa-1024 | | | OID: 2.16.840.1.101.3.4.3.TBD | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 03 TBD | | | Comments: FIPS 206; draft-ietf-lamps-fn-dsa- | | | certificates; | | | subjectPublicKey: bytes of size TBD | +-------+-----------------------------------------------------------+ 4.3. ML-KEM Public Keys (Key Encapsulation Mechanism) ML-KEM is a lattice-based key encapsulation mechanism standardized by NIST as [FIPS203] and specified for use in X.509 PKI by [RFC9935]. In C509, the subjectPublicKey field is a byte string containing the raw ML-KEM public key. ML-KEM is not a signature algorithm, so these entries have no counterpart in the C509 Signature Algorithms registry. Liao Expires 5 May 2027 [Page 12] Internet-Draft C509 PQ Algorithms November 2026 +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD27 | Name: ML-KEM-512 | | (14) | Identifiers: id-ml-kem-512 | | | OID: 2.16.840.1.101.3.4.4.1 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 04 01 | | | Comments: FIPS 203; RFC 9935; | | | subjectPublicKey: bytes of size 800 | +-------+-----------------------------------------------------------+ | TBD28 | Name: ML-KEM-768 | | (15) | Identifiers: id-ml-kem-768 | | | OID: 2.16.840.1.101.3.4.4.2 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 04 02 | | | Comments: FIPS 203; RFC 9935; | | | subjectPublicKey: bytes of size 1184 | +-------+-----------------------------------------------------------+ | TBD29 | Name: ML-KEM-1024 | | (16) | Identifiers: id-ml-kem-1024 | | | OID: 2.16.840.1.101.3.4.4.3 | | | Parameters: Absent | | | DER: 30 0B 06 09 60 86 48 01 65 03 04 04 03 | | | Comments: FIPS 203; RFC 9935; | | | subjectPublicKey: bytes of size 1568 | +-------+-----------------------------------------------------------+ 4.4. Stateful Hash-Based Public Keys HSS/LMS, XMSS, and XMSS^MT public keys in X.509 certificates are encoded as specified in [RFC9802]. In C509, the subjectPublicKey field is a byte string containing the raw public key, i.e., the hss_public_key structure of [RFC8554] or the xmss_public_key or xmssmt_public_key structure of [RFC8391]. Its size depends only on the hash output length n of the parameter set: * HSS/LMS: 4 + 24 + n bytes, i.e., 52 bytes for n = 24 and 60 bytes for n = 32. The parameter sets with n = 32 are defined in [RFC8554] and [RFC9858], and those with n = 24 in [RFC9858]. * XMSS and XMSS^MT: 4 + 2n bytes, i.e., 52 bytes for n = 24, 68 bytes for n = 32, and 132 bytes for n = 64. The values TBD6, TBD7, and TBD8 are the same as in the C509 Signature Algorithms registry. Liao Expires 5 May 2027 [Page 13] Internet-Draft C509 PQ Algorithms November 2026 +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD6 | Name: HSS/LMS Hash-based Signature | | (32) | Identifiers: id-alg-hss-lms-hashsig, | | | id-alg-mts-hashsig | | | OID: 1.2.840.113549.1.9.16.3.17 | | | Parameters: Absent | | | DER: 30 0D 06 0B 2A 86 48 86 F7 0D 01 09 10 03 11 | | | Comments: RFC 8554; RFC 9708; RFC 9802; | | | subjectPublicKey: bytes of size 52 or 60 | +-------+-----------------------------------------------------------+ | TBD7 | Name: XMSS Hash-based Signature | | (34) | Identifiers: id-alg-xmss-hashsig | | | OID: 1.3.6.1.5.5.7.6.34 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 22 | | | Comments: RFC 8391; RFC 9802; | | | subjectPublicKey: bytes of size 52, 68, or | | | 132 | +-------+-----------------------------------------------------------+ | TBD8 | Name: XMSS^MT Hash-based Signature | | (35) | Identifiers: id-alg-xmssmt-hashsig | | | OID: 1.3.6.1.5.5.7.6.35 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 23 | | | Comments: RFC 8391; RFC 9802; | | | subjectPublicKey: bytes of size 52, 68, or | | | 132 | +-------+-----------------------------------------------------------+ 4.5. Composite ML-DSA Public Keys In C509, the subjectPublicKey field is a byte string containing the composite public key as serialized by SerializePublicKey in [I-D.ietf-lamps-pq-composite-sigs], i.e., the ML-DSA public key followed by the traditional public key, exactly as in X.509. The traditional component is not re-encoded: RSA public keys remain DER- encoded RSAPublicKey structures, and ECDSA public keys remain uncompressed points. This is the same encoding as used for the pub parameter of composite ML-DSA keys in JOSE and COSE [I-D.ietf-jose-pq-composite-sigs]. The sizes given below for RSA- based composites assume the public exponent 65537. The OIDs are those of the corresponding composite signature algorithms in [I-D.ietf-lamps-pq-composite-sigs], and the values TBD9 through TBD26 are the same as in the C509 Signature Algorithms registry. Liao Expires 5 May 2027 [Page 14] Internet-Draft C509 PQ Algorithms November 2026 +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD9 | Name: pk-MLDSA44-RSA2048-PSS-SHA256 | | (293) | Identifiers: id-MLDSA44-RSA2048-PSS-SHA256 | | | OID: 1.3.6.1.5.5.7.6.37 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 25 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 1582 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD10 | Name: pk-MLDSA44-RSA2048-PKCS15-SHA256 | | (294) | Identifiers: id-MLDSA44-RSA2048-PKCS15-SHA256 | | | OID: 1.3.6.1.5.5.7.6.38 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 26 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 1582 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD11 | Name: pk-MLDSA44-Ed25519-SHA512 | | (295) | Identifiers: id-MLDSA44-Ed25519-SHA512 | | | OID: 1.3.6.1.5.5.7.6.39 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 27 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 1344 | +-------+-----------------------------------------------------------+ | TBD12 | Name: pk-MLDSA44-ECDSA-P256-SHA256 | | (296) | Identifiers: id-MLDSA44-ECDSA-P256-SHA256 | | | OID: 1.3.6.1.5.5.7.6.40 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 28 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 1377 | +-------+-----------------------------------------------------------+ | TBD13 | Name: pk-MLDSA65-RSA3072-PSS-SHA512 | | (297) | Identifiers: id-MLDSA65-RSA3072-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.41 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 29 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2350 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD14 | Name: pk-MLDSA65-RSA3072-PKCS15-SHA512 | | (298) | Identifiers: id-MLDSA65-RSA3072-PKCS15-SHA512 | Liao Expires 5 May 2027 [Page 15] Internet-Draft C509 PQ Algorithms November 2026 | | OID: 1.3.6.1.5.5.7.6.42 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2A | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2350 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD15 | Name: pk-MLDSA65-RSA4096-PSS-SHA512 | | (299) | Identifiers: id-MLDSA65-RSA4096-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.43 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2B | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2478 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD16 | Name: pk-MLDSA65-RSA4096-PKCS15-SHA512 | | (300) | Identifiers: id-MLDSA65-RSA4096-PKCS15-SHA512 | | | OID: 1.3.6.1.5.5.7.6.44 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2C | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2478 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD17 | Name: pk-MLDSA65-ECDSA-P256-SHA512 | | (301) | Identifiers: id-MLDSA65-ECDSA-P256-SHA512 | | | OID: 1.3.6.1.5.5.7.6.45 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2D | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2017 | +-------+-----------------------------------------------------------+ | TBD18 | Name: pk-MLDSA65-ECDSA-P384-SHA512 | | (302) | Identifiers: id-MLDSA65-ECDSA-P384-SHA512 | | | OID: 1.3.6.1.5.5.7.6.46 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2E | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2049 | +-------+-----------------------------------------------------------+ | TBD19 | Name: pk-MLDSA65-ECDSA-brainpoolP256r1-SHA512 | | (303) | Identifiers: id-MLDSA65-ECDSA-brainpoolP256r1-SHA512 | | | OID: 1.3.6.1.5.5.7.6.47 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 2F | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2017 | Liao Expires 5 May 2027 [Page 16] Internet-Draft C509 PQ Algorithms November 2026 +-------+-----------------------------------------------------------+ | TBD20 | Name: pk-MLDSA65-Ed25519-SHA512 | | (304) | Identifiers: id-MLDSA65-Ed25519-SHA512 | | | OID: 1.3.6.1.5.5.7.6.48 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 30 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 1984 | +-------+-----------------------------------------------------------+ | TBD21 | Name: pk-MLDSA87-ECDSA-P384-SHA512 | | (305) | Identifiers: id-MLDSA87-ECDSA-P384-SHA512 | | | OID: 1.3.6.1.5.5.7.6.49 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 31 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2689 | +-------+-----------------------------------------------------------+ | TBD22 | Name: pk-MLDSA87-ECDSA-brainpoolP384r1-SHA512 | | (306) | Identifiers: id-MLDSA87-ECDSA-brainpoolP384r1-SHA512 | | | OID: 1.3.6.1.5.5.7.6.50 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 32 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2689 | +-------+-----------------------------------------------------------+ | TBD23 | Name: pk-MLDSA87-Ed448-SHAKE256 | | (307) | Identifiers: id-MLDSA87-Ed448-SHAKE256 | | | OID: 1.3.6.1.5.5.7.6.51 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 33 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2649 | +-------+-----------------------------------------------------------+ | TBD24 | Name: pk-MLDSA87-RSA3072-PSS-SHA512 | | (308) | Identifiers: id-MLDSA87-RSA3072-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.52 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 34 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2990 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD25 | Name: pk-MLDSA87-RSA4096-PSS-SHA512 | | (309) | Identifiers: id-MLDSA87-RSA4096-PSS-SHA512 | | | OID: 1.3.6.1.5.5.7.6.53 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 35 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | Liao Expires 5 May 2027 [Page 17] Internet-Draft C509 PQ Algorithms November 2026 | | subjectPublicKey: bytes of size 3118 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD26 | Name: pk-MLDSA87-ECDSA-P521-SHA512 | | (310) | Identifiers: id-MLDSA87-ECDSA-P521-SHA512 | | | OID: 1.3.6.1.5.5.7.6.54 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 36 | | | Comments: draft-ietf-lamps-pq-composite-sigs; | | | subjectPublicKey: bytes of size 2725 | +-------+-----------------------------------------------------------+ 4.6. Composite ML-KEM Public Keys Composite ML-KEM combines an ML-KEM component with a traditional key establishment algorithm (RSA-OAEP, ECDH, X25519, or X448) into a single KEM for use in X.509 PKI. These algorithms are defined in [I-D.ietf-lamps-pq-composite-kem], which assigns their OIDs under the PKIX algorithms arc (1.3.6.1.5.5.7.6). These entries have no counterpart in the C509 Signature Algorithms registry. In C509, the subjectPublicKey field is a byte string containing the composite public key as serialized by SerializePublicKey in [I-D.ietf-lamps-pq-composite-kem], i.e., the ML-KEM public key followed by the traditional public key, exactly as in X.509. As for composite ML-DSA (Section 4.5), the traditional component is not re- encoded, and the sizes given below for RSA-based composites assume the public exponent 65537. +-------+-----------------------------------------------------------+ | Value | Public Key Algorithm | +=======+===========================================================+ | TBD30 | Name: pk-MLKEM768-RSA2048-SHA3-256 | | (311) | Identifiers: id-MLKEM768-RSA2048-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.55 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 37 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1454 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD31 | Name: pk-MLKEM768-RSA3072-SHA3-256 | | (312) | Identifiers: id-MLKEM768-RSA3072-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.56 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 38 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1582 | Liao Expires 5 May 2027 [Page 18] Internet-Draft C509 PQ Algorithms November 2026 | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD32 | Name: pk-MLKEM768-RSA4096-SHA3-256 | | (313) | Identifiers: id-MLKEM768-RSA4096-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.57 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 39 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1710 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD33 | Name: pk-MLKEM768-X25519-SHA3-256 | | (314) | Identifiers: id-MLKEM768-X25519-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.58 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3A | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1216 | +-------+-----------------------------------------------------------+ | TBD34 | Name: pk-MLKEM768-ECDH-P256-SHA3-256 | | (315) | Identifiers: id-MLKEM768-ECDH-P256-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.59 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3B | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1249 | +-------+-----------------------------------------------------------+ | TBD35 | Name: pk-MLKEM768-ECDH-P384-SHA3-256 | | (316) | Identifiers: id-MLKEM768-ECDH-P384-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.60 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3C | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1281 | +-------+-----------------------------------------------------------+ | TBD36 | Name: pk-MLKEM768-ECDH-brainpoolP256r1-SHA3-256 | | (317) | Identifiers: id-MLKEM768-ECDH-brainpoolP256r1-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.61 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3D | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1249 | +-------+-----------------------------------------------------------+ | TBD37 | Name: pk-MLKEM1024-RSA3072-SHA3-256 | | (318) | Identifiers: id-MLKEM1024-RSA3072-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.62 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3E | Liao Expires 5 May 2027 [Page 19] Internet-Draft C509 PQ Algorithms November 2026 | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1966 | | | (with RSA public exponent 65537) | +-------+-----------------------------------------------------------+ | TBD38 | Name: pk-MLKEM1024-ECDH-P384-SHA3-256 | | (319) | Identifiers: id-MLKEM1024-ECDH-P384-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.63 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 3F | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1665 | +-------+-----------------------------------------------------------+ | TBD39 | Name: pk-MLKEM1024-ECDH-brainpoolP384r1-SHA3-256 | | (320) | Identifiers: id-MLKEM1024-ECDH-brainpoolP384r1-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.64 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 40 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1665 | +-------+-----------------------------------------------------------+ | TBD40 | Name: pk-MLKEM1024-X448-SHA3-256 | | (321) | Identifiers: id-MLKEM1024-X448-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.65 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 41 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1624 | +-------+-----------------------------------------------------------+ | TBD41 | Name: pk-MLKEM1024-ECDH-P521-SHA3-256 | | (322) | Identifiers: id-MLKEM1024-ECDH-P521-SHA3-256 | | | OID: 1.3.6.1.5.5.7.6.66 | | | Parameters: Absent | | | DER: 30 0A 06 08 2B 06 01 05 05 07 06 42 | | | Comments: draft-ietf-lamps-pq-composite-kem; | | | subjectPublicKey: bytes of size 1701 | +-------+-----------------------------------------------------------+ 5. Use in Other C509 Structures 5.1. Private Keys Section 3.6 of [I-D.ietf-cose-cbor-encoded-cert] defines the C509PrivateKey structure, whose subjectPrivateKeyAlgorithm field takes values from the C509 Public Key Algorithms registry. The entries registered in Section 4 can therefore be used in C509PrivateKey with any C509 private key type, without further definitions in this document. Liao Expires 5 May 2027 [Page 20] Internet-Draft C509 PQ Algorithms November 2026 For example, with C509PrivateKeyType 0, subjectPrivateKey is the PrivateKey OCTET STRING value field of the OneAsymmetricKey structure [RFC5958], encoded as a CBOR byte string. For the algorithms in this document, the PrivateKey content is defined in the following specifications: * ML-DSA: the ML-DSA-44-PrivateKey, ML-DSA-65-PrivateKey, or ML-DSA- 87-PrivateKey defined in [RFC9881], i.e., the 32-byte seed, the expanded private key, or both. * FN-DSA: the FN-DSA-PrivateKey defined in [I-D.ietf-lamps-fn-dsa-certificates], i.e., the seed, whose size is TBD until [FIPS206] is finalized. * ML-KEM: the ML-KEM-512-PrivateKey, ML-KEM-768-PrivateKey, or ML- KEM-1024-PrivateKey defined in [RFC9935], i.e., the 64-byte seed, the expanded private key, or both. * Composite ML-DSA and composite ML-KEM: the composite private key defined in [I-D.ietf-lamps-pq-composite-sigs] and [I-D.ietf-lamps-pq-composite-kem], respectively. With C509PrivateKeyType 1, subjectPrivateKey is a COSE_Key. For example, ML-DSA private keys can be represented as COSE_Key using the Algorithm Key Pair (AKP) key type defined in [RFC9964], and composite ML-DSA private keys using the AKP key type as specified in [I-D.ietf-jose-pq-composite-sigs]. 5.2. Certification Requests A C509 certification request is signed by the subject using the algorithm in subjectSignatureAlgorithm (Section 4.2 of [I-D.ietf-cose-cbor-encoded-cert]). ML-KEM and composite ML-KEM keys cannot produce signatures, so a C509 certification request for such a key cannot prove possession of the private key with its own signature. Another proof-of-possession mechanism is required, which this document does not define. 6. Security Considerations The security considerations of [I-D.ietf-cose-cbor-encoded-cert] apply to all entries registered in this document. For post-quantum algorithms, implementers should consult the respective NIST standards ([FIPS203], [FIPS204], [FIPS206]) for guidance on security levels and parameter sets. Liao Expires 5 May 2027 [Page 21] Internet-Draft C509 PQ Algorithms November 2026 HSS/LMS, XMSS, and XMSS^MT are stateful signature schemes: each one- time key MUST be used to sign at most one message, and the signer has to update its private key state reliably after each signature. Reusing a one-time key undermines the security of the scheme; see the security considerations of [RFC8554], [RFC8391], and [RFC9802]. Copying or restoring the private key state, for example by exporting it in a private key structure, can lead to such reuse. 7. IANA Considerations 7.1. C509 Signature Algorithms Registry IANA is requested to register the entries defined in Section 3 in the "C509 Signature Algorithms" registry within the "CBOR Encoded X.509 (C509)" registry group, following the registration policy defined in [I-D.ietf-cose-cbor-encoded-cert]. 7.2. C509 Public Key Algorithms Registry IANA is requested to register the entries defined in Section 4 in the "C509 Public Key Algorithms" registry within the "CBOR Encoded X.509 (C509)" registry group, following the registration policy defined in [I-D.ietf-cose-cbor-encoded-cert]. Per Section 8.15 of [I-D.ietf-cose-cbor-encoded-cert], the public key algorithm entries TBD1 through TBD26 MUST be assigned the same values as the corresponding entries in the "C509 Signature Algorithms" registry. 7.3. Suggested Values _RFC Editor's Note:_ Please remove this section before publication. Values in the interval [0, 23] are encoded in one byte, values in the interval [24, 255] in two bytes, and values in the interval [256, 65535] in three bytes (Section 8.1 of [I-D.ietf-cose-cbor-encoded-cert]). Negative values are used in [I-D.ietf-cose-cbor-encoded-cert] mainly for deprecated algorithms, such as those based on SHA-1, and are not suggested for the algorithms in this document. The public keys and signatures of these algorithms are hundreds to thousands of bytes long, so saving one byte per algorithm identifier has little effect on certificate size, whereas the one-byte interval is small. The following assignments are therefore suggested. The suggested value of each entry is also given in parentheses below its TBD value in the tables of Section 3 and Section 4. Liao Expires 5 May 2027 [Page 22] Internet-Draft C509 PQ Algorithms November 2026 * ML-DSA (TBD1 through TBD3): 17, 18, and 19, i.e., values from the interval [0, 23] that are unassigned in both registries, as ML-DSA is expected to be widely used. * FN-DSA (TBD4 and TBD5): 20 and 21, i.e., values from the interval [0, 23] that are unassigned in both registries, as its compact public keys and signatures make FN-DSA well suited to constrained environments. * ML-KEM (TBD27 through TBD29): 14, 15, and 16, i.e., values from the interval [0, 23] that are unassigned in the "C509 Public Key Algorithms" registry. In the "C509 Signature Algorithms" registry, these values are assigned to non-signature proof-of- possession algorithms; this is no conflict, as ML-KEM has no entry in that registry. * HSS/LMS (TBD6): 32, a value from the interval [24, 255] that is unassigned in both registries. * XMSS and XMSS^MT (TBD7 and TBD8): the last arc of the OID under the PKIX algorithms arc (1.3.6.1.5.5.7.6), i.e., 34 and 35. These values are from the interval [24, 255] and are unassigned in both registries. * Composite ML-DSA and composite ML-KEM (TBD9 through TBD26 and TBD30 through TBD41): 256 plus the last arc of the OID under the PKIX algorithms arc (1.3.6.1.5.5.7.6), i.e., 293 through 310 for composite ML-DSA, and 311 through 322 for composite ML-KEM. These values are from the interval [256, 65535] and are unassigned in both registries. Composite algorithms are numerous and intended for the transition to post-quantum cryptography, and their public keys and signatures are among the largest in this document, so the additional byte is negligible, and the interval [24, 255] is left for other algorithms. 8. References 8.1. Normative References [FIPS203] National Institute of Standards and Technology (NIST), "Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)", DOI 10.6028/NIST.FIPS.203, 2024, . [FIPS204] National Institute of Standards and Technology (NIST), "Module-Lattice-Based Digital Signature Standard (FIPS 204)", DOI 10.6028/NIST.FIPS.204, 2024, . Liao Expires 5 May 2027 [Page 23] Internet-Draft C509 PQ Algorithms November 2026 [FIPS206] National Institute of Standards and Technology (NIST), "FN-DSA: FFT over NTRU-Lattice-Based Digital Signature Algorithm (FIPS 206)". [I-D.ietf-cose-cbor-encoded-cert] Mattsson, J. P., Selander, G., Raza, S., Höglund, J., Furuhed, M., and L. Liao, "CBOR Encoded X.509 Certificates (C509 Certificates)", Work in Progress, Internet-Draft, draft-ietf-cose-cbor-encoded-cert-21, 24 September 2026, . [I-D.ietf-lamps-fn-dsa-certificates] Massimo, J., Kampanakis, P., Turner, S., and B. Westerbaan, "Internet X.509 Public Key Infrastructure -- Algorithm Identifiers for the Fast-Fourier Transform over NTRU-Lattice-Based Digital Signature Algorithm (FN-DSA)", Work in Progress, Internet-Draft, draft-ietf-lamps-fn-dsa- certificates-00, 20 May 2026, . [I-D.ietf-lamps-pq-composite-kem] Ounsworth, M., Gray, J., Pala, M., Klaußner, J., and S. Fluhrer, "Composite ML-KEM for use in X.509 Public Key Infrastructure", Work in Progress, Internet-Draft, draft- ietf-lamps-pq-composite-kem-23, 14 October 2026, . [I-D.ietf-lamps-pq-composite-sigs] Ounsworth, M., Gray, J., Pala, M., Klaußner, J., and S. Fluhrer, "Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for use in X.509 Public Key Infrastructure", Work in Progress, Internet-Draft, draft- ietf-lamps-pq-composite-sigs-19, 21 April 2026, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . Liao Expires 5 May 2027 [Page 24] Internet-Draft C509 PQ Algorithms November 2026 [RFC8391] Huelsing, A., Butin, D., Gazdag, S., Rijneveld, J., and A. Mohaisen, "XMSS: eXtended Merkle Signature Scheme", RFC 8391, DOI 10.17487/RFC8391, May 2018, . [RFC8554] McGrew, D., Curcio, M., and S. Fluhrer, "Leighton-Micali Hash-Based Signatures", RFC 8554, DOI 10.17487/RFC8554, April 2019, . [RFC8949] Bormann, C. and P. Hoffman, "Concise Binary Object Representation (CBOR)", STD 94, RFC 8949, DOI 10.17487/RFC8949, December 2020, . [RFC9708] Housley, R., "Use of the HSS/LMS Hash-Based Signature Algorithm in the Cryptographic Message Syntax (CMS)", RFC 9708, DOI 10.17487/RFC9708, January 2025, . [RFC9802] Van Geest, D., Bashiri, K., Fluhrer, S., Gazdag, S., and S. Kousidis, "Use of the HSS and XMSS Hash-Based Signature Algorithms in Internet X.509 Public Key Infrastructure", RFC 9802, DOI 10.17487/RFC9802, June 2025, . [RFC9881] Massimo, J., Kampanakis, P., Turner, S., and B. E. Westerbaan, "Internet X.509 Public Key Infrastructure -- Algorithm Identifiers for the Module-Lattice-Based Digital Signature Algorithm (ML-DSA)", RFC 9881, DOI 10.17487/RFC9881, October 2025, . [RFC9935] Turner, S., Kampanakis, P., Massimo, J., and B. E. Westerbaan, "Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key- Encapsulation Mechanism (ML-KEM)", RFC 9935, DOI 10.17487/RFC9935, March 2026, . 8.2. Informative References [I-D.ietf-jose-pq-composite-sigs] Prabel, L., Shuzhou, S., Gray, J., and T. Reddy.K, "PQ/T Hybrid Composite Signatures for JOSE and COSE", Work in Progress, Internet-Draft, draft-ietf-jose-pq-composite- sigs-06, 20 October 2026, . Liao Expires 5 May 2027 [Page 25] Internet-Draft C509 PQ Algorithms November 2026 [RFC5958] Turner, S., "Asymmetric Key Packages", RFC 5958, DOI 10.17487/RFC5958, August 2010, . [RFC9858] Fluhrer, S. and Q. Dang, "Additional Parameter Sets for HSS/LMS Hash-Based Signatures", RFC 9858, DOI 10.17487/RFC9858, October 2025, . [RFC9964] Prorock, M. and O. Steele, "ML-DSA for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)", RFC 9964, DOI 10.17487/RFC9964, May 2026, . Appendix A. Examples TBD: add examples Change Log _RFC Editor's Note:_ Please remove this section before publication. Changes from draft-liao-cose-c509-algorithms-00 * Renamed the document from draft-liao-cose-c509-algorithms to draft-liao-cose-c509-pq-algorithms to reflect its scope. * Aligned with draft-ietf-cose-cbor-encoded-cert-21: - Used the registry group name "CBOR Encoded X.509 (C509)". - Gave the DER column as the DER encoding of the complete AlgorithmIdentifier and wrote "Absent" for absent parameters. - Referred to the signature value as issuerSignatureValue or subjectSignatureValue. - Referenced Section 8.15 of that document for assigning the same value in the signature and public key algorithm registries, and moved this requirement from Security Considerations to IANA Considerations. * Changed the encoding of composite public keys and signatures from a two-element CBOR array to the serialization defined in [I-D.ietf-lamps-pq-composite-sigs] and [I-D.ietf-lamps-pq-composite-kem], i.e., the same byte string as in X.509. Liao Expires 5 May 2027 [Page 26] Internet-Draft C509 PQ Algorithms November 2026 * Added FN-DSA signature and public key algorithms. * Renumbered the TBD values to follow the order of the document. * Specified the context string for natively signed ML-DSA, FN-DSA, and composite ML-DSA signatures. * Specified the public key sizes of HSS/LMS, XMSS, and XMSS^MT. * Added suggested values to the IANA considerations and to the registry tables. * Added a section on the use of the registered algorithms in C509 private keys and certification requests. * Added security considerations for stateful hash-based signature algorithms. * Removed unused references. * Editorial improvements. Acknowledgements The authors would like to thank xxx for reviewing and commenting on earlier versions of this document. Author's Address Lijun Liao NIO Inc. Email: lijun.liao@nio.io Liao Expires 5 May 2027 [Page 27]