Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 16
Abstract: This specification refers to cryptographic algorithm identifiers that fully specify the cryptographic operations to be performed, including any curve, key derivation function (KDF), and hash functions, as being "fully specified". It refers to cryptographic algorithm identifiers that require additional information beyond the algorithm identifier to determine the cryptographic operations to be performed as being "polymorphic". This specification creates fully-specified algorithm identifiers for registered JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) polymorphic algorithm identifiers, enabling applications to use only fully-specified algorithm identifiers. It deprecates those polymorphic algorithm identifiers. This specification updates RFCs 7518, 8037, and 9053. It deprecates polymorphic algorithms defined by RFCs 8037 and 9053 and provides fully-specified replacements for them. It adds to the instructions to designated experts in RFCs 7518 and 9053.
Publication Date: 2025-10-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9864
Link: https://doi.org/10.17487/RFC9864
Author(s): Michael B. Jones
Orie Steele
Keyword(s): Cryptographic Algorithm Identifiers, JOSE, COSE

Latest version of IETF RFC 9864

Document Versions — IETF RFC 9864

▶ IETF RFC 9864 (2025-10-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
RFC7516 — JWE EXTERNAL
RFC8037 — RFC8037 EXTERNAL
IETF RFC 8174 [Active*]
IETF RFC 9052 [Active*]
IETF RFC 9053 [Active*]

Bibliographic Reference(s)

NIST FIPS 140-3 [Active]
Thormarker, E., "On using the same key pair for Ed25519 and an X25519 based KEM", 23 April 2021, <https://eprint.iacr.org/2021/509.pdf>. EXTERNAL
Bradley, J., Jones, M.B., Kumar, A., Lindemann, R., Verrept, J., and D. Waite, "Client to Authenticator Protocol (CTAP)", FIDO Alliance Proposed Standard, 14 July 2025, <https://fidoalliance.org/specs/fido-v2.2-ps-20250714/fido-client-to-authenticator-protocol-v2.2-ps-20250714.html>. EXTERNAL
IANA, "CBOR Object Signing and Encryption (COSE)", <https://www.iana.org/assignments/cose/>. EXTERNAL
IANA, "JSON Object Signing and Encryption (JOSE)", <https://www.iana.org/assignments/jose/>. EXTERNAL
Sakimura, N., Bradley, J., Jones, M., and E. Jay, "OpenID Connect Discovery 1.0 incorporating errata set 2", 15 December 2023, <https://openid.net/specs/openid-connect-discovery-1_0.html>. EXTERNAL
RFC7518 — JWA EXTERNAL
IETF RFC 8032 [Active*]
IETF RFC 8126 [Active*]
IETF RFC 8152 [Superseded*]
RFC8414 — RFC8414 EXTERNAL
IETF RFC 8996 [Active*]
RFC9054 — RFC9054 EXTERNAL
RFC9459 — RFC9459 EXTERNAL
W3C.webauthn-2.20210408 — W3C.WebAuthn EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9864.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9864, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE). Available at https://doi.org/10.17487/RFC9864

Snippet:

IETF RFC 9864, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE). Available at https://doi.org/10.17487/RFC9864

HTML (ISO 690 compliant)

Preview:

IETF RFC 9864, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE). Available at https://doi.org/10.17487/RFC9864

Snippet:

<span class="citation"><cite>IETF RFC 9864</cite>, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE). Available at <a href="https://doi.org/10.17487/RFC9864" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9864</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9864, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)
doi: 10.17487/RFC9864
url: https://doi.org/10.17487/RFC9864

Snippet:

<li>
<cite id="bib-rfc9864">IETF RFC 9864</cite>, Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)
<span class="doi">10.17487/RFC9864</span>
</li>