Ascon-AEAD128 and Ascon-Hash256 for COSE
draft-ochkas-cose-ascon-05
This document is an Internet-Draft (I-D).
Anyone may submit an I-D to the IETF.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (individual) | |
|---|---|---|---|
| Authors | Dmytro Ochkas , Hélène Le Bouder , Alexander Pelov , Stefan Hristozov | ||
| Last updated | 2026-10-26 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| On agenda | cose at IETF-127 | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-ochkas-cose-ascon-05
COSE Working Group D. Ochkas
Internet-Draft H. Le Bouder
Intended status: Informational A. Pelov
Expires: 29 April 2027 IMT Atlantique
S. Hristozov
Infineon
26 October 2026
Ascon-AEAD128 and Ascon-Hash256 for COSE
draft-ochkas-cose-ascon-05
Abstract
This document describes CBOR Object Signing and Encryption (COSE)
serialization with Ascon, a NIST standard for lightweight
cryptography.
In 2019, as a part of CAESAR competition, Ascon-128 and Ascon-128a
were selected as the first choice for the lightweight authenticated
encryption. After, in 2023, National Institute of Standards and
Technology (NIST) selected Ascon family of cryptographic algorithms
to be the standard for lightweight cryptography. In August 2025,
NIST Special Publication 800-232 was released, defining Ascon-based
lightweight cryptography standards for constrained devices. This
recognition makes it particularly interesting to enable using Ascon
with COSE structures.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 29 April 2027.
Ochkas, et al. Expires 29 April 2027 [Page 1]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Ascon algorithms for COSE . . . . . . . . . . . . . . . . . . 4
3.1. Ascon-AEAD128 . . . . . . . . . . . . . . . . . . . . . . 4
3.2. Ascon-Hash256 . . . . . . . . . . . . . . . . . . . . . . 5
3.2.1. Ascon-Hash256 for direct usage . . . . . . . . . . . 6
3.2.2. Ascon-Hash256 for MAC operations . . . . . . . . . . 6
3.2.3. Ascon-Hash256 for KDF operations . . . . . . . . . . 7
3.3. Ascon-MAC . . . . . . . . . . . . . . . . . . . . . . . . 10
3.3.1. Ascon-MAC for MAC operations . . . . . . . . . . . . 10
3.3.2. Ascon-MAC for KDF operations . . . . . . . . . . . . 10
4. Security Considerations . . . . . . . . . . . . . . . . . . . 12
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
5.1. Additions to COSE Algorithms Registry . . . . . . . . . . 13
5.1.1. Ascon-AEAD128 for COSE . . . . . . . . . . . . . . . 13
5.1.2. Ascon-AEAD128/64 for COSE . . . . . . . . . . . . . . 13
5.1.3. Ascon-AEAD128/32 for COSE . . . . . . . . . . . . . . 14
5.1.4. Ascon-Hash256 for COSE . . . . . . . . . . . . . . . 14
5.1.5. Ascon-Hash256/64 for COSE . . . . . . . . . . . . . . 14
5.1.6. HMAC Ascon-Hash256 for COSE . . . . . . . . . . . . . 14
5.1.7. HMAC Ascon-Hash256/64 for COSE . . . . . . . . . . . 15
5.1.8. direct+HKDF-Ascon-Hash256 for COSE . . . . . . . . . 15
5.1.9. ECDH-ES+HKDF-Ascon-Hash256 for COSE . . . . . . . . . 15
5.1.10. ECDH-SS+HKDF-Ascon-Hash256 for COSE . . . . . . . . . 16
5.1.11. Ascon-MAC for COSE . . . . . . . . . . . . . . . . . 16
5.1.12. Ascon-MAC/64 for COSE . . . . . . . . . . . . . . . . 16
5.1.13. direct+KDF-Ascon-MAC for COSE . . . . . . . . . . . . 16
5.1.14. ECDH-ES+KDF-Ascon-MAC for COSE . . . . . . . . . . . 17
5.1.15. ECDH-SS+KDF-Ascon-MAC for COSE . . . . . . . . . . . 17
5.2. Additions to COSE Header Algorithm Parameters Registry . 17
5.2.1. salt . . . . . . . . . . . . . . . . . . . . . . . . 17
5.2.2. PartyU identity . . . . . . . . . . . . . . . . . . . 18
Ochkas, et al. Expires 29 April 2027 [Page 2]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
5.2.3. PartyU nonce . . . . . . . . . . . . . . . . . . . . 18
5.2.4. PartyU other . . . . . . . . . . . . . . . . . . . . 18
5.2.5. PartyV identity . . . . . . . . . . . . . . . . . . . 18
5.2.6. PartyV nonce . . . . . . . . . . . . . . . . . . . . 18
5.2.7. PartyV other . . . . . . . . . . . . . . . . . . . . 18
5.2.8. ephemeral key . . . . . . . . . . . . . . . . . . . . 18
5.2.9. static key . . . . . . . . . . . . . . . . . . . . . 18
5.2.10. static key id . . . . . . . . . . . . . . . . . . . . 18
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 19
6.1. Normative References . . . . . . . . . . . . . . . . . . 19
6.2. Informative References . . . . . . . . . . . . . . . . . 19
Appendix A. Examples . . . . . . . . . . . . . . . . . . . . . . 20
A.1. COSE Content Encryption . . . . . . . . . . . . . . . . . 20
A.1.1. Simple Ascon-AEAD128 encryption . . . . . . . . . . . 20
A.1.2. Direct Ascon-AEAD128 encryption with recipient . . . 20
A.1.3. Direct Ascon-AEAD128 encryption with HKDF-SHA-256 . . 21
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21
1. Introduction
Constrained networks such as Internet of Things (IoT) networks most
of the time are characterized by the limited computational power and
energy. In this context, the choice of suitable cryptographic suites
that provide reliable security without consuming large amount of
resources is essential. As a winner of the lightweight cryptography
standardization process conducted by NIST, Ascon algorithms are the
perfect candidates to fit into the described use case. The Ascon
family offers a low computational cost that translates into lower
latency, reduced energy consumption, and higher throughput compared
to traditional crypto algorithms. Moreover, all Ascon algorithms
share a single permutation function allowing for a drastic reduction
of memory footprint.
Ascon-Based Lightweight Cryptography Standards for Constrained
Devices [NIST.SP.800-232] introduces a suite of algorithms consisting
of Ascon-AEAD128, an authenticated encryption with associated data
(AEAD) algorithm; Ascon-Hash256, a hash function; and two eXtendable
Output Functions (XOFs).
This document focuses on the usage of Ascon-AEAD128 for content
encryption, Ascon-Hash256 for hashing, Key Derivation Function (KDF)
and Message Authentication Code (MAC) operations, and Ascon-MAC for
KDF and MAC operations.
This document does not define any new cryptography, only
serializations of existing cryptographic systems described in
[NIST.SP.800-232].
Ochkas, et al. Expires 29 April 2027 [Page 3]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
3. Ascon algorithms for COSE
3.1. Ascon-AEAD128
This document introduces Ascon-AEAD128 for COSE content encryption.
Ascon AEAD algorithm is parametrized by the key size k, the nonce
size n, the tag size t, the rate r, and the number of outer
permutation rounds a and the number of inner permutation rounds b.
[NIST.SP.800-232] specifies the Ascon-AEAD128 parameters with the
following numerical values.
+=========+=========+=========+=======+=============+=============+
| Key | Nonce | Tag | Rate, | Outer | Inner |
| size, k | size, n | size, t | r | permutation | permutation |
| | | | | rounds, a | rounds, b |
+=========+=========+=========+=======+=============+=============+
| 128 | 128 | 32-128 | 128 | 12 | 8 |
| bits | bits | bits | bits | | |
+---------+---------+---------+-------+-------------+-------------+
Table 1: Ascon-AEAD128 parameters
Note that the standard permits tag sizes t between 32 and 128 bits.
Tags of less than 64 bits SHALL only be selected after a careful risk
analysis.
Since COSE can be used in a variety of scenarios, this document
requests to register three configurations of Ascon-AEAD128 in
[IANA.cose] with tag sizes of 32, 64, and 128 bits (see Table 2).
Using the 32-bit variation is discouraged for typical scenarios and
SHOULD be introduced only in extremely constrained use cases with
justified security.
Ochkas, et al. Expires 29 April 2027 [Page 4]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
+==================+================+============================+
| Name | alg | Description |
+==================+================+============================+
| Ascon-AEAD128 | TBD (requested | Ascon-AEAD128 with 128-bit |
| | assignment 35) | tag as the CBOR Object |
| | | Encryption Algorithm |
+------------------+----------------+----------------------------+
| Ascon-AEAD128/64 | TBD (requested | Ascon-AEAD128 with 64-bit |
| | assignment 36) | tag as the CBOR Object |
| | | Encryption Algorithm |
+------------------+----------------+----------------------------+
| Ascon-AEAD128/32 | TBD (requested | Ascon-AEAD128 with 32-bit |
| | assignment 37) | tag as the CBOR Object |
| | | Encryption Algorithm |
+------------------+----------------+----------------------------+
Table 2: New COSE AEAD algorithms with Ascon
In COSE, keys may be obtained from either a key structure or a
recipient structure [RFC9052].
When using a COSE key for this algorithm, the following checks are
made:
* The "kty" field MUST be present, and it MUST be "Symmetric".
* If the "alg" field is present, it MUST match the variation of
Ascon-AEAD128 algorithm being used.
* If the "key_ops" field is present, it MUST include "encrypt" when
encrypting.
* If the "key_ops" field is present, it MUST include "decrypt" when
decrypting.
COSE encryption and decryption with Ascon-AEAD128 MUST be done in
accordance with Section 5.3 of [RFC9052].
3.2. Ascon-Hash256
This document introduces Ascon-Hash256 for direct operations, Key
Derivation Function (KDF) and Message Authentication Code (MAC) COSE
operations. Ascon hash algorithm is parametrized by the rate r, the
number of permutation rounds a, and the length of output l.
[NIST.SP.800-232] specifies the Ascon-Hash256 parameters with the
following numerical values.
Ochkas, et al. Expires 29 April 2027 [Page 5]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
+=========+=======================+==================+
| Rate, r | Permutation rounds, a | Output length, l |
+=========+=======================+==================+
| 64 bits | 12 | 256 bits |
+---------+-----------------------+------------------+
Table 3: Ascon-Hash256 parameters
3.2.1. Ascon-Hash256 for direct usage
In COSE, hash algorithms are used directly, for example, for object
identification with a fingerprint, or indirect signatures (see
[RFC9054]). Table 4 specifies two Ascon-Hash256 algorithms for COSE
to satisfy these use cases.
+==================+============+==============+======+=============+
| Name | Value | Description | | Recommended |
+==================+============+==============+======+=============+
| Ascon-Hash256 | TBD | Ascon |Yes | |
| | (requested | 256-bit | | |
| | assignment | hash | | |
| | -20) | | | |
+------------------+------------+--------------+------+-------------+
| Ascon-Hash256/64 | TBD | Ascon |Filter| |
| | (requested | 256-bit |Only | |
| | assignment | hash | | |
| | -21) | truncated | | |
| | | to 64 bits | | |
+------------------+------------+--------------+------+-------------+
Table 4: New COSE hash algorithms with Ascon
The truncated version the Ascon hash allows for a smaller
transmission overhead but with a higher risk of collision. Using
this algorithm requires risk analysis or must be limited to
noncryptographic use cases (see Section 2 of [RFC9054]).
3.2.2. Ascon-Hash256 for MAC operations
In COSE, integration Ascon-Hash256 for MAC operations SHALL be
implemented via HMAC algorithm [RFC2104]. This algorithm is
described in Table 5.
Ochkas, et al. Expires 29 April 2027 [Page 6]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
+==================+==========+=============+======+===============+
| Name |Value |Hash |Tag | Description |
| | | |Length| |
+==================+==========+=============+======+===============+
| HMAC Ascon- |TBD |Ascon-Hash256|256 | HMAC w/ |
| Hash256 |(requested| |bits | Ascon-Hash256 |
| |assigment | | | |
| |8) | | | |
+------------------+----------+-------------+------+---------------+
| HMAC Ascon- |TBD |Ascon-Hash256|64 | HMAC w/ |
| Hash256/64 |(requested| |bits | Ascon-Hash256 |
| |assigment | | | truncated to |
| |9) | | | 64 bits |
+------------------+----------+-------------+------+---------------+
Table 5: New COSE MAC algorithms with Ascon
The creation and verification of COSE MAC using the algorithms from
Table 5 MUST follow Section 6.3 of [RFC9052].
3.2.3. Ascon-Hash256 for KDF operations
In COSE, integration Ascon-Hash256 for KDF operations SHALL be done
via HMAC-based Extract-and-Expand KDF (HKDF) defined in [RFC5869].
HKDF leverages HMAC mechanism described in [RFC2104]. HMAC is an
algorithm allowing usage of arbirtary cryptographic hash functions
for message authentication. This KDF is described in Table 6.
+====================+=========================+====================+
| Name | PRF | Description |
+====================+=========================+====================+
| HKDF Ascon-Hash256 | HMAC with | HKDF using HMAC |
| | Ascon-Hash256 | with Ascon-Hash256 |
+--------------------+-------------------------+--------------------+
Table 6: New COSE KDF algorithms with Ascon
In addition to application-specific usage, COSE KDFs are used for
Direct Key with KDF and Direct Key Agreement key distribution
methods. To introduce this functionality with Ascon, this document
requests the registration of the following recipient algorithms:
Direct Key with HKDF Ascon-Hash256, Key Agreement with Ephemeral-
Static (ES) Ellyptic-Curve Diffie-Hellman (ECDH), and Key Agreement
with Static-Static (SS) ECDH. These algorithms are defined in
Table 7.
Ochkas, et al. Expires 29 April 2027 [Page 7]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
+==========================+==========+=============+=============+
|Name |Value | KDF |Description |
+==========================+==========+=============+=============+
|direct+HKDF-Ascon-Hash256 |TBD | HKDF Ascon- |Shared secret|
| |(requested| Hash256 |w/ HKDF |
| |assigment | |Ascon-Hash256|
| |-22) | | |
+--------------------------+----------+-------------+-------------+
|ECDH-ES+HKDF-Ascon-Hash256|TBD | HKDF Ascon- |ECDH ES w/ |
| |(requested| Hash256 |HKDF Ascon- |
| |assigment | |Hash256 |
| |-23) | | |
+--------------------------+----------+-------------+-------------+
|ECDH-SS+HKDF-Ascon-Hash256|TBD | HKDF Ascon- |ECDH SS w/ |
| |(requested| Hash256 |HKDF Ascon- |
| |assigment | |Hash256 |
| |-24) | | |
+--------------------------+----------+-------------+-------------+
Table 7: New COSE recipient algorithms with HKDF Ascon-Hash256
To accomodate the new algorithms specified in Table 6, this document
extends the relevant header algorithm parameters as shown in Table 8.
+===========+=======+==========+====================+=============+
| Name | Label | Type | New Algorithm | Description |
+===========+=======+==========+====================+=============+
| salt | -20 | bstr | direct+HKDF-Ascon- | Random salt |
| | | | Hash256,ECDH- | |
| | | | ES+HKDF-Ascon- | |
| | | | Hash256,ECDH- | |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| PartyU | -21 | bstr | direct+HKDF-Ascon- | PartyU |
| identity | | | Hash256,ECDH- | identity |
| | | | ES+HKDF-Ascon- | information |
| | | | Hash256,ECDH- | |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| PartyU | -22 | bstr/int | direct+HKDF-Ascon- | PartyU |
| nonce | | | Hash256,ECDH- | provided |
| | | | ES+HKDF-Ascon- | nonce |
| | | | Hash256,ECDH- | |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
Ochkas, et al. Expires 29 April 2027 [Page 8]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
| PartyU | -23 | bstr | direct+HKDF-Ascon- | PartyU |
| other | | | Hash256,ECDH- | other |
| | | | ES+HKDF-Ascon- | provided |
| | | | Hash256,ECDH- | information |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| PartyV | -24 | bstr | direct+HKDF-Ascon- | PartyV |
| identity | | | Hash256,ECDH- | identity |
| | | | ES+HKDF-Ascon- | information |
| | | | Hash256,ECDH- | |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| PartyV | -25 | bstr/int | direct+HKDF-Ascon- | PartyV |
| nonce | | | Hash256,ECDH- | provided |
| | | | ES+HKDF-Ascon- | nonce |
| | | | Hash256,ECDH- | |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| PartyV | -26 | bstr | direct+HKDF-Ascon- | PartyV |
| other | | | Hash256,ECDH- | other |
| | | | ES+HKDF-Ascon- | provided |
| | | | Hash256,ECDH- | information |
| | | | SS+HKDF-Ascon- | |
| | | | Hash256 | |
+-----------+-------+----------+--------------------+-------------+
| ephemeral | -1 | COSE_Key | ECDH-ES+HKDF- | Ephemeral |
| key | | | Ascon-Hash256 | public key |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+--------------------+-------------+
| static | -2 | COSE_Key | ECDH-SS+HKDF- | Static |
| key | | | Ascon-Hash256 | public key |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+--------------------+-------------+
| static | -3 | bstr | ECDH-SS+HKDF- | Static |
| key id | | | Ascon-Hash256 | public key |
| | | | | identifier |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+--------------------+-------------+
Table 8: Updates to COSE header algorithm parameters
Ochkas, et al. Expires 29 April 2027 [Page 9]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
The direct+HKDF-Ascon-Hash256 algorithm MUST be used as described in
Section 8.5.1 of [RFC9052] and Section 6.1.2 of [RFC9053]. The ECDH-
ES+HKDF-Ascon-Hash256 and ECDH-SS+HKDF-Ascon-Hash256 algorithms MUST
be used as described in Section 8.5.4 of [RFC9052] and Section 6.3.1
of [RFC9053].
3.3. Ascon-MAC
_Note: NIST is yet to standardize Ascon algorithms for MAC and KDF.
So this section can be modified based on the upcoming Ascon NIST
publication_
This document introduces Ascon-MAC for KDF and MAC COSE operations.
3.3.1. Ascon-MAC for MAC operations
In COSE, Ascon-MAC for MAC operations SHALL be used directly. This
algorithm is described in Table 9.
+==============+=======+===========+========+=====================+
| Name | Value | MAC | Tag | Description |
| | | | Length | |
+==============+=======+===========+========+=====================+
| Ascon-MAC | TBD | Ascon-MAC | 256 | Ascon MAC |
| | | | bits | |
+--------------+-------+-----------+--------+---------------------+
| Ascon-MAC/64 | TBD | Ascon-MAC | 64 | Ascon MAC truncated |
| | | | bits | to 64 bits |
+--------------+-------+-----------+--------+---------------------+
Table 9: New COSE MAC algorithms with Ascon-MAC
The creation and verification of COSE MAC using the algorithms from
Table 9 MUST follow Section 6.3 of [RFC9052].
3.3.2. Ascon-MAC for KDF operations
In COSE, Ascon-MAC SHALL be used directly as PRF for KDF operations,
similarly to KMAC [NIST.SP.800-108r1-upd1].
+===============+===========+============================+
| Name | PRF | Description |
+===============+===========+============================+
| Ascon-MAC KDF | Ascon-MAC | KDF using Ascon-MAC as PRF |
+---------------+-----------+----------------------------+
Table 10: New COSE KDF algorithms with Ascon-MAC
Ochkas, et al. Expires 29 April 2027 [Page 10]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
In addition to application-specific usage, COSE KDFs are used for
Direct Key with KDF and Direct Key Agreement key distribution
methods. To introduce this functionality with Ascon, this document
requests the registration of the following recipient algorithms:
Direct Key with HKDF Ascon-Hash256, Key Agreement with Ephemeral-
Static (ES) Ellyptic-Curve Diffie-Hellman (ECDH), and Key Agreement
with Static-Static (SS) ECDH. These algorithms are defined in
Table 11.
+=======================+=======+===============+==================+
| Name | Value | KDF | Description |
+=======================+=======+===============+==================+
| direct+KDF-Ascon-MAC | TBD | Ascon-MAC KDF | Shared secret w/ |
| | | | Ascon-MAC KDF |
+-----------------------+-------+---------------+------------------+
| ECDH-ES+KDF-Ascon-MAC | TBD | Ascon-MAC KDF | ECDH ES w/ |
| | | | Ascon-MAC KDF |
+-----------------------+-------+---------------+------------------+
| ECDH-SS+KDF-Ascon-MAC | TBD | Ascon-MAC KDF | ECDH SS w/ |
| | | | Ascon-MAC KDF |
+-----------------------+-------+---------------+------------------+
Table 11: New COSE recipient algorithms with Ascon-MAC KDF
To accomodate the new algorithms specified in Table 10, this document
extends the relevant header algorithm parameters as shown in
Table 12.
+===========+=======+==========+===================+================+
| Name | Label | Type | New Algorithm | Description |
+===========+=======+==========+===================+================+
| salt | -20 | bstr | direct+KDF-Ascon- | Random salt |
| | | | MAC,ECDH-ES+KDF- | |
| | | | Ascon-MAC,ECDH- | |
| | | | SS+KDF-Ascon-MAC | |
+-----------+-------+----------+-------------------+----------------+
| PartyU | -21 | bstr | direct+KDF-Ascon- | PartyU |
| identity | | | MAC,ECDH-ES+KDF- | identity |
| | | | Ascon-MAC,ECDH- | information |
| | | | SS+KDF-Ascon-MAC | |
+-----------+-------+----------+-------------------+----------------+
| PartyU | -22 | bstr/int | direct+KDF-Ascon- | PartyU |
| nonce | | | MAC,ECDH-ES+KDF- | provided |
| | | | Ascon-MAC,ECDH- | nonce |
| | | | SS+KDF-Ascon-MAC | |
+-----------+-------+----------+-------------------+----------------+
| PartyU | -23 | bstr | direct+KDF-Ascon- | PartyU |
| other | | | MAC,ECDH-ES+KDF- | other |
Ochkas, et al. Expires 29 April 2027 [Page 11]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
| | | | Ascon-MAC,ECDH- | provided |
| | | | SS+KDF-Ascon-MAC | information |
+-----------+-------+----------+-------------------+----------------+
| PartyV | -24 | bstr | direct+KDF-Ascon- | PartyV |
| identity | | | MAC,ECDH-ES+KDF- | identity |
| | | | Ascon-MAC,ECDH- | information |
| | | | SS+KDF-Ascon-MAC | |
+-----------+-------+----------+-------------------+----------------+
| PartyV | -25 | bstr/int | direct+KDF-Ascon- | PartyV |
| nonce | | | MAC,ECDH-ES+KDF- | provided |
| | | | Ascon-MAC,ECDH- | nonce |
| | | | SS+KDF-Ascon-MAC | |
+-----------+-------+----------+-------------------+----------------+
| PartyV | -26 | bstr | direct+KDF-Ascon- | PartyV |
| other | | | MAC,ECDH-ES+KDF- | other |
| | | | Ascon-MAC,ECDH- | provided |
| | | | SS+KDF-Ascon-MAC | information |
+-----------+-------+----------+-------------------+----------------+
| ephemeral | -1 | COSE_Key | ECDH-ES+KDF- | Ephemeral |
| key | | | Ascon-MAC | public key |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+-------------------+----------------+
| static | -2 | COSE_Key | ECDH-SS+KDF- | Static |
| key | | | Ascon-MAC | public key |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+-------------------+----------------+
| static | -3 | bstr | ECDH-SS+KDF- | Static |
| key id | | | Ascon-MAC | public key |
| | | | | identifier |
| | | | | for the |
| | | | | sender |
+-----------+-------+----------+-------------------+----------------+
Table 12: Updates to COSE header algorithm parameters
The direct+HKDF-Ascon-Hash256 algorithm MUST be used as described in
Section 8.5.1 of [RFC9052] and Section 6.1.2 of [RFC9053]. The ECDH-
ES+HKDF-Ascon-Hash256 and ECDH-SS+HKDF-Ascon-Hash256 algorithms MUST
be used as described in Section 8.5.4 of [RFC9052] and Section 6.3.1
of [RFC9053]. {:/comment}
4. Security Considerations
The security considerations of [NIST.SP.800-232], [RFC9052] and
[RFC9053] apply to this specification as well.
Ochkas, et al. Expires 29 April 2027 [Page 12]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
According to the most recent security analysis publications, Ascon
did not show any security vulnerabilities so far and the best attacks
target the initialization of Ascon reduced to 7 (out of 12) rounds,
concluding that Ascon has a security margin of 5 rounds (42 % of the
12 rounds). More details are available at List of Published Analysis
section of [asconv1.2-nist].
5. IANA Considerations
5.1. Additions to COSE Algorithms Registry
IANA is requested to add the following entries to the COSE Algorithms
Registry. The following completed registration templates are
provided as described in [RFC9053]. The "Recommended" fields for
Ascon-AEAD128/32 and HMAC Ascon-Hash256/64 are set to "Filter Only"
to discourage unreflected usage.
5.1.1. Ascon-AEAD128 for COSE
* Name: Ascon-AEAD128
* Value: TBD (requested assignment 35)
* Description: Ascon-AEAD128 with 128-bit tag
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.2. Ascon-AEAD128/64 for COSE
* Name: Ascon-AEAD128/64
* Value: TBD (requested assignment 36)
* Description: Ascon-AEAD128 with 64-bit tag
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
Ochkas, et al. Expires 29 April 2027 [Page 13]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
5.1.3. Ascon-AEAD128/32 for COSE
* Name: Ascon-AEAD128/32
* Value: TBD (requested assignment 37)
* Description: Ascon-AEAD128 with 32-bit tag
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Filter Only
5.1.4. Ascon-Hash256 for COSE
* Name: Ascon-Hash256
* Value: TBD (requested assignment -20)
* Description: Ascon 256-bit hash
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.5. Ascon-Hash256/64 for COSE
* Name: Ascon-Hash256/64
* Value: TBD (requested assignment -21)
* Description: Ascon 256-bit hash truncated to 64 bits
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Filter Only
5.1.6. HMAC Ascon-Hash256 for COSE
* Name: HMAC Ascon-Hash256
* Value: TBD (requested assignment 8)
Ochkas, et al. Expires 29 April 2027 [Page 14]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
* Description: HMAC w/ Ascon-Hash256
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.7. HMAC Ascon-Hash256/64 for COSE
* Name: HMAC Ascon-Hash256/64
* Value: TBD (requested assignment 9)
* Description: HMAC w/ Ascon-Hash256 truncated to 64 bits
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Filter Only
5.1.8. direct+HKDF-Ascon-Hash256 for COSE
* Name: direct+HKDF-Ascon-Hash256
* Value: TBD (requested assignment -22)
* Description: Shared secret w/ HKDF Ascon-Hash256
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.9. ECDH-ES+HKDF-Ascon-Hash256 for COSE
* Name: ECDH-ES+HKDF-Ascon-Hash256
* Value: TBD (requested assignment -23)
* Description: ECDH ES w/ HKDF Ascon-Hash256
* Capabilities: [kty]
* Reference: NIST SP 800-232
Ochkas, et al. Expires 29 April 2027 [Page 15]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
* Recommended: Yes
5.1.10. ECDH-SS+HKDF-Ascon-Hash256 for COSE
* Name: ECDH-SS+HKDF-Ascon-Hash256
* Value: TBD (requested assignment -24)
* Description: ECDH SS w/ HKDF Ascon-Hash256
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.11. Ascon-MAC for COSE
* Name: Ascon-MAC
* Value: TBD
* Description: Ascon MAC
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.12. Ascon-MAC/64 for COSE
* Name: Ascon-MAC/64
* Value: TBD
* Description: Ascon MAC truncated to 64 bits
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Filter Only
5.1.13. direct+KDF-Ascon-MAC for COSE
* Name: direct+KDF-Ascon-MAC
Ochkas, et al. Expires 29 April 2027 [Page 16]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
* Value: TBD
* Description: Shared secret w/ Ascon-MAC KDF
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.14. ECDH-ES+KDF-Ascon-MAC for COSE
* Name: ECDH-ES+KDF-Ascon-MAC
* Value: TBD
* Description: ECDH ES w/ Ascon-MAC KDF
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.1.15. ECDH-SS+KDF-Ascon-MAC for COSE
* Name: ECDH-SS+KDF-Ascon-MAC
* Value: TBD
* Description: ECDH SS w/ Ascon-MAC KDF
* Capabilities: [kty]
* Reference: NIST SP 800-232
* Recommended: Yes
5.2. Additions to COSE Header Algorithm Parameters Registry
5.2.1. salt
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
Ochkas, et al. Expires 29 April 2027 [Page 17]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
5.2.2. PartyU identity
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.3. PartyU nonce
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.4. PartyU other
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.5. PartyV identity
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.6. PartyV nonce
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.7. PartyV other
* Algorithm: ..., direct+HKDF-Ascon-Hash256,ECDH-ES+HKDF-Ascon-
Hash256,ECDH-SS+HKDF-Ascon-Hash256, direct+KDF-Ascon-MAC,ECDH-
ES+KDF-Ascon-MAC,ECDH-SS+KDF-Ascon-MAC
5.2.8. ephemeral key
* Algorithm: ..., ECDH-ES+HKDF-Ascon-Hash256, ECDH-ES+KDF-Ascon-MAC
5.2.9. static key
* Algorithm: ..., ECDH-SS+HKDF-Ascon-Hash256, ECDH-SS+KDF-Ascon-MAC
5.2.10. static key id
* Algorithm: ..., ECDH-SS+HKDF-Ascon-Hash256, ECDH-SS+KDF-Ascon-MAC
Ochkas, et al. Expires 29 April 2027 [Page 18]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
6. References
6.1. Normative References
[IANA.cose]
IANA, "CBOR Object Signing and Encryption (COSE)",
<https://www.iana.org/assignments/cose>.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104,
DOI 10.17487/RFC2104, February 1997,
<https://www.rfc-editor.org/rfc/rfc2104>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/rfc/rfc2119>.
[RFC5869] Krawczyk, H. and P. Eronen, "HMAC-based Extract-and-Expand
Key Derivation Function (HKDF)", RFC 5869,
DOI 10.17487/RFC5869, May 2010,
<https://www.rfc-editor.org/rfc/rfc5869>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC9052] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Structures and Process", STD 96, RFC 9052,
DOI 10.17487/RFC9052, August 2022,
<https://www.rfc-editor.org/rfc/rfc9052>.
[RFC9053] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Initial Algorithms", RFC 9053, DOI 10.17487/RFC9053,
August 2022, <https://www.rfc-editor.org/rfc/rfc9053>.
[RFC9054] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Hash Algorithms", RFC 9054, DOI 10.17487/RFC9054, August
2022, <https://www.rfc-editor.org/rfc/rfc9054>.
6.2. Informative References
[asconv1.2-caesar]
Dobraunig, C., Eichlseder, M., Mendel, F., and M.
Schläffer, "Ascon v1.2, Submission to Round 3 of the
CAESAR competition", 2016,
<https://competitions.cr.yp.to/round3/asconv12.pdf>.
Ochkas, et al. Expires 29 April 2027 [Page 19]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
[asconv1.2-nist]
Dobraunig, C., Eichlseder, M., Mendel, F., and M.
Schläffer, "Ascon v1.2, Submission to Final Round of the
NIST Lightweight Cryptography project", 2021,
<https://csrc.nist.gov/CSRC/media/Projects/lightweight-
cryptography/documents/finalist-round/updated-spec-doc/
ascon-spec-final.pdf>.
[NIST.SP.800-108r1-upd1]
Chen, L., "Recommendation for Key Derivation Using
Pseudorandom Functions",
DOI 10.6028/NIST.SP.800-108r1-upd1, August 2022,
<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-108r1-upd1.pdf>.
[NIST.SP.800-232]
Turan, M. S., McKay, K. A., Kang, J., and J. Kelsey,
"Ascon-Based Lightweight Cryptography Standards for
Constrained Devices", DOI 10.6028/NIST.SP.800-232, August
2025,
<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-232.pdf>.
Appendix A. Examples
This appendix provides some examples of various Ascon-AEAD128
encryptions with COSE.
A.1. COSE Content Encryption
A.1.1. Simple Ascon-AEAD128 encryption
{
"plaintext": "This is the content.",
"nonce_hex": "00000000000000000000000000000000",
"AAD_hex": "8367456E637279707443A1010140",
"CEK_hex": "849B57219DAE48DE646D07DBB533566E",
"Encrypt0_hex": "8344A1011823A1055000000000000000000000000000000000582461484F95FC36BD13D7EFCA1C370EE3B6A1125770C8878467D3AE466C7C6CC4F4918BAA96",
"Encrypt0_diag": "[h'A1011823', {5: h'00000000000000000000000000000000'}, h'61484F95FC36BD13D7EFCA1C370EE3B6A1125770C8878467D3AE466C7C6CC4F4918BAA96']"
}
A.1.2. Direct Ascon-AEAD128 encryption with recipient
Ochkas, et al. Expires 29 April 2027 [Page 20]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
{
"plaintext": "This is the content.",
"nonce_hex": "00000000000000000000000000000000",
"AAD_hex": "8367456E637279707443A1010140",
"CEK_hex": "849B57219DAE48DE646D07DBB533566E",
"key": {
"kid": "abcdef",
"kty": "Symmetric"
},
"Encrypt": "8444A1011823A10550000000000000000000000000000000005824D3468D9110A2C3005E82D48628CD462BBD8721FBABE883A7743F191AC81CA8D6BBED5E44818340A20125044661626364656640",
"Encrypt_diag": "[h'A1011823', {5: h'00000000000000000000000000000000'}, h'D3468D9110A2C3005E82D48628CD462BBD8721FBABE883A7743F191AC81CA8D6BBED5E44', [[h'', {1: -6, 4: h'616263646566'}, h'']]]"
}
A.1.3. Direct Ascon-AEAD128 encryption with HKDF-SHA-256
{
"plaintext": "This is the content.",
"nonce_hex": "00000000000000000000000000000000",
"AAD_hex": "8367456E637279707443A1010140",
"CEK_hex": "849B57219DAE48DE646D07DBB533566E",
"key": {
"kid": "abcdef",
"kty": "Symmetric"
},
"salt": "abcdefghijlmnopq",
"Encrypt": "8444A1011823A10550000000000000000000000000000000005824B80EA16F0EBCC9F25502EE1D992D23C4E7984E2919AD6C3E37581FB099DB5855F1490ECF818340A3012933506162636465666768696A6C6D6E6F7071044661626364656640",
"Encrypt_diag": "[h'A1011823', {5: h'00000000000000000000000000000000'}, h'B80EA16F0EBCC9F25502EE1D992D23C4E7984E2919AD6C3E37581FB099DB5855F1490ECF', [[h'', {1: -10, -20: h'6162636465666768696A6C6D6E6F7071', 4: h'616263646566'}, h'']]]"
}
Authors' Addresses
Dmytro Ochkas
IMT Atlantique
Email: dmytro.ochkas@imt-atlantique.fr
Hélène Le Bouder
IMT Atlantique
Email: helene.le-bouder@imt-atlantique.fr
Alexander Pelov
IMT Atlantique
Email: alexander.pelov@imt-atlantique.fr
Stefan Hristozov
Infineon
Ochkas, et al. Expires 29 April 2027 [Page 21]
Internet-Draft Ascon-AEAD128 and Ascon-Hash256 for COSE October 2026
Email: Stefan.Hristozov@infineon.com
Ochkas, et al. Expires 29 April 2027 [Page 22]