| Internet-Draft | COSE: KangarooTwelve, TurboSHAKE, KMAC | July 2026 |
| Dang, et al. | Expires 7 January 2027 | [Page] |
RFC 9861 defined and registered four eXtendable-Output Functions (XOFs), hash functions with output of arbitrary length, named TurboSHAKE128, TurboSHAKE256, KT128, and KT256; the present document is intended as the IETF consensus document that is now needed to give these algorithms Recommended status in the COSE registry.¶
This document specifies concrete instances of those four functions above to be used as MACs in COSE.¶
This document also specifies concrete instances of KMAC128 and KMAC256 in [NIST.SP.800-185] to be used as MACs in COSE and registers code points for them.¶
And, this document provides "Recommended" status for those algorithms for COSE.¶
This note is to be removed before publishing as an RFC.¶
The latest revision of this draft can be found at https://cabo.github.io/turbo-kanga/draft-bormann-cose-turbo-kanga-kmac.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-bormann-cose-turbo-kanga-kmac/.¶
Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (mailto:cose@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/cose/. Subscribe at https://www.ietf.org/mailman/listinfo/cose/.¶
Source for this draft and an issue tracker can be found at https://github.com/cabo/turbo-kanga.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 7 January 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
TurboSHAKE128, TurboSHAKE256, KT128, and KT256 specified in [RFC9861] have great performance improvement over Keccak-based functions specified in FIPS 202 and SP 800-185. This document specifies concrete instances of those four functions for being used as MACs in COSE and moves their status to "Recommended".¶
In addition, this document also specifies concrete instances of KMAC128 and KMAC256 specified in SP 800-185 for being used as MACs in COSE and registers code points for them.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This section provides concrete specifications for MACs derived from TurboSHAKE128 and TurboSHAKE256, as well as for simple MACs based on KT128 and KT256.¶
As specified in Section 2 of [RFC9861], TurboSHAKE128 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter D. TurboSHAKE128-MAC is a MAC using TurboSHAKE128 where M is the concatenation of the original input message, called M', and a 128-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a D value? If the answer is yes, what would it be? Question for the group: L being 16 bytes (128 bits) is fine?¶
As specified in Section 2 of [RFC9861], TurboSHAKE256 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter D. TurboSHAKE256-MAC is a MAC using TurboSHAKE256 where M is the concatenation of the original input message, called M', and a 256-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a D value? If the answer is yes, what would it be? Question for the group: L being 32 bytes (256 bits) is fine?¶
As specified in Section 3 of [RFC9861], KT128 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter C. KT128-MAC is a MAC using KT128 where M is the concatenation of the original input message, called M', and a 128-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a C value? If the answer is yes, what would it be? Question for the group: L being 16 bytes (128 bits) is fine?¶
KT128 was designed to utilize parallelism in SIMD processors.¶
As specified in Section 3 of [RFC9861], KT256 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter C. KT256-MAC is a MAC using KT256 where M is the concatenation of the original input message, called M', and a 256-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a C value? If the answer is yes, what would it be? Question for the group: L being 32 bytes (256 bits) is fine?¶
KT128 was designed to utilize parallelism in SIMD processors.¶
[NIST.SP.800-185] specifies two MAC algorithms: KMAC128 and KMAC256 which have 3 required input parameters and an optional customization string input, called S. The key, K, shall be 128 and 256 bits for KMAC128 and KMAC256 respectively.¶
Question for the group: Does the group want to have S to be an empty string? Or, is there a specific string the group would like to use?¶
RFC Ed.: throughout this section, please replace RFC-XXXX with the RFC number of this specification and remove this note.¶
IANA is requested to update [has updated] the registrations in the COSE Algorithms registry in [IANA.cose] shown in Table 1 by setting the Recommended status column to Yes, and by adding the present document to the Reference column.¶
In Table 1, the following columns all have the same content and have been elided:¶
| Name | Value | Description |
|---|---|---|
| KT256 | -264 | KT256 XOF |
| KT128 | -263 | KT128 XOF |
| TurboSHAKE256 | -262 | TurboSHAKE256 XOF |
| TurboSHAKE128 | -261 | TurboSHAKE128 XOF |
IANA is requested to add [has added] the registrations in the COSE Algorithms registry in [IANA.cose] shown in Table 2. RFC Editor: Actual values are TBD by IANA and need to be updated after registration.¶
In Table 2, the following columns all have the same content and have been elided:¶
| Name | Value | Description | Reference |
|---|---|---|---|
| TurboSHAKE256-MAC | -tbd | TurboSHAKE256 MAC | [RFC9861], RFC-XXXX |
| TurboSHAKE128-MAC | -tbd | TurboSHAKE128 MAC | [RFC9861], RFC-XXXX |
| KMAC128 | -tbd | KMAC128 | [NIST.SP.800-185], RFC-XXXX |
| KMAC256 | -tbd | KMAC256 | [NIST.SP.800-185], RFC-XXXX |
| KT128-MAC | -tbd | KT128 MAC | [RFC9861], RFC-XXXX |
| KT256-MAC | -tbd | KT256 MAC | [RFC9861], RFC-XXXX |
TBD¶
TBD¶