]> National Institute of Standards and Technology

quynh.dang@nist.gov

org

Your@example.com

Universität Bremen TZI

Postfach 330440 Bremen D-28359 Germany +49-421-218-63921 cabo@tzi.org

Security CBOR Object Signing and Encryption RFC 9861 defined and registered four eXtendable-Output Functions (XOFs), hash functions with output of arbitrary length, named TurboSHAKE128, TurboSHAKE256, KT128, and KT256; the present document is intended as the IETF consensus document that is now needed to give these algorithms Recommended status in the COSE registry. This document specifies concrete instances of those four functions above to be used as MACs in COSE. This document also specifies concrete instances of KMAC128 and KMAC256 in to be used as MACs in COSE and registers code points for them. And, this document provides "Recommended" status for those algorithms for COSE. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the CBOR Object Signing and Encryption Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction TurboSHAKE128, TurboSHAKE256, KT128, and KT256 specified in have great performance improvement over Keccak-based functions specified in FIPS 202 and SP 800-185. This document specifies concrete instances of those four functions for being used as MACs in COSE and moves their status to "Recommended". In addition, this document also specifies concrete instances of KMAC128 and KMAC256 specified in SP 800-185 for being used as MACs in COSE and registers code points for them.

Conventions and Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

MAC Algorithms Based on TurboSHAKE128, TurboSHAKE256, KT128, and KT256 for COSE This section provides concrete specifications for MACs derived from TurboSHAKE128 and TurboSHAKE256, as well as for simple MACs based on KT128 and KT256.

TurboSHAKE128-MAC As specified in , TurboSHAKE128 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter D. TurboSHAKE128-MAC is a MAC using TurboSHAKE128 where M is the concatenation of the original input message, called M', and a 128-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a D value? If the answer is yes, what would it be? Question for the group: L being 16 bytes (128 bits) is fine?

TurboSHAKE256-MAC As specified in , TurboSHAKE256 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter D. TurboSHAKE256-MAC is a MAC using TurboSHAKE256 where M is the concatenation of the original input message, called M', and a 256-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a D value? If the answer is yes, what would it be? Question for the group: L being 32 bytes (256 bits) is fine?

KT128-MAC As specified in , KT128 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter C. KT128-MAC is a MAC using KT128 where M is the concatenation of the original input message, called M', and a 128-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a C value? If the answer is yes, what would it be? Question for the group: L being 16 bytes (128 bits) is fine? KT128 was designed to utilize parallelism in SIMD processors.

KT256-MAC As specified in , KT256 has 2 required input parameters: the message M and the output length in bytes L, and one optional input parameter C. KT256-MAC is a MAC using KT256 where M is the concatenation of the original input message, called M', and a 256-bit secret key, called K, denoted as M'|| K. Question for the group: Does the group want to have a C value? If the answer is yes, what would it be? Question for the group: L being 32 bytes (256 bits) is fine? KT128 was designed to utilize parallelism in SIMD processors.

KMAC128 and KMAC256 for COSE specifies two MAC algorithms: KMAC128 and KMAC256 which have 3 required input parameters and an optional customization string input, called S. The key, K, shall be 128 and 256 bits for KMAC128 and KMAC256 respectively. Question for the group: Does the group want to have S to be an empty string? Or, is there a specific string the group would like to use?

IANA Considerations RFC Ed.: throughout this section, please replace RFC-XXXX with the RFC number of this specification and remove this note.

Updates to the COSE Algorithms Registry IANA is requested to update [has updated] the registrations in the COSE Algorithms registry in shown in by setting the Recommended status column to Yes, and by adding the present document to the Reference column. In , the following columns all have the same content and have been elided:

• Capabilities: [kty]
• Change Controller: IETF
• Reference: , RFC-XXXX
• Recommended: Yes

Registrations in COSE Algorithms Registry Updated to Recommended: Yes

Name	Value	Description
KT256	-264	KT256 XOF
KT128	-263	KT128 XOF
TurboSHAKE256	-262	TurboSHAKE256 XOF
TurboSHAKE128	-261	TurboSHAKE128 XOF

Additions to Existing Registries IANA is requested to add [has added] the registrations in the COSE Algorithms registry in shown in . RFC Editor: Actual values are TBD by IANA and need to be updated after registration. In , the following columns all have the same content and have been elided:

• Capabilities: [kty]
• Change Controller: IETF
• Recommended: Yes

Registrations Added to COSE Algorithms Registry

Name	Value	Description	Reference
TurboSHAKE256-MAC	-tbd	TurboSHAKE256 MAC	, RFC-XXXX
TurboSHAKE128-MAC	-tbd	TurboSHAKE128 MAC	, RFC-XXXX
KMAC128	-tbd	KMAC128	, RFC-XXXX
KMAC256	-tbd	KMAC256	, RFC-XXXX
KT128-MAC	-tbd	KT128 MAC	, RFC-XXXX
KT256-MAC	-tbd	KT256 MAC	, RFC-XXXX

Security Considerations TBD

Normative References Information Technology Laboratory Information Technology Laboratory Information Technology Laboratory National Institute of Standards and Technology

US Gaithersburg

This document defines four eXtendable-Output Functions (XOFs), hash functions with output of arbitrary length, named TurboSHAKE128, TurboSHAKE256, KT128, and KT256. All four functions provide efficient and secure hashing primitives, and the last two are able to exploit the parallelism of the implementation in a scalable way. This document is a product of the Crypto Forum Research Group. It builds up on the definitions of the permutations and of the sponge construction in NIST FIPS 202 and is meant to serve as a stable reference and an implementation guide. IANA In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.

Examples TBD

Acknowledgments TBD