This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| IETF COSE | |
|---|---|
| Name | COSE |
| Developer | Internet Engineering Task Force |
| Initial release | 2013 |
| Latest release | 2022 |
| Programming languages | C, Rust, Python, JavaScript, Java |
| License | Various |
| Genre | Cryptographic message format |
IETF COSE
IETF COSE is an Internet Engineering Task Force specification suite defining CBOR-based Object Signing and Encryption formats. It provides compact, binary message encodings suitable for constrained environments and integrates with standards from organizations such as the Internet Engineering Task Force, World Wide Web Consortium, and Trusted Computing Group. COSE is specified alongside protocols and profiles used by projects in the Open Web Application Security Project, Liberty Alliance, and industrial consortia for secure messaging.
COSE defines compact cryptographic message syntaxes that map to CBOR structures; it is intended for environments addressed by the Internet Engineering Task Force and used by working groups associated with the World Wide Web Consortium, Trusted Computing Group, and OpenID Foundation. The suite complements RFCs produced by the Internet Engineering Task Force, leveraging serialization approaches similar to those used by projects in the World Wide Web Consortium, Distributed Computing Environment, and Industrial Internet Consortium. COSE is applied in implementations for devices from vendors participating in the Open Mobile Alliance, Zigbee Alliance, and LoRa Alliance and is referenced by standardization activities at the International Organization for Standardization and European Telecommunications Standards Institute.
COSE emerged from Internet Research Task Force discussions and Internet Engineering Task Force work items influenced by prior efforts such as the JSON Web Signature and JSON Web Encryption specifications from the Internet Engineering Task Force and the World Wide Web Consortium. Early contributions came from engineers associated with companies and organizations including Cisco Systems, Microsoft, Intel, ARM, and NIST, and the specifications were refined in public mailing lists and meetings at IETF gatherings alongside other specifications like TLS and DTLS. The COSE series advanced through the Internet Engineering Task Force standards track with successive RFC publications and interoperability events involving implementers from Mozilla, Google, Amazon, and Apple, as well as research groups at universities such as MIT, Stanford, and ETH Zurich.
COSE uses CBOR as its canonical representation, building on data modeling and encoding principles found in work by IETF, W3C, and IRTF. Core COSE structures include protected and unprotected header maps, key representations compatible with formats used by NIST and the Elliptic Curve Digital Signature Algorithm implementations, and countersignature constructs that parallel mechanisms in PKCS standards and X.509 profiles leveraged by the IETF and ITU-T. Key management techniques in COSE reference practices from the Internet Engineering Task Force, OpenSSL, and hardware security modules designed by companies like Yubico and Thales, and align with cryptographic agility practices advocated by organizations such as ENISA and BSI.
COSE defines several message types: COSE_Sign, COSE_Sign1, COSE_Encrypt, COSE_Encrypt0, COSE_Mac, and COSE_Mac0, each encoding in CBOR similar to message constructs in earlier Internet Engineering Task Force documents and W3C specifications. These formats specify header parameter fields, recipient stacks, and payload encapsulation that interact with transport protocols like HTTP/2, CoAP, and MQTT used in projects from Eclipse Foundation and OASIS. Message layering strategies in COSE mirror approaches used in protocols standardized by the Internet Engineering Task Force such as DTLS, and are often deployed in ecosystems including OpenSSL, BoringSSL, and NSS.
COSE maps algorithm identifiers to cryptographic primitives including AES-GCM, AES-CCM, HMAC-SHA2, ECDSA over curves used in standards from SECG and NIST, and newer constructions like Ed25519 and X25519 developed by contributors associated with the Internet Research Task Force and research labs at Google and Microsoft. The parameter and algorithm registry model used by COSE is administered in the manner of Internet Engineering Task Force registries and aligns with algorithm negotiation mechanisms found in TLS, SSH, and JOSE. Cryptographic policy considerations reference guidance from NIST, ENISA, and IETF consensus documents addressing algorithm selection, key sizes, and randomness sources.
Multiple open-source and commercial libraries implement COSE in languages such as C (libsuit), Rust (cose-rust), Python (cose), Java (cose-java), and JavaScript (node-cose), maintained by organizations and contributors from GitHub, Apache Foundation projects, and vendor teams at Nordic Semiconductor, Espressif, and ARM. These implementations are integrated into platforms and toolchains from Eclipse Foundation projects, Zephyr RTOS, Android, and embedded SDKs provided by Silicon Labs and STMicroelectronics, and are tested in interoperability events hosted by the Internet Engineering Task Force and industry consortia like the Open Connectivity Foundation and GSMA.
Security guidance for COSE draws on threat models and review practices established by the Internet Engineering Task Force, OWASP, and national bodies such as NIST and ENISA. Key risks include algorithm downgrade, key management failures, misuse of header parameters, and side-channel leakage in implementations on processors from ARM and Intel; mitigations include use of secure elements from vendors like NXP and Infineon, protocol-level authentication, and adherence to best practices in cryptographic engineering articulated by organizations such as the Internet Engineering Task Force and IETF security directorate. Interoperability testing and formal analysis by academic groups at Carnegie Mellon University and ETH Zurich further inform secure deployments.
Category:Internet Engineering Task Force standards