RFC 9864
Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE), October 2025
- File formats:

- Also available: XML file for editing
- Status:
- PROPOSED STANDARD
- Updates:
- RFC 7518, RFC 8037, RFC 9053
- Authors:
- M.B. Jones
O. Steele - Stream:
- IETF
- Source:
- jose (sec)
Cite this RFC: TXT | XML | BibTeX
DOI: https://doi.org/10.17487/RFC9864
Discuss this RFC: Send questions or comments to the mailing list jose@ietf.org
Other actions: Submit Errata | Find IPR Disclosures from the IETF | View History of RFC 9864
Abstract
This specification refers to cryptographic algorithm identifiers that fully specify the cryptographic operations to be performed, including any curve, key derivation function (KDF), and hash functions, as being "fully specified". It refers to cryptographic algorithm identifiers that require additional information beyond the algorithm identifier to determine the cryptographic operations to be performed as being "polymorphic". This specification creates fully-specified algorithm identifiers for registered JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) polymorphic algorithm identifiers, enabling applications to use only fully-specified algorithm identifiers. It deprecates those polymorphic algorithm identifiers.
This specification updates RFCs 7518, 8037, and 9053. It deprecates polymorphic algorithms defined by RFCs 8037 and 9053 and provides fully-specified replacements for them. It adds to the instructions to designated experts in RFCs 7518 and 9053.
For the definition of Status, see RFC 2026.
For the definition of Stream, see RFC 8729.