Congratulations to Mike Prorock and Orie Steele on the publication of “ML-DSA for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)” as RFC 9964! This is a major step forward towards enabling widely-available post-quantum signatures for the Internet and devices.

The abstract from the RFC is:

This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for the Module-Lattice-Based Digital Signature Standard (ML-DSA), a Post-Quantum Cryptography (PQC) digital signature scheme defined in US NIST FIPS 204.

As I discussed at TDI 2026 and will discuss tomorrow at EIC 2026, transitioning to post-quantum algorithms is a multi-step process:

1. Developing PQ algorithms
2. Creating standards for using PQ algorithms
3. Updating software to use PQ standards
4. Deploying the updated software in your environment

Mike and Orie successfully completed step 2 for JOSE and COSE signatures today!

The JOSE and COSE algorithm identifiers for ML-DSA were actually registered with IANA in July 2025, once it was clear that the document was stable. Some deployments already exist. For instance, Yubico has created prototype Yubikeys (hardware passkeys) supporting ML-DSA signatures. The algorithms are now recommended in the FIDO2 CTAP2.3 Server Requirements.

I played a few supporting roles progressing this spec. I co-chaired the COSE Working Group with Ivaylo Petrov where the work occurred. Ivo and I made a consensus call in May 2025 to standardize only one private key representation – the seed. (As I often advocate, “Standards are about making choices”.) And I requested early allocation of the algorithm identifiers with IANA in July 2025.

Orie said to me while the spec was in AUTH48 with the RFC Editor: “This may be one of the most consequential RFCs I ever create.” I completely agree! And special congratulations, Mike Prorock, on your first RFC!

Here’s a slide from my TDI 2026 presentation on what’s hard about deploying post-quantum cryptography. I’ll make the same case tomorrow at EIC.