https://www.rfc-editor.org/rfc/rfc10082.txt

 Internet Engineering Task Force (IETF) M. Ounsworth Request for Comments: 10082 J. Gray Category: Standards Track Entrust ISSN: 2070-1721 J. Klaußner Bundesdruckerei GmbH D. Van Geest CryptoNext Security November 2026 Composite Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for Use in the Cryptographic Message Syntax (CMS) Abstract The Composite Module-Lattice-Based Digital Signature Algorithm (ML- DSA) defines combinations of ML-DSA with RSA, ECDSA, and EdDSA. This document specifies the conventions for using Composite ML-DSA algorithms within the Cryptographic Message Syntax (CMS). Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc10082. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction 1.1. ASN.1 1.2. Conventions 2. Composite ML-DSA Algorithm Identifiers 3. Signed-Data Conventions 3.1. Pre-Hashing 3.2. SignedData digestAlgorithms 3.3. Signature Generation and Verification 3.4. SignerInfo Content 4. IANA Considerations 5. Security Considerations 6. References 6.1. Normative References 6.2. Informative References Appendix A. ASN.1 Module Appendix B. Examples Acknowledgments Authors' Addresses 1. Introduction [RFC10073] defines a collection of signature algorithms, referred to as Composite ML-DSA, which combine ML-DSA [FIPS.204] with RSASSA- PKCS1-v1.5 [RFC8017], RSASSA-PSS [RFC8017], ECDSA (Section 6 of [FIPS.186-5]), Ed25519 [RFC8410], and Ed448 [RFC8410]. This document acts as a companion to [RFC10073] by providing conventions for using Composite ML-DSA algorithms within the Cryptographic Message Syntax (CMS) [RFC5652]. 1.1. ASN.1 CMS values are generated using ASN.1 [X.680], using the Basic Encoding Rules (BER) and the Distinguished Encoding Rules (DER) [X.690]. 1.2. Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Composite ML-DSA Algorithm Identifiers The same AlgorithmIdentifier is used to identify a Composite ML-DSA public key and signature algorithm. The object identifiers (OIDs) for Composite ML-DSA algorithms are defined in [RFC10073] and are reproduced here for convenience. The parameters field of the AlgorithmIdentifier for the Composite ML-DSA public key and signature algorithm MUST be absent. id-MLDSA44-RSA2048-PSS-SHA256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 37 } id-MLDSA44-RSA2048-PKCS15-SHA256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 38 } id-MLDSA44-Ed25519-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 39 } id-MLDSA44-ECDSA-P256-SHA256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 40 } id-MLDSA65-RSA3072-PSS-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 41 } id-MLDSA65-RSA3072-PKCS15-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 42 } id-MLDSA65-RSA4096-PSS-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 43 } id-MLDSA65-RSA4096-PKCS15-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 44 } id-MLDSA65-ECDSA-P256-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 45 } id-MLDSA65-ECDSA-P384-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 46 } id-MLDSA65-ECDSA-brainpoolP256r1-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 47 } id-MLDSA65-Ed25519-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 48 } id-MLDSA87-ECDSA-P384-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 49 } id-MLDSA87-ECDSA-brainpoolP384r1-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 50 } id-MLDSA87-Ed448-SHAKE256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) 51 } id-MLDSA87-RSA3072-PSS-SHA512 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg