Considering the text in the NIST spec: “Ascon-Hash256 is an approved cryptographic hash function; however, its use within the Keyed-Hash Message Authentication Code (HMAC) is not approved in this standard. Simi- larly, the use of Ascon-XOF128and Ascon-CXOF128 within HMAC is not approved.
Ascon-XOF128 and Ascon-CXOF128 are approved XOFs, and their approved uses will be specified in other NIST publications. While some of these uses may overlap with those of approved hash functions, XOFs are not approved as hash functions.“ I interpret the text (in the opposite direction) as follows: 1. Using Ascon-Hash256 and Ascon-XOF in HMAC is not approved in this spec, and will probably also not be approved in the future NIST specifications. 2. The use of Ascon-XOF and Ascon-CXOF as MAC and KDF is not specified in this spec, but will be used in a separate NIST spec. Lijun From: Lijun Liao <[email protected]> Date: Tuesday, 28. July 2026 at 16:36 To: Dmytro OCHKAS <[email protected]>; cose <[email protected]> Subject: [COSE] Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE CAUTION! External Email. Do not click links or open attachments unless you recognize the sender and know the content is safe. As in the original paper [ASCON], the authors proposed ascon-PRF and ascon-MAC based on the ascon basic primitives, but not on the high-level ascon-hash. That is why I am not sure that your proposed MAC and PRF mechanisms follow the correct direction. Another issue, could you add some technical data of ascon-based mechanisms vs e.g., AES / SHA-2 / SHA-3? This will help the WG to understand the necessity of ascon. [ASCON]: https://eprint.iacr.org/2021/1574.pdf Lijun From: Dmytro OCHKAS <[email protected]> Date: Tuesday, 28. July 2026 at 15:31 To: cose <[email protected]> Subject: [COSE] Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE CAUTION! External Email. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear COSE WG, Following my previous email, I will take the opportunity to ask the NIST members of the working group if there are intentions to approve Ascon Hash or Ascon XOFs for HMAC (or other MAC function) and, thus, for KDFs. This will help us know which directions to choose with the draft. In another case, we can proceed only with the Ascon AEAD for COSE. Though we consider it a significant limitation as Ascon reuses its permutation function for all of its algorithms, allowing for significant gains in memory footprint if using Ascon AEAD + Hash. Thanks in advance for the response. Best, Dmytro ----- Mail original ----- De: "dmytro ochkas" <[email protected]> À: "Lijun Liao" <[email protected]>, "cose" <[email protected]> Envoyé: Mardi 28 Juillet 2026 15:16:02 Objet: Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE Hello Lijun, Thanks for supporting the discussion. I will start with Ascon-Hash256 in COSE. Indeed, NIST.SP.800-232 explicitly says: ``` Ascon-Hash256 is an approved cryptographic hash function; however, its use within the Keyed-Hash Message Authentication Code (HMAC) is not approved in this standard. ... Ascon-XOF128 and Ascon-CXOF128 are approved XOFs, and their approved uses will be specified in other NIST publications. ``` The way we interpret this is that Ascon-Hash256 is still being approved for HMAC for future SPs. So we have proposed Ascon-Hash256 in HMAC, looking ahead to the possibility of a new NIST publication specifying this. The main idea for us is to follow the pattern of SHA-256 being integrated in COSE. Similarly for Ascon XOFs, they are not yet approved by NIST for KDFs. Lijun, if what you had in mind was specifying Ascon XOFs for MAC the way KMAC does it with SHAKE, we can introduce it in the draft as well. Analogous to KMAC128 from NIST.SP.800-185, the algorithm would look like: 1. newX = bytepad(encode_string(K), 168) || X || right_encode(L). 2. return Ascon-cXOF128(newX, L, “Ascon-MAC”, S). Let's hear the thoughts of others on this idea. Regarding the other remarks: 1. "It is not clear how to specify the nonce (N)" - We will do our best to clarify this in the next version of the draft. - The main idea is to have a notion of distinction between Nonce and IV in Ascon. 2. "Truncated size e.g. 64 could also be useful, like SHA-256/64" - Agree, this will probably be introduced in the next version. - Again, we need more comments on this one. Don't hesitate to ask follow-up questions. And please also let us know if you are in favor of the whole idea of having Ascon in COSE. Best, Dmytro ----- Mail original ----- De: "Lijun Liao" <[email protected]> À: "dmytro ochkas" <[email protected]>, "cose" <[email protected]> Envoyé: Mardi 28 Juillet 2026 08:22:28 Objet: Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE - MAC based on HMAC and Ascon-Hash 1) not standardized in NIST spec, 2) better to use ascon xofs. From: Lijun Liao <[email protected]> Date: Monday, 27. July 2026 at 21:05 To: Dmytro OCHKAS <[email protected]>; cose <[email protected]> Subject: Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE Sorry, the last email was with typo. "I am sure” -> “I am not sure" From: Lijun Liao <[email protected]> Date: Monday, 27. July 2026 at 21:04 To: Dmytro OCHKAS <[email protected]>; cose <[email protected]> Subject: Re: Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE Hi Dmytro, - Section IV Header Parameter It is not clear how to specify the nonce (N). - Ascon Hash Truncated size e.g. 64 could also be useful, like SHA-256/64 - KDF with Ascon-Hash I am sure this is the right way to follow. 1) not standardized anyway, 2) it is better to use Ascon-CXOF / Ascon-XOF which is designed for KDF. Lijun From: Dmytro OCHKAS <[email protected]> Date: Monday, 27. July 2026 at 18:08 To: cose <[email protected]> Subject: [COSE] Follow up on Ascon-AEAD128 and Ascon-Hash256 for COSE CAUTION! External Email. Do not click links or open attachments unless you recognize the sender and know the content is safe. Dear COSE WG, This is the follow up mail of my presentation on Ascon-AEAD128 and Ascon-Hash256 for COSE. We appreciate a lot all the feedback given during the WG meeting. To summarize, I will introduce the main highlights of the presentation: 1. NIST SP 800-232 is already out, standardizing Ascon-AEAD128 and Ascon-Hash256, so the main blocker of this draft is gone. 2. Ascon-AEAD128 is proposed for COSE encryption in 3 variations: with a 16-byte tag, an 8-byte tag, and a 4-byte tag. 3. Ascon-Hash256 is proposed for COSE Key Derivation and COSE MAC. 4. During the hackathon, we were working on Implementing Ascon Lightweight Cryptographic Suite over COSE. Please refer to the related Pull Requests below. If any of you are contributors to these repos, feel free to review the PRs and give us your feedback. We'll appreciate it a lot. libcose -- https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbergzand%2Flibcose%2Fpull%2F132&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753472607%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=0TlWYHrnbz6G2tem4SBXXTleOV6K7PNbFVQZcPkM%2BaA%3D&reserved=0<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fbergzand%2Flibcose%2Fpull%2F132&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753517087%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=zMOx6jZtRWyje8yyO8NVzkyfgTept8qH3s%2FyOMKX6Ns%3D&reserved=0><https://github.com/bergzand/libcose/pull/132> COSE-C -- https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcose-wg%2FCOSE-C%2Fpull%2F142&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753559079%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=N%2FNuLtq1lo0RBnUCNKDGOlkyToa%2FAiD1nMGJsn%2FbA5o%3D&reserved=0<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcose-wg%2FCOSE-C%2Fpull%2F142&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753595664%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=eJFac33AFk%2BvJTmk54b4XHYYv1asrFnY72NYAdskjrM%3D&reserved=0><https://github.com/cose-wg/COSE-C/pull/142> uoscore-uedhoc (only as a fork for now) -- https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdmochkas%2Fuoscore-uedhoc&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753621494%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GvJSWlyGq8AZ02VETmmBzuovMf5V1yojrO1VmoA%2F3b8%3D&reserved=0<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdmochkas%2Fuoscore-uedhoc&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753649394%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jw%2FodhEGWbOzR4WoORfL5bciTpQJ8TTty9NdDrElwNE%3D&reserved=0><https://github.com/dmochkas/uoscore-uedhoc> 5. If you would like to see Ascon with COSE in any other language than C (Rust, Java, Python, ...), please let me know. I will be excited to work together on this project. Also, we propose the following roadmap for the full Ascon integration in COSE. Please don't hesitate to give feedback on it. Status | New Algorithm + Ascon-AEAD128 for COSE encryption (35) + Ascon-AEAD128-64 for COSE encryption (36) + Ascon-AEAD128-32 for COSE encryption (37) + HMAC Ascon-Hash256 for COSE MAC (8) + HMAC Ascon-Hash256/64 for COSE MAC (9) + HKDF Ascon-Hash256 for Key Derivation + direct+HKDF-Ascon-Hash256 (-20) - ECDH-ES+HKDF-Ascon-Hash256 - ECDH-SS+HKDF-Ascon-Hash256 - Ascon-Hash256 (RFC 9054) Finally, to keep the draft moving, we would require 2-3 reviews of the draft. Many thanks to the people who volunteered to do that during the meeting. As long as the reviews are done, we will address the comments right after. Please refer to the draft for more details: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ochkas-cose-ascon%2F&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753679410%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=CNb%2Fyrjt%2BE8PTuV3nSYQ%2Fc0cHMcp1hUn%2Bq%2BEQ3uiWGo%3D&reserved=0<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ochkas-cose-ascon%2F&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753718722%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=G%2BudaK4vlylbbyaE6Qosagq%2B%2FRs%2BzIu%2B7asDnsybJMc%3D&reserved=0><https://datatracker.ietf.org/doc/draft-ochkas-cose-ascon/> Thanks in advance for making this project come true. Best regards, Dmytro _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected] [Banner]<https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.nio.io%2F&data=05%7C02%7Clijun.liao%40nio.io%7C9eb406c5f5fe4db3475108deecac7a90%7Cea1b2f97423f4ab3bf6d45a36c09ce34%7C1%7C0%7C639208422753765410%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=PFiIydrkyZCr0y1FxKWDPeEm82fPe%2BqtkG%2BB2mobaQQ%3D&reserved=0> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. _______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected] [Banner]<http://www.nio.io/> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. [Banner]<http://www.nio.io/> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. You may NOT use, disclose, copy or disseminate this information. If you have received this email in error, please notify the sender and destroy all copies of the original message and all attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
