cosE

COSE stands for CBOR Object Signing and Encryption. It is a standards-track specification from the Internet Engineering Task Force (IETF) that defines how to protect CBOR-encoded data by signing, optionally authenticating, and encrypting it. Designed for compactness, COSE targets environments with limited bandwidth and processing power, such as embedded devices and Internet of Things (IoT) systems, while preserving cryptographic integrity and confidentiality.

COSE defines several message formats for signing, mac-ing, and encryption. Core formats include COSE_Sign and COSE_Sign1 for digital signatures, COSE_Encrypt and COSE_Encrypt0 for encryption with one or multiple recipients, and COSE_Mac and COSE_Mac0 for message authentication codes. The 0 variants are designed for single-recipient operations with minimal overhead and straightforward processing on constrained devices. COSE messages are encoded using CBOR (Concise Binary Object Representation).

Key management and algorithms are specified to enable flexible deployments. A COSE_Key structure describes keys, and COSE defines a registry of algorithm identifiers and parameters for signing and encryption. These include symmetric-key methods (such as AES-based schemes) and public-key schemes (such as elliptic-curve or other modern signatures). Keys and parameters are carried in the COSE structures alongside the payload, enabling multi-recipient scenarios and delegated trust.

Applications and adoption. COSE is used in IoT security stacks and constrained-network protocols, including its use in OSCORE, which protects COAP messages with COSE-based cryptography. It remains an active standard within the CBOR ecosystem, with ongoing work on profiles and interoperability to support diverse devices and use cases. See also: CBOR, JOSE, OSCORE, RFC 8152.