Support for ML-DSA signed JWTs

[PhilSchmieder]

Hi, are there plans to implement support for ML-DSA signed JWTs? Is there a timeline or something similar?

RFC 9964 specifies JOSE bindings for ML-DSA variants, and both aws-lc-rs and RustCrypto implement the relevant algorithms.

Although it is not super important to implement post-quantum signature support asap, other JWT libs (like panva/jose for TS) already do and eventually it will be crucial.

I'm happy to help implement this!

[arckoor]

If there was an RFC with hybrid signatures I'd be onboard with it right away, for pure PQC signatures I feel a bit conflicted, but since there will likely be significant demand I'm not against a PR

[bwesterb]

If there was an RFC with hybrid signatures I'd be onboard with it right away,

The JOSE working group is working on a hybrid signatures draft. They have not asked IANA to assign entries in the registry. As usual with hybrids, there's quite a long list of different options.

For many of our use cases we're dealing with short-lived tokens. We're very comfortable using ML-DSA there. Even if it turns out weaker than expected (of which we have no indication), we can switch to something else. Compare this to encryption: a ciphertext has to be strong forever, whereas a signature only has to remain secure as long as it takes to swap out the trust anchor.

We are worried though about various forms of protocol ossification or people putting tokens in tight spaces, and think it's important to start testing early enough with these larger PQ tokens.

I do think hybrid JWTs will be used in places, but we'll have to wait a bit until a short list is agreed upon. But it seems clear that pure ML-DSA-44 JWTs will be quite common as well. JWTs wouldn't be the trailblaizer though: the WebPKI will default to ML-DSA-44 also for root certificates, slated for deployment early in 2027.