Subject: Re: [jose] #13: Enable AEAD key wrapping

From: "jose issue tracker" <[email-masked]>
Date: Thu, 04 Apr 2013 03:30:10 -0000

#13: Enable AEAD key wrapping

Comment (by [email-masked]):

 As I understood the feedback from WebCrypto, the desire was for general
 AEAD algorithms to be usable in both (1) and (2).  And as I expressed at
 IETF86, it would be architecturally simpler if we use the same key
 wrapping for all wrapped keys, whether attached to JWE or not.

 A proposed solution has been submitted as http://tools.ietf.org/html
 /draft-barnes-jose-key-wrapping

-- 
-------------------------+-------------------------------------------------
 Reporter:  [email-masked]   |       Owner:  draft-ietf-jose-json-web-
     Type:  defect       |  [email-masked]
 Priority:  major        |      Status:  new
Component:  json-web-    |   Milestone:
  encryption             |     Version:
 Severity:  -            |  Resolution:
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/13#comment:3>
jose <http://tools.ietf.org/jose/>

---

From: Russ Housley <[email-masked]>
Date: Thu, 4 Apr 2013 10:03:13 -0400

Richard:

We need to make sure that the solution is algorithm agile.  No matter what we pick, it will need to change in some number of years.

Also, when I design a cryptographic security solution, I tend to use one mode for data and another mode for keying material. This approach ensures that a decrypt operation will never return plaintext keying material outside the crypto boundary.  So, I strongly support the use of AES-KW or AES-KWP for key wrapping.

Russ

---

From: Richard Barnes <[email-masked]>
Date: Thu, 4 Apr 2013 12:08:39 -0400

Hi Russ,

There's no question of dropping support for AES-KW or AES-KWP.

As you point out, the desire here is for algorithm agility.  Currently,
there's no way to support other AEAD algorithms besides those two.

--Richard

On Thu, Apr 4, 2013 at 10:03 AM, Russ Housley <[email-masked]> wrote:

> Richard:
>
> We need to make sure that the solution is algorithm agile.  No matter what
> we pick, it will need to change in some number of years.
>
> Also, when I design a cryptographic security solution, I tend to use one
> mode for data and another mode for keying material. This approach ensures
> that a decrypt operation will never return plaintext keying material
> outside the crypto boundary.  So, I strongly support the use of AES-KW or
> AES-KWP for key wrapping.
>
> Russ
>
> > Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/13#comment:3
> >
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>