Subject: [jose] #19: JWA needs to specify an IV for use with JWE AES Key Wrap

From: "jose issue tracker" <[email-masked]>
Date: Tue, 09 Apr 2013 19:45:08 -0000

#19: JWA needs to specify an IV for use with JWE AES Key Wrap

 Section 4.5 of JSON Web Algorithms specifies the use of AES Key Wrap with
 JWE with reference to RFC3394. The RFC does not require a particular
 Initial Value to be used, although it defined a "default Initial Value".

 Either:
 (a) The JWA specification needs to specify that the default Initial Value
 from RFC3394 must be used, or
 (b) The JWE specification needs to include an object member to specify the
 Initial Value that was used (note that is this distinct from the
 Initialization Vector used for the payload encryption).

 I suggest (a) and I am uncertain of the security properties of (b).

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-jose-json-web-
  [email-masked]    |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  minor        |  Milestone:
Component:  json-web-    |    Version:
  algorithms             |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/19>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Tue, 09 Apr 2013 20:34:16 -0000

Comment (by [email-masked]):

 It turns out that RFC 5649 is actually unambiguous about this:
 """
       [If the input is not exactly 8 bytes long...]
       Otherwise, apply the wrapping process specified in Section 2.2.1
       of [AES-KW2] to the padded plaintext {P[1], ..., P[n]} with K (the
       KEK) and the AIV as defined in Section 3 above as the initial
       value.
 """

 So it seems like there's a third course of action here, namely:

 (c) Upgrade the reference to RFC 3394 to reference RFC 5649 instead.

 That would also allow us to process inputs that are not 64-bit aligned.

  algorithms             |  Resolution:
 Keywords:               |

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/19#comment:1>
jose <http://tools.ietf.org/jose/>

---

From: Russ Housley <[email-masked]>
Date: Wed, 10 Apr 2013 16:53:04 -0400

I encourage the use of only the default IV with AES Key Wrap.

Russ

On Apr 9, 2013, at 3:45 PM, jose issue tracker wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: "jose issue tracker" <[email-masked]>
Date: Wed, 10 Apr 2013 21:31:53 -0000

Comment (by [email-masked]):

 I will add text clarifying that the default IV must be used (which was
 always the intent) in the upcoming round of edits.

 RFC 5649 is a different (if related) algorithm, and not the topic of this
 issue.  When last discussed by the working group, the decision made was to
 have RFC 3394 continue to be in the JWA algorithm set but not RFC 5649.
 This was recorded in the IETF 83 minutes as "Agreement reached to use 3394
 since Schaad said there wasn't likely a need for the arbitrary alignment
 supported in 5649."

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/19#comment:2>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Wed, 24 Apr 2013 18:49:30 -0000

draft-ietf-jose-json-web-algorithms-09 now includes this text when
 describing AES Key Wrap "Advanced Encryption Standard (AES) Key Wrap
 Algorithm [RFC3394] using the default initial value specified in Section
 2.2.3.1".  I therefore believe that this issue should be closed.

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/19#comment:3>
jose <http://tools.ietf.org/jose/>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 24 Apr 2013 18:16:21 -0400

+1 to closing.

---

From: "jose issue tracker" <[email-masked]>
Date: Sun, 28 Apr 2013 12:43:06 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [email-masked]    |  [email-masked]
     Type:  defect       |      Status:  closed
 Priority:  minor        |   Milestone:
Component:  json-web-    |     Version:
  algorithms             |  Resolution:  fixed
 Severity:  -            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/19#comment:4>
jose <http://tools.ietf.org/jose/>