Re: [COSE] MAC with no recipient structures

For starters - there's no need for encryption support.  Also, the ID Token claims are viewable by intermediaries.

But I really think you have the question backwards.  Why not allow applications the choice of HMAC?  Unless there's a compelling reason not to, COSE should do so - particularly in light of the JOSE experience in which no-explicit-recipient HMAC is second-most used behind digital signatures, with encryption being a distant third - data also cited recently by Justin.  If you look at the set of JOSE libraries represented at http://openid.net/developers/libraries/#jwt, you'll find that most, including Microsoft's current production JOSE libraries, don't support encryption, because they don't have a need for it.

I see no reason not to allow the same implementation choices by COSE developers.

				-- Mike

-----Original Message-----
From: Jim Schaad [mailto:ietf@augustcellars.com] 
Sent: Monday, November 16, 2015 5:21 PM
To: Mike Jones; cose@ietf.org
Subject: RE: [COSE] MAC with no recipient structures

For this case, what is the benefit that you see for favoring HMAC over AES-GCM?

Jim

> -----Original Message-----
> From: Mike Jones [mailto:Michael.Jones@microsoft.com]
> Sent: Monday, November 16, 2015 2:39 PM
> To: Jim Schaad <ietf@augustcellars.com>; cose@ietf.org
> Subject: RE: [COSE] MAC with no recipient structures
> 
> It should be up to the application whether a MAC operation or an
authenticated
> encryption operation is the best choice for the application.  COSE 
> needs
to
> simply and efficiently support both, giving the application that choice.
> 
> One use case would be a CBOR mapping of OpenID Connect login for IoT 
> usage
-
> replacing the JWT-based ID Token with a CWT-based ID Token.  This 
> would often be used with symmetric crypto, where per RP/IdP symmetric 
> HMAC keys are employed.  The ID Token (containing information about 
> the
authentication
> that occurred) would use direct HMAC.
> 
> 				-- Mike
> 
> -----Original Message-----
> From: COSE [mailto:cose-bounces@ietf.org] On Behalf Of Jim Schaad
> Sent: Saturday, November 07, 2015 2:40 PM
> To: cose@ietf.org
> Subject: [COSE] MAC with no recipient structures
> 
> People keep telling me that they want to have a version of MACs that 
> do
not
> have a set of recipient information attached so that they can do 
> direct
MACs.  I
> keep asking for a use case where this makes sense.  In all of the use
cases that I
> have been presented so far, a better answer is going to be to do an 
> AEAD encrypted item rather than a MACed item.
> 
> The scenario that wants this is going to be:
> 
> Alice sends data to Bob in such a way that Bob can authenticate the data.
> Eve needs to be able to read the data in transit, without knowing if 
> the
message
> contains data or misinformation and will act on the message as if it 
> were
data.
> 
> The difference in message size between MAC and Encryption is going to 
> be minimal, at most a few bytes.  The execution difference is going to 
> be a
few
> extra encryption operations.
> 
> What use cases exist for this where encryption is not a better 
> security
answer
> anyway.
> 
> Jim
> 
> 
> _______________________________________________
> COSE mailing list
> COSE@ietf.org
> https://www.ietf.org/mailman/listinfo/cose