Re: [COSE] Authentication tag

Samuel Erdtman <samuel@erdtman.se> Sat, 18 March 2017 20:08 UTC

MIME-Version: 1.0
In-Reply-To: <00f701d29f43$c278fd60$476af820$@augustcellars.com>
References: <CAF2hCbYALonNaZ6BrmEhYosCrNsJqLmHs3YMupjOCeRxav2X9A@mail.gmail.com> <00f701d29f43$c278fd60$476af820$@augustcellars.com>
From: Samuel Erdtman <samuel@erdtman.se>
Date: Sat, 18 Mar 2017 21:08:09 +0100
Message-ID: <CAF2hCbbsEm7YNpPmQj_e2b-zfKyZ9B9E1BjLUPyZjbd44jtcNw@mail.gmail.com>
To: Jim Schaad <ietf@augustcellars.com>, ilariliusvaara@welho.com
Cc: cose <cose@ietf.org>
Content-Type: multipart/alternative; boundary="f4030437951c686245054b06da90"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cose/X871u1sEiAzzj0qsFBEJ-eoSqu8>
Subject: Re: [COSE] Authentication tag
Precedence: list

Thanks Jim and Ilari for the quick replies.

So if I understand it correctly RFC 5116 defines AE and AEAD with the
requirement to bundle the tag with the ciphertext, so it would not be
allowed to put the tag in the COSE headers.

Section 10 Content Encryption Algorithms, gives a hint of where to find the
tag, 'normally' appended. Forgive me my ignorance, but does GCM have a more
normative requirement on the location of the tag in a ciphertext?

If GCM does not mandate the location of the tag in the ciphertext and we
cannot put it in a header attribute then I would like more explicit
language about where to find/put the tag.

Once again thanks for the quick and enlightening reply.

Cheers
//Samuel

On Fri, Mar 17, 2017 at 6:27 PM, Jim Schaad <ietf@augustcellars.com> wrote:

> From Section 10:
>
>
>
> COSE restricts the set of legal content encryption algorithms to those
> that support authentication both of the content and additional data. The
> encryption process will generate some type of authentication value, but
> that value may be either explicit or implicit in terms of the algorithm
> definition. For simplicity sake, the authentication code will normally be
> defined as being appended to the cipher text stream. The encryption
> functions are:
>
>
>
>
>
> *From:* Samuel Erdtman [mailto:samuel@erdtman.se]
> *Sent:* Friday, March 17, 2017 9:50 AM
> *To:* cose <cose@ietf.org>; Jim Schaad <ietf@augustcellars.com>
> *Subject:* Authentication tag
>
>
>
> Hi
>
> I´m working on a JavaScript implementation of the COSE msg specification,
> currently working on the GCM encryption.
>
> In the nodejs crypto environment the authentication tag is set separately
> i.e. a specific setAuthTag call. I looked into openssl and could see that
> that was the case there too.
>
> In the examples provided with the COSE specification I could find out that
> the auth tag is appends to the end of the ciphertext.
>
> I tried to find this described in the COSE specification but could not
> find it. It might be described in some refereed specification but it was
> not obvious to me at least.
>
> If it is not to late I would suggest that authentication tag is lifted out
> from the ciphertext and into the unprotected header similar to IV. Or that
> it is explicitly described that the authentication tag should be appended
> to the ciphertext.
>
> Cheers
>
> Samuel Erdtman
>
>
>

[COSE] Authentication tag Samuel Erdtman
Re: [COSE] Authentication tag Ilari Liusvaara
Re: [COSE] Authentication tag Jim Schaad
Re: [COSE] Authentication tag Samuel Erdtman
Re: [COSE] Authentication tag Ilari Liusvaara
Re: [COSE] Authentication tag Jim Schaad
Re: [COSE] Authentication tag Samuel Erdtman
Re: [COSE] Authentication tag Samuel Erdtman
Re: [COSE] Authentication tag Justin Richer
Re: [COSE] Authentication tag Renzo Navas