[Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)

[Brian Campbell <[e-mail]>]

What value does key management on the MAC authentication key really
provide? I'm struggling to see it. What I do see is that it will make
messages larger and add complexity. And it seems very likely to be a source
of confusion that results in security problems around when integrity only
is provided vs. integrity and sender authentication. The latter being what
most will expect a MAC provides while the former isn't very useful but
potentially very problematic.

FWIW, I asked same(ish) question on the JOSE list
<http://www.ietf.org/mail-archive/web/jose/current/msg05156.html> yesterday
in regard to an individual draft about key managed MAC keys in JOSE.





On Sat, Jun 27, 2015 at 9:25 AM, Jim Schaad <[e-mail]> wrote:





*From:* Cose [mailto:[e-mail]] *On Behalf Of *Mike Jones
*Sent:* Saturday, June 27, 2015 2:07 AM
*To:* [e-mail]
*Subject:* [Cose] Review of draft-schaad-cose-msg-01





[JLS] This was discussed on the mailing list.  There are a number of
trade-offs that were discussed.  Please review that discussion and see if
you have something new to add.  Please remember that we are looking at both
the message size and the code size as criteria when making decisions.



*2.  HMACs should be optimized for the no-key-management case.*



Particularly for constrained devices, it is unlikely that applications will
want to pay the performance penalty of generating and encrypting a key
management key to perform a MAC operation.  Heck, they may not have
credible random number generation in the first place!  And they are
likewise unlikely to want to pay the message size penalty of carrying the
encrypted key.



I’m fine with the optional ability to have key management for MACs, but the
default should be that no key management information is present in the
representation.  The only algorithm represented by default should be the
MAC algorithm – not even “dir” (direct).  I suspect that this can be
cleanly done by omitting the key management layer entirely when it’s not
used, rather than explicitly using “dir” (direct).



[JLS] See above.