Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16EC8C14F6B8; Wed, 4 Sep 2024 12:24:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.654 X-Spam-Level: X-Spam-Status: No, score=-1.654 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=no autolearn_force=no Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uwpVE2f-6lss; Wed, 4 Sep 2024 12:24:14 -0700 (PDT) Received: from mail-oo1-f45.google.com (mail-oo1-f45.google.com [209.85.161.45]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EB00C14F699; Wed, 4 Sep 2024 12:24:14 -0700 (PDT) Received: by mail-oo1-f45.google.com with SMTP id 006d021491bc7-5df9433ac0cso4728838eaf.3; Wed, 04 Sep 2024 12:24:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725477853; x=1726082653; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=8TXE922FxThs+e0JbtFiVTRQ6maggTgv9pduiv3vSwk=; b=skvcmIbASMdhP1+cQfjWRQ1B48PVVkSjdnTtMNUNBGyyafA9pdeInxlq9ZlusFpQyB wJCvEMrCJXkZIVJ7ufAONbt9rgBAFbqEdrFPS2yXmzyeCTtE0PeMkNAyyNeyUPic/uRp yxTUBoz+5kT216qZOZm5GZyLS8UVhs0CsKZNrK32Lg7PNrkFpWp3hG/rJTp33BBxUBms pGyRiNwT/W2M1lecqLpnsEWtjBfA6arykFdWTiwWecz2tEUUQimuk0oHDk2yNGbx0kVk QPdX7ZZnukhLKvPn8XsmuAuUohRl0jEtGDs6G0Lle0gvh4vJq2owQlmZm1wAZZlPEPn5 fqKg== X-Forwarded-Encrypted: i=1; AJvYcCVvcCOIYeP9Evz53h1TkEAQU8lqBLVJDzBmhE4MwMX9V4ZCPpqzZsY9ITgb1oX+xt9UCwli@ietf.org X-Gm-Message-State: AOJu0YxcmMacCINXHVZ39iNj2wlsT6klyUNaTrH0NYRIqfXzKKnmy5tK 1DYX5AZFi5YG/KujBlhk4+tPehnXU75GipQGOUx/RB1lMaKU51I5+bXJV8XNu+N0NlowIwqFuU1 HPjXnkt+Uv7AKHopkpb+xXHUlpCI= X-Google-Smtp-Source: AGHT+IGgNpMki4Boaw6FDTgIUrkJX7r7eP+bp9bAsgbw/zjCwpIN93pmXiHedNra+tRmKwnT9KZG+48nWrjf+QzbMpM= X-Received: by 2002:a05:6820:2202:b0:5d8:6769:9d85 with SMTP id 006d021491bc7-5dfad01f5bamr19680406eaf.6.1725477853579; Wed, 04 Sep 2024 12:24:13 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Phillip Hallam-Baker Date: Wed, 4 Sep 2024 15:24:02 -0400 Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary="00000000000087d0e70621501e2b" Message-ID-Hash: JHBUU27UZ2WUZTUICSDMUARY6SYYIDY6 X-Message-ID-Hash: JHBUU27UZ2WUZTUICSDMUARY6SYYIDY6 X-MailFrom: hallam@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-jose.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: jose@ietf.org, cose WG X-Mailman-Version: 3.3.9rc4 Precedence: list Subject: =?utf-8?q?=5Bjose=5D_Re=3A_=5BCOSE=5D_Re=3A_ML-KEM_recipient_info?= List-Id: Javascript Object Signing and Encryption Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --00000000000087d0e70621501e2b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Much of the work at this stage is going to come under the heading 'standards describe the things that don't matter'. The exact serialization, I really don't care about at all, but we all have to agree to use the same thing. On Wed, Sep 4, 2024 at 3:00=E2=80=AFPM Ilari Liusvaara wrote: > On Wed, Sep 04, 2024 at 12:59:57PM -0400, Phillip Hallam-Baker wrote: > > Has anyone considered how to encode the recipient info for ML-KEM? > > Yes. > > > > RFC 7518 specifies a different key blob 'JWE Encrypted Key' per algorit= hm > > and ML-KEM doesn't look like either RSA or DH and its variations. > > Actually, it does look like how DH is used in COSE/JOSE. > > > > RSA has key recovery, DH uses an ephemeral key and fills the epk slot. > > ML-KEM does not create an ephemeral, it looks more like RSA except that > it > > doesn't provide key recovery. > > > > And that means that if there are multiple recipient blobs on a message, > we > > need to extend the definition because we are going to need to encrypt t= he > > content under the content-shared secret and then wrap that in the share= d > > secret from ML-KEM. Which means we are going to need two slots for data= , > a > > wrapped key slot and an ML-KEM ciphertext slot. > > Using epk slot would lead to some annoying complications, because that > one needs full key strucure, but one only has a byte string. > > Both COSE and JOSE specify slot to stuff the wrapped key to. > > For stuffing the ML-KEM ciphertext, for COSE, the easiest would be to > reuse the -4 slot from COSE-HPKE. For JOSE, one might have to define > a new parameter. > > > > (Because the content has to be encrypted under the same key for each > > recipient...) > > > > So I am thinking of something like this: > > > > "recipients":[{ > > "kid":"MBUX-V4NE-VRJS-6NT7-6QKR-DE2W-QQBG", > > "ct": "OYT5iH4doxVrj90NRowmffE20OOPLl....RGqaCav6b-Xw4", > > "wmk":"N3KQ0jcCztbOMSOwcvy_UdGNsLL-PMtd9_ZMuWqT4GzEIXj33a > > HlKQ"} > > > > Comments? > > That looks very much off... I would think it would be something like: > > "recipients":[ > { > "header":{ > "alg":"KEM+AES256KW", > "kid":"2011-04-29", > "ek":"geokgoekgosok...oegksgogoesgkosekg" > }, > > "encrypted_key:"D90J_pteUjm-jcoIRrWdgkQuyuzbS584BndndQhPhPvlJbgYWy7qh2qW4= qCSmSpW" > } > ] > > The "ek" is the ML-KEM ciphertext, "encrypted_key" is the wrapped key. > > The algorithm has class Key Agreement with Key Wrapping. > > > > > -Ilari > > _______________________________________________ > COSE mailing list -- cose@ietf.org > To unsubscribe send an email to cose-leave@ietf.org > --00000000000087d0e70621501e2b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Muc= h of the work at this stage is going to come under the heading 'standar= ds describe the things that don't matter'.

The exact serialization, I really don't care = about at all, but we all have to agree to use the same thing.


On Wed, Sep 4, 202= 4 at 3:00=E2=80=AFPM Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
On Wed, Sep 04, 2024 at 12:59:57PM -0400,= Phillip Hallam-Baker wrote:
> Has anyone considered how to encode the recipient info for ML-KEM?

Yes.


> RFC 7518 specifies a different key blob 'JWE Encrypted Key' pe= r algorithm
> and ML-KEM doesn't look like either RSA or DH and its variations.<= br>
Actually, it does look like how DH is used in COSE/JOSE.


> RSA has key recovery, DH uses an ephemeral key and fills the epk slot.=
> ML-KEM does not create an ephemeral, it looks more like RSA except tha= t it
> doesn't provide key recovery.
>
> And that means that if there are multiple recipient blobs on a message= , we
> need to extend the definition because we are going to need to encrypt = the
> content under the content-shared secret and then wrap that in the shar= ed
> secret from ML-KEM. Which means we are going to need two slots for dat= a, a
> wrapped key slot and an ML-KEM ciphertext slot.

Using epk slot would lead to some annoying complications, because that
one needs full key strucure, but one only has a byte string.

Both COSE and JOSE specify slot to stuff the wrapped key to.

For stuffing the ML-KEM ciphertext, for COSE, the easiest would be to
reuse the -4 slot from COSE-HPKE. For JOSE, one might have to define
a new parameter.


> (Because the content has to be encrypted under the same key for each > recipient...)
>
> So I am thinking of something like this:
>
>=C2=A0 =C2=A0 =C2=A0"recipients":[{
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"kid":"MBUX-V4NE-VRJS-= 6NT7-6QKR-DE2W-QQBG",
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"ct": "OYT5iH4doxVrj90= NRowmffE20OOPLl....RGqaCav6b-Xw4",
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"wmk":"N3KQ0jcCztbOMSO= wcvy_UdGNsLL-PMtd9_ZMuWqT4GzEIXj33a
>=C2=A0 =C2=A0HlKQ"}
>
> Comments?

That looks very much off... I would think it would be something like:

"recipients":[
=C2=A0 =C2=A0 =C2=A0 =C2=A0 {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "header":= {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 "alg":"KEM+AES256KW",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 "kid":"2011-04-29",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 "ek":"geokgoekgosok...oegksgogoesgkosekg" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 },
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "encrypted_key= :"D90J_pteUjm-jcoIRrWdgkQuyuzbS584BndndQhPhPvlJbgYWy7qh2qW4qCSmSpW&quo= t;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 }
]

The "ek" is the ML-KEM ciphertext, "encrypted_key" is t= he wrapped key.

The algorithm has class Key Agreement with Key Wrapping.




-Ilari

_______________________________________________
COSE mailing list -- cos= e@ietf.org
To unsubscribe send an email to cose-leave@ietf.org
--00000000000087d0e70621501e2b--