Re: [jose] PBES2-HS256+A256KW or PBES2-HS512+A256KW?

[Sean Turner <[e-mail]>]

Mike,

Apologies for taking too long to get back to this.

The -01 version used HMAC-512 untruncated.  To me that didn't make much 
sense.  You're getting some level of security but you're carrying a lot 
of extra bytes.  Using either a truncated HMAC-512 as Dave's draft does 
or HMAC-SHA-256 lines up the bits of security provided by the algs.  I 
guess the embedded question is whether we should align the 3.

spt

On 7/18/13 11:26 PM, Mike Jones wrote:
> Currently JWA defines two password-based key encryption algorithms:
>
>                 PBES2-HS256+A128KW
>
>                 PBES2-HS256+A256KW
>
> I was surprised that when the AES key size was increased from 128 to
> 256, the HMAC key size was not also increased from 256 to 512. Sean,
> Matt had told me that this used to be the case in his individual draft,
> but that you had requested that HMAC SHA-256 be used for both algorithms.
>
> If for no other reasons than symmetry, I’m curious why.  For instance,
> in McGrew’s AES-CBC-HMAC-SHA2 draft, these pairings are made:
>
>                 128 bit AES with 256 bit HMAC
>
>                 192 bit AES with 384 bit HMAC
>
>                 256 bit AES with 512 bit HMAC
>
> Sean, why aren’t we doing the same for password-based encryption?
>
>                                                              Thanks,
>
>                                                              -- Mike
>