Re: [jose] Use of AES-HMAC algorithm

Mike Jones <Michael.Jones@microsoft.com> Thu, 28 March 2013 00:39 UTC

From: Mike Jones <Michael.Jones@microsoft.com>
To: Dick Hardt <dick.hardt@gmail.com>
Thread-Topic: [jose] Use of AES-HMAC algorithm
Thread-Index: Ac4nS9Dlxfl1UeEXRp6aXJeHoQZF0QD+cy9AAAFxb4AAAAnDEA==
Date: Thu, 28 Mar 2013 00:39:01 +0000
Message-ID: <4E1F6AAD24975D4BA5B168042967394367590D06@TK5EX14MBXC283.redmond.corp.microsoft.com>
References: <006801ce2b39$52595700$f70c0500$@augustcellars.com> <4E1F6AAD24975D4BA5B168042967394367590C2F@TK5EX14MBXC283.redmond.corp.microsoft.com> <1D2E2774-4A20-43AE-A2D6-30FF797DAAAF@gmail.com>
In-Reply-To: <1D2E2774-4A20-43AE-A2D6-30FF797DAAAF@gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Jim Schaad <ietf@augustcellars.com>, "jose@ietf.org" <jose@ietf.org>
Subject: Re: [jose] Use of AES-HMAC algorithm
Precedence: list

I think the reason the working group is thinking about this algorithm is a combination of three things:

1.  Using the KDF could lead to interoperability problems.  Some early implementations have gotten this wrong.

2.  Apparently we're not using the Concat KDF for an approved use, as "approved" is defined by the NIST specs.  If we stop using it, this criticism would go away.

3.  Some have pushed back on us "inventing a new cryptographic algorithm".  While I believe that the composition of two establish algorithms - AES-CBC and HMAC SHA-2 is easily defensible, with David McGrew being the co-chair of the Crypto Forum Research Group (CFRG) - the group that IETF people go to when wanting to validate the use of crypto algorithms - if his algorithm is approved, using it would likely be considered to be above reproach, in terms of getting JWE through the IETF approval processes.

So it's really "spec approval" reasons - not security reasons that the change is being considered.

				-- Mike

P.S.  For what it's worth, you could distinguish the two algorithms by the key sizes if you wanted to run both algorithms side-by-side for a while.
 
-----Original Message-----
From: Dick Hardt [mailto:dick.hardt@gmail.com] 
Sent: Wednesday, March 27, 2013 5:30 PM
To: Mike Jones
Cc: Jim Schaad; jose@ietf.org
Subject: Re: [jose] Use of AES-HMAC algorithm


On Mar 27, 2013, at 5:21 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:

> Per your point 1, I don't think anyone was advocating doubling the key size.  The proposal in John's slides for issue #3 (http://trac.tools.ietf.org/wg/jose/trac/ticket/3) was to use a CMK that is the concatenation of the AES-CBC and HMAC-SHA-2 keys, as draft-mcgrew-aead-aes-hmac-sha2 does.  For instance, when using A128CBC with HS256, the key size would be 384 bits and when using A256CBC with HS512, the key size would be 768 bits.  This would multiply the current key sizes by 1.5, with the compensating benefit being the elimination of the use of the KDF.

Was this because people thought KDF was hard? I managed to implement it in JavaScript, can't be that hard! ;-) ... or was there a security reason?

This is a breaking change to my implementation. 

FWIW: I cache the results of the KDF so that I only incur the calculation the first time I see a key.

[jose] Use of AES-HMAC algorithm Jim Schaad
Re: [jose] Use of AES-HMAC algorithm Dick Hardt
Re: [jose] Use of AES-HMAC algorithm Mike Jones
Re: [jose] Use of AES-HMAC algorithm Dick Hardt
Re: [jose] Use of AES-HMAC algorithm Mike Jones
Re: [jose] Use of AES-HMAC algorithm Dick Hardt
Re: [jose] Use of AES-HMAC algorithm Manger, James H
Re: [jose] Use of AES-HMAC algorithm Dick Hardt
Re: [jose] Use of AES-HMAC algorithm Manger, James H
Re: [jose] Use of AES-HMAC algorithm Vladimir Dzhuvinov / NimbusDS
Re: [jose] Use of AES-HMAC algorithm Jim Schaad