Re: [jose] #28: AES-GCM should not be allowed for content encryption in combination with Direct Encryption key management mode

["jose issue tracker" <[e-mail]>]

#28: AES-GCM should not be allowed for content encryption in combination with
Direct Encryption key management mode


Comment (by [e-mail]):

 Thanks for pointing out the NIST text.  Rather than prohibiting the use of
 GCM, a less heavy-handed means of handling this issue would be to include
 text such as the following:

 "NIST SP 800-38D section 8.3 states 'The total number of invocations of
 the authenticated encryption function shall not exceed 2^32, including all
 IV lengths and all instances of the authenticated encryption function with
 the given key.'  In accordance with this rule, AES GCM MUST NOT be used
 with the same direct encryption key more than 2^32 times."

 No we can’t guarantee that applications will always follow this
 requirement, but we can’t guarantee that many other requirements are
 followed either – such as the requirement to use a unique ephemeral key
 when doing key agreement.  Just because incorrect uses are possible
 doesn’t mean that we shouldn’t enable correct uses.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [e-mail]        |  [e-mail]
     Type:  defect       |      Status:  new
 Priority:  major        |   Milestone:
Component:  json-web-    |     Version:
  algorithms             |  Resolution:
 Severity:  -            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/28#comment:1>
jose <http://tools.ietf.org/jose/>