Re: [jose] JOSE and PKCS11

"Stefan Berger" <stefanb@us.ibm.com> Tue, 26 February 2019 23:29 UTC

Return-Path: <stefanb@us.ibm.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1208E1286E7 for <jose@ietfa.amsl.com>; Tue, 26 Feb 2019 15:29:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LIw_3c29KvVT for <jose@ietfa.amsl.com>; Tue, 26 Feb 2019 15:29:31 -0800 (PST)
Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02C58126D00 for <jose@ietf.org>; Tue, 26 Feb 2019 15:29:30 -0800 (PST)
Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x1QNO4Fe131319 for <jose@ietf.org>; Tue, 26 Feb 2019 18:29:30 -0500
Received: from smtp.notes.na.collabserv.com (smtp.notes.na.collabserv.com [192.155.248.81]) by mx0a-001b2d01.pphosted.com with ESMTP id 2qweb7j3u7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <jose@ietf.org>; Tue, 26 Feb 2019 18:29:29 -0500
Received: from localhost by smtp.notes.na.collabserv.com with smtp.notes.na.collabserv.com ESMTP for <jose@ietf.org> from <stefanb@us.ibm.com>; Tue, 26 Feb 2019 23:29:28 -0000
Received: from us1a3-smtp04.a3.dal06.isc4sb.com (10.106.154.237) by smtp.notes.na.collabserv.com (10.106.227.88) with smtp.notes.na.collabserv.com ESMTP; Tue, 26 Feb 2019 23:29:25 -0000
Received: from us1a3-mail155.a3.dal06.isc4sb.com ([10.146.38.88]) by us1a3-smtp04.a3.dal06.isc4sb.com with ESMTP id 2019022623292495-1222001 ; Tue, 26 Feb 2019 23:29:24 +0000
MIME-Version: 1.0
In-Reply-To: <CAOASepMU3waryT=TKpw7sKFw-FT+JE3h-3xWUS7AZQwGgp8X5A@mail.gmail.com>
To: Nathaniel McCallum <npmccallum@redhat.com>
Cc: jose@ietf.org
From: "Stefan Berger" <stefanb@us.ibm.com>
Date: Tue, 26 Feb 2019 18:29:26 -0500
References: <OF5CBAD5FA.DA05866D-ON00258338.007B994B-00258338.007BD260@notes.na.collabserv.com> <CAOASepMU3waryT=TKpw7sKFw-FT+JE3h-3xWUS7AZQwGgp8X5A@mail.gmail.com>
X-KeepSent: 2BF5119B:748538F2-002583AD:007FDFBF; type=4; name=$KeepSent
X-Mailer: IBM Notes Release 9.0.1FP10 SHF68 March 06, 2018
X-LLNOutbound: False
X-Disclaimed: 14803
X-TNEFEvaluated: 1
x-cbid: 19022623-7093-0000-0000-00000A4E01C0
X-IBM-SpamModules-Scores: BY=0; FL=0; FP=0; FZ=0; HX=0; KW=0; PH=0; SC=0.415652; ST=0; TS=0; UL=0; ISC=; MB=0.019176
X-IBM-SpamModules-Versions: BY=3.00010670; HX=3.00000242; KW=3.00000007; PH=3.00000004; SC=3.00000281; SDB=6.01166841; UDB=6.00609532; IPR=6.00947446; BA=6.00006242; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00025756; XFM=3.00000015; UTC=2019-02-26 23:29:27
X-IBM-AV-DETECTION: SAVI=unsuspicious REMOTE=unsuspicious XFE=unused
X-IBM-AV-VERSION: SAVI=2019-02-26 15:38:29 - 6.00009633
x-cbparentid: 19022623-7094-0000-0000-000070E56AFB
Message-Id: <OF2BF5119B.748538F2-ON002583AD.007FDFBF-852583AD.0081099B@notes.na.collabserv.com>
Content-type: multipart/alternative; boundary="0__=8FBB093EDFEC592F8f9e8a93df938690918c8FBB093EDFEC592F"
Content-Disposition: inline
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-02-26_13:, , signatures=0
X-Proofpoint-Spam-Reason: safe
Archived-At: <https://mailarchive.ietf.org/arch/msg/jose/Uzkp-NGactmuWpoNqWU4A1uJh6w>
Subject: Re: [jose] JOSE and PKCS11
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/jose/>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Feb 2019 23:29:33 -0000

Nathaniel McCallum <npmccallum@redhat.com> wrote on 11/01/2018 07:07:55 PM:

>
> https://tools.ietf.org/html/draft-mccallum-jose-pkcs11-jwk-00
>
> I plan to update this in the upcoming months and publish it as an
> independent draft. Likewise, we are implementing it here:
>
> https://github.com/latchset/jose
>
> Your contributions are welcome!
>

RFC 7516 A.4.1 shows examples for encrypting the CEK with an RSA key and an
AES key:

   {"alg":"RSA1_5","kid":"2011-04-29"}

   and

   {"alg":"A128KW","kid":"7"}

https://tools.ietf.org/html/rfc7516#appendix-A.4.1


Would one add a p11 field for pkcs11 support in this case? Would kid still
have a meaning here? Or could one encode the pkcs11 URI in the kid field?
Similarly, one could come up with a kmip URI (missing any standard for it)
and put that into the kid, like this :  "kid": "kmip:uuid=<uuid>". An
implementation would have to have some sort of configuration file to look
up the credentials to access the server where the key with that UUID is
located.

   Stefan