[jose] Discussion Minutes on draft-mcgrew-aead-aes-hmac-sha2

["Matt Miller (mamille2)" <[e-mail]>]

A short discussion was had last night (US time) regarding David McGrew's draft < http://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2 >.

Below are the minutes, but for the TL;DR crowd: small refactors to draft-mcgrew-aead to allow for alternative formats, which JOSE is considered to be.  The goal is to drop the JWA defined composite algorithm in favor of draft-mgcrew-aead.


Thanks,

- m&m

Matt Miller < [e-mail] >
Cisco Systems, Inc.

-----BEGIN MINUTES-----

VENUE
-----

WebEx on 2013-03-20T22:00:00Z, approximately 30 minutes (apologies for not recording!)

ATTENDEES
---------
* Michael Jones
* David McGrew
* Matt Miller

NOTES
-----

Based on email exchanges prior to meeting, a rough consensus has been reached. It is suggested that David's draft separate the inputs, outputs, and process from what is encoded for the wire; this should allow JOSE to be compliant but retain its formatting.  Roughly speaking this means:

* inputs and outputs (independent of encoding)
* process
* encoding for RFC 5116
* test vectors

David believes a new version for (limited?) review should be available next week (03/25 - 03/29).

David also directed Mike to draft-mcgrew-iv-gen[1], and will suggest some text about how IV ought to be generated for GCM.

There was a side discussion on the use of AES Key Wrap and its accessibility to implementers, versus using existing AEAD algorithms for key wrap. Given the general lack of support by underlying cryptographic libraries, re-using AEAD is very desirable.

ACTIONS
-------

* David to provide a new revision of draft-mcgrew-aead-aes-hmac-sha2 with suggested changes
* David to provide suggested text on IV generation for GCM
* Mike to review updated draft-mcgrew-aead-aes-hmac-sha2 when available
* Mike to update draft-ietf-jose-json-web-algorithms with suggested text on GCM initialization vector values when available

-----END MINUTES-----