[jose] PBES2-HS256+A256KW or PBES2-HS512+A256KW?

Mike Jones <Michael.Jones@microsoft.com> Thu, 18 July 2013 21:26 UTC

Received-SPF: pass (mail69-ch1: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14MLTC103.redmond.corp.microsoft.com ; icrosoft.com ;
From: Mike Jones <Michael.Jones@microsoft.com>
To: Sean Turner <turners@ieca.com>
Thread-Topic: PBES2-HS256+A256KW or PBES2-HS512+A256KW?
Thread-Index: Ac6D/X6i731YwNWqSou0hS+H2eCoCw==
Date: Thu, 18 Jul 2013 21:26:42 +0000
Message-ID: <4E1F6AAD24975D4BA5B16804296739436B6EC773@TK5EX14MBXC284.redmond.corp.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739436B6EC773TK5EX14MBXC284r_"
MIME-Version: 1.0
Cc: "jose@ietf.org" <jose@ietf.org>
Subject: [jose] PBES2-HS256+A256KW or PBES2-HS512+A256KW?
Precedence: list

Currently JWA defines two password-based key encryption algorithms:
               PBES2-HS256+A128KW
               PBES2-HS256+A256KW

I was surprised that when the AES key size was increased from 128 to 256, the HMAC key size was not also increased from 256 to 512.  Sean, Matt had told me that this used to be the case in his individual draft, but that you had requested that HMAC SHA-256 be used for both algorithms.

If for no other reasons than symmetry, I'm curious why.  For instance, in McGrew's AES-CBC-HMAC-SHA2 draft, these pairings are made:
               128 bit AES with 256 bit HMAC
               192 bit AES with 384 bit HMAC
               256 bit AES with 512 bit HMAC
Sean, why aren't we doing the same for password-based encryption?

                                                            Thanks,
                                                            -- Mike

[jose] PBES2-HS256+A256KW or PBES2-HS512+A256KW? Mike Jones
Re: [jose] PBES2-HS256+A256KW or PBES2-HS512+A256… Sean Turner
Re: [jose] PBES2-HS256+A256KW or PBES2-HS512+A256… Mike Jones