Re: [jose] Use of AES-HMAC algorithm

[Dick Hardt <[e-mail]>]

On Mar 27, 2013, at 5:39 PM, Mike Jones <[e-mail]> wrote:

> I think the reason the working group is thinking about this algorithm is a combination of three things:
> 
> 1.  Using the KDF could lead to interoperability problems.  Some early implementations have gotten this wrong.

Were these improper implementations, or different interpretations? The first is a bug in the software, the second is a bug in the spec.

> 
> 2.  Apparently we're not using the Concat KDF for an approved use, as "approved" is defined by the NIST specs.  If we stop using it, this criticism would go away.

Not relevant for me, but I understand the motivation.

> 
> 3.  Some have pushed back on us "inventing a new cryptographic algorithm".  While I believe that the composition of two establish algorithms - AES-CBC and HMAC SHA-2 is easily defensible, with David McGrew being the co-chair of the Crypto Forum Research Group (CFRG) - the group that IETF people go to when wanting to validate the use of crypto algorithms - if his algorithm is approved, using it would likely be considered to be above reproach, in terms of getting JWE through the IETF approval processes.

What is David's algorithm?

> 
> So it's really "spec approval" reasons - not security reasons that the change is being considered.

A smaller key is better than a larger key, but it is not that much larger. 

> 
> 				-- Mike
> 
> P.S.  For what it's worth, you could distinguish the two algorithms by the key sizes if you wanted to run both algorithms side-by-side for a while.

Thanks for the suggestion. I can still change the implementation for the next couple weeks without impacting a third party. Would be useful to know where this will land so I can change or not.

P.S. thanks for the explanation Mike!

-- Dick