[jose] PBES2-HS256+A128KW: where do salt and iteration count go?

"Manger, James H" <James.H.Manger@team.telstra.com> Tue, 16 July 2013 01:13 UTC

Return-Path: <James.H.Manger@team.telstra.com>
X-Original-To: jose@ietfa.amsl.com
Delivered-To: jose@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id A3EC311E80F2 for <jose@ietfa.amsl.com>; Mon, 15 Jul 2013 18:13:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.963
X-Spam-Status: No, score=-0.963 tagged_above=-999 required=5 tests=[AWL=-0.062, BAYES_00=-2.599, HELO_EQ_AU=0.377, HOST_EQ_AU=0.327, RELAY_IS_203=0.994]
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id SwCf9Z3Rax+i for <jose@ietfa.amsl.com>; Mon, 15 Jul 2013 18:13:38 -0700 (PDT)
Received: from ipxcvo.tcif.telstra.com.au (ipxcvo.tcif.telstra.com.au []) by ietfa.amsl.com (Postfix) with ESMTP id 57EE711E810A for <jose@ietf.org>; Mon, 15 Jul 2013 18:13:38 -0700 (PDT)
X-IronPort-AV: E=Sophos;i="4.89,673,1367935200"; d="scan'208";a="146831941"
Received: from unknown (HELO ipcbvi.tcif.telstra.com.au) ([]) by ipocvi.tcif.telstra.com.au with ESMTP; 16 Jul 2013 11:13:32 +1000
X-IronPort-AV: E=McAfee;i="5400,1158,7137"; a="144066262"
Received: from wsmsg3707.srv.dir.telstra.com ([]) by ipcbvi.tcif.telstra.com.au with ESMTP; 16 Jul 2013 11:13:32 +1000
Received: from WSMSG3153V.srv.dir.telstra.com ([]) by wsmsg3707.srv.dir.telstra.com ([]) with mapi; Tue, 16 Jul 2013 11:13:31 +1000
From: "Manger, James H" <James.H.Manger@team.telstra.com>
To: "jose@ietf.org" <jose@ietf.org>
Date: Tue, 16 Jul 2013 11:13:30 +1000
Thread-Topic: PBES2-HS256+A128KW: where do salt and iteration count go?
Thread-Index: Ac6Bwa7E5l6r/DDHRwe+2UU0iYcgFQ==
Message-ID: <255B9BB34FB7D647A506DC292726F6E1151C7C31BF@WSMSG3153V.srv.dir.telstra.com>
Accept-Language: en-US, en-AU
Content-Language: en-US
acceptlanguage: en-US, en-AU
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Subject: [jose] PBES2-HS256+A128KW: where do salt and iteration count go?
X-BeenThere: jose@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Javascript Object Signing and Encryption <jose.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/jose>, <mailto:jose-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/jose>
List-Post: <mailto:jose@ietf.org>
List-Help: <mailto:jose-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/jose>, <mailto:jose-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Jul 2013 01:13:43 -0000

draft-ietf-jose-json-web-algorithms-13 adds password-based encryption algorithms that involve a salt (s) and iteration count (c). I cannot quite tell how s & c are conveyed. Section 4.9.1 "PBES2-HS256+A128KW" says s & c come from the "applicable PBKDF2 JWK object".

Is the "applicable PBKDF2 JWK object" the value of the "jwk" header parameter in a JWE message?
Or is the "applicable PBKDF2 JWK object" part of each parties locally-configured key set (which is not part of a message, but can be referenced by a "kid" header parameter)?

The latter makes little sense as salt and iteration count are parameters of a particular message, not fixed for a given password.

The former is at best underspecified. "jwk" is defined as "the public key to which the JWE was encrypted" [http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-13#section-4.1.5]. s & c obviously are not a public key so that definition would need to change.

A PBKDF2 JWK object is also defined to have a 'hint' parameter ("a descriptive clue to the password"). It would be awful if 'hint's were sent in JOSE messages. JWK needs to do a much better job of separating sensitive fields (secret key, private key, password hint) from public fields. If we need text to display when prompting for a password I think we need a different field to 'hint'.

An example of PBES2-HS256+A128KW would help.

James Manger