Re: [KEYPROV] KW-AES-128 vs. AES-128-CBC

["Matt Ball" <[e-mail]>]

Hi Folks,

>From a NIST (i.e., FIPS 140-2) point-of-view, the only currently approved
symmetric algorithm for protecting keys is AES Key Wrap (e.g., KW-AES-128).
NIST will likely expand the list of approved algorithms in the next couple
years, but I'm sure that they will always have a requirement to include both
confidentiality and integrity.  For this reason, if the decision is for
AES-128-CBC, I would recommend adding an HMAC-SHA for integrity.  AES Key
Wrap already adds in a 64-bit integrity check, so this comes for 'free'.

Preferences:
1) AES Key Wrap
2) AES-CBC with HMAC-SHA

Cheers,
-Matt

On Mon, Jan 12, 2009 at 4:06 PM, Hannes Tschofenig <
[e-mail]> wrote:

> Hi all,
>
> Section 6.1.1. of
>
> http://www.ietf.org/internet-drafts/draft-ietf-keyprov-portable-symmetric-ke
> y-container-06.txt<http://www.ietf.org/internet-drafts/draft-ietf-keyprov-portable-symmetric-key-container-06.txt>describes the AES-128-CBC encryption algorithm as
> mandatory to implement.
>
> It was suggested to switch from AES-128-CBC to KW-AES-128 as the mandatory
> algorithm.
>
> During the meeting we had a very brief chat about this topic, see (and
> hear):
> http://www.ietf.org/proceedings/08nov/slides/keyprov-2/keyprov-2.htm
> ftp://videolab.uoregon.edu/pub/videolab/media/ietf73/ietf73-ch8-wed-am2.mp3
>
> I checked the meeting minutes and noticed that they do not capture a lot:
> http://www.ietf.org/proceedings/08nov/minutes/keyprov.txt
>
> So, let's us do a quick poll.
>
> Please indicate your preference (if possible with arguments why you want
> one
> or the other).
>
> --> Deadline for your response: 20th Jan. 2009 <--
>
> Ciao
> Hannes
>
> ________________________________
>
>        From: [e-mail] [mailto:[e-mail]] On
> Behalf Of Pei, Mingliang
>        Sent: 12 January, 2009 20:01
>        To: Philip Hoyer; [e-mail]; [e-mail]
>        Subject: Re: [KEYPROV] Examples in PSKC
>
>
>        It was an issue raised during 73-th IETF. I wasn't aware that the
> decision to KW has been made in the follow up calls. Thanks for the update.
> I will make changes to AES-128-KW.
>
>        - Ming
>
>
> ________________________________
>
>                From: Philip Hoyer [mailto:[e-mail]]
>                Sent: Monday, January 12, 2009 2:31 AM
>                To: Pei, Mingliang; [e-mail];
> [e-mail]
>                Subject: RE: [KEYPROV] Examples in PSKC
>
>
>
>                Ming,
>
>                We agreed on previous call that the KW version AES 128 will
> be the mandatory algorithm for PSKC and DSKPP so we need examples using
> KW-AES-128
>
>
>
>                Philip
>
>
>
>                ________________________________
>
>                                From: [e-mail]
> [mailto:[e-mail]] On Behalf Of Pei, Mingliang
>                Sent: Monday, January 12, 2009 9:38 AM
>                To: [e-mail]; [e-mail]
>                Subject: Re: [KEYPROV] Examples in PSKC
>
>
>
>                Yes, I have done AES128-CBC examples. The padding and iv are
> well considered in the example now, and I will update the draft to reflect
> the specifications and example data. The mac key choice is the encryption
> key by default and we need to come out a way to allow other mac key as we
> discussed during 73th ietf.
>
>                I am working on the rsa example, and hope to get most
> results before Tuesday's call.
>
>                - Ming
>
>
>                ----- Original Message -----
>                From: Hannes Tschofenig <[e-mail]>
>                To: Pei, Mingliang; [e-mail]
> <[e-mail]>; [e-mail] <[e-mail]>
>                Sent: Sat Jan 10 09:22:36 2009
>                Subject: RE: [KEYPROV] Examples in PSKC
>
>                Ming,
>
>                Are you making progress with the examples?
>
>                Ciao
>                Hannes
>
>
>                ________________________________
>
>                        From: [e-mail]
> [mailto:[e-mail]] On
>                Behalf Of ext Pei, Mingliang
>                        Sent: 15 December, 2008 09:25
>                        To: [e-mail]; [e-mail]
>                        Subject: Re: [KEYPROV] Examples in PSKC
>
>
>
>                        I am one. Philip also suggested that it better has
> two versions so
>                that they can verify each other. Hope to get another
> reference check.
>
>                        - Ming
>
>                        ----- Original Message -----
>                        From: [e-mail]
> <[e-mail]>
>                        To: [e-mail] <[e-mail]>
>                        Sent: Sun Dec 14 04:55:43 2008
>                        Subject: [KEYPROV] Examples in PSKC
>
>                        Hi all,
>
>                        during the IETF#73 KEYPROV meeting Ming mentioned
> that the examples
>                will be
>                        extended in such a way that they can actually be
> verified, i.e.,
>                when there
>                        is a digital signature then enough information is
> provided in the
>                document
>                        so that it can be checked for correctness.
>
>                        What I have in mind is something similar to what is
> done in
>                        http://www.ietf.org/rfc/rfc4474.txt (see also
> Appendix B)
>
>                        So, who is working on this aspect?
>
>                        Ciao
>                        Hannes
>
>
>                        _______________________________________________
>                        KEYPROV mailing list
>                        [e-mail]
>                        https://www.ietf.org/mailman/listinfo/keyprov
>
>
>
>
>
> _______________________________________________
> KEYPROV mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/keyprov
>



-- 
Thanks!
-Matt

Matt Ball, IEEE P1619.x SISWG Chair
Cell: 303-717-2717
http://www.linkedin.com/in/matthewvball
http://www.mavaball.net/

_______________________________________________
KEYPROV mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/keyprov