Re: [plasma] Encrypted KEK and/or encrypted

"Jim Schaad" <jimsch@nwlink.com> Thu, 28 June 2012 03:34 UTC

From: Jim Schaad <jimsch@nwlink.com>
To: 'Dan Griffin' <dan@jwsecure.com>, plasma@ietf.org
References: <B66E1F139A0F29418103E63A6124AC1C09FDFE4D@BY2PRD0511MB427.namprd05.prod.outlook.com>
In-Reply-To: <B66E1F139A0F29418103E63A6124AC1C09FDFE4D@BY2PRD0511MB427.namprd05.prod.outlook.com>
Date: Wed, 27 Jun 2012 20:02:54 -0700
Message-ID: <019e01cd54da$8518ef60$8f4ace20$@nwlink.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_019F_01CD549F.D8BADAB0"
Thread-Index: AQIBEGi/vb0IilwtWX6W18bWciwOE5ank1cQ
Content-Language: en-us
Subject: Re: [plasma] Encrypted KEK and/or encrypted
Precedence: list

For privacy reasons, the Plasma server is not permitted to see the message
content being sent from the sender to the recipient. 

 

The Plasma server gets the KEK and not the CEK.  The Plasma server encrypts
the OtherKeyAttribute not the message.  I will need to re-read the documents
but if you point out where this is not clear it would help.

 

Jim

 

 

From: plasma-bounces@ietf.org [mailto:plasma-bounces@ietf.org] On Behalf Of
Dan Griffin
Sent: Wednesday, June 27, 2012 1:54 PM
To: plasma@ietf.org
Subject: [plasma] Encrypted KEK and/or encrypted

 

In the Plasma CMS extensions, the KEKRecipientInfo includes a member of type
EncryptedKey. To confirm, is it intended that that KEK byte array be
encrypted in addition to the outer P7 message being encrypted, both by the
Plasma server? 

 

It would seem that the desired solution is for the Plasma server to encrypt
the entire CMS data, for privacy purposes, and that therefore encrypting
internal data members is redundant.

 

Thanks.

[plasma] Encrypted KEK and/or encrypted Dan Griffin
Re: [plasma] Encrypted KEK and/or encrypted Jim Schaad