Re: [lamps] CMS: selection of key management technique to use for EnvelopedData

["von Oheimb, David" <[e-mail]>]

Russ et al.,

On Sat, 2022-12-24 at 15:06 -0500, Russ Housley wrote:

I wonder why nobody brought this up before -
maybe simply because cryptographically educated users of CMS know (and others should learn by failure) that RSA does not support key agreement and ECC does not support key transport.

The CMS-related algorithm specifications make it pretty clear.  For example, RFC 5753 tells ho to use ECC Algorithms in CMS.  I do not see how an implementer would try to use KeyTransRecipientInfo after reading that document.

indeed https://datatracker.ietf.org/doc/html/rfc5753#section-3 describes for ECC only key agreement and not key transport.
Yet even from this RFC, one cannot conclude (without assumed/implicit general crypto knowledge) that this is the only possible choice for ECC,
and for RSA a naive crypto implementer would have a hard time looking around further until hopefully finding some guidance elsewhere.


Maybe some pointers are needed in CMP in the central key generation section.

Yes, this is what we were after - one or two simple pointers to some place where suitable explicit spec/guidance was already present.
Yet from our recent exchange I've come to the somewhat disappointing conclusion that this does not (yet) exist.
So likely we have to specify something ourselves, for instance:

The key transport key management technique SHALL be used if the public key in the recipient certificate is an RSA key.
The key agreement key management technique SHALL be used if the public key is an EC or DH key.
For any other key type, a suitable key management technique should be chosen (but is not defined here).

Does this text sufficiently reflect the current state of the art?
I'm aware that for PQ KEM keys different key management techniques will be used, but those are out of scope of the CMP profile for now.

David