Re: [lamps] Review draft-ietf-lamps-cms-mix-with-psk-00

[Russ Housley <[e-mail]>]

Jim:

> * I am missing the discussion about what the KDK length is going to be for a
> key agreement algorithm.   Am I just blind?

I have been playing with a toy implementation to make sure that I have sorted out all of the issues, and I think that the key agreement needs some fine tuning, not so much in what is actually going on, but more in the way that it is explained.

I think this processing description will make more sense, and it will encourage the intended code reuse...

   1. The content-encryption key is generated at random.

   2. The pairwise key-encryption key is established for each recipient.
        The recipient's public key and the sender's private key are used
        to produce a pairwise symmetric key-encryption key, called KEK1.

   3.  The key derivation function (KDF) is used to mix the pre-shared
         key (PSK) and KEK1, and the result is called KEK2.

   4. The KEK2 is used to encrypt the content-encryption key.

KEK1 is not actually used to encrypt anything, but it allows existing DH and ECDH implementations to used without any modification.

I think this also makes it very clear why KEK1 and KEK2 ought to be the same size.

Russ