[lamps] KeyTransRecipientInfo vs. KEMRecipientInfo

[Russ Housley <[e-mail]>]

I have been looking at RSA-KEM to try and decide whether KeyTransRecipientInfo or a new KEMRecipientInfo is the better way forward for CMS with Kyber.

RFC 5990 defines RSA-KEM and specifies the use with KeyTransRecipientInfo.  The result is a fairly complex use of the parameters of AlgorithmIdentifier.

    SEQUENCE {
       id-rsa-kem,                                   -- RSA-KEM cipher
       SEQUENCE {                           -- GenericHybridParameters
          SEQUENCE {                    -- key encapsulation mechanism
             id-kem-rsa,                                    -- RSA-KEM
             SEQUENCE {                            -- RsaKemParameters
                SEQUENCE {                  -- key derivation function
                   id-kdf-kdf3,                                -- KDF3
                   SEQUENCE {                     -- KDF3-HashFunction
                      id-sha256  -- SHA-256; no parameters (preferred)
                   },
                16                              -- KEK length in bytes
                },
          SEQUENCE {                   -- data encapsulation mechanism
             id-aes128-Wrap             -- AES-128 Wrap; no parameters
          }
       }
    } 

Lately, we have been trying to make the eliminate parameters, and when we cannot do so, we keep them very simple.

On one hand, the KeyTransRecipientInfo is already defined and it can be made to work.

On the other hand, KEMRecipientInfo would simply carry KEM algorithm identifier, the KDF algorithm identifier, and the Key Wrap algorithm identifier, the KEK length, and any other information that we need in a straightforward structure.

For this reason, I am leaning toward the definition of KEMRecipientInfo.  I am willing to work on a draft.

What do others think?

Russ