Re: [Teep] [Suit] ECDH-ES + A128KW vs. ECDH-ES + HKDF-256

Laurence:

I am aware of a presentation about an attack against AES-GCM and AES-CCM:

	Roth, J. and F. Strenzke,
	"AEAD-to-CBC Downgrade Attacks on CMS",
	8 November 2023,
	<https://datatracker.ietf.org/meeting/118/materials/slides-118-lamps-attack-against-aead-in-cms>.

I am not aware of any attacks that involve AES-KW.

Where can I find information about the attack you are talking about?

Russ

> On Dec 14, 2023, at 12:19 PM, lgl island-resort.com <lgl@island-resort.com> wrote:
> 
> Note that there is a vulnerability in ECDH-ES + A128KW — the one that was presented in Prague. I think there are fixes, and it’s on my list to dig into it (IETF/COSE needs a full, proper and secure multi-recipient modern encryption format), but don’t have bandwidth right now.
> 
> LL
> 
>> On Dec 14, 2023, at 2:18 AM, hannes.tschofenig=40gmx.net@dmarc.ietf.org wrote:
>> 
>> Thank you all for your quick response. From the feedback it seems clear to go for ECDH-ES + A128KW
>> We will update the documents accordingly.
>> 
>> -----Original Message-----
>> From: Suit <suit-bounces@ietf.org> On Behalf Of Akira Tsukamoto
>> Sent: Donnerstag, 14. Dezember 2023 06:29
>> To: Brendan Moran <brendan.moran.ietf@gmail.com>; Russ Housley <housley@vigilsec.com>; Hannes Tschofenig <Hannes.Tschofenig@gmx.net>
>> Cc: suit@ietf.org; teep@ietf.org; Ken Takayama <ken.takayama.ietf@gmail.com>
>> Subject: Re: [Suit] [Teep] ECDH-ES + A128KW vs. ECDH-ES + HKDF-256
>> 
>> Hi Brendan,
>> 
>> I am fine changing the MTI with ECDH-ES + A128KW.
>> 
>> Akira
>> 
>> On 12/14/2023 12:08 AM, Russ Housley wrote:
>>> I think ECDH-ES + A128KW covers more use cases.  It can be used with on recipient or many recipients.  So, I'd like to see that be the MTI.
>>> 
>>> Russ
>>> 
>>> 
>>>> On Dec 13, 2023, at 3:38 AM, hannes.tschofenig=40gmx.net@dmarc.ietf.org wrote:
>>>> 
>>>> Hi all,
>>>> 
>>>> In the SUIT firmware encryption draft we have so far used ECDH-ES + A128KW, which is also what we implemented in t_cose to generate the examples.
>>>> 
>>>> In a discussion with Ken today we realized that the SUIT-MTI draft has always used ECDH-ES + HKDF-256 instead.
>>>> 
>>>> Now, the question is: Should we support both, ECDH-ES + A128KW and ECDH-ES + HKDF-256?
>>>> 
>>>> IHMO we definitely need AES-KW for scenarios where we encrypt a firmware with a CEK once and then distribute that encrypted firmware image to many recipients. In this case, we 
>>>> 
>>>> * randomly generate a CEK, 
>>>> * encrypt the firmware using this CEK, 
>>>> * encrypt this CEK with a KEY unique per recipient with a KEK. The KEK is the result of using ECDH-ES with an KDF, as described in Section 6.4 of RFC 9053. 
>>>> 
>>>> 
>>>> For scenarios where we send one firmware image to one recipient we could use ECDH-ES + HKDF-256 and currently we have a little bit of overhead here by using ECDH-ES + A128KW.
>>>> 
>>>> My preference is to leave the SUIT firmware encryption draft as is and to change the SUIT MTI draft to reference ECDH-ES + A128KW instead of ECDH-ES + HKDF-256.
>>>> 
>>>> Thoughts?
>>>> 
>>>> Ciao
>>>> Hannes
>>>> 
>>> 
>>> _______________________________________________
>>> TEEP mailing list
>>> TEEP@ietf.org
>>> https://www.ietf.org/mailman/listinfo/teep
>> 
>> _______________________________________________
>> Suit mailing list
>> Suit@ietf.org
>> https://www.ietf.org/mailman/listinfo/suit
>> 
>> _______________________________________________
>> Suit mailing list
>> Suit@ietf.org
>> https://www.ietf.org/mailman/listinfo/suit
> 