Re: [Teep] [Suit] ECDH-ES + A128KW vs. ECDH-ES + HKDF-256

Maybe I’m wrong here (hope so), but AES-GCM is used with ECDH-ES + A128KW for the bulk payload encryption and the algorithm ID identifying it is not mixed in with the KDF context so the alg ID is not really protected.

Will look at the referenced paper some more.

LL

> On Dec 14, 2023, at 10:34 AM, Russ Housley <housley@vigilsec.com> wrote:
> 
> Laurence:
> 
> I am aware of a presentation about an attack against AES-GCM and AES-CCM:
> 
> 	Roth, J. and F. Strenzke,
> 	"AEAD-to-CBC Downgrade Attacks on CMS",
> 	8 November 2023,
> 	<https://datatracker.ietf.org/meeting/118/materials/slides-118-lamps-attack-against-aead-in-cms>.
> 
> I am not aware of any attacks that involve AES-KW.
> 
> Where can I find information about the attack you are talking about?
> 
> Russ
> 
>> On Dec 14, 2023, at 12:19 PM, lgl island-resort.com <lgl@island-resort.com> wrote:
>> 
>> Note that there is a vulnerability in ECDH-ES + A128KW — the one that was presented in Prague. I think there are fixes, and it’s on my list to dig into it (IETF/COSE needs a full, proper and secure multi-recipient modern encryption format), but don’t have bandwidth right now.
>> 
>> LL
>> 
>>> On Dec 14, 2023, at 2:18 AM, hannes.tschofenig=40gmx.net@dmarc.ietf.org wrote:
>>> 
>>> Thank you all for your quick response. From the feedback it seems clear to go for ECDH-ES + A128KW
>>> We will update the documents accordingly.
>>> 
>>> -----Original Message-----
>>> From: Suit <suit-bounces@ietf.org> On Behalf Of Akira Tsukamoto
>>> Sent: Donnerstag, 14. Dezember 2023 06:29
>>> To: Brendan Moran <brendan.moran.ietf@gmail.com>; Russ Housley <housley@vigilsec.com>; Hannes Tschofenig <Hannes.Tschofenig@gmx.net>
>>> Cc: suit@ietf.org; teep@ietf.org; Ken Takayama <ken.takayama.ietf@gmail.com>
>>> Subject: Re: [Suit] [Teep] ECDH-ES + A128KW vs. ECDH-ES + HKDF-256
>>> 
>>> Hi Brendan,
>>> 
>>> I am fine changing the MTI with ECDH-ES + A128KW.
>>> 
>>> Akira
>>> 
>>> On 12/14/2023 12:08 AM, Russ Housley wrote:
>>>> I think ECDH-ES + A128KW covers more use cases.  It can be used with on recipient or many recipients.  So, I'd like to see that be the MTI.
>>>> 
>>>> Russ
>>>> 
>>>> 
>>>>> On Dec 13, 2023, at 3:38 AM, hannes.tschofenig=40gmx.net@dmarc.ietf.org wrote:
>>>>> 
>>>>> Hi all,
>>>>> 
>>>>> In the SUIT firmware encryption draft we have so far used ECDH-ES + A128KW, which is also what we implemented in t_cose to generate the examples.
>>>>> 
>>>>> In a discussion with Ken today we realized that the SUIT-MTI draft has always used ECDH-ES + HKDF-256 instead.
>>>>> 
>>>>> Now, the question is: Should we support both, ECDH-ES + A128KW and ECDH-ES + HKDF-256?
>>>>> 
>>>>> IHMO we definitely need AES-KW for scenarios where we encrypt a firmware with a CEK once and then distribute that encrypted firmware image to many recipients. In this case, we 
>>>>> 
>>>>> * randomly generate a CEK, 
>>>>> * encrypt the firmware using this CEK, 
>>>>> * encrypt this CEK with a KEY unique per recipient with a KEK. The KEK is the result of using ECDH-ES with an KDF, as described in Section 6.4 of RFC 9053. 
>>>>> 
>>>>> 
>>>>> For scenarios where we send one firmware image to one recipient we could use ECDH-ES + HKDF-256 and currently we have a little bit of overhead here by using ECDH-ES + A128KW.
>>>>> 
>>>>> My preference is to leave the SUIT firmware encryption draft as is and to change the SUIT MTI draft to reference ECDH-ES + A128KW instead of ECDH-ES + HKDF-256.
>>>>> 
>>>>> Thoughts?
>>>>> 
>>>>> Ciao
>>>>> Hannes
>>>>> 
>>>> 
>>>> _______________________________________________
>>>> TEEP mailing list
>>>> TEEP@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/teep
>>> 
>>> _______________________________________________
>>> Suit mailing list
>>> Suit@ietf.org
>>> https://www.ietf.org/mailman/listinfo/suit
>>> 
>>> _______________________________________________
>>> Suit mailing list
>>> Suit@ietf.org
>>> https://www.ietf.org/mailman/listinfo/suit
>> 
> 