Re: [Webpush] Major change to encryption

[jr conlin <[e-mail]>]

Perhaps I'm just confused by the various PRs and comments, but if I may,
i'd like to make sure I'm very clear on what the change is:

The crux of the change is:
1) Encrypted content would be identified as "aes128gcm", which should
not be confused with the now, long obsolete "aesgcm128".

2) salt, rs, and key_id are now prefixed to the encrypted content as:
`salt(16)|rs(4)|id_len(1)|key_id(id_len)|encrypted_content`

3) The content encoding key (CEK) is set to
```
HMAC-SHA-256(
    HMAC-SHA-256(salt, key[key_id].secret),
    "Content-Encoding: aes128gcm\x00\x01")  # from 2.2 of
http://httpwg.org/http-extensions/encryption-preview.html
```
The majority case will be that `key_id` is not defined (or is ''), in
which case, we'd use the locally derived key.

4) There's no longer a need for "context" to be appended to the key info
and nonce info, although the Content-Encoding for the new content type
will use the now obsolete "aesgcm128"
https://github.com/martinthomson/encrypted-content-encoding/pull/28/files#diff-6ee19a23c153fa68b2910aeb69bde1ddR213

5) The DH secret is now derived from running an HMAC-SHA-256 over
```'WebPush: info\x00' + receiverPublicKey + senderPublicKey```

Is that correct? Am I missing something?

On 10/31/2016 3:38 AM, Martin Thomson wrote:
> Discussion in the HTTP working group has lead to some fairly
> substantial changes to the spec that we rely on.  These are breaking
> changes.  See the changes here:
> https://github.com/httpwg/http-extensions/pull/252
>
> In short, several of the parameters that were in header fields are now
> in the body of the message and the Encryption header field is now
> gone.
>
> This completely messes with the use of that spec in Webpush.  It's
> easy to detect which version is in use because the identifier has
> changed, and there are small gains to be had.  The overall message
> size is now slightly smaller, and the key derivation is now slightly
> simpler.  The specs also have fewer interdependencies as a result.
>
> I've put together a revision of the webpush-encryption draft.  I've
> taken this opportunity to simplify things a little.  You can see a
> preview in the editor's draft:
>
>   https://webpush-wg.github.io/webpush-encryption/
>
> I realize that this is a fairly big (and late) change.  I remain
> optimistic that it will be the last. Feedback on the changes are
> positive so far [1].
>
> I plan to submit this doc very soon, ahead of the draft submission
> deadline.  I realize that's short notice, but I'm fully prepared to
> back out this change if necessary.
>
> --Martin
>
> [1] Costin suggested that we might also remove Crypto-Key.  That is
> technically possible, though it's probably excessively kludgy, the DH
> key could be moved to the keyid field.  I'm leery of that sort of
> optimization, but I'm willing to be convinced that this is a special
> enough case (I don't think that it is that special, but have at it).
>
> _______________________________________________
> Webpush mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/webpush