Re: [Webpush] Major change to encryption

[Martin Thomson <[e-mail]>]

That is (to the best of my limited ability to check) 100% correct.

On 1 November 2016 at 09:47, jr conlin <[e-mail]> wrote:
> Perhaps I'm just confused by the various PRs and comments, but if I may,
> i'd like to make sure I'm very clear on what the change is:
>
> The crux of the change is:
> 1) Encrypted content would be identified as "aes128gcm", which should
> not be confused with the now, long obsolete "aesgcm128".
>
> 2) salt, rs, and key_id are now prefixed to the encrypted content as:
> `salt(16)|rs(4)|id_len(1)|key_id(id_len)|encrypted_content`
>
> 3) The content encoding key (CEK) is set to
> ```
> HMAC-SHA-256(
>     HMAC-SHA-256(salt, key[key_id].secret),
>     "Content-Encoding: aes128gcm\x00\x01")  # from 2.2 of
> http://httpwg.org/http-extensions/encryption-preview.html
> ```
> The majority case will be that `key_id` is not defined (or is ''), in
> which case, we'd use the locally derived key.
>
> 4) There's no longer a need for "context" to be appended to the key info
> and nonce info, although the Content-Encoding for the new content type
> will use the now obsolete "aesgcm128"
> https://github.com/martinthomson/encrypted-content-encoding/pull/28/files#diff-6ee19a23c153fa68b2910aeb69bde1ddR213
>
> 5) The DH secret is now derived from running an HMAC-SHA-256 over
> ```'WebPush: info\x00' + receiverPublicKey + senderPublicKey```
>
> Is that correct? Am I missing something?
>
> On 10/31/2016 3:38 AM, Martin Thomson wrote:
>> Discussion in the HTTP working group has lead to some fairly
>> substantial changes to the spec that we rely on.  These are breaking
>> changes.  See the changes here:
>> https://github.com/httpwg/http-extensions/pull/252
>>
>> In short, several of the parameters that were in header fields are now
>> in the body of the message and the Encryption header field is now
>> gone.
>>
>> This completely messes with the use of that spec in Webpush.  It's
>> easy to detect which version is in use because the identifier has
>> changed, and there are small gains to be had.  The overall message
>> size is now slightly smaller, and the key derivation is now slightly
>> simpler.  The specs also have fewer interdependencies as a result.
>>
>> I've put together a revision of the webpush-encryption draft.  I've
>> taken this opportunity to simplify things a little.  You can see a
>> preview in the editor's draft:
>>
>>   https://webpush-wg.github.io/webpush-encryption/
>>
>> I realize that this is a fairly big (and late) change.  I remain
>> optimistic that it will be the last. Feedback on the changes are
>> positive so far [1].
>>
>> I plan to submit this doc very soon, ahead of the draft submission
>> deadline.  I realize that's short notice, but I'm fully prepared to
>> back out this change if necessary.
>>
>> --Martin
>>
>> [1] Costin suggested that we might also remove Crypto-Key.  That is
>> technically possible, though it's probably excessively kludgy, the DH
>> key could be moved to the keyid field.  I'm leery of that sort of
>> optimization, but I'm willing to be convinced that this is a special
>> enough case (I don't think that it is that special, but have at it).
>>
>> _______________________________________________
>> Webpush mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/webpush
>
>
> _______________________________________________
> Webpush mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/webpush