Subject: [Cfrg] Use of draft-mgcrew-aead-aes-cbc-hmac-sha2 with CMS

From: "Jim Schaad" <[email-masked]>
Date: Sun, 17 Mar 2013 13:00:53 -0400

David,

If I were to assume that I wanted to use your draft rather than RFC 6476
(Using Message Authentication Code (MAC) Encryption in the Cryptographic
Message Syntax (CMS)) in a CMS context with the AEAD structures defined in
RFC 5038, I believe that I would have a problem.  Specifically, the current
CMS structure assumes that the IV and the authentication tag are kept
separate

I have no objects to the fact that a long key is used and the fact that the
MAC cannot be truncated.  However the fact that the IV and the tag MUST be
part of the encryption stream is difficult.

I do however 100% agree that the IV MUST be included in the tag computation.

Jim

---

From: Mike Jones <[email-masked]>
Date: Sun, 17 Mar 2013 18:56:48 +0000

In a private thread with David, there's a discussion about how the algorithm description in draft-mgcrew-aead-aes-cbc-hmac-sha2 could be refactored into:

1)  Requirements about the content of the key value.
2)  Requirements about the content of the initialization vector value.
3)  A deterministic function generating the ciphertext and integrity value from the plaintext, additional authenticated data, initialization vector, and key.
4)  A RFC 5116 encoding for the results of 1-3.

I believe, Jim, that you're saying that CMS would use 1-3, but a different encoding of the results than 4.  I believe that JSON Web Encryption (JWE) would also want to use 1-3 but not 4.

Anyway, I think this is a really useful discussion and one that could result in the algorithm being used in more contexts.  Thanks for your thoughts, Jim.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Sunday, March 17, 2013 10:01 AM
To: David McGrew
Cc: [email-masked]
Subject: [Cfrg] Use of draft-mgcrew-aead-aes-cbc-hmac-sha2 with CMS

David,

If I were to assume that I wanted to use your draft rather than RFC 6476 (Using Message Authentication Code (MAC) Encryption in the Cryptographic Message Syntax (CMS)) in a CMS context with the AEAD structures defined in RFC 5038, I believe that I would have a problem.  Specifically, the current CMS structure assumes that the IV and the authentication tag are kept separate

I have no objects to the fact that a long key is used and the fact that the MAC cannot be truncated.  However the fact that the IV and the tag MUST be part of the encryption stream is difficult.

Jim