Subject: [Cose] AES based MAC algorithm

From: "Jim Schaad" <[email-masked]>
Date: Tue, 30 Jun 2015 15:58:54 -0700

In doing the work on getting algorithms into the document I ended up with a
"Which one" question.

AES-MAC has historically been the block cipher MAC algorithm used by most
people.  In part because it has been around the longest.  It does the
traditional AES-CBC mode of encryption and then takes the last block of the
output as the MAC value.

AES-CMAC (also known as AES-OMAC1) is a variant of the same algorithm which
uses one extra encryption operation and an XOR operation at the end of the
process to provide higher security than is available with AES-MAC.  Details
of this algorithm can be found in RFC 4493.

Do people have a preference as to which of these two algorithms is
specified?  My personal preference leans towards using the newer algorithm
as there is not a significant performance penalty and it appears to have
better security properties.

Jim

---

From: Mike Jones <[email-masked]>
Date: Tue, 30 Jun 2015 23:20:39 +0000

Do you have data on how commonly available implementations of these algorithms are to help inform the choice?  As you know, in JOSE we drove the set of algorithm choices off of a survey of which algorithms were implemented on which common development platforms.  (See the attached spreadsheet.)

I realize that in this case, the right sets of development platforms to survey may be different than the largely Web-targeted development platforms that JOSE surveyed.  For COSE, the right tools are more likely to be embedded systems development platforms.

Anyway, if we can make this choice based on data, that would be good.  If the data shows that people will have to largely build AES-MAC or AES-CMAC from scratch because their platforms don't support either of them, then I agree with your preference for AES-CMAC.

				-- Mike

-----Original Message-----
From: Cose [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Tuesday, June 30, 2015 3:59 PM
To: [email-masked]
Subject: [Cose] AES based MAC algorithm

In doing the work on getting algorithms into the document I ended up with a "Which one" question.

AES-MAC has historically been the block cipher MAC algorithm used by most people.  In part because it has been around the longest.  It does the traditional AES-CBC mode of encryption and then takes the last block of the output as the MAC value.

AES-CMAC (also known as AES-OMAC1) is a variant of the same algorithm which uses one extra encryption operation and an XOR operation at the end of the process to provide higher security than is available with AES-MAC.  Details of this algorithm can be found in RFC 4493.

Do people have a preference as to which of these two algorithms is specified?  My personal preference leans towards using the newer algorithm as there is not a significant performance penalty and it appears to have better security properties.

Jim

_______________________________________________
Cose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cose