Subject: [COSE] COSE authentication tag encoding

From: Brian Sipos <[email-masked]>
Date: Tue, 9 Apr 2019 01:16:24 +0000

Hello,
I had been interested in using COSE a while back, before RFC 8152 was
published, and am just getting back to looking into COSE as a standard
container. One thing that I still find confusing is how the *-GCM
encryption algorithms are supposed to represent the authentication tag
result. I see in [1] the statement that COSE does different than JOSE
to "Combine the authentication tag for encryption algorithms with the
ciphertext". Other than this one statement, I am struggling to see
where the authentication tag gets encoded based on the actual
requirements statements in the document.

Am I just missing something very fundamental, or is there an implicit
behavior to append the authentication tag data to the ciphertext? It
would be useful for someone like me, who has not followed JOSE/COSE too
closely, to have this kind of detail indicated with an actual
requirement statement within the algorithm description(s).

Thanks for any guidance,
Brian S.

[1]: https://tools.ietf.org/html/rfc8152#section-1.1

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 9 Apr 2019 10:45:34 +0300

> requirement statement within the algorithm description(s).

COSE uses RFC5116 version of AEAD interface. This interface specifies
that tag is included in the ciphertext.

Now, AES-GCM (in RFC5116) and Chacha20-Poly1305-AEAD (in RFC8439,
and as errata for RFC7539) further specify that the tag is to be
appended to other ciphertext (i.e., tag is the last 16 bytes of
ciphertext output).

If more AEAD algorithms are defined in the future, those could do
something else than to append with their tags. This is to be
documented in the RFC that documents the RFC5116 interface for the
algorithm, which RFC about use of it in COSE then references.

-Ilari

---

From: Jim Schaad <[email-masked]>
Date: Tue, 9 Apr 2019 09:18:48 -0700

> -----Original Message-----
> From: COSE <[email-masked]> On Behalf Of Ilari Liusvaara
> Sent: Tuesday, April 9, 2019 12:46 AM
> To: Brian Sipos <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [COSE] COSE authentication tag encoding
> 
> > would be useful for someone like me, who has not followed JOSE/COSE
> > too closely, to have this kind of detail indicated with an actual
> COSE uses RFC5116 version of AEAD interface. This interface specifies that
> tag is included in the ciphertext.
> 
> Now, AES-GCM (in RFC5116) and Chacha20-Poly1305-AEAD (in RFC8439, and
> as errata for RFC7539) further specify that the tag is to be appended to
other
> ciphertext (i.e., tag is the last 16 bytes of ciphertext output).
> 
something
> else than to append with their tags. This is to be documented in the RFC
that
> documents the RFC5116 interface for the algorithm, which RFC about use of
> it in COSE then references.

I will go in and put some more explicit text to cover this in the document.
The rule is going to be that it is algorithm specific so it cannot be in a
generic place but needs to be specified on a per algorithm basis.  Examples
of some algorithms where different behavior is going to happen are with
Synthetic Initialization Vector (SIV) (RFC 5297) the IV is the
authentication tag and thus it would get stored in the IV slot.  For the
KeyWrap algorithms  (RFC 3394) the authentication tag is the first 64-bits
of the plain text and is thus part of what one sees as the encrypted bytes.

For the algorithms you are looking at as stated above, the authentication
tag is appended to the encrypted content to form a single value which is
then stored as the encrypted content.

Jim

> 
> 
> -Ilari
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose