Subject: [jose] WTKDF?

From: Brian Campbell <[email-masked]>
Date: Thu, 12 Apr 2012 12:33:28 -0600

Hi all,

I'm trying to do an implementation of the Concatenation Key Derivation
Function from §5.8.1 of NIST SP800-56A for JWE but I'm honestly having
some trouble making sense out of some of the language in the NIST
document.

On page 47 of NIST SP800-56A it says, "The subfields SuppPrivInfo and
SuppPubInfo (when allowed by the application) shall be formed by the
concatenation of an application-specific, fixed-length sequence of
substrings of additional information that may be used in key
derivation upon mutual agreement of parties U and V. Each substring
representing a separate unit of information shall be of the form
Datalen || Data, where Data is a variable-length string of zero or
more (eight-bit) bytes and Datalen is a fixed-length, big-endian
counter that indicates the length (in bytes) of Data."

§7 of JWE-01* says "the SuppPubInfo parameter is the Label [Integrity
or Encryption], and the remaining OtherInfo parameters are the empty
bit string."

So the label is one such sub-string and is concatenated with the key
and the counter and hashed as part of the KDF algorithm. I'm a bit
confused about (among other things) what the byte sequence should be
for the label.  Using the CIK as an example, the ASCII byte
representation of "Integrity" is

[73, 110, 116, 101, 103, 114, 105, 116, 121]

but does the text from NIST page 47 say that the label bytes should be
the following sequence where the Datalen, as a four byte fixed-length
big-endian counter, is prepended to the byte sequence above?

[0, 0, 0, 9, 73, 110, 116, 101, 103, 114, 105, 116, 121]

Or is it something else? Can anyone set me straight here?

Anyone else working on or have an implementation of this? Or know
about existing implementations that could be used as a reference to
test results?

Thanks,
Brian

* http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-01#section-7

On a side note, it looks like §7 got a little mangled in the HTML version:
http://tools.ietf.org/id/draft-ietf-jose-json-web-encryption-01.html#rfc.section.7