Subject: [jose] AES-CBC padding

From: John Bradley <[email-masked]>
Date: Wed, 2 May 2012 16:32:09 -0700

JWE is not making a specific padding recommendation for CBC.

There are several options including PKCS#5 and the variant used by xmlenc.

The other option is to use one of the new CBC modes AES-CBC-CS1.
http://csrc.nist.gov/publications/nistpubs/800-38a/addendum-to-nist_sp800-38A.pdf

I suspect the best thing for interoperability is to use PKCS#5 like CMS.

The new modes are more secure, but will be an interoperability problem.

Thoughts?

John B.

---

From: "Philip Hoyer" <[email-masked]>
Date: Thu, 3 May 2012 16:05:42 +0200

John,

This is what we did in RFC6030 around the area of padding:

For AEC-CBC we used PKCS#5 padding 

"

Figure 6 shows an example that illustrates the encryption of the
   content of the <Secret> element using AES-128-CBC and PKCS #5
   Padding.  The plaintext value of <Secret> is
   '3132333435363738393031323334353637383930'.  The name of the pre-
   shared secret is "Pre-shared-key", as set in the <KeyName> element
   (which is a child element of the <EncryptionKey> element).  The value
   of the encryption key used is '12345678901234567890123456789012'.
 
   The IV for the MAC key is '11223344556677889900112233445566', and the
   IV for the HOTP key is '000102030405060708090a0b0c0d0e0f'.
 
   As AES-128-CBC does not provide integrity checks, a keyed MAC is
   applied to the encrypted value using a MAC key and a MAC algorithm as
   declared in the <MACMethod> element (in our example,
   "http://www.w3.org/2000/09/xmldsig#hmac-sha1" is used as the
   algorithm and the value of the MAC key is randomly generated, in our
   case '1122334455667788990011223344556677889900', and encrypted with
   the above encryption key).  The result of the keyed-MAC computation
   is placed in the <ValueMAC> child element of <Secret>.

"

and then:

"

For systems implementing PSKC, it is RECOMMENDED to support

   AES-128-CBC (with the URI of

   http://www.w3.org/2001/04/xmlenc#aes128-cbc) and KW-AES128 (with the

   URI of http://www.w3.org/2001/04/xmlenc#kw-aes128).  Please note that

   KW-AES128 requires that the key to be protected must be a multiple of

   8 bytes in length.  Hence, if keys of a different length have to be

   protected, then the usage of the key-wrap algorithm with padding, as

   described in [RFC5649 <http://tools.ietf.org/html/rfc5649> ] is
RECOMMENDED. 

"

Philip

From: [email-masked] [mailto:[email-masked]] On Behalf Of
John Bradley
Sent: 03 May 2012 00:32
To: [email-masked]
Subject: [jose] AES-CBC padding

There are several options including PKCS#5 and the variant used by
xmlenc.

http://csrc.nist.gov/publications/nistpubs/800-38a/addendum-to-nist_sp80
0-38A.pdf
<http://csrc.nist.gov/publications/nistpubs/800-38a/addendum-to-nist_sp8
00-38A.pdf> 

Thoughts?

John B.

---

From: John Bradley <[email-masked]>
Date: Thu, 3 May 2012 08:10:45 -0700

Thanks an other good datapoint for PKCS #5.

I suspect that is the most reasonable option, but wanted to solicit other opinions before getting getting the clarification added.

People building librarys need a decision shortly otherwise it will not interop.

John B.

On 2012-05-03, at 7:05 AM, Philip Hoyer wrote:

> For AEC—CBC we used PKCS#5 padding
> “
> ”
> “
>    described in [RFC5649] is RECOMMENDED.
>  
> “
>  
> Philip
>  
> From: [email-masked] [mailto:[email-masked]] On Behalf Of John Bradley
> Sent: 03 May 2012 00:32
> To: [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Fri, 4 May 2012 21:57:56 +0000

FYI, I intend to specify the use of PKCS #5 padding for ACS-CBC in the next JWE spec unless further discussion results in consensus for another decision.

My thanks to Edmund Jay and John Bradley for identifying the issue and analyzing potential solutions.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Thursday, May 03, 2012 8:11 AM
To: Philip Hoyer
Cc: [email-masked]
Subject: Re: [jose] AES-CBC padding

John B.

John,

"

and then:

"
   described in [RFC5649<http://tools.ietf.org/html/rfc5649>] is RECOMMENDED.

"

Philip

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of John Bradley
Sent: 03 May 2012 00:32
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] AES-CBC padding

Thoughts?

John B.