Subject: Re: [jose] JWE: key agreement algorithms and the content master key

From: Mike Jones <[email-masked]>
Date: Fri, 6 Jul 2012 18:20:54 +0000

In response to Jim Schaad's and Sean's comments, the draft now specifies that an ephemeral public key must be randomly generated per key agreement transaction.  So your concern that JWE key agreement might generate the same CMK for all messages exchanged between two parties will not happen.

As for generating a CMK, rather than using the agreed upon key, I've added this to the list of open issues to be discussed by the working group.  I can see why you would want this for the multiple recipients case.

				Best wishes,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Manger, James H
Sent: Tuesday, May 29, 2012 6:53 PM
To: [email-masked]
Subject: [jose] JWE: key agreement algorithms and the content master key

One option for constructing an encrypted message (JWE) is to use a key agreement mechanism. The draft says:

  when key agreement is employed,
  use the key agreement algorithm to compute the value
  of the Content Master Key (CMK)

  when key agreement is employed,
  let the JWE Encrypted Key be an empty byte array

Is this a good approach?

It differs from the approach in Crypto Message Syntax Standard (CMS) [rfc5652#section-6.2.2], where the secret that the key agreement mechanism generates is used to encrypt a randomly chosen CMK.

Sharing the ciphertext when encrypting for multiple recipients (as done in the JWE-JS serialization) presumably cannot work when JWE key agreement is used since the CMK is per-recipient, not per-message.

The JWE key agreement might also generates the same CMK for all messages exchanged between two parties. That sounds unacceptable. Perhaps this is avoidable by assuming/requiring the sender uses a per-message ephemeral key pair?

I am inclined to stick with the CMS approach. It adds about 32 chars to the message (for a 128-bit key) and a key wrapping step.

--
James Manger

_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose