Subject: Re: [jose] Complete JWE computation example

From: Mike Jones <[email-masked]>
Date: Fri, 6 Jul 2012 18:24:03 +0000

I’ve now defined the key sizes for the “int” algorithms in JWA.

See my replies to Jim and Sean about the Concat KDF.

Also, see my reply to Jim about requiring a “kid” value.

                                                                Thanks again,
                                                                -- Mike

From: Manger, James H [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>
Sent: Wednesday, June 27, 2012 11:23 PM
To: Mike Jones; [email-masked]<mailto:[email-masked]>
Subject: RE: Complete JWE computation example

The calculations in these examples worked for me too. Providing binary values as comma-separated decimal values for each byte is a bit annoying. I guess this is a JavaScript thing.

The key derivation cannot really call itself the Concat KDF from NIST 800 56A. Leaving the AlgorithmID, PartyUInfo (sender id), and PartyVInfo (receiver id) empty is not allowed. Additionally, the NIST spec’s way of deriving an HMAC and AES key would be to run the KDF once to generate enough bits for both keys (“concatenated”). JWE, in contrast, runs the KDF twice to get the HMAC and AES keys separately.

Nothing actually specifies the actual key size for the HS256 calculation. JWA only says 256-bits is the minimum key length.

Please put a key id in the header. JWE decryption step 5 says “verify that the JWE Header references a key known to the recipient” which is a bit hard with no key reference. Everyone should support key rollover (even if manually) which basically needs a key id so it may as well be mandatory. If the key id is conveyed out-of-band (or merely implied) it isn’t protected by the integrity check – which almost starts to undo the argument for integrity-protection of the header.

--
James Manger

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Mike Jones
Sent: Wednesday, 27 June 2012 10:33 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] Complete JWE computation example

Dear working group members,

For the next round of the JOSE JWE spec, I’m adding example encryption computations to aid implementers.  An example JWE computation is included below, in case you’d like to compare your implementations against these.  These values have already been verified by two independent implementations.

This example uses the header values:
    {"alg":"RSA1_5","enc":"A128CBC","int":"HS256","iv":"AxY8DCtDaGlsbGljb3RoZQ"}
…