Subject: Re: [jose] #28: AES-GCM should not be allowed for content encryption in combination with Direct Encryption key management mode

From: "jose issue tracker" <[email-masked]>
Date: Thu, 01 Aug 2013 11:00:09 -0000

#28: AES-GCM should not be allowed for content encryption in combination with
Direct Encryption key management mode

Comment (by [email-masked]):

 What's practical for applications depends entirely upon the application
 context.  For many applications, the rate of encryption transactions by
 itself means that 2-to-the-32 encryption operations will never be
 performed, and so no "keeping track" would be needed.  2-to-the-32 is big.
 For instance, it would take 136 years to do that many encryptions at a
 rate of one per second.  If the algorithm is used to encrypt daily updates
 of information, you'd have over 49,000 years of updates before hitting the
 limit.

 We've told applications that they must not exceed this limit.  We've given
 them other algorithms without this limit - notably McGrew's
 AES_CBC_HMAC_SHA2 algorithms.  If applications choose to not heed these
 constraints, I'm sure that we have bigger problems. There are a lot easier
 ways they can hurt themselves by not heeding other usage constraints.

 For instance, if they ignore what's said about safely using the JOSE
 crypto encodings, they could always use zero initialization vector values.
 They could publish their symmetric and private keys on publicly accessible
 Internet sites.  They could use random number generators and key
 generators that produce constant or predictable values.  Etc.

 Yes, it's possible to use direct encryption with GCM in an unsafe manner.
 It's possible to use all the crypto operations in an unsafe manner.  The
 key is that we've clearly told applications how to not do that.  If they
 choose to ignore what the specs say about how to use the crypto operations
 safely, there's very little we can do to prevent that.  (Heck, even if we
 accepted your proposed action for this issue, they could ignore a
 prohibition not to use GCM for direct encryption as well! :-) )  I think
 we've already fulfilled our responsibilities to implementers and
 applications by clearly saying how to do safe crypto, both in this
 particular case, and in others.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [email-masked]        |  [email-masked]
     Type:  defect       |      Status:  new
 Priority:  major        |   Milestone:
Component:  json-web-    |     Version:
  algorithms             |  Resolution:
 Severity:  -            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/jose/trac/ticket/28#comment:5>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Mon, 19 Aug 2013 01:14:00 -0000

Comment (by [email-masked]):

 It is not true that there is no need to keep track in this case.  An
 application would still need to ensure that it does not re-use the nonce
 value when doing the encryption.  The simplest way to do this is to have a
 counter which can then be used to say it has been exceeded.

 One of the stated goals for this group is to allow crypto to be done by
 people who are not experts.  This means that we need to ensure that there
 is good text that can be understood to deal with those cases where it is
 going to be very easy to get things wrong.  This is probably one of those
 cases.

Ticket URL: <https://grenache.tools.ietf.org/wg/jose/trac/ticket/28#comment:6>
jose <http://tools.ietf.org/jose/>