Subject: Re: [jose] draft minutes for jose wg meeting at IETF87

From: "Peck, Michael A" <[email-masked]>
Date: Wed, 14 Aug 2013 19:43:10 +0000

>*  Issue #18 - Address MAC key lifetime concerns
>
>Mike stated that he had added in a set of security considerations to the
>version 14 draft that was just published.  At this point people need to
>review the text and determine if it is sufficient.  Reviews should be
>completed in two weeks after which a decision on closing this issue will
>be made.
>
>The chairs stated that they would like to get input from Micheal Peck as
>this was his issue before making a final determination.

Looks like this is Richard's issue, not mine.
I personally don't know of any cryptographic issues around using the same HMAC key for a long time and/or for a large number of messages.
There's a risk that if the key is somehow exposed, then the longer it continues to be valid, the longer the opportunity for an attacker to use it to improperly authenticate messages.  It would be good practice for organizations to periodically rotate the key.  A potential feature request for JOSEv2 would be to provide options for key management of the MAC key to help make that happen, but for now just going with Security Considerations text seems reasonable.

>*  Issue #28 - AES-GCM should not be allowed for content encryption in
>combination with Direct Encryption key management mode
>
>This issue is basically the same as issue # 18.  The resolution will be
>the same.

As I wrote in the issue #28 entry I don't think Security Considerations text is enough here as there are known cryptographic issues with manual key management of GCM keys.  By forcing automated key management, the JOSE protocols can encourage safer implementation.  As written in the issue this concern also applies to AES-GCM Key Wrap not just content encryption.
http://trac.tools.ietf.org/wg/jose/trac/ticket/28