Subject: [jose] JWE Flattened Serialization with AES*GCMKW Sealing

From: Nathaniel McCallum <[email-masked]>
Date: Wed, 22 Jun 2016 18:33:43 -0400

I've been working on a C implementation of JOSE:
https://github.com/npmccallum/jose

I noticed that RFC 7518 Section 4.7 defines the AES*GCMKW algorithms
for key encryption and defines some optional header parameters: iv and
tag.  Am I wrong that this seems to collide with the iv and tag
parameters when AES*GCMKW is used in the JWE Flattened Serialization?

Can someone help clarify this for me?

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 22 Jun 2016 17:36:45 -0700

I would agree that appears to be the case.  Given that the "iv" and "tag" fields are not registered for content encryption algorithms it was not noticed at the time that flattening was proposed and adopted.

Jim

> -----Original Message-----
> From: jose [mailto:[email-masked]] On Behalf Of Nathaniel McCallum
> Sent: Wednesday, June 22, 2016 3:34 PM
> To: [email-masked]
> Subject: [jose] JWE Flattened Serialization with AES*GCMKW Sealing
> 
> I noticed that RFC 7518 Section 4.7 defines the AES*GCMKW algorithms for key
> encryption and defines some optional header parameters: iv and tag.  Am I
> wrong that this seems to collide with the iv and tag parameters when
> AES*GCMKW is used in the JWE Flattened Serialization?
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 23 Jun 2016 01:10:29 -0700

I got the wrong answer last time.  I should have thought a bit longer.

No there is no conflict.  The content encryption IV and tag are at the top level of the structure  The IV and tag for the key wrap algorithm are either protected or unprotected attributes and placed in those fields as is appropriate.

Jim

---

From: Brian Campbell <[email-masked]>
Date: Thu, 23 Jun 2016 05:18:32 -0600

Figure 150 at the end of section 5.7 of the JOSE Cookbook (RFC 7520)
<https://tools.ietf.org/html/rfc7520#section-5.7> has an example of
Flattened JWE JSON Serialization using A256GCMKW, which might be helpful to
illustrate. As Jim said, the content encryption IV and tag are at the top
level of the structure and the IV and tag for the key wrap algorithm are
parameters within the encoded "protected" member.
<https://tools.ietf.org/html/rfc7520#section-5.7>

On Thu, Jun 23, 2016 at 2:10 AM, Jim Schaad <[email-masked]> wrote:

> No there is no conflict.  The content encryption IV and tag are at the top
> level of the structure  The IV and tag for the key wrap algorithm are
> either protected or unprotected attributes and placed in those fields as is
> appropriate.
>
> Jim
>
>

---

From: Nathaniel McCallum <[email-masked]>
Date: Thu, 23 Jun 2016 10:00:36 -0400

Thanks. I knew the problem was mine!

On Thu, 2016-06-23 at 05:18 -0600, Brian Campbell wrote:
> has an example of Flattened JWE JSON Serialization using A256GCMKW,
> which might be helpful to illustrate. As Jim said, the content
> encryption IV and tag are at the top level of the structure and the
> IV and tag for the key wrap algorithm are parameters within the
> encoded "protected" member.
> 
> 
> 
> > No there is no conflict.  The content encryption IV and tag are at
> > the top level of the structure  The IV and tag for the key wrap
> > algorithm are either protected or unprotected attributes and placed
> > in those fields as is appropriate.
> > 
> > Jim
> > 
> >