Subject: [KEYPROV] FW: Advice needed: how shall we use AES-128-KW to wrap any length of keys?

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 14 Jan 2009 10:27:23 +0200

FYI

  _____  

From: Pei, Mingliang [mailto:[email-masked]] 
Sent: 14 January, 2009 02:34
To: Russ Housley
Cc: Hallam-Baker, Phillip; Philip Hoyer; Hannes Tschofenig;
[email-masked]; Salah Machani
Subject: Advice needed: how shall we use AES-128-KW to wrap any length of
keys?

Hi Russ,
 
Happy New Year!
 
On deciding between KW-AES vs. AES as the mandatory key encryption algorithm
in PSKC, Anders noted that KW-AES-128 by RFC3394 assumes the size of the key
to be wrapped is multiple of block size. We consider that some padding can
be done to support any length of key (at least two times of the block size
of an encryption algorithm). You are our expert in this area as the author
of RFC3394. We believe that you must have also thought of ways to support
any size of keys for wrapping. 
 
Could you advise us on the following two questions?
 
1. What padding would you recommend when using KW-AES-xxx algorithms?
 
I am thinking that PKCS7 padding would simply work as we do for AES-CBC on
any size of plaintext.
 
2. When PSKC already supports a MAC value along with wrapped key value, the
purpose of "key wrapping algorithm KW-AES-xxx" is already served so that
AES-128-CBC can serve the same security level as KW-AES-xxx. By this
argument, we are fine to recommend either AES-128-CBC or KW-AES-128 as the
mandatory one.
 
Is this right?
 
If the above is true, I would recommend AES-128-CBC as the mandatory one:
(1) we don't need to worry padding part as it is well understood with this.
(2) the security level is the same and AES-128-CBC is more widely supported
than KW- counterparts (my claim though).
 
We would appreciate your advice and help on this. I look forward to hearing
from you soon.
 
Thank you,
 
- Ming
 
  _____  

From: Pei, Mingliang 
Sent: Monday, January 12, 2009 2:37 PM
To: Anders Rundgren; Philip Hoyer; Hannes Tschofenig
Cc: Hallam-Baker, Phillip; 'Doherty, Andrea'; [email-masked]
Subject: RE: KW-AES-128 clashes with HOTP? Was: [KEYPROV] Examples in PSKC

Russ is the author of RFC3394 on this. Copying him for more comments. Here
is my understanding.
 
True that the original definition in RFC3394 and xmlenc spec assumes the key
length is multiple (n) of 64-bit data blocks.
 
http://tools.ietf.org/html/rfc3394
http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#kw-aes128
 
I assume that padding can be independently applied on the plaintext (key to
be wrap) but cannot find a general standard yet. One RFC that handles
padding for key wrapping is the RFC3537 on wrapping a HMAC key with 3DES and
AES.
 
http://tools.ietf.org/html/rfc3537
 
The padding in that spec is new one, different from known ones such as PKCS5
or PKCS7 padding. I was curious why PKCS5 cannot be simply used in key
wrapping in the similar way to AES-CBC. 
 
Regardless, if we are determined to use kw-xxx, I think that we could
specify in PSKC how to do padding for any symmetric key length. The key size
should be at least 2 blocks for use of this per RFC3394:
 
Quoted: "The only restriction the key wrap algorithm places on n is that n
be at least two.  (For key data with length less than or equal to 64 bits,
the constant field used in this specification and the key data
   form a single 128-bit codebook input making this key wrap unnecessary.)"
 
On the other hand, the email reply by Hannes tried to further clarify
whether we are in agreement to change back to KW-AES-128. AES-128-CBC is
fine while we have ValueMAC for integrity check in the schema.
 
- Ming

  _____  

From: Anders Rundgren [mailto:[email-masked]] 
Sent: Monday, January 12, 2009 1:29 PM
To: Philip Hoyer; Pei, Mingliang; Hannes Tschofenig
Subject: KW-AES-128 clashes with HOTP? Was: [KEYPROV] Examples in PSKC

Hi Guys,
 
Pardon my limited knowledge of "hardcore crypto" but during some experiments
with KW-AES-128 I found out that it seems to require that the keys to be
wrapped are a multiple of 8 bytes which seems to clash with HOTP's
recommended 20 byte-keys.
 
Anders

----- Original Message ----- 
From: Philip Hoyer <mailto:[email-masked]>  
To: Pei, Mingliang <mailto:[email-masked]>  ; [email-masked] ;
[email-masked] 
Sent: Monday, January 12, 2009 11:31
Subject: Re: [KEYPROV] Examples in PSKC

Ming,

We agreed on previous call that the KW version AES 128 will be the mandatory
algorithm for PSKC and DSKPP so we need examples using KW-AES-128

Philip

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf
Of Pei, Mingliang
Sent: Monday, January 12, 2009 9:38 AM
To: [email-masked]; [email-masked]
Subject: Re: [KEYPROV] Examples in PSKC

Yes, I have done AES128-CBC examples. The padding and iv are well considered
in the example now, and I will update the draft to reflect the
specifications and example data. The mac key choice is the encryption key by
default and we need to come out a way to allow other mac key as we discussed
during 73th ietf.

I am working on the rsa example, and hope to get most results before
Tuesday's call.

- Ming

----- Original Message -----
From: Hannes Tschofenig <[email-masked]>
To: Pei, Mingliang; [email-masked] <[email-masked]>;
[email-masked] <[email-masked]>
Sent: Sat Jan 10 09:22:36 2009
Subject: RE: [KEYPROV] Examples in PSKC

Ming,

Are you making progress with the examples?

Ciao
Hannes

________________________________

        From: [email-masked] [mailto:[email-masked]] On
Behalf Of ext Pei, Mingliang
        Sent: 15 December, 2008 09:25
        To: [email-masked]; [email-masked]
        Subject: Re: [KEYPROV] Examples in PSKC

        I am one. Philip also suggested that it better has two versions so
that they can verify each other. Hope to get another reference check.
       
        - Ming
       
        ----- Original Message -----
        From: [email-masked] <[email-masked]>
        To: [email-masked] <[email-masked]>
        Sent: Sun Dec 14 04:55:43 2008
        Subject: [KEYPROV] Examples in PSKC
       
        Hi all,
       
        during the IETF#73 KEYPROV meeting Ming mentioned that the examples
will be
        extended in such a way that they can actually be verified, i.e.,
when there
        is a digital signature then enough information is provided in the
document
        so that it can be checked for correctness.
       
        What I have in mind is something similar to what is done in
        http://www.ietf.org/rfc/rfc4474.txt (see also Appendix B)
       
        So, who is working on this aspect?
       
        Ciao
        Hannes

        _______________________________________________
        KEYPROV mailing list
        [email-masked]
        https://www.ietf.org/mailman/listinfo/keyprov

  _____  

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/keyprov