Subject: Re: [xmpp] Anonymity and PFR with Miller's E2E proposal (Was: Self Introduction)

From: Richard Barnes <[email-masked]>
Date: Fri, 12 Apr 2013 16:37:49 -0400

Hey Jon,

Sorry for the late reply.  If you're interested in DH for JWK, I would
suggest sending a message to the JOSE mailing list.  Other than that, your
syntax looks OK to me, although I would just use standard letters, like "p"
for "prime" and "g" for "generator".

Also, as to the IPR on ECC, there's some story about how to do it IPR-free:
<http://tools.ietf.org/html/rfc6090>

Best,
--Richard

On Thu, Mar 14, 2013 at 4:52 PM, Jon Kristensen <[email-masked]> wrote:

>  On 03/14/2013 06:39 AM, Richard Barnes wrote:
>
> It's even simpler than that: Alice and Bob each generate a JWK
> representing a DH or ECDH key, the exchange them in an IQ.
>
>  http://tools.ietf.org/html/draft-ietf-jose-json-web-key-08
>
>
> Thank you for pointing me in the right direction!
>
> Please correct me if I'm wrong, but the way I see it is this:
>
> In order to provide authentication and (weak) anonymity, we would have to
> exchange
>
>    1. unauthenticated Diffie-Hellman key exchange <keyreq /> stanzas,
>    used to negotiate a first shared secret, and
>     2. encrypted (with the first shared secret) <keyreq /> stanzas (which
>    wraps the long-lived public keys) to negotiate a second shared secret.
>
> The second shared secret would be the symmetric key used for encrypting
> the following stanzas. This would protect the long-lived public key from a
> passive attacker, and provide perfect forward secrecy. Also, any entity
> could perform additional unauthenticated Diffie-Hellman key exchanges (this
> time, however, encrypted) to redo the procedure, and add yet another "PFS
> layer".
>
> As there seems to be some patent-related uncertainty surrounding elliptic
> curve cryptography[1], I would like to see support for regular
> Diffie-Hellman keys.
>
> Looking at the IANA JSON Web Key Types registry key types[2], there appear
> to only be two key types defined: `EC' (Elliptic Curve [DSS] key type) and
> `RSA' (RFC3447 key type). Could perhaps `DH' be added to this table?
>
> Would `alg' (refer to the the JSON Web Encryption algorithm section[3]) be
> something like `DH+A128KW'?
>
> All-in-all, would something like the following JWK representation be
> suitable for the Diffie-Hellman public key exchanges?
>
> {
>   "kty": "DH",
>   "public-key": "...",
>   "prime": "...",
>   "generator": "...",
>   "use": "enc",
>   "alg": "DH+A128KW"
> }
>
> [1]: http://en.wikipedia.org/wiki/ECC_patents
> [2]:
> http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-08#section-5.1
> [3]:
> http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-08#section-4.1
>
> Jon
>