Subject: [Cose] Reuse of Content Encryption Keys

From: "Jim Schaad" <[email-masked]>
Date: Mon, 11 May 2015 15:30:13 -0700

I want to call the groups attention to this RFC "RFC 3185: Reuse of CMS
Content Encryption Keys"  (https://tools.ietf.org/html/rfc3185).  The draft
talks about a method in CMS to start with an asymmetric operation on a CMS
message followed by sending a number of messages back and forth that use a
symmetric key which can be computed from the original CEK value.

I don't know that it makes any sense for the group to adopt a similar
methodology, but I did want to make sure that group did at least see it.

Jim

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 11 May 2015 23:40:43 +0100

On 11/05/15 23:30, Jim Schaad wrote:
> Content Encryption Keys"  (https://tools.ietf.org/html/rfc3185).  

Now there's a blast from the past:-)

> The draft

As a co-author, I can say that 3185 is, as far as I know, universally
unimplemented;-) It was developed as part of a Diameter e2e security
proposal that in the end didn't fly - iirc, the scenario was something
like Alice sends ciphertext to Bob who needs to be able to immediately
send ciphertext back to Alice with low overhead. I think the idea may
still be useful sometime though, but 3185 may be (rightly) considered
too hacky nowadays, but maybe with s/reverse bytes/use-KDF/ and a bit
more work, the basic concept might be acceptable. (And if that turns
out to be the case then well spotted Jim!)

S.

> 
> Jim
> 
> 
> _______________________________________________
> Cose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
> 
>