Subject: [jose] AES+CBC algorithm

From: "Jim Schaad" <[email-masked]>
Date: Fri, 5 Jul 2013 14:31:06 -0700

Are we going to lobby to get this algorithm adopted as an algorithm by the
WebCrypto group?

Jim

---

From: Mike Jones <[email-masked]>
Date: Fri, 5 Jul 2013 22:39:08 +0000

It seems that David will be in Berlin in person.  I was planning on talking with him there.

-- Mike

________________________________
From: Jim Schaad
Sent: 7/5/2013 2:32 PM
To: [email-masked]
Subject: [jose] AES+CBC algorithm

Are we going to lobby to get this algorithm adopted as an algorithm by the WebCrypto group?

Jim

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 5 Jul 2013 15:47:40 -0700

I am glad to hear that, but it does not address the question that I asked

From: Mike Jones [mailto:[email-masked]] 
Sent: Friday, July 05, 2013 3:39 PM
To: Jim Schaad; [email-masked]
Subject: RE: [jose] AES+CBC algorithm

It seems that David will be in Berlin in person.  I was planning on talking
with him there.

-- Mike

  _____  

From: Jim Schaad
Sent: 7/5/2013 2:32 PM
To: [email-masked]

Jim

---

From: Martin Thomson <[email-masked]>
Date: Fri, 5 Jul 2013 16:05:01 -0700

> I am glad to hear that, but it does not address the question that I asked

Are you asking if the IETF JOSE working group should send a liaison statement?

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 5 Jul 2013 16:17:01 -0700

It would probably be a more informal push that that.  There are a number of people who are in both working groups.  The question is should we do the push?

> -----Original Message-----
> From: Martin Thomson [mailto:[email-masked]]
> Sent: Friday, July 05, 2013 4:05 PM
> To: Jim Schaad
> Cc: Mike Jones; jose
> Subject: Re: [jose] AES+CBC algorithm
>

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 5 Jul 2013 19:59:49 -0700

That is what I get for sending mail while thinking about meals.

AES-CBC + HMAC is what I meant to say.  We have a composite AEAD algorithm
that computes an HMAC over a CBC encryption using AES.  This can be done
either by doing the composite things from the WebCrypto API or by getting a
composite algorithm defined that takes a CBC encryption algorithm and a MAC
algorithm and pushes things together.

Jim

> From: Ryan Sleevi [mailto:[email-masked]]
> Sent: Friday, July 05, 2013 7:03 PM
> To: Jim Schaad
> Cc: [email-masked]
> On Fri, July 5, 2013 2:31 pm, Jim Schaad wrote:
> >  _______________________________________________
> >  jose mailing list
> >  [email-masked]
> >  https://www.ietf.org/mailman/listinfo/jose
> >
> 
> Can you explain what you mean, Jim?
> 
> AES-CBC has been listed in the Web Cryptography API since the FPWD.

---

From: Russ Housley <[email-masked]>
Date: Sat, 6 Jul 2013 08:16:29 -0400

In CMS, Peter Gutmann wrote RFC 6475 because he wanted a way to provide authenticated encryption on platforms that did not support AES-GCM or AES-CCM. I suggest that there are still many fewer of these platforms today, but there may still be a significant number of them.  Having AES-CBC with HMAC seems like a good idea to me.

Russ

---

From: "Ryan Sleevi" <[email-masked]>
Date: Fri, 5 Jul 2013 19:02:44 -0700

---

From: Richard Barnes <[email-masked]>
Date: Mon, 8 Jul 2013 13:23:18 -0400

Interpolating the rest of the thread, I think what is meant here is the "
A128CBC-HS256" algorithm in JWA, which synthesizes an authenticated
encryption algorithm out of AES-CBC and HMAC:
<
http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-11#section-4.8.3

The CMS parallel that Russ raised is actually RFC 6476, which adapts the
TLS A&E scheme to CMS:
<http://tools.ietf.org/html/rfc6476>

The obvious counter-argument to including this in WebCrypto is that the
whole point of the algorithm is that it's easy to polyfill.  In fact, an
application could implement it today using the existing AES-CBC and HMAC
functions.  The only trouble would be getting the wrapped key out with
wrapKey, since the key for the overall operation would be the concatenation
of the two individual keys.

--Richard