Subject: RE: Comments on CMC-09, Section 12.3.1.1

From: Russ Housley <[email-masked]>
Date: Thu, 03 Dec 1998 14:37:51 -0500

Jim & Steve:

>> > > >16.  Section 12.3.1.1 - In the KeyWrapAlgorithm is the IV present and
is its
>> > > >value the constant 'A5' repeated n time?  The IV was not present in the
>> > > >previous versions but would appear to be present now.  We still have
the IV
>> > > >restriction on the key wrap algorithm however.
>> > >
>> > > There is no field needed to carry the IV as it is always "A5...A5".  For
3DES,
>> > > the parameter is always NULL, and for RC2 the parameter is the effective
key
>> > > length.  Where do you see an IV?
>> > 
>> > OK -- I see where I got confused.  I started with the second paragraph in
>> > section 12.3.1 and made a leap of incorrectness into the fact that the
>> > KeyWrapAlgorithm was going to be rc2-cbc not id-alg-RC2wrap.  I don't see
>> > any clarifications that need to be added to the text, I was just skimming
>> > the changes too fast.
>> 
>> Just to add a little comment of my own since I suggested part of this.
>> My primary reason for this change is to allow algorithms other than RC2
>> and 3DES to be used with key agreement. In the case of RC2 and 3DES a
>> special algorithm identifier form is defined without the IV. In other
>> cases, such as (single) DES the normal algorithm identifier would be
>> used which would include an IV: but in this case it would be ignored
>> and A5 used.
>
>Yes -- this is what I kind of expected to have happen.  I would however make
>an assert that the IV MUST be 'A5' and encoded as such.

Presetly, two key wrap algorithm identifiers are defined.  They are:

        id-alg-3DESwrap OBJECT IDENTIFIER ::= { iso(1) member-body(2)
            us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 3 }

        id-alg-RC2wrap OBJECT IDENTIFIER ::= { iso(1) member-body(2)
            us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 4 }

People who want to use E-S D-H with other algorithms are free to assign
additional algorithm identifiers for use in the KeyWrapAlgorithm.  In fact,
these additional algorithms need not follow the technque specified in CMS
Secion 12.6.  These additional assignments will not represent "must" implement
or "should" implement algorithms.

I consider this issue closed.

Russ

---

From: Russ Housley <[email-masked]>
Date: Thu, 03 Dec 1998 14:44:51 -0500

Steve & Jim:

>> > > >15.  Section 12.6.2 - You have not modified the key wrap algorithm
to allow
>> > > >for arbitrary length RC2 key sources.
>> > >
>> > > Are you suggesting an explicit length field or something else?
>> >
>> > We need to either put in an explicit length field or use a known padding
>> > algorithm.  I have no perference on which is used but something along this
>> > lines is absolutely required.
>> 
>> Speaking personally I'd prefer known padding. Known padding at least
>> adds some consistency with the use of symmetric algorithms: 
>> they all use the "padded" forms.
>> 
>> If an explicit length parameter is included the logical place to put it
>> is in the EncryptedContentInfo structure because its a property of the
>> content encryption key. You'd probably then have to make it OPTIONAL for
>> v2 compatability only include it when at least one recipient used key
>> agreement.
>
>If I was to put it some place I would put it into the encrypted content to
>make for minimual changes from now.

Why not replace random padding with the technique specified in 6.3?  I do
not see any advantage to the random block prior to the 6.3 padding.

I am going to change the text for CMS-10 this way.  Anyone object?

Russ

---

From: Dr Stephen Henson <[email-masked]>
Date: Fri, 04 Dec 1998 18:28:37 +0000

> I am going to change the text for CMS-10 this way.  Anyone object?

No objections at all. I only included it because the original wrap
algorithm included the addition of a random padding.

Steve.
-- 
Dr Stephen N. Henson. UK based freelance Cryptographic Consultant. 
For info see homepage at http://www.drh-consultancy.demon.co.uk/
Email: [email-masked]
PGP key: via homepage.