Subject: [Cfrg] Fwd: Draft NIST Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping

From: David McGrew <[email-masked]>
Date: Mon, 15 Aug 2011 09:30:57 -0700

FYI - NIST is requesting feedback on the draft specification for Key  
Wrapping.  This will probably be of interest to implementers of RFCs  
3394 and 5649.

Comments on the draft should be sent directly to NIST, of course.   
Discussion about the use of key wrapping in Internet standards is  
welcome on the CFRG list.

David

Begin forwarded message:

> From: NIST Computer Security Resource Center <[email-masked] 
> >
> Date: August 15, 2011 8:37:36 AM PDT
> To: [email-masked]
> Subject: Draft NIST Special Publication 800-38F, Recommendation for  
> Block Cipher Modes of Operation: Methods for Key Wrapping
> Reply-To: NIST Computer Security Resource Center <[email-masked] 
> >
>
> Draft Special Publication 800-38F
>
> NIST is pleased to announce that the Draft NIST Special Publication  
> 800-38F, Recommendation for Block Cipher Modes of Operation: Methods  
> for Key Wrapping, is available for public comment.
>
> For more informaiton regarding this draft please visit the CSRC  
> Drafts page at:
> http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-38-F
>
>

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 15 Aug 2011 10:05:35 -0700 (PDT)

Hi David,

> Wrapping.  This will probably be of interest to implementers of RFCs

  ...and RFC 5297 too!

> welcome on the CFRG list.

  SIV is being used in the just-ratified 802.11s amendment for "mesh
networking" to do key wrapping. The reason it was chosen is its ability
to bind additional data to the wrapped key-- the message itself is
authenticated and bound to the key such that the key cannot be unwrapped
if the message it is being sent in has been tampered with.

  I hate to sound like a broken record but SIV really is a swiss army
knife for crypto protocol design. It slices, it dices, it's a misuse
resistant AEAD scheme, it wraps arbitrary-length keys (no padding req'd)
and binds additional data to the wrapped key. And it's provably secure.

  Dan.

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>

---

From: David McGrew <[email-masked]>
Date: Fri, 19 Aug 2011 14:23:02 -0700

Hi Dan,

> and binds additional data to the wrapped key. And it's provably  

I was recently having an email conversation with Tom Shrimpton on the  
same subject.  I think it would make sense to analyze and document the  
need for misuse-resistant crypto, by reviewing failure modes, problem  
areas, and whatever actual case studies of misuse we can come up  
with.  (It sounds like Peter G. has several that we could use.)

I think it would be a useful approach to consider the need for misuse- 
resistant crypto in a way that is independent from a particular  
algorithm proposal, because it might convince more peole of the  
importance of the issue if we can document the need and the  
requirements.   This exercise might also uncover failure modes that we  
haven't yet anticipated, or it might help us understand which failure  
modes are the most common or the most damaging.  What do you think -  
does that sound like something worth doing?

David