Subject: Re: [Cfrg] Key wrap algorithm

From: "Erik Andersen" <[email-masked]>
Date: Mon, 1 Aug 2016 11:03:31 +0200

Hi Jim and others,

I have a question concerning key wrapping. I my understanding right that it
is more difficult to break an AES key wrap algorithm than the normal AES-CBC
encryption algorithms?

Erik

-----Oprindelig meddelelse-----
Fra: Cfrg [mailto:[email-masked]] På vegne af Jim Schaad
Sendt: 01 August 2016 07:04
Til: [email-masked]
Emne: [Cfrg] Key wrap algorithm

We have traditionally used the AES key wrap algorithm when encrypting keys
for transport in the S/MIME documents.  If we move to using
ChaCha20/Poly1305 as one of the new content encryption algorithms, it would
make sense to have a key wrap algorithm based on ChaCha20 rather than AES to
match.

Has anybody looked at using ChaCha20, either with or without Poly1305 for
doing a key wrap.  An SIV style algorithm would be acceptable.  A preference
for an algorithm without the same IV requirements would be nice, but it
should be assumed that the same key will be used to encrypt multiple keys.
The algorithm could either be an AE or and AEAD algorithm, the current AES
key wrap is an AE algorithm but allowing for additional data might be useful
in other contexts (i.e. COSE). 

Jim

_______________________________________________
Cfrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/cfrg

---

From: Dan Harkins <[email-masked]>
Date: Mon, 1 Aug 2016 11:34:24 -0700

Hi Jim,

> in other contexts (i.e. COSE).
   Have you looked at RFC 5297 (AES-SIV)? It does deterministic 
authenticated
encryption (aka key wrapping), with associated data.

   regards,

   Dan.

---

From: lvh <[email-masked]>
Date: Mon, 1 Aug 2016 13:41:51 -0500

Hi,

I’ve been building nonce-misuse resistant schemes with an associated deterministic scheme in caesium, my binding on top of libsodium. This is on top of XSalsa20, which makes the construction simpler due to its large nonce size. That might be a downside in your case, since it greatly inflates the size of the wrapped key, but it might be worth for you to look at regardless. I hope to get the time to put a paper together about it sometime this month.

hth
lvh

> On Aug 1, 2016, at 12:03 AM, Jim Schaad <[email-masked]> wrote:
>

---

From: Jim Schaad <[email-masked]>
Date: Mon, 1 Aug 2016 11:59:58 -0700

Dan,

I want to have a non AES algorithm, have you looked at what SIV ChaCha20
does?

Jim

> -----Original Message-----
> From: Cfrg [mailto:[email-masked]] On Behalf Of Dan Harkins
> Sent: Monday, August 01, 2016 11:34 AM
> To: [email-masked]
> Subject: Re: [Cfrg] Key wrap algorithm
> 
> 
>    Hi Jim,
> 
> > We have traditionally used the AES key wrap algorithm when encrypting
> > keys for transport in the S/MIME documents.  If we move to using
> > ChaCha20/Poly1305 as one of the new content encryption algorithms, it
> > would make sense to have a key wrap algorithm based on ChaCha20 rather
> > than AES to match.
> >
> > Has anybody looked at using ChaCha20, either with or without Poly1305
> > for doing a key wrap.  An SIV style algorithm would be acceptable.  A
> > preference for an algorithm without the same IV requirements would be
> > nice, but it should be assumed that the same key will be used to encrypt
> multiple keys.
> > The algorithm could either be an AE or and AEAD algorithm, the current
> > AES key wrap is an AE algorithm but allowing for additional data might
> > be useful in other contexts (i.e. COSE).
authenticated