Subject: [jose] WebCrypto feedback on key wrapping

From: Richard Barnes <[email-masked]>
Date: Mon, 18 Mar 2013 19:25:19 -0400

On today's call with the W3C WebCrypto working  group, I reported on the
discussion of JOSE key wrapping at the last IETF.  I was asked to relay a
few bits of feedback:

1. Vijay Bharadwaj (Microsoft) observed that AES key wrap has fallen out of
favor with some parts of the cryptographic community.  People prefer to be
able to use AEAD algorithms for key wrapping, since they are perceived to
be faster and offer a higher level of security than AES-KW. He gave the
example that IEEE 802.1 uses AES CCM.

2. Mark Watson (Netflix) noted that if we use RSA directly to encrypt
wrapped key objects, then we would need something other than OAEP in order
to carry arbitrary-length payloads.  I agreed, and suggested that something
like RSA-KEM would be necessary.  Ryan Sleevi (Google) and Vijay observed
that KEM is troublesome due to the lack of support by native crypto
libraries.

It seems to me that these comments have impacts on JWE and JWS (pending
ISSUE-2), as well as the wrapping discussion.  The former has more impact
than the latter.

Point number 1 implies that we should offer AEAD for key wrapping in JWE as
well as for wrapped keys.  It seems to me that the simplest approach to
this would be to make the "alg" field contain an object that is
semantically equivalent to an AlgorithmIdentifier in CMS/PKCS8.  For
example, { name: "A128GCM", iv: "PCIGJe0DjunuM7s0" }.  This syntax,
incidentally, is roughly the same form that algorithm identifiers have in
the WebCrypto API.  Note that this type of key wrapping is supported in CMS
by the use of an AEAD AlgorithmIdentifier in the KEKRecipientInfo
structure.

Point number 2 likely applies for some scenarios of JWE, especially if we
adopt the McGrew approach.  For example, if using HMAC-SHA1 and AES with a
256-bit key, the total key length is 788 bits, which is too long to be
encrypted with OAEP under a 1,024-bit RSA key.  I'm not sure how to resolve
it.  The best idea I've got is to allow wrapped keys to nest, so that you
can wrap a key inside of another wrapped key.

I will try to take these points into account in my forthcoming key wrapping
draft, and I've filed two issues against JWE to track them.

--Richard

---

From: Mike Jones <[email-masked]>
Date: Tue, 19 Mar 2013 00:02:18 +0000

Given that we require RSA keys to be a minimum of 2048 bits in length, there's no problem wrapping 768 bit keys with OAEP in practice.

                                                                -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Monday, March 18, 2013 4:25 PM
To: [email-masked]
Subject: [jose] WebCrypto feedback on key wrapping

On today's call with the W3C WebCrypto working  group, I reported on the discussion of JOSE key wrapping at the last IETF.  I was asked to relay a few bits of feedback:

1. Vijay Bharadwaj (Microsoft) observed that AES key wrap has fallen out of favor with some parts of the cryptographic community.  People prefer to be able to use AEAD algorithms for key wrapping, since they are perceived to be faster and offer a higher level of security than AES-KW. He gave the example that IEEE 802.1 uses AES CCM.

2. Mark Watson (Netflix) noted that if we use RSA directly to encrypt wrapped key objects, then we would need something other than OAEP in order to carry arbitrary-length payloads.  I agreed, and suggested that something like RSA-KEM would be necessary.  Ryan Sleevi (Google) and Vijay observed that KEM is troublesome due to the lack of support by native crypto libraries.

It seems to me that these comments have impacts on JWE and JWS (pending ISSUE-2), as well as the wrapping discussion.  The former has more impact than the latter.

Point number 1 implies that we should offer AEAD for key wrapping in JWE as well as for wrapped keys.  It seems to me that the simplest approach to this would be to make the "alg" field contain an object that is semantically equivalent to an AlgorithmIdentifier in CMS/PKCS8.  For example, { name: "A128GCM", iv: "PCIGJe0DjunuM7s0" }.  This syntax, incidentally, is roughly the same form that algorithm identifiers have in the WebCrypto API.  Note that this type of key wrapping is supported in CMS by the use of an AEAD AlgorithmIdentifier in the KEKRecipientInfo structure.

Point number 2 likely applies for some scenarios of JWE, especially if we adopt the McGrew approach.  For example, if using HMAC-SHA1 and AES with a 256-bit key, the total key length is 788 bits, which is too long to be encrypted with OAEP under a 1,024-bit RSA key.  I'm not sure how to resolve it.  The best idea I've got is to allow wrapped keys to nest, so that you can wrap a key inside of another wrapped key.

I will try to take these points into account in my forthcoming key wrapping draft, and I've filed two issues against JWE to track them.

--Richard

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 18 Mar 2013 17:39:30 -0700

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Richard Barnes
Sent: Monday, March 18, 2013 4:25 PM
To: [email-masked]
Subject: [jose] WebCrypto feedback on key wrapping

1. Vijay Bharadwaj (Microsoft) observed that AES key wrap has fallen out of
favor with some parts of the cryptographic community.  People prefer to be
able to use AEAD algorithms for key wrapping, since they are perceived to be
faster and offer a higher level of security than AES-KW. He gave the example
that IEEE 802.1 uses AES CCM.

[JLS] AES Key Wrap is an AD algorithm and a variant of it exists that is an
AEAD algorithm.  So this is a case of not correctly using terminology.  I
would also question the issue of perceived security as with AES-KW every bit
of the plain text affects every other bit of plain text in the encryption
process and this is not true for AES-GW or AES-CCM.  I would agree that
there is both a speed advantage and perhaps more importantly the fact that
only one side of the AES engine is needed (i.e. you only need to encrypt but
not decrypt) for AES CCM and AES-GCM.

Note that using RSA-KEM is not using RSA directly.  RSA-KEM should be
thought of as a single party key agreement algorithm and not a key transport
algorithm.  You encrypt a large integer and then run a KDF on that large
integer to get a key.  I perceive no advantage to using RSA-KEM except for
the fact that the security on it is more provable.

Point number 1 implies that we should offer AEAD for key wrapping in JWE as
well as for wrapped keys.  It seems to me that the simplest approach to this
would be to make the "alg" field contain an object that is semantically
equivalent to an AlgorithmIdentifier in CMS/PKCS8.  For example, { name:
"A128GCM", iv: "PCIGJe0DjunuM7s0" }.  This syntax, incidentally, is roughly
the same form that algorithm identifiers have in the WebCrypto API.  Note
that this type of key wrapping is supported in CMS by the use of an AEAD
AlgorithmIdentifier in the KEKRecipientInfo structure.  

--Richard

---

From: Richard Barnes <[email-masked]>
Date: Mon, 18 Mar 2013 22:31:02 -0400

ISSUE-(n+1): Remove silly restriction on key sizes.  We're a formatting
working group, not a crypto parameters working group.

--Richard

On Mon, Mar 18, 2013 at 8:02 PM, Mike Jones <[email-masked]>wrote:

>  Given that we require RSA keys to be a minimum of 2048 bits in length,
> there’s no problem wrapping 768 bit keys with OAEP in practice.****
>
> ** **
>
>                                                                 -- Mike***
> *
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Richard Barnes
> *Sent:* Monday, March 18, 2013 4:25 PM
> *To:* [email-masked]
> *Subject:* [jose] WebCrypto feedback on key wrapping****
>
> ** **
>
> few bits of feedback:****
>
> ** **
>
> 1. Vijay Bharadwaj (Microsoft) observed that AES key wrap has fallen out
> of favor with some parts of the cryptographic community.  People prefer to
> be able to use AEAD algorithms for key wrapping, since they are perceived
> to be faster and offer a higher level of security than AES-KW. He gave the
> example that IEEE 802.1 uses AES CCM.****
>
> ** **
>
> libraries.****
> ** **
> than the latter. ****
> ** **
> Point number 1 implies that we should offer AEAD for key wrapping in JWE
> as well as for wrapped keys.  It seems to me that the simplest approach to
> structure.  ****
> ** **
> can wrap a key inside of another wrapped key.****
>
> ** **
>
> I will try to take these points into account in my forthcoming key
> wrapping draft, and I've filed two issues against JWE to track them.****
>
> ** **
>
> --Richard****
>

---

From: Mark Watson <[email-masked]>
Date: Tue, 19 Mar 2013 14:33:06 +0000

On Mar 18, 2013, at 5:02 PM, Mike Jones wrote:

Given that we require RSA keys to be a minimum of 2048 bits in length, there’s no problem wrapping 768 bit keys with OAEP in practice.

Sure, but there would be a problem if what you are wrapping is a JWK object, which could get much bigger than 768 bits.

…Mark

                                                                -- Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Richard Barnes
Sent: Monday, March 18, 2013 4:25 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] WebCrypto feedback on key wrapping

--Richard
_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

---

From: Mike Jones <[email-masked]>
Date: Tue, 19 Mar 2013 16:27:31 +0000

Yes, but at least as I see it, you wouldn't wrap a JWK with OAEP directly.  You'd encrypt an ephemeral symmetric key with OAEP and then use an authenticated symmetric key encryption algorithm to encrypt the JWK.  This is exactly what a JWE does.

                                                                -- Mike

From: Mark Watson [mailto:[email-masked]]
Sent: Tuesday, March 19, 2013 7:33 AM
To: Mike Jones
Cc: Richard Barnes; [email-masked]
Subject: Re: [jose] WebCrypto feedback on key wrapping

...Mark

                                                                -- Mike

--Richard

---

From: Mark Watson <[email-masked]>
Date: Wed, 20 Mar 2013 13:55:53 +0000

Sent from my iPhone

On Mar 19, 2013, at 9:27 AM, "Mike Jones" <[email-masked]<mailto:[email-masked]>> wrote:

Yes, but at least as I see it, you wouldn’t wrap a JWK with OAEP directly.  You’d encrypt an ephemeral symmetric key with OAEP and then use an authenticated symmetric key encryption algorithm to encrypt the JWK.  This is exactly what a JWE does.

Yes, this is how it works in the JWE-wrapped-JWK proposal for key wrapping. I am fine with this. I was asking how it would work with Richard's alternative proposal.

...Mark

                                                                -- Mike

From: Mark Watson [mailto:[email-masked]]
Sent: Tuesday, March 19, 2013 7:33 AM
To: Mike Jones
Cc: Richard Barnes; [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] WebCrypto feedback on key wrapping

…Mark

                                                                -- Mike

--Richard