Subject: Re: [jose] PBE salt should include alg id

From: Mike Jones <[email-masked]>
Date: Sat, 8 Feb 2014 00:33:19 +0000

Hi Matt,

Since no one has objected to the breaking change, could you please update the example PBE computation in http://tools.ietf.org/html/draft-ietf-jose-json-web-key-20#appendix-C to use a salt value that is the concatenation of (the UTF-8 "alg" value "PBES2-HS256+A128KW" || 0x00 || base64url_decode(p2s)) and send me the step-by-step results to include in the -21 versions of the specs?  Ideally, only the salt value used would change from the current example.

Also, if you could also send me the intermediate result from the PBES2-HS256 computation, before applying A128KW, I'd like to include that in the example as well, since it might help implementers when trying to reproduce the result.

				Thanks a bunch,
				-- Mike

-----Original Message-----
From: jose [mailto:[email-masked]] On Behalf Of Matt Miller
Sent: Friday, January 31, 2014 10:31 AM
To: Manger, James; <[email-masked]>
Subject: Re: [jose] PBE salt should include alg id

On 1/30/14, 5:58 PM, Manger, James wrote:
>> On 11/7/13, 5:51 PM, Manger, James H wrote:
>>> JWA section 4.9 ?Key Encryption with PBES2? should follow the 
>>> recommendation of the PBES2 spec [RFC 2898 section 4.1 ?Salt?] by 
>>> including in the salt ?data that explicitly distinguishes between 
>>> different operations and different key lengths?.
>>> 
>>> We can do this quite easily in JWA by including the alg value (eg 
>>> ?PBES2-HS384+A192KW?) in the salt. I suggest:
>>> 
>>> salt = UTF8(alg) || 0x00 || BASE64URL_DECODE(p2s)
> 
> 
> Matt replied:
>> When I read and interpreted that section, it came across as a 
>> consideration for applications using PBES2 in JOSE.  I probably 
>> should have pointed that out in my initial work on this.  C'est la 
>> vie.
>> 
>> That said, I personally don't have a problem with this change. 
>> However, it does break existing implementations.  Given the stage 
>> these drafts are in, it might be less disruptive to include 
>> considerations and recommendations for applications.
> 
> 
> Matt,
> 
> I'm not sure what you mean by "include considerations and 
> recommendations for applications". Do you mean JWA section 4.8.1.1.
> "p2s (PBES2 salt) Parameter" should say: "A salt MUST include 8 or 
> more random octets, and can include the "alg" value"
> 
> I don't think that helps. The issue is that the JOSE *recipient* needs 
> to ensure the correct "alg" value is in the salt.
> 
> Or are you suggesting app-specific profiles of JOSE can add a
> requirement: "A salt MUST include the "alg" value and 8 or more random 
> octets. A recipient MUST confirm that the "p2s" value (after
> base64url-decoding) starts with the "alg" value."
> 
> That would theoretically work, except that it adds about 30 bytes to 
> messages, is easily ignored, and is awkward to implement as it 
> requires an app-specific rule to be enforced deep inside app-agnostic 
> JOSE libraries.
> 
> "p2s" has only been in the drafts for 6 months. Can't we fix it 
> properly?
> 
> -- James Manger
> 

I was suggesting that app-specific profiles can add a requirement, as suits their needs -- maybe it's what you wrote, maybe it's something else.  That's why I think there's two parts to that section in RFC 2898.

I don't think it requires app-agnostic libraries to enforce.  It does require the application to enforce it's own policies, although how awkward it is depends on how accessible this information out of the JOSE library.

But this might all be moot if no one objects to the breaking change.

- --
- - m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.
_______________________________________________
jose mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/jose

---

From: Mike Jones <[email-masked]>
Date: Sat, 15 Feb 2014 01:50:43 +0000

These changes have been applied in the -21 drafts.  Thanks to James for the suggestion and thanks to Matt Miller for updating the example PBES2 computation in JWK Appendix C.

                                                                -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Manger, James H
Sent: Thursday, November 07, 2013 4:52 PM
To: <[email-masked]>
Subject: [jose] PBE salt should include alg id

JWA section 4.9 “Key Encryption with PBES2” should follow the recommendation of the PBES2 spec [RFC 2898 section 4.1 “Salt”] by including in the salt “data that explicitly distinguishes between different operations and different key lengths”.

We can do this quite easily in JWA by including the alg value (eg “PBES2-HS384+A192KW”) in the salt. I suggest:

--
James Manger