Subject: [lamps] CMP and PBKDF2-MAC (use RFC 8018's PBMAC1?)

From: Mike Ounsworth <[email-masked]>
Date: Fri, 4 Dec 2020 00:10:07 +0000

RFC 4210 (CMP) allows for shared secret (MAC) protection of the message. Section 5.1.3.1 specifies the use of id-PasswordBasedMac which is defined in section 4.4 of RFC 4211. This algorithm looks a lot like PBKDF1 with a round of MAC at the end.

Question1: We are not seeing a RFC 4210 (CMP) update that provides a PBKDF2-based MAC. Is that correct or have we missed something?

RFC 8018 defines PBMAC1 using PBKDF2 and a MAC of your choice. Looks great!

Question2: Are you aware of any CMP implementations that have implemented PBKDF2-MAC, and did they use RFC 8018's PBMAC1 to do it, or some other AlgorithmIdentifier?

---
Mike Ounsworth

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 4 Dec 2020 18:11:13 +0000

Mike

> Von: Spasm <[email-masked]> Im Auftrag von Mike Ounsworth
> 
> RFC 4210 (CMP) allows for shared secret (MAC) protection of the message.
> Section 5.1.3.1 specifies the use of id-PasswordBasedMac which is defined in
> section 4.4 of RFC 4211. This algorithm looks a lot like PBKDF1 with a round of
> MAC at the end.
> 
> Question1: We are not seeing a RFC 4210 (CMP) update that provides a
> PBKDF2-based MAC. Is that correct or have we missed something?

As the password-based MAC is identified by an OID, we are free to specify an alternative to id-PasswordBasedMac in draft-ietf-lamps-cmp-algorithms.

> Question2: Are you aware of any CMP implementations that have
> implemented PBKDF2-MAC, and did they use RFC 8018's PBMAC1 to do it, or
> some other AlgorithmIdentifier?

No I am not aware of any implementation using something other than id-PasswordBasedMac.

- Hendrik

---

From: Mike Ounsworth <[email-masked]>
Date: Mon, 7 Dec 2020 22:39:26 +0000

Hi Hendrik,

Are you interested in collaborators on draft-ietf-lamps-cmp-algorithms-01? We would love to help you update your section 6.1 to define a PBKDF2-based mechanism.

---
Mike Ounsworth
Software Security Architect, Entrust

-----Original Message-----
From: Spasm <[email-masked]> On Behalf Of Brockhaus, Hendrik
Sent: December 4, 2020 12:11 PM
To: Mike Ounsworth <Mike.Ounsworth=[email-masked]>; 'LAMPS' <[email-masked]>
Subject: [EXTERNAL]Re: [lamps] CMP and PBKDF2-MAC (use RFC 8018's PBMAC1?)

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

Mike

> Section 5.1.3.1 specifies the use of id-PasswordBasedMac which is 
> defined in section 4.4 of RFC 4211. This algorithm looks a lot like 
> PBKDF1 with a round of MAC at the end.
> 

> implemented PBKDF2-MAC, and did they use RFC 8018's PBMAC1 to do it, 
> or some other AlgorithmIdentifier?

- Hendrik

_______________________________________________
Spasm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/spasm

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Tue, 8 Dec 2020 07:43:52 +0000

Hi Mike

Together with a colleague of mine, Hans Aschauer, I am working on an update of the draft addressing the feedback from IETF109.
If you are interested in support of alternatives to id-PasswordBasedMac in Section 6.1, you are welcome to join in.
I would anyhow be happy to have sparing's partner for this draft as I am not an expert on all of the different algorithm variants out there :-)

Hendrik

> -----Ursprüngliche Nachricht-----
> Von: Mike Ounsworth <[email-masked]>
> Gesendet: Montag, 7. Dezember 2020 23:39
> An: Brockhaus, Hendrik (T RDA CST SEA-DE)
> <[email-masked]>; 'LAMPS' <[email-masked]>
> Betreff: RE: CMP and PBKDF2-MAC (use RFC 8018's PBMAC1?)
> 
> Hi Hendrik,
> 
> Are you interested in collaborators on draft-ietf-lamps-cmp-algorithms-01?
> We would love to help you update your section 6.1 to define a PBKDF2-based
> mechanism.
> 
> ---
> Mike Ounsworth
> As the password-based MAC is identified by an OID, we are free to specify an
> alternative to id-PasswordBasedMac in draft-ietf-lamps-cmp-algorithms.
> 
> >
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> .ietf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=04%7C01%7Chendrik.
> brockhaus%40siemens.com%7C4c85776a7bca4699af5108d89b00f708%7C38a
> e3bcd95794fd4addab42e1495d55a%7C1%7C1%7C637429775762026495%7CU
> nknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI
> 6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=GpRhv3oCupCoS%2BnG1
> b0VveVjWDptdWJwcPwr%2Fz5Cc5I%3D&amp;reserved=0