Subject: [Cfrg] Key wrap algorithm

From: Jim Schaad <[email-masked]>
Date: Sun, 31 Jul 2016 22:03:43 -0700

We have traditionally used the AES key wrap algorithm when encrypting keys
for transport in the S/MIME documents.  If we move to using
ChaCha20/Poly1305 as one of the new content encryption algorithms, it would
make sense to have a key wrap algorithm based on ChaCha20 rather than AES to
match.

Has anybody looked at using ChaCha20, either with or without Poly1305 for
doing a key wrap.  An SIV style algorithm would be acceptable.  A preference
for an algorithm without the same IV requirements would be nice, but it
should be assumed that the same key will be used to encrypt multiple keys.
The algorithm could either be an AE or and AEAD algorithm, the current AES
key wrap is an AE algorithm but allowing for additional data might be useful
in other contexts (i.e. COSE). 

Jim

---

From: Dmitry Khovratovich <[email-masked]>
Date: Mon, 1 Aug 2016 07:51:40 +0200

I have once looked at using a single (wide) permutation call for a key
wrap, and got the design of KWF  https://eprint.iacr.org/2013/145.pdf
(later CT-RSA 2014).

With the ChaCha20 permutation inside we could wrap 128-bit keys (+
associated data) with 128-bit security level.

Dmitry

On Mon, Aug 1, 2016 at 7:03 AM, Jim Schaad <[email-masked]> wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Best regards,
Dmitry Khovratovich