Subject: Re: [jose] #28: AES-GCM should not be allowed for content encryption in combination with Direct Encryption key management mode

From: "jose issue tracker" <[email-masked]>
Date: Thu, 27 Jun 2013 15:25:42 -0000

#28: AES-GCM should not be allowed for content encryption in combination with
Direct Encryption key management mode

Comment (by [email-masked]):

 Thanks for pointing out the NIST text.  Rather than prohibiting the use of
 GCM, a less heavy-handed means of handling this issue would be to include
 text such as the following:

 "NIST SP 800-38D section 8.3 states 'The total number of invocations of
 the authenticated encryption function shall not exceed 2^32, including all
 IV lengths and all instances of the authenticated encryption function with
 the given key.'  In accordance with this rule, AES GCM MUST NOT be used
 with the same direct encryption key more than 2^32 times."

 No we can’t guarantee that applications will always follow this
 requirement, but we can’t guarantee that many other requirements are
 followed either – such as the requirement to use a unique ephemeral key
 when doing key agreement.  Just because incorrect uses are possible
 doesn’t mean that we shouldn’t enable correct uses.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-jose-json-web-
  [email-masked]        |  [email-masked]
     Type:  defect       |      Status:  new
 Priority:  major        |   Milestone:
Component:  json-web-    |     Version:
  algorithms             |  Resolution:
 Severity:  -            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/28#comment:1>
jose <http://tools.ietf.org/jose/>

---

From: "jose issue tracker" <[email-masked]>
Date: Thu, 27 Jun 2013 15:13:12 -0000

Section 4.9 of draft-ietf-jose-json-web-algorithms should prohibit use of
 the A128GCM and A256GCM "enc" content encryption algorithms in combination
 with the Direct Encryption key management mode (when the value of "alg" is
 "dir").

 NIST SP 800-38D section 8.3 states "The total number of invocations of the
 authenticated encryption function shall not exceed 2^32 ,  including all
 IV lengths and all instances of the authenticated encryption function with
 the given key."  There is no way to guarantee compliance with this using
 the Direct Encryption mode.  All of the other modes are OK because they
 generate or derive a fresh CEK for each message.

 Existing RFCs using GCM include requirements for "automated key
 management", for example RFC 4106 Section 2 and RFC 5084.

  algorithms             |   Keywords:

Ticket URL: <http://tools.ietf.org/wg/jose/trac/ticket/28>
jose <http://tools.ietf.org/jose/>