Subject: [jose] Do we have actual normative text which curves are allowed / standard for ECDH-ES in JOSE?

From: Vladimir Dzhuvinov <[email-masked]>
Date: Tue, 3 Nov 2020 23:40:31 +0200

Today we received the question why the Nimbus JOSE+JWT lib supports the
EC curves it does for ECDH (P-256, P-384, P-512) and I couldn't find any
normative text or reference in the JWA spec to explain this.

https://tools.ietf.org/html/rfc7518#section-4.6

We also looked at the IANA registry for hints:

https://www.iana.org/assignments/jose/jose.xhtml

Contrast this with the JWS ECDSA, where the curves to go with the ESxxx
algs are specced:

https://tools.ietf.org/html/rfc7518#section-3.4

Can someone help here? :)

Thanks,

Vladimir

-- 
Vladimir Dzhuvinov

---

From: Neil Madden <[email-masked]>
Date: Tue, 3 Nov 2020 21:50:16 +0000

Good question!

I guess the answer is that ECDH-ES requires a JWK-formatted “epk” header and so the JWK elliptic curve IANA registry defines the available choices. https://tools.ietf.org/html/rfc7518#section-7.6

https://tools.ietf.org/html/rfc7518#section-4.6.1.1

But I agree that you have to join the dots a bit. 

— Neil

> On 3 Nov 2020, at 21:40, Vladimir Dzhuvinov <[email-masked]> wrote:
> 
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

-- 
ForgeRock values your Privacy <https://www.forgerock.com/your-privacy>

---

From: Filip Skokan <[email-masked]>
Date: Tue, 3 Nov 2020 22:50:22 +0100

Hi Vladimir,

I kinda got the same question from someone a couple days ago and could
pinpoint a clear normative answer.

We have https://tools.ietf.org/html/rfc7520 that shows ECDH-ES with P-384
and P-256. In not having any normative text around these curves being
allowed or P-521 being disallowed I always assumed all original three are
fair use for ECDH-ES (and its composite KW variants).

We also have https://tools.ietf.org/html/rfc8037 which specifically
mentions X25519 and X448 OKP subtypes to be usable for ECDH-ES (and its
composite KW variants).

Then we have the JOSE registration of EC secp256k1 curve which specifically
mentions that the curve is NOT released for ECDH in that document.

So,

EC P-256
EC P-384
EC P-521
OKP X25519
OKP X448

S pozdravem,
*Filip Skokan*

---

From: Filip Skokan <[email-masked]>
Date: Tue, 3 Nov 2020 22:52:42 +0100

I meant to say "*couldn't* pinpoint a clear normative answer". Which i hope
is clear from the rest of my email.

S pozdravem,
*Filip Skokan*

On Tue, 3 Nov 2020 at 22:50, Filip Skokan <[email-masked]> wrote:

> Then we have the JOSE registration of EC secp256k1 curve which
> specifically mentions that the curve is NOT released for ECDH in that
> document.
>
> So,
>
> EC P-256
> EC P-384
> EC P-521
> OKP X25519
> OKP X448
>
> S pozdravem,
> *Filip Skokan*
>
>

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 4 Nov 2020 09:57:28 +0100

The JSON Web Key Elliptic Curve registry just lists the curves:

https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve

In COSE we have a registry "COSE Elliptic Curves”:

https://www.iana.org/assignments/cose/cose.xhtml#elliptic-curves

This actually has a column “description” that contains some more information about where these curves are supposed to be used.

Grüße, Carsten

> On 2020-11-03, at 22:50, Filip Skokan <[email-masked]> wrote:
> 
> Hi Vladimir,
> 
> I kinda got the same question from someone a couple days ago and could pinpoint a clear normative answer.
> 
> We have https://tools.ietf.org/html/rfc7520 that shows ECDH-ES with P-384 and P-256. In not having any normative text around these curves being allowed or P-521 being disallowed I always assumed all original three are fair use for ECDH-ES (and its composite KW variants).
> 
> We also have https://tools.ietf.org/html/rfc8037 which specifically mentions X25519 and X448 OKP subtypes to be usable for ECDH-ES (and its composite KW variants).
> 
> Then we have the JOSE registration of EC secp256k1 curve which specifically mentions that the curve is NOT released for ECDH in that document.
> 
> So, 
> 
> EC P-256
> EC P-384
> EC P-521
> OKP X25519
> OKP X448
> 
> S pozdravem,
> Filip Skokan
> 
> 
> On Tue, 3 Nov 2020 at 22:40, Vladimir Dzhuvinov <[email-masked]> wrote:

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Thu, 5 Nov 2020 07:18:49 +0200

Thanks Carsten, Filip, Neil.

This was amazing detective work and that's why I love cryptography so
much :)

Vladimir

-- 
Vladimir Dzhuvinov