Subject: [KEYPROV] RE: PSKC - Issue 19: clarify the key generation for HMAC value of a secret data when a PBE is used for encryption

From: "Salah Machani" <[email-masked]>
Date: Fri, 6 Jul 2007 13:21:56 -0400

I agree we should clarify this for inter-op.

My recommendation is to use a password derived key as opposed to the
actual password.   Also, I suggest we add an implementation note
recommending using a different password for the MAC key derivation than
the password used for the encryption key derivation.  

Regards,

 

\\\

Title

PSKC: clarify the key generation for HMAC value of a secret data when a
PBE is used for encryption

Priority

feature

Status

chatting

Superseder

Nosy List

keyprov, mpei 

Assigned To

mpei

Topics

Created on 2007-06-20.14:19:52 by mpei, last changed 2007-06-20.14:19:52
by mpei.

Messages

msg34 (view) <http://www.tschofenig.priv.at:8080/keyprov/msg34> 

Author: mpei

Date: 2007-06-20.14:19:52

Currently, PSKC SecretContainer contains an encryption method for data 
encryption including an secret in DataType. 
 
<complexType name="DataType">
     <sequence>
       <element name="Value" type="base64Binary"/>
       <element name="ValueDigest" type="base64Binary" minOccurs="0"/>
       <attribute name="Name" type="string" use="required"/>
     </sequence>
   </complexType>
 
"The digest MUST be calculated on the unencrypted value and MUST use one

of the Digest algorithms specified in DigestMethodType element of the 
SecretContainer."
 
<complexType name="DigestMethodType">
     <sequence>
       <element name="DigestKeyLabel" minOccurs="0"/>
     </sequence>
     <attribute name="algorithm" type="oath-pskc:DigestAlgorithmType"
     use="required"/>
   </complexType>
 
When PBE is used as encryption and HMAC-SHA1 as digest algorithm, it
isn't 
clear whether one should use the password value as the key for HMAC or
PBE 
derived encryption key as the HMAC key.
 
It is worthywhile to clarify this in the document for inter-op clarify.

Salah Machani

Diversinet Corp., 

[O] +1 (416) 756 2324 x321| [M] +1 (647) 284 7816
|http://www.diversinet.com <http://www.diversinet.com> 

Notice to Recipient:  The information in this message is meant only for the intended recipient of the transmission and may contain confidential or privileged information. 
Any copying, retransmittal, taking of action in reliance on, or other use of the information in this communication by persons other than the addressees is prohibited.  
If you received this email in error, please immediately notify us and please delete or destroy all copies of this message.
This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors.  Thank you.

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov