Subject: [KEYPROV] Algorithm choices - Take II

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 2 Mar 2009 21:12:50 +0100

Interesting, alarming or just plain stupid, I have anyway come to the conclusion that I on my part [*] will switch to AES256_CBC, SHA256 and HMAC_SHA256 as default to hopefully be able to concentrate on implementations and deployments, rather than getting stuck in "cryptic" discussions that probably have pretty limited relevance for key-provisioning schemes that only carries random, high-entropy data.

I will not consider the AES KW variants because with a separate MAC you can create more powerful schemes where you bind attributes to keys using trusted hardware.  Although server-to-client-HW-enforced algorithm/key-usage may be a "luxury", I still think it looks a bit cool in the "pamphlet" :-)

Anders Rundgren
*] http://android-keystore-v2.webpki.org