Subject: Re: [KEYPROV] Recommended AES Key wrapping mechanism

From: "Philip Hoyer" <[email-masked]>
Date: Fri, 19 Feb 2010 21:23:12 +0100

Thanks Russ for the clarification.

Philip

----- Original Message -----
From: Russ Housley <[email-masked]>
To: Philip Hoyer
Cc: KEYPROV <[email-masked]>; Phillip Hallam-Baker <[email-masked]>; [email-masked] <[email-masked]>; Tschofenig, Hannes (NSN - FI/Espoo) <[email-masked]>
Sent: Fri Feb 19 21:13:39 2010
Subject: Re: Recommended AES Key wrapping mechanism

Please take a second look.  The document makes references to AES-KW1 and
AES-KW2:

AES-KW1:
http://csrc.nist.gov/groups/ST/toolkit/documents/kms/AES_key_wrap.pdf

AES-KW2: RFC 3394

These are two references to the same algorithm, which requires 8-byte
alignment.

RFC 5649 specified a single algorithm.  It builds on constructs
specified in AES-KW1 / AES-KW2.

Russ

On 2/19/2010 7:53 AM, Philip Hoyer wrote:
> Ladies and Gentlemen,
> 
>  
> 
> In the keyprov specification we have made a recommendation to use
> AES-Keywrap algorithms when transporting keys, whose value are not
> multiple of 8 bytes.
> 
>  
> 
> We referenced a draft from Russ Housley that has now become an RFC
> (5649)  (http://tools.ietf.org/html/rfc5649) to be precise.
> 
>  
> 
> Now reading through the RFC there are two wrapping algorithms presented
> AES-KW1 and AES-KW2
> 
>  
> 
> Also even if the spec dfines ASN.1 identifier like 'id-aes128-wrap-pad’
> it does not define any URI for the algorithm.
> 
>  
> 
> Since we recommend this algorithm do we need to change the
> recommendation text somehow to reference a specific wrapping algorithm
> or do we need to define URIs for the keywrap algorithms?
> 
>  
> 
> Philip
> 
>  
> 
> ________________________________
> 
>  
> 
> Philip Hoyer
> 
>  
> 
> Senior Architect - Office of CTO
> 
>  
> 
> ActivIdentity (UK)
> 
> 117 Waterloo Road
> 
> London SE1 8UL
> 
>  
> 
> Telephone: +44 (0) 20 7960 0220
> 
> Fax: +44 (0) 20 7902 1985
> 
>  
> 
> Private and confidential: This message and any attachments may contain
> 
> privileged / confidential information. If you are not an intended recipient,
> 
> you must not copy, distribute, discuss or take any action in reliance on it.
> 
> If you have received this communication in error, please notify the sender
> 
> and delete this message immediately.
> 
>  
>