Subject: RE: Algorithm parameters for symmetric algorithms in EncryptedVal ue

From: Carlisle Adams <[email-masked]>
Date: Thu, 30 Mar 2000 10:45:22 -0500

Hi Chris,

> ----------
> From: 	Christopher Williams[SMTP:[email-masked]]
> Sent: 	Thursday, March 30, 2000 10:11 AM
> To: 	PKIX Mailing List
> Subject: 	Algorithm parameters for symmetric algorithms in
> EncryptedValue
> 
> In the EncryptedValue structure, the symmAlg member, like most members, is
> optional.  This, I guess, is for when communication between an EE and CA
> is
> always done using 3-DES and never using RC4, for example.  However, one
> passes important information with the AlgorithmIdentifier, e.g.:
> 
> DES / 3-DES - the IV
> RC2 - the IV and the effective key length
> 
> If one does not set the symmAlg member, there is no way of passing this
> information between the EE and CA; therefore, should one ever set the
> parameters, even if symmAlg is set?
 
Recall that the purpose of an IV is simply to randomize the first block of
data (so that if two pieces of text start with the same first 8 characters,
for example, their corresponding ciphertexts will look completely different,
instead of identical).  An alternative way of doing this is to use an IV of
zero and to prepend 8 random bytes to the actual text (the receiver, after
decryption, simply ignores the first 8 bytes and then starts reading the
actual text).  This method is perfectly legitimate and accomplishes the same
function as the "true" IV method (although it causes slight data expansion
-- the ciphertext is 8 bytes larger than it would be if a true IV was used).

In any case, all I'm suggesting is that it is possible -- within a
particular, known environment -- to omit even things like IV in the
EncryptedValue structure without compromising security.  In general,
however, the symmAlg field can be expected to be present because, as you
note, the AlgId passes important information.

Carlisle.