Mike: Like Jim, I cannot support this statement: AES GCM MUST NOT be used when using the JWE JSON Serialization for multiple recipients
All recipients ought to be performing decryption and integrity checking with the same GCM key. The manner in which they obtain that key may be different (key transport: decrypt the GCM key with the recipient's private key, key agreement: agreement of a pairwise KEK and then unwrapping the GCM key with the KEK, pre-shared KEK: unwrapping the GCM key with the already known KEK, etc). Russ On Apr 25, 2013, at 12:07 AM, Jim Schaad wrote: > Mike, > > AES GCM MUST NOT be used when using the JWE JSON Serialization for > multiple recipients, since this would result in the same > Initialization Vector and Plaintext values being used for multiple > GCM encryptions. > > I doubt your co-authors would agree with this. > I doubt the working group with agree with this. > I know that at least one co-chair does not agree with this > I can predict that the AD and IESG along with the security directorate would > crucify me if I allowed this to stand in the document.. > > Jim > > > >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] On Behalf Of >> [email protected] >> Sent: Tuesday, April 23, 2013 5:29 PM >> To: [email protected] >> Cc: [email protected] >> Subject: [jose] I-D Action: draft-ietf-jose-json-web-encryption-09.txt >> >> >> A New Internet-Draft is available from the on-line Internet-Drafts > directories. >> This draft is a work item of the Javascript Object Signing and Encryption >> Working Group of the IETF. >> >> Title : JSON Web Encryption (JWE) >> Author(s) : Michael B. Jones >> Eric Rescorla >> Joe Hildebrand >> Filename : draft-ietf-jose-json-web-encryption-09.txt >> Pages : 54 >> Date : 2013-04-23 >> >> Abstract: >> JSON Web Encryption (JWE) is a means of representing encrypted >> content using JavaScript Object Notation (JSON) data structures. >> Cryptographic algorithms and identifiers for use with this >> specification are described in the separate JSON Web Algorithms (JWA) >> specification. Related digital signature and MAC capabilities are >> described in the separate JSON Web Signature (JWS) specification. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-jose-json-web-encryption >> >> There's also a htmlized version available at: >> http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-09 >> >> A diff from the previous version is available at: >> http://www.ietf.org/rfcdiff?url2=draft-ietf-jose-json-web-encryption-09 >> >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ >> jose mailing list >> [email protected] >> https://www.ietf.org/mailman/listinfo/jose > > _______________________________________________ > jose mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/jose _______________________________________________ jose mailing list [email protected] https://www.ietf.org/mailman/listinfo/jose
