pkcs11 — archive

[Michael StJohns]

On 4/3/2013 6:19 PM, Burns, Robert wrote: It would appear that NIST will allow other approved encryption modes, so GCM is a candidate. Yes. But it is listed in 2.30 without the wrapping/unwrapping flag (as is CCM). I think if we do modify the mechanism to allow wrapping, we probably should provide some guidance on IV/Nonce selection (or allow it to be done only internally?) The nice thing about the AES Keywrap algorithm is that the output is fully self-contained - you don't need to track an IV or other ancillary data separately. In general, I think we should only block inclusions of mechanisms if there are known security issues, and I wasn't able to locate any obvious research on the subject of the AEAD modes as being weaker for key wrap versus data protection. Anyone know of any prohibitions against using GCM for key wrapping? I brought this up originally. I *thought* I'd read something suggesting that this wasn't an appropriate use of AEAD mechanisms, but I can't find it now. That said, I would tend to avoid XOR style key wrap mechanisms because they are too easy to get wrong (e.g. duplicate an IV and you can compromise a lot of keys) during implementation and use. The commentary in RFC5297 section 1.3.2 is somewhat on point. Mike Bob