[Cryptech Tech] [Cryptech-Commits] [user/sra/aes-keywrap] 01/01: Initial commit of AES Key Wrap implementation.

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Simon Josefsson wrote:
> Bernd Paysan <bernd at net2o.de> writes:
> 
>> Let's look at SIV that way.  What are the things I feel
>> uncomfortable with SIV?
>> 
>> 1. The idea of "unencrypted, but authenticated data" obviously
>> tries to lead one to believe that parts of a key bundle isn't worth
>> to encrypt.  Don't, always encrypt everything.  If you have wrap
>> your key n times for n recipients, better make each recipient try
>> to open all wrapped keys instead of giving hints who's the
>> recipient (by sorting the wrapped keys e.g. with the per-recipient
>> shared secret, you can reduce search time to O(sqrt(n)) on 
>> average).
> 
> Having unencrypted data is optional.  It is there so that it is a 
> complete AEAD cipher -- the 'AD' part in 'AEAD' is for Associated
> Data' which is unencrypted data.

I assume that there are quite a lot of metadata one would like to
associate with keys (and thus have authenticated) that basically becomes
more cumbersome if it is encrypted.

Things like creation and expiry dates, key length, name/ID of key,
associated email addresses, owner, usage (what is the key(s) for),
signatures, trust metrics and validation information.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJVWvgxAAoJEF3cfFQkIuyN2scQAK7oiluiUeN1PtlR0cSgGsFL
/ruvFszguVDGzcZfdfTJGh4f5AW04IDgGTdK6rd4v+rzTM39SJOOC00taLjLILZY
ZgDmO/kRGvtSjXyM5GvhgIc87ifEPORrzNzHahuDoyQ7/c7cll1UsiWeI3AHJ9jm
8e9DKS7aOj4j54t3eEJEBUUUooX1x3Bw6A09z6Mn38yICa0XL1synQEZwHxYgtyG
k+JGsZx+NgEuEkri3Vww9EU+41RFEH//6Z0OSYjvmeEk1Nt3ffNZitqWawXQKmhm
FvmCrxP+qvamUxdy1vMCr0u9DYVKUkdooNWyclmI6nVveTWpiX2pLTTNiWFgUWiH
8XZjtgxCLaT3YWiNTOVBv8yEGFgY1VdOuh+hZ63yVOIiVJU6yufeQYBa+/fDLTCo
9e8jECBY+lz1gMFuljKZiG/wqDFJNFqMNlW04rVeVIN1mBuPJ6hhLIWQf49h3J0e
OTtItngPT0p7PQH9nm1gYLIJ5Z541ynjEeGw9EchfKLpExXVq8tcH5/j2AwpLpWW
/QUDxm+VIA4e0Yggj8vrtBA6nOYl8Blg30HDKmAowC6bfVDZiOv7ln3Qc1PfPbdf
028VmThkjrbAprHBs/AeLvp97cXcN36j7KuKv7+Gtya3S98QXox6HwjEH630phO0
QQybcIk13lPRoqN3BWp4
=vOem
-----END PGP SIGNATURE-----