Subject: [Spasm] Use of CMS

From: "Erik Andersen" <[email-masked]>
Date: Tue, 2 Aug 2016 12:14:04 +0200

Hi,

I am working on a new edition of X.1080.1. The current version claims to use
CMS without any details. It is also crap otherwise. It is supposed to
provide a general framework for telebiometrics protocols.

It the general model there is an exchange that sets up a session. Within the
session there may be several exchanges. The envelopedData contents type
using the keyAgreement options is used together with the signedData content
type. However, it seems a little heavy to use the key agreement method for
every exchange. 

My thinking is to use the AuthenticatedData content type together with
AES-GCM (aes256-GCM) as defined in RFC 5480 for all exchanges except for the
first one and then reuse the pairwise key-encryption key generated during
the first exchange by using the KEKRecipientInfo type specified in section
6.2.3. However, the KEKRecipientInfo data type requires a mandatory key

Identifier. I have not seen that the pairwise key-encryption key is
allocated a key identifier. (Such an key identifier is not actually needed,
as there is only one key in play. )

It seems it is a little against the spirit of CMS to do what I am
suggesting.

Kind regards,

Erik

---

From: Jim Schaad <[email-masked]>
Date: Tue, 2 Aug 2016 09:09:56 -0700

Try taking a look at 3185, this did something similar to what you are
discussing.

jim

From: Spasm [mailto:[email-masked]] On Behalf Of Erik Andersen
Sent: Tuesday, August 02, 2016 3:14 AM
To: SPASM <[email-masked]>
Subject: [Spasm] Use of CMS

Hi,

Kind regards,

Erik