Re: Starting the ietf-smime-examples list

Paul wrote:

>Greetings. So, the next step is for people to start sending in examples of 
>keys and certs and objects. Please send these to me directly, so I can 
>encode them and tell the list what we have. 

Unclear: Do you mean the ietf-smime list? Because if so, I'd rather send
examples and so on to this list.

>I believe that this message will be followed by Andrew Farrell who has
>a question about some of the key wrapping we have in the current doc.

'sright. Firstly, I agree with Alexy Shamov's observation that the
example in the document only makes sense if the RC2 encryptions are done
at 40bit effective length, and note that the results he gets for
128-bit effective length are identical to the ones I mailed around at
Oslo (which went to Jim, and Paul, and Bob Colestock, I think).

Secondly, these are what I'd consider the relevant references in the
S/MIME RFCs: 

CMS 12.3.1:

   For key agreement of RC2 key-encryption keys, 128 bits must be
   generated as input to the key expansion process used to compute the
   RC2 effective key [RC2].

CMS 12.3.3.2:

   Only 128-bit RC2 keys may be used as key-encryption keys, and they
   must be used with the RC2ParameterVersion parameter set to 58.

CMS 12.6:

   The key-encryption key is generated by the key agreement algorithm or
   distributed out of band.  For key agreement of RC2 key-encryption
   keys, 128 bits must be generated as input to the key expansion
   process used to compute the RC2 effective key [RC2].

CMS Security Considerations:

   When using key agreement algorithms or previously distributed
   symmetric key-encryption keys, a key-encryption key is used to
   encrypt the content-encryption key.  If the key-encryption and
   content-encryption algorithms are different, the effective security
   is determined by the weaker of the two algorithms.  If, for example,
   a message content is encrypted with 168-bit Triple-DES and the
   Triple-DES content-encryption key is wrapped with a 40-bit RC2 key,
   then at most 40 bits of protection is provided.  A trivial search to
   determine the value of the 40-bit RC2 key can recover Triple-DES key,
   and then the Triple-DES key can be used to decrypt the content.
   Therefore, implementers must ensure that key-encryption algorithms
   are as strong or stronger than content-encryption algorithms.

X942 2.1.4

   RC2 effective key lengths are equal to RC2 real key lengths.

So, apart from a potentially misleading sentence in the security
considerations, I don't see any evidence that the effective length of
the RC2 KEK in 12.6.4 can be anything other that 128 bits, in a S/MIME
context.

Thirdly, I can verify Jim's Triple-DES keywrapping that Russ already
verified:)

Any thoughts?

Andrew.