Re: [Cfrg] comments on AES Key Wrap with Pad

["Dan Harkins" <dharkins at lounge.org>]

  Hi Russ,

  This looks good. I suggest s/should not be tempted to/MUST NOT/
in the warning but it's probably fine as is.

  Thanks for addressing my comments,

  Dan.

On Mon, April 6, 2009 11:04 am, Russ Housley wrote:
> Dan & Dave:
>
> You have suggested things that should be added to the security
> considerations.  I'd prefer to back up a few hundred feet and see if
> some more general statements would be satisfactory.
>
> Key Criteria:  I'd rather use the guidance that already appears in
> NIST description for the AES Key Wrap.  That is:
>
>     The KEK must be at least as good as the keying material it is
> protecting.
>
> AEAD: I'd rather explain why an algorithm dedicated to key wrapping
> is desirable.  That is:
>
>     In the design of some high assurance cryptographic modules, it is
>     desirable to segregate cryptographic keying material from other data.
>     The use of a specific cryptographic mechanism solely for the
>     protection of cryptographic keying material can assist in this goal.
>     The AES Key Wrap and the AES Key Wrap with Pad are such mechanisms.
>     System designers should not be tempted to use these algorithms to
>     encrypt anything other than cryptographic keying material.
>
> Russ
>
>