Open issues to be addressed.
1. Why is KDF2 a mandatory to implement algorithm? The AES key wrap is the
only mandatory key wrap algorithm and that should match up with KDF3 as the
correct KDF algorithm. I would be happier if I understood more about when
KDF2 vs KDF3 should be used.
2. Is KDF3 also defined in SP800-56A? If so this citation would be useful
since it would be a free publicly available location to obtain a definition
of the algorithm.
3. Fix the reference of RFC 3280 to RFC 5280 (Note that the reference
appears to be missing from section 4)
4. ASN.1 module does not compile. Issues are:
a) line wrapping issue
-- id-kdf-kdf3 OID ::= { x9-44-components kdf3(2) } kdf3 ALGORITHM
::= { OID id-kdf-kdf2 PARMS KDF3-HashFunction } KDF3-HashFunction
::= AlgorithmIdentifier {{ KDF3-HashFunctions }}
b) missing definition KEMAlgorithms
5. Given that you are using aes128 wrap in the example B.4, you should use
id-kdf-kdf3 in the example.
-----Original Message-----
From: owner-ietf-smime(_at_)mail(_dot_)imc(_dot_)org [mailto:owner-ietf-
smime(_at_)mail(_dot_)imc(_dot_)org] On Behalf Of Sean Turner
Sent: Wednesday, July 08, 2009 9:34 PM
To: ietf-smime(_at_)imc(_dot_)org
Subject: 2nd Last Call: draft-ietf-smime-cms-rsa-kem
This message initiates the 2nd SMIME Working Group Last Call on the
document:
Title : Use of the RSA-KEM Key Transport Algorithm in CMS
Author(s) : J. Brainard, S. Turner, J. Randall, B. Kaliski
Filename : draft-ietf-smime-cms-rsa-kem-07.txt
Pages : 28
Date : 2009-7-7
The rationale for the 2nd last call is that a number of changes were
made to the ID to address SECDIR review comments. A summary of the
draft follows:
The RSA-KEM Key Transport Algorithm is a one-pass (store-and-forward)
mechanism for transporting keying data to a recipient using the
recipient's RSA public key. This document specifies the conventions for
using the RSA-KEM Key Transport Algorithm with the Cryptographic
Message
Syntax (CMS). The ASN.1 syntax is aligned with ANS X9.44 and ISO/IEC
18033-2.
A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-smime-cms-rsa-kem-07.txt
The purpose of this WG Last Call is to ensure that the Working Group
has
achieved consensus that the document is suitable for publication as a
Standards Track RFC.
Please review the document for both technical and editorial problems.
Technical issues should be discussed on this list. Editorial issues may
be sent to the document editor.
The Last Call period will end on 24 July 2009.
Upon completion of the last call, the WG chairs will take action based
upon the consensus of the WG. Possible actions include:
1) recommending to the IETF Security Area Directors
that the document, after possible editorial or
other minor changes, be considered by the IESG
for publication as an Informational RFC
(which generally involves an IETF-wide Last Call); or
2) requiring that outstanding issues be adequately
addressed prior to further action (including,
possibly, another WG Last Call).
Remember that it is our responsibility as Working Group members to
ensure the quality of our documents and of the Internet Standards
process. So, please read and comment!
spt