New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Concat or HKDF? The RFC and COSE-JAVA disagree #104

Open

cyberphone opened this issue Jun 2, 2021 · 0 comments

cyberphone commented Jun 2, 2021

This is Jim's reference code:
https://github.com/cose-wg/COSE-JAVA/blob/master/src/main/java/COSE/AlgorithmID.java#L54
https://github.com/cose-wg/COSE-JAVA/blob/master/src/main/java/COSE/Recipient.java#L258

This is the IANA registry line for the same algorithm (ECDH-ES+A256KW):
CDH-ES + A256KW -31 ECDH ES w/ Concat KDF and AES Key Wrap w/ 256-bit key

And this is the RFC:
| ECDH-ES + | -31 | HKDF - | yes | A256KW | ECDH ES w/ |
| A256KW | | SHA-256 | | | Concat KDF |
| | | | | | and AES Key |
| | | | | | Wrap w/ |
| | | | | | 256-bit key |

?

Being a developer, I tend to stick to code so I vote for HKDF as the "truth" :)

Thanx,
Anders

cyberphone mentioned this issue

Decoding attestationObject w3c/webauthn#1614

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment