RFC 9044

Using the AES-GMAC Algorithm with the Cryptographic Message Syntax (CMS)

📅 published June 2021, from ietf

RFC 9044: Using the AES-GMAC Algorithm with the Cryptographic Message Syntax (CMS) 🎀

okay bestie, this is RFC 9044 🦋 It's written by R. Housley from Vigil Security, and it's an Internet Standards Track document, so it's official and actually used. It was published in June 2021 and has the ISSN 2070-1721. It comes from the IETF (Internet Engineering Task Force), the crew that keeps the internet's protocols organized 💅 The header has no "Obsoletes" or "Updates" line, so it doesn't replace or change any other RFC. Main character, no side quests 🌸

Abstract 💖

This doc explains how to use the AES-GMAC Message Authentication Code algorithm with the Cryptographic Message Syntax (CMS) from RFC 5652. It's all about the conventions, aka the rules of the road ✨

Status of This Memo 📜

This is an Internet Standards Track document 🔥

It's a product of the IETF, and it reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841. 🫶

For the latest status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc9044. 💅

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at https://trustee.ietf.org/license-info, as they were in effect when this was published. Please actually read those, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes. ⭐

Table of Contents 🧚

   1.  Introduction
   2.  Terminology
   3.  Message Authentication Code Algorithms
     3.1.  AES-GMAC
   4.  Implementation Considerations
   5.  ASN.1 Module
   6.  IANA Considerations
   7.  Security Considerations
   8.  References
     8.1.  Normative References
     8.2.  Informative References
   Acknowledgements
   Author's Address

1. Introduction ✨

Okay so this section is the setup 💖 The doc explains how to use the AES-GMAC [AES] [GCM] Message Authentication Code (MAC) algorithm with the Cryptographic Message Syntax (CMS) [RFC5652]. Basically, it's the recipe for pairing those two. 🦋

2. Terminology 📖

So here's the deal with the key words. The words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are BCP 14 [RFC2119] [RFC8174] key words. They mean what BCP 14 says, but only when they're in all capitals, exactly like this. 🎀

3. Message Authentication Code Algorithms 🌸

This section covers the conventions that CMS [RFC5652] implementations follow when they support the AES-GMAC [AES] [GCM] Message Authentication Code (MAC) algorithm. 💅

The MAC algorithm identifiers live in the AuthenticatedData macAlgorithm field. 🔥

The MAC values live in the AuthenticatedData mac field. 🦋

3.1. AES-GMAC 🌈

The AES-GMAC [AES] [GCM] Message Authentication Code (MAC) algorithm uses one of the following algorithm identifiers in the AuthenticatedData macAlgorithm field. Which one you use depends on the AES key size, which is 128 bits, 192 bits, or 256 bits: 💜

      aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
              organization(1) gov(101) csor(3) nistAlgorithm(4) 1 }

      id-aes128-GMAC OBJECT IDENTIFIER ::= { aes 9 }

      id-aes192-GMAC OBJECT IDENTIFIER ::= { aes 29 }

      id-aes256-GMAC OBJECT IDENTIFIER ::= { aes 49 }

For all three of these identifier values, the AlgorithmIdentifier parameters field MUST be present, and the parameters MUST contain GMACParameters: ✨

      GMACParameters ::= SEQUENCE {
         nonce        OCTET STRING, -- recommended size is 12 octets
         length       MACLength DEFAULT 12 }

      MACLength ::= INTEGER (12 | 13 | 14 | 15 | 16)

The GMACParameters nonce field is the GMAC initialization vector. The nonce can have any number of bits from 8 up to (2^64)-1, but it MUST be a multiple of 8 bits. Within the scope of any content-authentication key, the nonce value MUST be unique. A 12-octet nonce gets processed more efficiently, so that length for the nonce value is RECOMMENDED. 🫶

The GMACParameters length field tells you the size of the message authentication code. It MUST match the size in octets of the value in the AuthenticatedData mac field. A length of 12 octets is RECOMMENDED. 💖

4. Implementation Considerations 🛠️

An implementation of the Advanced Encryption Standard (AES) Galois/Counter Mode (GCM) authenticated encryption algorithm is specified in [GCM]. 🦋

You can use an AES-GCM implementation to compute the GMAC message authentication code. You give it the content-authentication key as the AES key, the nonce as the initialization vector, a zero-length plaintext content, and the content you want authenticated as the additional authenticated data (AAD). The result of the AES-GCM invocation is the AES-GMAC authentication code, which some implementations call the "authentication tag". In AES-GCM, the encryption step gets skipped when no input plaintext is provided, so no ciphertext is produced. It's giving efficiency 💅

The DEFAULT and RECOMMENDED values in GMACParameters were picked to line up with the parameters defined for AES-GCM in Section 3.2 of [RFC5084]. 🌸

5. ASN.1 Module 🧚

The following ASN.1 module uses the definition for MAC-ALGORITHM from [RFC5912]. This is the formal version, so take a breath 🙈

   CryptographicMessageSyntaxGMACAlgorithms
       { iso(1) member-body(2) us(840) rsadsi(113549)
         pkcs(1) pkcs-9(9) smime(16) modules(0)
         id-mod-aes-gmac-alg-2020(72) }

   DEFINITIONS IMPLICIT TAGS ::=
   BEGIN

   -- EXPORTS All

   IMPORTS
     AlgorithmIdentifier{}, MAC-ALGORITHM
     FROM AlgorithmInformation-2009 -- from [RFC5912]
         { iso(1) identified-organization(3) dod(6) internet(1)
           security(5) mechanisms(5) pkix(7) id-mod(0)
           id-mod-algorithmInformation-02(58)} ;

   -- Object Identifiers

   aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)
          organization(1) gov(101) csor(3) nistAlgorithm(4) 1 }

   id-aes128-GMAC OBJECT IDENTIFIER ::= { aes 9 }

   id-aes192-GMAC OBJECT IDENTIFIER ::= { aes 29 }

   id-aes256-GMAC OBJECT IDENTIFIER ::= { aes 49 }

   -- GMAC Parameters

   GMACParameters ::= SEQUENCE {
      nonce        OCTET STRING, -- recommended size is 12 octets
      length       MACLength DEFAULT 12 }

   MACLength ::= INTEGER (12 | 13 | 14 | 15 | 16)

   -- Algorithm Identifiers

   maca-aes128-GMAC MAC-ALGORITHM ::= {
      IDENTIFIER id-aes128-GMAC
      PARAMS TYPE GMACParameters ARE required
      IS-KEYED-MAC TRUE }

   maca-aes192-GMAC MAC-ALGORITHM ::= {
      IDENTIFIER id-aes192-GMAC
      PARAMS TYPE GMACParameters ARE required
      IS-KEYED-MAC TRUE }

   maca-aes256-GMAC MAC-ALGORITHM ::= {
      IDENTIFIER id-aes256-GMAC
      PARAMS TYPE GMACParameters ARE required
      IS-KEYED-MAC TRUE }

   END -- of CryptographicMessageSyntaxGMACAlgorithms

Next up in part 2: IANA Considerations, Security Considerations (the spicy part 🔥), References, Acknowledgements, and the Author's Address 🫶

8.1. Normative References

okay so these are the must-read-first docs, bestie 📚✨ the stuff this spec leans on to work at all

8.2. Informative References

these ones are the extra reading 🧚 not required to build the thing, but SO worth a look if you want the backstory

Acknowledgements ✨

huge thank-yous to Hans Aschauer, Hendrik Brockhaus, Quynh Dang, Roman Danyliw, Tim Hollebeek, Ben Kaduk, Mike Ounsworth, and Magnus Westerlund for their careful review and thoughtful improvements 🥹💖

Author's Address 🖋️

Russ Housley
Vigil Security, LLC
516 Dranesville Road
Herndon, VA 20170
United States of America

Email: housley@vigilsec.com

That's the whole thing, bestie! 🌈💅

📦 where this page comes from