Algorithms for Cryptographic Message Syntax (CMS) Key Package Receipt and Error Content Types
Extracted elements (15)
AES in CBC mode is used as the content-encryption algorithm instead of AES Key Wrap with MLI (as used in related RFCs for key packages) because receipt and error content types are not keys; AES Key Wrap with MLI is therefore inappropriate for this content-encryption role.
Because AES Key Wrap with MLI is not used as the content-encryption algorithm, there is no requirement to align the key-wrap algorithm with the content-encryption algorithm as in sibling specifications; plain AES Key Wrap is used instead.
The algorithm requirements in this document mirror those in RFC 5959, RFC 6033, RFC 6160, RFC 6161, and RFC 6162 except for the content-encryption algorithm (AES-CBC here vs. AES Key Wrap with MLI there) and the key-wrap algorithm (AES Key Wrap here vs. AES Key Wrap with MLI there).
If an implementation supports AuthEnvelopedData, it MUST follow EnvelopedData key management recommendations, but the content-encryption algorithm MUST be AES-GCM; the 128-bit version MUST be implemented and the 256-bit version SHOULD be implemented.
If an implementation supports EncryptedData, it MUST implement AES-128 in CBC mode and SHOULD implement AES-256 in CBC mode. Key management for EncryptedData is handled by other means outside this document.
If an implementation supports EnvelopedData, it MUST implement key transport and MAY implement key agreement.
If an implementation supports RSA, RSASSA-PSS, DSA, RSAES-OAEP, or Diffie-Hellman, it MUST support key lengths from 1024-bit to 2048-bit inclusive. If it supports ECDSA or ECDH, it MUST support keys on the P-256 curve.
If an implementation supports SignedData, it MUST support RSA signature scheme and SHOULD support RSASSA-PSS and DSA. Implementations MUST support SHA-256 and SHOULD support SHA-1 in concert with these schemes.
Implementations MAY also choose to support ECDSA for SignedData, referencing RFC 5753 and RFC 6090.
Implementations MAY also support AES-CCM for AuthEnvelopedData.
Regardless of key management technique, implementations MUST support AES-128 in CBC mode as the content-encryption algorithm and SHOULD support AES-256 in CBC mode.
When key agreement is used in EnvelopedData, DH ephemeral-static MUST be supported; ECDH MAY be supported.
When key agreement is used, the key-wrap algorithm MUST use the same key length as the content-encryption algorithm: AES-128 Key Wrap for AES-128-CBC content encryption, AES-256 Key Wrap for AES-256-CBC.
When key transport is used in EnvelopedData, RSA encryption MUST be supported and RSAES-OAEP SHOULD be supported.
Security considerations from RFC 3370, RFC 3394, RFC 3560, RFC 4056, RFC 5084, RFC 5652, RFC 5753, and RFC 5754 all apply. SP800-57 guidance on comparable bits of security and appropriate time frames for algorithm/key-size choices is noted as applicable.