Encryption Key Derivation in the Cryptographic Message Syntax (CMS) Using HKDF with SHA-256
Extracted elements (20)
Both the object identifier and the parameters of the content-encryption algorithm are fed into the KDF (not just the OID). This protects against hypothetical future attacks that manipulate only the parameters field, even though including only the OID would suffice against the known [RS2023] attack.
Only HKDF with SHA-256 is supported; there is no provision for other KDFs or hash functions. This deliberate constraint keeps the design simple and avoids negotiation; a new object identifier can be assigned later if an alternative is ever needed.
The mechanism was created to thwart an AEAD-to-CBC downgrade attack presented at IETF 118 by Roth and Strenzke, where an attacker intercepts AES-GCM/CCM authenticated-enveloped-data, converts it to AES-CBC guess blocks, and recovers plaintext by observing the victim's decryption result. Binding the content-encryption key to the algorithm identifier prevents the attack because altering the identifier causes the recipient to derive a different key.
If the id-alg-cek-hkdf-sha256 algorithm identifier is absent from the contentEncryptionAlgorithm.algorithm field, the recipient uses the original content-encryption key (CEK) for decryption, preserving backward compatibility with implementations that do not support this mitigation.
If an S/MIME client supports the key derivation mechanism, the id-alg-cek-hkdf-sha256 object identifier SHOULD be included in the SMIMECapabilities attribute to announce support.
Implementations MUST protect content-encryption keys and content-authenticated-encryption keys, including both CEK and CEK'. Compromise of CEK may disclose encrypted content; compromise of a content-authenticated-encryption key may also allow modification of authenticated content and AAD.
Implementations MUST randomly generate content-encryption keys and content-authenticated-encryption keys. Using an inadequate PRNG can result in little or no security because an attacker may reproduce the PRNG environment and search the small resulting key space.
When advertising id-alg-cek-hkdf-sha256 in SMIMECapabilities, the parameter with this encoding MUST be absent.
If the message-digest attribute is included in AuthAttributes, its value is the unencrypted one-way hash of the plaintext, enabling content tracking and candidate matching. Implementations SHOULD NOT include the message-digest attribute in AuthAttributes.
For the authenticated-enveloped-data content type, the originator derives CEK' = CMS_CEK_HKDF_SHA256(CEK, ContentEncryptionAlgorithmIdentifier) and uses CEK' for both authenticated encryption of content and authentication of AAD.
For the encrypted-data content type, the same derivation applies: id-alg-cek-hkdf-sha256 in the algorithm field, the real algorithm in parameters, and CEK' derived via CMS_CEK_HKDF_SHA256 before encrypting content.
For the enveloped-data content type, the originator places id-alg-cek-hkdf-sha256 in contentEncryptionAlgorithm.algorithm, puts the actual encryption AlgorithmIdentifier in contentEncryptionAlgorithm.parameters, derives CEK' = CMS_CEK_HKDF_SHA256(CEK, ContentEncryptionAlgorithmIdentifier), and encrypts content with CEK'.
The CMS_CEK_HKDF_SHA256 function derives OKM from IKM using HKDF-Extract with a fixed salt ('The Cryptographic Message Syntax') and HKDF-Expand with the DER-encoded AlgorithmIdentifier as the info input. The output OKM is the same size as the IKM and must not exceed 8160 octets.
The id-alg-cek-hkdf-sha256 object identifier (OID 1.2.840.113549.1.9.16.3.31) signals use of the CMS_CEK_HKDF_SHA256 key derivation. Its parameters field carries an AlgorithmIdentifier for the actual content-encryption or content-authenticated-encryption algorithm and any associated parameters.
IANA assigned OID decimal 31 (id-alg-cek-hkdf-sha256) in the 'SMI Security for S/MIME Algorithms (1.2.840.113549.1.9.16.3)' registry for the key derivation algorithm identifier defined in Section 3.
IANA assigned OID decimal 80 (id-mod-CMS-CEK-HKDF-SHA256-2023) in the 'SMI Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)' registry for the ASN.1 module defined in Appendix A.
If an attacker modifies the contentEncryptionAlgorithm.parameters field, the recipient derives a different CEK', preventing decryption but not assisting the attacker in recovering plaintext. The AlgorithmIdentifier binding thus defeats both OID-manipulation and parameter-manipulation attacks.
If an attacker removes the id-alg-cek-hkdf-sha256 OID from the contentEncryptionAlgorithm.algorithm field before delivery, the recipient will not derive CEK' and will fail to decrypt, denying access to the content but not aiding the attacker in recovering plaintext.
The info input to HKDF-Expand is the DER-encoded AlgorithmIdentifier carried as the parameter to id-alg-cek-hkdf-sha256. The encoding includes the ASN.1 SEQUENCE tag (0x30), length, and value.
The SMIMECapabilities encoding for id-alg-cek-hkdf-sha256 is the 15-byte hex sequence: 30 0d 06 0b 2a 86 48 86 f7 0d 01 09 10 03 1f. The parameter field MUST be absent in this capability advertisement.