W3C home > Mailing lists > Public > xml-encryption@w3.org > January 2002

Password derivation

From: Christian Geuer-Pollmann <geuer-pollmann@nue.et-inf.uni-siegen.de>
Date: Mon, 21 Jan 2002 17:25:17 +0100
To: Joseph Reagle <reagle@w3.org>
Cc: xml-encryption@w3.org
Message-ID: <2316602946.1011633917@clouseau>
Hi Joseph,

in [1] section 4.2.10 there is stated:

"4.2.10: Password derivation: Unclear what it means, strike from 
requirements."

I guess I have an idea: Currently, I'm implementing an 
XML-Signature/Encryption-based KeyStore (for all the non-Java-Folks, a file 
which collects encrypted Keys, Certificates etc). The keys which are used 
in EncryptedData elements must be derived from user-supplied passwords. 
This means that a mechanism like the one defined in PKCS12 is used to 
derive a literal key from a used-supplied passphrase (or in Java lingo, to 
create a byte[] key from a char[] passphrase).

Question: How could this be incorporated into XML Encryption?

Example: I want to use #kw-aes256 for wrapping an RSA private key, and the 
AES 256 bit key should be derived from a user-supplied pass phrase. Do I 
simply say nothing and let the application decide where to get the AES key 
from?

Christian

[1] W3C XML-Encryption Minutes, Boston, MA, 01 March 2000
    http://www.w3.org/Encryption/2001/Minutes/0103-Boston/minutes.html
Received on Monday, 21 January 2002 11:29:28 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 27 October 2009 08:42:20 GMT