- From: Christian Geuer-Pollmann <geuer-pollmann@nue.et-inf.uni-siegen.de>
- Date: Mon, 21 Jan 2002 17:25:17 +0100
- To: Joseph Reagle <reagle@w3.org>
- Cc: xml-encryption@w3.org
Hi Joseph,
in [1] section 4.2.10 there is stated:
"4.2.10: Password derivation: Unclear what it means, strike from
requirements."
I guess I have an idea: Currently, I'm implementing an
XML-Signature/Encryption-based KeyStore (for all the non-Java-Folks, a file
which collects encrypted Keys, Certificates etc). The keys which are used
in EncryptedData elements must be derived from user-supplied passwords.
This means that a mechanism like the one defined in PKCS12 is used to
derive a literal key from a used-supplied passphrase (or in Java lingo, to
create a byte[] key from a char[] passphrase).
Question: How could this be incorporated into XML Encryption?
Example: I want to use #kw-aes256 for wrapping an RSA private key, and the
AES 256 bit key should be derived from a user-supplied pass phrase. Do I
simply say nothing and let the application decide where to get the AES key
from?
Christian
[1] W3C XML-Encryption Minutes, Boston, MA, 01 March 2000
http://www.w3.org/Encryption/2001/Minutes/0103-Boston/minutes.html
Received on Monday, 21 January 2002 11:29:28 UTC