Fwd: FIPS 140-2 Inquiry Regarding XML Encryption

resend to public xml security working group list.

>From your comment Jeff it looks like it is good that we now allow various MGSF variants.

The original MGF variant whose URL you note uses SHA1. Do you have any specific comment on the concerns related to FIPS?

THanks

regards, Frederick

Frederick Hirsch
Nokia



Begin forwarded message:

Resent-From: <public-xmlsec-comments@w3.org<mailto:public-xmlsec-comments@w3.org>>
From: "ext Krug, Jeff" <Jeff.Krug@gtri.gatech.edu<mailto:Jeff.Krug@gtri.gatech.edu>>
Date: December 2, 2011 12:49:52 AM EST
To: "public-xmlsec-comments@w3.org<mailto:public-xmlsec-comments@w3.org>" <public-xmlsec-comments@w3.org<mailto:public-xmlsec-comments@w3.org>>
Subject: FIPS 140-2 Inquiry Regarding XML Encryption

GTRI is trying to ascertain authoritatively whether the use of RSA-OAEP for key transport within XML encryption is considered FIPS 140-2 compliant. FIPS PUB 140-2 Annex D specifies that the key transport algorithms from NIST SP 800-56B are acceptable key establishment techniques. NIST SP 800-56B specifies RSA-OAEP is acceptable.  What seems to confuse the issue is that Annex A limits what is acceptable from from RSA's PKCS v2.1 standard.  Additionally there is a great deal of FIPS documentation pushing for the use of SHA2 or better (although it's not clear if that push impacts key transport the same way it impacts digital signatures).  These variations are making it hard to determine if the key transport mechanism (http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p) described in section 5.4.2 ofhttp://www.w3.org/TR/xmlenc-core/ would be considered FIPS compliant.

I noticed in the latest draft of the standard, the mask generating function may be changed from mgf1sha1 to use SHA2s, but I'm primarily interested in the specific implementation defined in 2002.

Thanks,
Jeff