2
$\begingroup$

I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems there is no out of the box compatibility between Android - if you want to use the HW backed keystore - and any node JWE library when it comes to the RSA key, because:

  • Android supports these ciphers for the HW backed AndroidKeyStore provider. Note, RSA-OAEP-256 (MGF1 SHA-256) is NOT supported; for some reason Android only supports MGF with SHA-1 even for OAEP-256.
  • node-jose only seems to support OAEP schemes with the same MD for OAEP and the MGF:
  • Nimbus JOSE Java library doesn't support the Android KeyStore out of the box, but I've patched it to use RSA/ECB/OAEPWithSHA-256AndMGF1Padding(SHA-1)
  • Nimbus JOSE has deprecated RSA-OAEP (SHA-1) in favor of RSA-OAEP (SHA-256)

The incompatibility is surprising to me, you'd think there would be an off-the-shelf solution for implementing JWE between Node.JS and Android. But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE deprecated it, is it discouraged to use it? Has it been proven vulnerable?

Also, in the future, I want to support the iPhone. I don't know much about iOS, but it seems Apple also has an HW protected key store ("Secure Enclave"). However, it only supports EC!

So if one wanted to build a solution where a mobile phone and a backend server uses JWE for encrypted communication, what's my best bet? My idea is that the mobile app creates a key pair in its hardware-backed Keystore, gives the public key to the backend, and the backend can then create JWEs where the public key is used to encrypt the CEK. But considering Android only supports RSA with some flavors such as RSA OAEP with SHA-256 andMGF1+SHA1, and Apple only supports EC, I guess I'd have to support both RSA and EC on the backend, and if needed patch libraries such as node-jose and node-forge to fit my needs. But perhaps I'm going around this all wrong?

Ref: node-jose issue

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1

That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one defined: MGF1. So maybe it doesn't specify it explicitly, but it really must support it to be called OAEP.

But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE deprecated it, is it discouraged to use it? Has it been proven vulnerable?

No. Best to compare MGF1 with an expanding key derivation function probably. For this kind of use SHA-1 is still secure, even though the relatively small output size doesn't help. It certainly doesn't depend on the collision resistance.

However, I've had plenty of entities asking to deprecate SHA-1 in its entirety. The problem is that it is a huge red flag for auditors, who then have to look if the use of the hash is secure. And, to be honest, many auditors wouldn't know how to qualify if it is secure or not, so they see it as an avoidable risk. Which, to be honest, it probably is.

But perhaps I'm going around this all wrong?

I don't know, it seems that Apple supports RSA for encryption if I look at the description here.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Uh, most auditors wouldn't know how to qualify if it is secure or not $\endgroup$
    – kelalaka
    Mar 17, 2020 at 21:21
  • $\begingroup$ Well, personal experience ;) Is there still SHA-1 in there? We asked to remove all SHA-1. Yes, but it is the only option in the standard, and it is secure... Similarly with code inspection machines. Definitely easier to just try and remove it anyway. $\endgroup$
    – Maarten Bodewes ♦
    Mar 17, 2020 at 21:59
  • $\begingroup$ @MaartenBodewes You're right, I was confused about the MGF. My understanding now is that JOSE only supports RSA-OAEP-SHA1(+MGF-SHA1) or RSA-OAEP-SHA256(+MGF-SHA256), and unfortunately, for some reason, the Android KeyStore only supports the former of those two plus RSA-OAEP-SHA256(+MGF-SHA1), which is an odd combination? So I have no choice but using RSA-OAEP-SHA1 (in JWE terms, alg: RSA-OAEP). $\endgroup$
    – JHH
    Mar 20, 2020 at 7:45
  • $\begingroup$ And yes, Apple supports RSA key generation and usage, but I don't believe you can store them in the HW backed key store ("Secure enclave"). $\endgroup$
    – JHH
    Mar 20, 2020 at 7:46
  • $\begingroup$ I updated the question to try to clarify my findings. $\endgroup$
    – JHH
    Mar 20, 2020 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.