22570 2013-07-04 01:03:05 +0000 AES-GCM should provide distinct inputs/outputs for the tag 2014-02-20 20:54:35 +0000 1 1 1 Unclassified Web Cryptography Web Cryptography API Document unspecified PC Windows NT RESOLVED FIXED P2 normal --- 1 sleevi watsonm ap israelh watsonm oldest_to_newest 90311 0 sleevi 2013-07-04 01:03:05 +0000 Currently, AES-GCM handles the tag by appending it to the result. However, it should instead provide distinct inputs/outputs for the ciphertext and the tag, per http://lists.w3.org/Archives/Public/public-webcrypto/2013May/0060.html 90429 1 watsonm 2013-07-08 19:40:03 +0000 If this change is made it should apply to the input to unwrapKey and the output from wrapKey as well, for the case that AES-GCM is used as the wrapping algorithm. 99207 2 watsonm 2014-01-27 22:48:00 +0000 Agreed on 1/27 call that we'll follow the approach of RFC5116/PKCS#11 where the tag is appended to the ciphertext.