[Bimi] BIMI image security open questions

[Seth Blank <[e-mail]>]

These three drafts cover a myriad of security concerns:
- General threats: https://tools.ietf.org/html/draft-bkl-bimi-overview-00
- Problems with certificates/CAs:
https://tools.ietf.org/html/draft-chuang-ietf-bimi-security-perspectives-00
- Other more specific technical issues:
https://tools.ietf.org/html/draft-blank-ietf-bimi-00#section-9

Outside of these three documents and specific guidance in
https://tools.ietf.org/html/draft-blank-ietf-bimi-00#section-5.1.2 (which
itself refers to https://tools.ietf.org/html/rfc6170#section-5.2), I
believe the only top line threat that's not well documented are related to
the image payload itself. Details below from M3AAWG technical.

None of the above authors are experts on these vectors. We'd love to
discuss in more depth or be connected to people or resources who can help
educate us (preferably on this list).

Thanks, we're looking forward to your feedback and participation in the BoF!


The M3AAWG technical list has provided the following threats that are not
encapsulated in the above drafts:

1) Richard Clayton provided:

An issue where the image which is certified may not be the actual image
that is rendered unless care is taken to specify the nature of the
rendering:

https://pdfs.semanticscholar.org/e8c5/6fe612c0edd436361b1f07551c832c0f1fb8.pdf

2) Joe St. Sauver provided:

Steganography in SVG: https://github.com/japplebaum/svgsteg

Script tags in SVG: https://www.redteamsecure.com/evil-svg-project/

The script tag is mediated by the requirements of
https://tools.ietf.org/html/rfc6170#section-5.2, but is still worth calling
out explicitly.

-- 

Seth Blank | Director, Industry Initiatives

e: [e-mail] |* p: *415-273-8818

<https://www.valimail.com/>


<https://twitter.com/valimail> <https://twitter.com/valimail>
<https://www.linkedin.com/company/valimail/>
<https://www.linkedin.com/company/valimail/>
<https://www.facebook.com/ValiMail-649042791951699>
<https://www.facebook.com/Valimail-649042791951699/>

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it.  If you are not an intended and authorized
recipient you are hereby notified any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful.  Please immediately notify the sender by replying to
this email and then delete it from your system.