IETF Logo Mail Archive

Re: [Cbor] Deterministic CBOR as a possible DISPATCH item

Carsten Bormann <cabo@tzi.org> Mon, 06 March 2023 20:45 UTC

Return-Path: <cabo@tzi.org>
X-Original-To: cbor@ietfa.amsl.com
Delivered-To: cbor@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDCA7C1526E9 for <cbor@ietfa.amsl.com>; Mon, 6 Mar 2023 12:45:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.899
X-Spam-Level:
X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkf0f3MaAOCj for <cbor@ietfa.amsl.com>; Mon, 6 Mar 2023 12:45:44 -0800 (PST)
Received: from smtp.uni-bremen.de (gabriel-smtp.zfn.uni-bremen.de [134.102.50.15]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B3CAC15257C for <cbor@ietf.org>; Mon, 6 Mar 2023 12:45:43 -0800 (PST)
Received: from [192.168.217.124] (p548dc9a4.dip0.t-ipconnect.de [84.141.201.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.uni-bremen.de (Postfix) with ESMTPSA id 4PVrFJ05SnzDCbQ; Mon, 6 Mar 2023 21:45:39 +0100 (CET)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <F16409C6-81FF-4C99-A465-0BE1C07AD603@island-resort.com>
Date: Mon, 06 Mar 2023 21:45:39 +0100
Cc: Wolf McNally <wolf@wolfmcnally.com>, Anders Rundgren <anders.rundgren.net@gmail.com>, cbor@ietf.org, Christopher Allen <ChristopherA@lifewithalacrity.com>
X-Mao-Original-Outgoing-Id: 699828339.551677-4c333ebb1214ee4865f27fbff7bee068
Content-Transfer-Encoding: quoted-printable
Message-Id: <EDA4AD3D-F354-4A34-A403-9E71E91106E8@tzi.org>
References: <A9CF043D-4FA9-48D4-B953-3BE7AA40D1E0@tzi.org> <D25A0C94-ADAD-4C3D-8669-AA7FE9A6B3C4@wolfmcnally.com> <FA0E2D22-37F4-4C27-B5F5-E841D13EF0CF@tzi.org> <1DA00A88-64DF-48FD-B03E-10B520934DD2@island-resort.com> <3D57170C-61E4-4192-8B5F-120134ADA964@tzi.org> <F16409C6-81FF-4C99-A465-0BE1C07AD603@island-resort.com>
To: Laurence Lundblade <lgl@island-resort.com>
X-Mailer: Apple Mail (2.3608.120.23.2.7)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cbor/pYoHDwRwJYhH-KziDZe2VE7oQGg>
Subject: Re: [Cbor] Deterministic CBOR as a possible DISPATCH item
X-BeenThere: cbor@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Concise Binary Object Representation \(CBOR\)" <cbor.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cbor>, <mailto:cbor-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cbor/>
List-Post: <mailto:cbor@ietf.org>
List-Help: <mailto:cbor-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cbor>, <mailto:cbor-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Mar 2023 20:45:45 -0000

On 2023-03-06, at 19:22, Laurence Lundblade <lgl@island-resort.com> wrote:
> 
> Here’s a simple protocol to show that deterministic CBOR serialization is not required for signing.

A significant design decision of COSE was not to require onerous forms of deterministic CBOR to compute the signing input — for the subset of CBOR used for that, preferred encoding is sufficient.  Note that for this subset, preferred encoding *is* deterministic encoding.

Of course, you can compute the signing input using some other form, but why would you?  Preferred encoding is already available to you and its use reduces the attack surface.

Of course, if the signing input is generated (e.g., from data at rest) in a more complicated way than COSE does, full deterministic encoding can be useful.

Grüße, Carsten

v2.37.1 | Report a Bug | By Email | System Status