Re: [Cfrg] pkcs#1v1.5 (was: Re: [saag] Fwd: W3C Web Crypto API - moving to Last Call)

[Watson Ladd <[e-mail]>]

On Sat, Mar 22, 2014 at 11:30 AM, Salz, Rich <[e-mail]> wrote:
>> I agree, this is important. But putting the already broken schemes in a new standard does not seem helpful in that regard.
>
> It's a  new API.  It's not a standardization of something that already exists, it's a brand new whole-cloth invention of something that did not exist before.  And yet, we're going to allow developers to create broken data.  "Does not seem helpful" is really understatement.
>
> Perhaps they can create read-only bindings for these insecure structures?
>
> Perhaps, as a gedanken experiment, I can propose a generalization of the symmetric encryption algorithm rot-13, which has a huge historical legacy via Usenet? The security considerations are pretty simple: "do not choose number of rounds (n) and shift size (s) such that n*s is zero mod 26."  That would seem to meet all the requirements of the current draft.

Let's be even clearer: there is no reason why crypto_box(pubkey,
seckey, message, nonce, assoc_data) cannot be provided in the API as a
safe combination of the primitives already existing, but the current
draft ignores what application developers actually want. By providing
subtle_crypto the authors are saying that PKCS 1.5 and AES-CBC aren't
problems, but AES-CTR is. (This is actually said in the current
draft). By failing to provide a safe alternative to roll your own,
they are asking developers who don't know anything about crypto to
play a Choose-Your-Own-Adventure novel where most paths end with
death.

This is the wrong approach to take. If the current draft is
implemented, expect thousands of of badly broken applications to be
built on top if it. It should be difficult to do the wrong thing, and
easy to do the right thing, but this API takes the opposite approach.

Sincerely,
Watson Ladd
>
>         /r$
>
> --
> Principal Security Engineer
> Akamai Technology
> Cambridge, MA
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin