Re: [Cfrg] [jose] Question from JOSE working group

[John Bradley <[e-mail]>]

Yes sorry JOSE would not be susceptible to chosen prefix unless we allow the attacker to control the entire plaintext.
As it is now the header is controlled by the signer.

I think Richard was referring to an identical prefix attack being possible due to the header without a nonce or date stamp being relatively deterministic.

In ether event integrity protecting the header is not increasing the vulnerability.

Thanks few the correction.

Regards
John Bradley

On 2012-07-02, at 6:19 PM, Weger, B.M.M. de wrote:

> Hi John,
> 
>> Chosen-prefix attacks require the text of both messages to be the same up
>> to the point where the attacker can insert the collision function blocks.
> 
> Correction: 
> It's identical-prefix attacks that require the text of both messages to be 
> the same up to the point where the attacker can insert the collision blocks.
> That's exactly why these attacks are called "identical-prefix".
> 
> Chosen-prefix attacks allow the attacker to choose whatever he wants in
> each of the two messages up to the point where ... etc.
> 
> Chosen-prefix attacks fail if the attacker has no sufficient control over / 
> cannot sufficiently predict this part of the messages.
> 
> Grtz,
> Benne de Weger