Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

On Nov 16, 2016 8:56 AM, "Derek Atkins" <derek@ihtfp.com> wrote:
>
> Taylor,
>
> Taylor R Campbell <campbell+cfrg@mumble.net> writes:
>
> >    Date: Mon, 14 Nov 2016 11:28:56 -0500
> >    From: Derek Atkins <derek@ihtfp.com>
> >
> >    It depends which security service of signatures you're asking about.
> >    For non-repudiation, yes, collision resistance is important.  However
> >    preimage resistance is important for integrity/forging security.
> >
> > No!
>
> Yes!  (two can play at that silly game -- I've got two toddlers who LOVE
> to play that game).
>
> > A signature scheme defined in terms of H(m), such as RSASSA-PSS,
> > relies on the collision resistance of H to prevent forgery.  Preimage
> > resistance is *not* sufficient.  Failure of MD5 to be collision-
> > resistant is what enabled HTTPS certificate forgery in the wild ten
> > years ago.
>
> Ah, I see the confusion now...  We're using different definitions (and
> processes) of forgery.

Yours are nonstandard.

>
> > (Attack: Find m =/= m' such that H(m) = H(m') and m is a certificate
> > for for harmlessexample.com while m' is a certificate for google.com.
> > Submit a CSR to a CA that you predict will issue m signed.  Now you
> > have a signed certificate for google.com.)
>
> In my mind this is a different kind of "non-repudiation" attack, not a
> "forgery" attack.  In this case you're getting actual data signed, but
> you're instead claiming (successfully, due to the collision) that you
> got something else signed.  I.e., getting harmlessexample.com signed
> isn't forging.  It's a valid signature on a valid certificate.  But
> you're using a collision to effect a repudiation attack by claiming that
> no, what was signed wasn't harmlessexample.com, but google.com.
>
> It's a subtle but very important distinction (even if the end result is
> the same -- a signed certificate for google.com).

It is not actually so. This would violate EUF-CMA.

>
> [snip]
> > Can we persuade the CURDLE WG to use an H(r, m) scheme instead, such
> > as EdDSA without the prehash, and thereby dispel requirements of
> > collision resistance?
>
> Unlikely.
>
> -derek
>
> --
>        Derek Atkins                 617-623-3745
>        derek@ihtfp.com             www.ihtfp.com
>        Computer and Internet Security Consultant
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg