Re: [Cfrg] Help with the use of contexts

[Ilari Liusvaara <[e-mail]>]

On Fri, Feb 03, 2017 at 09:16:11AM +0100, Tibor Jager wrote:
> On 30 January 2017 at 12:40, Paterson, Kenny <[e-mail]>
> wrote:
> 
> >
> > So: does anyone else want to offer an opinion on the question of contexts?
> >
> >
> Contexts are a clean and relatively simple way to prevent cross-protocol
> attacks, in particular when implemented in an as simple way as proposed
> by Adam and Dan.

Unfortunately, in practice those are anything but clean and simple.

Yes, the theoretical notion is pretty simple (where (context,message)
tuple replaces the message in standard notion of signature security).

The biggest practical problem: Backwards compatiblity, the ever-present
nemsis of security.

There are basically two major problems:

- Non-contextualized schemes, which leave the system wide open for
  any possible attacks. Hopefully nothing major.
- The standard signature API can't accomodiate contexts.

When it comes to TLS, AFAIK the most significant target for possible
cross-protocol attacks is PKIX CSR mechanism.


What I think it would take to deploy contextualization to TLS and
closely associated technologies (PKIX mainly):

- New RSA-PSS (possibly original RSA-PSS), ECDSA and EdDSA signature
  schemes (X.509 algorithms) that are contextualized.
- New RSA and ECDSA key types (X.509 key types; EdDSA can reuse keys) 
- New TLS SignatureScheme values to go with these.

One advantage of having different RSA key type would be that the old
standard one has been jinxed by the broken RSA-PKCS#1v1.5 encryption.
However, there is already standard RSA-PSS key type, which does not
have the same problem AFAIK.


-Ilari