Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

> -----Original Message-----
> From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Taylor R Campbell
> Sent: Tuesday, November 15, 2016 3:47 AM
> To: Derek Atkins <derek@ihtfp.com>
> Cc: IRTF CFRG <cfrg@irtf.org>; Russ Housley <housley@vigilsec.com>; Scott
> Fluhrer (sfluhrer) <sfluhrer@cisco.com>
> Subject: Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448
> 
>    Date: Mon, 14 Nov 2016 11:28:56 -0500
>    From: Derek Atkins <derek@ihtfp.com>
> 
>    It depends which security service of signatures you're asking about.
>    For non-repudiation, yes, collision resistance is important.  However
>    preimage resistance is important for integrity/forging security.
> 
> No!
> 
> A signature scheme defined in terms of H(m), such as RSASSA-PSS, relies on
the
> collision resistance of H to prevent forgery.  Preimage resistance is
*not*
> sufficient.  Failure of MD5 to be collision- resistant is what enabled
HTTPS
> certificate forgery in the wild ten years ago.
> 
> (Attack: Find m =/= m' such that H(m) = H(m') and m is a certificate for
for
> harmlessexample.com while m' is a certificate for google.com.
> Submit a CSR to a CA that you predict will issue m signed.  Now you have a
> signed certificate for google.com.)
> 
> A more sensible signature scheme defined in terms of H(r, m) for some
> unpredictable per-message value r, such as EdDSA, relies only on the
> *target* collision resistance of H to prevent forgery.  This is a stronger
> requirement than preimage resistance, but all the standard hash functions,
even
> MD5, are still conjectured to be target- collision-resistant.
> 
> However, the question at hand is about a scheme defined in terms of
> H(m) -- in particular, what H should we use for computing the message
digest in
> step 1 of Russ Housley's original message, message-id <7DDD1353-96FC-4E70-
> 8427-AA9C6F499232@vigilsec.com> at <https://www.ietf.org/mail-
> archive/web/cfrg/current/msg08786.html>?
> 
>    Date: Sat, 12 Nov 2016 22:55:21 -0500
>    From: Russ Housley <housley@vigilsec.com>
> 
>    The CURDLE WG is working on a document that specifies the
>    conventions for using EdDSA with CMS [RFC5652].  See
>    draft-ietf-curdle-cms-eddsa-signatures.
> 
>    The most common case involves these steps:
> 
>       1.  Compute a message digest on the content.
>       [...]
> 
> Can we persuade the CURDLE WG to use an H(r, m) scheme instead, such as
> EdDSA without the prehash, and thereby dispel requirements of collision
> resistance?

Please note that the following is how CMS works

Sign( list of attributes )
List of attributes contains a hash of the message along with other items
such as a time, which signature algorithm, which hash algorithm, potentially
which certificate(s) to use for verification.

For this exercise, we are looking what to use for the hash of message, the
sign operation is using EdDSA pure.

Jim

> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg