Re: [Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)

From: Brian Campbell [mailto:bcampbell@pingidentity.com] 
Sent: Friday, July 10, 2015 3:07 PM
To: Jim Schaad
Cc: Ilari Liusvaara; cose@ietf.org
Subject: Re: [Cose] Key management for MACs (was Re: Review of draft-schaad-cose-msg-01)

And my question was about ephemeral-static DH and RSA-OAEP (both of which are used in the MAC example at https://cose-wg.github.io/cose-spec/#rfc.appendix.C.1.4) . Without the statement of origin, I don't see what value there is?

It would be static-static DH not ES DH.  Otherwise – yes it is the same as RSA

On Fri, Jul 10, 2015 at 12:21 PM, Jim Schaad <ietf@augustcellars.com <mailto:ietf@augustcellars.com> > wrote:

> -----Original Message-----
> From: Ilari Liusvaara [mailto:ilari.liusvaara@elisanet.fi <mailto:ilari.liusvaara@elisanet.fi> ]
> Sent: Friday, July 10, 2015 10:11 AM
> To: Derek Atkins
> Cc: Brian Campbell; Jim Schaad; Mike Jones; cose@ietf.org <mailto:cose@ietf.org> 
> Subject: Re: [Cose] Key management for MACs (was Re: Review of draft-
> schaad-cose-msg-01)
>
> On Fri, Jul 10, 2015 at 09:28:24AM -0400, Derek Atkins wrote:
> >
> > Performing a MAC using the output of a DH (be it ECDH, AEDH, or raw
> > DH) can still tell you that the transmission has not been modified
> > between you and the party you're talking to.  You're right that it
> > tells you nothing about the party you're talking to (i.e., without
> > authentication of the DH keys you have no idea if you're talking to a
> > MITM or the real endpoint).  However, using DH + MAC does tell you
> > that you're not being spoofed by a "passive" eavesdropper.
> >
> > So IMHO it does have some benefit.
>
> It occurs to me that any sort of asymmetric key management with MACs is
> unsafe, since knowing just public key enables message forgery.

We are going to need to have a consistent definition of message forgery for this to be a true statement.  Can one have a forgery from an anonymous person?  If you don't make a statement about who is sending the message, which may not be done in this case, then I have a problem with saying something is a forgery.

To have origination, one needs to use static-static DH.  Without this one does not have statement of origin.

>
> This does not straightforwardly extend to symmetric schems (like key
> wrapping), but are those useful with MACs?

Depends to a large extent on what you are doing for key roll over of your shared secrets.   If you don't do it very often, then as I stated in my last message it can improve security as some attacks can be easier to detect.

jim

>
>
> -Ilari

_______________________________________________
Cose mailing list
Cose@ietf.org <mailto:Cose@ietf.org> 
https://www.ietf.org/mailman/listinfo/cose