Re: [COSE] Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

[Jim Schaad <[e-mail]>]

Not quite.  A bad actor can get you to download something that does not match what you are after, but only after you have validated the original message.  Nothing stops a bad actor from trying to trigger you to start with a new base message.

Jim

-----Original Message-----
From: Barry Leiba <[e-mail]> 
Sent: Monday, June 1, 2020 1:15 PM
To: Jim Schaad <[e-mail]>
Cc: Warren Kumari <[e-mail]>; The IESG <[e-mail]>; Ivaylo Petrov <[e-mail]>; [e-mail]; [e-mail]; [e-mail]
Subject: Re: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

Put another way, I think that Warren is asking if a bad actor can trick you into downloading something anyway, and only after to wasted the download will you find out that you shouldn't have bothered.  The answer to that is, "Sure."  The point here is that the download can be saved most of the time, during normal operation.  And the signature protects against the abnormal situations (such as someone trying to spoof an update).  Nothing is perfect, but the combination is beneficial.

Barry

On Mon, Jun 1, 2020 at 3:53 PM Jim Schaad <[e-mail]> wrote:
>
>
>
> -----Original Message-----
> From: Warren Kumari via Datatracker <[e-mail]>
> Sent: Monday, June 1, 2020 6:26 AM
> To: The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail]; 
> [e-mail]; Ivaylo Petrov <[e-mail]>; [e-mail]
> Subject: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: 
> (with COMMENT)
>
> Warren Kumari has entered the following ballot position for
> draft-ietf-cose-hash-algs-04: No Objection
>
> When responding, please keep the subject line intact and reply to all 
> email addresses included in the To and CC lines. (Feel free to cut 
> this introductory paragraph, however.)
>
>
> Please refer to 
> https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Thank you for writing this - it was an interesting read.
>
> I do have one issue, which I cannot tell if it is simply me being dumb, or if the text needs more work.
>
> “ Doing indirect signing allows for a signature to be validated without first downloading all of the  content associated with the signature.  This capability
> can be of   even greater importance in a constrained environment as not all of
>  the content signed may be needed by the device.”
>
> I’m unclear how this works —  itseems clear enough that I can verify that the signature matches the hash, but doesn’t the device need to still download and compute the hash over all of the content?
>
> Otherwise I could take a hash and signature from content A, and claim that it is for content B. Sure, if the signature **doens’t** match the hash I know not to bother downloading the content at all, but if the sig does match the hash I still need to download the content to check that the hash is for this content....
>
> Please help educate me!
>
> [JLS] I am more than willing to help educate.  You are going to be seeing some of this from the SUIT people as well.  For a firmware type update you might defined a structure that looks like:
> FirmwareBlock  = Array of (
>         Text description of block
>         Hardware target
>         Version number
>         URL to the bytes of the update
>         Hash algorithm identifier
>         Hash of the bytes of the update
>
> A message containing an array of these blocks is created, a COSE signed message is then created containing this array of blocks as the content of the message and sent to the piece of hardware.
>
> The hardware can then validate the signed message, walk the array of blocks, if the block applies download the bytes pointed to by the URL, hash the bytes downloaded and compare the hash values.  If the hash values match then the bytes can be applied to the device.  This allows a device to only download the bytes that are needed, ignoring those which have either already been applied or which are not relevant to the device.
>
> This is what I call an indirect signature, the block of data pointed to by the URL is not part of the message is implicitly signed since the hash of the data block is signed rather than the actual data.  It is interesting to note that this is the way that CMS has always worked, the hash of the message is placed in an array of attributes and that array of attributes is what is signed by the signature algorithm.
>
> Nit: “ A pointer to the value that was hashed.  this could” — 
> s/this/This/
>
> [JLS] Fixed.
>
>
>