Re: [COSE] 🔔 WGLC of draft-ietf-cose-webauthn-algorithms

[Neil Madden <[e-mail]>]

A couple of additional data points with regard to deterministic ECDSA (sorry Mike!):

 - While deterministic ECDSA is generally more secure, I gather that is not (yet?) a FIPS-approved nonce-generation method. So people with FIPS requirements won't be able to use it, sigh.

 - In the specific context of IoT where devices may be physically vulnerable, deterministic ECDSA and EdDSA have both been shown to be susceptible to fault attacks (see e.g. [1] and [2]). In particular, deterministic ECDSA may be *more* vulnerable to such attacks than randomized ECDSA. The linked papers offer some proposed countermeasures. For CWT usage, I believe including a fresh random "cti" claim in every signed token would reduce the effectiveness of these attacks dramatically as the signature generation will be effectively randomized while also being nonce reuse misuse-resistant.

If I was going to propose wording, perhaps something along these lines:

====
Implementations SHOULD use a deterministic algorithm to generate the ECDSA nonce, k, such as [RFC 6979]. In situations where devices are vulnerable to physical attacks, deterministic ECDSA has been shown to be susceptible to fault injection attacks [refs]. Where this is a possibility, implementations SHOULD implement appropriate countermeasures. Where there are specific certification requirements (such as FIPS approval), implementors should check whether deterministic ECDSA is an approved nonce generation method.
====

[1]: https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-faults/ <https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-faults/> 
[2]: https://eprint.iacr.org/2017/1014.pdf <https://eprint.iacr.org/2017/1014.pdf> 

--
 <http://www.forgerock.com/>	Neil Madden
Security Director  |  ForgeRock
e [e-mail] <mailto:[e-mail]>
web https://www.forgerock.com <http://www.forgerock.com/>





> On 22 Oct 2019, at 16:14, Jim Schaad <[e-mail]> wrote:
> 
> I forgot to respond to this one
>  
> From: Mike Jones <[e-mail] <mailto:[e-mail]>> 
> Sent: Monday, October 21, 2019 5:00 PM
> To: Jim Schaad <[e-mail] <mailto:[e-mail]>>; 'cose' <[e-mail] <mailto:[e-mail]>>
> Cc: [e-mail] <mailto:[e-mail]>
> Subject: RE: [COSE] 🔔 WGLC of draft-ietf-cose-webauthn-algorithms
>  
> Thanks for your review, Jim.  Responses are inline, prefixed by “Mike>”.
>  
>                                                        -- Mike
>  
> From: Jim Schaad <[e-mail] <mailto:[e-mail]>> 
> Sent: Tuesday, September 17, 2019 6:46 PM
> To: 'cose' <[e-mail] <mailto:[e-mail]>>
> Cc: [e-mail] <mailto:[e-mail]>
> Subject: RE: [COSE] 🔔 WGLC of draft-ietf-cose-webauthn-algorithms
>  
> I start this review by copying forward all of my comments on draft-jones-cose-additional-algorithms-00
>  
>  
> Please include text related to deterministic ECDSA in this text.
>  
> Mike> What do you want this text to say?  I’m reluctant to use the text at https://tools.ietf.org/html/rfc8152#section-8.1 <https://tools.ietf.org/html/rfc8152#section-8.1>, which says that “implementations SHOLUD use a deterministic algorithm”, which is misleading, in that it implies that there are many such algorithms that could be used.  In fact, exactly one is being specified.
>  
> [JLS] I was unaware that there is only one possible deterministic algorithm, any keyed hash algorithm can be used to generate the deterministic ‘k’ to be used for the signature algorithm.  There is not a requirement that the secret value be the private key for the signature key pair, one could generate a private value just for that purpose.  Independent of that, the default ECDSA algorithm specifications all say use a random value of ‘k’ rather than a deterministic value and the use of the deterministic value is far more secure.
> _______________________________________________
> COSE mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/cose <https://www.ietf.org/mailman/listinfo/cose>