Re: [COSE] Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

[Jim Schaad <[e-mail]>]

-----Original Message-----
From: Warren Kumari <[e-mail]> 
Sent: Tuesday, June 2, 2020 6:52 AM
To: Barry Leiba <[e-mail]>
Cc: Jim Schaad <[e-mail]>; The IESG <[e-mail]>; Ivaylo Petrov <[e-mail]>; [e-mail]; [e-mail]; [e-mail]
Subject: Re: Warren Kumari's No Objection on draft-ietf-cose-hash-algs-04: (with COMMENT)

On Mon, Jun 1, 2020 at 4:15 PM Barry Leiba <[e-mail]> wrote:
>
> Put another way, I think that Warren is asking if a bad actor can 
> trick you into downloading something anyway, and only after to wasted 
> the download will you find out that you shouldn't have bothered.

Nah, not quite -- "Doing indirect signing allows for a signature to be validated without first downloading all of the content associated with the signature.  This capability can be of  even greater importance in a constrained environment as not all of  the content signed may be needed by the device."

Sorry, I'm still not getting it

I can see a signature over something like a manifest, listing all of the "things" (firmware blocks, files, whatever). I can download this, and validate the signature, and know that the manifest came from the e.g device manufacturer. I can then look through and find the thing (let's pretend it's a URL to a firmware update), go fetch that, hash it and then check that the "Hash of the bytes of the update" match what was in the manifest.
But, in both of these cases, I have to download the entire thing that is signed or hashed (first the manifest, and all of the bytes of the update *for my device type*).

In another example, if this were a book, if I only cared about the chapter about doughnuts, I would check the index (and signature over the index), and then go hash the chapter that the index points to, and make sure that it matches -- but, I've still had to a: check the signature on the index (which requires the entire index) and b: hash the entire doughnuts chapter (which means I need the entire doughnuts chapter). Yes, I don't need to hash the chapter on macarons or Mille feuilles, but I'm still having to download / hash the content associated with the signature...

Or, is this just saying that the index contains hashes for the individual blocks (chapters), and so I just need to download the entire index and check the signature, and then the block(s) that I care about (and that the hashes match what is in the index)?

[JLS] This is the case, all we have is an index that contains the hashes of the individual blocks.  You only need to download what you care about.  Thus you don't need to download the chapter on macarons, even though you have the pointer and hash of that data.  If you later become interested in macarons you can down load that chapter and check that it has the correct hash.

Jim

I'm really not trying to be difficult, I'm just confused...
W


> The
> answer to that is, "Sure."  The point here is that the download can be 
> saved most of the time, during normal operation.  And the signature 
> protects against the abnormal situations (such as someone trying to 
> spoof an update).  Nothing is perfect, but the combination is 
> beneficial.
>
> Barry
>
> On Mon, Jun 1, 2020 at 3:53 PM Jim Schaad <[e-mail]> wrote:
> >
> >
> >
> > -----Original Message-----
> > From: Warren Kumari via Datatracker <[e-mail]>
> > Sent: Monday, June 1, 2020 6:26 AM
> > To: The IESG <[e-mail]>
> > Cc: [e-mail]; [e-mail]; 
> > [e-mail]; Ivaylo Petrov <[e-mail]>; [e-mail]
> > Subject: Warren Kumari's No Objection on 
> > draft-ietf-cose-hash-algs-04: (with COMMENT)
> >
> > Warren Kumari has entered the following ballot position for
> > draft-ietf-cose-hash-algs-04: No Objection
> >
> > When responding, please keep the subject line intact and reply to 
> > all email addresses included in the To and CC lines. (Feel free to 
> > cut this introductory paragraph, however.)
> >
> >
> > Please refer to 
> > https://www.ietf.org/iesg/statement/discuss-criteria.html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/
> >
> >
> >
> > --------------------------------------------------------------------
> > --
> > COMMENT:
> > --------------------------------------------------------------------
> > --
> >
> > Thank you for writing this - it was an interesting read.
> >
> > I do have one issue, which I cannot tell if it is simply me being dumb, or if the text needs more work.
> >
> > “ Doing indirect signing allows for a signature to be validated without first downloading all of the  content associated with the signature.  This capability
> > can be of   even greater importance in a constrained environment as not all of
> >  the content signed may be needed by the device.”
> >
> > I’m unclear how this works —  itseems clear enough that I can verify that the signature matches the hash, but doesn’t the device need to still download and compute the hash over all of the content?
> >
> > Otherwise I could take a hash and signature from content A, and claim that it is for content B. Sure, if the signature **doens’t** match the hash I know not to bother downloading the content at all, but if the sig does match the hash I still need to download the content to check that the hash is for this content....
> >
> > Please help educate me!
> >
> > [JLS] I am more than willing to help educate.  You are going to be seeing some of this from the SUIT people as well.  For a firmware type update you might defined a structure that looks like:
> > FirmwareBlock  = Array of (
> >         Text description of block
> >         Hardware target
> >         Version number
> >         URL to the bytes of the update
> >         Hash algorithm identifier
> >         Hash of the bytes of the update
> >
> > A message containing an array of these blocks is created, a COSE signed message is then created containing this array of blocks as the content of the message and sent to the piece of hardware.
> >
> > The hardware can then validate the signed message, walk the array of blocks, if the block applies download the bytes pointed to by the URL, hash the bytes downloaded and compare the hash values.  If the hash values match then the bytes can be applied to the device.  This allows a device to only download the bytes that are needed, ignoring those which have either already been applied or which are not relevant to the device.
> >
> > This is what I call an indirect signature, the block of data pointed to by the URL is not part of the message is implicitly signed since the hash of the data block is signed rather than the actual data.  It is interesting to note that this is the way that CMS has always worked, the hash of the message is placed in an array of attributes and that array of attributes is what is signed by the signature algorithm.
> >
> > Nit: “ A pointer to the value that was hashed.  this could” — 
> > s/this/This/
> >
> > [JLS] Fixed.
> >
> >
> >



--
I don't think the execution is relevant when it was obviously a bad idea in the first place.
This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.
   ---maf