Re: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12

Peter Gutmann <> Tue, 13 March 2018 07:01 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7EA94126DCA for <>; Tue, 13 Mar 2018 00:01:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id LFy1uvAUym3o for <>; Tue, 13 Mar 2018 00:01:45 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CC00512AF84 for <>; Tue, 13 Mar 2018 00:01:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=mail; t=1520924505; x=1552460505; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=PvrmPpVNvvfg7wfGJbnXjBTNkH7YpfjYAD1bCJxInak=; b=N3dNbfVs37E6XQSihiESCGLJjciMWy7ckOVfWSuk+Twmi59Yseudfzmp Ba/yAPJVxdvzG6aEw8P+meKRTdx7z4iZVv4W/Qt6LV/cOkaM3jT2Zbphu 3w+qle/0pK09zgOqYMPPUYlHubwY+R5tQ1DUis8g9urIPXq5oWJvirub6 /QMpK1dqRuAQ1v/c6G9zBXg3N1oRpixMLEExKToM6lkYYWJ4oqc37+5XP m/t9lmFiLaR69dhXFy222w/33Cs9hCspKNyk8UGitYKdAJpeUxseDbpFe ik66Sp0myVEVRrkirFJl29/b4Gzbwhu92wmUUVLW/k7RJLBfmYiYwFIMb g==;
X-IronPort-AV: E=Sophos;i="5.47,464,1515409200"; d="scan'208";a="3957124"
X-Ironport-Source: - Outgoing - Outgoing
Received: from (HELO ([]) by with ESMTP/TLS/AES256-SHA; 13 Mar 2018 20:01:42 +1300
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 13 Mar 2018 20:01:41 +1300
Received: from ([]) by ([]) with mapi id 15.00.1263.000; Tue, 13 Mar 2018 20:01:42 +1300
From: Peter Gutmann <>
To: denis bider <>, Ron Frederick <>
CC: "Salz, Rich" <>, "" <>, "Mark D. Baushke" <>
Thread-Topic: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12
Thread-Index: AQHTuWKiwRoSx0z86ka0CfIYgjsJJqPLx0qH//89swCAAQHAnP//eTiAgADfEm2AACHSAIAAOeIAgAEEGG4=
Date: Tue, 13 Mar 2018 07:01:41 +0000
Message-ID: <>
References: <> <> <> <> <> <> <>, <>
In-Reply-To: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Curdle] Confirming a change to draft-ietf-curdle-rsa-sha2-12
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "List for discussion of potential new security area wg." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 13 Mar 2018 07:01:48 -0000

denis bider <> writes:

>What I cannot say is how many implementations might ACCEPT a signed encoding
>if it is sent. If they do, I have no idea how many extra zeros such
>implementations might accept. It might be that there exist implementations
>(perhaps including ours!) that will accept an arbitrary number of leading

My read-integer code accepts leading zeroes and strips them, based on
implementations that assume e.g. a 1024-bit RSA key always produces 128 bytes
of output and memcpy() the result into a zero-filled 128-byte field.  I've
seen stuff like this in the past, in PGP code I think (the read-integer code
is shared across a range of different crypto protocols).

I also reject anything that's supposed to be signed where the sign bit is set:

	/* If we're reading a signed integer then the sign bit can't be set 
	   since this would produce a negative value.  This differs from the 
	   ASN.1 code, where the incorrect setting of the sign bit is so common 
	   that we always treat integers as unsigned */