Re: [Curdle] AD Review: draft-ietf-curdle-cms-eddsa-signatures-05.txt

-----Original Message-----
From: Curdle [mailto:curdle-bounces@ietf.org] On Behalf Of Russ Housley
Sent: Monday, May 8, 2017 10:32 AM
To: curdle <curdle@ietf.org>
Cc: Eric Rescorla <ekr@rtfm.com>
Subject: Re: [Curdle] AD Review: draft-ietf-curdle-cms-eddsa-signatures-05.txt

> TECHNICAL
> S 3.1 and 3.2.
> - Is there some reason to not prescribe exactly one form here?
>   I.e., require id-sha512 (etc.) or require it not be there?
> 
> - Also, TLS has converged on talking about an "identity" hash
>   for the PureEd forms. Was this discussed and rejected?

CMS supports signatures with and without signed attributes.  In most cases, signed attributes are present.  When signed attributes are present, the message-digest attribute MUST be one of the attributes.  Eric is suggesting that the “identity” hash could be used with Ed25519 and Ed448 when there are no attributes to hash.  Using ED25519 as an example, we get:

   IF (signed attributes are absent)
   THEN
	signedData.digestAlgorithms includes id-hashIdentity
        signedData.signerInfo.digestAlgorithm = id-hashIdentity
        signedData.signerInfo.signature = Ed25519(content)
   ELSE
	signedData.digestAlgorithms includes id-sha512
        signedData.signerInfo.digestAlgorithm = id-sha512
	signedData.signerInfo.signedAttrs includes message-digest = SHA512(content)
        signedData.signerInfo.signature = Ed25519(DER(signedData.signerInfo.signedAttrs))

Do others think the use of an algorithm identifier for the “identity” hash is better?  The current document include id-sha512 as a warning that Ed25519 uses that hash algorithm internally.

[JLS]  Creation of an identity hash function would certainly be a good way to give the hint that the entirety of the content is going to be needed or the signature algorithm.  As such it sounds like a good idea.  My worry would be about potential misuse of this as a hash function in other contexts.  For example, what happens if you used the identity hash unction when signed attributes are present?  Does this mean that you end up with two copies of the content in the resulting SignedMessage object?  Where would it get abused that might be problematic. 

On the balance however, I think this is a better idea than not having the indicator.  It is just going to need some caveats around it.  I still think I just prefer saying that you must have the attributes present, but that ship is probably never going to sail.

Jim

Russ
_______________________________________________
Curdle mailing list
Curdle@ietf.org
https://www.ietf.org/mailman/listinfo/curdle