Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C58A11E8146 for ; Tue, 3 Sep 2013 15:15:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.456 X-Spam-Level: X-Spam-Status: No, score=-3.456 tagged_above=-999 required=5 tests=[AWL=0.142, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id awohMdgpzT5e for ; Tue, 3 Sep 2013 15:15:41 -0700 (PDT) Received: from smtp3.pacifier.net (smtp3.pacifier.net [64.255.237.177]) by ietfa.amsl.com (Postfix) with ESMTP id A0D7E11E8143 for ; Tue, 3 Sep 2013 15:15:41 -0700 (PDT) Received: from Philemon (mail.augustcellars.com [50.34.17.238]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp3.pacifier.net (Postfix) with ESMTPSA id 4A04B38F2A; Tue, 3 Sep 2013 15:15:41 -0700 (PDT) From: "Jim Schaad" To: "'Richard Barnes'" , "'Mike Jones'" Date: Tue, 3 Sep 2013 15:14:31 -0700 Message-ID: <02d001cea8f2$f6e81540$e4b83fc0$@augustcellars.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_02D1_01CEA8B8.4A8BD550" X-Mailer: Microsoft Outlook 14.0 Thread-Index: Ac6o8sHOdbr6gaNmQfGCd1XXCSCpew== Content-Language: en-us Cc: jose@ietf.org Subject: [jose] Mxed Signature Algorithm TYpes X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Sep 2013 22:15:46 -0000 This is a multipart message in MIME format. ------=_NextPart_000_02D1_01CEA8B8.4A8BD550 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit A side question from this discussion that I would like to see addressed is should we state any recommendations about mixing different types of signatures algorithms in the same message. I would think that it makes sense to say that type types "none", "mac" and "asymmetric-Signature" should never be mixed in the same message because these different types of algorithms have significantly different security properties. From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of Richard Barnes Sent: Tuesday, September 03, 2013 1:33 PM To: Mike Jones Cc: jose@ietf.org Subject: Re: [jose] Text about applications and "alg":"none" This text is still far too weak, and does not reflect what I remember EKR saying (in particular, there is no MUST). It does not address the attack where an application may, in general, be willing to accept both signed and unsigned content, but each in specific contexts. Proposed text: """ JWS implementations MUST provide an interface for applications to specify a list of "alg" values that are acceptable for the validation of a given JWS object. JWS implementations MUST NOT indicate that a JWS object is valid if the "alg" value for the object is "none", unless the application has specifically indicated that the value "none" is acceptable for the particular JWS object being validated. Applications using "none" MUST indicate support on a per-object basis, in order to avoid downgrade attacks that arise if more broadly-applicable preferences are specified. """ I continue to believe that this is far too subtle, and that applications are very likely to get it wrong. It is far simpler and safer to require that a JWS implementation MUST reject an object with "alg":"none", and have another content type for unsigned content. Also, if "none" is going to remain, then it needs to be OPTIONAL. Given all the above limitations, I don't see how you could justify it being mandatory. --Richard On Tue, Sep 3, 2013 at 2:02 PM, Mike Jones wrote: I took an action item during the last call to write text along the lines suggested by ekr about applications and "alg":"none". I propose that the following text be included: It is RECOMMENDED that libraries provide applications a means of specifying the list of acceptable algorithms used in a JWS object in a way that causes inputs using algorithms outside the specified set to be rejected. In particular, it is intended for applications to use this mechanism to exclude accepting inputs using "alg":"none" in security contexts where non-integrity protected inputs are not acceptable. Feedback/proposed wording refinements welcomed. -- Mike _______________________________________________ jose mailing list jose@ietf.org https://www.ietf.org/mailman/listinfo/jose ------=_NextPart_000_02D1_01CEA8B8.4A8BD550 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

A side question from this discussion that I would like to see = addressed is should we state any recommendations about mixing different = types of signatures algorithms in the same = message.

 

I would think that it makes sense to say that type types = “none”, “mac” and = “asymmetric-Signature” should never be mixed in the same = message because these different types of algorithms have significantly = different security properties.

 

 

From:= = jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of = Richard Barnes
Sent: Tuesday, September 03, 2013 1:33 = PM
To: Mike Jones
Cc: = jose@ietf.org
Subject: Re: [jose] Text about applications and = "alg":"none"

 

This = text is still far too weak, and does not reflect what I remember EKR = saying (in particular, there is no MUST).  It does not address the = attack where an application may, in general, be willing to accept both = signed and unsigned content, but each in specific contexts. =  Proposed text:

 

"""

JWS implementations MUST provide an interface for = applications to specify a list of "alg" values that are = acceptable for the validation of a given JWS object.  JWS = implementations MUST NOT indicate that a JWS object is valid if the = "alg" value for the object is "none", unless the = application has specifically indicated that the value "none" = is acceptable for the particular JWS object being validated. =  Applications using "none" MUST indicate support on a = per-object basis, in order to avoid downgrade attacks that arise if more = broadly-applicable preferences are = specified.

"""

 

I = continue to believe that this is far too subtle, and that applications = are very likely to get it wrong.  It is far simpler and safer to = require that a JWS implementation MUST reject an object with = "alg":"none", and have another content type for = unsigned content.

 

Also, if "none" is going to remain, then it = needs to be OPTIONAL.  Given all the above limitations, I don't see = how you could justify it being mandatory.

 

--Richard

 

 

On Tue, Sep 3, 2013 at 2:02 PM, Mike Jones <Michael.Jones@microsoft.com> = wrote:

I took an = action item during the last call to write text along the lines suggested = by ekr about applications and "alg":"none".  I = propose that the following text be included:

 <= /o:p>

It is RECOMMENDED that libraries provide applications a means of = specifying the list of acceptable algorithms used in a JWS object in a = way that causes inputs using algorithms outside the specified set to be = rejected.  In particular, it is intended for applications to use = this mechanism to exclude accepting inputs using = "alg":"none" in security contexts where = non-integrity protected inputs are not acceptable.

 <= /o:p>

Feedback/pro= posed wording refinements welcomed.

 

        &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;       -- Mike

 


______________________________________= _________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose

 

------=_NextPart_000_02D1_01CEA8B8.4A8BD550--