[jose] Re: Do you need the JWP JSON Serialization?

[Neil Madden <[e-mail]>]

On 8 Aug 2024, at 23:34, Orie Steele <[e-mail]> wrote:

On Thu, Aug 8, 2024 at 3:26 PM Neil Madden <[e-mail]> wrote:

On 8 Aug 2024, at 20:44, Orie Steele <[e-mail]> wrote:



That only applies to "SD-JWT+KB"

I don’t think so, otherwise SD-JWT would not be secure. The signature covers the claims, which includes the hashes of all the disclosures. Thus the disclosures are all protected (cannot be altered/forged) and immutable. 

In SD-JWT (without +KB) the Issuer's signature covers the claims which include hashes of the disclosures, that is true.

The order of ~ separated stuff is not secured ... because that stuff is not included in the claims.

What security property do you think is being violated here?

There could also be extra stuff that appears to be disclosures, but is actually not in the issuer SD-JWT.
See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-5.3.1" rel="nofollow">https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-5.3.1

[..]

Unless I am mistaken, there is no ordering requirement for the SD-JWT without key binding, so the disclosures are mutable, until the holder makes them immutable by applying key binding:

They are an unordered set, so this “mutability” is irrelevant. 

Exactly, they are unordered, and unsecured (they are outside of the JWT).

This is not what unsecured means. 

See https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-8.1" rel="nofollow">https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-8.1

"""
If any digest value is encountered more than once in the Issuer-signed JWT payload (directly or recursively via other Disclosures), the SD-JWT MUST be rejected.
If any Disclosure was not referenced by digest value in the Issuer-signed JWT (directly or recursively via other Disclosures), the SD-JWT MUST be rejected.
"""

This means it is possible for an adversary to cause an SD-JWT without key binding to be rejected, by dropping or adding properties... in between the issuer and the holder, before the key binding token is even possible to produce.

This is trivially possible in any signature/MAC scheme: the crypto detects modifications it doesn’t prevent them.

With apologies to Lea Kissner: cryptography is a tool for turning confidentiality and integrity threats into denial of service threats. 

The only way to know if this is the case as a holder is to perform the validation steps in 8.1 on the issuer signed SD-JWT (without KB) before considering attempting to use it.
This property is ensured by: "The Holder or the Verifier MUST perform the following (or equivalent) steps when receiving an SD-JWT..."

See: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-9.3" rel="nofollow">https://datatracker.ietf.org/doc/html/draft-ietf-oauth-selective-disclosure-jwt-10#section-9.3

"""

In case of the General JSON Serialization, there are multiple unprotected headers (one per signature). If present, disclosures and kb_jwt, MUST be included in the first unprotected header and MUST NOT be present in any following unprotected headers.
"""

In SD-JWT JSON Serialization, disclosures and kbt are transmitted in unprotected headers... You need to process them carefully as described in section 8.1, in order to be assured that they have not been tampered with.

I’m not sure what you’re arguing here. There are things you have to do to validate any signature scheme. If you don’t do them, the security properties don’t apply. (If you want to discuss more misuse-resistant APIs, we can do that). 

In SD-JWT Compact serialization, disclosures and kbt are transmitted as concatenated strings... You need to process them carefully as described in section 8.1, in order to be assured that they have not been tampered with.

The major difference between these 2 approaches is that there is no ability to include "other" unprotected material in the jwp compact serialization... this property is unique to JOSE compact serializations, because they cannot express unprotected headers.
COSE / CWP will not have this problem... assuming it follows conventions.

I think JOSE / JWP would be improved if support for unprotected headers was consistent in both compact and json.

I don’t think this follows at all from your arguments. 

— Neil