Re: [jose] JWS Signing of HTTP attachments

[Ilari Liusvaara <[e-mail]>]

On Fri, May 12, 2017 at 01:59:21PM +0100, Sergey Beryozkin wrote:
> Hi All,
> 
> I've experimented in our project with having HTTP attachment parts protected
> using JWS with Detached Content and Unencoded Payload options [1].
> 
> This approach appears to be quite effective to me. It also appears to me
> that the data as shown in the example at [1], can, in principle, be produced
> and processed by any HTTP stack that can work with multiparts, assuming a
> JOSE library supporting the detached and unencoded content is also
> available.
> 
> I'd appreciate if the experts could comment on 1) do you see some weaknesses
> in the proposed approach and 2) can someone see a point in drafting some
> text around it (I can contribute if it is of interest) ?

It look from the text that the implementation can produce output before
the entiere signature (or tag in case of encryption) has been verified.
This is very dangerous if so.


Then there are the standard attacks against JOSE (the JOSE library must
not be vulernable to these):

- The JWS HMAC versus signature confusion
- The JWE ECDH-ES invalid curve attack.


-Ilari