Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Phillip Hallam-Baker <[e-mail]>]

I was aware of that attack.

That is not a problem with the use of MD2 in a self-signed certificate.

That is a problem of having used MD2.

The problem there is that if you have a key that has been used to sign
with MD2 it is going to be permanently tainted regardless of what
place the cert is in the chain and regardless of what type of cert it
is. The attacker can 'correct' for any defect wrt cert type, validity
interval etc.


There is only one effective defense against that attack and that is to
withdraw the MD2 algorithm from service.

You don't get any additional security from adding additional stronger
algorithms to the support list. You only get additional security from
withdrawing a weak algorithm from service.


Which is why I am arguing it is time to withdraw SHA1 from service. It
is only marginally more secure than MD5.



On Wed, Mar 2, 2011 at 12:24 PM, Martin Rex <[e-mail]> wrote:
> Phillip Hallam-Baker wrote:
>>
>> The use of MD2 in a self signed cert has little risk as far as use of
>> the cert itself goes since it only serves as proof of possession which
>> is only relevant when the browser provider chooses to install it in
>> the browser.
>
> In the universe where I live, there exist collision attacks against MD2.
>  (check http://en.wikipedia.org/wiki/MD2_%28cryptography%29)
>
> So an RSA-key for which a PKCS#1 encrypted MD2 signature has been
> published is a real security problem and ought to have been discarded
> long ago.
>
> Else someone could try to use the preimage attack to issue himself
> an intermediate CA cert under such a root cert, reusing the md2-based
> signature on the RootCA cert.
>
> I would REALLY like to kill md2withRsaEncryption as a digital
> signature algorithm from our PKI implementation, like I did
> with all of md4-based digital signature algorithms.
>
>
> Getting rid of "tainted" RSA keys is also important.
>
> Why do you think that FIPS 186-3 says that you are not allowed
> to use an RSA keypair for both PKCS-v1.5 and PKCS-PSS signatures?
> Because you "taint" your RSA key on the first time that you use it
> for a weak scheme.
>
> -Martin
>



-- 
Website: http://hallambaker.com/