Re: [rtcweb] JSEP fingerprint hash requirements

[Martin Thomson <[e-mail]>]

On 22 October 2013 08:39, Eric Rescorla <[e-mail]> wrote:
> On Tue, Oct 22, 2013 at 5:24 AM, Harald Alvestrand <[e-mail]>
> wrote:
>> If I don't support SHA-512, and the certificate says you have to use
>> SHA-512 to verify the certificate, but I have a fingerprint using SHA-256,
>> am I exposed to some attack I'd have been protected against if I understood
>> SHA-512, or not?
>
> I'm not quite sure I follow. If the certificate isn't being third-party
> validated,
> it's irrelevant what digest was used to sign the certificate.


What EKR said.  It's all in the draft.  For 4572, aside from secondary
uses, the certificate is primarily used as a container for a public
key.  The hash forms a binding between the public key (by hashing its
container) and the actual session description.  Then, all you need is
some form of trust in the integrity of the session description.

Of course, once we go to webrtc, the integrity of the session
description is immediately suspect.  RFC 4572 provides close to zero
utility for webrtc.  Identity providers use a separate binding of the
same form to bind an identity assertion to the public key that is
independent of the integrity of the signaling channel.