Re: [secdir] [jose] Secdir review of draft-ietf-jose-json-web-signature-31

John Bradley <ve7jtb@ve7jtb.com> Sat, 20 September 2014 02:17 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7F941A891D for <secdir@ietfa.amsl.com>; Fri, 19 Sep 2014 19:17:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TgtT4Mn8d_U2 for <secdir@ietfa.amsl.com>; Fri, 19 Sep 2014 19:17:26 -0700 (PDT)
Received: from mail-we0-f176.google.com (mail-we0-f176.google.com [74.125.82.176]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BF9B1A8918 for <secdir@ietf.org>; Fri, 19 Sep 2014 19:17:25 -0700 (PDT)
Received: by mail-we0-f176.google.com with SMTP id x48so539933wes.21 for <secdir@ietf.org>; Fri, 19 Sep 2014 19:17:24 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=LxQxAVP0m9HMgKs77Q+eFmk8UOv8au7rekWPRI68CBE=; b=fQNiaEWPzG9ElHnbkolS8QEfG1lvNM4uNWIvpiGiIaQMqYcwNZ7OA6IQPRu2EDZ+SC XSQM2KEqMbynw8BuvC7rDnN61x+fd4TthacmqKzPDStj4MtSSIfyxWu3cBkkiuyzo+HW k7Vyc8FE+HYDjmlngBh3mMJZ4iiCNp3Slu1640GhWHsEAorr//Afq3wrYDIfr3VSMdSG eVJugMdFJs5vjyn+54pO3cxIw6beukRhw+xAfiEsWHKjSTwwNvGlsPx0gRUpyJOFVDBn WjLaucaFC8osSq+s4gRaH2l0Z+zzGjc/W49lpsul7g/346RylVzexTonehDSS+ktR/i4 WIog==
X-Gm-Message-State: ALoCoQl8EFCqfUYnOCOAgNS7VyCJbtpQaxMYDKcl4KMU8nG4uNb6hymDem+xNc7rwd928wf3hBeq
X-Received: by 10.180.182.67 with SMTP id ec3mr632536wic.12.1411179444506; Fri, 19 Sep 2014 19:17:24 -0700 (PDT)
Received: from [10.6.0.146] ([95.211.146.166]) by mx.google.com with ESMTPSA id gj3sm3861943wib.15.2014.09.19.19.17.16 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 19 Sep 2014 19:17:23 -0700 (PDT)
Content-Type: multipart/signed; boundary="Apple-Mail=_FCEAC809-B68D-4C9D-9E0B-92138C502043"; protocol="application/pkcs7-signature"; micalg=sha1
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <03a601cfd460$f8d71d70$ea855850$@augustcellars.com>
Date: Fri, 19 Sep 2014 22:17:05 -0400
Message-Id: <C9BA46F1-5F30-47C7-A90A-689C5DA084F6@ve7jtb.com>
References: <21512.21725.209461.976375@fireball.kivinen.iki.fi> <4E1F6AAD24975D4BA5B16804296739439AE9DD47@TK5EX14MBXC292.redmond.corp.microsoft.com> <CAL02cgSsi603XL2o4S89pAw64yLv0JRZaDg823uiyuTkm02AHA@mail.gmail.com> <21527.63989.999440.801542@fireball.kivinen.iki.fi> <CAL02cgQKfQr_dQ=0-oY19G4rmYL3928UWFLBfhDAyspwMU7W9g@mail.gmail.com> <21529.16232.880915.215045@fireball.kivinen.iki.fi> <CAL02cgSRmP+iRYqTPUdcgTipeDw1H8TdF3AMP-ORSqOwiWJEcQ@mail.gmail.com> <4E1F6AAD24975D4BA5B16804296739439BA59EB7@TK5EX14MBXC286.redmond.corp.microsoft.com> <CAL02cgRTmsVTkwwDMbHtcqHzCs6GkOz-uZ_SOKNeR3hxJZMdDw@mail.gmail.com> <03a601cfd460$f8d71d70$ea855850$@augustcellars.com>
To: Jim Schaad <ietf@augustcellars.com>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/-MgbCdvVqK7sxXIjMvo4E32MveQ
Cc: ietf@ietf.org, secdir@ietf.org, Michael Jones <Michael.Jones@microsoft.com>, IESG <iesg@ietf.org>, jose@ietf.org, draft-ietf-jose-json-web-signature.all@tools.ietf.org
Subject: Re: [secdir] [jose] Secdir review of draft-ietf-jose-json-web-signature-31
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 20 Sep 2014 02:17:30 -0000

For HMAC changing the  hash from SHA3 256 to SHA2 256 doesn't really get the attacker much as they still don't know the key to be able to create a appropriate fake plaintext.
So simply knowing a value that creates a collision is not sufficient for an attack.

I interpreted Mike's comment on PKCS#1 as being that the signature needs to be verified by the algorithm specified in the "alg" parameter.  That is not to say that if in the case of PKCS#1 padding if the OID is not consistent with the value of "alg" that wouldn't be an error.   I think that would be a invalid JWS.     I do think that should be made clear.  

With PSS if the key is the same length it is true that you are going to be vulnerable to collisions over the plaintext based on the weakest hash you can get the receiver to accept.  
This is not a issue unique to JOSE in any way.   One would be tempted to rule out SHA1 now but it is differentiated by it's key length, so can't be downgraded to from SHA2.

John B.


On Sep 19, 2014, at 7:25 PM, Jim Schaad <ietf@augustcellars.com> wrote:

>  
>  
> From: Richard Barnes [mailto:rlb@ipv.sx] 
> Sent: Friday, September 19, 2014 2:32 PM
> To: Mike Jones
> Cc: Tero Kivinen; iesg@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-jose-json-web-signature.all@tools.ietf.org;jose@ietf.org
> Subject: Re: Secdir review of draft-ietf-jose-json-web-signature-31
>  
> """
> # Signature Algorithm Protection
> 
> In some usages of JWS, there is a risk of algorithm substitution attacks, in which an attacker can use an existing signature value with a different signature algorithm to make it appear that a signer has signed something that he actually has not.  These attacks have been discussed in detail in the context of CMS {{RFC 6211}}.  The risk arises when all of the following are true:
> 
> * Verifiers of a signature support multiple algorithms of different strengths
> * Given an existing signature, an attacker can find another payload that produces the same signature value with a weaker algorithm
> * In particular, the payload crafted by the attacker is valid in a given application-layer context
> 
> For example, suppose a verifier is willing to accept both "PS1" and "PS256" as "alg" values, and a signer creates a signature using "PS256".  If the attacker can craft a payload that has the same SHA-1 digest has as the SHA-256 digest of the legitimate payload, then the "PS1" signature over the bogus payload will be the same as the "PS256" signature over the legitimate payload.
>  
> There are several ways for an application using JOSE to mitigate algorithm substitution attacks:
> 
> * Don't accept signatures using vulnerable algorithms: Algorithm substitution attacks do not arise for all signature algorithms.  
>   * Signatures using RSA PKCS#1 v1.5 ("RS1", "RS256", etc.) are not subject to substitution attacks because the signature value itself encodes the hash function used.  
>   * Signatures with HMAC algorithms ("HS1", "HS256", etc.) cannot be substituted because the signature values have different lengths  Likewise for signatures with ECDSA algorithms ("ES256", "ES384", etc.).
>  
> [JLS] This is not a true statement.  If you support both SHA256 and SHA512/256 then the signature values have the same length.  This will also be an issue if you support both the SHA2 and the SHA3 algorithm sets as they have results of the same length.
>  
>   * The only algorithms defined in JWA {{I-D.ietf-jose-json-web-algorithms}} that is vulnerable to algorithm substitution attacks is RSA-PSS ("PS1", "PS256", etc.).  An implementation that does not support RSA-PSS is not vulnerable to algorithm substitution attacks.
>  
> [JLS] ECDSA is open to this attack if you support both SHA256 and SHA512/256 the hash lengths are the same.  This will also be an issue if you support both the SHA2 and the SHA3 algorithm sets as they have results of the same length.
>  
> * Require that the "alg" parameter be carried in the protected header.  (This is the approach taken by RFC 6211.)
> 
> * Include a field reflecting the algorithm in the application payload, and require that it be matched with the "alg" parameter during verification (This is the approach taken by PKIX {{RFC5280}}.)
>  
> [JLS] RSA-PKCS#1.5 is open to this attack if the suggestion of Mike in a message prior to this is put into the text.  That is to allow for the hash inside of the signature and that outside of the signature to differ in value because you only enforce one of the two values.
>  
> Of these mitigations, the only sure solution is the first.  Signing over the "alg" parameter (directly or indirectly) only makes the attacker's work more difficult, by requiring that the bogus payload also contain bogus information about the signing algorithm.  They do not prevent attack by a sufficiently powerful attacker.
> """
>  
> On Fri, Sep 19, 2014 at 2:49 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:
> I would appreciate it if you would write a draft of the proposed security considerations text, Richard.  Perhaps title the section “Unsecured Algorithm Values”.
>  
>                                                             Thanks!
>                                                             -- Mike
>  
> From: Richard Barnes [mailto:rlb@ipv.sx] 
> Sent: Wednesday, September 17, 2014 6:24 AM
> To: Tero Kivinen
> Cc: Mike Jones; iesg@ietf.org; secdir@ietf.org; ietf@ietf.org; draft-ietf-jose-json-web-signature.all@tools.ietf.org;jose@ietf.org
> Subject: Re: Secdir review of draft-ietf-jose-json-web-signature-31
>  
> 
> 
> On Wednesday, September 17, 2014, Tero Kivinen <kivinen@iki.fi> wrote:
> Richard Barnes writes:
> >     Perhaps, but is there benefits for leaving the alg without protection?
> >
> > Simplicity (if you omit protected headers altogether), and
> > compatibility with other signed things.  In the sense that you could
> > transform one of them into a JWS without re-signing.  This would
> > apply, for example, to an X.509 certificate -- just parse the outer
> > SEQUENCE, and re-assemble into a JWS with the tbsCertificate as
> > payload.  Same security properties that X.509 already has.
> 
> Ok, having this kind of information somewhere in the draft would help
> to understand the reason. Also having text explaining that is
> possible, and that the security properties of this option (i.e. no
> problem with PKCS#1, etc... the text you had in the other email).
> 
> > It's also completely unnecessary for PKCS#1 signatures, which are
> > the dominant use case today.
> 
> I agree.
> 
> > In general, I'm opposed to protocols baking in more
> > application-specific logic than they need to.  The point of JOSE is
> > to describe the cryptographic operation that was performed, and
> > carry the relevant bits around.  Its job is not to fix all the
> > weaknesses that every algorithm has. 
> 
> Yes, but this property might have security issues, so they should be
> covered by the security considerations section.
>  
> I'm perfectly happy to have it documented in the Security Considerations. 
>  
> Mike: Should I generate some text, or do you want to take a stab?
>  
> --
> kivinen@iki.fi
>  
> _______________________________________________
> jose mailing list
> jose@ietf.org
> https://www.ietf.org/mailman/listinfo/jose