[lamps] Re: WG Last Call: draft-ietf-lamps-pq-composite-sigs-08 (Ends 2025-10-06)

[Falko Strenzke <[e-mail]>]

Hi Russ,

Am 24.09.25 um 17:21 schrieb Russ Housley:
> Falko:
>
>> ## Strong Non-Separability for X.509 and CMS
>>
>> I claim that Strong Non-Separability (SNS) is naturally fulfilled for 
>> X.509 certificates and CRLs by a straightforward parallel combiner. 
>> This is due to the fact that both these data structures contain the 
>> signature algorithm identifier within the signed data. RFC 5280 
>> requires these signature algorithm identifiers within  the signed 
>> data to be equal to their copy outside the signed data [1]. This 
>> means that a stripping attack is naturally prevented since removing 
>> one signature requires changing the signed algorithm identifier and 
>> thus invalidates the remaining signature.
>>
>> It should be noted that the chosen construction in the draft thus, 
>> for the case of X.509 when component keys are reused as standalone 
>> keys, unnecessarily weakens the security features since an attacker 
>> can, through a stripping attack, produce new validly signed 
>> artifacts, namely by rendering the signed data as M'. This amounts to 
>> a violation of EUF-CMA under consideration of cross-algorithm attacks 
>> (composite and component algorithm). Whereas the straightforward 
>> parallel combiner doesn't allow this or any other kind of stripping 
>> attack.
>>
>> For CMS the case is different, as there is no mechanism that 
>> naturally prevents stripping attacks. Here it would be possible to 
>> achieve SNS by specifying a new Signed Attribute that contains the 
>> signature algorithm identifier and is made a mandatory Signed 
>> Attribute in a protocol.
>
> The attribute defined in Section 5 of RFC 2634 binds the certificate 
> of the signer into CMS signature.  It is not a mandatory attribute, 
> but when it is used, it should provide the protection that you seek. 
>  Of course, a simpler attribute could be defined in the future.

Thanks for the pointer. This attribute would solve the problem indeed. 
(I want to remind us all that we are talking about theoretical things 
here, since the proposed signature combiner breaks the properties that 
could be achieved with this approach.)

Falko

>
> Russ
>
>
> _______________________________________________
> Spasm mailing list [e-mail]
> To unsubscribe send an email [e-mail]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: [phone]
E-Mail: [e-mail]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>