Re: [lamps] WG Last call: draft-ietf-lamps-hash-of-root-key-cert-extn

[Russ Housley <[e-mail]>]

Jim:

I think I have two comments from you that have not yet been resolved.  Here is the text for the Security Considerations that I propose to address them:

   The Root CA needs to ensure that the public key in the next
   generation certificate is as strong or stronger than the key that it
   is replacing.

   The Root CA needs to employ a hash function that is resistant to
   preimage attacks [RFC4270].  A first-preimage attack against the hash
   function would allow an attacker to find another input that results
   published hash value.  For the attack to be successful, the input
   would have to be a valid SubjectPublicKeyInfo that contains the
   public key that corresponds to a private key known to the attacker.
   A second-preimage attack becomes possible once the Root CA releases
   the next generation public key, which makes the input to the hash
   function becomes available to the attacker and everyone else.  Again,
   the attacker needs to find a valid SubjectPublicKeyInfo that contains
   the public key that corresponds to a private key known to the
   attacker.

Russ