Re: [lamps] header-protection test vectors: should they include intermediate CA?

Russ Housley <housley@vigilsec.com> Fri, 28 May 2021 12:47 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 809D63A27A7 for <spasm@ietfa.amsl.com>; Fri, 28 May 2021 05:47:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OlFS96GfxH2T for <spasm@ietfa.amsl.com>; Fri, 28 May 2021 05:47:38 -0700 (PDT)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A1443A27A5 for <spasm@ietf.org>; Fri, 28 May 2021 05:47:38 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 08347300C21 for <spasm@ietf.org>; Fri, 28 May 2021 08:47:36 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Sy56H3kAuvuv for <spasm@ietf.org>; Fri, 28 May 2021 08:47:31 -0400 (EDT)
Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id DB702300259; Fri, 28 May 2021 08:47:30 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.20\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <87r1hrj0qt.fsf@fifthhorseman.net>
Date: Fri, 28 May 2021 08:47:30 -0400
Cc: LAMPS WG <spasm@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <97DC27F0-AE32-47F6-AC8B-6F625C313607@vigilsec.com>
References: <87r1hrj0qt.fsf@fifthhorseman.net>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
X-Mailer: Apple Mail (2.3445.104.20)
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/AqhE-5AHguPnpMuzqXUKYW8RQMI>
Subject: Re: [lamps] header-protection test vectors: should they include intermediate CA?
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 May 2021 12:47:43 -0000

I agree.  RFC 5652 says:

      certificates is a collection of certificates.  It is intended that
      the set of certificates be sufficient to contain certification
      paths from a recognized "root" or "top-level certification
      authority" to all of the signers in the signerInfos field.  There
      may be more certificates than necessary, and there may be
      certificates sufficient to contain certification paths from two or
      more independent top-level certification authorities.  There may
      also be fewer certificates than necessary, if it is expected that
      recipients have an alternate means of obtaining necessary
      certificates (e.g., from a previous set of certificates).  The
      signer's certificate MAY be included.  The use of version 1
      attribute certificates is strongly discouraged.

To me, that says that trust anchors are not carried in the message.

Russ

> On May 27, 2021, at 6:00 PM, Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:
> 
> Signed PGP part
> Hey LAMPS folks--
> 
> An open question about the test vectors for
> draft-ietf-lamps-header-protection:
> 
> The sample messages all include the signer's signing certificate and
> encryption certificate.  They do *not* include the issuing authority's
> root certificate (ca.rsa.crt) or the cross-signed cert
> (ca.rsa.cross.crt) that would allow the end-entity certificates to be
> validated by an different authority.
> 
> I don't think it makes any sense to include ca.rsa.crt in the messages
> -- if the peer doesn't know about that certificate already, then it
> won't trust it.  But ca.rsa.cross.crt is potentially useful for building
> a path to a different known, trusted root.
> 
> This is similar in some sense to the question about what CA
> certificate(s) to include in the PKCS#12 objects from
> draft-ietf-lamps-samples, but now i'm asking it about PKCS#7 CMS blobs.
> 
> In draft-ietf-lamps-header-protection-04, no intermediate certificates
> are included in the PKCS#7.
> 
> I'm considering adding ca.rsa.cross.crt to the PKCS#7 blobs for -05.
> 
> This will increase the size of the draft but not the complexity of it.
> Any objections to this proposal?  Any counterproposals?
> 
>   --dkg
> 
>