Re: [lamps] Martin Duke's Discuss on draft-ietf-lamps-cmp-updates-20: (with DISCUSS and COMMENT)

[Martin Duke <[e-mail]>]

Hendrik,

Thanks for clarifying that the error messages are always authenticated. I
agree that there is then no risk of downgrade, and I will clear my DISCUSS.

Although it doesn't affect anything given the above, I disagree that a V3
-> V2 downgrade would have no consequences. IIUC V3 is about introducing
crypto agility, so presumably at one point V3 will have more advanced
algorithms, and downgrading to V2 would prevent use of those. But again,
that's an academic discussion now.

Martin

On Wed, Jun 1, 2022 at 11:05 AM Brockhaus, Hendrik <
[e-mail]> wrote:

>
>
> > Von: Spasm <[e-mail]> Im Auftrag von Martin Duke via
> > Datatracker
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> > As far as I can tell, CMP provides multiple optional levels of
> encryption and
> > authentication to protect its messages and components of that message.
> > However,
> > I gather that the transport substrate is allowed to be HTTP without TLS.
> >
> > Given that, how does this protocol defend against version downgrade
> attacks? If
> > an on-path attacker responds to a client message with an error message
> > requiring an older version, do all configurations of CMP detect the
> > intervention?
>
> There are only two changes to the ASN.1 syntax that require a V3
> indication. To offer maximum backward compatibility with existing
> implementations the WG decided to go with an approach regarding version
> handling like with CMS. Therefore, we only use V3 for EnvelopedData and
> hashAlg filed in CertConf messages. The version handling is described in
> Section 2.20.
>
> As CMP V3 does not resolve weaknesses of CMP V2, I do not see the risk of
> downgrade attacks. In addition all CMP messages should be either signature-
> or MAC-protected.
>
> Hendrik
>