Re: [lamps] WG Last call: draft-ietf-lamps-hash-of-root-key-cert-extn

[Jim Schaad <[e-mail]>]

That looks fine

> -----Original Message-----
> From: Russ Housley <[e-mail]>
> Sent: Wednesday, November 7, 2018 6:38 PM
> To: Jim Schaad <[e-mail]>
> Cc: SPASM <[e-mail]>
> Subject: Re: [lamps] WG Last call: draft-ietf-lamps-hash-of-root-key-cert-
> extn
> 
> Jim:
> 
> I think I have two comments from you that have not yet been resolved.
Here
> is the text for the Security Considerations that I propose to address
them:
> 
>    The Root CA needs to ensure that the public key in the next
>    generation certificate is as strong or stronger than the key that it
>    is replacing.
> 
>    The Root CA needs to employ a hash function that is resistant to
>    preimage attacks [RFC4270].  A first-preimage attack against the hash
>    function would allow an attacker to find another input that results
>    published hash value.  For the attack to be successful, the input
>    would have to be a valid SubjectPublicKeyInfo that contains the
>    public key that corresponds to a private key known to the attacker.
>    A second-preimage attack becomes possible once the Root CA releases
>    the next generation public key, which makes the input to the hash
>    function becomes available to the attacker and everyone else.  Again,
>    the attacker needs to find a valid SubjectPublicKeyInfo that contains
>    the public key that corresponds to a private key known to the
>    attacker.
> 
> Russ