Re: [lamps] Last Call: draft-ietf-lamps-cms-hash-sig-03

Sorry for being late, but I was just re-reviewing the draft, and I noticed something odd:

You define id-alg-hss-lms-hashsig-with-sha384 (and sha512); with the comment that this specifies the use SHA-384 to hash the content.

That’s not how LMS is designed to work; currently, it uses the same hash function to hash the message as it does for all its internal hashes.  If you were to replace the initial SHA-256 hash with something larger, well, you’d need to tweak the size of the LM-OTS signature (to accomendate the larger value being signed), and so that wouldn’t be clean at all.

For that matter, iLMS doesn’t do a straight hash of the message; instead, it includes a prefix (the point of the prefix, which is randomized, is to avoid relying on the collision resistance of SHA-256).

Now, I suppose you could SHA-384 hash the message, and then turn around and do an LMS signature generate/verify on that hash (which would, with the currently defined LMS parameter sets, immediately prepend the prefix, and that SHA-256 hash it).  However, if something that nonobvious is specified, you need to call it out explicitly (and also what do you do with id-alg-hss-lms-hashsig-with-sha256; would that also do an initial SHA-256 hash?).

My suggestion would be to combine all three algorithm identifiers into a single id-alg-hssms-hashsig (and have the parameter set indicator within the LMS public key specify which hash is to be used).

And, since someone brought up XMSS, well, that’d have pretty much the same issues (and for the same reasons…)

From: Russ Housley <housley@vigilsec.com>
Sent: Thursday, January 31, 2019 11:07 AM
To: Scott Fluhrer (sfluhrer) <sfluhrer@cisco.com>
Cc: Tim Hollebeek <tim.hollebeek@digicert.com>; SPASM <spasm@ietf.org>
Subject: Re: [lamps] Last Call: draft-ietf-lamps-cms-hash-sig-03

Scott:

Thanks for the careful read.  I have made these changes in my edit buffer.

Russ

On Jan 30, 2019, at 3:04 PM, Scott Fluhrer (sfluhrer) <sfluhrer@cisco.com<mailto:sfluhrer@cisco.com>> wrote:

Just two spelling corrections…

Nit: in the first line of section 4: “for an HHS/LMS public key” should be “for an HSS/LMS public key”

Nit: in the first line of section 6.2: “on the current sate” should be “on the current state”

From: Spasm <spasm-bounces@ietf.org<mailto:spasm-bounces@ietf.org>> On Behalf Of Tim Hollebeek
Sent: Wednesday, January 30, 2019 2:25 PM
To: SPASM <spasm@ietf.org<mailto:spasm@ietf.org>>
Subject: [lamps] Last Call: draft-ietf-lamps-cms-hash-sig-03

This is the LAMPS WG Last Call for “Use of the HSS/LMS Hash-based Signature Algorithm in the Cryptographic Message Syntax (CMS)” <draft-ietf-lamps-cms-hash-sig-03>.

Please review the document and send your comments to the list by 14 February 2019.

If no concerns are raised, the document will be forwarded to the IESG with a request for publication as Proposed Standard.

-Tim

_______________________________________________
Spasm mailing list
Spasm@ietf.org<mailto:Spasm@ietf.org>
https://www.ietf.org/mailman/listinfo/spasm