[lamps] Re: WG Last Call: draft-ietf-lamps-pq-composite-sigs-08 (Ends 2025-10-06)

[Russ Housley <[e-mail]>]

>>> ## Strong Non-Separability for X.509 and CMS
>>> 
>>> I claim that Strong Non-Separability (SNS) is naturally fulfilled for X.509 certificates and CRLs by a straightforward parallel combiner. This is due to the fact that both these data structures contain the signature algorithm identifier within the signed data. RFC 5280 requires these signature algorithm identifiers within  the signed data to be equal to their copy outside the signed data [1]. This means that a stripping attack is naturally prevented since removing one signature requires changing the signed algorithm identifier and thus invalidates the remaining signature.
>>> 
>>> It should be noted that the chosen construction in the draft thus, for the case of X.509 when component keys are reused as standalone keys, unnecessarily weakens the security features since an attacker can, through a stripping attack, produce new validly signed artifacts, namely by rendering the signed data as M'. This amounts to a violation of EUF-CMA under consideration of cross-algorithm attacks (composite and component algorithm). Whereas the straightforward parallel combiner doesn't allow this or any other kind of stripping attack.
>>> 
>>> For CMS the case is different, as there is no mechanism that naturally prevents stripping attacks. Here it would be possible to achieve SNS by specifying a new Signed Attribute that contains the signature algorithm identifier and is made a mandatory Signed Attribute in a protocol.
>> 
>> The attribute defined in Section 5 of RFC 2634 binds the certificate of the signer into CMS signature.  It is not a mandatory attribute, but when it is used, it should provide the protection that you seek.  Of course, a simpler attribute could be defined in the future.
> Thanks for the pointer. This attribute would solve the problem indeed. (I want to remind us all that we are talking about theoretical things here, since the proposed signature combiner breaks the properties that could be achieved with this approach.)
> 
A small addition to the Security Considerations seems appropriate.

Russ