Re: [lamps] prehash PQ Sig OIDs (was Re: pre-hashing the OID in draft-ounsworth-pq-composite-sigs-10)

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Nov 27, 2023 at 3:44 PM Michael Richardson <[e-mail]>
wrote:

>
> Phillip Hallam-Baker <[e-mail]> wrote:
>     > I think we need a reset here to look at the reason prehashing is an
>     > issue.
>
> Thanks, this was a useful read.
>
> ...
>     > And that is all entirely OK and not subject to some sort of
>     > substitution attack provided that the signature is bound to some
>     > attribute saying what is being signed.
>
>     > That approach does not fit into the PKCS#7 model because it is over
> 30
>     > years old and we weren't thinking in those terms then. But we should
> be
>     > thinking about that now.
>
> I think you are saying, the fact that you can break some things that use
> PKCS#7, doesn't mean that we should never pre-hash.
>

Not quite. I am saying that in CMS, we have a chunk of data that is signed
and that is it. And that really isn't sufficient for using signatures in a
transaction system.

Alice sends Bob an email signed with her public key. Does that mean
anything beyond Alice sent the email?

If the email contains a contract offer or acceptance, a human can fairly
interpret that as being a contract or acceptance but we can't really make
use of that in an automated system.

What I am saying is that if we want to get beyond the limited applications
of the 1990s, we have to be thinking of binding semantic identifiers into
the signature. There are hooks in XML Signature and Jose that can be used
for this sort of tagging. I am not seeing that in CMS.